@reason-machines/cli-linux-arm64-musl 0.2.288 → 0.2.289
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/ara +1 -1
- package/bin/vm-hands/{connect-cli-603s7j9a.js → connect-cli-7dy6febe.js} +1 -1
- package/bin/vm-hands/{hands-worker-source-xvkfkf6v.js → hands-worker-source-emf3gv2b.js} +1 -1
- package/bin/vm-hands/{local-automation-4ke1jrmj.js → local-automation-9788wj0n.js} +1 -1
- package/bin/vm-hands/{local-capabilities-sc9f2pjw.js → local-capabilities-phg0kvet.js} +1 -1
- package/bin/vm-hands/{local-display-session-b2953j3d.js → local-display-session-28pkwr6v.js} +1 -1
- package/bin/vm-hands/{permissions-4rf2aknt.js → permissions-zr4qw779.js} +1 -1
- package/bin/vm-hands/{status-5qksq9mv.js → status-jvapvrq5.js} +2 -2
- package/bin/vm-hands/{version-dpdqjcta.js → version-h0hrdfe3.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-3nfhybjy.js → vm-hands-entry-lite-5rbj89cs.js} +8 -21
- package/bin/vm-hands/{vm-hands-entry-lite-ey5wf75d.js → vm-hands-entry-lite-8nmj4r5v.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-t2ee2e71.js → vm-hands-entry-lite-d9h818st.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-91tcwjpv.js → vm-hands-entry-lite-dhngjmag.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-d3fvjfh4.js → vm-hands-entry-lite-g7mf4fc7.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-fg8cwd29.js → vm-hands-entry-lite-pkwvjyy8.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-ekzch8tn.js → vm-hands-entry-lite-tjfnxx84.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-jefk3h6n.js → vm-hands-entry-lite-tqn3a245.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-00sd3eb1.js → vm-hands-entry-lite-znw0vvb2.js} +2 -2
- package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
- package/bin/vm-hands/{vm-hands-executor-qke5rfh4.js → vm-hands-executor-htdjhq9a.js} +1 -1
- package/bin/vm-hands/{vm-hands-op-runner-yd9x9ytb.js → vm-hands-op-runner-c4pc076v.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-qjpasm8p.js → vm-hands-runtime-6eb7vytb.js} +2 -2
- package/package.json +1 -1
package/bin/ara
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-
|
|
2
|
+
import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-tjfnxx84.js";import"./vm-hands-entry-lite-250sqsry.js";import"./vm-hands-entry-lite-tqn3a245.js";import"./vm-hands-entry-lite-pkwvjyy8.js";import"./vm-hands-entry-lite-5rbj89cs.js";import"./vm-hands-entry-lite-mk9p22xa.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-qdwm3ya8.js";import"./vm-hands-entry-lite-dhngjmag.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import"./vm-hands-entry-lite-d9h818st.js";import"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-znw0vvb2.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-g7mf4fc7.js";import"./vm-hands-entry-lite-8nmj4r5v.js";import"./vm-hands-entry-lite-d94sv87n.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ab as a,Bb as b,Cb as c,Db as d,Eb as e,Fb as f,Gb as g,Hb as h,Ib as i}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ab as a,Bb as b,Cb as c,Db as d,Eb as e,Fb as f,Gb as g,Hb as h,Ib as i}from"./vm-hands-entry-lite-5rbj89cs.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{e as selectCloudChildPath,a as REASON_HANDS_WORKER_VERSION,h as REASON_HANDS_WORKER_SOURCE,b as REASON_HANDS_WORKER_ENTRYPOINT,i as REASON_HANDS_WORKER_ARTIFACT_SHA256,f as REASON_HANDS_MAC_PTY_MEMBER_SOURCE,g as REASON_HANDS_LINUX_PTY_PROBE_SOURCE,d as REASON_HANDS_CLOUD_CHILD_PATH_MACOS,c as REASON_HANDS_CLOUD_CHILD_PATH_LINUX};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Cc as a,Dc as b,Ec as c,Fc as d,Gc as e,Hc as f,Ic as g,Jc as h,Kc as i,Lc as j,Mc as k,Nc as l}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Cc as a,Dc as b,Ec as c,Fc as d,Gc as e,Hc as f,Ic as g,Jc as h,Kc as i,Lc as j,Mc as k,Nc as l}from"./vm-hands-entry-lite-dhngjmag.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import"./vm-hands-entry-lite-d9h818st.js";import"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-znw0vvb2.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-g7mf4fc7.js";import"./vm-hands-entry-lite-8nmj4r5v.js";import"./vm-hands-entry-lite-d94sv87n.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-
|
|
2
|
+
import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-tqn3a245.js";import"./vm-hands-entry-lite-pkwvjyy8.js";import"./vm-hands-entry-lite-5rbj89cs.js";import"./vm-hands-entry-lite-mk9p22xa.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b}from"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-qdwm3ya8.js";import"./vm-hands-entry-lite-dhngjmag.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import"./vm-hands-entry-lite-d9h818st.js";import"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-znw0vvb2.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-g7mf4fc7.js";import"./vm-hands-entry-lite-8nmj4r5v.js";import"./vm-hands-entry-lite-d94sv87n.js";import{Jh as a}from"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};
|
package/bin/vm-hands/{local-display-session-b2953j3d.js → local-display-session-28pkwr6v.js}
RENAMED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ae as h,te as a,ue as b,ve as c,we as d,xe as e,ye as f,ze as g}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ae as h,te as a,ue as b,ve as c,we as d,xe as e,ye as f,ze as g}from"./vm-hands-entry-lite-d9h818st.js";import"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-znw0vvb2.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-g7mf4fc7.js";import"./vm-hands-entry-lite-8nmj4r5v.js";import"./vm-hands-entry-lite-d94sv87n.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{qg as a,rg as b,sg as c,tg as d,ug as e,vg as f,wg as g,xg as h,yg as i,zg as j}from"./vm-hands-entry-lite-
|
|
2
|
+
import{qg as a,rg as b,sg as c,tg as d,ug as e,vg as f,wg as g,xg as h,yg as i,zg as j}from"./vm-hands-entry-lite-znw0vvb2.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-g7mf4fc7.js";import"./vm-hands-entry-lite-8nmj4r5v.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{a as Wq,b as Bq,c as bq,d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-
|
|
2
|
+
import{a as Wq,b as Bq,c as bq,d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-tjfnxx84.js";import"./vm-hands-entry-lite-250sqsry.js";import"./vm-hands-entry-lite-tqn3a245.js";import"./vm-hands-entry-lite-pkwvjyy8.js";import"./vm-hands-entry-lite-5rbj89cs.js";import"./vm-hands-entry-lite-mk9p22xa.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-qdwm3ya8.js";import{lc as jq}from"./vm-hands-entry-lite-dhngjmag.js";import"./vm-hands-entry-lite-5zzey257.js";import{ae as G}from"./vm-hands-entry-lite-h7ndfgwc.js";import"./vm-hands-entry-lite-d9h818st.js";import{Ee as H,Fe as u,Ge as s,bf as Qq}from"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-znw0vvb2.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-cfjx91rj.js";import{Zg as l}from"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import{xh as R}from"./vm-hands-entry-lite-g7mf4fc7.js";import"./vm-hands-entry-lite-8nmj4r5v.js";import"./vm-hands-entry-lite-d94sv87n.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import{Nh as $q}from"./vm-hands-entry-lite-a3n86qqm.js";import{createHash as tq,randomBytes as sq}from"crypto";import{readFileSync as eq,realpathSync as Aq,renameSync as nq,unlinkSync as aq,writeFileSync as q3}from"fs";import{dirname as x3,join as zq}from"path";import{spawnSync as Mq}from"child_process";import{accessSync as _q,constants as wq,existsSync as L,mkdirSync as Lq,readFileSync as fq,renameSync as Sq,writeFileSync as hq}from"fs";import{homedir as Cq}from"os";import{delimiter as gq,dirname as mq,join as T}from"path";import{existsSync as Tq,readFileSync as Uq}from"fs";import{join as vq}from"path";var Eq=`---
|
|
3
3
|
name: reason
|
|
4
4
|
description: Integrate software with Reason's public REST API using a scoped API key. Use for API clients, CI, service integrations, or cloud coding-session automation.
|
|
5
5
|
---
|
|
@@ -79,7 +79,7 @@ This computer
|
|
|
79
79
|
`),b.version)x.stdout.write(`Version: ${b.version}${b.version===R?"":` (${R} is installed; \`reason connect\` restarts it on that)`}
|
|
80
80
|
`);if(x.stdout.write(`Folder: ${b.folder}
|
|
81
81
|
`),x.stdout.write(`Sessions: ${b.sessions_running===null?"":`${b.sessions_running} running, `}${b.sessions_max===1?"one at a time":`up to ${b.sessions_max} at once`}
|
|
82
|
-
`),A){let Z=A,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-
|
|
82
|
+
`),A){let Z=A,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-zr4qw779.js"),{macScreenStatus:Oq}=await import("./local-display-mac-4mtwfgty.js");return Rq(await Nq({identity:()=>Iq(),grants:Oq,worker:async()=>Z}))}))().catch(()=>null);if(V)x.stdout.write(`${V}
|
|
83
83
|
`);x.stdout.write(`Keep awake: ${A.keep_awake.enabled?"on":"off"}${A.keep_awake.holding?" (holding)":""}
|
|
84
84
|
`)}if(b.service)x.stdout.write(`Logs: ${b.service.logs}
|
|
85
85
|
`);for(let Z of b.workspaces??[]){let V=Z.state==="removed"?"removed from that workspace":Z.blocked?"offline (this computer is outside that workspace's allowed networks)":Z.device_id?Gq[Z.state]:"connecting";x.stdout.write(`Also in workspace ${Z.name??Z.organization_id}${Z.account?" (another Reason account's)":""}: ${V}
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ah as d,xh as a,yh as b,zh as c}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ah as d,xh as a,yh as b,zh as c}from"./vm-hands-entry-lite-g7mf4fc7.js";import"./vm-hands-entry-lite-8nmj4r5v.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};
|
|
@@ -1562,6 +1562,8 @@ async function handleRequestCancel(target, claim, raw) {
|
|
|
1562
1562
|
} catch { status = "unconfirmed"; }
|
|
1563
1563
|
}
|
|
1564
1564
|
}
|
|
1565
|
+
// One coded line per explicit cancel (its outcome as the reason), so a spike is visible.
|
|
1566
|
+
if (operation) diagnostic("request_cancelled", status);
|
|
1565
1567
|
if (target === socket && claim.generation === targetGeneration && claim.fenceId === targetFenceId) {
|
|
1566
1568
|
sendResult(target, { type: "cancel_ack", version: VERSION, generation: claim.generation,
|
|
1567
1569
|
id: request.id, targetId: request.targetId, status });
|
|
@@ -3892,30 +3894,15 @@ function reconnect() {
|
|
|
3892
3894
|
setTimeout(connect, retryMs);
|
|
3893
3895
|
retryMs = Math.min(1000, retryMs * 2);
|
|
3894
3896
|
}
|
|
3895
|
-
function disconnected(next
|
|
3897
|
+
function disconnected(next) {
|
|
3896
3898
|
if (stopped || next !== socket) return;
|
|
3897
3899
|
socket = null;
|
|
3898
3900
|
socketClaim = null;
|
|
3899
3901
|
failSdkCalls(next, SDK_DISCONNECTED);
|
|
3900
|
-
// A Brain socket
|
|
3901
|
-
//
|
|
3902
|
-
//
|
|
3903
|
-
//
|
|
3904
|
-
// no reason and is deliberately recoverable.
|
|
3905
|
-
const reason = closeEvent && typeof closeEvent.reason === "string"
|
|
3906
|
-
? closeEvent.reason
|
|
3907
|
-
: "";
|
|
3908
|
-
if ([
|
|
3909
|
-
"request_aborted",
|
|
3910
|
-
"request_timeout",
|
|
3911
|
-
"client_closed",
|
|
3912
|
-
"driver_stopped",
|
|
3913
|
-
"driver_handoff",
|
|
3914
|
-
"run_cancelled",
|
|
3915
|
-
"run_finished",
|
|
3916
|
-
].includes(reason)) {
|
|
3917
|
-
cancelActive(false);
|
|
3918
|
-
}
|
|
3902
|
+
// A Brain socket closing never cancels work, whatever its reason: the ledger
|
|
3903
|
+
// keeps an in-flight Bash/REPL operation so a replacement Brain can receive
|
|
3904
|
+
// the exact result, and managed jobs (dev and preview servers) must outlive
|
|
3905
|
+
// the turn. The Brain cancels a request explicitly (cancel_request).
|
|
3919
3906
|
reconnect();
|
|
3920
3907
|
}
|
|
3921
3908
|
function connect() {
|
|
@@ -3987,7 +3974,7 @@ function connect() {
|
|
|
3987
3974
|
const knownReasons = ["request_aborted", "request_timeout", "client_closed", "driver_stopped", "driver_handoff", "run_cancelled", "run_finished"];
|
|
3988
3975
|
diagnostic("close", knownReasons.includes(event.reason) ? event.reason : "other",
|
|
3989
3976
|
null, Number.isSafeInteger(event.code) ? event.code : null);
|
|
3990
|
-
disconnected(next
|
|
3977
|
+
disconnected(next);
|
|
3991
3978
|
});
|
|
3992
3979
|
}
|
|
3993
3980
|
function stop(reason) {
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
var r={name:"github-native-engineer-device-worker-production",version:"0.2.
|
|
2
|
+
var r={name:"github-native-engineer-device-worker-production",version:"0.2.289",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@anthropic-ai/sandbox-runtime":"^0.0.73","@earendil-works/pi-tui":"1.0.0","@modelcontextprotocol/sdk":"^1.29.0","@reason/runtime-distribution":"workspace:*","playwright-core":"1.60.0",zod:"^4.4.3"},overrides:{"@hono/node-server":"1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"1.20.0","basic-ftp":"6.2.1","@grpc/grpc-js":"1.14.5",browserslist:"4.28.8","engine.io":"6.6.7","fast-uri":"3.1.8",hono:"^4.13.7","ip-address":"10.7.1",nanoid:"3.3.18",dompurify:"3.4.13",postcss:"8.5.23",qs:"6.16.0","shell-quote":"1.11.0","socket.io-parser":"4.2.7",tmp:"0.2.7",toml:"4.2.0",undici:"8.10.2",ws:"^8.21.0","js-yaml":"4.3.2","@modelcontextprotocol/sdk":"1.31.0","proxy-addr":"2.0.8","source-map-js":"1.2.2"}};
|
|
3
3
|
export{r as Bh};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{ef as Z8}from"./vm-hands-entry-lite-zmf3vn3w.js";import{nf as R0}from"./vm-hands-entry-lite-mysjgrwy.js";import{ig as Kq}from"./vm-hands-entry-lite-
|
|
2
|
+
import{ef as Z8}from"./vm-hands-entry-lite-zmf3vn3w.js";import{nf as R0}from"./vm-hands-entry-lite-mysjgrwy.js";import{ig as Kq}from"./vm-hands-entry-lite-znw0vvb2.js";import{Eg as p,Hg as V0,Kg as F0,Lg as C8,Mg as eq,Og as g8,Rg as q0,Tg as x0}from"./vm-hands-entry-lite-yadv8a82.js";import{Yg as wq}from"./vm-hands-entry-lite-cfjx91rj.js";import{Zg as o,_g as C0}from"./vm-hands-entry-lite-pr65ksfz.js";import{lh as B0}from"./vm-hands-entry-lite-ngvxyjhy.js";import{Ch as A0}from"./vm-hands-entry-lite-d94sv87n.js";import{Jh as Z}from"./vm-hands-entry-lite-sn3vjjgx.js";import{execFile as V1,spawn as w0}from"child_process";import{randomBytes as F1}from"crypto";import{chmodSync as w1,existsSync as K0,lstatSync as K1,mkdirSync as M1,readFileSync as z1,rmSync as Y1,writeFileSync as Xq}from"fs";import{connect as _1}from"net";import{join as H}from"path";var Bq="./desktop-wallpaper-0pjhgyfk.jpg";var Rq="./dock-browser-afp005mt.png";var Cq="./dock-files-rywdm96b.png";var yq="./dock-terminal-s41cj1jp.png";var Sq=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
|
|
3
3
|
# The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
|
|
4
4
|
# python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
|
|
5
5
|
# Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Fd as xe}from"./vm-hands-entry-lite-5zzey257.js";import{ge as W,he as se,je as ut,ke as Ne,ne as pt,oe as xt,pe as $,ye as z,ze as Je}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Fd as xe}from"./vm-hands-entry-lite-5zzey257.js";import{ge as W,he as se,je as ut,ke as Ne,ne as pt,oe as xt,pe as $,ye as z,ze as Je}from"./vm-hands-entry-lite-d9h818st.js";import{Be as v,De as tt,Ee as D,Me as gt}from"./vm-hands-entry-lite-zmf3vn3w.js";import{gg as zt,jg as St,mg as Z,og as jt,pg as ie}from"./vm-hands-entry-lite-znw0vvb2.js";import{Og as Ae,Pg as ae}from"./vm-hands-entry-lite-yadv8a82.js";import{Xg as Se}from"./vm-hands-entry-lite-cfjx91rj.js";import{Zg as q}from"./vm-hands-entry-lite-pr65ksfz.js";import{Ch as pe,Ih as ye}from"./vm-hands-entry-lite-d94sv87n.js";import{Jh as _}from"./vm-hands-entry-lite-sn3vjjgx.js";import{spawn as I}from"child_process";import{randomUUID as Oe}from"crypto";import{closeSync as Vr,copyFileSync as de,existsSync as mt,fstatSync as Er,mkdirSync as fe,openSync as vr,readdirSync as V,readFileSync as ge,readlinkSync as to,renameSync as eo,rmSync as ro,statSync as oo}from"fs";import{connect as so}from"net";import{userInfo as Te}from"os";import{basename as le,dirname as bt,join as b}from"path";var Nt=`import { spawn, execFileSync } from "node:child_process";
|
|
3
3
|
import { createHash, randomUUID } from "node:crypto";
|
|
4
4
|
import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
|
|
5
5
|
import { tmpdir } from "node:os";
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Bh as $}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Bh as $}from"./vm-hands-entry-lite-8nmj4r5v.js";var O=$.version,Z=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function S(B,D){if(!Z.test(B)||!Z.test(D))throw Error("cannot compare invalid CLI versions");let J=(q)=>{let y=q.indexOf("-");return y===-1?[q,void 0]:[q.slice(0,y),q.slice(y+1)]},[j,F]=J(B),[w,G]=J(D),K=j.split(".").map(BigInt),M=w.split(".").map(BigInt);for(let q=0;q<3;q+=1){if(K[q]===M[q])continue;return K[q]<M[q]?-1:1}if(F===void 0||G===void 0){if(F===G)return 0;return F===void 0?1:-1}let Q=F.split("."),U=G.split("."),A=Math.max(Q.length,U.length);for(let q=0;q<A;q+=1){let y=Q[q],z=U[q];if(y===void 0||z===void 0){if(y===z)return 0;return y===void 0?-1:1}if(y===z)continue;let H=/^\d+$/.test(y),W=/^\d+$/.test(z);if(H&&W){let X=BigInt(y),Y=BigInt(z);if(X===Y)continue;return X<Y?-1:1}if(H!==W)return H?-1:1;return y<z?-1:1}return 0}function k(B,D){return D?`cli ${B} \xB7 agent ${D}`:`cli ${B}`}
|
|
3
3
|
export{O as xh,Z as yh,S as zh,k as Ah};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ab as U9,Bb as u0,Ib as z0,wb as UQ,xb as Z8,yb as u9,zb as q0}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ab as U9,Bb as u0,Ib as z0,wb as UQ,xb as Z8,yb as u9,zb as q0}from"./vm-hands-entry-lite-5rbj89cs.js";import{Qb as PQ,Rb as IQ,Sb as rZ,Tb as tZ,Ub as G8}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as E0}from"./vm-hands-entry-lite-n07kxrd1.js";import{Bd as N0,Oc as a$,Rc as o$,ud as R9,vd as n0,wd as V8,xd as b0}from"./vm-hands-entry-lite-5zzey257.js";import{ae as I}from"./vm-hands-entry-lite-h7ndfgwc.js";import{Ke as kQ,Le as f8,Ze as wQ,df as s9,ef as w8}from"./vm-hands-entry-lite-zmf3vn3w.js";import{Af as x8,Df as c9,Lf as A8,Mf as I0,Nf as j0,Of as d9,Vf as R8,Wf as $Q,Xf as l$,gf as UZ,jf as F9,sf as r$,tf as t$,vf as e$,xf as v9,yf as p$,zf as u$}from"./vm-hands-entry-lite-mysjgrwy.js";import{Xg as aZ}from"./vm-hands-entry-lite-cfjx91rj.js";import{Zg as W8,_g as p9,bh as iZ}from"./vm-hands-entry-lite-pr65ksfz.js";import{ch as F8,dh as l0,eh as U8,fh as s0,gh as K9,hh as Q8,ih as r8,jh as p0,kh as v0,lh as d$,wh as F$}from"./vm-hands-entry-lite-ngvxyjhy.js";import{Bh as JZ}from"./vm-hands-entry-lite-8nmj4r5v.js";import{Hh as oZ}from"./vm-hands-entry-lite-d94sv87n.js";import{Jh as C}from"./vm-hands-entry-lite-sn3vjjgx.js";import{Kh as L1,Nh as ZZ}from"./vm-hands-entry-lite-a3n86qqm.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000,window:8};function g9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function _0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function I$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function A0($){if(!g9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(I$)||!_0($.attachmentRevision,0)||!_0($.grantRevision,1)||!_0($.generation,1)||!_0($.port,1024,65535)||!_0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function y0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function M9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function P$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function N9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function R$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function E$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!g9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello")return{type:"hello",binding:A0(Q.binding),..._0(Q.messages,v.chunk,v.upload)?{messages:Q.messages}:{},..._0(Q.window,1,v.window)?{window:Q.window}:{}};if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:A0(Q.binding),reason:Q.reason};if(!I$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return N9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&_0(Q.status,200,599)&&P$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&P$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return N9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:M9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function T8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((G)=>G.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function O8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function j9($){return await O8($)===!0}function y9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function S$($){if(!g9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:A0($.binding),deviceRelayUrl:y9($.deviceRelayUrl,"device")}}function w$($){if(!g9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:A0($.binding)}}import{request as B4}from"http";import{WebSocket as C9}from"ws";import{randomBytes as F4,timingSafeEqual as U4}from"crypto";import{createServer as W4}from"net";var b$="x-preview-connection";async function k$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=F4(32).toString("base64url"),X=new Set,J=!1,G=W4((Y)=>{if(J||Q.aborted||X.size>=v.streams*2)return Y.destroy();X.add(Y);let V=new AbortController;Y.once("close",()=>{X.delete(Y),V.abort()}),Y.on("error",()=>Y.destroy()),Y.setTimeout(2000,()=>Y.destroy());let U=Buffer.alloc(0),F=(L)=>{U=Buffer.concat([U,L]);let B=U.indexOf(`\r
|
|
3
3
|
\r
|
|
4
4
|
`);if(B<0){if(U.length>16384)Y.destroy();return}if(Y.pause(),Y.off("data",F),B>16384||U.length>v.upload+16384)return Y.destroy();K(U,B).catch(()=>Y.destroy())};Y.on("data",F);async function K(L,B){let W=L.subarray(0,B).toString("latin1").split(`\r
|
|
5
5
|
`),M=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(W.shift()??"");if(!M)throw Error("preview_request_invalid");M9(M[2]);let _=!1,q=0,D=[];for(let T of W){let k=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(T);if(!k)throw Error("preview_header_invalid");if(k[1].toLowerCase()===b$){q++;let g=Buffer.from(k[2].trim());_=g.length===Z.length&&U4(g,Buffer.from(Z))}else if(k[1].toLowerCase()!=="host")D.push(T)}if(!_||q!==1||J||V.signal.aborted)throw Error("preview_connection_denied");let x=await $.connect(V.signal);if(J||V.signal.aborted)throw x.destroy(),Error("preview_closed");X.add(x),x.on("error",()=>Y.destroy()),x.once("close",()=>{X.delete(x),Y.destroy()}),Y.once("close",()=>x.destroy()),Y.setTimeout(0);let b=[`${M[1]} ${M[2]} HTTP/1.1`,`Host: 127.0.0.1:${x.remotePort}`,...D,"",""].join(`\r
|
|
@@ -454,6 +454,6 @@ lines.on("line", (line) => {
|
|
|
454
454
|
`);v6(Z,J,{mode:384});let G=!1;return{command:"/usr/bin/sandbox-exec",args:["-f",Z,$.nodeExecutable,...$.nodeArgs],cwd:$.workRoot,env:{...$.environment,TMPDIR:Q},async cleanup(){if(G)return;G=!0,y6(Q,{recursive:!0,force:!0})}}}async function i6($){let Q=g6($.workRoot),Z=$.nodeExecutable??s6(),X=["--max-old-space-size=512","--permission",`--allow-fs-read=${Q}`,`--allow-fs-write=${Q}`,"-e",l6],J=G8({home:Q,temporaryDirectory:Q}),G=$.platformName??d6();if(G==="linux")return{command:Z,args:X,cwd:Q,env:J,async cleanup(){}};if(G==="darwin")return n6({nodeExecutable:Z,nodeArgs:X,workRoot:Q,environment:J});throw Error("hands_node_repl_platform_unsupported")}async function I9($){let Q;try{await Promise.race([$,new Promise((Z,X)=>{Q=setTimeout(()=>X(Error("hands_node_repl_child_cleanup_timeout")),u6)})])}finally{clearTimeout(Q)}}async function hZ($){if($.executionMode!=="single-evaluation")throw Error(qZ);let Q=await i6($),Z;try{Z=k6(Q.command,Q.args,{cwd:Q.cwd,env:Q.env,stdio:["pipe","pipe","pipe"]})}catch(q){throw await Q.cleanup(),q}let X=new Promise((q)=>Z.once("close",()=>q())),J;Z.once("error",(q)=>{J=q});let G=!1,z=!1,H="";Z.stderr.setEncoding("utf8"),Z.stderr.on("data",(q)=>{H=`${H}${q}`.slice(-16384)});let Y=Z.stdout,V,U=(q,D,x)=>{if(x)q.failure??=x;if(q.finishing)return;q.finishing=!0,z=!0,Z.kill("SIGKILL"),I9(X).then(()=>{if(q.failure)q.reject(q.failure);else q.resolve(D??{})},(b)=>q.reject(b))},F=()=>{if(z=!0,V)U(V,void 0,Error("hands_node_repl_state_lost"));else Z.kill("SIGKILL")},K="";Y?.setEncoding("utf8"),Y?.on("data",(q)=>{if(V?.finishing||z)return;if(K+=q,K.length>yZ){F();return}while(!0){let D=K.indexOf(`
|
|
455
455
|
`);if(D===-1)return;let x=K.slice(0,D);K=K.slice(D+1);let b=V;if(!b){F();return}try{let T=JSON.parse(x);if(b.action==="probe")b.resolve(T);else{U(b,T);return}}catch{U(b,void 0,Error("invalid_hands_node_repl_child_response"));return}}});let L=(q)=>{let D=H.trim(),x=q??Error(D?`hands_node_repl_child_exited:${D}`:"hands_node_repl_child_exited");if(z=!0,V&&!V.finishing)U(V,void 0,x)};Z.once("error",L),Z.once("close",()=>L()),Z.stdin.on("error",L);let B=(q)=>new Promise((D,x)=>{if(G||z||Z.exitCode!==null||Z.signalCode!==null){x(Error(z?"hands_node_repl_state_lost":"hands_node_repl_stopped"));return}let b=setTimeout(F,q.action==="probe"?1e4:Math.max(1,Math.min($.evaluationTimeoutMs??Y$-1000,Y$-1000))),T={action:q.action,finishing:!1,resolve(k){if(V===T)V=void 0;clearTimeout(b),D(k)},reject(k){if(V===T)V=void 0;clearTimeout(b),x(k)}};V=T,Z.stdin.write(`${JSON.stringify(q)}
|
|
456
456
|
`,(k)=>{if(!k)return;U(T,void 0,k)})});try{if(!Y){if(Z.pid===void 0)await I9(X);throw J??Error("hands_node_repl_control_pipe_missing")}let q=await B({action:"probe"});if(q.ok!==!0||q.output!=="ARA_HANDS_REPL_READY")throw Error("hands_node_repl_probe_failed")}catch(q){G=!0,Z.kill("SIGKILL");try{await I9(X)}finally{await Q.cleanup()}throw q}let W=Promise.resolve(),M=new Set;X$($.socketPath);let _=c6.createServer((q)=>{M.add(q),q.once("close",()=>M.delete(q)),q.setEncoding("utf8");let D="",x=!1,b=!1;q.once("close",()=>{if(b)F()}),q.on("error",()=>q.destroy()),q.on("data",(T)=>{if(x)return;if(D+=T,D.length>yZ){x=!0,Y8(q,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let k=D.indexOf(`
|
|
457
|
-
`);if(k===-1)return;x=!0;let g=D.slice(0,k);W=W.then(async()=>{if(q.destroyed)return;try{let O=JSON.parse(g);if(O.action!=="evaluate"||typeof O.code!=="string")throw Error("Invalid REPL request");b=!0;let N=await B({action:"evaluate",code:O.code});if(b=!1,N.ok!==!0||typeof N.output!=="string")throw Error(typeof N.error==="string"?N.error:"hands_node_repl_failed");Y8(q,{ok:!0,output:N.output})}catch(O){b=!1,Y8(q,{ok:!1,error:O instanceof Error?O.message:String(O),stack:O instanceof Error?O.stack:void 0})}}).catch((O)=>{Y8(q,{ok:!1,error:O instanceof Error?O.message:String(O)})})})});try{await new Promise((q,D)=>{_.once("error",D),_.listen($.socketPath,()=>{_.off("error",D);try{f6($.socketPath,384),q()}catch(x){_.close(()=>D(x))}})})}catch(q){G=!0,Z.kill("SIGKILL");try{await I9(X)}finally{await Q.cleanup(),X$($.socketPath)}throw q}return{socketPath:$.socketPath,async stop(){if(G)return;G=!0;let q=new Promise((D)=>_.close(()=>D()));for(let D of M)D.destroy();await q,W.catch(()=>{return}),F();try{await I9(X)}finally{await Q.cleanup(),X$($.socketPath)}}}}var G$=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var vZ="/workspace",cZ="/var/lib/reason/sessions",a6="/var/lib/reason/session-controls";function dZ($){let Q=`${cZ}/`;if(!$.startsWith(Q))return null;let Z=$.slice(Q.length);if(!G$.test(Z)||Z!==Z.toLowerCase())throw Error("personal_computer_invalid_runtime_root");return`${a6}/${Z}/job.env`}function o6($){if(!G$.test($))throw Error("personal_computer_invalid_identity");return $.toLowerCase()}function z8($){let Q=o6($);return{runtimeRoot:`${cZ}/${Q}`,workspaceRoot:`${vZ}/sessions/${Q}`,sharedRoot:vZ}}var pZ="/root/.ara/cloud-browser/repl.sock";function z$($){return $==="compute"}function uZ($,Q,Z="linux"){if($)z8($);if(Z!=="linux")throw Error("cloud_browser_os_invalid");if(Q!==void 0&&(!$||!/^[1-9][0-9]{0,18}$/.test(Q)))throw Error("cloud_browser_generation_invalid");let X=$?`/var/lib/reason/browsers/${$.toLowerCase()}`:"/root/.ara/cloud-browser",J=$?`${X}/${Q?`g${Q}`:"current"}`:X,G=$?`/root/.b/${$.toLowerCase().replaceAll("-","")}`:X;return{temporarySessionDirectory:G,temporaryDirectory:$?`${G}/${Q??"current"}`:`${J}/tmp`,directory:J,sessionDirectory:X,config:`${J}/config.json`,status:`${J}/status.json`,socket:`${J}/repl.sock`,bundle:`${J}/driver.mjs`,processName:$?`ara-browser-${$.toLowerCase()}${Q?`-${Q}`:""}`:"ara-cloud-browser"}}var H$="browser_egress",lZ=FQ,H7=45000,V7=c9+1500,k0=/^[A-Za-z0-9._:-]{1,160}$/,F7="/run/ara-hands";function U7($,Q,Z=eZ()){if($==="darwin")return{temporaryRoot:Z,prepareRoot:!1,sessionMode:448};return{temporaryRoot:Q??F7,prepareRoot:!0,sessionMode:457}}function sZ($,Q=process.platform,Z=process.geteuid?.()){return $===!0&&Q==="linux"&&Z===0}function U$($=aZ(),Q=process.platform,Z=process.geteuid?.()){return $&&Q==="linux"&&Z===0?{uid:$.uid,gid:$.gid,home:$.home,username:$.username}:null}function W7($=U$(),Q=MZ){return $&&Q()?a8:null}function OY($=U$(),Q=process.platform,Z=process.geteuid?.()){return Q!=="linux"||Z!==0||$!==null}function DY($=process.platform,Q=process.geteuid?.()){return $!=="linux"||Q!==0}function B7($,Q){if(!Q&&($??"linux")==="linux")return pZ;return uZ(Q,void 0,$??"linux").socket}function L7($){return $[W0]===!0?"sandbox_loopback":"ara_device_wss"}function V9($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function Q4($){let Q=$.toLowerCase().replace(/^\[|\]$/g,"");return Q==="localhost"||Q.endsWith(".localhost")||Q==="::1"||Q==="0:0:0:0:0:0:0:1"||Q==="0.0.0.0"||Q.startsWith("127.")}class Z4 extends C{expiryDiagnostic;constructor($){super("invalid_hands_expiry","Reason Hands connection expiry is invalid.");this.expiryDiagnostic=$}}function N7($){return V9($)&&Object.keys($).every((Q)=>Q==="source_path"||Q==="branch")&&($.source_path===void 0||p0($.source_path))&&typeof $.branch==="string"&&t8.test($.branch)}function M7($,Q,Z){let X=Q===void 0?Date.now():Q,J=["relay_url","session_id","environment_id","expires_at","policy_mode","policy_version","hands_protocol_version","hands_worker_version","hands_worker_artifact_sha256","hands_worker_entrypoint","target_generation","target_fence_id"],G=new Set([...J,"workspace_id","legacy_workspace_id",l0,s0,"environment_binding","cloud_browser","sandbox_provider","sandbox_os","personal_workspace","workspace_path","workspace_worktree",p,W0,H$,z9,N0,n0,b0]),z=V9($)?$:null,H=z?.[H$],Y=z?.[z9],V=z?.[n0],U=H===void 0||(z?.[p]===w0||V===R9&&z?.[p]===void 0)&&V9(H)&&Object.keys(H).every((q)=>q==="mode"||q==="allowed_domains")&&H.mode==="enforce"&&Array.isArray(H.allowed_domains)&&H.allowed_domains.length<=256&&H.allowed_domains.every((q)=>typeof q==="string"&&y8(q));if(!V9($)||J.some((q)=>!(q in $))||Object.keys($).some((q)=>!G.has(q))||!U||V!==void 0&&V!==R9||z?.[b0]!==void 0&&z[b0]!==V8||z?.personal_workspace!==void 0&&(z.personal_workspace!==!0||z[p]!==w0)||z?.cloud_browser!==void 0&&(z.cloud_browser!==!0||z[p]!==w0)||z?.sandbox_provider!==void 0&&!z$(z.sandbox_provider)||z?.sandbox_os!==void 0&&z.sandbox_os!=="linux"||Y!==void 0&&(z?.[p]!==G9||!o8(Y))||p in $&&$[p]!==w0&&$[p]!==G9&&$[p]!==U0||W0 in $&&$[W0]!==!0||$.workspace_path!==void 0&&(!p0($.workspace_path)||$[p]!==U0)||$.workspace_worktree!==void 0&&($.workspace_path===void 0||!N7($.workspace_worktree))||typeof $.relay_url!=="string"||typeof $.session_id!=="string"||!k0.test($.session_id)||$.workspace_id!==void 0&&(typeof $.workspace_id!=="string"||!k0.test($.workspace_id))||$.legacy_workspace_id!==void 0&&(typeof $.legacy_workspace_id!=="string"||!k0.test($.legacy_workspace_id))||$[l0]!==void 0&&($[l0]!==F8||(p in $))||$[s0]!==void 0&&($[s0]!==U8||(p in $))||$[N0]!==void 0&&(typeof $[N0]!=="string"||!k0.test($[N0]))||typeof $.environment_id!=="string"||!k0.test($.environment_id)||typeof $.expires_at!=="string"||$.policy_mode!=="full_access"||$.policy_version!==1||$.hands_protocol_version!==F9||$.hands_worker_version!==U9||$.hands_worker_artifact_sha256!==z0||!wZ($.hands_worker_entrypoint)||!I0($.target_generation)||!j0($.target_fence_id))throw new C("invalid_hands_payload","Reason Hands connection payload is invalid.");let F;try{F=new URL($.relay_url)}catch{throw new C("invalid_hands_relay","Reason Hands relay URL is invalid.")}let K=$[W0]===!0,L=Q4(F.hostname);if((K?F.protocol!=="ws:"||!L:L?F.protocol!=="ws:":F.protocol!=="wss:")||F.username||F.password||F.hash||!/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(F.pathname))throw new C("invalid_hands_relay","Reason Hands relay URL is not allowed.");let B=Date.parse($.expires_at),W=Number.isNaN(B)?"parse":new Date(B).toISOString()!==$.expires_at?"noncanonical":B<=X?"expired":B-X>lZ?"over_cap":"accepted",M={version:1,outcome:W,clock_source:Q===void 0?"date_now":"injected",validation_now_ms:$9(X),expiry_ms:$9(B),remaining_ms:Number.isSafeInteger(B-X)?B-X:null,maximum_lifetime_ms:lZ,cli_artifact:bZ()};if(W!=="accepted")throw new Z4(M);try{Z?.(M)}catch{}let _=$.environment_binding===void 0?void 0:E8.safeParse($.environment_binding);if(_&&!_.success)throw new C("invalid_hands_request","Reason Hands environment binding is invalid.");return{...$.cloud_browser===!0?{cloud_browser:!0}:{},...z$($.sandbox_provider)?{sandbox_provider:$.sandbox_provider}:{},...$.sandbox_os==="linux"?{sandbox_os:$.sandbox_os}:{},...$.personal_workspace===!0?{personal_workspace:!0}:{},relay_url:F.toString(),..._?.success?{environment_binding:_.data}:{},session_id:$.session_id,...$.workspace_id===void 0?{}:{workspace_id:$.workspace_id},...$.legacy_workspace_id===void 0?{}:{legacy_workspace_id:$.legacy_workspace_id},...$[l0]===F8?{[l0]:F8}:{},...$[s0]===U8?{[s0]:U8}:{},...typeof $[N0]==="string"?{[N0]:$[N0]}:{},...$[n0]===R9?{[n0]:R9}:{},...$[b0]===V8?{[b0]:V8}:{},...typeof $.workspace_path==="string"?{workspace_path:$.workspace_path}:{},...V9($.workspace_worktree)?{workspace_worktree:{...typeof $.workspace_worktree.source_path==="string"?{source_path:$.workspace_worktree.source_path}:{},branch:String($.workspace_worktree.branch)}}:{},environment_id:$.environment_id,expires_at:$.expires_at,policy_mode:"full_access",policy_version:1,hands_protocol_version:F9,hands_worker_version:U9,hands_worker_artifact_sha256:z0,hands_worker_entrypoint:u0,target_generation:$.target_generation,target_fence_id:$.target_fence_id,...p in $?{[p]:$[p]}:{},...K?{[W0]:!0}:{},...Y===void 0?{}:{[z9]:Y},...H===void 0?{}:{[H$]:{mode:"enforce",allowed_domains:[...new Set(H.allowed_domains)].sort()}}}}function j7(){let $=new Map;return{acquire(Q,Z){if($.has(Q))return null;let X=[...$.values()],J=(z)=>Z.group!==void 0&&z.group===Z.group;if(Z.exclusive?!X.every(J):X.some((z)=>z.exclusive))return null;if(Z.limit!==void 0&&!X.some(J)&&new Set(X.map((z,H)=>z.group??H)).size>=Z.limit)return null;$.set(Q,Z);let G=!1;return()=>{if(G)return;G=!0,$.delete(Q)}},activeOwners:()=>[...$.keys()]}}var C7=j7();function q7($,Q){W9($,{recursive:!0,mode:448});let Z=n($),X=()=>new C("invalid_hands_workspace","Reason Hands managed workspace ancestor must be a real directory, not a link.");for(let z of Q.split("/")){let H=o(Z,z);try{let V=t(H);if(V.isSymbolicLink()||!V.isDirectory())throw X()}catch(V){if(!(V&&typeof V==="object"&&("code"in V)&&V.code==="ENOENT"))throw V;try{W9(H,{mode:448})}catch(U){if(!(U&&typeof U==="object"&&("code"in U)&&U.code==="EEXIST"))throw U}}let Y=t(H);if(Y.isSymbolicLink()||!Y.isDirectory()||n(H)!==H)throw X();Z=H}let J=t(Z),G=X7(Z,K$.O_RDONLY|K$.O_DIRECTORY|K$.O_NOFOLLOW);try{let z=Z7(G);if(!z.isDirectory()||z.dev!==J.dev||z.ino!==J.ino||n(Z)!==Z)throw X();Q7(G,448)}finally{$7(G)}return Z}function T7($,Q=iZ(),Z,X,J){if(!k0.test($)||Z!==void 0&&!k0.test(Z))throw new C("invalid_hands_workspace","Reason Hands run identity is invalid.");let G=K0(v0({kind:"managed",workspaceId:$,...X?{base:X}:{},...J?{layout:J}:{}})),z=q7(Q,K0(G)),H=o(z,K7(G)),Y=!1;try{let K=t(H);if(Y=!0,K.isSymbolicLink())throw new C("invalid_hands_workspace","Reason Hands workspace cannot be a symbolic link.");if(!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands workspace must be a managed directory.")}catch(K){if(K instanceof C||!(K&&typeof K==="object"&&("code"in K)&&K.code==="ENOENT"))throw K}if(J&&!Y)try{let K=o(n(Q),K0(v0({kind:"managed",workspaceId:$,...X?{base:X}:{}}))),L=t(K);if(!L.isSymbolicLink()&&L.isDirectory()&&n(K)===K)K8(K,H),Y=!0}catch{}if(Z&&Z!==$){let K=o(z,Z);try{let L=t(K);if(L.isSymbolicLink()||!L.isDirectory())throw new C("invalid_hands_workspace","Reason Hands legacy workspace must be a managed directory.");let B=n(K);if(K0(B)!==z)throw new C("invalid_hands_workspace","Reason Hands legacy workspace escaped its managed parent.");let W=null;if(Y){W=o(z,`.${$}.previous`);try{throw t(W),new C("invalid_hands_workspace","Reason Hands previous workspace backup already exists.")}catch(M){if(M instanceof C||!(M&&typeof M==="object"&&("code"in M)&&M.code==="ENOENT"))throw M}K8(H,W)}try{K8(B,H)}catch(M){if(W)K8(W,H);throw M}Y=!0}catch(L){if(L instanceof C||!(L&&typeof L==="object"&&("code"in L)&&L.code==="ENOENT"))throw L}}W9(H,{recursive:!0,mode:448}),E9(H,448);let V=n(H);if(K0(V)!==z)throw new C("invalid_hands_workspace","Reason Hands workspace escaped its managed parent.");let U=o(V,"repo");try{let K=t(U);if(K.isSymbolicLink()||!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.")}catch(K){if(K instanceof C||!(K&&typeof K==="object"&&("code"in K)&&K.code==="ENOENT"))throw K}W9(U,{recursive:!0,mode:448}),E9(U,448);let F=n(U);if(K0(F)!==V)throw new C("invalid_hands_workspace","Reason Hands repository escaped its managed run workspace.");return{workRoot:V,repoPath:F}}function X4($){let Q=null;try{Q=t($)}catch{}if(!Q||Q.isSymbolicLink()||!Q.isDirectory()||Q.uid!==0||Q.gid!==0||(Q.mode&4095)!==493)throw new C("cloud_workspace_root_invalid","This cloud Session's workspace root is not root's 0755 directory, so Reason Hands cannot use it.")}function O7($,Q){let Z="/";for(let X of["",...$.split("/"),...Q.split("/")].filter((J,G)=>G===0||J)){if(X)Z=o(Z,X);let J;try{J=t(Z)}catch{return null}if(J.uid!==0)return J.uid;if((J.mode&2)!==0&&(J.mode&512)===0&&!J.isSymbolicLink())return-1;if(J.isSymbolicLink()||!J.isDirectory())return null}return null}function D7($,Q,Z,X=process.geteuid?.(),J){if(!k0.test(Q))return null;let G,z;try{G=n($),z=K0(v0({kind:"managed",workspaceId:Q,...Z?{base:Z}:{},...J?{layout:J}:{}}))}catch{return null}let H=o(G,z),Y=F$(H)!==null,V=(B)=>new C("cloud_workspace_root_invalid",B),U;if(X===0){let B=O7(G,z);if(B===null)return null;if(!Y)throw new C("invalid_hands_workspace","As root, Reason Hands never prepares a workspace in folders another user owns.");U=B}else{if(!Y)return null;let B,W;try{B=t(K0(H)),W=t(H)}catch{return null}if(B.isSymbolicLink()||!B.isDirectory()||B.uid===0||W.uid!==0)return null;U=B.uid}let F=G;for(let B of z.split("/")){let W=o(F,B),M=!1;try{let _=t(W);M=!_.isSymbolicLink()&&_.isDirectory()&&n(W)===W}catch{}if(!M)throw V("This cloud Session's workspace root is missing or is not a real directory.");F=W}X4(H);let K;try{K=J4(H)}catch(B){if(B instanceof C)throw B;throw V("This cloud Session's workspace root changed while Reason Hands checked it.")}let L=null;try{L=S9(K.repoPath).uid}catch{}if(L!==U)throw new C("invalid_hands_workspace","Reason Hands repository must belong to the cloud Session's user.");return K}function J4($,Q=!1){let Z=n($),X=o(Z,"repo"),J;try{J=t(X)}catch{throw new C("invalid_hands_workspace","Reason Hands repository is missing from the granted root.")}if(Q){if(!/^\/var\/lib\/reason\/sessions\/[0-9a-f-]{36}$/.test(Z))throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");if(z8(Z.slice(Z.lastIndexOf("/")+1)).runtimeRoot!==Z)throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");let H=n("/workspace"),Y=n(X);if(H!=="/workspace"||!S9(Y).isDirectory()||!Y.startsWith("/workspace/"))throw new C("invalid_hands_workspace","Personal files escaped the personal computer.");return{workRoot:Z,repoPath:Y}}let G=jZ(Z);if(G&&J.isSymbolicLink()){let H=n(X);if(H!==n(G)||!S9(H).isDirectory())throw new C("invalid_hands_workspace","Side chat repository must be its parent's checkout.");return{workRoot:Z,repoPath:H}}if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.");let z=n(X);if(K0(z)!==Z)throw new C("invalid_hands_workspace","Reason Hands repository escaped its granted root.");return{workRoot:Z,repoPath:z}}function W$($,Q,Z){if(Q!==void 0&&!p0(Q))throw new C("invalid_hands_workspace",`Reason Hands ${Z} is invalid.`);let X=$4($,Q??".");if(!R0($,X))throw new C("invalid_hands_workspace",`Reason Hands ${Z} escapes its granted root.`);return X}function Y4($,Q,Z){if(r8(Q)){let X=n(Z);return{anchor:X,target:$4(X,Q),boundary:o(X,K9)}}return{anchor:$,target:W$($,Q,"folder"),boundary:$}}function _7($,Q){if(!R0($,Q))throw new C("invalid_hands_workspace","Reason Hands folder escapes its granted root.");let Z=$;for(let X of Q.slice($.length).split("/").filter(Boolean)){Z=o(Z,X);let J=null;try{J=t(Z)}catch(G){if(G.code!=="ENOENT")throw G}if(!J)W9(Z,{mode:448});else if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands folder must be made of real directories.")}}function G4($,Q){let Z=n(W$($,Q.source_path,"repository"));if(!R0($,Z)||!S9(Z).isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a folder in its granted root.");return Z}async function A7($,Q,Z,X=W8()){try{let J=n($);if(V$(Y4(J,Q,X).target))return;return await _Z(G4(J,Z))??void 0}catch{return}}function x7($,Q,Z,X,J=P7,G=W8()){let z=n($),{target:H,boundary:Y,anchor:V}=Y4(z,Q,G);if(Z&&!V$(H)){let K=G4(z,Z);_7(V,K0(H));let L=["-c","core.hooksPath=/dev/null","-C",K];if(X)J([...L,"update-ref","--create-reflog","-m",X.note,`refs/heads/${Z.branch}`,X.commit,""]);let B=X?J([...L,"worktree","add",H,Z.branch]):J([...L,"worktree","add","-b",Z.branch,H]);if(!X&&B.status!==0&&/already exists/.test(B.stderr)&&!V$(H))B=J([...L,"worktree","add",H,Z.branch]);if(B.status!==0)throw new C(/not a git repository/i.test(B.stderr)?"workspace_not_git_repository":"workspace_worktree_failed","Reason could not create this Session's git worktree.")}let U;try{U=t(H)}catch{throw new C("workspace_folder_missing","This Session's folder no longer exists.")}let F=n(H);if(U.isSymbolicLink()&&!R0(Y,F))throw new C("invalid_hands_workspace","Reason Hands folder resolves outside its granted root.");if(!S9(F).isDirectory()||!R0(Y,F))throw new C("invalid_hands_workspace","Reason Hands folder must be a directory in its granted root.");if(E0(F))throw new C("protected_path","Credential and secret folders are unavailable to Sessions.");return F}function P7($){let Q=e6("git",$,{encoding:"utf8",timeout:60000,env:{...process.env,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});return{status:Q.status,stderr:Q.stderr??""}}function z4($){return dZ($)??F$($)?.jobEnv??o($,"job.env")}function I7($,Q){let Z=z4($),X=t(Z);if(X.isSymbolicLink()||!X.isFile())throw new C("invalid_hands_workspace","Reason Hands job environment must be a managed regular file.");J7(Z,Q),E9(Q,384)}function R7($){if($.workspaceMode===U0&&$.workspacePath!==void 0){let z=$.home??W8(),H=x7($.grantedRoot,$.workspacePath,$.workspaceWorktree,$.workspaceWorktreeStart,void 0,z);if($.workspaceWorktree&&$.deviceId)IZ(z,$.workspacePath,$.deviceId);return{workRoot:H,repoPath:H,workspace:{kind:"root",path:$.workspacePath},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}if($.workspaceMode===w0)return{...J4($.grantedRoot,$.personalWorkspace),workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1};if($.workspaceMode===G9||$.workspaceMode===U0){let z=t($.grantedRoot);if(z.isSymbolicLink()||!z.isDirectory())throw new C("invalid_hands_workspace","Reason Hands root must be a real directory.");let H=n($.grantedRoot);return{workRoot:H,repoPath:H,workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}let Q=$.workspaceId??$.runId,Z={kind:"managed",workspaceId:Q,...$.workspaceBase?{base:$.workspaceBase}:{},...$.workspaceLayout?{layout:$.workspaceLayout}:{}},X=p9($.grantedRoot,Z,$.home).anchor,J=D7(X,Q,$.workspaceBase,void 0,$.workspaceLayout);if(J)return{...J,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1,cloudSessionRoot:!0};let G=T7(Q,X,$.legacyWorkspaceId,$.workspaceBase,$.workspaceLayout);return{...G,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:K0(G.workRoot),managedWorkspace:!0}}function E7($){let{command:Q,prefix:Z}=S8($.executablePath,$.sourceEntrypoint),X=G8({home:z7(),temporaryDirectory:$.temporaryDirectory,path:$.path});if(X.REASON_DEVICE_ROOT=X.ARA_DEVICE_ROOT=$.grantedRoot,X.REASON_HANDS_WORKSPACE=X.ARA_HANDS_WORKSPACE=$.workRoot,X.REASON_HANDS_REPO=X.ARA_HANDS_REPO=$.root,$.workspacePoolPath)X.REASON_HANDS_WORKSPACE_POOL=X.ARA_HANDS_WORKSPACE_POOL=$.workspacePoolPath;return{command:Q,args:[...Z,"__device","__hands-worker","--config",$.configPath],options:{cwd:$.root,env:X,shell:!1,stdio:["ignore","ignore","pipe"]}}}function S7($,Q){let Z="",X=!1,J=Date.now(),G=0,z=new Set(["connecting","open","dial_pending","socket_error","close","claim_accepted","claim_rejected","stopping","stopped"].map((F)=>`hands.worker.${F}`)),H=new Set([null,"open_not_received","current_connection","obsolete_connection","request_aborted","request_timeout","client_closed","driver_stopped","driver_handoff","run_cancelled","run_finished","other","frame_too_large","invalid_json","invalid_claim","executor_mismatch","stale_generation","fence_conflict","SIGTERM","SIGINT","SIGHUP","expired","cleanup_complete","cleanup_failed"]),Y=["timestampMs","connectionAttempt","connectionGeneration","targetGeneration","activeRequestCount","remainingLifetimeMs","suppressedDiagnostics"],V=["peerGeneration","socketState","closeCode"],U=new Set(["event","reason","launchId",...Y,...V]);return(F)=>{for(let K of F.toString().split(/(?<=\n)/)){let L=K.endsWith(`
|
|
457
|
+
`);if(k===-1)return;x=!0;let g=D.slice(0,k);W=W.then(async()=>{if(q.destroyed)return;try{let O=JSON.parse(g);if(O.action!=="evaluate"||typeof O.code!=="string")throw Error("Invalid REPL request");b=!0;let N=await B({action:"evaluate",code:O.code});if(b=!1,N.ok!==!0||typeof N.output!=="string")throw Error(typeof N.error==="string"?N.error:"hands_node_repl_failed");Y8(q,{ok:!0,output:N.output})}catch(O){b=!1,Y8(q,{ok:!1,error:O instanceof Error?O.message:String(O),stack:O instanceof Error?O.stack:void 0})}}).catch((O)=>{Y8(q,{ok:!1,error:O instanceof Error?O.message:String(O)})})})});try{await new Promise((q,D)=>{_.once("error",D),_.listen($.socketPath,()=>{_.off("error",D);try{f6($.socketPath,384),q()}catch(x){_.close(()=>D(x))}})})}catch(q){G=!0,Z.kill("SIGKILL");try{await I9(X)}finally{await Q.cleanup(),X$($.socketPath)}throw q}return{socketPath:$.socketPath,async stop(){if(G)return;G=!0;let q=new Promise((D)=>_.close(()=>D()));for(let D of M)D.destroy();await q,W.catch(()=>{return}),F();try{await I9(X)}finally{await Q.cleanup(),X$($.socketPath)}}}}var G$=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var vZ="/workspace",cZ="/var/lib/reason/sessions",a6="/var/lib/reason/session-controls";function dZ($){let Q=`${cZ}/`;if(!$.startsWith(Q))return null;let Z=$.slice(Q.length);if(!G$.test(Z)||Z!==Z.toLowerCase())throw Error("personal_computer_invalid_runtime_root");return`${a6}/${Z}/job.env`}function o6($){if(!G$.test($))throw Error("personal_computer_invalid_identity");return $.toLowerCase()}function z8($){let Q=o6($);return{runtimeRoot:`${cZ}/${Q}`,workspaceRoot:`${vZ}/sessions/${Q}`,sharedRoot:vZ}}var pZ="/root/.ara/cloud-browser/repl.sock";function z$($){return $==="compute"}function uZ($,Q,Z="linux"){if($)z8($);if(Z!=="linux")throw Error("cloud_browser_os_invalid");if(Q!==void 0&&(!$||!/^[1-9][0-9]{0,18}$/.test(Q)))throw Error("cloud_browser_generation_invalid");let X=$?`/var/lib/reason/browsers/${$.toLowerCase()}`:"/root/.ara/cloud-browser",J=$?`${X}/${Q?`g${Q}`:"current"}`:X,G=$?`/root/.b/${$.toLowerCase().replaceAll("-","")}`:X;return{temporarySessionDirectory:G,temporaryDirectory:$?`${G}/${Q??"current"}`:`${J}/tmp`,directory:J,sessionDirectory:X,config:`${J}/config.json`,status:`${J}/status.json`,socket:`${J}/repl.sock`,bundle:`${J}/driver.mjs`,processName:$?`ara-browser-${$.toLowerCase()}${Q?`-${Q}`:""}`:"ara-cloud-browser"}}var H$="browser_egress",lZ=FQ,H7=45000,V7=c9+1500,k0=/^[A-Za-z0-9._:-]{1,160}$/,F7="/run/ara-hands";function U7($,Q,Z=eZ()){if($==="darwin")return{temporaryRoot:Z,prepareRoot:!1,sessionMode:448};return{temporaryRoot:Q??F7,prepareRoot:!0,sessionMode:457}}function sZ($,Q=process.platform,Z=process.geteuid?.()){return $===!0&&Q==="linux"&&Z===0}function U$($=aZ(),Q=process.platform,Z=process.geteuid?.()){return $&&Q==="linux"&&Z===0?{uid:$.uid,gid:$.gid,home:$.home,username:$.username}:null}function W7($=U$(),Q=MZ){return $&&Q()?a8:null}function OY($=U$(),Q=process.platform,Z=process.geteuid?.()){return Q!=="linux"||Z!==0||$!==null}function DY($=process.platform,Q=process.geteuid?.()){return $!=="linux"||Q!==0}function B7($,Q){if(!Q&&($??"linux")==="linux")return pZ;return uZ(Q,void 0,$??"linux").socket}function L7($){return $[W0]===!0?"sandbox_loopback":"ara_device_wss"}function V9($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function Q4($){let Q=$.toLowerCase().replace(/^\[|\]$/g,"");return Q==="localhost"||Q.endsWith(".localhost")||Q==="::1"||Q==="0:0:0:0:0:0:0:1"||Q==="0.0.0.0"||Q.startsWith("127.")}class Z4 extends C{expiryDiagnostic;constructor($){super("invalid_hands_expiry","Reason Hands connection expiry is invalid.");this.expiryDiagnostic=$}}function N7($){return V9($)&&Object.keys($).every((Q)=>Q==="source_path"||Q==="branch")&&($.source_path===void 0||p0($.source_path))&&typeof $.branch==="string"&&t8.test($.branch)}function M7($,Q,Z){let X=Q===void 0?Date.now():Q,J=["relay_url","session_id","environment_id","expires_at","policy_mode","policy_version","hands_protocol_version","hands_worker_version","hands_worker_artifact_sha256","hands_worker_entrypoint","target_generation","target_fence_id"],G=new Set([...J,"workspace_id","legacy_workspace_id",l0,s0,"environment_binding","cloud_browser","sandbox_provider","sandbox_os","personal_workspace","workspace_path","workspace_worktree",p,W0,H$,z9,N0,n0,b0]),z=V9($)?$:null,H=z?.[H$],Y=z?.[z9],V=z?.[n0],U=H===void 0||(z?.[p]===w0||V===R9&&z?.[p]===void 0)&&V9(H)&&Object.keys(H).every((q)=>q==="mode"||q==="allowed_domains")&&H.mode==="enforce"&&Array.isArray(H.allowed_domains)&&H.allowed_domains.length<=256&&H.allowed_domains.every((q)=>typeof q==="string"&&y8(q));if(!V9($)||J.some((q)=>!(q in $))||Object.keys($).some((q)=>!G.has(q))||!U||V!==void 0&&V!==R9||z?.[b0]!==void 0&&z[b0]!==V8||z?.personal_workspace!==void 0&&(z.personal_workspace!==!0||z[p]!==w0)||z?.cloud_browser!==void 0&&(z.cloud_browser!==!0||z[p]!==w0)||z?.sandbox_provider!==void 0&&!z$(z.sandbox_provider)||z?.sandbox_os!==void 0&&z.sandbox_os!=="linux"||Y!==void 0&&(z?.[p]!==G9||!o8(Y))||p in $&&$[p]!==w0&&$[p]!==G9&&$[p]!==U0||W0 in $&&$[W0]!==!0||$.workspace_path!==void 0&&(!p0($.workspace_path)||$[p]!==U0)||$.workspace_worktree!==void 0&&($.workspace_path===void 0||!N7($.workspace_worktree))||typeof $.relay_url!=="string"||typeof $.session_id!=="string"||!k0.test($.session_id)||$.workspace_id!==void 0&&(typeof $.workspace_id!=="string"||!k0.test($.workspace_id))||$.legacy_workspace_id!==void 0&&(typeof $.legacy_workspace_id!=="string"||!k0.test($.legacy_workspace_id))||$[l0]!==void 0&&($[l0]!==F8||(p in $))||$[s0]!==void 0&&($[s0]!==U8||(p in $))||$[N0]!==void 0&&(typeof $[N0]!=="string"||!k0.test($[N0]))||typeof $.environment_id!=="string"||!k0.test($.environment_id)||typeof $.expires_at!=="string"||$.policy_mode!=="full_access"||$.policy_version!==1||$.hands_protocol_version!==F9||$.hands_worker_version!==U9||$.hands_worker_artifact_sha256!==z0||!wZ($.hands_worker_entrypoint)||!I0($.target_generation)||!j0($.target_fence_id))throw new C("invalid_hands_payload","Reason Hands connection payload is invalid.");let F;try{F=new URL($.relay_url)}catch{throw new C("invalid_hands_relay","Reason Hands relay URL is invalid.")}let K=$[W0]===!0,L=Q4(F.hostname);if((K?F.protocol!=="ws:"||!L:L?F.protocol!=="ws:":F.protocol!=="wss:")||F.username||F.password||F.hash||!/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(F.pathname))throw new C("invalid_hands_relay","Reason Hands relay URL is not allowed.");let B=Date.parse($.expires_at),W=Number.isNaN(B)?"parse":new Date(B).toISOString()!==$.expires_at?"noncanonical":B<=X?"expired":B-X>lZ?"over_cap":"accepted",M={version:1,outcome:W,clock_source:Q===void 0?"date_now":"injected",validation_now_ms:$9(X),expiry_ms:$9(B),remaining_ms:Number.isSafeInteger(B-X)?B-X:null,maximum_lifetime_ms:lZ,cli_artifact:bZ()};if(W!=="accepted")throw new Z4(M);try{Z?.(M)}catch{}let _=$.environment_binding===void 0?void 0:E8.safeParse($.environment_binding);if(_&&!_.success)throw new C("invalid_hands_request","Reason Hands environment binding is invalid.");return{...$.cloud_browser===!0?{cloud_browser:!0}:{},...z$($.sandbox_provider)?{sandbox_provider:$.sandbox_provider}:{},...$.sandbox_os==="linux"?{sandbox_os:$.sandbox_os}:{},...$.personal_workspace===!0?{personal_workspace:!0}:{},relay_url:F.toString(),..._?.success?{environment_binding:_.data}:{},session_id:$.session_id,...$.workspace_id===void 0?{}:{workspace_id:$.workspace_id},...$.legacy_workspace_id===void 0?{}:{legacy_workspace_id:$.legacy_workspace_id},...$[l0]===F8?{[l0]:F8}:{},...$[s0]===U8?{[s0]:U8}:{},...typeof $[N0]==="string"?{[N0]:$[N0]}:{},...$[n0]===R9?{[n0]:R9}:{},...$[b0]===V8?{[b0]:V8}:{},...typeof $.workspace_path==="string"?{workspace_path:$.workspace_path}:{},...V9($.workspace_worktree)?{workspace_worktree:{...typeof $.workspace_worktree.source_path==="string"?{source_path:$.workspace_worktree.source_path}:{},branch:String($.workspace_worktree.branch)}}:{},environment_id:$.environment_id,expires_at:$.expires_at,policy_mode:"full_access",policy_version:1,hands_protocol_version:F9,hands_worker_version:U9,hands_worker_artifact_sha256:z0,hands_worker_entrypoint:u0,target_generation:$.target_generation,target_fence_id:$.target_fence_id,...p in $?{[p]:$[p]}:{},...K?{[W0]:!0}:{},...Y===void 0?{}:{[z9]:Y},...H===void 0?{}:{[H$]:{mode:"enforce",allowed_domains:[...new Set(H.allowed_domains)].sort()}}}}function j7(){let $=new Map;return{acquire(Q,Z){if($.has(Q))return null;let X=[...$.values()],J=(z)=>Z.group!==void 0&&z.group===Z.group;if(Z.exclusive?!X.every(J):X.some((z)=>z.exclusive))return null;if(Z.limit!==void 0&&!X.some(J)&&new Set(X.map((z,H)=>z.group??H)).size>=Z.limit)return null;$.set(Q,Z);let G=!1;return()=>{if(G)return;G=!0,$.delete(Q)}},activeOwners:()=>[...$.keys()]}}var C7=j7();function q7($,Q){W9($,{recursive:!0,mode:448});let Z=n($),X=()=>new C("invalid_hands_workspace","Reason Hands managed workspace ancestor must be a real directory, not a link.");for(let z of Q.split("/")){let H=o(Z,z);try{let V=t(H);if(V.isSymbolicLink()||!V.isDirectory())throw X()}catch(V){if(!(V&&typeof V==="object"&&("code"in V)&&V.code==="ENOENT"))throw V;try{W9(H,{mode:448})}catch(U){if(!(U&&typeof U==="object"&&("code"in U)&&U.code==="EEXIST"))throw U}}let Y=t(H);if(Y.isSymbolicLink()||!Y.isDirectory()||n(H)!==H)throw X();Z=H}let J=t(Z),G=X7(Z,K$.O_RDONLY|K$.O_DIRECTORY|K$.O_NOFOLLOW);try{let z=Z7(G);if(!z.isDirectory()||z.dev!==J.dev||z.ino!==J.ino||n(Z)!==Z)throw X();Q7(G,448)}finally{$7(G)}return Z}function T7($,Q=iZ(),Z,X,J){if(!k0.test($)||Z!==void 0&&!k0.test(Z))throw new C("invalid_hands_workspace","Reason Hands run identity is invalid.");let G=K0(v0({kind:"managed",workspaceId:$,...X?{base:X}:{},...J?{layout:J}:{}})),z=q7(Q,K0(G)),H=o(z,K7(G)),Y=!1;try{let K=t(H);if(Y=!0,K.isSymbolicLink())throw new C("invalid_hands_workspace","Reason Hands workspace cannot be a symbolic link.");if(!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands workspace must be a managed directory.")}catch(K){if(K instanceof C||!(K&&typeof K==="object"&&("code"in K)&&K.code==="ENOENT"))throw K}if(J&&!Y)try{let K=o(n(Q),K0(v0({kind:"managed",workspaceId:$,...X?{base:X}:{}}))),L=t(K);if(!L.isSymbolicLink()&&L.isDirectory()&&n(K)===K)K8(K,H),Y=!0}catch{}if(Z&&Z!==$){let K=o(z,Z);try{let L=t(K);if(L.isSymbolicLink()||!L.isDirectory())throw new C("invalid_hands_workspace","Reason Hands legacy workspace must be a managed directory.");let B=n(K);if(K0(B)!==z)throw new C("invalid_hands_workspace","Reason Hands legacy workspace escaped its managed parent.");let W=null;if(Y){W=o(z,`.${$}.previous`);try{throw t(W),new C("invalid_hands_workspace","Reason Hands previous workspace backup already exists.")}catch(M){if(M instanceof C||!(M&&typeof M==="object"&&("code"in M)&&M.code==="ENOENT"))throw M}K8(H,W)}try{K8(B,H)}catch(M){if(W)K8(W,H);throw M}Y=!0}catch(L){if(L instanceof C||!(L&&typeof L==="object"&&("code"in L)&&L.code==="ENOENT"))throw L}}W9(H,{recursive:!0,mode:448}),E9(H,448);let V=n(H);if(K0(V)!==z)throw new C("invalid_hands_workspace","Reason Hands workspace escaped its managed parent.");let U=o(V,"repo");try{let K=t(U);if(K.isSymbolicLink()||!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.")}catch(K){if(K instanceof C||!(K&&typeof K==="object"&&("code"in K)&&K.code==="ENOENT"))throw K}W9(U,{recursive:!0,mode:448}),E9(U,448);let F=n(U);if(K0(F)!==V)throw new C("invalid_hands_workspace","Reason Hands repository escaped its managed run workspace.");return{workRoot:V,repoPath:F}}function X4($){let Q=null;try{Q=t($)}catch{}if(!Q||Q.isSymbolicLink()||!Q.isDirectory()||Q.uid!==0||Q.gid!==0||(Q.mode&4095)!==493)throw new C("cloud_workspace_root_invalid","This cloud Session's workspace root is not root's 0755 directory, so Reason Hands cannot use it.")}function O7($,Q){let Z="/";for(let X of["",...$.split("/"),...Q.split("/")].filter((J,G)=>G===0||J)){if(X)Z=o(Z,X);let J;try{J=t(Z)}catch{return null}if(J.uid!==0)return J.uid;if((J.mode&2)!==0&&(J.mode&512)===0&&!J.isSymbolicLink())return-1;if(J.isSymbolicLink()||!J.isDirectory())return null}return null}function D7($,Q,Z,X=process.geteuid?.(),J){if(!k0.test(Q))return null;let G,z;try{G=n($),z=K0(v0({kind:"managed",workspaceId:Q,...Z?{base:Z}:{},...J?{layout:J}:{}}))}catch{return null}let H=o(G,z),Y=F$(H)!==null,V=(B)=>new C("cloud_workspace_root_invalid",B),U;if(X===0){let B=O7(G,z);if(B===null)return null;if(!Y)throw new C("invalid_hands_workspace","As root, Reason Hands never prepares a workspace in folders another user owns.");U=B}else{if(!Y)return null;let B,W;try{B=t(K0(H)),W=t(H)}catch{return null}if(B.isSymbolicLink()||!B.isDirectory()||B.uid===0||W.uid!==0)return null;U=B.uid}let F=G;for(let B of z.split("/")){let W=o(F,B),M=!1;try{let _=t(W);M=!_.isSymbolicLink()&&_.isDirectory()&&n(W)===W}catch{}if(!M)throw V("This cloud Session's workspace root is missing or is not a real directory.");F=W}X4(H);let K;try{K=J4(H)}catch(B){if(B instanceof C)throw B;throw V("This cloud Session's workspace root changed while Reason Hands checked it.")}let L=null;try{L=S9(K.repoPath).uid}catch{}if(L!==U)throw new C("invalid_hands_workspace","Reason Hands repository must belong to the cloud Session's user.");return K}function J4($,Q=!1){let Z=n($),X=o(Z,"repo"),J;try{J=t(X)}catch{throw new C("invalid_hands_workspace","Reason Hands repository is missing from the granted root.")}if(Q){if(!/^\/var\/lib\/reason\/sessions\/[0-9a-f-]{36}$/.test(Z))throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");if(z8(Z.slice(Z.lastIndexOf("/")+1)).runtimeRoot!==Z)throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");let H=n("/workspace"),Y=n(X);if(H!=="/workspace"||!S9(Y).isDirectory()||!Y.startsWith("/workspace/"))throw new C("invalid_hands_workspace","Personal files escaped the personal computer.");return{workRoot:Z,repoPath:Y}}let G=jZ(Z);if(G&&J.isSymbolicLink()){let H=n(X);if(H!==n(G)||!S9(H).isDirectory())throw new C("invalid_hands_workspace","Side chat repository must be its parent's checkout.");return{workRoot:Z,repoPath:H}}if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.");let z=n(X);if(K0(z)!==Z)throw new C("invalid_hands_workspace","Reason Hands repository escaped its granted root.");return{workRoot:Z,repoPath:z}}function W$($,Q,Z){if(Q!==void 0&&!p0(Q))throw new C("invalid_hands_workspace",`Reason Hands ${Z} is invalid.`);let X=$4($,Q??".");if(!R0($,X))throw new C("invalid_hands_workspace",`Reason Hands ${Z} escapes its granted root.`);return X}function Y4($,Q,Z){if(r8(Q)){let X=n(Z);return{anchor:X,target:$4(X,Q),boundary:o(X,K9)}}return{anchor:$,target:W$($,Q,"folder"),boundary:$}}function _7($,Q){if(!R0($,Q))throw new C("invalid_hands_workspace","Reason Hands folder escapes its granted root.");let Z=$;for(let X of Q.slice($.length).split("/").filter(Boolean)){Z=o(Z,X);let J=null;try{J=t(Z)}catch(G){if(G.code!=="ENOENT")throw G}if(!J)W9(Z,{mode:448});else if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands folder must be made of real directories.")}}function G4($,Q){let Z=n(W$($,Q.source_path,"repository"));if(!R0($,Z)||!S9(Z).isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a folder in its granted root.");return Z}async function A7($,Q,Z,X=W8()){try{let J=n($);if(V$(Y4(J,Q,X).target))return;return await _Z(G4(J,Z))??void 0}catch{return}}function x7($,Q,Z,X,J=P7,G=W8()){let z=n($),{target:H,boundary:Y,anchor:V}=Y4(z,Q,G);if(Z&&!V$(H)){let K=G4(z,Z);_7(V,K0(H));let L=["-c","core.hooksPath=/dev/null","-C",K];if(X)J([...L,"update-ref","--create-reflog","-m",X.note,`refs/heads/${Z.branch}`,X.commit,""]);let B=X?J([...L,"worktree","add",H,Z.branch]):J([...L,"worktree","add","-b",Z.branch,H]);if(!X&&B.status!==0&&/already exists/.test(B.stderr)&&!V$(H))B=J([...L,"worktree","add",H,Z.branch]);if(B.status!==0)throw new C(/not a git repository/i.test(B.stderr)?"workspace_not_git_repository":"workspace_worktree_failed","Reason could not create this Session's git worktree.")}let U;try{U=t(H)}catch{throw new C("workspace_folder_missing","This Session's folder no longer exists.")}let F=n(H);if(U.isSymbolicLink()&&!R0(Y,F))throw new C("invalid_hands_workspace","Reason Hands folder resolves outside its granted root.");if(!S9(F).isDirectory()||!R0(Y,F))throw new C("invalid_hands_workspace","Reason Hands folder must be a directory in its granted root.");if(E0(F))throw new C("protected_path","Credential and secret folders are unavailable to Sessions.");return F}function P7($){let Q=e6("git",$,{encoding:"utf8",timeout:60000,env:{...process.env,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});return{status:Q.status,stderr:Q.stderr??""}}function z4($){return dZ($)??F$($)?.jobEnv??o($,"job.env")}function I7($,Q){let Z=z4($),X=t(Z);if(X.isSymbolicLink()||!X.isFile())throw new C("invalid_hands_workspace","Reason Hands job environment must be a managed regular file.");J7(Z,Q),E9(Q,384)}function R7($){if($.workspaceMode===U0&&$.workspacePath!==void 0){let z=$.home??W8(),H=x7($.grantedRoot,$.workspacePath,$.workspaceWorktree,$.workspaceWorktreeStart,void 0,z);if($.workspaceWorktree&&$.deviceId)IZ(z,$.workspacePath,$.deviceId);return{workRoot:H,repoPath:H,workspace:{kind:"root",path:$.workspacePath},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}if($.workspaceMode===w0)return{...J4($.grantedRoot,$.personalWorkspace),workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1};if($.workspaceMode===G9||$.workspaceMode===U0){let z=t($.grantedRoot);if(z.isSymbolicLink()||!z.isDirectory())throw new C("invalid_hands_workspace","Reason Hands root must be a real directory.");let H=n($.grantedRoot);return{workRoot:H,repoPath:H,workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}let Q=$.workspaceId??$.runId,Z={kind:"managed",workspaceId:Q,...$.workspaceBase?{base:$.workspaceBase}:{},...$.workspaceLayout?{layout:$.workspaceLayout}:{}},X=p9($.grantedRoot,Z,$.home).anchor,J=D7(X,Q,$.workspaceBase,void 0,$.workspaceLayout);if(J)return{...J,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1,cloudSessionRoot:!0};let G=T7(Q,X,$.legacyWorkspaceId,$.workspaceBase,$.workspaceLayout);return{...G,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:K0(G.workRoot),managedWorkspace:!0}}function E7($){let{command:Q,prefix:Z}=S8($.executablePath,$.sourceEntrypoint),X=G8({home:z7(),temporaryDirectory:$.temporaryDirectory,path:$.path});if(X.REASON_DEVICE_ROOT=X.ARA_DEVICE_ROOT=$.grantedRoot,X.REASON_HANDS_WORKSPACE=X.ARA_HANDS_WORKSPACE=$.workRoot,X.REASON_HANDS_REPO=X.ARA_HANDS_REPO=$.root,$.workspacePoolPath)X.REASON_HANDS_WORKSPACE_POOL=X.ARA_HANDS_WORKSPACE_POOL=$.workspacePoolPath;return{command:Q,args:[...Z,"__device","__hands-worker","--config",$.configPath],options:{cwd:$.root,env:X,shell:!1,stdio:["ignore","ignore","pipe"]}}}function S7($,Q){let Z="",X=!1,J=Date.now(),G=0,z=new Set(["connecting","open","dial_pending","socket_error","close","claim_accepted","claim_rejected","stopping","stopped","request_cancelled"].map((F)=>`hands.worker.${F}`)),H=new Set([null,"open_not_received","current_connection","obsolete_connection","request_aborted","request_timeout","client_closed","driver_stopped","driver_handoff","run_cancelled","run_finished","other","frame_too_large","invalid_json","invalid_claim","executor_mismatch","stale_generation","fence_conflict","SIGTERM","SIGINT","SIGHUP","expired","cleanup_complete","cleanup_failed","cancelled","settled","unsupported","unconfirmed"]),Y=["timestampMs","connectionAttempt","connectionGeneration","targetGeneration","activeRequestCount","remainingLifetimeMs","suppressedDiagnostics"],V=["peerGeneration","socketState","closeCode"],U=new Set(["event","reason","launchId",...Y,...V]);return(F)=>{for(let K of F.toString().split(/(?<=\n)/)){let L=K.endsWith(`
|
|
458
458
|
`);if(!X&&Z.length+K.length<=2048)Z+=K;else X=!0;if(!L)continue;let B=Z;if(Z="",X){X=!1;continue}try{let W=JSON.parse(B);if(!W||typeof W!=="object"||Array.isArray(W)||Object.keys(W).some((M)=>!U.has(M))||!z.has(W.event)||!H.has(W.reason)||W.launchId!==$||Y.some((M)=>!Number.isSafeInteger(W[M])||W[M]<0)||V.some((M)=>W[M]!==null&&(!Number.isSafeInteger(W[M])||W[M]<0)))continue;if(Date.now()-J>=60000)J=Date.now(),G=0;if(G>=122)continue;G+=1,Q(W)}catch{}}}}async function w7($){let Q=$.now()+$.timeoutMs;while($.now()<Q){if($.signal.aborted)throw new C("cancelled","Reason Hands start was cancelled.");if($.spawnFailed?.()||$.child.exitCode!==null||$.child.signalCode!==null)throw new C("hands_worker_exited","Reason Hands exited before ready.");let Z=J8($.path,{pid:$.child.pid??-1,launchId:$.launchId,workerVersion:U9,protocolVersion:F9,workerArtifactSha256:z0,workerEntrypoint:u0});if(Z?.targetGeneration===$.targetGeneration&&Z.fenceId===$.fenceId)return Z;await new Promise((X)=>setTimeout(X,10))}throw new C("hands_ready_timeout","Reason Hands did not become ready.")}async function b7($,Q){let Z=()=>$.exitCode===0&&$.signalCode===null;if($.exitCode!==null||$.signalCode!==null)return Z()?"stopped":"already_exited";let X=new Promise((z)=>$.once("exit",()=>z()));try{if(!$.kill("SIGTERM"))return Z()?"stopped":"unobserved"}catch{return Z()?"stopped":"unobserved"}if(await nZ(X,Q))return Z()?"stopped":"unobserved";try{$.kill("SIGKILL")}catch{}return await nZ(X,Q)?"forced":"unobserved"}async function nZ($,Q){let Z;try{return await Promise.race([$.then(()=>!0),new Promise((X)=>{Z=setTimeout(()=>X(!1),Q)})])}finally{clearTimeout(Z)}}function k7($){return new Promise((Q)=>{let Z=!1,X=(H)=>{if(Z)return;Z=!0,clearTimeout(z),$.signal.removeEventListener("abort",J),$.child.off("exit",G),Q(H)},J=()=>X("cancelled"),G=()=>X("exited"),z=setTimeout(()=>X("expired"),Math.max(0,$.expiresAt-$.now()));if($.signal.addEventListener("abort",J,{once:!0}),$.child.once("exit",G),$.signal.aborted)J();else if($.child.exitCode!==null||$.child.signalCode!==null)G()})}var K4=tZ();function f7($,Q){if(!($ instanceof Error)||$ instanceof C)return!1;let Z=["hands_browser_driver_missing","hands_browser_driver_version_mismatch","hands_browser_executable_missing","hands_browser_unsupported_platform","hands_browser_unavailable"].includes($.message),X=["ENOENT","EACCES","EPERM"].includes($.code??"");if(!Z&&!X)return!1;try{return t(Q),!1}catch(J){return V9(J)&&J.code==="ENOENT"}}function m7($){return $.sandbox_provider==="compute"&&!$.cloud_browser&&!$[W0]&&$[p]===w0}function g7($,Q,Z){return $===void 0?{}:{dispatch_stages:{version:1,claim_to_entered_ms:H0($,Q),...Z===void 0?{}:{worker_prespawned:Z}}}}function _Y(){K4().catch(()=>{return}),X9().catch(()=>{return})}async function AY($,Q={}){let Z=Q.logDiagnostic??((N)=>console.warn(N)),X=new Map,J=(N)=>{let j=Date.now();X.set(N,j);try{Z(JSON.stringify({event:"sandbox.hands_startup",stage:N,timestampMs:j}))}catch{}};J("entered");let G=$.claimEnvironment;$.claimEnvironment=void 0;let z=Q.now??Date.now,H,Y=M7($.payload,Q.now?.(),(N)=>{H=N});if($.managedPty&&($.managedPty.version!==1||!$.headless||!$.runtimeDirectory||![void 0,!0].includes($.managedPty.startupVerified)||!$.deviceIdentity||!$.claimOwner||$.claimOwner.device_id!==$.deviceIdentity.deviceId||!Y.environment_binding||!["darwin","linux"].includes(process.platform)))throw new C("pty_unsupported","Bound PTY requires qualified headless Hands with private jobs and environment.");let V=async(N)=>{let j;try{await Promise.race([N,new Promise((A,m)=>{j=setTimeout(()=>m(new C("hands_event_delivery_unavailable","Hands event delivery did not settle within its deadline.")),Math.max(1,Math.min(Q.eventDeliveryTimeoutMs??5000,5000)))})])}finally{clearTimeout(j)}},U=async(N,j)=>V($.emitEvent(N,j));if($.headless&&(Y.cloud_browser===!0||$.managedBrowser!==void 0||Y[W0]!==void 0||Y[z9]!==void 0||Y[p]!==void 0&&Y[p]!==U0))throw new C("invalid_hands_request","Managed sandbox extensions are unavailable to a headless worker.");let F=U$(),K=Y[b0]===void 0?null:W7(F);if(Y[b0]!==void 0&&(K===null||!$.headless||!sZ($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_model_jobs_egress_unavailable","This worker cannot hold its jobs to the guest egress guard; the Hands did not start.");if(Y[n0]!==void 0&&!($.headless&&sZ($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_confinement_unavailable","Confined Hands need a root Linux worker in host mode.");if(Y.cloud_browser&&process.platform!=="linux")throw new C("cloud_browser_target_invalid","Cloud browser is available only on a cloud machine.");let L=`${$.operationId}:${$.attemptId}`,B=Y[p]===G9,W=$.headless||process.platform==="darwin"&&$.managedBrowser===void 0&&!Y.cloud_browser&&!Y.browser_egress&&!Y[W0]&&(Y[p]===void 0||Y[p]===U0)||m7(Y),M=B?Y[z9]??"bash":null,_=M?TZ(M):null;if(_)throw new C(_,"Persistent Node REPL execution is unavailable; this benchmark profile cannot start.");let q=Y[p],D=$.headless===!0?$.handsSlots??1:void 0,x=(Q.slot??C7).acquire(L,{exclusive:D===1||q!==void 0&&q!==U0,...D!==void 0&&D>1?{limit:D}:{},...$.headless===!0&&Y[N0]!==void 0?{group:Y[N0]}:{}});if(!x)throw new C("hands_slot_busy",D!==void 0&&D>1?`This Reason worker runs at most ${D} sessions at a time.`:"This Reason Device runs one session at a time.");let b=$.headless===!0?oZ($.runId):null,T=null,k=null,g,O;try{J("browser_resolution");let N=$.headless&&Q.browserExecutablePath===void 0?await X9():null,j=B||Y.cloud_browser?null:Q.browserExecutablePath===void 0?$.headless?N?.status==="resolved"?N.executablePath:null:await BZ(void 0,process.platform,$.managedBrowser):Q.browserExecutablePath;if(!B&&!Y.cloud_browser&&!W&&!j)throw new C("hands_browser_unavailable","Reason Hands requires Chrome, Edge, Brave, Chromium, or a Playwright Chromium install.");J("path_resolution");let A;try{A=await(Q.resolvePathEnvironment??K4)()}catch{A={path:rZ(),source:"fallback"}}if(J("workspace_setup"),process.platform==="darwin"){let s=Y[p]===U0&&Y.workspace_path!==void 0?W$($.root,Y.workspace_worktree?Y.workspace_worktree.source_path:Y.workspace_path,"folder"):null;for(let Z0 of new Set([$.root,...s?[s]:[]]))await hQ(Z0)}let w=Y[p]===w0||Y[p]===G9?U7(process.platform,Q.sandboxRuntimeRoot):null,E=$.headless&&$.runtimeDirectory?$.runtimeDirectory:w?w.temporaryRoot:eZ();if(T="private_runtime",$.headless&&$.runtimeDirectory){T9(E);let s=n($.root);if(!_9(s,E))throw new C("invalid_hands_workspace","Private worker state must not overlap the granted workspace.")}if($.headless&&$.runtimeDirectory&&(!$.deviceIdentity||!Y.environment_binding))throw new C("environment_unavailable","Headless Hands requires a server-bound private environment.");if(T="runtime_root",w?.prepareRoot)W9(E,{recursive:!0,mode:457}),E9(E,457);T="temporary_directory";let P=n(Y7(o(E,"reason-hands-session-")));k=P,E9(P,w?.sessionMode??448);let f=o(P,"hands-config.json"),d=o(P,"hands-ready.json"),u=r6(),l=Y.target_fence_id;T="granted_root";let S=n($.root);T="workspace_layout";let h=Y[p]===U0&&Y.workspace_path!==void 0&&Y.workspace_worktree?await A7(S,Y.workspace_path,Y.workspace_worktree):void 0,{workRoot:c,repoPath:a,jobEnvPath:V0,workspacePoolPath:B8,managedWorkspace:D0,workspace:i0,cloudSessionRoot:w9}=R7({grantedRoot:S,personalWorkspace:Y.personal_workspace===!0,runId:$.runId,workspaceId:Y.workspace_id,legacyWorkspaceId:Y.legacy_workspace_id,workspaceBase:Y[l0],workspaceLayout:Y[s0],temporaryDirectory:P,workspaceMode:Y[p],applicationSupportPath:Q.applicationSupportPath,...Y.workspace_path===void 0?{}:{workspacePath:Y.workspace_path},...Y.workspace_worktree?{workspaceWorktree:Y.workspace_worktree}:{},...h?{workspaceWorktreeStart:h}:{},...$.deviceIdentity?{deviceId:$.deviceIdentity.deviceId}:{}}),f0=L7(Y);T="jobs";let r=$.headless&&$.runtimeDirectory?JQ({runtimeDirectory:$.runtimeDirectory,root:S,runId:$.runId}):void 0;g=r?.disposeSocket;let B0=r?YQ(r):null;if(B0)try{Z(JSON.stringify({event:"hands.journal_owner_retired",run_id:$.runId,reason:B0.reason,prior_executor_launch_id:B0.executorLaunchId}))}catch{}if(r&&[c,a].some((s)=>!_9(s,r.journalDirectory)))throw new C("invalid_hands_workspace","A Session can't work in the folder that holds this worker's settings; start it in a project or repository inside it.");let a0=Y.personal_workspace?c.slice(c.lastIndexOf("/")+1):void 0;if(a0&&a0!==Y.workspace_id)throw new C("invalid_hands_workspace","Personal session identity does not match its Device grant.");T="browser_socket";let F0=Y.cloud_browser?B7(Y.sandbox_os,a0):o(r?K0(r.socketPath):P,"repl.sock");T="relay_url";let L0=Q4(new URL(Y.relay_url).hostname),m0=f0==="ara_device_wss"&&!L0?(Q.loadProxy??w8)()?.url:void 0,Y0;T="environment_owner";let X0=$.headless&&$.deviceIdentity&&Y.environment_binding?EZ(P,{runId:$.runId,...$.deviceIdentity,binding:Y.environment_binding,expiresAtMs:Date.parse(Y.expires_at),identity:()=>Y0?.()??null}):void 0;T="job_environment";let B9=!X0&&i0.kind==="managed"&&D0?o(c,"job.env"):null;if(B9)try{H8(B9,"",{mode:384,flag:"wx"})}catch(s){if(!(s instanceof Error&&("code"in s)&&s.code==="EEXIST"))throw s}let L8={url:Y.relay_url,transport:f0,...m0===void 0?{}:{proxyUrl:m0},...$.localGithubConfinement?{localGithubConfinement:!0}:{},...Y[n0]&&X0?{gitCredentialEnvironment:!0}:{},workerVersion:U9,protocolVersion:F9,workerArtifactSha256:z0,workerEntrypoint:u0,targetGeneration:Y.target_generation,fenceId:l,workRoot:c,workspaceAliasPath:c,jobEnvPath:V0,...X0?{environmentSnapshotPath:X0.path,...$.hostExecution?{executionEnvironment:RQ()}:{},environmentExpectedBinding:{runId:$.runId,...$.deviceIdentity,binding:Y.environment_binding}}:B9?{jobEnvSourcePath:B9,workspacePoolPath:K0(c)}:D0?{}:{jobEnvSourcePath:z4(c)},repoPath:a,replSocketPath:F0,...Y.cloud_browser?{browserRunId:$.runId}:{},readyPath:d,launchId:u,expiresAtMs:Date.parse(Y.expires_at),bashTimeoutMs:300000,replTimeoutMs:120000,...r?{managedJobs:{journalDirectory:r.journalDirectory,scopeId:r.scopeId},jobControlSocketPath:r.socketPath}:{},...r&&F?{jobsUser:{...F,...K!==null?{modelGid:K}:{}}}:{},...$.managedPty&&r&&X0?{managedPty:{version:1,...$.managedPty.startupVerified===!0?{persistent:!0}:{},...process.platform==="darwin"?{shell:EQ()}:{}}}:{},...W&&!j?{allowedTools:["bash","read","write","edit"]}:B?{allowedTools:M==="bash"?["bash"]:["bash","repl"]}:{}};if(X0||D0&&!B9)H8(V0,"",{mode:384});else I7(c,V0);T="config_write",H8(f,JSON.stringify(L8),{mode:384}),T=null;let g0={session_id:Y.session_id,environment_id:Y.environment_id,hands_protocol_version:F9,hands_worker_version:U9,hands_worker_artifact_sha256:z0,hands_worker_entrypoint:u0,target_generation:Y.target_generation,target_fence_id:Y.target_fence_id,executor_launch_id:u},b9=null,B$=!1,L$=!1,N$,Q0=null,M$,j$,k9="failed",C$=null,N8=Promise.resolve(),q$=null,M8=async(s,Z0)=>{try{await U(s,Z0)}catch{}};try{J("event_started");let s,Z0=(async()=>{await $.emitEvent("hands.started",{...g0,policy_mode:"full_access",policy_version:1,path_source:A.source}),s=Date.now()})();Z0.catch(()=>{return}),J("worker_setup");let f9=Y.browser_egress?{mode:"enforce",allowedDomains:Y.browser_egress.allowed_domains}:{mode:"off"};if(M&&M!=="bash")b9=await(Q.startNodeRepl??hZ)({socketPath:F0,workRoot:c});else if(!B&&!Y.cloud_browser&&j)b9=await(Q.startRepl??LZ)({socketPath:F0,browserExecutablePath:j,workspaceRoot:a,...$.managedBrowser?{managedBrowser:$.managedBrowser}:{},...$.desktopRecording?{recording:$.desktopRecording}:{},networkPolicy:f9,onEgressDenied:(y)=>{let M0=CZ(y.host);Z(JSON.stringify({event:"sandbox.repl_egress_denied",destination_id:M0,reason:y.reason,run_id:$.runId})),N8=N8.then(()=>U("hands.browser_egress_denied",{destination_id:M0,reason:y.reason})).catch((V4)=>{q$??=V4})}}).catch((y)=>{if(!W||$.signal.aborted||z()>=Date.parse(Y.expires_at)||!f7(y,F0))throw y;return Object.assign(L8,{allowedTools:["bash","read","write","edit"]}),H8(f,JSON.stringify(L8),{mode:384}),L$=!0,null});let T$=E7({configPath:f,root:a,grantedRoot:S,workRoot:c,workspacePoolPath:B8,temporaryDirectory:P,path:A.path,executablePath:Q.executablePath,sourceEntrypoint:Q.sourceEntrypoint}),j8=Date.now(),C8,O$,q8=Q.takePrespawnedWorker?.(T$)??null;if(N$=Q.takePrespawnedWorker?q8!==null:void 0,Q0=q8??(Q.spawnWorker??((y)=>t6(y.command,y.args,y.options)))(T$),!q8)Q.adoptSpawnedWorker?.(Q0);Q0.stderr?.on("data",S7(u,(y)=>{if(y.event==="hands.worker.connecting")C8??=y.timestampMs;else if(y.event==="hands.worker.open")O$??=y.timestampMs;Z(JSON.stringify({...y,run_id:$.runId}))}));let D$=!1;Q0.on("error",()=>{D$=!0}),Q0.once("exit",(y,M0)=>{try{Z(JSON.stringify({event:"hands.worker.exited",run_id:$.runId,launchId:u,exit_code:y,exit_signal:M0}))}catch{}}),O=Q0,J("worker_ready_wait");let L9=await w7({path:d,launchId:u,fenceId:l,targetGeneration:Y.target_generation,child:Q0,spawnFailed:()=>D$,signal:$.signal,timeoutMs:Q.readyTimeoutMs??H7,now:z}),H4=Date.now();if(Y0=()=>{if(!Q0||Q0.exitCode!==null||Q0.signalCode!==null)return null;let y=J8(d,L9);return y?{generation:y.targetGeneration,fenceId:y.fenceId}:null},r){let y={root:S,runId:$.runId,operationId:$.operationId,scopeId:r.scopeId,socketPath:r.socketPath,generation:L9.targetGeneration,fenceId:L9.fenceId,executorLaunchId:u,expiresAtMs:Date.parse(Y.expires_at),readIdentity:Y0,workspace:i0,localGithubConfinement:$.localGithubConfinement===!0};if(X0)y.environment=X0;if($.claimOwner&&$.deviceIdentity&&$.claimOwner.device_id===$.deviceIdentity.deviceId){let M0=[$.deviceIdentity.apiOrigin,Y.relay_url];if(m0)M0.push(m0);y.previewAuthority={owner:Object.freeze({...$.claimOwner}),rootId:$.deviceIdentity.rootId,relayOrigin:new URL(Y.relay_url).origin,deniedPorts:y$(M0)}}j$=GQ(y)}if(await new Promise((y)=>{setImmediate(y)}),w9)X4(c);let m9;if(G&&X0){try{let y=X0.install(G);m9={snapshot_id:y.snapshot_id,installed_revision:y.installed_revision}}catch{}try{Z(JSON.stringify({event:"hands.environment_at_claim",run_id:$.runId,installed:m9!==void 0}))}catch{}}G=void 0,J("event_ready");let _$=V(Z0);_$.catch(()=>{return});let A$=Date.now();B$=!0,await U("hands.ready",{...g0,expiry_diagnostic:H,startup_stages:{version:1,browser_resolution_ms:H0(X.get("browser_resolution"),X.get("path_resolution")),path_resolution_ms:H0(X.get("path_resolution"),X.get("workspace_setup")),workspace_setup_ms:H0(X.get("workspace_setup"),X.get("event_started")),repl_setup_ms:H0(X.get("worker_setup"),j8),worker_boot_ms:H0(j8,C8),worker_dial_ms:H0(C8,O$),worker_ready_ms:H0(j8,H4),started_event_ms:H0(X.get("event_started"),s),started_join_wait_ms:H0(X.get("event_ready"),A$),total_ms:H0(X.get("entered"),A$)},...g7($.claimedAtMs,X.get("entered"),N$),...$.managedPty?.startupVerified===!0?{managed_pty:{version:1,execution_mode:"host",descendant_cleanup_verified:!0}}:{},policy_mode:"full_access",policy_version:1,path_source:A.source,connection_generation:L9.generation,...m9?{environment_installed:m9}:{},...W&&!b9?{browser_state:"unavailable",browser_reason_code:L$?"setup_failed":"not_resolved"}:{viewport_width:1440,viewport_height:900}}),await _$,J("ready"),M$=mZ({path:d,initial:L9,signal:$.signal,isAlive:()=>Q0!==null&&Q0.exitCode===null&&Q0.signalCode===null&&z()<Date.parse(Y.expires_at),publish:(y,M0)=>$.emitEvent("hands.reconnected",{...g0,target_generation:y.targetGeneration,target_fence_id:y.fenceId,connection_generation:y.generation},M0),failed:()=>Z(JSON.stringify({event:"hands.worker.generation_proof_failed",run_id:$.runId,executor_launch_id:u}))});let x$=await k7({child:Q0,signal:$.signal,expiresAt:Date.parse(Y.expires_at),now:z});if(x$==="cancelled"){let y=$.signal.reason instanceof C?$.signal.reason.code:"cancelled";throw k9=y,new C(y,"Reason Hands was cancelled.")}if(x$==="exited")throw new C("hands_worker_exited","Reason Hands exited unexpectedly.");return k9="expired",{...g0,policy_mode:"full_access",policy_version:1,ended:"expired"}}catch(s){C$=s;let Z0=s instanceof C?s.code:"hands_failed",f9=Z0==="cancelled"||["run_finished","run_cancelled","driver_handoff","driver_stopped"].includes(Z0);if(k9=f9?Z0:"failed",!f9)await M8("hands.failed",{...g0,reason_code:Z0});throw s}finally{M$?.stop(),j$?.();let s=Q0?await b7(Q0,Q.stopTimeoutMs??V7):null,Z0=!1;await $.desktopRecording?.close();try{await b9?.stop()}catch{Z0=!0}if(await N8,(s==="stopped"||s==="already_exited"&&!B$)&&!Z0)await M8("hands.stopped",{...g0,reason_code:k9});else if(s!==null||Z0){if(await M8("hands.failed",{...g0,reason_code:s==="forced"?"hands_stop_forced":"hands_stop_unconfirmed"}),C$===null||Z0)throw new C("hands_stop_unconfirmed","Reason Hands resource cleanup could not be proven.")}if(q$!==null)throw new C("hands_egress_audit_failed","Reason Hands could not persist a browser egress denial receipt.")}}catch(N){let j=NZ(T,N);if(j)try{Z(JSON.stringify({event:"sandbox.hands_workspace_failed",...j}))}catch{}throw N}finally{try{if(!O||O.exitCode!==null||O.signalCode!==null)g?.();if(k!==null&&(!O||O.exitCode!==null||O.signalCode!==null))G7(k,{recursive:!0,force:!0})}finally{b?.(),x()}}}
|
|
459
459
|
export{v as ga,E$ as ha,S$ as ia,j4 as ja,f$ as ka,g$ as la,y$ as ma,H2 as na,JQ as oa,_2 as pa,A2 as qa,x2 as ra,P2 as sa,I2 as ta,R2 as ua,KQ as va,E2 as wa,w2 as xa,p as ya,U0 as za,OX as Aa,DX as Ba,hX as Ca,vX as Da,NQ as Ea,l9 as Fa,T9 as Ga,O9 as Ha,AQ as Ia,EZ as Ja,l2 as Ka,xQ as La,RQ as Ma,EQ as Na,M5 as Oa,j5 as Pa,J0 as Qa,C5 as Ra,q5 as Sa,T5 as Ta,E5 as Ua,u3 as Va,S5 as Wa,_9 as Xa,R0 as Ya,w5 as Za,X9 as _a,n3 as $a,i3 as ab,tQ as bb,p5 as cb,A9 as db,y1 as eb,G$ as fb,dZ as gb,sZ as hb,U$ as ib,W7 as jb,OY as kb,DY as lb,Z4 as mb,j7 as nb,X4 as ob,J4 as pb,E7 as qb,_Y as rb,AY as sb};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{t as u0}from"./vm-hands-entry-lite-250sqsry.js";import{A as Z5,B as Q5,C as j7,D as z7,E as v3,F as p5,G as G5,H as _0,I as l$,J as p$,K as E0,L as J2,M as c5,N as i0,O as H6,P as Z3,Q as o5,U as e5,ba as R7,ca as C7,da as I7,ea as P7,fa as u3,y as v6,z as g6}from"./vm-hands-entry-lite-
|
|
2
|
+
import{t as u0}from"./vm-hands-entry-lite-250sqsry.js";import{A as Z5,B as Q5,C as j7,D as z7,E as v3,F as p5,G as G5,H as _0,I as l$,J as p$,K as E0,L as J2,M as c5,N as i0,O as H6,P as Z3,Q as o5,U as e5,ba as R7,ca as C7,da as I7,ea as P7,fa as u3,y as v6,z as g6}from"./vm-hands-entry-lite-tqn3a245.js";import{Aa as X5,Ba as Y5,Ca as T7,Da as _7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as M5,Ka as W7,La as W$,Oa as V4,Pa as H4,Qa as zJ,Ra as OJ,Sa as AJ,Ta as k0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as L7,db as K6,fb as k8,ha as s7,ib as u2,ka as W5,kb as l5,la as L5,lb as T3,nb as b5,oa as q5,qa as C5,rb as D7,sb as N3,ta as I5,ya as S5,za as w5}from"./vm-hands-entry-lite-pkwvjyy8.js";import{Ab as P5,Bb as x5,Ib as E5}from"./vm-hands-entry-lite-5rbj89cs.js";import{Nb as B5}from"./vm-hands-entry-lite-mk9p22xa.js";import{Ub as d5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Ac as G4,Ec as a5,Hc as O7,Kc as u6,Lc as d6,mc as i1,nc as Y1,oc as _1,pc as L$,qc as GJ,rc as CJ,sc as IJ,tc as D$,uc as PJ,vc as e3,wc as xJ,xc as Y4,yc as F1,zc as I8}from"./vm-hands-entry-lite-dhngjmag.js";import{Bd as J5,Hd as $$,Rd as F2,Vc as b2,Zc as q7,_c as M7}from"./vm-hands-entry-lite-5zzey257.js";import{ae as B}from"./vm-hands-entry-lite-h7ndfgwc.js";import{ie as RJ,je as o2,me as A7,pe as n$,re as aJ,se as iJ,xe as t5}from"./vm-hands-entry-lite-d9h818st.js";import{$e as h1,Be as b0,Ce as k$,Ee as P0,Fe as j4,He as o0,Ie as z0,Je as w9,Ke as DJ,Le as jJ,Me as E2,Ne as q2,Oe as f3,Pe as R8,Qe as C8,Re as Y$,Se as v$,Te as Y0,Ue as T2,Ve as S7,We as w7,Xe as e1,Ye as R4,_e as Q3,af as m0,bf as y$,cf as X3,ff as m1}from"./vm-hands-entry-lite-zmf3vn3w.js";import{jf as R5}from"./vm-hands-entry-lite-mysjgrwy.js";import{hg as TJ,kg as s5,lg as h3,ng as K5}from"./vm-hands-entry-lite-znw0vvb2.js";import{Wg as Z2,Xg as u5}from"./vm-hands-entry-lite-cfjx91rj.js";import{$g as Y7,Zg as V0}from"./vm-hands-entry-lite-pr65ksfz.js";import{xh as r}from"./vm-hands-entry-lite-g7mf4fc7.js";import{Eh as F7}from"./vm-hands-entry-lite-d94sv87n.js";import{Jh as v0}from"./vm-hands-entry-lite-sn3vjjgx.js";import{spawn as EJ,spawnSync as lK}from"child_process";import{closeSync as SJ,mkdirSync as pK,openSync as wJ,readdirSync as cK,realpathSync as G1,rmSync as z$}from"fs";import{hostname as sK}from"os";import{dirname as $9,join as F0,resolve as aK}from"path";var rJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function U9($){let J=typeof $==="string"?rJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as XZ,randomBytes as j9}from"crypto";import{createInterface as YZ}from"readline";import{randomBytes as tJ}from"crypto";import{chmodSync as M9,existsSync as T9,lstatSync as oJ,mkdirSync as eJ,readFileSync as _9,renameSync as $Z,unlinkSync as F9,writeFileSync as W9}from"fs";import{homedir as JZ}from"os";import{dirname as ZZ,join as q9}from"path";function e0($=process.env,J=JZ()){let Z=$.XDG_CONFIG_HOME?.trim()||q9(J,".config"),X=P0({env:$})==="staging"?["staging"]:[];return q9(q2(Z,...X),"credentials.json")}function L9($,J=e0()){return eJ(ZZ(J),{recursive:!0,mode:448}),W9(J,`${JSON.stringify($,null,2)}
|
|
3
3
|
`,{mode:384}),M9(J,384),J}function P$($=e0()){if(!T9($))return null;try{let J=_9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=o0(Q);if(X!==Q)QZ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function QZ($,J,Z){let Q=`${$}.${process.pid}.${tJ(6).toString("hex")}.tmp`;try{let X=oJ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(W9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
|
|
4
4
|
`,{mode:384,flag:"wx"}),M9(Q,384),_9($,"utf8")!==J)throw Error("credentials_changed");$Z(Q,$)}catch{try{F9(Q)}catch{}}}function D9($=e0()){if(!T9($))return!1;return F9($),!0}class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function O9(){let $=j9(48).toString("base64url"),J=XZ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:j9(32).toString("base64url")}}function GZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function BZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw GZ(Y,`OAuth token request failed (${X.status})`);return Y}var KZ=1e4;async function VZ($,J={}){let Z=J.fetchImpl??fetch,Q=await BZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(KZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return L9(X,J.path??e0()),X}var M2=new Map;function z9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function b1($={}){let J=$.path??e0(),Z=P$(J);if(!Z)return null;let Q=$.apiOrigin??b0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),G=M2.get(Y);if(G)return z9(G,$.signal);let V;return V=VZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=P$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return b1({fetchImpl:$.fetchImpl,path:J});return D9(J),null}).finally(()=>{if(M2.get(Y)===V)M2.delete(Y)}),M2.set(Y,V),z9(V,$.signal)}function A9($,J){return new Promise((Z)=>{let Q=YZ({input:$}),X=!1,Y=(V)=>{if(X)return;X=!0,J.removeEventListener("abort",G),Q.close(),$.pause(),Z(V)},G=()=>Y(null);J.addEventListener("abort",G,{once:!0}),Q.once("line",(V)=>Y(V)),Q.once("close",()=>Y(null))})}var HZ=B.object({label:B.string(),used_percent:B.number().min(0).max(100).nullable(),resets_at:B.string().nullable(),exhausted:B.boolean().nullable()}),NZ=B.object({groups:B.array(B.object({selectable:B.boolean().optional(),accounts:B.array(B.object({source_id:B.string().min(1),model_ids:B.array(B.string().min(1)).optional()}))}))});function UZ($){let J=NZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var qZ=["minimal","low","medium","high","xhigh","max"],MZ=B.object({id:B.string().min(1),kind:B.string(),name:B.string(),custom_name:B.string().nullish(),status:B.string(),online:B.boolean(),compatible:B.boolean().optional(),compatibility_reason:B.string().nullish(),folder_lane_of:B.string().nullish(),roots:B.array(B.object({id:B.string().min(1),label:B.string()}))}),TZ=B.object({devices:B.array(MZ),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),_Z=B.object({id:B.string().min(1),name:B.string()}),FZ=B.object({items:B.array(_Z)}),WZ=B.object({skill_id:B.string().min(1),name:B.string(),description:B.string().nullish(),activation_keywords:B.array(B.string()).default([]),is_enabled:B.boolean().default(!0)}),LZ=B.object({items:B.array(WZ).default([])}),DZ=B.enum(["linux","macos"]),R9=B.object({id:B.string().min(1),name:B.string().min(1),platform:DZ.nullable(),workers:B.object({total:B.number().int(),online:B.number().int(),busy:B.number().int(),idle:B.number().int()}),sessions:B.object({queued:B.number().int(),running:B.number().int()})}),jZ=B.object({machines:B.array(R9)}),zZ=B.object({machine:R9}),OZ=B.object({deleted:B.literal(!0),revoked_workers:B.number().int(),revoked_tokens:B.number().int()}),AZ=B.object({token:B.object({id:B.string().min(1),machine_id:B.string().min(1),token_prefix:B.string()}),secret:B.string().startsWith("rmt_")}),C9=B.looseObject({machine_id:B.string().min(1),machine_name:B.string().min(1)}),RZ=C9.extend({organization_id:B.string().min(1)}),yV=B.object({id:B.string().min(1),name:B.string().min(1),state:B.enum(["waiting","placed"]),queue_position:B.number().int().nullable()});var fV=B.union([B.object({kind:B.literal("cloud")}),B.object({kind:B.enum(["mac","headless"]),device_id:B.string().min(1),root_id:B.string().min(1)})]);function k1($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var CZ=B.object({error:B.object({type:B.string(),message:B.string()})});function I9($,J,Z){let Q=CZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,G=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",V=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${G}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(V)&&V>=0?V*1000:void 0)}async function P9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw I9(J.status,Z,J.headers.get("retry-after"));return k1(RZ,Z,"invalid_machine_ticket")}class N1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let G=await b1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(G)return this.credentials=G,this.request($,J,!0)}if(!X.ok)throw I9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return k1(jZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return k1(zZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return k1(OZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return k1(AZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return k1(C9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=FZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return k1(LZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=TZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...G})=>({...G,...Array.isArray(Q)?{reasoning_efforts:qZ.filter((V)=>Q.includes(V))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return U9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=HZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=UZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((G)=>X.components[G]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments`)).items??[]}catch(J){if(J instanceof G0&&(J.status===403||J.status===404))return[];throw J}}async requireSessionAttachments(){if((await this.request("/deployment")).session_attachments!==!0)throw Error("This server does not support Session image attachments yet. Update the server and retry; the image was not sent.")}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{}}})}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}}function y1($,J){let Z=b0($,"REASON_API_URL")?.trim();if(!Z)return j4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function IZ($){return b0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function z4($){return b0($,"REASON_API_KEY")?.trim()||void 0}async function x9($,J){let Z=$.env??process.env,Q=z4(Z);if(!Q)return($.getCredentials??b1)({apiOrigin:IZ(Z),signal:J});let X=y1(Z,$.channel??P0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),G=await Y.json().catch(()=>({})),V=i0(G)?G:{};if(!Y.ok){let N=typeof V.detail==="string"?V.detail:typeof V.message==="string"?V.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof V.error==="string"?V.error:"api_key_auth_failed",N)}if(typeof V.org_id!=="string"||!V.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(V.scopes)?V.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:V.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as PZ}from"crypto";import{unlinkSync as xZ}from"fs";import{platform as EZ}from"os";import{join as SZ}from"path";var E9=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),f1=($)=>SZ($,"api-key.json");function z1($){let J=PZ("sha256").update(`reason-connect-api-key
|
|
5
5
|
${$}`).digest("hex");return new e1(T2(),EZ(),J)}function O4($,J,Z=z1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof Y0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function l0($,J=z1($)){if(!u(f1($)))return null;let Z=E9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof Y0))throw Q;throw Error("worker_api_key_unreadable")}}function S9($,J=z1($)){if(!u(f1($)))return;if(E9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof Y0))throw Z}xZ(f1($))}async function A4($,J){let Z;try{Z=await x9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:k0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as rZ,renameSync as tZ,rmSync as v1}from"fs";import{join as M0}from"path";import{createHash as wZ}from"crypto";import{realpathSync as bZ,statSync as kZ,unlinkSync as _2}from"fs";import{platform as yZ}from"os";import{join as y0}from"path";function d($){return{state:y0(g($),"device.json"),control:y0(g($),"control.json"),lock:y0(g($),"lifecycle.lock"),socket:y0(g($),"control.sock"),daemon:y0(g($),"daemon.json"),releaseCheck:y0(g($),"release-check.json"),updateDeferral:y0(g($),"update-deferral.json"),firstHeartbeat:y0(g($),"first-heartbeat.json")}}var fZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max($$).optional()});function b9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function C4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=fZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?I4($):new R4(g($))}function W2($,J){T0($,!0),vZ($);let Z=J??I4($),Q=new R4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof Y0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function I4($){return new e1(T2(),yZ(),hZ($))}function hZ($){let J=P4($);return wZ("sha256").update(`reason-worker
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{$a as n6,Ea as u6,Ga as L4,Ha as O4,Ma as l6,Na as s6,Xa as I4,ab as r6,bb as S4,cb as k4,eb as a6,ga as U4,gb as B8,hb as y0,ia as W2,ib as m0,ja as X4,jb as c1,ka as W4,la as Y4,ma as S6,mb as i6,na as f6,oa as M4,pa as b6,pb as V8,qa as A3,qb as A4,ra as x6,sa as y6,sb as o6,ta as h6,ua as m6,va as w4,wa as v6,xa as p6}from"./vm-hands-entry-lite-fg8cwd29.js";import{Ab as n0,Bb as r0,Ib as P0,tb as i3,ub as q6,vb as E6}from"./vm-hands-entry-lite-3nfhybjy.js";import{Jb as t6,Mb as e6,Ob as $7,Pb as J7}from"./vm-hands-entry-lite-mk9p22xa.js";import{Ub as d6}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Vb as _6,Wb as R6,Xb as P6,Yb as z6,Zb as w0}from"./vm-hands-entry-lite-n07kxrd1.js";import{$b as o1,ac as t1,bc as S3,dc as k3,fc as f3,gc as b3,kc as x3}from"./vm-hands-entry-lite-qdwm3ya8.js";import{Bc as r1,Ec as H7,Nc as D7}from"./vm-hands-entry-lite-91tcwjpv.js";import{$c as u,$d as g8,Ad as L6,Cd as O6,Dd as j6,Ed as I6,Fd as A6,Gd as T6,Ld as D8,Md as M8,Nd as w8,Oc as w1,Od as L8,Pc as Q2,Pd as O8,Qc as e5,Qd as j8,Rc as I3,Sc as r3,Sd as I8,Tc as a3,Td as A8,Uc as M0,Ud as T8,Vd as _8,Wd as R8,Xd as P8,Yc as N0,Yd as z8,Zd as q8,_d as E8,ad as E1,dd as H8,fd as g1,hd as $6,id as J6,jd as Z6,kd as Q6,ld as K6,md as B6,nd as V6,od as G6,pd as U6,qd as X6,rd as W6,sd as Y6,td as F6,ud as N6,vd as C6,wd as H6,xd as D6,yd as M6,zd as w6}from"./vm-hands-entry-lite-5zzey257.js";import{ae as V}from"./vm-hands-entry-lite-h7ndfgwc.js";import{Ae as l1,be as W7,ce as Y7,de as F7,ee as N7,fe as C7,le as p5,pe as Q5,qe as T5,we as M7,ze as K5}from"./vm-hands-entry-lite-t2ee2e71.js";import{Ze as j4,ef as c6}from"./vm-hands-entry-lite-zmf3vn3w.js";import{jf as M3,wf as g6}from"./vm-hands-entry-lite-mysjgrwy.js";import{Ag as Z7,Bg as Q7,Cg as K7,Dg as B7,Fg as V7,Gg as G7,Ig as U7,Jg as X7}from"./vm-hands-entry-lite-yadv8a82.js";import{Xg as n1}from"./vm-hands-entry-lite-cfjx91rj.js";import{$g as H4,Zg as j1,_g as k6,ah as D4}from"./vm-hands-entry-lite-pr65ksfz.js";import{ch as D3,eh as $1,kh as K8,lh as J4}from"./vm-hands-entry-lite-ngvxyjhy.js";import{Jh as H}from"./vm-hands-entry-lite-sn3vjjgx.js";import{Nh as a4}from"./vm-hands-entry-lite-a3n86qqm.js";import{request as m7}from"http";import{request as v7}from"https";async function p7($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?v7:m7)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:k3},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Error("custom_endpoint_timeout"))),K.end($.body)})}function u7($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function d7($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let W=Buffer.allocUnsafe(G.length*Q.length+B),Y=0;for(let X of G){while(B&&Z[B]!==X){let F=K[B-1];Y+=Z.copy(W,Y,0,B-F),B=F}if(Z[B]===X){if(B++,B===Z.length)Y+=Q.copy(W,Y),B=0}else W[Y++]=X}if(U)Y+=Z.copy(W,Y,0,B),B=0;return W.subarray(0,Y)}}async function y3($){$.signal.throwIfAborted();let J=b3.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=x3.parse(await $.credential($.signal));if(!f3(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,W=0,Y=u7(Q.apiKey),X=d7(Q.apiKey,Y),F=async(N,D)=>{$.signal.throwIfAborted(),await new Promise((L,M)=>{let I=()=>{$.signal.removeEventListener("abort",I),M($.signal.reason)};if($.signal.addEventListener("abort",I,{once:!0}),$.signal.aborted){I();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(N,D)}).then(()=>{$.signal.removeEventListener("abort",I),L()},(O)=>{$.signal.removeEventListener("abort",I),M(O)})})},C=async(N)=>{if(G+=N.length,G>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let D=0;D<N.length;D+=o1){if(W>=S3)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await F(`custom_endpoint.chunk.${W++}`,{eof:!1,data:N.subarray(D,D+o1).toString("base64")})}};try{let N=await p7({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=N.response,B=N.close;let D=K.statusCode??500;if(D>=300&&D<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let L={};for(let M of["content-type","retry-after","x-request-id","request-id"]){let I=K.headers[M];if(typeof I==="string")L[M]=I.replaceAll(Q.apiKey,Y).slice(0,4096)}await F("custom_endpoint.headers",{status:D,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,Y).slice(0,256),headers:L});for await(let M of K){$.signal.throwIfAborted();let I=Buffer.isBuffer(M)?M:Buffer.from(M);if(U+=I.length,U>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(X(I))}return await C(X(Buffer.alloc(0),!0)),await F(`custom_endpoint.chunk.${W}`,{eof:!0}),{bytes:G,chunks:W}}catch(N){if($.signal.throwIfAborted(),N instanceof H)throw N;throw new H("custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as h3}from"path";function l7($,J){return $===h3(J,".ara","workspace")||$===h3(J,".reason","workspace")}function m3($,J){let Z=$.filter((Q)=>l7(Q.path,J));return Z.length===1?Z[0].path:null}var s7=/^[a-f0-9]{64}$/;var e1=32,c7=/^\/[^\x00-\x1f\x7f\\]*$/;function H1($){if(typeof $!=="string"||$.length>4096||!c7.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function D1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!H1(J.home)||!Array.isArray(J.roots)||J.roots.length>e1)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!s7.test(K)||!H1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}import{spawn as r7}from"child_process";import*as z from"fs";import*as l from"path";import{homedir as a7}from"os";function $2($,J,Z,Q="gh"){if(!["gh","git"].includes(Q))throw Error("local_device_gh_unavailable");let K=$.realpathSync(Z),B=Q==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+Q;for(let G of["/opt/homebrew/bin/"+Q,"/usr/local/bin/"+Q,B])try{let U=$.realpathSync(G);if(U===K||U.startsWith(K+J.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...Q==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((Y)=>U.startsWith(Y)))continue;let W=$.statSync(U);if(!W.isFile()||(W.mode&18)!==0||![0,process.getuid()].includes(W.uid))continue;return $.accessSync(U,$.constants.X_OK),U}catch{continue}throw Error("local_device_gh_unavailable")}function v3($,J){let Z=1;for(let Q=0;Q<J;Q+=1)if($.charCodeAt(Q)===10)Z+=1;return Z}var p3=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function J2($){let J=$.trim().replaceAll("\\","/");if(!J)return{valid:!1,reason:"empty_path"};if(J.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(J.split("/").includes("..")||J.includes("../")||J.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(J===".git"||J.startsWith(".git/")||J.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function u3($){return[...new Set($.map((J)=>J.trim()).filter((J)=>J.length>=8))]}function d3($,J){return[...J.matchAll(new RegExp($.regex.source,`${$.regex.flags}g`))]}function M1($,J=[],Z={}){let Q=[],K=Z.published??new Set,B=u3(J).filter((G)=>!K.has(G));for(let G of $){let U=J2(G.path);if(!U.valid){Q.push({path:G.path,reason:U.reason??"invalid_path"});continue}let W=G.content??"",Y=B.map((X)=>({secret:X,offset:W.indexOf(X)})).filter((X)=>X.offset>=0).sort((X,F)=>X.offset-F.offset);if(Y.length>0){let X=[...new Set(Y.flatMap((F)=>Z.secretNames?.(F.secret)??[]))];Q.push({path:G.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:v3(W,Y[0].offset),...X.length>0?{secretNames:X}:{}})}for(let X of p3){let F=d3(X,W).find((C)=>!K.has(C[0]));if(F){Q.push({path:G.path,reason:`credential_pattern_detected: ${X.name}`,pattern:X.name,ruleId:X.name,line:v3(W,F.index)});break}}}return{clean:Q.length===0,violations:Q,scannedObjectCount:$.length}}function l3($,J=[]){let Z=u3(J),Q=new Set;for(let{content:K}of $){for(let B of Z)if(K.includes(B))Q.add(B);for(let B of p3)for(let G of d3(B,K))Q.add(G[0])}return[...Q]}function n7($,J){let Z=0;for(let Q=$.indexOf(J);Q>=0;Q=$.indexOf(J,Q+J.length))Z+=1;return Z}function s3($,J,Z){let Q=(K,B)=>K.reduce((G,U)=>G+n7(U,B),0);return new Set($.filter((K)=>Q(J,K)<=Q(Z,K)))}var T0=4194304,c3=536870912,Z2=/^[a-f0-9]{40}$/,i7=($,J,Z)=>new Promise((Q)=>{if(Z.signal?.aborted){Q({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let K;try{K=r7($,J,{cwd:Z.cwd,env:Z.env,detached:!0,stdio:["pipe","pipe","pipe"]})}catch{Q({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let B=Buffer.alloc(0),G=Buffer.alloc(0),U,W=!1,Y=(N)=>{if(U??=Error(N),K.pid)try{process.kill(-K.pid,"SIGKILL")}catch{}},X=()=>Y("cancelled"),F=setTimeout(()=>Y("timeout"),Z.timeout);Z.signal?.addEventListener("abort",X,{once:!0});let C=(N)=>{if(W)return;W=!0,clearTimeout(F),Z.signal?.removeEventListener("abort",X),Q({status:N,stdout:B,stderr:G,...U?{error:U}:{}})};if(K.stdout.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else B=Buffer.concat([B,N])}),K.stderr.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else G=Buffer.concat([G,N])}),K.on("error",()=>{if(Y("spawn_failed"),!K.pid)C(null)}),K.on("close",(N)=>C(N)),K.stdin.on("error",()=>Y("input_failed")),K.stdin.end(Z.input),Z.signal?.aborted)X()}),o7={command:i7,gh:($,J)=>$2(z,l,$,J),home:a7};function T($){throw Error($)}var t7=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),e7=($)=>JSON.stringify($,(J,Z)=>t7.has(J)?void 0:Z);function n3($,J,Z){let Q=[...new Set($.map((B)=>`${J(B.path)}${B.line?`:${B.line}`:""} (${B.reason==="literal_secret_detected"?`value of ${B.secretNames?.length?B.secretNames.slice(0,3).join(", "):"a session variable"}`:`${B.ruleId??"credential"} credential`})`))].slice(0,10),K=$.some((B)=>B.reason==="literal_secret_detected");T(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${Q.join("; ")}. Nothing was sent. ${Z}${K?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function o3($,J,Z=o7){let Q=w1.parse($);if(!["darwin","linux"].includes(process.platform))T("local_device_gh_platform_unavailable");J.assertCurrent();let K=z.realpathSync(J.root);if(K==="/")T("local_device_gh_root_unavailable");if(!M0(Q)&&!J.forbiddenSecretValues)T("local_device_gh_secret_scope_unavailable");if(!M0(Q)&&J.readOnly)T("local_device_gh_read_only");if(!M0(Q)){let w=M1([{path:"github-operation",content:e7(Q)}],J.forbiddenSecretValues,J.secretNames?{secretNames:J.secretNames}:{});if(!w.clean)n3(w.violations,()=>`the ${Q.kind} request text`,"Remove it from the pull request text and try again.")}let B=Z.gh(K),G=Z.home(),U=$2(z,l,K,"git"),W=J.privateDirectory?z.realpathSync(J.privateDirectory):z.realpathSync(G);if(!M0(Q)&&(!J.privateDirectory||W===K||W.startsWith(K+l.sep)))T("local_device_gh_private_scope_unavailable");let Y={PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:G,GH_CONFIG_DIR:l.join(G,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((w)=>process.env[w]?[[w,process.env[w]]]:[])):{}},X=async(w,_,P=W,g,b=T0)=>{J.assertCurrent();let x=await Z.command(w,_,{cwd:P,env:Y,input:g,maxBuffer:b,timeout:Math.max(1,Math.min(60000,(J.deadlineMs??Date.now()+60000)-Date.now())),signal:J.signal});if(J.assertCurrent(),x.error||x.status!==0)T("local_device_gh_command_failed");return x.stdout},F=async(w)=>(await X(B,w)).toString("utf8").trim(),C=async(w,_="application/vnd.github+json")=>{r3(Q.repoFullName,w,{headers:{accept:_}}),J.assertCurrent();let P=await Z.command(B,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${_}`,w],{cwd:W,env:Y,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal});if(J.assertCurrent(),P.error&&P.status===null)T("local_device_gh_response_unavailable");let g=P.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!g)T("local_device_gh_response_invalid");let b=Number(g[1]);if(b>=200&&b<300&&P.status!==0)T("local_device_gh_response_unavailable");if(Buffer.byteLength(g[3])>Q2)T("local_device_gh_response_too_large");let x={};for(let n of g[2].split(/\r?\n/)){let r=n.indexOf(":"),D0=n.slice(0,r).toLowerCase();if(["link","content-type"].includes(D0))x[D0]=n.slice(r+1).trim().slice(0,8192)}return{kind:"read",status:b,headers:x,body:b>=200&&b<300?g[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(Q.kind==="read")return C(Q.path,Q.accept);if(Q.kind==="pr_review_context"){let[w,_]=Q.repoFullName.split("/"),P=await F(["api","graphql","--hostname","github.com","-f",`query=${a3}`,"-f",`owner=${w}`,"-f",`repo=${_}`,"-F",`number=${Q.number}`,...Q.after?["-f",`after=${Q.after}`]:[]]);if(Buffer.byteLength(P)>Q2)T("local_device_gh_response_too_large");let g=JSON.parse(P);if(g.errors||g.data?.repository?.nameWithOwner?.toLowerCase()!==Q.repoFullName.toLowerCase()||g.data.repository.pullRequest?.number!==Q.number)T("local_device_gh_response_invalid");return{kind:"pr_review_context",body:P}}if(Q.kind==="pr_merge"){let w=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),_=JSON.parse(w.body),P=(x)=>x.number===Q.number&&x.html_url===`https://github.com/${Q.repoFullName}/pull/${Q.number}`&&x.base?.repo?.full_name?.toLowerCase()===Q.repoFullName.toLowerCase()&&x.base?.ref===Q.expectedBaseRef&&x.head?.sha===Q.expectedHeadSha;if(w.status!==200||!P(_)||_.state!=="open"||_.draft!==!1||_.head?.sha!==Q.expectedHeadSha||_.base?.repo?.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase())T("local_device_gh_merge_target_changed");await F(["pr","merge",String(Q.number),`--repo=${Q.repoFullName}`,`--${Q.method}`,"--match-head-commit",Q.expectedHeadSha]);let g=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),b=JSON.parse(g.body);if(g.status!==200||!P(b)||b.merged!==!0)T("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:Q.number,merged:!0}}if(Q.kind==="pr_create"){if(Q.head===Q.base)T("local_device_gh_default_branch");let w=await F(["pr","create","--repo",Q.repoFullName,"--head",Q.head,"--base",Q.base,`--title=${Q.title}`,`--body=${Q.body}`,...Q.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+Q.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(w))T("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:w}}if(Q.kind==="pr_mutation"){let w=Q.mutation,_=w.action==="edit"?["edit",...w.title!==void 0?[`--title=${w.title}`]:[],...w.body!==void 0?[`--body=${w.body}`]:[],...w.base?[`--base=${w.base}`]:[]]:w.action==="metadata"?["edit",`--${w.change}-${w.field}=${w.value}`]:w.action==="ready"?["ready"]:w.action==="draft"?["ready","--undo"]:["close"];return await F(["pr",..._,String(Q.number),"--repo",Q.repoFullName]),{kind:"pr_mutation",number:Q.number,applied:!0}}if(!J.repoPath)T("local_device_gh_workspace_unavailable");let N=z.realpathSync(J.repoPath);if(N!==K&&!N.startsWith(K+l.sep))T("local_device_gh_workspace_unavailable");let D=`https://github.com/${Q.repoFullName}.git`,L="!'"+B.replace(/'/g,"'\\''")+"' auth git-credential",M=Function("return ("+i3+")")(),I=(w,_,P)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",w,_,...P]]:[_,P],O=async(w,_,P,g=T0)=>{let b=w===W||w.startsWith(W+l.sep),x=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...b?["-c",`credential.https://github.com.helper=${L}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",..._];if(b)return X(U,x,w,P,g);let n=l.join(N,".ara-local-gh-tmp");if(z.mkdirSync(n,{recursive:!0,mode:448}),z.lstatSync(n).isSymbolicLink()||z.realpathSync(n)!==n)T("local_device_gh_workspace_unavailable");J.assertCurrent();let r=await Z.command(...I(M(N,n),U,x),{cwd:w,input:P,maxBuffer:g,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:N,TMPDIR:n,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),r.error||r.status!==0)T("local_device_gh_collection_failed");return r.stdout},k=async(w,_)=>(await O(w,_)).toString("utf8").trim(),E=async(w,_)=>{let P=l.join(w,".ara-local-gh-tmp");if(z.mkdirSync(P,{recursive:!0,mode:448}),z.lstatSync(P).isSymbolicLink()||z.realpathSync(P)!==P)T("local_device_gh_workspace_unavailable");J.assertCurrent();let g=await Z.command(...I(M(w,P),"/bin/sh",["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",_]),{cwd:w,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:w,TMPDIR:P}});if(J.assertCurrent(),g.error||g.status!==0)T("local_device_gh_materialization_failed")},j=async(w)=>{let _=new Map;if(w.length===0)return _;let P=await O(m,["cat-file","--batch"],[...new Set(w)].join(`
|
|
2
|
+
import{$a as n6,Ea as u6,Ga as L4,Ha as O4,Ma as l6,Na as s6,Xa as I4,ab as r6,bb as S4,cb as k4,eb as a6,ga as U4,gb as B8,hb as y0,ia as W2,ib as m0,ja as X4,jb as c1,ka as W4,la as Y4,ma as S6,mb as i6,na as f6,oa as M4,pa as b6,pb as V8,qa as A3,qb as A4,ra as x6,sa as y6,sb as o6,ta as h6,ua as m6,va as w4,wa as v6,xa as p6}from"./vm-hands-entry-lite-pkwvjyy8.js";import{Ab as n0,Bb as r0,Ib as P0,tb as i3,ub as q6,vb as E6}from"./vm-hands-entry-lite-5rbj89cs.js";import{Jb as t6,Mb as e6,Ob as $7,Pb as J7}from"./vm-hands-entry-lite-mk9p22xa.js";import{Ub as d6}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Vb as _6,Wb as R6,Xb as P6,Yb as z6,Zb as w0}from"./vm-hands-entry-lite-n07kxrd1.js";import{$b as o1,ac as t1,bc as S3,dc as k3,fc as f3,gc as b3,kc as x3}from"./vm-hands-entry-lite-qdwm3ya8.js";import{Bc as r1,Ec as H7,Nc as D7}from"./vm-hands-entry-lite-dhngjmag.js";import{$c as u,$d as g8,Ad as L6,Cd as O6,Dd as j6,Ed as I6,Fd as A6,Gd as T6,Ld as D8,Md as M8,Nd as w8,Oc as w1,Od as L8,Pc as Q2,Pd as O8,Qc as e5,Qd as j8,Rc as I3,Sc as r3,Sd as I8,Tc as a3,Td as A8,Uc as M0,Ud as T8,Vd as _8,Wd as R8,Xd as P8,Yc as N0,Yd as z8,Zd as q8,_d as E8,ad as E1,dd as H8,fd as g1,hd as $6,id as J6,jd as Z6,kd as Q6,ld as K6,md as B6,nd as V6,od as G6,pd as U6,qd as X6,rd as W6,sd as Y6,td as F6,ud as N6,vd as C6,wd as H6,xd as D6,yd as M6,zd as w6}from"./vm-hands-entry-lite-5zzey257.js";import{ae as V}from"./vm-hands-entry-lite-h7ndfgwc.js";import{Ae as l1,be as W7,ce as Y7,de as F7,ee as N7,fe as C7,le as p5,pe as Q5,qe as T5,we as M7,ze as K5}from"./vm-hands-entry-lite-d9h818st.js";import{Ze as j4,ef as c6}from"./vm-hands-entry-lite-zmf3vn3w.js";import{jf as M3,wf as g6}from"./vm-hands-entry-lite-mysjgrwy.js";import{Ag as Z7,Bg as Q7,Cg as K7,Dg as B7,Fg as V7,Gg as G7,Ig as U7,Jg as X7}from"./vm-hands-entry-lite-yadv8a82.js";import{Xg as n1}from"./vm-hands-entry-lite-cfjx91rj.js";import{$g as H4,Zg as j1,_g as k6,ah as D4}from"./vm-hands-entry-lite-pr65ksfz.js";import{ch as D3,eh as $1,kh as K8,lh as J4}from"./vm-hands-entry-lite-ngvxyjhy.js";import{Jh as H}from"./vm-hands-entry-lite-sn3vjjgx.js";import{Nh as a4}from"./vm-hands-entry-lite-a3n86qqm.js";import{request as m7}from"http";import{request as v7}from"https";async function p7($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?v7:m7)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:k3},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Error("custom_endpoint_timeout"))),K.end($.body)})}function u7($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function d7($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let W=Buffer.allocUnsafe(G.length*Q.length+B),Y=0;for(let X of G){while(B&&Z[B]!==X){let F=K[B-1];Y+=Z.copy(W,Y,0,B-F),B=F}if(Z[B]===X){if(B++,B===Z.length)Y+=Q.copy(W,Y),B=0}else W[Y++]=X}if(U)Y+=Z.copy(W,Y,0,B),B=0;return W.subarray(0,Y)}}async function y3($){$.signal.throwIfAborted();let J=b3.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=x3.parse(await $.credential($.signal));if(!f3(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,W=0,Y=u7(Q.apiKey),X=d7(Q.apiKey,Y),F=async(N,D)=>{$.signal.throwIfAborted(),await new Promise((L,M)=>{let I=()=>{$.signal.removeEventListener("abort",I),M($.signal.reason)};if($.signal.addEventListener("abort",I,{once:!0}),$.signal.aborted){I();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(N,D)}).then(()=>{$.signal.removeEventListener("abort",I),L()},(O)=>{$.signal.removeEventListener("abort",I),M(O)})})},C=async(N)=>{if(G+=N.length,G>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let D=0;D<N.length;D+=o1){if(W>=S3)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await F(`custom_endpoint.chunk.${W++}`,{eof:!1,data:N.subarray(D,D+o1).toString("base64")})}};try{let N=await p7({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=N.response,B=N.close;let D=K.statusCode??500;if(D>=300&&D<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let L={};for(let M of["content-type","retry-after","x-request-id","request-id"]){let I=K.headers[M];if(typeof I==="string")L[M]=I.replaceAll(Q.apiKey,Y).slice(0,4096)}await F("custom_endpoint.headers",{status:D,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,Y).slice(0,256),headers:L});for await(let M of K){$.signal.throwIfAborted();let I=Buffer.isBuffer(M)?M:Buffer.from(M);if(U+=I.length,U>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(X(I))}return await C(X(Buffer.alloc(0),!0)),await F(`custom_endpoint.chunk.${W}`,{eof:!0}),{bytes:G,chunks:W}}catch(N){if($.signal.throwIfAborted(),N instanceof H)throw N;throw new H("custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as h3}from"path";function l7($,J){return $===h3(J,".ara","workspace")||$===h3(J,".reason","workspace")}function m3($,J){let Z=$.filter((Q)=>l7(Q.path,J));return Z.length===1?Z[0].path:null}var s7=/^[a-f0-9]{64}$/;var e1=32,c7=/^\/[^\x00-\x1f\x7f\\]*$/;function H1($){if(typeof $!=="string"||$.length>4096||!c7.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function D1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!H1(J.home)||!Array.isArray(J.roots)||J.roots.length>e1)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!s7.test(K)||!H1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}import{spawn as r7}from"child_process";import*as z from"fs";import*as l from"path";import{homedir as a7}from"os";function $2($,J,Z,Q="gh"){if(!["gh","git"].includes(Q))throw Error("local_device_gh_unavailable");let K=$.realpathSync(Z),B=Q==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+Q;for(let G of["/opt/homebrew/bin/"+Q,"/usr/local/bin/"+Q,B])try{let U=$.realpathSync(G);if(U===K||U.startsWith(K+J.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...Q==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((Y)=>U.startsWith(Y)))continue;let W=$.statSync(U);if(!W.isFile()||(W.mode&18)!==0||![0,process.getuid()].includes(W.uid))continue;return $.accessSync(U,$.constants.X_OK),U}catch{continue}throw Error("local_device_gh_unavailable")}function v3($,J){let Z=1;for(let Q=0;Q<J;Q+=1)if($.charCodeAt(Q)===10)Z+=1;return Z}var p3=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function J2($){let J=$.trim().replaceAll("\\","/");if(!J)return{valid:!1,reason:"empty_path"};if(J.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(J.split("/").includes("..")||J.includes("../")||J.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(J===".git"||J.startsWith(".git/")||J.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function u3($){return[...new Set($.map((J)=>J.trim()).filter((J)=>J.length>=8))]}function d3($,J){return[...J.matchAll(new RegExp($.regex.source,`${$.regex.flags}g`))]}function M1($,J=[],Z={}){let Q=[],K=Z.published??new Set,B=u3(J).filter((G)=>!K.has(G));for(let G of $){let U=J2(G.path);if(!U.valid){Q.push({path:G.path,reason:U.reason??"invalid_path"});continue}let W=G.content??"",Y=B.map((X)=>({secret:X,offset:W.indexOf(X)})).filter((X)=>X.offset>=0).sort((X,F)=>X.offset-F.offset);if(Y.length>0){let X=[...new Set(Y.flatMap((F)=>Z.secretNames?.(F.secret)??[]))];Q.push({path:G.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:v3(W,Y[0].offset),...X.length>0?{secretNames:X}:{}})}for(let X of p3){let F=d3(X,W).find((C)=>!K.has(C[0]));if(F){Q.push({path:G.path,reason:`credential_pattern_detected: ${X.name}`,pattern:X.name,ruleId:X.name,line:v3(W,F.index)});break}}}return{clean:Q.length===0,violations:Q,scannedObjectCount:$.length}}function l3($,J=[]){let Z=u3(J),Q=new Set;for(let{content:K}of $){for(let B of Z)if(K.includes(B))Q.add(B);for(let B of p3)for(let G of d3(B,K))Q.add(G[0])}return[...Q]}function n7($,J){let Z=0;for(let Q=$.indexOf(J);Q>=0;Q=$.indexOf(J,Q+J.length))Z+=1;return Z}function s3($,J,Z){let Q=(K,B)=>K.reduce((G,U)=>G+n7(U,B),0);return new Set($.filter((K)=>Q(J,K)<=Q(Z,K)))}var T0=4194304,c3=536870912,Z2=/^[a-f0-9]{40}$/,i7=($,J,Z)=>new Promise((Q)=>{if(Z.signal?.aborted){Q({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let K;try{K=r7($,J,{cwd:Z.cwd,env:Z.env,detached:!0,stdio:["pipe","pipe","pipe"]})}catch{Q({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let B=Buffer.alloc(0),G=Buffer.alloc(0),U,W=!1,Y=(N)=>{if(U??=Error(N),K.pid)try{process.kill(-K.pid,"SIGKILL")}catch{}},X=()=>Y("cancelled"),F=setTimeout(()=>Y("timeout"),Z.timeout);Z.signal?.addEventListener("abort",X,{once:!0});let C=(N)=>{if(W)return;W=!0,clearTimeout(F),Z.signal?.removeEventListener("abort",X),Q({status:N,stdout:B,stderr:G,...U?{error:U}:{}})};if(K.stdout.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else B=Buffer.concat([B,N])}),K.stderr.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else G=Buffer.concat([G,N])}),K.on("error",()=>{if(Y("spawn_failed"),!K.pid)C(null)}),K.on("close",(N)=>C(N)),K.stdin.on("error",()=>Y("input_failed")),K.stdin.end(Z.input),Z.signal?.aborted)X()}),o7={command:i7,gh:($,J)=>$2(z,l,$,J),home:a7};function T($){throw Error($)}var t7=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),e7=($)=>JSON.stringify($,(J,Z)=>t7.has(J)?void 0:Z);function n3($,J,Z){let Q=[...new Set($.map((B)=>`${J(B.path)}${B.line?`:${B.line}`:""} (${B.reason==="literal_secret_detected"?`value of ${B.secretNames?.length?B.secretNames.slice(0,3).join(", "):"a session variable"}`:`${B.ruleId??"credential"} credential`})`))].slice(0,10),K=$.some((B)=>B.reason==="literal_secret_detected");T(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${Q.join("; ")}. Nothing was sent. ${Z}${K?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function o3($,J,Z=o7){let Q=w1.parse($);if(!["darwin","linux"].includes(process.platform))T("local_device_gh_platform_unavailable");J.assertCurrent();let K=z.realpathSync(J.root);if(K==="/")T("local_device_gh_root_unavailable");if(!M0(Q)&&!J.forbiddenSecretValues)T("local_device_gh_secret_scope_unavailable");if(!M0(Q)&&J.readOnly)T("local_device_gh_read_only");if(!M0(Q)){let w=M1([{path:"github-operation",content:e7(Q)}],J.forbiddenSecretValues,J.secretNames?{secretNames:J.secretNames}:{});if(!w.clean)n3(w.violations,()=>`the ${Q.kind} request text`,"Remove it from the pull request text and try again.")}let B=Z.gh(K),G=Z.home(),U=$2(z,l,K,"git"),W=J.privateDirectory?z.realpathSync(J.privateDirectory):z.realpathSync(G);if(!M0(Q)&&(!J.privateDirectory||W===K||W.startsWith(K+l.sep)))T("local_device_gh_private_scope_unavailable");let Y={PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:G,GH_CONFIG_DIR:l.join(G,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((w)=>process.env[w]?[[w,process.env[w]]]:[])):{}},X=async(w,_,P=W,g,b=T0)=>{J.assertCurrent();let x=await Z.command(w,_,{cwd:P,env:Y,input:g,maxBuffer:b,timeout:Math.max(1,Math.min(60000,(J.deadlineMs??Date.now()+60000)-Date.now())),signal:J.signal});if(J.assertCurrent(),x.error||x.status!==0)T("local_device_gh_command_failed");return x.stdout},F=async(w)=>(await X(B,w)).toString("utf8").trim(),C=async(w,_="application/vnd.github+json")=>{r3(Q.repoFullName,w,{headers:{accept:_}}),J.assertCurrent();let P=await Z.command(B,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${_}`,w],{cwd:W,env:Y,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal});if(J.assertCurrent(),P.error&&P.status===null)T("local_device_gh_response_unavailable");let g=P.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!g)T("local_device_gh_response_invalid");let b=Number(g[1]);if(b>=200&&b<300&&P.status!==0)T("local_device_gh_response_unavailable");if(Buffer.byteLength(g[3])>Q2)T("local_device_gh_response_too_large");let x={};for(let n of g[2].split(/\r?\n/)){let r=n.indexOf(":"),D0=n.slice(0,r).toLowerCase();if(["link","content-type"].includes(D0))x[D0]=n.slice(r+1).trim().slice(0,8192)}return{kind:"read",status:b,headers:x,body:b>=200&&b<300?g[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(Q.kind==="read")return C(Q.path,Q.accept);if(Q.kind==="pr_review_context"){let[w,_]=Q.repoFullName.split("/"),P=await F(["api","graphql","--hostname","github.com","-f",`query=${a3}`,"-f",`owner=${w}`,"-f",`repo=${_}`,"-F",`number=${Q.number}`,...Q.after?["-f",`after=${Q.after}`]:[]]);if(Buffer.byteLength(P)>Q2)T("local_device_gh_response_too_large");let g=JSON.parse(P);if(g.errors||g.data?.repository?.nameWithOwner?.toLowerCase()!==Q.repoFullName.toLowerCase()||g.data.repository.pullRequest?.number!==Q.number)T("local_device_gh_response_invalid");return{kind:"pr_review_context",body:P}}if(Q.kind==="pr_merge"){let w=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),_=JSON.parse(w.body),P=(x)=>x.number===Q.number&&x.html_url===`https://github.com/${Q.repoFullName}/pull/${Q.number}`&&x.base?.repo?.full_name?.toLowerCase()===Q.repoFullName.toLowerCase()&&x.base?.ref===Q.expectedBaseRef&&x.head?.sha===Q.expectedHeadSha;if(w.status!==200||!P(_)||_.state!=="open"||_.draft!==!1||_.head?.sha!==Q.expectedHeadSha||_.base?.repo?.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase())T("local_device_gh_merge_target_changed");await F(["pr","merge",String(Q.number),`--repo=${Q.repoFullName}`,`--${Q.method}`,"--match-head-commit",Q.expectedHeadSha]);let g=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),b=JSON.parse(g.body);if(g.status!==200||!P(b)||b.merged!==!0)T("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:Q.number,merged:!0}}if(Q.kind==="pr_create"){if(Q.head===Q.base)T("local_device_gh_default_branch");let w=await F(["pr","create","--repo",Q.repoFullName,"--head",Q.head,"--base",Q.base,`--title=${Q.title}`,`--body=${Q.body}`,...Q.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+Q.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(w))T("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:w}}if(Q.kind==="pr_mutation"){let w=Q.mutation,_=w.action==="edit"?["edit",...w.title!==void 0?[`--title=${w.title}`]:[],...w.body!==void 0?[`--body=${w.body}`]:[],...w.base?[`--base=${w.base}`]:[]]:w.action==="metadata"?["edit",`--${w.change}-${w.field}=${w.value}`]:w.action==="ready"?["ready"]:w.action==="draft"?["ready","--undo"]:["close"];return await F(["pr",..._,String(Q.number),"--repo",Q.repoFullName]),{kind:"pr_mutation",number:Q.number,applied:!0}}if(!J.repoPath)T("local_device_gh_workspace_unavailable");let N=z.realpathSync(J.repoPath);if(N!==K&&!N.startsWith(K+l.sep))T("local_device_gh_workspace_unavailable");let D=`https://github.com/${Q.repoFullName}.git`,L="!'"+B.replace(/'/g,"'\\''")+"' auth git-credential",M=Function("return ("+i3+")")(),I=(w,_,P)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",w,_,...P]]:[_,P],O=async(w,_,P,g=T0)=>{let b=w===W||w.startsWith(W+l.sep),x=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...b?["-c",`credential.https://github.com.helper=${L}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",..._];if(b)return X(U,x,w,P,g);let n=l.join(N,".ara-local-gh-tmp");if(z.mkdirSync(n,{recursive:!0,mode:448}),z.lstatSync(n).isSymbolicLink()||z.realpathSync(n)!==n)T("local_device_gh_workspace_unavailable");J.assertCurrent();let r=await Z.command(...I(M(N,n),U,x),{cwd:w,input:P,maxBuffer:g,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:N,TMPDIR:n,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),r.error||r.status!==0)T("local_device_gh_collection_failed");return r.stdout},k=async(w,_)=>(await O(w,_)).toString("utf8").trim(),E=async(w,_)=>{let P=l.join(w,".ara-local-gh-tmp");if(z.mkdirSync(P,{recursive:!0,mode:448}),z.lstatSync(P).isSymbolicLink()||z.realpathSync(P)!==P)T("local_device_gh_workspace_unavailable");J.assertCurrent();let g=await Z.command(...I(M(w,P),"/bin/sh",["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",_]),{cwd:w,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:w,TMPDIR:P}});if(J.assertCurrent(),g.error||g.status!==0)T("local_device_gh_materialization_failed")},j=async(w)=>{let _=new Map;if(w.length===0)return _;let P=await O(m,["cat-file","--batch"],[...new Set(w)].join(`
|
|
3
3
|
`)+`
|
|
4
4
|
`,T0*8);for(let g=0;g<P.length;){let b=P.indexOf(10,g),[x,n,r]=P.subarray(g,b).toString("utf8").split(" ");if(b<0||!x||n!=="blob"||!/^[0-9]+$/.test(r??""))T("local_device_gh_object_invalid");_.set(x,P.subarray(b+1,b+1+Number(r)).toString("utf8")),g=b+1+Number(r)+1}return _},R=async(w,_,P)=>{let g=l.join(N,".ara-local-gh-tmp"),b=M(N,g)+`
|
|
5
5
|
(allow file-read* file-write* (subpath ${JSON.stringify(N)}))
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Og as wz,Pg as Nz}from"./vm-hands-entry-lite-yadv8a82.js";import{Zg as N}from"./vm-hands-entry-lite-pr65ksfz.js";import{xh as A}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Og as wz,Pg as Nz}from"./vm-hands-entry-lite-yadv8a82.js";import{Zg as N}from"./vm-hands-entry-lite-pr65ksfz.js";import{xh as A}from"./vm-hands-entry-lite-g7mf4fc7.js";import{Nh as Fz}from"./vm-hands-entry-lite-a3n86qqm.js";import{spawnSync as iz}from"child_process";import{dirname as g}from"path";import{spawn as cz}from"child_process";import{accessSync as lz,constants as sz}from"fs";import{basename as nz,join as pz}from"path";import{randomUUID as p}from"crypto";import{spawnSync as M}from"child_process";import{chmodSync as Hz,cpSync as Rz,existsSync as U,lstatSync as O,mkdirSync as i,readdirSync as Cz,readFileSync as E,readlinkSync as Lz,realpathSync as T,renameSync as R,rmdirSync as Mz,rmSync as P,symlinkSync as c,writeFileSync as Oz}from"fs";import{dirname as C,join as D,relative as Uz,resolve as Tz}from"path";var a="so.ara.cli",_z="5LJFSBRY2F";var o="ReasonBackgroundIdentity",r="Contents/Helpers/ReasonPermissionTile";var x="AraBackgroundIdentity",Az="Reason",Iz=`anchor apple generic and identifier "${a}" and certificate leaf[subject.OU] = "${_z}"`;class L extends Error{code;constructor(z,J){super(J);this.code=z;this.name="MacOSBackgroundIdentityError"}}var k="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function v(z=N()){return D(z,"Library","Application Support","Reason","Background","Reason.app")}function _(z=N()){return D(z,"Library","Application Support","Ara","Background","Ara.app")}function kz(z){try{return O(z).isFile()}catch{return!1}}function y(z){return[o,x].map((J)=>D(z,"Contents","MacOS",J)).find(kz)??null}function w(z){try{if(!O(z).isDirectory())return!1;let J=E(D(z,"Contents","Info.plist"),"utf8");return J.includes(`<string>${a}</string>`)&&(J.includes(`<string>${Az}</string>`)||J.includes("<string>Ara</string>"))&&y(z)!==null}catch{return!1}}function I(z=N()){let J=v(z);if(!w(J))return null;try{let Z=E(D(J,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(Z)?.[1]??null}catch{return null}}function Sz(z,J=N()){let Z=I(J);return Z===null||$z(S(Z.split(".")),S(z.split(/[.-]/).slice(0,3)))}var fz=1e4;function t(z,J){return M(z,[...J],{stdio:"ignore",timeout:fz}).status??1}var e=new Set;function zz(z){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let J=(Z)=>{try{return T(Z)}catch{return Tz(Z)}};if(z!==void 0&&J(z)!==J(N()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var Jz=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.ara(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,Zz=new Set(["ara","ara.exe","reason","reason.exe"]);function S(z){return z.map((J)=>Number(J))}function $z(z,J){for(let Z=0;Z<3;Z+=1)if(z[Z]!==J[Z])return z[Z]<J[Z];return!1}var Ez=[0,2,161];function xz(z){if(z===null)return!0;let J=Ez,Z=null;try{Z=T(process.execPath)}catch{}return z.some(($)=>{let j=Jz.exec($);if(j){let Q=j[1]===void 0?j.slice(4,7):j.slice(1,4);return $z(S(Q),J)}let q=$.slice($.lastIndexOf("/")+1);return Zz.has(q)&&$!==Z&&$!==process.execPath})}function yz(){let z=M("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(z.status!==0)return null;let J=[];for(let Z of z.stdout.split(`
|
|
3
3
|
`)){let $=/^\s*(\d+)\s+(\S.*)$/.exec(Z);if(!$||Number($[1])===process.pid)continue;let j=$[2].trimEnd(),q=j.slice(j.lastIndexOf("/")+1);if(!Jz.test(j)&&Zz.has(q)){let V=M("/usr/sbin/lsof",["-a","-p",$[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
|
|
4
4
|
`).find((X)=>X.startsWith("n/"));if(V)j=V.slice(1)}J.push(j)}return J}function bz(z){if(zz(z.home),!w(z.sourceApp))throw new L("identity_invalid","The packaged Reason background identity is missing or invalid.");let J=z.command??t,Z=v(z.home),$=C(Z);i($,{recursive:!0,mode:448}),Hz($,448);let j=T(z.sourceApp),q=null;try{q=T(Z)}catch{}if(j!==q){let Q=`${process.pid}.${p()}`,V=D($,`.Reason.app.${Q}.tmp`),X=D($,`.Reason.app.${Q}.old`),W=!1;try{if(Rz(j,V,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!w(V))throw new L("identity_invalid","The copied Reason background identity is invalid.");let Y=z.releaseSigned?["--test-requirement",`=${Iz}`]:[];if(J("/usr/bin/codesign",["--verify","--strict",...Y,V])!==0)throw new L("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let B=!1;for(let F=0;F<4;F+=1){let G=!1;try{R(Z,X),G=!0,W=!0}catch(K){if(K.code!=="ENOENT")throw K}if(F===0)z.beforePublish?.();try{R(V,Z),B=!0}catch(K){let m=K.code;if(!["EEXIST","ENOTEMPTY"].includes(m??""))throw K;if(G)P(X,{recursive:!0,force:!0}),W=!1;if(F===3)throw K;continue}if(G)P(X,{recursive:!0,force:!0}),W=!1;break}if(!B)throw Error("Could not publish Reason's background identity.")}catch(Y){if(W&&!U(Z)&&U(X))R(X,Z);throw Y}finally{P(V,{recursive:!0,force:!0}),P(X,{recursive:!0,force:!0})}}return Wz(Z,z,{verified:j!==q}),Z}function jz(z){return D(C(z),".Reason.app.registered")}function qz(z){try{let J=O(z);return J.isDirectory()?`${J.ino}:${J.birthtimeMs}`:null}catch{return null}}function f(z){let J=qz(z);try{return J!==null&&E(jz(z),"utf8")===J}catch{return!1}}function Qz(z){if(w(z))return"bundle";try{if(O(D(z,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return O(D(z,"Contents","MacOS",x)).isSymbolicLink()?"retired":null}catch{return null}}function Wz(z,J,Z={}){let $=J.command??t;if(!Z.verified&&$("/usr/bin/codesign",["--verify","--strict",z])!==0)throw new L("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if($(k,["-f",z])!==0)throw new L("identity_register_failed","Could not register Reason's macOS background identity.");let j=qz(z);try{if(j)Oz(jz(z),j,{mode:384})}catch{}try{gz(z,J.home,$,J.runningExecutables??yz)}catch(q){let Q=q.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${Q})
|
|
5
5
|
`)}}function gz(z,J,Z,$){let j=y(z);if(!j)return;let q=_(J),Q=C(q),V=(K)=>D(K,"Contents","MacOS",x),X=Uz(C(V(q)),j),W=`${process.pid}.${p()}`,Y=Qz(q);if(Y===null)return;let B=Y==="bundle";if(B)Z(k,["-u",q]);let F=D(Q,`.Ara.app.${W}.old`);if(!e.has(q)&&!xz($())){if(!B)Z(k,["-u",q]);try{R(q,F)}catch(K){if(K.code==="ENOENT")return;throw K}P(F,{recursive:!0,force:!0}),uz(Q);return}if(!B){if(Lz(V(q))===X)return;let K=`${V(q)}.${W}`;c(X,K);try{R(K,V(q))}finally{P(K,{force:!0})}return}let G=D(Q,`.Ara.app.${W}.shim`);i(C(V(G)),{recursive:!0}),c(X,V(G));try{try{R(q,F)}catch(K){if(K.code==="ENOENT")return;throw K}try{R(G,q)}catch(K){if(U(q))return;throw R(F,q),K}}finally{P(G,{recursive:!0,force:!0}),P(F,{recursive:!0,force:!0})}}function uz(z){try{if(Cz(z).some((Z)=>Z!==".DS_Store"))return;P(D(z,".DS_Store"),{force:!0}),Mz(z)}catch{}}var l=new Map;function hz(z=N()){let J=l.get(z);if(J)return J;if(process.platform!=="darwin")return[];let Z=s(z);if(Z===null&&U(C(v(z))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),Z=s(z);if(Z===null)return[];return l.set(z,Z),Z}function s(z){let J=v(z),Z=_(z);if(!w(J)||!f(J))try{dz({home:z,skipWhenSettled:!0})}catch{}let $=w(J)&&(f(J)||!w(Z))?J:w(Z)?Z:null,j=$?y($):null;if(!j)return null;if($===Z)e.add(Z);let q=M(j,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return q.status===0&&q.stdout===`spawn
|
|
@@ -20,7 +20,7 @@ The macOS privacy permissions of this computer's Reason worker:
|
|
|
20
20
|
allow asks for each missing one, or the one named. macOS cannot ask for Full
|
|
21
21
|
Disk Access: allow disk opens its pane, shows the file to add in Finder and
|
|
22
22
|
waits until the worker has it.
|
|
23
|
-
`,u="x-apple.systempreferences:com.apple.preference.security",az="curl -fsSL https://reasonmachines.com/install.sh | bash",oz=180000,rz=2000,h=["screen","accessibility","disk"],d={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${u}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${u}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${u}?Privacy_AllFiles`}};function Bz(z){return z.executable}function tz(z,J){if(z==="computer_use_identity_missing")return`Reason's background identity is not installed (${z}); reinstall Reason: ${az}`;if(z==="computer_use_identity_outdated")return`Reason's background identity is outdated (${I(J)??"unknown"}; this CLI is ${A}) (${z}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${z}); run the installed \`reason\``}function ez(z=N()){let J=b(z);if(J.length>0)return{state:"ready",path:g(g(g(J[0]))),prefix:J};let Z=Kz(J,z)??"computer_use_identity_unavailable";return{state:Z,path:v(z),detail:tz(Z,z)}}function Pz(){return{identity:()=>ez(),grants:(z)=>wz(z),request:(z,J)=>Nz(z,J),worker:async()=>(await import("./status-
|
|
23
|
+
`,u="x-apple.systempreferences:com.apple.preference.security",az="curl -fsSL https://reasonmachines.com/install.sh | bash",oz=180000,rz=2000,h=["screen","accessibility","disk"],d={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${u}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${u}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${u}?Privacy_AllFiles`}};function Bz(z){return z.executable}function tz(z,J){if(z==="computer_use_identity_missing")return`Reason's background identity is not installed (${z}); reinstall Reason: ${az}`;if(z==="computer_use_identity_outdated")return`Reason's background identity is outdated (${I(J)??"unknown"}; this CLI is ${A}) (${z}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${z}); run the installed \`reason\``}function ez(z=N()){let J=b(z);if(J.length>0)return{state:"ready",path:g(g(g(J[0]))),prefix:J};let Z=Kz(J,z)??"computer_use_identity_unavailable";return{state:Z,path:v(z),detail:tz(Z,z)}}function Pz(){return{identity:()=>ez(),grants:(z)=>wz(z),request:(z,J)=>Nz(z,J),worker:async()=>(await import("./status-jvapvrq5.js")).connectionMacState(),open:(z)=>{iz("/usr/bin/open",z,{stdio:"ignore",timeout:1e4})},tile:Xz,restartConnection:async()=>(await import("./connect-cli-7dy6febe.js")).restartConnection(),sleep:(z)=>new Promise((J)=>setTimeout(J,z)),now:()=>Date.now()}}function Yz(z,J,Z){if(z.state!=="ready"||!J)return"unknown";return J[Z]?"granted":"missing"}async function vz(z){let J=z.identity(),Z=J.state==="ready"?await z.grants(J.prefix):null,$=await z.worker(),j=$?Bz($):null,q=!j||$?.full_disk_access==="unknown"?"unknown":$?.full_disk_access==="granted"?"granted":"missing",Q=(V,X,W)=>{let{label:Y,purpose:B,level:F}=d[V];return{id:V,label:Y,purpose:B,level:F,state:X,holder:W}};return{identity:{state:J.state,path:J.path,detail:J.state==="ready"?null:J.detail},worker_detail:j?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[Q("screen",Yz(J,Z,"screen"),J.path),Q("accessibility",Yz(J,Z,"accessibility"),J.path),Q("disk",q,j)]}}function MJ(z){let J=z.identity.state==="ready"?null:z.identity.state,Z=z.permissions.filter((q)=>q.state==="granted").length,$=[...J?[J]:[],...z.permissions.filter((q)=>q.state!=="granted"&&!(J&&q.id!=="disk")).map((q)=>`${q.label} ${q.state}`)],j=!J&&z.permissions.some((q)=>q.state==="missing");return`Permissions: ${Z} of ${z.permissions.length}${$.length>0?` (${$.join(", ")})`:""}`+(j?" \u2014 reason permissions allow":$.length>0?" \u2014 reason permissions":"")}function zJ(z){let J=[];if(z.identity.detail)J.push(z.identity.detail);J.push(`Reason: ${z.identity.path}`);let Z=z.permissions.find(($)=>$.id==="disk");J.push(Z?.holder?`Worker: ${Z.holder}`:`Worker: ${z.worker_detail}`),J.push("");for(let $ of z.permissions){let j=`${$.label}${$.level==="recommended"?" (recommended)":""}`;J.push(` ${$.id.padEnd(13)} ${$.state.padEnd(7)} ${j}: ${$.purpose}`)}if(z.permissions.some(($)=>$.state==="missing"))J.push("","Allow the missing ones: reason permissions allow");return`${J.join(`
|
|
24
24
|
`)}
|
|
25
25
|
`}async function Gz(z,J){let Z=J.now()+oz;for(;;){if(await z())return!0;if(J.now()>=Z)return!1;await J.sleep(rz)}}async function JJ(z,J){let Z=J.host??Pz(),{io:$}=J,j=await vz(Z),q=j.permissions.filter((W)=>z.includes(W.id)&&W.state!=="granted");if(q.length===0)return $.stdout.write(`Reason permissions: ${z.map((W)=>d[W].label).join(", ")} already allowed.
|
|
26
26
|
`),0;let Q=!1,V=!1,X=Z.identity();for(let W of q){let{label:Y,pane:B}=d[W.id];if(W.id!=="disk"){if(X.state!=="ready"){if(!Q)$.stderr.write(`Reason permissions: ${X.detail}
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import"./vm-hands-entry-lite-z7twr5ec.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import{Nh as A}from"./vm-hands-entry-lite-a3n86qqm.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-
|
|
2
|
+
import"./vm-hands-entry-lite-z7twr5ec.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import{Nh as A}from"./vm-hands-entry-lite-a3n86qqm.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-c4pc076v.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-6eb7vytb.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ka as s,ob as i,qa as t,sb as n}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ka as s,ob as i,qa as t,sb as n}from"./vm-hands-entry-lite-pkwvjyy8.js";import"./vm-hands-entry-lite-5rbj89cs.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-8nmj4r5v.js";import"./vm-hands-entry-lite-d94sv87n.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";import{spawn as Zq}from"child_process";import{chmodSync as $q,chownSync as zq,existsSync as Qq,lstatSync as S,mkdirSync as Wq,mkdtempSync as Gq,readdirSync as m,readFileSync as F,realpathSync as Jq,rmSync as Yq,writeFileSync as u}from"fs";import{join as U}from"path";var o="/sys/fs/cgroup/reason-payload",k="vm-hands",Kq="/run/ara-srt/fallbacks.jsonl",E="/reason-person",Bq=5000,bq=1e4,c="__VM_HANDS_PROOF_DIR__",Tq="__VM_HANDS_PROBE_NONCE__";class L extends Error{code;constructor(q,W){super(W);this.code=q}}var Lq=30000,e=(q)=>`'${q.replaceAll("'","'\\''")}'`;function xq(q){let W=q.cgroup??o,J=q.init.layout.payload_uid,X=q.log??(()=>{}),Q=null,Z=0,T=()=>{try{let z=F("/run/ara-srt/starts.jsonl","utf8"),$=z.slice(Z>z.length?0:Z).split(`
|
|
3
3
|
`).filter(Boolean);Z=z.length;let G=$.map((Y)=>{try{return Number(JSON.parse(Y).elapsed_ms)||0}catch{return 0}});if(G.length)X("vm_hands.srt_server_starts",{count:G.length,elapsed_ms:G.slice(0,8)})}catch{}},j=null,D=!1,C=q.srtCgroup??"/sys/fs/cgroup/reason-srt",R=()=>{j??=Iq()},N=0,A=()=>{try{let z=F(Kq,"utf8"),$=z.slice(N>z.length?0:N);N=z.length;let G=$.split(`
|
|
4
4
|
`).filter(Boolean).slice(0,1000);if(!G.length)return null;let Y={},K=0;for(let b of G)try{let M=JSON.parse(b),I=typeof M.code==="string"&&/^[a-z_]{1,40}$/.test(M.code)?M.code:"other";if(Y[I]=(Y[I]??0)+1,typeof M.elapsed_ms==="number")K=Math.max(K,M.elapsed_ms)}catch{Y.unparsed=(Y.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:G.length,codes:Y,max_elapsed_ms:K}),{count:G.length,codes:Y,max_elapsed_ms:K}}catch{return null}},v=!1,qq=(z,$,G)=>{if(v)throw Error("vm_hands_pool_held");return H(z,$,G)},H=(z,$,G)=>Zq("/bin/sh",["-c",`echo $$ > ${e(U(W,k,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",z,...$],G),Xq=(z)=>H(z.command,z.args,z.options),P=q.prespawn?s({spawnProcess:qq,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(z,$)=>X(z,$??{})}):null;P?.arm();let h=P?setInterval(()=>{if(!Q)P.arm()},Lq):null;h?.unref?.();async function y(){let z=Q;if(Q=null,!z)return;z.abort.abort(),await z.done}return{async startExecutor(z){if(R(),D=!0,!z.claim)throw new L("vm_hands_bind_invalid","an executor needs the claim it serves");await y();let $=z.claim,G=$.owner;if(!G||typeof G.device_id!=="string"||typeof $.root_id!=="string")throw new L("vm_hands_bind_invalid","claim without its owner Device or root");let Y=new AbortController,K,b,M=new Promise((B,O)=>{K=B,b=O}),I,w=new Promise((B)=>{I=B}),g=n({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:G.device_id,rootId:$.root_id,apiOrigin:q.apiOrigin},claimOwner:$.owner,root:q.root,runId:$.run_id,operationId:$.operation_id,attemptId:$.attempt_id,payload:Object.fromEntries(Object.entries($.payload).filter(([B])=>!B.startsWith("vm_hands_"))),signal:Y.signal,emitEvent:async(B,O)=>{if(B==="hands.ready"){K(O);return}if(B==="hands.started"||B==="hands.stopped"||B==="hands.failed")return;await q.forward(B,O)}},{...q.relayDependencies,spawnWorker:Xq,...P?{takePrespawnedWorker:P.take,adoptSpawnedWorker:P.adopt}:{}}).then(()=>{I("executor_stopped")},(B)=>{let O=B&&typeof B==="object"&&"code"in B?String(B.code):"executor_failed";b(new L(O,B instanceof Error?B.message:String(B))),I(O)}).finally(()=>b(new L("vm_hands_executor_exited","executor ended before it was ready")));Q={abort:Y,done:g,exited:w,operationId:$.operation_id,runId:$.run_id,expiresAtMs:Date.parse(String($.payload.expires_at??""))||0};let V=await M,x=V.executor_launch_id;if(typeof x!=="string")throw new L("vm_hands_bind_failed","executor ready without a launch id");return{launchId:x,readyData:V,applied:{hands_confinement:typeof $.payload.hands_confinement==="string"?$.payload.hands_confinement:null,browser_egress:$.payload.browser_egress??null}}},takeSrtFallbacks:A,executorExited(){return Q?Q.exited:new Promise(()=>{})},async killAndVerifyPayload(){v=!0;let z=Aq();try{await Dq(),await y().catch(()=>{return}),T();let $=Date.now()+Bq;await p(W,$,"payload");let G=(D||q.srtWarmLate?.()===!0)&&Qq(U(C,"cgroup.events"));if(G)await p(C,$,"srt");let Y=Cq(J).filter((K)=>!l(K,E));if(j!==null){let K=Mq(j).filter((b)=>b!==process.pid&&!l(b,E));if(K.length)throw X("vm_hands.kill_strays",{strays:K.slice(0,16).map((b)=>{let M="?",I="?";try{M=F(`/proc/${b}/comm`,"utf8").trim().slice(0,32)}catch{}try{I=(F(`/proc/${b}/cgroup`,"utf8").split(`
|
|
5
5
|
`).find((w)=>w.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:b,comm:M,cgroup:I}})}),new L("vm_hands_kill_unverified",`${K.length} process(es) the run started survived it`);j=null}if(D=!1,G)q.onSrtReset?.();if(Y.length)throw X("vm_hands.kill_survivors",{pids:Y.slice(0,16)}),new L("vm_hands_kill_unverified",`${Y.length} payload-uid process(es) outside the payload cgroup`)}finally{v=!1,z()}if(P)setTimeout(()=>{if(!Q)P.arm()},100).unref?.()},async runProbe({nonce:z,script:$}){if(R(),!$.includes(c))throw new L("vm_hands_probe_failed","probe names no proof directory");let G=q.proofParent??"/tmp/reason-vm-hands-proof";Wq(G,{mode:457,recursive:!0});let Y=S(G);if(Y.isSymbolicLink()||!Y.isDirectory()||Y.uid!==(process.getuid?.()??-1)||(Y.mode&4095)!==457)throw new L("vm_hands_probe_failed","proof parent is not root's 0711 directory");let K=Gq(U(G,"p-")),b=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(K)||!/^[A-Za-z0-9_-]{1,128}$/.test(z))throw new L("vm_hands_probe_failed","proof directory path or nonce");zq(K,J,J),$q(K,448);let M=S(K).ino,I=H("/bin/bash",["-c",$.replaceAll(c,K).replaceAll(Tq,z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),w="";I.stdout?.on("data",(V)=>{if(w.length<16384)w+=V.toString("utf8").slice(0,16384-w.length)});let g=await new Promise((V)=>{let x=setTimeout(()=>{b=!0,I.kill("SIGKILL"),V(124)},bq);I.once("error",()=>{clearTimeout(x),V(127)}),I.once("close",(B)=>{clearTimeout(x),V(B??1)})});return X("vm_hands.probe",{nonce_len:z.length,exit_code:g}),{exitCode:g,markers:w,proofDirInode:M}}finally{if(!b)Yq(K,{recursive:!0,force:!0})}},restatLayout(){let{session_root:z,alias:$}=q.init.layout,G="invalid";try{i(z),G="0:0:755"}catch{}let Y=!1,K=-1;try{let b=S($);K=b.uid,Y=G==="0:0:755"&&$===U(z,"repo")&&!b.isSymbolicLink()&&b.isDirectory()&&Jq($)===$&&b.uid===J}catch{}return{root_mode:G,alias_ok:Y,owner_uid:K}},installEnvironment(z){let $=Q;if(!$)throw new L("environment_unavailable","no executor owns an environment");return t({root:q.root,operationId:$.operationId,payload:z}).installed_revision},async stop(){if(h)clearInterval(h);P?.close(),await y()}}}function l(q,W,J="/proc"){try{let Q=F(U(J,String(q),"cgroup"),"utf8").split(`
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Nh as E}from"./vm-hands-entry-lite-a3n86qqm.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-
|
|
2
|
+
import{Nh as E}from"./vm-hands-entry-lite-a3n86qqm.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-phg0kvet.js"),import("./desktop-account-vr5beh82.js"),import("./worker-sandbox-wqxffxa1.js")]);J();let K=(process.geteuid?.()??0)!==0,z=new Map,y=(B)=>{try{process.send?.(B)}catch{}};process.on("message",(B)=>{let j=B;if(j?.t==="cancel"){z.get(j.id)?.abort();return}if(j?.t!=="op")return;if(!K){y({t:"done",id:j.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let F=new AbortController;z.set(j.id,F),G(j.state,j.claim,{worker:j.worker,signal:F.signal,emit:(q)=>{let{deliverySignal:N,...M}=q;y({t:"event",id:j.id,event:M})}}).then((q)=>y({t:"done",id:j.id,completion:q}),(q)=>y({t:"done",id:j.id,completion:{status:"failed",error_code:q&&typeof q==="object"&&"code"in q&&typeof q.code==="string"?q.code:"vm_hands_op_failed"}})).finally(()=>z.delete(j.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}export{Q as runVmHandsOpRunner};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
2
|
import{u as y,v as k,w as m}from"./vm-hands-entry-lite-z7twr5ec.js";import{Wc as v}from"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import{Nh as K}from"./vm-hands-entry-lite-a3n86qqm.js";import{spawn as n}from"child_process";import{createHash as i}from"crypto";import{lstatSync as T,mkdirSync as d,readFileSync as a,statSync as r,writeFileSync as l}from"fs";var A="/run/reason-vm-hands",E="/run/reason-vm-hands/env",f="/home/runner",t=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,O="/sys/fs/cgroup/reason-srt",R="/usr/local/bin/ara-srt-exec",e=65536,jj=21600000;function qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;d(j,{recursive:!0,mode:448});let q=T(j);if(!q.isDirectory()||q.uid!==0||(q.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}l(`${j}/base-keyed`,`1
|
|
3
|
-
`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function S(Q,j){let q=(G)=>{return j("srt_warm_skipped",{reason:G}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return q("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>e||Z.toString("base64")!==Q.srt_base_settings)return q("settings_invalid");try{let G=T(O);if(!G.isDirectory()||G.uid!==0||(G.mode&18)!==0)return q("cgroup_unsafe");for(let[Y,N]of[[R,!1],["/usr/local/bin",!0]]){let B=T(Y);if((N?!B.isDirectory():!B.isFile())||B.uid!==0||(B.mode&18)!==0)return q("srt_exec_unsafe")}}catch{return q("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return q("not_root");let z=performance.now(),X=i("sha256").update(Z).digest("hex"),M=`${A}/srt-base-settings.json`;try{l(M,Z,{mode:384,flag:"w"})}catch{return q("settings_write")}let H=n("/bin/sh",["-c",`echo $$ > ${O}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",R,"--settings",M,"--idle-ms",String(jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((G)=>{H.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),G()}),H.once("close",(Y)=>{j(Y===0?"srt_warm_done":"srt_warm_failed",{exit_code:Y,warm_ms:Math.round(performance.now()-z),settings_sha256:X}),G()})})}var p=3000;function Yj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,q=j.layout,Z=j.device_key,z=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&t.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!z&&typeof z.key_id==="string"&&Number.isSafeInteger(z.expires_at_ms)&&typeof z.signature==="string"&&!!q&&typeof q.session_root==="string"&&typeof q.alias==="string"&&Number.isSafeInteger(q.payload_uid)&&typeof q.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function u(Q){d(Q,{recursive:!0,mode:448});let j=r(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Jj(Q){let[{CLI_VERSION:j},q,Z,z]=await Promise.all([import("./version-
|
|
4
|
-
`)){let q=j.split(":");if(q.length>=4&&Number(q[2])===Q&&/^\d+$/.test(q[3]??"")&&Number(q[3])>0)return Number(q[3])}throw Error("vm_hands_payload_account_unavailable")}function zj(Q,j){let q=j.owner;if(!q||typeof q.organization_id!=="string"||typeof q.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Hj(Q,j){u(A),u(E),qj(j);let q=S(Q,j),Z=!1,z=async()=>{if(!await Promise.race([q.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),p).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:p})},[{configureDesktopAccount:X},{configureWorkerSandbox:M}]=await Promise.all([import("./desktop-account-vr5beh82.js"),import("./worker-sandbox-wqxffxa1.js")]);M();try{X({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let H=new AbortController;for(let J of["SIGTERM","SIGINT"])process.on(J,()=>H.abort());let G=null,Y,N=new Promise((J)=>{Y=J}),B=N.then(()=>import("./vm-hands-executor-
|
|
3
|
+
`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function S(Q,j){let q=(G)=>{return j("srt_warm_skipped",{reason:G}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return q("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>e||Z.toString("base64")!==Q.srt_base_settings)return q("settings_invalid");try{let G=T(O);if(!G.isDirectory()||G.uid!==0||(G.mode&18)!==0)return q("cgroup_unsafe");for(let[Y,N]of[[R,!1],["/usr/local/bin",!0]]){let B=T(Y);if((N?!B.isDirectory():!B.isFile())||B.uid!==0||(B.mode&18)!==0)return q("srt_exec_unsafe")}}catch{return q("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return q("not_root");let z=performance.now(),X=i("sha256").update(Z).digest("hex"),M=`${A}/srt-base-settings.json`;try{l(M,Z,{mode:384,flag:"w"})}catch{return q("settings_write")}let H=n("/bin/sh",["-c",`echo $$ > ${O}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",R,"--settings",M,"--idle-ms",String(jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((G)=>{H.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),G()}),H.once("close",(Y)=>{j(Y===0?"srt_warm_done":"srt_warm_failed",{exit_code:Y,warm_ms:Math.round(performance.now()-z),settings_sha256:X}),G()})})}var p=3000;function Yj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,q=j.layout,Z=j.device_key,z=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&t.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!z&&typeof z.key_id==="string"&&Number.isSafeInteger(z.expires_at_ms)&&typeof z.signature==="string"&&!!q&&typeof q.session_root==="string"&&typeof q.alias==="string"&&Number.isSafeInteger(q.payload_uid)&&typeof q.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function u(Q){d(Q,{recursive:!0,mode:448});let j=r(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Jj(Q){let[{CLI_VERSION:j},q,Z,z]=await Promise.all([import("./version-h0hrdfe3.js"),import("./hands-worker-source-emf3gv2b.js"),import("./network-contract-y6kbgyhe.js"),import("./device-workspace-s5z0zr53.js")]),{REASON_HANDS_PROTOCOL_VERSION:X}=await import("./reason-hands-protocol-5wqth9ga.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:q.REASON_HANDS_WORKER_VERSION,protocol_version:X,worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:z.REASON_WORKSPACE_BASE,workspace_layout:z.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var g=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],Qj=new Set(["pty.start","jobs.control"]);function Zj(Q,j){let q=j([{id:"vm-hands",label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(g.map((X)=>[X,!0]))}}),Z=Q.capabilities,z={...Z.operation_constraints};for(let X of g)z[X]={...q.operation_constraints?.[X]??{},ready:!0,execution_mode:q.operation_constraints?.[X]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...g],operation_constraints:z}}}function $j(Q){for(let j of a("/etc/passwd","utf8").split(`
|
|
4
|
+
`)){let q=j.split(":");if(q.length>=4&&Number(q[2])===Q&&/^\d+$/.test(q[3]??"")&&Number(q[3])>0)return Number(q[3])}throw Error("vm_hands_payload_account_unavailable")}function zj(Q,j){let q=j.owner;if(!q||typeof q.organization_id!=="string"||typeof q.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Hj(Q,j){u(A),u(E),qj(j);let q=S(Q,j),Z=!1,z=async()=>{if(!await Promise.race([q.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),p).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:p})},[{configureDesktopAccount:X},{configureWorkerSandbox:M}]=await Promise.all([import("./desktop-account-vr5beh82.js"),import("./worker-sandbox-wqxffxa1.js")]);M();try{X({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let H=new AbortController;for(let J of["SIGTERM","SIGINT"])process.on(J,()=>H.abort());let G=null,Y,N=new Promise((J)=>{Y=J}),B=N.then(()=>import("./vm-hands-executor-htdjhq9a.js")).then(({createVmHandsExecutor:J})=>{let $=J({init:Q,root:f,runtimeDirectory:A,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,q=S(Q,j)},srtWarmLate:()=>Z,forward:(U,L)=>G?G(U,L):Promise.reject(Error("vm_hands_not_bound")),log:(U,L)=>j(U,L)});return j("executor_loaded"),$}),C=(J)=>async(...$)=>(await B)[J](...$),V=null;B.then((J)=>{V=()=>J.executorExited()});let W={startExecutor:async(...J)=>{return await z(),C("startExecutor")(...J)},killAndVerifyPayload:C("killAndVerifyPayload"),runProbe:async(...J)=>{return await z(),C("runProbe")(...J)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:()=>V?V():new Promise(()=>{}),takeSrtFallbacks:()=>null};B.then((J)=>{W.restatLayout=()=>J.restatLayout(),W.installEnvironment=($)=>J.installEnvironment($),W.takeSrtFallbacks=()=>J.takeSrtFallbacks?.()??null});let s=await y(Q),c=new k(Q,s,W,{envRoot:E}),x=Jj(Q),I=null,o=Promise.all([x,import("./local-capabilities-phg0kvet.js")]).then(([J,$])=>{I=Zj(J,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((J)=>j("device_ops_unavailable",{error:J instanceof Error?J.name:"error"})),D=N.then(()=>import("./vm-hands-executor-htdjhq9a.js")).then(({createVmHandsOpRunners:J})=>J({payloadUid:Q.layout.payload_uid,payloadGid:$j(Q.layout.payload_uid),log:($,U)=>j($,U)})).catch(()=>null);D.then((J)=>J?.warm("person")),j("agent_ready"),await m({apiOrigin:Q.api_origin,agent:c,signal:H.signal,heartbeat:async()=>I??await x,executeOp:async({kind:J,claim:$,signal:U,emit:L})=>{let b=zj(Q,$);if(!b)return{status:"failed",error_code:"vm_hands_bind_invalid"};let w={executionMode:"unsandboxed",runtimeDirectory:A,readiness:Object.fromEntries(g.map((F)=>[F,!0]))},h=(F)=>{let P=typeof F.kind==="string"?F.kind:"";if(P)L({kind:P,...F.data&&typeof F.data==="object"?{data:F.data}:{}})};if($.capability==="exec.full"&&J!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&J!=="model")return{status:"failed",error_code:"capability_not_granted"};if(Qj.has(String($.capability))){let{executeLocalOperation:F}=await import("./local-capabilities-phg0kvet.js");return F(b,$,{worker:w,signal:U,emit:(P)=>h(P)})}let _=await D;if(!_)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return _.run(J,{id:String($.attempt_id),claim:$,state:b,worker:w},h,U)},readyData:({launchId:J})=>({executor_launch_id:J}),log:(J,$)=>{if(J==="vm_hands.registered"||J==="vm_hands.reconnected")Y();j(J,$)},onTurn:(J)=>{G=J}}),await(await B).stop(),(await D)?.stop()}export{S as startBaseSrtServer,Hj as runVmHands,Yj as parseVmHandsInit,Jj as heartbeatBody,qj as enableBaseKeyedSrt};
|