@reason-machines/cli-linux-arm64-musl 0.2.295 → 0.2.296

package/bin/vm-hands/{vm-hands-entry-lite-mk9p22xa.js → vm-hands-entry-lite-ya1a2eep.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Qb as D}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Jh as j}from"./vm-hands-entry-lite-sn3vjjgx.js";import{statSync as i}from"fs";import{delimiter as n,join as t}from"path";function _(q,z=process.env.PATH??""){if(!q||q.includes("/")||q.includes("\x00"))return!1;return z.split(n).some((G)=>{if(!G)return!1;try{let Q=i(t(G,q));return Q.isFile()&&(Q.mode&73)!==0}catch{return!1}})}import{spawn as r,spawnSync as e}from"child_process";import{existsSync as k,mkdtempSync as E,readFileSync as O,readdirSync as o,realpathSync as qq,rmSync as b,statSync as zq}from"fs";import{platform as y,tmpdir as g}from"os";import{dirname as A,join as Z}from"path";import{fileURLToPath as Gq,pathToFileURL as T}from"url";var Hq=["bwrap","socat","rg"],Jq=2000,v=20000,Qq=3,P=4000,Vq=new Set([".git",".hg",".svn","node_modules"]),Wq=["runAsHostUid","sysrq-trigger"],Yq=Z(A(A(Gq(import.meta.url))),"packages/sandbox-runtime/src/index.ts"),h=!1;function fq(){h=!0}async function u(){let z=h?Z(A(qq(process.execPath)),"runtime","srt"):void 0;if(z&&process.platform==="linux"&&!k(Z(z,"vendor","seccomp",process.arch,"apply-seccomp")))throw Error("packaged_sandbox_runtime_vendor_missing");if(z){let J=O(Z(z,"sandbox-runtime.mjs"),"utf8");for(let Y of Wq)if(!J.includes(Y))throw Error(`packaged_sandbox_runtime_fork_missing:${Y}`)}let H=(await import(z?T(Z(z,"sandbox-runtime.mjs")).href:T(Yq).href)).SandboxManager;if(!H||typeof H.initialize!=="function"||typeof H.wrapWithSandboxArgv!=="function")throw Error("sandbox-runtime does not expose the expected SandboxManager API.");return{SandboxManager:H}}function Zq(q={}){if((q.platformName??y())!=="linux")return!1;let G=q.fileExists??k,Q=q.readFile??((H)=>O(H,"utf8"));for(let H of["/.dockerenv","/run/.containerenv"])try{if(G(H))return!0}catch{}try{return/docker|containerd|kubepods|lxc|libpod/.test(Q("/proc/1/cgroup"))}catch{return!1}}function l(q){return["/bin/true","/usr/bin/true"].find((z)=>q(z))??null}function $q(q,z){return q==="strict"?["--ro-bind","/","/","--unshare-pid","--unshare-user","--cap-drop","ALL","--proc","/proc","--",z]:["--ro-bind","/","/","--unshare-pid","--unshare-user","--bind","/proc","/proc","--",z]}function jq(q,z){try{let G=e("bwrap",$q(q,z),{stdio:"ignore",timeout:Jq});return!G.error&&G.status===0}catch{return!1}}function Bq(q){let z=q.platformName??y();if(z!=="linux")return null;let G=q.hasExecutable??_;if(!Hq.every((V)=>G(V)))return null;let Q=q.fileExists??k,H=l(Q);if(!H)return null;let J=B??(q.containerized??Zq({platformName:z})?"weak":"strict");return(q.probeNamespaces??((V)=>jq(V,H)))(J)?J:null}var L=null,C=!1,K=null,S=null,f=null,B=null,F=null;function M(){throw I("sandbox_mode_conflict"),new j("sandbox_unavailable","Sandbox process policy conflicts with an existing probe or session. Restart the worker.")}function xq(q){if(B!==null&&B!==q||C&&L!==null&&L!==q||F!==null&&F!==q)M();B=q}function I(q){K=q}function c(q){if(K)return!1;if(!C){if(L=Bq(q??{}),C=!0,L&&!q)d()}return L!==null}function Lq(){return c()?L:null}var U=null,w=0;function m(q){if(K)throw new j("sandbox_unavailable","Confined execution is unavailable in this worker process.");if(B&&q.sandboxMode&&B!==q.sandboxMode)M();let z=B??q.sandboxMode??Lq();if(!z)throw new j("sandbox_unavailable","Confined command execution is unavailable on this operating system.");if(F&&F!==z)M();return F=z,U??=(async()=>{let{SandboxManager:G}=await(q.loadSandboxRuntime??u)();return await G.initialize(Iq(z)),G})().catch((G)=>{throw U=null,I(`initialize_failed: ${String(G)}`),G instanceof j?G:new j("sandbox_unavailable","The confined execution sandbox failed to start.")}),U.then((G)=>{if(K)throw new j("sandbox_unavailable","Confined execution became unavailable during sandbox initialization.");return G})}async function Kq(){let q=U;if(U=null,!q)return;try{await(await q).reset()}catch{}}async function d(q={}){if(K)return!1;if(q.loadSandboxRuntime)return x(q.loadSandboxRuntime);if(!c())return!1;return S??=x(u),S}async function x(q){try{let{SandboxManager:z}=await q(),G=z.checkDependencies().errors;if(G.length>0)return I(`dependencies_missing: ${G.join(", ")}`),!1;return!K}catch(z){return I(`load_failed: ${String(z)}`),!1}}async function Rq(q={}){if(!q.loadSandboxRuntime&&!q.sandboxMode){if(!await d())return!1;return f??=R({}),f}return R(q)}async function R(q){let z;try{z=await m(q)}catch{return!1}let G=await Xq(z);if(!G)I("confined_command_failed");if(w===0)await Kq();return G}async function Xq(q){let z=l(k);if(!z)return!1;let G=E(Z(g(),"reason-device-probe-"));try{let{argv:Q}=await q.wrapWithSandboxArgv(a([z]),p(),{filesystem:s({root:G,allowWrite:!1,temporaryDirectory:G,protectedPaths:[]})},void 0,G),[H,...J]=Q;if(!H)return!1;return await Fq(H,J,G)}catch{return!1}finally{try{q.cleanupAfterCommand()}catch{}b(G,{recursive:!0,force:!0})}}function Fq(q,z,G,Q={}){return new Promise((H)=>{let J=!1,Y,V=(X)=>{if(J)return;J=!0,clearTimeout(Y),H(X)},W;try{W=(Q.spawnChild??r)(q,z,{cwd:G,env:{PATH:D,HOME:G,TMPDIR:G},stdio:"ignore"})}catch{V(!1);return}W.once("error",()=>V(!1));let $=(X,N)=>V(X===0&&N===null);if(W.once("exit",$),W.once("close",$),W.exitCode!==null||W.signalCode!==null)$(W.exitCode,W.signalCode);if(J)return;Y=setTimeout(()=>{V(!1);try{W.kill("SIGKILL")}catch{}},Math.min(Q.timeoutMs??v,v))})}function p(q=k){return["/bin/bash","/bin/sh"].find((z)=>q(z))??"/bin/sh"}function a(q){return q.map((z)=>`'${z.replaceAll("'","'\\''")}'`).join(" ")}function Uq(q,z,G=(Q)=>o(Q,{withFileTypes:!0}).filter((H)=>H.isDirectory()||H.isFile()).map((H)=>H.name)){let Q=[],H=[{path:q,depth:0}],J=0;while(H.length>0&&J<P){let Y=H.pop(),V;try{V=G(Y.path)}catch{continue}for(let W of V){if(J+=1,J>P)break;let $=Z(Y.path,W);if(z($)){Q.push($);continue}if(Y.depth+1<Qq&&!Vq.has(W))H.push({path:$,depth:Y.depth+1})}}return Q}function s(q){let z=Z(q.root,".git"),G=[];try{if(zq(z).isDirectory())G=[Z(z,"config"),Z(z,"hooks")]}catch{}return{denyRead:["/home","/root","/tmp","/tmp/.X11-unix",...q.protectedPaths],allowRead:[q.root,q.temporaryDirectory],allowWrite:[...q.allowWrite?[q.root]:[],q.temporaryDirectory],denyWrite:[...q.protectedPaths,...G]}}function Iq(q){return{network:{allowedDomains:[],deniedDomains:[]},filesystem:{denyRead:[],allowRead:[],allowWrite:[],denyWrite:[]},...q==="weak"?{enableWeakerNestedSandbox:!0}:{}}}function Dq(q){let z=q.createTemporaryDirectory??(()=>E(Z(g(),"reason-device-"))),G=q.removeTemporaryDirectory??((Q)=>b(Q,{recursive:!0,force:!0}));return async(Q,H,J)=>{let Y=await m(q),V=z();w+=1;try{let W;try{W=await Y.wrapWithSandboxArgv(a([Q,...H]),q.shell??p(),{filesystem:s({root:J.root,allowWrite:J.allowWrite,temporaryDirectory:V,protectedPaths:Uq(J.root,q.isProtectedPath)})},J.signal,J.cwd)}catch(N){throw N instanceof j?N:new j("sandbox_unavailable","The confined execution sandbox could not wrap the command.")}let[$,...X]=W.argv;if(!$)throw new j("sandbox_unavailable","The confined execution sandbox produced no command.");return await q.spawnCaptured($,X,{cwd:J.cwd,timeoutMs:J.timeoutMs,signal:J.signal,env:q.scrubEnvironment(J.root,V)})}finally{w-=1;try{Y.cleanupAfterCommand()}catch{}G(V)}}}
+import{Qb as D}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Kh as j}from"./vm-hands-entry-lite-xsq25kmd.js";import{statSync as i}from"fs";import{delimiter as n,join as t}from"path";function _(q,z=process.env.PATH??""){if(!q||q.includes("/")||q.includes("\x00"))return!1;return z.split(n).some((G)=>{if(!G)return!1;try{let Q=i(t(G,q));return Q.isFile()&&(Q.mode&73)!==0}catch{return!1}})}import{spawn as r,spawnSync as e}from"child_process";import{existsSync as k,mkdtempSync as E,readFileSync as O,readdirSync as o,realpathSync as qq,rmSync as b,statSync as zq}from"fs";import{platform as y,tmpdir as g}from"os";import{dirname as A,join as Z}from"path";import{fileURLToPath as Gq,pathToFileURL as T}from"url";var Hq=["bwrap","socat","rg"],Jq=2000,v=20000,Qq=3,P=4000,Vq=new Set([".git",".hg",".svn","node_modules"]),Wq=["runAsHostUid","sysrq-trigger"],Yq=Z(A(A(Gq(import.meta.url))),"packages/sandbox-runtime/src/index.ts"),h=!1;function fq(){h=!0}async function u(){let z=h?Z(A(qq(process.execPath)),"runtime","srt"):void 0;if(z&&process.platform==="linux"&&!k(Z(z,"vendor","seccomp",process.arch,"apply-seccomp")))throw Error("packaged_sandbox_runtime_vendor_missing");if(z){let J=O(Z(z,"sandbox-runtime.mjs"),"utf8");for(let Y of Wq)if(!J.includes(Y))throw Error(`packaged_sandbox_runtime_fork_missing:${Y}`)}let H=(await import(z?T(Z(z,"sandbox-runtime.mjs")).href:T(Yq).href)).SandboxManager;if(!H||typeof H.initialize!=="function"||typeof H.wrapWithSandboxArgv!=="function")throw Error("sandbox-runtime does not expose the expected SandboxManager API.");return{SandboxManager:H}}function Zq(q={}){if((q.platformName??y())!=="linux")return!1;let G=q.fileExists??k,Q=q.readFile??((H)=>O(H,"utf8"));for(let H of["/.dockerenv","/run/.containerenv"])try{if(G(H))return!0}catch{}try{return/docker|containerd|kubepods|lxc|libpod/.test(Q("/proc/1/cgroup"))}catch{return!1}}function l(q){return["/bin/true","/usr/bin/true"].find((z)=>q(z))??null}function $q(q,z){return q==="strict"?["--ro-bind","/","/","--unshare-pid","--unshare-user","--cap-drop","ALL","--proc","/proc","--",z]:["--ro-bind","/","/","--unshare-pid","--unshare-user","--bind","/proc","/proc","--",z]}function jq(q,z){try{let G=e("bwrap",$q(q,z),{stdio:"ignore",timeout:Jq});return!G.error&&G.status===0}catch{return!1}}function Bq(q){let z=q.platformName??y();if(z!=="linux")return null;let G=q.hasExecutable??_;if(!Hq.every((V)=>G(V)))return null;let Q=q.fileExists??k,H=l(Q);if(!H)return null;let J=B??(q.containerized??Zq({platformName:z})?"weak":"strict");return(q.probeNamespaces??((V)=>jq(V,H)))(J)?J:null}var L=null,C=!1,K=null,S=null,f=null,B=null,F=null;function M(){throw I("sandbox_mode_conflict"),new j("sandbox_unavailable","Sandbox process policy conflicts with an existing probe or session. Restart the worker.")}function xq(q){if(B!==null&&B!==q||C&&L!==null&&L!==q||F!==null&&F!==q)M();B=q}function I(q){K=q}function c(q){if(K)return!1;if(!C){if(L=Bq(q??{}),C=!0,L&&!q)d()}return L!==null}function Lq(){return c()?L:null}var U=null,w=0;function m(q){if(K)throw new j("sandbox_unavailable","Confined execution is unavailable in this worker process.");if(B&&q.sandboxMode&&B!==q.sandboxMode)M();let z=B??q.sandboxMode??Lq();if(!z)throw new j("sandbox_unavailable","Confined command execution is unavailable on this operating system.");if(F&&F!==z)M();return F=z,U??=(async()=>{let{SandboxManager:G}=await(q.loadSandboxRuntime??u)();return await G.initialize(Iq(z)),G})().catch((G)=>{throw U=null,I(`initialize_failed: ${String(G)}`),G instanceof j?G:new j("sandbox_unavailable","The confined execution sandbox failed to start.")}),U.then((G)=>{if(K)throw new j("sandbox_unavailable","Confined execution became unavailable during sandbox initialization.");return G})}async function Kq(){let q=U;if(U=null,!q)return;try{await(await q).reset()}catch{}}async function d(q={}){if(K)return!1;if(q.loadSandboxRuntime)return x(q.loadSandboxRuntime);if(!c())return!1;return S??=x(u),S}async function x(q){try{let{SandboxManager:z}=await q(),G=z.checkDependencies().errors;if(G.length>0)return I(`dependencies_missing: ${G.join(", ")}`),!1;return!K}catch(z){return I(`load_failed: ${String(z)}`),!1}}async function Rq(q={}){if(!q.loadSandboxRuntime&&!q.sandboxMode){if(!await d())return!1;return f??=R({}),f}return R(q)}async function R(q){let z;try{z=await m(q)}catch{return!1}let G=await Xq(z);if(!G)I("confined_command_failed");if(w===0)await Kq();return G}async function Xq(q){let z=l(k);if(!z)return!1;let G=E(Z(g(),"reason-device-probe-"));try{let{argv:Q}=await q.wrapWithSandboxArgv(a([z]),p(),{filesystem:s({root:G,allowWrite:!1,temporaryDirectory:G,protectedPaths:[]})},void 0,G),[H,...J]=Q;if(!H)return!1;return await Fq(H,J,G)}catch{return!1}finally{try{q.cleanupAfterCommand()}catch{}b(G,{recursive:!0,force:!0})}}function Fq(q,z,G,Q={}){return new Promise((H)=>{let J=!1,Y,V=(X)=>{if(J)return;J=!0,clearTimeout(Y),H(X)},W;try{W=(Q.spawnChild??r)(q,z,{cwd:G,env:{PATH:D,HOME:G,TMPDIR:G},stdio:"ignore"})}catch{V(!1);return}W.once("error",()=>V(!1));let $=(X,N)=>V(X===0&&N===null);if(W.once("exit",$),W.once("close",$),W.exitCode!==null||W.signalCode!==null)$(W.exitCode,W.signalCode);if(J)return;Y=setTimeout(()=>{V(!1);try{W.kill("SIGKILL")}catch{}},Math.min(Q.timeoutMs??v,v))})}function p(q=k){return["/bin/bash","/bin/sh"].find((z)=>q(z))??"/bin/sh"}function a(q){return q.map((z)=>`'${z.replaceAll("'","'\\''")}'`).join(" ")}function Uq(q,z,G=(Q)=>o(Q,{withFileTypes:!0}).filter((H)=>H.isDirectory()||H.isFile()).map((H)=>H.name)){let Q=[],H=[{path:q,depth:0}],J=0;while(H.length>0&&J<P){let Y=H.pop(),V;try{V=G(Y.path)}catch{continue}for(let W of V){if(J+=1,J>P)break;let $=Z(Y.path,W);if(z($)){Q.push($);continue}if(Y.depth+1<Qq&&!Vq.has(W))H.push({path:$,depth:Y.depth+1})}}return Q}function s(q){let z=Z(q.root,".git"),G=[];try{if(zq(z).isDirectory())G=[Z(z,"config"),Z(z,"hooks")]}catch{}return{denyRead:["/home","/root","/tmp","/tmp/.X11-unix",...q.protectedPaths],allowRead:[q.root,q.temporaryDirectory],allowWrite:[...q.allowWrite?[q.root]:[],q.temporaryDirectory],denyWrite:[...q.protectedPaths,...G]}}function Iq(q){return{network:{allowedDomains:[],deniedDomains:[]},filesystem:{denyRead:[],allowRead:[],allowWrite:[],denyWrite:[]},...q==="weak"?{enableWeakerNestedSandbox:!0}:{}}}function Dq(q){let z=q.createTemporaryDirectory??(()=>E(Z(g(),"reason-device-"))),G=q.removeTemporaryDirectory??((Q)=>b(Q,{recursive:!0,force:!0}));return async(Q,H,J)=>{let Y=await m(q),V=z();w+=1;try{let W;try{W=await Y.wrapWithSandboxArgv(a([Q,...H]),q.shell??p(),{filesystem:s({root:J.root,allowWrite:J.allowWrite,temporaryDirectory:V,protectedPaths:Uq(J.root,q.isProtectedPath)})},J.signal,J.cwd)}catch(N){throw N instanceof j?N:new j("sandbox_unavailable","The confined execution sandbox could not wrap the command.")}let[$,...X]=W.argv;if(!$)throw new j("sandbox_unavailable","The confined execution sandbox produced no command.");return await q.spawnCaptured($,X,{cwd:J.cwd,timeoutMs:J.timeoutMs,signal:J.signal,env:q.scrubEnvironment(J.root,V)})}finally{w-=1;try{Y.cleanupAfterCommand()}catch{}G(V)}}}
 export{_ as Jb,fq as Kb,xq as Lb,c as Mb,Rq as Nb,p as Ob,Dq as Pb};

package/bin/vm-hands/{vm-hands-entry-lite-ngvxyjhy.js → vm-hands-entry-lite-yp315y25.js}

@@ -1,3 +1,3 @@
 // @bun
 var U=".reason/workspace",T="workspace_base",y="sessions",W="workspace_layout",g=".reason/workspace/sessions",B=/^[0-9a-f]{8}$/;function C(j){if(!J(j))return!1;let q=".reason/workspace/sessions/";if(!j.startsWith(q))return!1;let z=j.slice(q.length).split("/");return z.length===2&&B.test(z[0])}var G=4096,X="workspaces/pi";function J(j){if(typeof j!=="string"||!j||j.length>G)return!1;if(j.startsWith("/")||j.includes("\x00")||j.includes("\\"))return!1;return j.split("/").every((q)=>q!==""&&q!=="."&&q!=="..")}function Z(j){if(j.kind==="root"){if(j.path===void 0)return".";if(!J(j.path))throw Error("invalid_device_workspace_identity");return j.path}if(!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/.test(j.workspaceId)||j.workspaceId==="."||j.workspaceId==="..")throw Error("invalid_device_workspace_identity");let q=j.layout==="sessions"?"sessions":X;return`${j.base?`${j.base}/`:""}${q}/${j.workspaceId}/repo`}function L(j){if(!j||typeof j!=="object"||Array.isArray(j))return null;let q=j;if(q.kind==="root"&&Object.keys(q).length===1)return{kind:"root"};if(q.kind==="root"&&Object.keys(q).length===2&&J(q.path))return{kind:"root",path:q.path};if(q.kind!=="managed"||typeof q.workspaceId!=="string"||Object.keys(q).length!==2+(q.base===void 0?0:1)+(q.layout===void 0?0:1)||q.base!==void 0&&q.base!==".reason/workspace"||q.layout!==void 0&&q.layout!=="sessions")return null;let z={kind:"managed",workspaceId:q.workspaceId,...q.base===".reason/workspace"?{base:".reason/workspace"}:{},...q.layout==="sessions"?{layout:"sessions"}:{}};try{return Z(z),z}catch{return null}}var b="/home/runner",P=10001,x="/run/reason/sessions",f=/^(?:\/[A-Za-z0-9._-]+)+$/,M=/-sidechat-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/,H=/^(.+)-repository-[a-z0-9][a-z0-9._-]*-[0-9a-f]{12}$/;function K(j){return M.exec(j)?.[1]??H.exec(j)?.[1]??j}var $=/^((?:\/[A-Za-z0-9._-]+)+)\/\.reason\/workspace\/(workspaces\/pi|sessions)\/([^/]+)$/,A="*/.reason/workspace/workspaces/pi/*|*/.reason/workspace/sessions/*";function N(j,q=b,z="sessions"){if(!f.test(q)||q.split("/").some((V)=>V==="."||V===".."))throw Error("invalid_cloud_payload_home");let Q=`${q}/${Z({kind:"managed",workspaceId:j,base:".reason/workspace",...z?{layout:z}:{}})}`,F=`${x}/${K(j)}`;return{home:q,root:Q.slice(0,-5),checkout:Q,control:F,jobEnv:`${F}/job.env`,cloudAccess:`${F}/cloud-access`,logs:`${F}/logs`,pin:`${F}/ws`}}function Y(j){return $.exec(j.replace(/\/+$/,""))?.[2]==="sessions"?"sessions":null}function D(j){return{kind:"managed",workspaceId:j,layout:"sessions"}}function R(j){let q=$.exec(j.replace(/\/+$/,""));if(!q)return null;try{let z=N(q[3],q[1],Y(j));return z.root===j.replace(/\/+$/,"")?z:null}catch{return null}}
-export{U as ch,T as dh,y as eh,W as fh,g as gh,B as hh,C as ih,J as jh,Z as kh,L as lh,b as mh,P as nh,x as oh,M as ph,H as qh,$ as rh,A as sh,N as th,Y as uh,D as vh,R as wh};
+export{U as dh,T as eh,y as fh,W as gh,g as hh,B as ih,C as jh,J as kh,Z as lh,L as mh,b as nh,P as oh,x as ph,M as qh,H as rh,$ as sh,A as th,N as uh,Y as vh,D as wh,R as xh};

package/bin/vm-hands/{vm-hands-entry-lite-z7twr5ec.js → vm-hands-entry-lite-z662b8yj.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ld as UJ,ad as CJ,id as qJ}from"./vm-hands-entry-lite-5zzey257.js";import{createHash as v,randomBytes as t}from"crypto";import{closeSync as QJ,fsyncSync as FJ,mkdirSync as kJ,openSync as WJ,renameSync as SJ,rmSync as gJ,statSync as BJ,writeSync as PJ,constants as S}from"fs";import{join as V}from"path";var HJ=1;var d=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function e(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function jJ(J,Z){let{payload:z,authority:G}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!G||typeof G!=="object"||Array.isArray(G)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||G.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function NJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&d.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:e(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var g=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),y=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function R(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(R).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${R(J[Z])}`).join(",")}}`}async function aJ(J){let Z=await crypto.subtle.importKey("pkcs8",y(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=y(J.device_key.spki),G=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),N=new Uint8Array(await crypto.subtle.exportKey("spki",G.publicKey)),D=v("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:G,signingSpki:z,agreementSpki:N,fingerprint:D}}class VJ{init;keys;hooks;options;state="identity_free";lastBrainGeneration=0;bound=null;servedRun=!1;verifiedSinceRun=!1;envDirectory=null;constructor(J,Z,z,G){this.init=J;this.keys=Z;this.hooks=z;this.options=G;if(!d.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){return this.state}get boundRunId(){return this.state==="bound"?this.bound?.runId??null:null}canSpawn(J){return this.state==="bound"&&this.bound?.runId===J&&this.bound.envInstalled}async registerFrame(J){if(this.state!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:HJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:g(this.keys.signingSpki),env_public_key:g(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:g(t(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(R(Z)));return{...Z,device_signature:g(z)}}async helloFrame(J,Z){if(this.state==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),G=g(t(32)),N=UJ({method:"GET",pathAndQuery:CJ,timestamp:z,nonce:G,challenge:J,bodySha256:v("sha256").update("").digest("hex")}),D=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(N)));return{t:"hello",timestamp:z,nonce:G,signature:g(vJ(D)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.state!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.state="registered"}async bind(J){if(this.state!=="registered")throw new W("vm_hands_not_registered","bind before register or while bound");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let G of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!d.test(G))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=this.lastBrainGeneration)throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(v("sha256").update(R({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");this.lastBrainGeneration=J.brain_generation;let z=null;try{if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload();this.verifiedSinceRun=!1;let{launchId:G,applied:N,readyData:D}=await this.hooks.startExecutor({sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),B=this.hooks.restatLayout(),M=null;if(J.env){let A=J.claim?.owner??{},x=jJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof A.device_id==="string"?A.device_id:"",rootId:J.claim?.root_id??""});M=this.hooks.installEnvironment(x),z=this.writeJobEnvRootOnly(J.bind_id,x)}return this.servedRun=!0,this.bound={bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:G,envInstalled:M!==null,rootId:J.claim?.root_id??""},this.state="bound",{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:G,snapshot_revision:M,layout:B,...D?{ready_data:D}:{},policy_digest:v("sha256").update(R({hands_confinement:N.hands_confinement??null,browser_egress:N.browser_egress??null})).digest("hex")}}catch(G){if(this.servedRun=!0,z)this.shred();let N=G&&typeof G==="object"&&"code"in G&&typeof G.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(G.code)?G.code:"vm_hands_bind_failed";throw G instanceof W?G:new W(N,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound;if(this.state!=="bound"||!Z)throw new W("vm_hands_not_bound","environment delivered while not bound");if(J.attemptId!==Z.bindId)throw new W("vm_hands_env_invalid","environment for another attempt");if(!d.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let G=jJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),N=this.hooks.installEnvironment(G);return Z.envInstalled=!0,this.shred(),this.writeJobEnvRootOnly(`${Z.bindId}-r${N}`,G),{snapshot_id:J.snapshotId,installed_revision:N,installed:!0}}async attestFrame(J,Z){if(this.state==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killAndVerifyPayload(),this.verifiedSinceRun=!0}catch{this.servedRun=!0,this.verifiedSinceRun=!1}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:v("sha256").update(J).digest("hex")}}executorExited(){return this.hooks.executorExited?.()??new Promise(()=>{})}async boundRefused(){await this.unbind()}async unbind(){let J=this.bound?.bindId??null;return this.state="unbinding",this.bound=null,await this.hooks.killAndVerifyPayload(),this.verifiedSinceRun=!0,this.shred(),this.state="registered",{bind_id:J,killed_verified:!0,shredded:!0,srt_fallbacks:this.hooks.takeSrtFallbacks?.()??null}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},G=await crypto.subtle.importKey("spki",y(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),N=await crypto.subtle.deriveKey({name:"ECDH",public:G},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),D=await crypto.subtle.decrypt({name:"AES-GCM",iv:y(J.iv),additionalData:new TextEncoder().encode(Z)},N,y(J.ct)).catch(z),B=JSON.parse(new TextDecoder().decode(D));if(!B||typeof B!=="object"||Array.isArray(B))throw new W("vm_hands_env_invalid","env not an object");return B}writeJobEnvRootOnly(J,Z){let z=V(this.options.envRoot,`bind-${J}`);kJ(z,{mode:448});let G=BJ(z);if(!G.isDirectory()||(G.mode&63)!==0||G.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let N=Z.variables&&typeof Z.variables==="object"?Z.variables:{},D=Object.entries(N).filter(([A,x])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(A)&&typeof x==="string").map(([A,x])=>`export ${A}='${String(x).replaceAll("'","'\\''")}'`).join(`
+import{Ld as UJ,ad as CJ,id as qJ}from"./vm-hands-entry-lite-8st97h7b.js";import{createHash as v,randomBytes as t}from"crypto";import{closeSync as QJ,fsyncSync as FJ,mkdirSync as kJ,openSync as WJ,renameSync as SJ,rmSync as gJ,statSync as BJ,writeSync as PJ,constants as S}from"fs";import{join as V}from"path";var HJ=1;var d=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function e(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function jJ(J,Z){let{payload:z,authority:G}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!G||typeof G!=="object"||Array.isArray(G)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||G.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function NJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&d.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:e(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var g=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),y=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function R(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(R).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${R(J[Z])}`).join(",")}}`}async function aJ(J){let Z=await crypto.subtle.importKey("pkcs8",y(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=y(J.device_key.spki),G=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),N=new Uint8Array(await crypto.subtle.exportKey("spki",G.publicKey)),D=v("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:G,signingSpki:z,agreementSpki:N,fingerprint:D}}class VJ{init;keys;hooks;options;state="identity_free";lastBrainGeneration=0;bound=null;servedRun=!1;verifiedSinceRun=!1;envDirectory=null;constructor(J,Z,z,G){this.init=J;this.keys=Z;this.hooks=z;this.options=G;if(!d.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){return this.state}get boundRunId(){return this.state==="bound"?this.bound?.runId??null:null}canSpawn(J){return this.state==="bound"&&this.bound?.runId===J&&this.bound.envInstalled}async registerFrame(J){if(this.state!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:HJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:g(this.keys.signingSpki),env_public_key:g(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:g(t(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(R(Z)));return{...Z,device_signature:g(z)}}async helloFrame(J,Z){if(this.state==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),G=g(t(32)),N=UJ({method:"GET",pathAndQuery:CJ,timestamp:z,nonce:G,challenge:J,bodySha256:v("sha256").update("").digest("hex")}),D=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(N)));return{t:"hello",timestamp:z,nonce:G,signature:g(vJ(D)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.state!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.state="registered"}async bind(J){if(this.state!=="registered")throw new W("vm_hands_not_registered","bind before register or while bound");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let G of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!d.test(G))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=this.lastBrainGeneration)throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(v("sha256").update(R({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");this.lastBrainGeneration=J.brain_generation;let z=null;try{if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload();this.verifiedSinceRun=!1;let{launchId:G,applied:N,readyData:D}=await this.hooks.startExecutor({sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),B=this.hooks.restatLayout(),M=null;if(J.env){let A=J.claim?.owner??{},x=jJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof A.device_id==="string"?A.device_id:"",rootId:J.claim?.root_id??""});M=this.hooks.installEnvironment(x),z=this.writeJobEnvRootOnly(J.bind_id,x)}return this.servedRun=!0,this.bound={bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:G,envInstalled:M!==null,rootId:J.claim?.root_id??""},this.state="bound",{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:G,snapshot_revision:M,layout:B,...D?{ready_data:D}:{},policy_digest:v("sha256").update(R({hands_confinement:N.hands_confinement??null,browser_egress:N.browser_egress??null})).digest("hex")}}catch(G){if(this.servedRun=!0,z)this.shred();let N=G&&typeof G==="object"&&"code"in G&&typeof G.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(G.code)?G.code:"vm_hands_bind_failed";throw G instanceof W?G:new W(N,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound;if(this.state!=="bound"||!Z)throw new W("vm_hands_not_bound","environment delivered while not bound");if(J.attemptId!==Z.bindId)throw new W("vm_hands_env_invalid","environment for another attempt");if(!d.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let G=jJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),N=this.hooks.installEnvironment(G);return Z.envInstalled=!0,this.shred(),this.writeJobEnvRootOnly(`${Z.bindId}-r${N}`,G),{snapshot_id:J.snapshotId,installed_revision:N,installed:!0}}async attestFrame(J,Z){if(this.state==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killAndVerifyPayload(),this.verifiedSinceRun=!0}catch{this.servedRun=!0,this.verifiedSinceRun=!1}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:v("sha256").update(J).digest("hex")}}executorExited(){return this.hooks.executorExited?.()??new Promise(()=>{})}async boundRefused(){await this.unbind()}async unbind(){let J=this.bound?.bindId??null;return this.state="unbinding",this.bound=null,await this.hooks.killAndVerifyPayload(),this.verifiedSinceRun=!0,this.shred(),this.state="registered",{bind_id:J,killed_verified:!0,shredded:!0,srt_fallbacks:this.hooks.takeSrtFallbacks?.()??null}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},G=await crypto.subtle.importKey("spki",y(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),N=await crypto.subtle.deriveKey({name:"ECDH",public:G},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),D=await crypto.subtle.decrypt({name:"AES-GCM",iv:y(J.iv),additionalData:new TextEncoder().encode(Z)},N,y(J.ct)).catch(z),B=JSON.parse(new TextDecoder().decode(D));if(!B||typeof B!=="object"||Array.isArray(B))throw new W("vm_hands_env_invalid","env not an object");return B}writeJobEnvRootOnly(J,Z){let z=V(this.options.envRoot,`bind-${J}`);kJ(z,{mode:448});let G=BJ(z);if(!G.isDirectory()||(G.mode&63)!==0||G.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let N=Z.variables&&typeof Z.variables==="object"?Z.variables:{},D=Object.entries(N).filter(([A,x])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(A)&&typeof x==="string").map(([A,x])=>`export ${A}='${String(x).replaceAll("'","'\\''")}'`).join(`
 `)+`
 `,B=V(z,`.job.env.${t(8).toString("hex")}`),M=WJ(B,S.O_WRONLY|S.O_CREAT|S.O_EXCL|S.O_NOFOLLOW,384);try{PJ(M,D),FJ(M)}finally{QJ(M)}return SJ(B,V(z,"job.env")),this.envDirectory=z,V(z,"job.env")}shred(){let J=this.envDirectory;if(this.envDirectory=null,!J)return;try{let Z=V(J,"job.env"),z=BJ(Z).size,G=WJ(Z,S.O_WRONLY|S.O_NOFOLLOW);try{PJ(G,Buffer.alloc(z)),FJ(G)}finally{QJ(G)}}catch{}gJ(J,{recursive:!0,force:!0})}}function vJ(J){if(J.length!==64)throw new W("vm_hands_signature_invalid","unexpected ECDSA signature length");let Z=(N)=>{let D=0;while(D<N.length-1&&N[D]===0)D++;let B=N.subarray(D),M=B[0]&128?Uint8Array.of(0,...B):B;return Uint8Array.of(2,M.length,...M)},z=Z(J.subarray(0,32)),G=Z(J.subarray(32));return Uint8Array.of(48,z.length+G.length,...z,...G)}import{randomUUID as yJ}from"crypto";var RJ="/app/local-runtime/session?register=vm_hands_v1",fJ="/app/local-runtime",DJ=25000,bJ=20000,mJ=1e4,cJ=5000,pJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),JJ=75000,lJ=1e4,u=20000;class h extends Error{}var dJ=64;async function AJ(J){let Z=[...J.modelOps];for(let z of Z)z.abort.abort();await Promise.race([Promise.all(Z.map((z)=>z.settled)),new Promise((z)=>setTimeout(z,cJ))])}async function f(J,Z){return await AJ(J),Z.unbind()}function o(J){for(let Z of J.outbox?.splice(0)??[])Z.reject(Error("vm_hands_attempt_ended"))}var LJ=15000,uJ=1e4;async function zZ(J){let Z=Date.now(),z={deviceId:null,connection:null,turn:null,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],flush:null,modelOps:new Set},G=J.log??(()=>{}),N=async(D)=>{let B=z.turn;if(!B)return;z.turn=null,o(B);let M=await f(z,J.agent).catch(()=>null);if(M)z.receipts.push({turn:B,failure:"vm_hands_bind_lost",unbound:M});G("vm_hands.bound_dropped",{reason:D})};try{for(let D=0;!J.signal.aborted;D++){let B=await oJ(J,z).catch((A)=>{if(A instanceof W&&z.deviceId===null&&A.code==="vm_hands_no_session"&&Date.now()-Z<lJ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(A instanceof W&&z.deviceId===null)throw A;return{closeCode:0,closeReason:A instanceof Error?A.message:String(A)}});if(G("vm_hands.session_closed",{close_code:B.closeCode,reason:B.closeReason.slice(0,120),registered:z.deviceId!==null}),B.closeCode===4401||z.attest==="refused")return;if(J.signal.aborted)return;if(z.turn&&Date.now()-z.lostAt>=JJ)await N("reconnect_deadline");let M=B.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(D,5),2000):z.turn?Math.min(250*2**Math.min(D,5),5000,Math.max(0,z.lostAt+JJ-Date.now())):Math.min(500*2**D,30000);if(await new Promise((A)=>setTimeout(A,M)),z.turn&&Date.now()-z.lostAt>=JJ)await N("reconnect_deadline")}}finally{await N("session_ended")}}async function oJ(J,Z){let z=Z.deviceId,G=J.log??(()=>{}),N=z?`/app/local-runtime/session?device_id=${encodeURIComponent(z)}`:RJ,D=`${J.apiOrigin.replace(/^http/,"ws")}${N}`,B=new WebSocket(D),M=0,A="",x=new Map,i=[],b=null,MJ=new Promise(($)=>{B.onclose=(K)=>{M=K.code,A=K.reason;for(let Y of x.values())Y.reject(new h(`session closed ${K.code}`));for(let Y of Z.attestWaiters.splice(0))Y(!1);x.clear(),$()}});B.onmessage=($)=>{let K;try{K=JSON.parse(String($.data))}catch{B.close(4400);return}if(K.t==="res"){let Y=K;x.get(Y.id)?.resolve({status:Y.status,body:Y.body}),x.delete(Y.id);return}if(!b?.(K))i.push(K)};let m=($,K)=>new Promise((Y,F)=>{let P=i.findIndex((C)=>$.includes(C.t));if(P>=0){Y(i.splice(P,1)[0]);return}let U=setTimeout(()=>{b=null,F(new W("vm_hands_no_register",`no ${$.join("/")} in ${K} ms`))},K);b=(C)=>{if(!$.includes(C.t))return!1;return clearTimeout(U),b=null,Y(C),!0}}),c=($)=>B.send(JSON.stringify($)),w=($,K)=>new Promise((Y,F)=>{if(B.readyState!==WebSocket.OPEN){F(new h("session closed"));return}let P=yJ(),U=typeof K.wait_ms==="number"?K.wait_ms:0,C=setTimeout(()=>{if(!x.delete(P))return;F(new h(`no answer to ${$.split("/").pop()} in ${U+LJ} ms`)),B.close(4000,"request_timeout")},U+LJ);x.set(P,{reject:(X)=>{clearTimeout(C),F(X)},resolve:({status:X,body:Q})=>{clearTimeout(C);let j=null;try{j=Q?JSON.parse(Q):null}catch{}Y({status:X,json:j})}}),c({t:"req",id:P,path:`${fJ}${$}`,body:JSON.stringify(K)})}),ZJ=()=>B.close(1001,"stopping");J.signal.addEventListener("abort",ZJ,{once:!0});let r,p={turn:null},T=null,$J=!1,s=new Set,n=!1,l=!1;try{await new Promise((X,Q)=>{let j=setTimeout(()=>Q(Error("session open timeout")),uJ);B.onopen=()=>{clearTimeout(j),G("vm_hands.ws_open",{}),X()},B.onerror=()=>{clearTimeout(j),Q(Error("session socket error"))}});let $=await m(["challenge"],5000);G("vm_hands.challenge",{});let K=null,Y=null,F=null,P;if(z){c(await J.agent.helloFrame($.challenge,Z.connection));let X=await m(["ready"],1e4);if(typeof X.vm_hands_connection==="string")Z.connection=X.vm_hands_connection;if(P={device_id:z,...X.cadence?{cadence:X.cadence}:{}},typeof X.vm_hands_probe_script==="string"){if(F=X.vm_hands_probe_script,l=!0,J.agent.phase==="registered"&&!Z.turn)Z.attest="pending"}if(G("vm_hands.reconnected",{device_id:z}),Z.turn){let Q=X.vm_hands_bind;if(Q&&Q.operation_id===Z.turn.claim.operation_id&&Q.attempt_id===Z.turn.claim.attempt_id)K=Z.turn,G("vm_hands.bound_resumed",{operation_id:Q.operation_id});else{Y=Z.turn,Z.turn=null,o(Y);let j=await f(Z,J.agent).catch(()=>null);if(j)Z.receipts.push({turn:Y,failure:"vm_hands_bind_lost",unbound:j});G("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}}else{c(await J.agent.registerFrame($.challenge)),G("vm_hands.register_sent",{});let X=await m(["registered","register_refused"],1e4);if(X.t==="register_refused")throw new W(X.code,"register refused");J.agent.registered();let Q=X;if(P=Q,Z.deviceId=Q.device_id,typeof Q.vm_hands_connection==="string")Z.connection=Q.vm_hands_connection;if(typeof Q.vm_hands_probe_script==="string"){if(F=Q.vm_hands_probe_script,l=!0,J.agent.phase==="registered"&&!Z.turn)Z.attest="pending"}G("vm_hands.registered",{device_id:P.device_id})}let U=async()=>{let X=await w("/heartbeat",await J.heartbeat());if(X.status>=300)throw Error(`heartbeat ${X.status}`)};await U();let C=P.cadence?.presence_interval_ms??30000;if(r=setInterval(()=>{U().catch(()=>B.close())},C),F&&Z.attest!=="accepted"&&J.agent.phase==="registered"&&!Z.turn)IJ(F,$.challenge);try{if(await KJ(),K){let X=K;Z.flush=()=>zJ(X),Z.flush(),T=GJ(X).catch(async(Q)=>{await a(Q),B.close()}).finally(()=>{T=null})}while(!J.signal.aborted&&B.readyState===WebSocket.OPEN){let X=await w("/operations/claim",{wait_ms:Math.min(P.cadence?.claim_wait_ms??DJ,DJ)});if(X.status===204||!X.json)continue;if(X.status>=300)throw Error(`claim ${X.status}`);let Q=X.json;if(Q.capability==="hands.connect"){if(T){_({claim:Q,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}T=EJ(Q).catch(async(j)=>{await a(j),B.close()}).finally(()=>{T=null})}else _J(Q).catch(()=>{return})}}catch(X){await a(X)}}finally{if(r)clearInterval(r);if(J.signal.removeEventListener("abort",ZJ),Z.flush=null,B.close(),await MJ,await T,(J.agent.phase==="bound"||J.agent.phase==="unbinding")&&!Z.turn){let $=await f(Z,J.agent).catch(()=>null),K=p.turn;if($&&K)Z.receipts.push({turn:{...K,eventSeq:K.eventSeq+1},failure:"vm_hands_bind_lost",unbound:$});G("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let $ of s)$.abort()}return{closeCode:M,closeReason:A};async function a($){if($J)return;if($J=!0,Z.turn&&$ instanceof h)Z.lostAt=Date.now();else{let K=Z.turn;if(Z.turn=null,K)o(K),J.onTurn?.(null);if(J.agent.phase==="bound"||J.agent.phase==="unbinding"){let Y=await f(Z,J.agent).catch(()=>null),F=p.turn;if(Y&&F)Z.receipts.push({turn:{...F,eventSeq:F.eventSeq+1},failure:"vm_hands_bind_lost",unbound:Y})}}G("vm_hands.session_lost",{error:$ instanceof Error?$.message:String($),bound_kept:Z.turn!==null})}function _($){let K=$.claim,Y={attempt_id:K.attempt_id,attempt_token:K.attempt_token},F=encodeURIComponent(K.operation_id);return{fence:Y,op:F,complete:(U,C={})=>w(`/operations/${F}/complete`,{...Y,status:U,...C}),emit:(U,C)=>{let X=($.chain??Promise.resolve()).catch(()=>{return}).then(()=>P(U,C));return $.chain=X,X}};async function P(U,C){let X=$.eventSeq,Q=(L)=>w(`/operations/${F}/events`,{...Y,event_seq_start:L,events:[{kind:U,payload:{sequence:L,capability:String(K.capability??"hands.connect"),data:C}}]}),j=X,E=await Q(j),I=E.status===409?E.json?.expected_event_seq:void 0;if(typeof I==="number"&&I===X+1)E={status:200,json:{duplicate:!0}};else if(typeof I==="number"&&I>=0&&I!==X)j=I,E=await Q(j);if(E.status<300)$.eventSeq=j+1;return E}}function xJ($){return(K,Y)=>new Promise((F,P)=>{if(Z.turn!==$){P(Error("vm_hands_attempt_ended"));return}if($.outbox??=[],$.outbox.length>=dJ){P(Error("vm_hands_outbox_full"));return}$.outbox.push({kind:K,data:Y,resolve:F,reject:P}),Z.flush?.()})}function zJ($){if(n)return;n=!0,(async()=>{try{while($.outbox?.length&&Z.turn===$&&B.readyState===WebSocket.OPEN){let K=$.outbox[0],Y;try{Y=await _($).emit(K.kind,K.data)}catch(F){if(F instanceof h)return;Y={status:500}}if($.outbox.shift(),Y.status<300)K.resolve();else K.reject(Error(`${K.kind} refused ${Y.status}`))}}finally{n=!1}})()}async function IJ($,K){try{let Y=await J.agent.attestFrame($,K);if(B.readyState!==WebSocket.OPEN)return;c(Y);let F=await m(["attested","attest_refused"],15000);Z.attest=F.t==="attested"?"accepted":"refused";for(let P of Z.attestWaiters.splice(0))P(Z.attest==="accepted");if(G("vm_hands.attest",{result:Z.attest,exit_code:Y.exit_code,...F.t==="attest_refused"?{code:String(F.code??"")}:{}}),Z.attest==="refused")B.close(4401,"attest_refused")}catch(Y){G("vm_hands.attest_failed",{code:Y instanceof W?Y.code:"probe_error"});for(let F of Z.attestWaiters.splice(0))F(!1);if(Z.attest!=="accepted")B.close(4000,"attest_unanswered")}}async function EJ($){let K=l&&Z.attest==="pending",Y=$.vm_hands_attest,F=Y;if(Z.attest==="refused"){G("vm_hands.claim_attest_refused",{said:typeof Y==="string"?Y.slice(0,16):typeof Y,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(F==="accepted"){if(!K&&Z.attest!=="accepted"){Z.attest="accepted";for(let L of Z.attestWaiters.splice(0))L(!0)}}else if(F!=="pending"||!K){G("vm_hands.claim_attest_refused",{said:typeof Y==="string"?Y.slice(0,16):typeof Y,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Z.attest!=="accepted"){let L=Date.parse($.lease_until)-Date.now()-5000,H=Math.max(0,Math.min(u,Number.isFinite(L)?L:u));if(!await new Promise((q)=>{let O=setTimeout(()=>q(!1),H);Z.attestWaiters.push((k)=>{clearTimeout(O),q(k)})})){await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let P={claim:$,eventSeq:0},{complete:U,emit:C}=_(P),X;try{if($.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not hands.connect");X=!e($)}catch(L){G("vm_hands.bind_refused",{code:L instanceof W?L.code:"unexpected"}),await U("failed",{error_code:L instanceof W?L.code:"vm_hands_bind_invalid"});return}let Q;try{Q=await J.agent.bind(NJ($))}catch(L){G("vm_hands.bind_refused",{code:L instanceof W?L.code:"unexpected"}),await U("failed",{error_code:L instanceof W?L.code:"vm_hands_bind_failed"});return}let j={...Q.ready_data??J.readyData({launchId:Q.launch_id,claim:$})};if(X)delete j.environment_installed;p.turn={claim:$,launchId:Q.launch_id,readyData:j,eventSeq:P.eventSeq,ackSeq:-1};let E=await C("hands.ready",{...j,vm_hands:{layout:Q.layout,policy_digest:Q.policy_digest,launch_id:Q.launch_id}});if(p.turn=null,E.status>=300){await AJ(Z),await J.agent.boundRefused(),await U("failed",{error_code:String(E.json?.error??"vm_hands_probe_failed")});return}let I={claim:$,launchId:Q.launch_id,readyData:j,eventSeq:P.eventSeq,ackSeq:-1};Z.turn=I,Z.flush=()=>zJ(I),J.onTurn?.(xJ(I)),await GJ(I)}async function GJ($){let{fence:K,op:Y}=_($),F=null,P=null,U=J.agent.executorExited().then((C)=>{return P=C,null});J:for(;;){let C=await Promise.race([U,w(`/operations/${Y}/heartbeat`,{...K,control_ack_seq:$.ackSeq,wait_ms:bJ})]);if(!C){F="vm_hands_executor_exited",G("vm_hands.executor_exited",{reason:P});break}if(C.status>=300)break;let X=(C.json?.controls??[]).slice().sort((Q,j)=>Q.seq-j.seq);for(let Q of X){if(Q.seq<=$.ackSeq)continue;if(Q.kind==="operation.cancel"||Q.kind==="cancel"){$.ackSeq=Q.seq;break J}if(Q.kind===qJ)try{await wJ($,Q.payload??{})}catch(j){if(j instanceof h)throw j;F=j instanceof W?j.code:"environment_unavailable",G("vm_hands.environment_refused",{code:F});break J}$.ackSeq=Q.seq}}await OJ($,F)}async function _J($){let K=$,Y={claim:K,eventSeq:0},{complete:F,emit:P,fence:U,op:C}={..._(Y)},X=$.vm_hands_origin==="person"?"person":"model",Q=String($.capability??"");if(!J.executeOp){await F("failed",{error_code:"vm_hands_op_unsupported"});return}if($.vm_hands_attest==="accepted"&&Z.attest==="pending"&&!(l&&Z.attest==="pending")){Z.attest="accepted";for(let q of Z.attestWaiters.splice(0))q(!0)}if(Z.attest!=="accepted"){let q=Date.parse(String($.lease_until??""))-Date.now()-5000,O=Z.attest==="refused"?0:Math.max(0,Math.min(u,Number.isFinite(q)?q:u));if(!(O>0&&await new Promise((XJ)=>{let hJ=setTimeout(()=>XJ(!1),O);Z.attestWaiters.push((TJ)=>{clearTimeout(hJ),XJ(TJ)})}))){await F("failed",{error_code:"vm_hands_unattested"});return}}if(X==="model"&&(J.agent.phase!=="bound"||J.agent.boundRunId!==K.run_id)){await F("failed",{error_code:"vm_hands_not_bound"});return}if(pJ.has(Q)&&J.agent.phase!=="bound"){await F("failed",{error_code:"vm_hands_not_bound"});return}let j=new AbortController;s.add(j);let E,I=new Promise((q)=>{E=q}),L={abort:j,settled:I};if(X==="model")Z.modelOps.add(L);let H=-1,YJ=setInterval(()=>{w(`/operations/${C}/heartbeat`,{...U,control_ack_seq:H,wait_ms:0}).then((q)=>{if(q.status>=300){j.abort();return}let O=q.json?.controls??[];for(let k of O)if(H=Math.max(H,k.seq),k.kind==="operation.cancel"||k.kind==="cancel")j.abort()},()=>j.abort())},mJ);try{let q=await J.executeOp({kind:X,claim:$,signal:j.signal,emit:async(O)=>{await P(O.kind,O.data??{})}});await F(q.status,{...q.result?{result:q.result}:{},...q.error_code!==void 0?{error_code:q.error_code}:{}}),G("vm_hands.op",{capability:Q,kind:X,status:q.status,code:q.error_code??null})}finally{clearInterval(YJ),s.delete(j),Z.modelOps.delete(L),E()}}async function OJ($,K){if(Z.turn===$)Z.turn=null;J.onTurn?.(null),o($);let Y=await f(Z,J.agent);Z.receipts.push({turn:$,failure:K,unbound:Y}),await KJ()}async function KJ(){while(Z.receipts.length){let{turn:$,failure:K,unbound:Y}=Z.receipts[0],{complete:F,emit:P}=_($);try{if(await P("hands.stopped",{...$.readyData,reason_code:K?"failed":"cancelled",killed_verified:Y.killed_verified,shredded:Y.shredded,...Y.srt_fallbacks?{vm_hands_srt_fallbacks:Y.srt_fallbacks}:{}}),K)await F("failed",{error_code:K});else await F("cancelled",{error_code:"driver_stopped"})}catch(U){if(U instanceof h)return}Z.receipts.shift()}}async function wJ($,K){let{fence:Y,op:F}=_($),P=K.snapshot_id;if(K.version!==1||typeof P!=="string"||Object.keys(K).length!==2)throw new W("vm_hands_env_invalid","invalid environment delivery");let U=await w(`/operations/${F}/environment`,{...Y,snapshot_id:P}),C=U.json?.environment_sealed;if(U.status!==200||!C||U.json?.payload!==void 0)throw new W("vm_hands_env_invalid","environment not delivered sealed");let X=await J.agent.deliverEnvironment({attemptId:$.claim.attempt_id,snapshotId:P,deviceId:Z.deviceId??"",sealed:C});if((await w(`/operations/${F}/environment-ack`,{...Y,...X})).status>=300)throw new W("vm_hands_env_ack_refused","environment ack refused")}}
 export{aJ as u,VJ as v,zZ as w};

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,2 +1,2 @@
 // @bun
-import"./vm-hands-entry-lite-z7twr5ec.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import{Nh as A}from"./vm-hands-entry-lite-a3n86qqm.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-34mh58h8.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-ws1x5fg0.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();
+import"./vm-hands-entry-lite-z662b8yj.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import{Oh as A}from"./vm-hands-entry-lite-hf0mk7vd.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-1n9sw4m8.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-0jf6d2gd.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();

package/bin/vm-hands/{vm-hands-executor-w3k6wwx4.js → vm-hands-executor-5vqhd6bn.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ka as s,ob as i,qa as t,sb as n}from"./vm-hands-entry-lite-qz9mkksp.js";import"./vm-hands-entry-lite-5rbj89cs.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-x3ytsxjm.js";import"./vm-hands-entry-lite-d94sv87n.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";import{spawn as Zq}from"child_process";import{chmodSync as $q,chownSync as zq,existsSync as Qq,lstatSync as S,mkdirSync as Wq,mkdtempSync as Gq,readdirSync as m,readFileSync as F,realpathSync as Jq,rmSync as Yq,writeFileSync as u}from"fs";import{join as U}from"path";var o="/sys/fs/cgroup/reason-payload",k="vm-hands",Kq="/run/ara-srt/fallbacks.jsonl",E="/reason-person",Bq=5000,bq=1e4,c="__VM_HANDS_PROOF_DIR__",Tq="__VM_HANDS_PROBE_NONCE__";class L extends Error{code;constructor(q,W){super(W);this.code=q}}var Lq=30000,e=(q)=>`'${q.replaceAll("'","'\\''")}'`;function xq(q){let W=q.cgroup??o,J=q.init.layout.payload_uid,X=q.log??(()=>{}),Q=null,Z=0,T=()=>{try{let z=F("/run/ara-srt/starts.jsonl","utf8"),$=z.slice(Z>z.length?0:Z).split(`
+import{Ka as s,ob as i,qa as t,sb as n}from"./vm-hands-entry-lite-7vscxzd1.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-aswtt2b5.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";import{spawn as Zq}from"child_process";import{chmodSync as $q,chownSync as zq,existsSync as Qq,lstatSync as S,mkdirSync as Wq,mkdtempSync as Gq,readdirSync as m,readFileSync as F,realpathSync as Jq,rmSync as Yq,writeFileSync as u}from"fs";import{join as U}from"path";var o="/sys/fs/cgroup/reason-payload",k="vm-hands",Kq="/run/ara-srt/fallbacks.jsonl",E="/reason-person",Bq=5000,bq=1e4,c="__VM_HANDS_PROOF_DIR__",Tq="__VM_HANDS_PROBE_NONCE__";class L extends Error{code;constructor(q,W){super(W);this.code=q}}var Lq=30000,e=(q)=>`'${q.replaceAll("'","'\\''")}'`;function xq(q){let W=q.cgroup??o,J=q.init.layout.payload_uid,X=q.log??(()=>{}),Q=null,Z=0,T=()=>{try{let z=F("/run/ara-srt/starts.jsonl","utf8"),$=z.slice(Z>z.length?0:Z).split(`
 `).filter(Boolean);Z=z.length;let G=$.map((Y)=>{try{return Number(JSON.parse(Y).elapsed_ms)||0}catch{return 0}});if(G.length)X("vm_hands.srt_server_starts",{count:G.length,elapsed_ms:G.slice(0,8)})}catch{}},j=null,D=!1,C=q.srtCgroup??"/sys/fs/cgroup/reason-srt",R=()=>{j??=Iq()},N=0,A=()=>{try{let z=F(Kq,"utf8"),$=z.slice(N>z.length?0:N);N=z.length;let G=$.split(`
 `).filter(Boolean).slice(0,1000);if(!G.length)return null;let Y={},K=0;for(let b of G)try{let M=JSON.parse(b),I=typeof M.code==="string"&&/^[a-z_]{1,40}$/.test(M.code)?M.code:"other";if(Y[I]=(Y[I]??0)+1,typeof M.elapsed_ms==="number")K=Math.max(K,M.elapsed_ms)}catch{Y.unparsed=(Y.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:G.length,codes:Y,max_elapsed_ms:K}),{count:G.length,codes:Y,max_elapsed_ms:K}}catch{return null}},v=!1,qq=(z,$,G)=>{if(v)throw Error("vm_hands_pool_held");return H(z,$,G)},H=(z,$,G)=>Zq("/bin/sh",["-c",`echo $$ > ${e(U(W,k,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",z,...$],G),Xq=(z)=>H(z.command,z.args,z.options),P=q.prespawn?s({spawnProcess:qq,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(z,$)=>X(z,$??{})}):null;P?.arm();let h=P?setInterval(()=>{if(!Q)P.arm()},Lq):null;h?.unref?.();async function y(){let z=Q;if(Q=null,!z)return;z.abort.abort(),await z.done}return{async startExecutor(z){if(R(),D=!0,!z.claim)throw new L("vm_hands_bind_invalid","an executor needs the claim it serves");await y();let $=z.claim,G=$.owner;if(!G||typeof G.device_id!=="string"||typeof $.root_id!=="string")throw new L("vm_hands_bind_invalid","claim without its owner Device or root");let Y=new AbortController,K,b,M=new Promise((B,O)=>{K=B,b=O}),I,w=new Promise((B)=>{I=B}),g=n({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:G.device_id,rootId:$.root_id,apiOrigin:q.apiOrigin},claimOwner:$.owner,root:q.root,runId:$.run_id,operationId:$.operation_id,attemptId:$.attempt_id,payload:Object.fromEntries(Object.entries($.payload).filter(([B])=>!B.startsWith("vm_hands_"))),signal:Y.signal,emitEvent:async(B,O)=>{if(B==="hands.ready"){K(O);return}if(B==="hands.started"||B==="hands.stopped"||B==="hands.failed")return;await q.forward(B,O)}},{...q.relayDependencies,spawnWorker:Xq,...P?{takePrespawnedWorker:P.take,adoptSpawnedWorker:P.adopt}:{}}).then(()=>{I("executor_stopped")},(B)=>{let O=B&&typeof B==="object"&&"code"in B?String(B.code):"executor_failed";b(new L(O,B instanceof Error?B.message:String(B))),I(O)}).finally(()=>b(new L("vm_hands_executor_exited","executor ended before it was ready")));Q={abort:Y,done:g,exited:w,operationId:$.operation_id,runId:$.run_id,expiresAtMs:Date.parse(String($.payload.expires_at??""))||0};let V=await M,x=V.executor_launch_id;if(typeof x!=="string")throw new L("vm_hands_bind_failed","executor ready without a launch id");return{launchId:x,readyData:V,applied:{hands_confinement:typeof $.payload.hands_confinement==="string"?$.payload.hands_confinement:null,browser_egress:$.payload.browser_egress??null}}},takeSrtFallbacks:A,executorExited(){return Q?Q.exited:new Promise(()=>{})},async killAndVerifyPayload(){v=!0;let z=Aq();try{await Dq(),await y().catch(()=>{return}),T();let $=Date.now()+Bq;await p(W,$,"payload");let G=(D||q.srtWarmLate?.()===!0)&&Qq(U(C,"cgroup.events"));if(G)await p(C,$,"srt");let Y=Cq(J).filter((K)=>!l(K,E));if(j!==null){let K=Mq(j).filter((b)=>b!==process.pid&&!l(b,E));if(K.length)throw X("vm_hands.kill_strays",{strays:K.slice(0,16).map((b)=>{let M="?",I="?";try{M=F(`/proc/${b}/comm`,"utf8").trim().slice(0,32)}catch{}try{I=(F(`/proc/${b}/cgroup`,"utf8").split(`
 `).find((w)=>w.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:b,comm:M,cgroup:I}})}),new L("vm_hands_kill_unverified",`${K.length} process(es) the run started survived it`);j=null}if(D=!1,G)q.onSrtReset?.();if(Y.length)throw X("vm_hands.kill_survivors",{pids:Y.slice(0,16)}),new L("vm_hands_kill_unverified",`${Y.length} payload-uid process(es) outside the payload cgroup`)}finally{v=!1,z()}if(P)setTimeout(()=>{if(!Q)P.arm()},100).unref?.()},async runProbe({nonce:z,script:$}){if(R(),!$.includes(c))throw new L("vm_hands_probe_failed","probe names no proof directory");let G=q.proofParent??"/tmp/reason-vm-hands-proof";Wq(G,{mode:457,recursive:!0});let Y=S(G);if(Y.isSymbolicLink()||!Y.isDirectory()||Y.uid!==(process.getuid?.()??-1)||(Y.mode&4095)!==457)throw new L("vm_hands_probe_failed","proof parent is not root's 0711 directory");let K=Gq(U(G,"p-")),b=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(K)||!/^[A-Za-z0-9_-]{1,128}$/.test(z))throw new L("vm_hands_probe_failed","proof directory path or nonce");zq(K,J,J),$q(K,448);let M=S(K).ino,I=H("/bin/bash",["-c",$.replaceAll(c,K).replaceAll(Tq,z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),w="";I.stdout?.on("data",(V)=>{if(w.length<16384)w+=V.toString("utf8").slice(0,16384-w.length)});let g=await new Promise((V)=>{let x=setTimeout(()=>{b=!0,I.kill("SIGKILL"),V(124)},bq);I.once("error",()=>{clearTimeout(x),V(127)}),I.once("close",(B)=>{clearTimeout(x),V(B??1)})});return X("vm_hands.probe",{nonce_len:z.length,exit_code:g}),{exitCode:g,markers:w,proofDirInode:M}}finally{if(!b)Yq(K,{recursive:!0,force:!0})}},restatLayout(){let{session_root:z,alias:$}=q.init.layout,G="invalid";try{i(z),G="0:0:755"}catch{}let Y=!1,K=-1;try{let b=S($);K=b.uid,Y=G==="0:0:755"&&$===U(z,"repo")&&!b.isSymbolicLink()&&b.isDirectory()&&Jq($)===$&&b.uid===J}catch{}return{root_mode:G,alias_ok:Y,owner_uid:K}},installEnvironment(z){let $=Q;if(!$)throw new L("environment_unavailable","no executor owns an environment");return t({root:q.root,operationId:$.operationId,payload:z}).installed_revision},async stop(){if(h)clearInterval(h);P?.close(),await y()}}}function l(q,W,J="/proc"){try{let Q=F(U(J,String(q),"cgroup"),"utf8").split(`

package/bin/vm-hands/{vm-hands-op-runner-34mh58h8.js → vm-hands-op-runner-1n9sw4m8.js}

@@ -1,2 +1,2 @@
 // @bun
-import{Nh as E}from"./vm-hands-entry-lite-a3n86qqm.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-vr1j2605.js"),import("./desktop-account-vr5beh82.js"),import("./worker-sandbox-wqxffxa1.js")]);J();let K=(process.geteuid?.()??0)!==0,z=new Map,y=(B)=>{try{process.send?.(B)}catch{}};process.on("message",(B)=>{let j=B;if(j?.t==="cancel"){z.get(j.id)?.abort();return}if(j?.t!=="op")return;if(!K){y({t:"done",id:j.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let F=new AbortController;z.set(j.id,F),G(j.state,j.claim,{worker:j.worker,signal:F.signal,emit:(q)=>{let{deliverySignal:N,...M}=q;y({t:"event",id:j.id,event:M})}}).then((q)=>y({t:"done",id:j.id,completion:q}),(q)=>y({t:"done",id:j.id,completion:{status:"failed",error_code:q&&typeof q==="object"&&"code"in q&&typeof q.code==="string"?q.code:"vm_hands_op_failed"}})).finally(()=>z.delete(j.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}export{Q as runVmHandsOpRunner};
+import{Oh as E}from"./vm-hands-entry-lite-hf0mk7vd.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-j9aa1shb.js"),import("./desktop-account-axaenf68.js"),import("./worker-sandbox-snmfpfax.js")]);J();let K=(process.geteuid?.()??0)!==0,z=new Map,y=(B)=>{try{process.send?.(B)}catch{}};process.on("message",(B)=>{let j=B;if(j?.t==="cancel"){z.get(j.id)?.abort();return}if(j?.t!=="op")return;if(!K){y({t:"done",id:j.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let F=new AbortController;z.set(j.id,F),G(j.state,j.claim,{worker:j.worker,signal:F.signal,emit:(q)=>{let{deliverySignal:N,...M}=q;y({t:"event",id:j.id,event:M})}}).then((q)=>y({t:"done",id:j.id,completion:q}),(q)=>y({t:"done",id:j.id,completion:{status:"failed",error_code:q&&typeof q==="object"&&"code"in q&&typeof q.code==="string"?q.code:"vm_hands_op_failed"}})).finally(()=>z.delete(j.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}export{Q as runVmHandsOpRunner};

package/bin/vm-hands/{vm-hands-runtime-ws1x5fg0.js → vm-hands-runtime-0jf6d2gd.js}

@@ -1,4 +1,4 @@
 // @bun
-import{u as y,v as k,w as m}from"./vm-hands-entry-lite-z7twr5ec.js";import{Wc as v}from"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import{Nh as K}from"./vm-hands-entry-lite-a3n86qqm.js";import{spawn as n}from"child_process";import{createHash as i}from"crypto";import{lstatSync as T,mkdirSync as d,readFileSync as a,statSync as r,writeFileSync as l}from"fs";var A="/run/reason-vm-hands",E="/run/reason-vm-hands/env",f="/home/runner",t=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,O="/sys/fs/cgroup/reason-srt",R="/usr/local/bin/ara-srt-exec",e=65536,jj=21600000;function qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;d(j,{recursive:!0,mode:448});let q=T(j);if(!q.isDirectory()||q.uid!==0||(q.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}l(`${j}/base-keyed`,`1
-`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function S(Q,j){let q=(G)=>{return j("srt_warm_skipped",{reason:G}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return q("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>e||Z.toString("base64")!==Q.srt_base_settings)return q("settings_invalid");try{let G=T(O);if(!G.isDirectory()||G.uid!==0||(G.mode&18)!==0)return q("cgroup_unsafe");for(let[Y,N]of[[R,!1],["/usr/local/bin",!0]]){let B=T(Y);if((N?!B.isDirectory():!B.isFile())||B.uid!==0||(B.mode&18)!==0)return q("srt_exec_unsafe")}}catch{return q("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return q("not_root");let z=performance.now(),X=i("sha256").update(Z).digest("hex"),M=`${A}/srt-base-settings.json`;try{l(M,Z,{mode:384,flag:"w"})}catch{return q("settings_write")}let H=n("/bin/sh",["-c",`echo $$ > ${O}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",R,"--settings",M,"--idle-ms",String(jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((G)=>{H.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),G()}),H.once("close",(Y)=>{j(Y===0?"srt_warm_done":"srt_warm_failed",{exit_code:Y,warm_ms:Math.round(performance.now()-z),settings_sha256:X}),G()})})}var p=3000;function Yj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,q=j.layout,Z=j.device_key,z=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&t.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!z&&typeof z.key_id==="string"&&Number.isSafeInteger(z.expires_at_ms)&&typeof z.signature==="string"&&!!q&&typeof q.session_root==="string"&&typeof q.alias==="string"&&Number.isSafeInteger(q.payload_uid)&&typeof q.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function u(Q){d(Q,{recursive:!0,mode:448});let j=r(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Jj(Q){let[{CLI_VERSION:j},q,Z,z]=await Promise.all([import("./version-eyf47yc7.js"),import("./hands-worker-source-emf3gv2b.js"),import("./network-contract-y6kbgyhe.js"),import("./device-workspace-s5z0zr53.js")]),{REASON_HANDS_PROTOCOL_VERSION:X}=await import("./reason-hands-protocol-5wqth9ga.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:q.REASON_HANDS_WORKER_VERSION,protocol_version:X,worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:z.REASON_WORKSPACE_BASE,workspace_layout:z.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var g=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],Qj=new Set(["pty.start","jobs.control"]);function Zj(Q,j){let q=j([{id:"vm-hands",label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(g.map((X)=>[X,!0]))}}),Z=Q.capabilities,z={...Z.operation_constraints};for(let X of g)z[X]={...q.operation_constraints?.[X]??{},ready:!0,execution_mode:q.operation_constraints?.[X]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...g],operation_constraints:z}}}function $j(Q){for(let j of a("/etc/passwd","utf8").split(`
-`)){let q=j.split(":");if(q.length>=4&&Number(q[2])===Q&&/^\d+$/.test(q[3]??"")&&Number(q[3])>0)return Number(q[3])}throw Error("vm_hands_payload_account_unavailable")}function zj(Q,j){let q=j.owner;if(!q||typeof q.organization_id!=="string"||typeof q.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Hj(Q,j){u(A),u(E),qj(j);let q=S(Q,j),Z=!1,z=async()=>{if(!await Promise.race([q.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),p).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:p})},[{configureDesktopAccount:X},{configureWorkerSandbox:M}]=await Promise.all([import("./desktop-account-vr5beh82.js"),import("./worker-sandbox-wqxffxa1.js")]);M();try{X({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let H=new AbortController;for(let J of["SIGTERM","SIGINT"])process.on(J,()=>H.abort());let G=null,Y,N=new Promise((J)=>{Y=J}),B=N.then(()=>import("./vm-hands-executor-w3k6wwx4.js")).then(({createVmHandsExecutor:J})=>{let $=J({init:Q,root:f,runtimeDirectory:A,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,q=S(Q,j)},srtWarmLate:()=>Z,forward:(U,L)=>G?G(U,L):Promise.reject(Error("vm_hands_not_bound")),log:(U,L)=>j(U,L)});return j("executor_loaded"),$}),C=(J)=>async(...$)=>(await B)[J](...$),V=null;B.then((J)=>{V=()=>J.executorExited()});let W={startExecutor:async(...J)=>{return await z(),C("startExecutor")(...J)},killAndVerifyPayload:C("killAndVerifyPayload"),runProbe:async(...J)=>{return await z(),C("runProbe")(...J)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:()=>V?V():new Promise(()=>{}),takeSrtFallbacks:()=>null};B.then((J)=>{W.restatLayout=()=>J.restatLayout(),W.installEnvironment=($)=>J.installEnvironment($),W.takeSrtFallbacks=()=>J.takeSrtFallbacks?.()??null});let s=await y(Q),c=new k(Q,s,W,{envRoot:E}),x=Jj(Q),I=null,o=Promise.all([x,import("./local-capabilities-vr1j2605.js")]).then(([J,$])=>{I=Zj(J,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((J)=>j("device_ops_unavailable",{error:J instanceof Error?J.name:"error"})),D=N.then(()=>import("./vm-hands-executor-w3k6wwx4.js")).then(({createVmHandsOpRunners:J})=>J({payloadUid:Q.layout.payload_uid,payloadGid:$j(Q.layout.payload_uid),log:($,U)=>j($,U)})).catch(()=>null);D.then((J)=>J?.warm("person")),j("agent_ready"),await m({apiOrigin:Q.api_origin,agent:c,signal:H.signal,heartbeat:async()=>I??await x,executeOp:async({kind:J,claim:$,signal:U,emit:L})=>{let b=zj(Q,$);if(!b)return{status:"failed",error_code:"vm_hands_bind_invalid"};let w={executionMode:"unsandboxed",runtimeDirectory:A,readiness:Object.fromEntries(g.map((F)=>[F,!0]))},h=(F)=>{let P=typeof F.kind==="string"?F.kind:"";if(P)L({kind:P,...F.data&&typeof F.data==="object"?{data:F.data}:{}})};if($.capability==="exec.full"&&J!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&J!=="model")return{status:"failed",error_code:"capability_not_granted"};if(Qj.has(String($.capability))){let{executeLocalOperation:F}=await import("./local-capabilities-vr1j2605.js");return F(b,$,{worker:w,signal:U,emit:(P)=>h(P)})}let _=await D;if(!_)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return _.run(J,{id:String($.attempt_id),claim:$,state:b,worker:w},h,U)},readyData:({launchId:J})=>({executor_launch_id:J}),log:(J,$)=>{if(J==="vm_hands.registered"||J==="vm_hands.reconnected")Y();j(J,$)},onTurn:(J)=>{G=J}}),await(await B).stop(),(await D)?.stop()}export{S as startBaseSrtServer,Hj as runVmHands,Yj as parseVmHandsInit,Jj as heartbeatBody,qj as enableBaseKeyedSrt};
+import{u as y,v as k,w as m}from"./vm-hands-entry-lite-z662b8yj.js";import{Wc as v}from"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import{Oh as K}from"./vm-hands-entry-lite-hf0mk7vd.js";import{spawn as n}from"child_process";import{createHash as i}from"crypto";import{lstatSync as T,mkdirSync as d,readFileSync as a,statSync as r,writeFileSync as l}from"fs";var A="/run/reason-vm-hands",E="/run/reason-vm-hands/env",f="/home/runner",t=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,O="/sys/fs/cgroup/reason-srt",R="/usr/local/bin/ara-srt-exec",e=65536,jj=21600000;function qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;d(j,{recursive:!0,mode:448});let q=T(j);if(!q.isDirectory()||q.uid!==0||(q.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}l(`${j}/base-keyed`,`1
+`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function S(Q,j){let q=(G)=>{return j("srt_warm_skipped",{reason:G}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return q("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>e||Z.toString("base64")!==Q.srt_base_settings)return q("settings_invalid");try{let G=T(O);if(!G.isDirectory()||G.uid!==0||(G.mode&18)!==0)return q("cgroup_unsafe");for(let[Y,N]of[[R,!1],["/usr/local/bin",!0]]){let B=T(Y);if((N?!B.isDirectory():!B.isFile())||B.uid!==0||(B.mode&18)!==0)return q("srt_exec_unsafe")}}catch{return q("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return q("not_root");let z=performance.now(),X=i("sha256").update(Z).digest("hex"),M=`${A}/srt-base-settings.json`;try{l(M,Z,{mode:384,flag:"w"})}catch{return q("settings_write")}let H=n("/bin/sh",["-c",`echo $$ > ${O}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",R,"--settings",M,"--idle-ms",String(jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((G)=>{H.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),G()}),H.once("close",(Y)=>{j(Y===0?"srt_warm_done":"srt_warm_failed",{exit_code:Y,warm_ms:Math.round(performance.now()-z),settings_sha256:X}),G()})})}var p=3000;function Yj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,q=j.layout,Z=j.device_key,z=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&t.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!z&&typeof z.key_id==="string"&&Number.isSafeInteger(z.expires_at_ms)&&typeof z.signature==="string"&&!!q&&typeof q.session_root==="string"&&typeof q.alias==="string"&&Number.isSafeInteger(q.payload_uid)&&typeof q.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function u(Q){d(Q,{recursive:!0,mode:448});let j=r(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Jj(Q){let[{CLI_VERSION:j},q,Z,z]=await Promise.all([import("./version-92d8018j.js"),import("./hands-worker-source-w477y8ad.js"),import("./network-contract-ggqak7gp.js"),import("./device-workspace-ecq3hfd6.js")]),{REASON_HANDS_PROTOCOL_VERSION:X}=await import("./reason-hands-protocol-as5477xr.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:q.REASON_HANDS_WORKER_VERSION,protocol_version:X,worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:z.REASON_WORKSPACE_BASE,workspace_layout:z.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var g=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],Qj=new Set(["pty.start","jobs.control"]);function Zj(Q,j){let q=j([{id:"vm-hands",label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(g.map((X)=>[X,!0]))}}),Z=Q.capabilities,z={...Z.operation_constraints};for(let X of g)z[X]={...q.operation_constraints?.[X]??{},ready:!0,execution_mode:q.operation_constraints?.[X]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...g],operation_constraints:z}}}function $j(Q){for(let j of a("/etc/passwd","utf8").split(`
+`)){let q=j.split(":");if(q.length>=4&&Number(q[2])===Q&&/^\d+$/.test(q[3]??"")&&Number(q[3])>0)return Number(q[3])}throw Error("vm_hands_payload_account_unavailable")}function zj(Q,j){let q=j.owner;if(!q||typeof q.organization_id!=="string"||typeof q.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Hj(Q,j){u(A),u(E),qj(j);let q=S(Q,j),Z=!1,z=async()=>{if(!await Promise.race([q.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),p).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:p})},[{configureDesktopAccount:X},{configureWorkerSandbox:M}]=await Promise.all([import("./desktop-account-axaenf68.js"),import("./worker-sandbox-snmfpfax.js")]);M();try{X({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let H=new AbortController;for(let J of["SIGTERM","SIGINT"])process.on(J,()=>H.abort());let G=null,Y,N=new Promise((J)=>{Y=J}),B=N.then(()=>import("./vm-hands-executor-5vqhd6bn.js")).then(({createVmHandsExecutor:J})=>{let $=J({init:Q,root:f,runtimeDirectory:A,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,q=S(Q,j)},srtWarmLate:()=>Z,forward:(U,L)=>G?G(U,L):Promise.reject(Error("vm_hands_not_bound")),log:(U,L)=>j(U,L)});return j("executor_loaded"),$}),C=(J)=>async(...$)=>(await B)[J](...$),V=null;B.then((J)=>{V=()=>J.executorExited()});let W={startExecutor:async(...J)=>{return await z(),C("startExecutor")(...J)},killAndVerifyPayload:C("killAndVerifyPayload"),runProbe:async(...J)=>{return await z(),C("runProbe")(...J)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:()=>V?V():new Promise(()=>{}),takeSrtFallbacks:()=>null};B.then((J)=>{W.restatLayout=()=>J.restatLayout(),W.installEnvironment=($)=>J.installEnvironment($),W.takeSrtFallbacks=()=>J.takeSrtFallbacks?.()??null});let s=await y(Q),c=new k(Q,s,W,{envRoot:E}),x=Jj(Q),I=null,o=Promise.all([x,import("./local-capabilities-j9aa1shb.js")]).then(([J,$])=>{I=Zj(J,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((J)=>j("device_ops_unavailable",{error:J instanceof Error?J.name:"error"})),D=N.then(()=>import("./vm-hands-executor-5vqhd6bn.js")).then(({createVmHandsOpRunners:J})=>J({payloadUid:Q.layout.payload_uid,payloadGid:$j(Q.layout.payload_uid),log:($,U)=>j($,U)})).catch(()=>null);D.then((J)=>J?.warm("person")),j("agent_ready"),await m({apiOrigin:Q.api_origin,agent:c,signal:H.signal,heartbeat:async()=>I??await x,executeOp:async({kind:J,claim:$,signal:U,emit:L})=>{let b=zj(Q,$);if(!b)return{status:"failed",error_code:"vm_hands_bind_invalid"};let w={executionMode:"unsandboxed",runtimeDirectory:A,readiness:Object.fromEntries(g.map((F)=>[F,!0]))},h=(F)=>{let P=typeof F.kind==="string"?F.kind:"";if(P)L({kind:P,...F.data&&typeof F.data==="object"?{data:F.data}:{}})};if($.capability==="exec.full"&&J!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&J!=="model")return{status:"failed",error_code:"capability_not_granted"};if(Qj.has(String($.capability))){let{executeLocalOperation:F}=await import("./local-capabilities-j9aa1shb.js");return F(b,$,{worker:w,signal:U,emit:(P)=>h(P)})}let _=await D;if(!_)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return _.run(J,{id:String($.attempt_id),claim:$,state:b,worker:w},h,U)},readyData:({launchId:J})=>({executor_launch_id:J}),log:(J,$)=>{if(J==="vm_hands.registered"||J==="vm_hands.reconnected")Y();j(J,$)},onTurn:(J)=>{G=J}}),await(await B).stop(),(await D)?.stop()}export{S as startBaseSrtServer,Hj as runVmHands,Yj as parseVmHandsInit,Jj as heartbeatBody,qj as enableBaseKeyedSrt};

package/bin/vm-hands/worker-sandbox-snmfpfax.js

@@ -0,0 +1,2 @@
+// @bun
+import{t as a}from"./vm-hands-entry-lite-bswnp5ve.js";import"./vm-hands-entry-lite-ya1a2eep.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{a as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-arm64-musl",
-  "version": "0.2.295",
+  "version": "0.2.296",
   "description": "Reason CLI native binary for linux-arm64-musl",
   "os": [
     "linux"

package/bin/vm-hands/connect-cli-pwvhzdn1.js

@@ -1,2 +0,0 @@
-// @bun
-import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-tf9322ea.js";import"./vm-hands-entry-lite-250sqsry.js";import"./vm-hands-entry-lite-zeay5yc9.js";import"./vm-hands-entry-lite-qz9mkksp.js";import"./vm-hands-entry-lite-5rbj89cs.js";import"./vm-hands-entry-lite-mk9p22xa.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-qdwm3ya8.js";import"./vm-hands-entry-lite-ggkqyxmp.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import"./vm-hands-entry-lite-yvftswfy.js";import"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-32d3ydnw.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-tm7mv31d.js";import"./vm-hands-entry-lite-x3ytsxjm.js";import"./vm-hands-entry-lite-d94sv87n.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};

package/bin/vm-hands/desktop-account-vr5beh82.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ug as a,Vg as b,Wg as c,Xg as d,Yg as e}from"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{b as passwdAccount,e as desktopHome,d as desktopAccount,c as configureDesktopAccount,a as DESKTOP_USER_ENV};

package/bin/vm-hands/local-automation-jg8850x7.js

@@ -1,2 +0,0 @@
-// @bun
-import{Cc as a,Dc as b,Ec as c,Fc as d,Gc as e,Hc as f,Ic as g,Jc as h,Kc as i,Lc as j,Mc as k,Nc as l}from"./vm-hands-entry-lite-ggkqyxmp.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import"./vm-hands-entry-lite-yvftswfy.js";import"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-32d3ydnw.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-tm7mv31d.js";import"./vm-hands-entry-lite-x3ytsxjm.js";import"./vm-hands-entry-lite-d94sv87n.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};

package/bin/vm-hands/local-capabilities-vr1j2605.js

@@ -1,2 +0,0 @@
-// @bun
-import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-zeay5yc9.js";import"./vm-hands-entry-lite-qz9mkksp.js";import"./vm-hands-entry-lite-5rbj89cs.js";import"./vm-hands-entry-lite-mk9p22xa.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b}from"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-qdwm3ya8.js";import"./vm-hands-entry-lite-ggkqyxmp.js";import"./vm-hands-entry-lite-5zzey257.js";import"./vm-hands-entry-lite-h7ndfgwc.js";import"./vm-hands-entry-lite-yvftswfy.js";import"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-32d3ydnw.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-tm7mv31d.js";import"./vm-hands-entry-lite-x3ytsxjm.js";import"./vm-hands-entry-lite-d94sv87n.js";import{Jh as a}from"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};

package/bin/vm-hands/local-desktop-users-vztj8kn8.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ch as a,Dh as b,Eh as c,Fh as d,Gh as e,Hh as f,Ih as g}from"./vm-hands-entry-lite-d94sv87n.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{f as trackDesktopRun,c as releaseLocalDesktop,a as noteLocalDesktopUse,g as holdLocalDesktop,b as forgetLocalDesktopUse,e as DESKTOP_WAIT_MS,d as DESKTOP_IDLE_MS};

package/bin/vm-hands/local-display-mac-4mtwfgty.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ng as a,Og as b,Pg as c,Qg as d,Rg as e,Sg as f,Tg as g}from"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{c as requestMacScreenAccess,d as parseMacWindowBounds,a as parseMacScreenStatus,e as openMacWindowBounds,g as openMacInput,b as macScreenStatus,f as MacInputTranslator};

package/bin/vm-hands/local-display-session-9tbyrsqk.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ae as h,te as a,ue as b,ve as c,we as d,xe as e,ye as f,ze as g}from"./vm-hands-entry-lite-yvftswfy.js";import"./vm-hands-entry-lite-zmf3vn3w.js";import"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-32d3ydnw.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-cfjx91rj.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-tm7mv31d.js";import"./vm-hands-entry-lite-x3ytsxjm.js";import"./vm-hands-entry-lite-d94sv87n.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};

package/bin/vm-hands/package-q8gdr1z1.js

@@ -1,2 +0,0 @@
-// @bun
-import{x as a}from"./vm-hands-entry-lite-tkpfs08y.js";import"./vm-hands-entry-lite-a3n86qqm.js";export default a();

package/bin/vm-hands/permissions-5bmhsbwr.js

@@ -1,2 +0,0 @@
-// @bun
-import{qg as a,rg as b,sg as c,tg as d,ug as e,vg as f,wg as g,xg as h,yg as i,zg as j}from"./vm-hands-entry-lite-32d3ydnw.js";import"./vm-hands-entry-lite-yadv8a82.js";import"./vm-hands-entry-lite-pr65ksfz.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-tm7mv31d.js";import"./vm-hands-entry-lite-x3ytsxjm.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};

package/bin/vm-hands/reason-hands-protocol-5wqth9ga.js

@@ -1,2 +0,0 @@
-// @bun
-import{$f as S,Af as r,Bf as s,Cf as t,Df as u,Ef as v,Ff as w,Gf as x,Hf as y,If as z,Jf as A,Kf as B,Lf as C,Mf as D,Nf as E,Of as F,Pf as G,Qf as H,Rf as I,Sf as J,Tf as K,Uf as L,Vf as M,Wf as N,Xf as O,Yf as P,Zf as Q,_f as R,ag as T,bg as U,cg as V,dg as W,eg as X,fg as Y,jf as a,kf as b,lf as c,mf as d,nf as e,of as f,pf as g,qf as h,rf as i,sf as j,tf as k,uf as l,vf as m,wf as n,xf as o,yf as p,zf as q}from"./vm-hands-entry-lite-mysjgrwy.js";import"./vm-hands-entry-lite-ngvxyjhy.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{w as reasonHandsCloseReason,X as parseReasonHandsSdkResponse,W as parseReasonHandsSdkRequest,I as parseReasonHandsResult,H as parseReasonHandsRequest,O as parseReasonHandsPtyReceipt,J as parseReasonHandsProgress,N as parseReasonHandsJobResult,M as parseReasonHandsJobRequest,L as parseReasonHandsClaimAck,K as parseReasonHandsClaim,P as parseReasonHandsCancelRequest,Q as parseReasonHandsCancelAck,E as isReasonHandsUuid,C as isReasonHandsRequestId,F as isReasonHandsPtyJobId,D as isReasonHandsGeneration,G as isReasonHandsArtifactSha256,Y as encodeReasonHandsSdkResponse,S as encodeReasonHandsResult,R as encodeReasonHandsRequest,T as encodeReasonHandsProgress,V as encodeReasonHandsClaimAck,U as encodeReasonHandsClaim,z as REASON_HANDS_SDK_MAX_QUERY_CHARS,y as REASON_HANDS_SDK_MAX_NAME_CHARS,n as REASON_HANDS_PTY_PROTOCOL_VERSION,q as REASON_HANDS_PTY_MAX_PENDING_INPUT_BYTES,p as REASON_HANDS_PTY_MAX_OUTPUT_BYTES,o as REASON_HANDS_PTY_MAX_INPUT_BYTES,r as REASON_HANDS_PTY_MAX_DIMENSION,s as REASON_HANDS_PTY_CLEANUP_SWEEP_MS,u as REASON_HANDS_PTY_CLEANUP_RECEIPT_MS,t as REASON_HANDS_PTY_ANCHOR_EXIT_MS,a as REASON_HANDS_PROTOCOL_VERSION,f as REASON_HANDS_OUTPUT_TRUNCATED_MARKER,d as REASON_HANDS_MAX_STRUCTURED_INPUT_CHARS,e as REASON_HANDS_MAX_OUTPUT_CHARS,c as REASON_HANDS_MAX_INPUT_CHARS,b as REASON_HANDS_MAX_FRAME_BYTES,g as REASON_HANDS_MAX_ERROR_CHARS,h as REASON_HANDS_JOB_PROTOCOL_VERSION,l as REASON_HANDS_JOB_MAX_RECORDS,k as REASON_HANDS_JOB_MAX_OUTPUT_CHUNKS,j as REASON_HANDS_JOB_MAX_OUTPUT_CHARS,i as REASON_HANDS_JOB_MAX_INPUT_CHARS,A as REASON_HANDS_JOB_ERRORS,m as REASON_HANDS_JOB_CONTROL_MAX_FRAME_BYTES,x as REASON_HANDS_ERROR_CODES,v as REASON_HANDS_CLOSE_CODES,B as HandsProtocolError};

package/bin/vm-hands/version-eyf47yc7.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ah as d,xh as a,yh as b,zh as c}from"./vm-hands-entry-lite-tm7mv31d.js";import"./vm-hands-entry-lite-x3ytsxjm.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};

package/bin/vm-hands/vm-hands-entry-lite-mysjgrwy.js

@@ -1,4 +0,0 @@
-// @bun
-import{lh as m}from"./vm-hands-entry-lite-ngvxyjhy.js";var E=["Click browser element","Double click browser element","Type text","Clear browser field","Press key","Scroll browser element into view","Drag on computer","Select browser option","Check browser control","Uncheck browser control","Hover browser element","Focus browser element","Open browser page","Reload browser page","Go back in browser","Go forward in browser","Take browser screenshot"],VA=32;function R(x){if(!Array.isArray(x)||x.length>32||!x.every((A)=>typeof A==="string"&&E.includes(A)))return;return x.slice()}var $A="__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__",JA=262144;function Y(x){if(!x||typeof x!=="object"||Array.isArray(x))return!1;let A=x,B=Object.keys(A);return B.length===2&&B.includes("template")&&B.includes("quoteDepth")&&typeof A.template==="string"&&A.template.length<=262144&&!A.template.includes("\x00")&&A.template.split("__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__").length===2&&(A.quoteDepth===1||A.quoteDepth===2||A.quoteDepth===3)}var X=2,P=33554432,K=200000,D=4000000,Q=240000,DA=`
-...[executor output truncated]`,j=2000,f=1,b=16384,p=32768,w=128,RA=64,i=2097152,h=1,y=16384,d=32768,YA=8388608,s=1000,c=2500,n=2000,LA=c+n,t=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/,r=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,o={text_only:4430,invalid_json:4431,invalid_cancel_request:4432,invalid_sdk_response:4433,claim_required:4434,invalid_claim:4435,executor_mismatch:4436,stale_generation:4437,fence_conflict:4438,frame_too_large:4439,result_too_large:4440,progress_too_large:4441,terminal_cleanup_started:4442,job_journal_unavailable:4443},v=new Map(Object.entries(o).map(([x,A])=>[A,x]));function OA(x,A){return A||(v.get(x)??"")}var l=["cancelled","command_failed","duplicate_request_id","duplicate_result_evicted","invalid_repl_response","invalid_request","process_group_cleanup_unconfirmed","repl_failed","result_too_large","repl_response_too_large","repl_transport_failed","request_ledger_full","request_journal_unavailable","request_outcome_uncertain","maintenance_held","request_not_found","resume_digest_mismatch","spawn_failed","stale_generation","timeout"],u=new Set(l),a=200,e=2000,AA=["maintenance_held","invalid_job_request","jobs_disabled","job_not_found","job_conflict","job_capacity","job_journal_unavailable","job_not_running","job_lease_expired","job_input_sequence","job_input_backpressure","stale_generation","pty_unsupported","job_mode_mismatch"];class G extends Error{code;constructor(x){super(x);this.name="HandsProtocolError",this.code=x}}function k(x){return new TextEncoder().encode(x).byteLength}function F(x){return typeof x==="object"&&x!==null&&!Array.isArray(x)}function W(x,A){let B=new Set(A);return Object.keys(x).every((N)=>B.has(N))}function M(x){return typeof x==="string"&&t.test(x)}function V(x){return Number.isSafeInteger(x)&&Number(x)>=1}function $(x){return typeof x==="string"&&r.test(x)}function C(x){return typeof x==="string"&&x.startsWith("pty-")&&$(x.slice(4))}function z(x){return[x.cols,x.rows].every((A)=>Number.isSafeInteger(A)&&Number(A)>=1&&Number(A)<=s)}function H(x){if(typeof x!=="string"||x.length>Math.ceil(y/3)*4||x.length%4!==0||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(x))return-1;let A=x.endsWith("==")?2:x.endsWith("=")?1:0;if(A&&"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(x[x.length-A-1])&(A===2?15:3))return-1;let N=x.length/4*3-A;return N<=y?N:-1}function S(x){return typeof x==="string"&&/^[0-9a-f]{64}$/.test(x)}function Z(x){if(k(x)>P)throw new G("frame_too_large");try{return JSON.parse(x)}catch{throw new G("invalid_json")}}function xA(x){let A=Z(x);if(!F(A)||!W(A,["version","generation","id","tool","input","semanticDigest","lifecycleLeaseId"])||A.version!==X||!V(A.generation)||!M(A.id)||!["bash","repl","resume","read","edit","write","pi_tool"].includes(String(A.tool))||!F(A.input)||A.lifecycleLeaseId!==void 0&&(A.tool!=="bash"||!$(A.lifecycleLeaseId)))throw new G("invalid_request");if(A.tool==="bash"){if(!W(A.input,["script","retainBackground","machineSdk"])||typeof A.input.script!=="string"||A.input.script.length>K||A.input.retainBackground!==void 0&&A.input.retainBackground!==!0||A.input.machineSdk!==void 0&&A.input.machineSdk!==!0||A.semanticDigest!==void 0&&!S(A.semanticDigest))throw new G("invalid_request");return{version:X,generation:A.generation,id:A.id,tool:"bash",input:{script:A.input.script,...A.input.retainBackground===!0?{retainBackground:!0}:{},...A.input.machineSdk===!0?{machineSdk:!0}:{}},...A.semanticDigest===void 0?{}:{semanticDigest:A.semanticDigest},...A.lifecycleLeaseId===void 0?{}:{lifecycleLeaseId:A.lifecycleLeaseId}}}if(A.tool==="resume"){if(A.semanticDigest!==void 0||!W(A.input,["semanticDigest"])||!S(A.input.semanticDigest))throw new G("invalid_request");return{version:X,generation:A.generation,id:A.id,tool:"resume",input:{semanticDigest:A.input.semanticDigest}}}if(A.tool==="repl"){if(!W(A.input,["code"])||typeof A.input.code!=="string"||A.input.code.length>K||A.semanticDigest!==void 0)throw new G("invalid_request");return{version:X,generation:A.generation,id:A.id,tool:"repl",input:{code:A.input.code}}}if(A.tool==="pi_tool"){let B=A.semanticDigest===void 0?BA(A.input):null;if(!B)throw new G("invalid_request");return{version:X,generation:A.generation,id:A.id,tool:"pi_tool",input:B}}if(A.tool==="read"){if(!W(A.input,["path","offset","limit"])||typeof A.input.path!=="string"||A.input.path.length<1||A.input.path.length>K||A.semanticDigest!==void 0||A.input.offset!==void 0&&(!Number.isSafeInteger(A.input.offset)||Number(A.input.offset)<1)||A.input.limit!==void 0&&(!Number.isSafeInteger(A.input.limit)||Number(A.input.limit)<1||Number(A.input.limit)>2000))throw new G("invalid_request");return{version:X,generation:A.generation,id:A.id,tool:"read",input:{path:A.input.path,...A.input.offset===void 0?{}:{offset:Number(A.input.offset)},...A.input.limit===void 0?{}:{limit:Number(A.input.limit)}}}}if(A.tool==="edit"){if(!W(A.input,["path","edits"])||typeof A.input.path!=="string"||A.input.path.length<1||!Array.isArray(A.input.edits)||A.input.edits.length<1||A.input.edits.length>128||A.semanticDigest!==void 0)throw new G("invalid_request");let B=A.input.path.length,N=[];for(let I of A.input.edits){if(!F(I)||!W(I,["oldText","newText"])||typeof I.oldText!=="string"||I.oldText.length<1||typeof I.newText!=="string")throw new G("invalid_request");if(B+=I.oldText.length+I.newText.length,B>D)throw new G("invalid_request");N.push({oldText:I.oldText,newText:I.newText})}return{version:X,generation:A.generation,id:A.id,tool:"edit",input:{path:A.input.path,edits:N}}}if(A.tool!=="write"||!W(A.input,["path","content"])||typeof A.input.path!=="string"||A.input.path.length<1||typeof A.input.content!=="string"||A.input.path.length+A.input.content.length>D||A.semanticDigest!==void 0)throw new G("invalid_request");return{version:X,generation:A.generation,id:A.id,tool:"write",input:{path:A.input.path,content:A.input.content}}}function L(x){return x===void 0||typeof x==="number"&&Number.isFinite(x)}function BA(x){let A=x.args;if(!W(x,["tool","args"])||!F(A))return null;if(x.tool==="bash")return W(A,["command","timeout"])&&typeof A.command==="string"&&A.command.length<=K&&L(A.timeout)?{tool:"bash",args:{command:A.command,...A.timeout===void 0?{}:{timeout:Number(A.timeout)}}}:null;if(typeof A.path!=="string"||A.path.length>K)return null;if(x.tool==="read")return W(A,["path","offset","limit"])&&L(A.offset)&&L(A.limit)?{tool:"read",args:{path:A.path,...A.offset===void 0?{}:{offset:Number(A.offset)},...A.limit===void 0?{}:{limit:Number(A.limit)}}}:null;if(x.tool==="write")return W(A,["path","content"])&&typeof A.content==="string"&&A.path.length+A.content.length<=D?{tool:"write",args:{path:A.path,content:A.content}}:null;if(x.tool!=="edit"||!W(A,["path","edits"])||!Array.isArray(A.edits))return null;let B=A.path.length,N=[];for(let I of A.edits){if(!F(I)||!W(I,["oldText","newText"])||typeof I.oldText!=="string"||typeof I.newText!=="string")return null;if(B+=I.oldText.length+I.newText.length,B>D)return null;N.push({oldText:I.oldText,newText:I.newText})}return{tool:"edit",args:{path:A.path,edits:N}}}function WA(x){if(!F(x))return null;if("thrown"in x)return W(x,["thrown"])&&typeof x.thrown==="string"?{thrown:x.thrown}:null;let A=x.structuredContent;if(!W(x,["content","details","structuredContent","isError"])||!Array.isArray(x.content)||x.isError!==void 0&&x.isError!==!0||A!==void 0&&(!F(A)||!W(A,["output","truncated","full_output_path","exit_code","wall_time_seconds"])||typeof A.output!=="string"||typeof A.truncated!=="boolean"||A.full_output_path!==void 0&&typeof A.full_output_path!=="string"||typeof A.exit_code!=="number"||typeof A.wall_time_seconds!=="number"))return null;let B=[];for(let N of x.content)if(F(N)&&N.type==="text"&&W(N,["type","text"])&&typeof N.text==="string")B.push({type:"text",text:N.text});else if(F(N)&&N.type==="image"&&W(N,["type","data","mimeType"])&&typeof N.data==="string"&&typeof N.mimeType==="string")B.push({type:"image",data:N.data,mimeType:N.mimeType});else return null;return{content:B,...x.details===void 0?{}:{details:x.details},...F(A)?{structuredContent:{output:String(A.output),truncated:A.truncated===!0,...typeof A.full_output_path==="string"?{full_output_path:A.full_output_path}:{},exit_code:Number(A.exit_code),wall_time_seconds:Number(A.wall_time_seconds)}}:{},...x.isError===!0?{isError:!0}:{}}}function GA(x){let A=Z(x);if(!F(A)||!W(A,["version","generation","id","ok","exitCode","stdout","stderr","cwd","error","resumed","browserActions","automaticProgressImage","piToolOutcome","workerElapsedMs","environmentWaitMs"])||A.version!==X||!V(A.generation)||!M(A.id)||typeof A.ok!=="boolean"||!Number.isSafeInteger(A.exitCode)||Number(A.exitCode)<0||Number(A.exitCode)>255||typeof A.stdout!=="string"||A.stdout.length>Q||typeof A.stderr!=="string"||A.stderr.length>Q||A.cwd!==void 0&&(typeof A.cwd!=="string"||A.cwd.length<1||A.cwd.length>4096||!A.cwd.startsWith("/")||A.cwd.includes("\x00"))||A.error!==void 0&&(typeof A.error!=="string"||A.error.length<1||A.error.length>j||!u.has(A.error))||A.browserActions!==void 0&&!R(A.browserActions)||A.automaticProgressImage!==void 0&&(A.automaticProgressImage!==!0||!A.ok)||A.resumed!==void 0&&A.resumed!==!0||A.workerElapsedMs!==void 0&&(!Number.isSafeInteger(A.workerElapsedMs)||Number(A.workerElapsedMs)<0)||A.environmentWaitMs!==void 0&&(!Number.isSafeInteger(A.environmentWaitMs)||Number(A.environmentWaitMs)<0)||A.ok&&(A.exitCode!==0||A.error!==void 0)||!A.ok&&A.exitCode===0)throw new G("invalid_result");let B=A.piToolOutcome===void 0?void 0:WA(A.piToolOutcome);if(B===null||B&&!A.ok)throw new G("invalid_result");return{version:X,generation:A.generation,id:A.id,ok:A.ok,exitCode:Number(A.exitCode),stdout:A.stdout,stderr:A.stderr,...typeof A.cwd==="string"?{cwd:A.cwd}:{},...A.browserActions!==void 0?{browserActions:R(A.browserActions)}:{},...typeof A.error==="string"?{error:A.error}:{},...A.automaticProgressImage===!0?{automaticProgressImage:!0}:{},...A.resumed===!0?{resumed:!0}:{},...B?{piToolOutcome:B}:{},...A.workerElapsedMs!==void 0?{workerElapsedMs:Number(A.workerElapsedMs)}:{},...A.environmentWaitMs!==void 0?{environmentWaitMs:Number(A.environmentWaitMs)}:{}}}function NA(x){let A=Z(x);if(!F(A)||!W(A,["type","version","generation","id","sequence","stdout","stderr"])||A.type!=="progress"||A.version!==X||!V(A.generation)||!M(A.id)||!Number.isSafeInteger(A.sequence)||Number(A.sequence)<1||typeof A.stdout!=="string"||A.stdout.length>Q||typeof A.stderr!=="string"||A.stderr.length>Q)throw new G("invalid_progress");return{type:"progress",version:X,generation:Number(A.generation),id:A.id,sequence:Number(A.sequence),stdout:A.stdout,stderr:A.stderr}}function UA(x){let A=Z(x);if(!F(A)||!W(A,["type","version","generation","fenceId","executorLaunchId","requestCancelVersion","managedJobsVersion","browserRunEnvelopeVersion","terminalCleanupVersion","guestMemoryVersion","guestMemoryDiagnosticsVersion","piToolsVersion","piToolsConfinement","backgroundBashVersion","machineSdkVersion","executionTimingVersion","environmentWaitVersion"])||A.type!=="claim"||A.version!==X||!V(A.generation)||!$(A.fenceId)||!$(A.executorLaunchId)||A.requestCancelVersion!==void 0&&A.requestCancelVersion!==1||A.managedJobsVersion!==void 0&&A.managedJobsVersion!==f||A.guestMemoryVersion!==void 0&&A.guestMemoryVersion!==1||A.guestMemoryDiagnosticsVersion!==void 0&&(A.guestMemoryDiagnosticsVersion!==1||A.guestMemoryVersion!==1)||A.terminalCleanupVersion!==void 0&&A.terminalCleanupVersion!==1||A.browserRunEnvelopeVersion!==void 0&&A.browserRunEnvelopeVersion!==1||A.piToolsVersion!==void 0&&A.piToolsVersion!==1||A.piToolsConfinement!==void 0&&(!Y(A.piToolsConfinement)||A.piToolsVersion!==1)||A.backgroundBashVersion!==void 0&&A.backgroundBashVersion!==1||A.machineSdkVersion!==void 0&&A.machineSdkVersion!==1||A.executionTimingVersion!==void 0&&A.executionTimingVersion!==1||A.environmentWaitVersion!==void 0&&(A.environmentWaitVersion!==1||A.executionTimingVersion!==1))throw new G("invalid_claim");return{type:"claim",version:X,generation:A.generation,fenceId:A.fenceId,executorLaunchId:A.executorLaunchId,...A.requestCancelVersion===1?{requestCancelVersion:1}:{},...A.managedJobsVersion===1?{managedJobsVersion:1}:{},...A.guestMemoryVersion===1?{guestMemoryVersion:1}:{},...A.guestMemoryDiagnosticsVersion===1?{guestMemoryDiagnosticsVersion:1}:{},...A.terminalCleanupVersion===1?{terminalCleanupVersion:1}:{},...A.browserRunEnvelopeVersion===1?{browserRunEnvelopeVersion:1}:{},...A.piToolsVersion===1?{piToolsVersion:1}:{},...Y(A.piToolsConfinement)?{piToolsConfinement:{template:A.piToolsConfinement.template,quoteDepth:A.piToolsConfinement.quoteDepth}}:{},...A.backgroundBashVersion===1?{backgroundBashVersion:1}:{},...A.machineSdkVersion===1?{machineSdkVersion:1}:{},...A.executionTimingVersion===1?{executionTimingVersion:1}:{},...A.environmentWaitVersion===1?{environmentWaitVersion:1}:{}}}function FA(x){let A=Z(x);if(!F(A)||!W(A,["type","version","generation","fenceId","executorLaunchId","workerVersion","workerArtifactSha256","requestCancelVersion","managedJobsVersion","lifecycleVersion","browserRunEnvelopeVersion","terminalCleanupVersion","guestMemoryVersion","guestMemoryDiagnosticsVersion","piToolsVersion","piToolsConfinementVersion","backgroundBashVersion","machineSdkVersion","executionTimingVersion","environmentWaitVersion"])||A.lifecycleVersion!==void 0&&A.lifecycleVersion!==1||A.piToolsVersion!==void 0&&A.piToolsVersion!==1||A.piToolsConfinementVersion!==void 0&&(A.piToolsConfinementVersion!==1||A.piToolsVersion!==1)||A.backgroundBashVersion!==void 0&&A.backgroundBashVersion!==1||A.machineSdkVersion!==void 0&&A.machineSdkVersion!==1||A.executionTimingVersion!==void 0&&A.executionTimingVersion!==1||A.environmentWaitVersion!==void 0&&(A.environmentWaitVersion!==1||A.executionTimingVersion!==1)||A.guestMemoryVersion!==void 0&&A.guestMemoryVersion!==1||A.guestMemoryDiagnosticsVersion!==void 0&&(A.guestMemoryDiagnosticsVersion!==1||A.guestMemoryVersion!==1)||A.terminalCleanupVersion!==void 0&&A.terminalCleanupVersion!==1||A.browserRunEnvelopeVersion!==void 0&&A.browserRunEnvelopeVersion!==1||A.type!=="claim_ack"||A.version!==X||!V(A.generation)||!$(A.fenceId)||!$(A.executorLaunchId)||!Number.isSafeInteger(A.workerVersion)||Number(A.workerVersion)<1||!S(A.workerArtifactSha256)||A.requestCancelVersion!==void 0&&A.requestCancelVersion!==1||A.managedJobsVersion!==void 0&&A.managedJobsVersion!==f)throw new G("invalid_claim_ack");return{type:"claim_ack",...A.guestMemoryVersion===1?{guestMemoryVersion:1}:{},...A.guestMemoryDiagnosticsVersion===1?{guestMemoryDiagnosticsVersion:1}:{},...A.terminalCleanupVersion===1?{terminalCleanupVersion:1}:{},...A.browserRunEnvelopeVersion===1?{browserRunEnvelopeVersion:1}:{},...A.lifecycleVersion===1?{lifecycleVersion:1}:{},...A.piToolsVersion===1?{piToolsVersion:1}:{},...A.piToolsConfinementVersion===1?{piToolsConfinementVersion:1}:{},...A.backgroundBashVersion===1?{backgroundBashVersion:1}:{},...A.machineSdkVersion===1?{machineSdkVersion:1}:{},...A.executionTimingVersion===1?{executionTimingVersion:1}:{},...A.environmentWaitVersion===1?{environmentWaitVersion:1}:{},version:X,generation:A.generation,fenceId:A.fenceId,executorLaunchId:A.executorLaunchId,workerVersion:Number(A.workerVersion),workerArtifactSha256:A.workerArtifactSha256,...A.requestCancelVersion===1?{requestCancelVersion:1}:{},...A.managedJobsVersion===1?{managedJobsVersion:1}:{}}}function zA(x){let A=Z(x);if(!F(A)||!W(A,["type","version","generation","id","jobId","action","input"])||A.type!=="job"||A.version!==X||!V(A.generation)||!M(A.id)||!M(A.jobId)||!F(A.input))throw new G("invalid_job_request");let B=A.input,N=Number.isSafeInteger(B.leaseExpiresAtMs)&&Number(B.leaseExpiresAtMs)>0,I=Number.isSafeInteger(B.sequence)&&Number(B.sequence)>=1;if(!(A.action==="start"?B.mode==="pty"?W(B,["mode","cols","rows","leaseExpiresAtMs"])&&C(A.jobId)&&z(B)&&N:W(B,["script","leaseExpiresAtMs"])&&typeof B.script==="string"&&B.script.length<=K&&N:A.action==="inspect"?W(B,["after"])&&Number.isSafeInteger(B.after)&&Number(B.after)>=0:A.action==="input"?"dataBase64"in B?W(B,["sequence","dataBase64"])&&C(A.jobId)&&I&&H(B.dataBase64)>0:W(B,["sequence","data","eof"])&&I&&typeof B.data==="string"&&B.data.length<=b&&typeof B.eof==="boolean":A.action==="resize"?W(B,["sequence","cols","rows"])&&C(A.jobId)&&I&&z(B):A.action==="renew"?W(B,["leaseExpiresAtMs"])&&N:A.action==="cancel"&&W(B,[])))throw new G("invalid_job_request");return A}function IA(x){let A=Z(x);if(!F(A)||!W(A,["type","version","generation","id","ok","job","error"])||A.type!=="job_result"||A.version!==X||!V(A.generation)||!M(A.id))throw new G("invalid_job_result");if(A.ok===!1&&A.job===void 0&&typeof A.error==="string"&&AA.some((U)=>U===A.error))return A;let B=A.job;if(A.ok!==!0||A.error!==void 0||!F(B)||!W(B,["jobId","state","startedAtMs","finishedAtMs","leaseExpiresAtMs","exitCode","inputSequence","output","firstCursor","nextCursor","truncated","process","environmentRevision","environmentSnapshotId","pty"])||!M(B.jobId)||!["starting","running","exited","cancelled","expired","uncertain"].includes(String(B.state))||!Number.isSafeInteger(B.startedAtMs)||Number(B.startedAtMs)<1||!Number.isSafeInteger(B.leaseExpiresAtMs)||Number(B.leaseExpiresAtMs)<1||B.finishedAtMs!==null&&(!Number.isSafeInteger(B.finishedAtMs)||Number(B.finishedAtMs)<Number(B.startedAtMs))||B.exitCode!==null&&(!Number.isSafeInteger(B.exitCode)||Number(B.exitCode)<0||Number(B.exitCode)>255)||!Number.isSafeInteger(B.inputSequence)||Number(B.inputSequence)<0||!Number.isSafeInteger(B.firstCursor)||Number(B.firstCursor)<1||!Number.isSafeInteger(B.nextCursor)||Number(B.nextCursor)<Number(B.firstCursor)-1||typeof B.truncated!=="boolean"||!Array.isArray(B.output)||B.output.length>w)throw new G("invalid_job_result");if(B.environmentRevision===void 0!==(B.environmentSnapshotId===void 0)||B.environmentRevision!==void 0&&(!Number.isSafeInteger(B.environmentRevision)||Number(B.environmentRevision)<1||!$(B.environmentSnapshotId)))throw new G("invalid_job_result");let N=Number(B.firstCursor)-1,I=0;for(let U of B.output){if(!F(U)||!W(U,["cursor","stream","text"])||!Number.isSafeInteger(U.cursor)||Number(U.cursor)<=N||Number(U.cursor)>Number(B.nextCursor)||!["stdout","stderr"].includes(String(U.stream))||typeof U.text!=="string")throw new G("invalid_job_result");I+=U.text.length,N=Number(U.cursor)}if(I>p)throw new G("invalid_job_result");let _=B.state==="starting"||B.state==="running";if(_&&(B.finishedAtMs!==null||B.exitCode!==null)||!_&&B.finishedAtMs===null||B.state==="uncertain"&&B.exitCode!==null||B.state==="exited"&&B.exitCode===null||B.state==="cancelled"&&B.exitCode!==130||B.state==="expired"&&B.exitCode!==124)throw new G("invalid_job_result");if(B.process!==void 0){let U=B.process;if(!F(U)||!W(U,["pid","processGroupId","executorLaunchId"])||!Number.isSafeInteger(U.pid)||Number(U.pid)<1||U.processGroupId!==U.pid||!$(U.executorLaunchId)||!["starting","running"].includes(String(B.state)))throw new G("invalid_job_result")}if(B.pty!==void 0){let U=B.pty;if(!F(U)||!W(U,["version","cols","rows","output","cleanup"])||U.version!==h||!C(B.jobId)||!z(U)||B.output.length!==0||!Array.isArray(U.output)||U.output.length>w||(_?U.cleanup!=="pending":B.state==="uncertain"?U.cleanup!=="unconfirmed":U.cleanup!=="confirmed")||B.state==="running"&&(B.process===void 0||B.environmentRevision===void 0))throw new G("invalid_job_result");let T=Number(B.firstCursor)-1,g=0;for(let J of U.output){if(!F(J)||!W(J,["cursor","dataBase64"])||!Number.isSafeInteger(J.cursor)||Number(J.cursor)<=T||Number(J.cursor)>Number(B.nextCursor))throw new G("invalid_job_result");let q=H(J.dataBase64);if(q<=0||(g+=q)>d)throw new G("invalid_job_result");T=Number(J.cursor)}}return A}function SA(x){if(k(x)>i)throw new G("frame_too_large");let A=Z(x);if(!F(A)||!W(A,["version","sessionId","operationId","runId","deviceId","rootId","workspace","binding","targetRevision","rootGrantRevision","generation","fenceId","executorLaunchId","job"])||A.version!==h||![A.sessionId,A.operationId,A.runId].every(M)||![A.deviceId,A.rootId,A.fenceId,A.executorLaunchId].every($)||!V(A.generation)||!Number.isSafeInteger(A.rootGrantRevision)||Number(A.rootGrantRevision)<1||!["workspace_source","mcp_control"].includes(String(A.binding))||!Number.isSafeInteger(A.targetRevision)||Number(A.targetRevision)<0||A.binding==="workspace_source"&&A.targetRevision!==0||!F(A.workspace))throw new G("invalid_pty_receipt");if(!m(A.workspace))throw new G("invalid_pty_receipt");let B=IA(JSON.stringify({type:"job_result",version:X,generation:A.generation,id:A.operationId,ok:!0,job:A.job}));if(!B.ok||!B.job.pty||B.job.pty.output.length!==0||B.job.process&&B.job.process.executorLaunchId!==A.executorLaunchId)throw new G("invalid_pty_receipt");return A}function TA(x){let A=Z(x);if(!F(A)||!W(A,["type","version","generation","id","targetId"])||A.type!=="cancel_request"||A.version!==X||!V(A.generation)||!M(A.id)||!M(A.targetId))throw new G("invalid_cancel_request");return A}function qA(x){let A=Z(x);if(!F(A)||!W(A,["type","version","generation","id","targetId","status"])||A.type!=="cancel_ack"||A.version!==X||!V(A.generation)||!M(A.id)||!M(A.targetId)||!["cancelled","settled","not_found","unsupported","unconfirmed"].includes(String(A.status)))throw new G("invalid_cancel_ack");return A}function wA(x){let A=JSON.stringify(x);return xA(A),A}function yA(x){let A=JSON.stringify(x);return GA(A),A}function mA(x){let A=JSON.stringify(x);return NA(A),A}function fA(x){let A=JSON.stringify(x);return UA(A),A}function hA(x){let A=JSON.stringify(x);return FA(A),A}function O(x){return typeof x==="string"&&x.length>=1&&x.length<=a&&!x.includes("\x00")}function XA(x){let A=["type","version","generation","id","jobRequestId","verb"];if(x.verb==="help")return W(x,A)?{verb:"help"}:null;if(x.verb==="describe"||x.verb==="namespace")return W(x,[...A,"name"])&&O(x.name)?{verb:x.verb,name:x.name}:null;if(x.verb==="search"){let B=x.args;if(!W(x,[...A,"query","args"])||typeof x.query!=="string"||x.query.trim().length<1||x.query.length>e)return null;if(B===void 0)return{verb:"search",query:x.query};if(!F(B)||!W(B,["namespace","limit"])||B.namespace!==void 0&&!O(B.namespace)||B.limit!==void 0&&(!Number.isSafeInteger(B.limit)||Number(B.limit)<1||Number(B.limit)>50))return null;return{verb:"search",query:x.query,args:{...typeof B.namespace==="string"?{namespace:B.namespace}:{},...B.limit===void 0?{}:{limit:Number(B.limit)}}}}if(x.verb!=="call"||!W(x,[...A,"name","args"])||!O(x.name)||!F(x.args)||JSON.stringify(x.args).length>K)return null;return{verb:"call",name:x.name,args:x.args}}function kA(x){let A=Z(x);if(!F(A)||A.type!=="sdk_request"||A.version!==X||!V(A.generation)||!M(A.id)||!M(A.jobRequestId))throw new G("invalid_sdk_request");let B=XA(A);if(!B)throw new G("invalid_sdk_request");return{type:"sdk_request",version:X,generation:Number(A.generation),id:A.id,jobRequestId:A.jobRequestId,...B}}function MA(x){let A=Z(x);if(!F(A)||A.type!=="sdk_response"||A.version!==X||!V(A.generation)||!M(A.id))throw new G("invalid_sdk_response");let B={type:"sdk_response",version:X,generation:Number(A.generation),id:A.id},N=["type","version","generation","id","ok"];if(A.ok===!0&&W(A,[...N,"result"])&&typeof A.result==="string"&&A.result.length<=Q)return{...B,ok:!0,result:A.result};if(A.ok===!1&&W(A,[...N,"error"])&&typeof A.error==="string"&&A.error.length>=1&&A.error.length<=Q)return{...B,ok:!1,error:A.error};throw new G("invalid_sdk_response")}function HA(x){let A=JSON.stringify(x);return MA(A),A}
-export{VA as gf,$A as hf,JA as if,X as jf,P as kf,K as lf,D as mf,Q as nf,DA as of,j as pf,f as qf,b as rf,p as sf,w as tf,RA as uf,i as vf,h as wf,y as xf,d as yf,YA as zf,s as Af,c as Bf,n as Cf,LA as Df,o as Ef,OA as Ff,l as Gf,a as Hf,e as If,AA as Jf,G as Kf,M as Lf,V as Mf,$ as Nf,C as Of,S as Pf,xA as Qf,GA as Rf,NA as Sf,UA as Tf,FA as Uf,zA as Vf,IA as Wf,SA as Xf,TA as Yf,qA as Zf,wA as _f,yA as $f,mA as ag,fA as bg,hA as cg,kA as dg,MA as eg,HA as fg};

package/bin/vm-hands/worker-sandbox-wqxffxa1.js

@@ -1,2 +0,0 @@
-// @bun
-import{t as a}from"./vm-hands-entry-lite-250sqsry.js";import"./vm-hands-entry-lite-mk9p22xa.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-sn3vjjgx.js";import"./vm-hands-entry-lite-a3n86qqm.js";export{a as configureWorkerSandbox};