@reason-machines/cli-linux-arm64-musl 0.2.310 → 0.2.312

package/bin/ara

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/ara
 size: 98348920 bytes
-sha256: 520895adc8cf3eb1624ddfea292aa1ed74ae32a5204cef88430bb388c4667367
+sha256: d5cc757026b5a6223e157855fe1de8a8285bd8d605b9e318a20b17ca01ab3a01

package/bin/vm-hands/{connect-cli-cs0mgjrv.js → connect-cli-x9pdtb0c.js}

@@ -1,2 +1,2 @@
 // @bun
-import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-mmhbhj1y.js";import"./vm-hands-entry-lite-bswnp5ve.js";import"./vm-hands-entry-lite-z93r72nn.js";import"./vm-hands-entry-lite-815h1kvr.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-ya1a2eep.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-0ergg2ky.js";import"./vm-hands-entry-lite-sqdh029v.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-32mphjwz.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-y6cp754a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-t2xdqqqj.js";import"./vm-hands-entry-lite-cgm3es3w.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};
+import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-gj0vxxcb.js";import"./vm-hands-entry-lite-bswnp5ve.js";import"./vm-hands-entry-lite-32tgpj26.js";import"./vm-hands-entry-lite-dxxnp4nx.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-ya1a2eep.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-0ergg2ky.js";import"./vm-hands-entry-lite-makvjdxz.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-n29bgmjx.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-qhexy1ws.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-cw9qs82e.js";import"./vm-hands-entry-lite-kg5gmpvq.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};

package/bin/vm-hands/{local-automation-wchbp1rm.js → local-automation-kwv18cae.js}

@@ -1,2 +1,2 @@
 // @bun
-import{Cc as a,Dc as b,Ec as c,Fc as d,Gc as e,Hc as f,Ic as g,Jc as h,Kc as i,Lc as j,Mc as k,Nc as l}from"./vm-hands-entry-lite-sqdh029v.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-32mphjwz.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-y6cp754a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-t2xdqqqj.js";import"./vm-hands-entry-lite-cgm3es3w.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};
+import{Cc as a,Dc as b,Ec as c,Fc as d,Gc as e,Hc as f,Ic as g,Jc as h,Kc as i,Lc as j,Mc as k,Nc as l}from"./vm-hands-entry-lite-makvjdxz.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-n29bgmjx.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-qhexy1ws.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-cw9qs82e.js";import"./vm-hands-entry-lite-kg5gmpvq.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};

package/bin/vm-hands/{local-capabilities-hdm858r9.js → local-capabilities-88dfgxzc.js}

@@ -1,2 +1,2 @@
 // @bun
-import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-z93r72nn.js";import"./vm-hands-entry-lite-815h1kvr.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-ya1a2eep.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b}from"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-0ergg2ky.js";import"./vm-hands-entry-lite-sqdh029v.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-32mphjwz.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-y6cp754a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-t2xdqqqj.js";import"./vm-hands-entry-lite-cgm3es3w.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as a}from"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};
+import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-32tgpj26.js";import"./vm-hands-entry-lite-dxxnp4nx.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-ya1a2eep.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b}from"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-0ergg2ky.js";import"./vm-hands-entry-lite-makvjdxz.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-n29bgmjx.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-qhexy1ws.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-cw9qs82e.js";import"./vm-hands-entry-lite-kg5gmpvq.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as a}from"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};

package/bin/vm-hands/{local-display-session-09syxhrb.js → local-display-session-e0vrw73w.js}

@@ -1,2 +1,2 @@
 // @bun
-import{Ae as h,te as a,ue as b,ve as c,we as d,xe as e,ye as f,ze as g}from"./vm-hands-entry-lite-32mphjwz.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-y6cp754a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-t2xdqqqj.js";import"./vm-hands-entry-lite-cgm3es3w.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};
+import{Ae as h,te as a,ue as b,ve as c,we as d,xe as e,ye as f,ze as g}from"./vm-hands-entry-lite-n29bgmjx.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-qhexy1ws.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-cw9qs82e.js";import"./vm-hands-entry-lite-kg5gmpvq.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};

package/bin/vm-hands/{permissions-y4n9qc17.js → permissions-ch5zgbq0.js}

@@ -1,2 +1,2 @@
 // @bun
-import{Ag as j,rg as a,sg as b,tg as c,ug as d,vg as e,wg as f,xg as g,yg as h,zg as i}from"./vm-hands-entry-lite-y6cp754a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-t2xdqqqj.js";import"./vm-hands-entry-lite-cgm3es3w.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};
+import{Ag as j,rg as a,sg as b,tg as c,ug as d,vg as e,wg as f,xg as g,yg as h,zg as i}from"./vm-hands-entry-lite-qhexy1ws.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-cw9qs82e.js";import"./vm-hands-entry-lite-kg5gmpvq.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};

package/bin/vm-hands/{status-v057fs9a.js → status-71456987.js}

@@ -1,5 +1,5 @@
 // @bun
-import{a as Wq,b as Bq,c as bq,d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-mmhbhj1y.js";import"./vm-hands-entry-lite-bswnp5ve.js";import"./vm-hands-entry-lite-z93r72nn.js";import"./vm-hands-entry-lite-815h1kvr.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-ya1a2eep.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-0ergg2ky.js";import{lc as jq}from"./vm-hands-entry-lite-sqdh029v.js";import"./vm-hands-entry-lite-8st97h7b.js";import{ae as G}from"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-32mphjwz.js";import{Ee as H,Fe as u,Ge as s,bf as Qq}from"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-y6cp754a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import{_g as l}from"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import{yh as R}from"./vm-hands-entry-lite-t2xdqqqj.js";import"./vm-hands-entry-lite-cgm3es3w.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import{Oh as $q}from"./vm-hands-entry-lite-hf0mk7vd.js";import{createHash as tq,randomBytes as sq}from"crypto";import{readFileSync as eq,realpathSync as Aq,renameSync as nq,unlinkSync as aq,writeFileSync as q3}from"fs";import{dirname as x3,join as zq}from"path";import{spawnSync as Mq}from"child_process";import{accessSync as _q,constants as wq,existsSync as L,mkdirSync as Lq,readFileSync as fq,renameSync as Sq,writeFileSync as hq}from"fs";import{homedir as Cq}from"os";import{delimiter as gq,dirname as mq,join as T}from"path";import{existsSync as Tq,readFileSync as Uq}from"fs";import{join as vq}from"path";var Eq=`---
+import{a as Wq,b as Bq,c as bq,d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-gj0vxxcb.js";import"./vm-hands-entry-lite-bswnp5ve.js";import"./vm-hands-entry-lite-32tgpj26.js";import"./vm-hands-entry-lite-dxxnp4nx.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-ya1a2eep.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-0ergg2ky.js";import{lc as jq}from"./vm-hands-entry-lite-makvjdxz.js";import"./vm-hands-entry-lite-8st97h7b.js";import{ae as G}from"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-n29bgmjx.js";import{Ee as H,Fe as u,Ge as s,bf as Qq}from"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-qhexy1ws.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import{_g as l}from"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import{yh as R}from"./vm-hands-entry-lite-cw9qs82e.js";import"./vm-hands-entry-lite-kg5gmpvq.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import{Oh as $q}from"./vm-hands-entry-lite-hf0mk7vd.js";import{createHash as tq,randomBytes as sq}from"crypto";import{readFileSync as eq,realpathSync as zq,renameSync as nq,unlinkSync as aq,writeFileSync as q3}from"fs";import{dirname as x3,join as Aq}from"path";import{spawnSync as Mq}from"child_process";import{accessSync as _q,constants as wq,existsSync as L,mkdirSync as Lq,readFileSync as fq,renameSync as Sq,writeFileSync as hq}from"fs";import{homedir as Cq}from"os";import{delimiter as gq,dirname as mq,join as T}from"path";import{existsSync as Tq,readFileSync as Uq}from"fs";import{join as vq}from"path";var Eq=`---
 name: reason
 description: Integrate software with Reason's public REST API using a scoped API key. Use for API clients, CI, service integrations, or cloud coding-session automation.
 ---
@@ -44,7 +44,7 @@ Base URL: \`https://api.reasonmachines.com/v3\`
 `;function m(q){return vq(q,".agents","skills","ara","SKILL.md")}function i(q){let J=m(q);return Tq(J)&&Uq(J,"utf8")===Eq}var p=["codex","claude","cursor"],r={codex:"Codex",claude:"Claude Code",cursor:"Cursor"};function pq(q,J=process.env){let x=J.PATH??"";for(let Y of x.split(gq)){if(!Y)continue;try{return _q(T(Y,q),wq.X_OK),!0}catch{}}return!1}function dq(){return{exists:pq,run(q,J,x={}){let Y=x.interactive===!0,X=Mq(q,J,{encoding:"utf8",env:process.env,stdio:Y?"inherit":"pipe"});return{status:X.status??1,stdout:Y?"":X.stdout??"",stderr:Y?X.error?.message??"":`${X.stderr??""}${X.error?`${X.error.message}
 `:""}`}}}}function O(q){return`${q.stdout}
 ${q.stderr}`}function k(q){return q.status===0}function I(q,J,x,Y={}){let X=q.run(J,x,Y);if(k(X))return X;let $=O(X).trim();throw Error(`${J} ${x.join(" ")} failed${$?`: ${$}`:` with exit code ${X.status}`}`)}function uq(q=process.env){return s(H({env:q}))}function d(q,J){return q.split(/\s+/).some((x)=>e(x,J))}function w(q){return T(q,".cursor","mcp.json")}function t(q){if(!L(q))return{};try{let J=JSON.parse(fq(q,"utf8"));if(!J||typeof J!=="object"||Array.isArray(J))throw Error("top-level value must be an object");return J}catch(J){let x=J instanceof Error?J.message:String(J);throw Error(`Cursor MCP config at ${q} is invalid; refusing to overwrite it (${x})`)}}function lq(q,J){Lq(mq(q),{recursive:!0,mode:448});let x=`${q}.ara-${process.pid}.tmp`;hq(x,`${JSON.stringify(J,null,2)}
-`,{mode:384}),Sq(x,q)}function e(q,J){if(typeof q!=="string")return!1;if(q===J)return!0;try{let x=new URL(q);return["https://api.ara.so","https://api-staging.ara.so","https://api.reasonmachines.ai","https://staging-api.reasonmachines.ai","https://api.reasonmachines.com","https://staging-api.reasonmachines.com"].includes(x.origin)&&!x.username&&!x.password&&x.pathname==="/mcp/ara"&&!x.search&&!x.hash}catch{return!1}}function oq(q,J){let x=q.mcpServers?.ara;return Boolean(x&&typeof x==="object"&&!Array.isArray(x)&&e(x.url,J))}class f{runner;home;mcpUrl;constructor(q=dq(),J=Cq(),x=uq()){this.runner=q;this.home=J;this.mcpUrl=x}isAvailable(q){if(q==="codex")return this.runner.exists("codex");if(q==="claude")return this.runner.exists("claude");return this.runner.exists("cursor")||L("/Applications/Cursor.app")||L(T(this.home,"Applications","Cursor.app"))||L(w(this.home))}availableClients(){return p.filter((q)=>this.isAvailable(q))}installationPath(q){if(q==="cursor")return w(this.home);if(q==="codex")return T(this.home,".codex","plugins","cache","ara");return T(this.home,".claude","plugins","cache","ara")}sharedSkillStatus(){return{installed:i(this.home),path:m(this.home)}}status(q){let J=r[q];if(!this.isAvailable(q))return{id:q,label:J,available:!1,installed:!1,connection:null,detail:"Client not detected",legacyInstallations:[]};if(q==="cursor"){let W=w(this.home),D=oq(t(W),this.mcpUrl);return{id:q,label:J,available:!0,installed:D,connection:D?"configured":null,detail:D?`Retired Reason MCP configuration in ${W}`:`No retired Reason MCP configuration in ${W}`,legacyInstallations:[]}}if(q==="codex"){let W=this.runner.run("codex",["plugin","list"]);if(!(k(W)&&O(W).includes("ara@ara")))return{id:q,label:J,available:!0,installed:!1,connection:null,detail:"No retired Reason plugin installed",legacyInstallations:[]};let P=this.runner.run("codex",["mcp","list"]),Q=O(P).split(/\r?\n/).find((E)=>E.trimStart().startsWith("ara ")&&d(E,this.mcpUrl)),h=k(P)&&Boolean(Q),v=!k(P)?"error":Q?.includes("Not logged in")?"not_logged_in":Q?.includes("OAuth")?"oauth":Q?"configured":"unknown";return{id:q,label:J,available:!0,installed:h,connection:v,detail:Q?.trim()||"The retired Reason plugin is installed but has no verified retired MCP registration",legacyInstallations:[]}}let x=this.runner.run("claude",["plugin","list"]),Y=O(x),X=k(x)&&Y.includes("ara@ara"),$=k(x)&&Y.includes("ara-handoff@ara");if(!X&&!$)return{id:q,label:J,available:!0,installed:!1,connection:null,detail:"No retired Reason plugin installed",legacyInstallations:[]};let B=this.runner.run("claude",["mcp","list"]),K=O(B),j=K.split(/\r?\n/).find((W)=>W.includes("plugin:ara:ara")&&d(W,this.mcpUrl)),z=K.split(/\r?\n/).find((W)=>W.includes("plugin:ara-handoff:ara")&&d(W,this.mcpUrl)),U=k(B)&&Boolean(j),F=k(B)&&z?["ara-handoff@ara"]:[],S=!k(B)?"error":j?.includes("Connected")?"connected":j?.includes("Failed")?"error":j?"configured":"unknown";return{id:q,label:J,available:!0,installed:U,connection:S,detail:j?.trim()||"The retired Reason plugin is installed but has no verified retired MCP registration",legacyInstallations:F}}statuses(){return p.map((q)=>this.status(q))}logout(q){let J=this.status(q);if(!J.available||!J.installed)return`${J.label}: not connected`;if(q==="cursor")return this.uninstall("cursor").replace("removed retired Reason","signed out and removed retired Reason");if(q==="codex")return I(this.runner,"codex",["mcp","logout","ara"]),"Codex: signed out of Reason";return I(this.runner,"claude",["mcp","logout","plugin:ara:ara"]),"Claude Code: signed out of Reason"}uninstall(q){let J=this.status(q);if(!J.available||!J.installed)return`${J.label}: Reason is not installed`;if(q==="cursor"){let x=w(this.home),Y=t(x),X={...Y.mcpServers??{}};return delete X.ara,Y.mcpServers=X,lq(x,Y),`Cursor: removed retired Reason MCP from ${x}`}if(q==="codex")return I(this.runner,"codex",["plugin","remove","ara@ara"]),"Codex: removed retired ara@ara";return I(this.runner,"claude",["plugin","uninstall","ara@ara","--scope","user"]),"Claude Code: removed retired ara@ara"}removeLegacyClaudePlugin(){if(!this.runner.exists("claude"))return"Claude Code: not installed";if(!this.status("claude").legacyInstallations.includes("ara-handoff@ara"))return"Claude Code: no legacy Reason plugin found";return I(this.runner,"claude",["plugin","uninstall","ara-handoff@ara","--scope","user"]),"Claude Code: removed obsolete ara-handoff@ara"}removeRetiredInstallations(){let q=[],J=[];for(let x of p){let Y;try{Y=this.status(x)}catch(X){J.push(`${r[x]}: ${X instanceof Error?X.message:String(X)}`);continue}if(Y.installed){if(x!=="cursor")try{q.push(this.logout(x))}catch(X){J.push(`${Y.label}: ${X instanceof Error?X.message:String(X)}`)}try{q.push(this.uninstall(x))}catch(X){J.push(`${Y.label}: ${X instanceof Error?X.message:String(X)}`)}}if(x==="claude"&&Y.legacyInstallations.includes("ara-handoff@ara"))try{q.push(this.removeLegacyClaudePlugin())}catch(X){J.push(`${Y.label}: ${X instanceof Error?X.message:String(X)}`)}}if(q.length===0&&J.length===0)q.push("No retired Reason MCP configuration found.");return{messages:q,failures:J}}}function n(q){return`claude mcp add --transport http reason ${q}`}function a(q){return`codex mcp add reason --url ${q}
+`,{mode:384}),Sq(x,q)}function e(q,J){if(typeof q!=="string")return!1;if(q===J)return!0;try{let x=new URL(q);return["https://api.ara.so","https://api-staging.ara.so","https://api.reasonmachines.ai","https://staging-api.reasonmachines.ai","https://api.reasonmachines.com","https://staging-api.reasonmachines.com"].includes(x.origin)&&!x.username&&!x.password&&x.pathname==="/mcp/ara"&&!x.search&&!x.hash}catch{return!1}}function oq(q,J){let x=q.mcpServers?.ara;return Boolean(x&&typeof x==="object"&&!Array.isArray(x)&&e(x.url,J))}class f{runner;home;mcpUrl;constructor(q=dq(),J=Cq(),x=uq()){this.runner=q;this.home=J;this.mcpUrl=x}isAvailable(q){if(q==="codex")return this.runner.exists("codex");if(q==="claude")return this.runner.exists("claude");return this.runner.exists("cursor")||L("/Applications/Cursor.app")||L(T(this.home,"Applications","Cursor.app"))||L(w(this.home))}availableClients(){return p.filter((q)=>this.isAvailable(q))}installationPath(q){if(q==="cursor")return w(this.home);if(q==="codex")return T(this.home,".codex","plugins","cache","ara");return T(this.home,".claude","plugins","cache","ara")}sharedSkillStatus(){return{installed:i(this.home),path:m(this.home)}}status(q){let J=r[q];if(!this.isAvailable(q))return{id:q,label:J,available:!1,installed:!1,connection:null,detail:"Client not detected",legacyInstallations:[]};if(q==="cursor"){let B=w(this.home),D=oq(t(B),this.mcpUrl);return{id:q,label:J,available:!0,installed:D,connection:D?"configured":null,detail:D?`Retired Reason MCP configuration in ${B}`:`No retired Reason MCP configuration in ${B}`,legacyInstallations:[]}}if(q==="codex"){let B=this.runner.run("codex",["plugin","list"]);if(!(k(B)&&O(B).includes("ara@ara")))return{id:q,label:J,available:!0,installed:!1,connection:null,detail:"No retired Reason plugin installed",legacyInstallations:[]};let P=this.runner.run("codex",["mcp","list"]),Q=O(P).split(/\r?\n/).find((E)=>E.trimStart().startsWith("ara ")&&d(E,this.mcpUrl)),h=k(P)&&Boolean(Q),v=!k(P)?"error":Q?.includes("Not logged in")?"not_logged_in":Q?.includes("OAuth")?"oauth":Q?"configured":"unknown";return{id:q,label:J,available:!0,installed:h,connection:v,detail:Q?.trim()||"The retired Reason plugin is installed but has no verified retired MCP registration",legacyInstallations:[]}}let x=this.runner.run("claude",["plugin","list"]),Y=O(x),X=k(x)&&Y.includes("ara@ara"),$=k(x)&&Y.includes("ara-handoff@ara");if(!X&&!$)return{id:q,label:J,available:!0,installed:!1,connection:null,detail:"No retired Reason plugin installed",legacyInstallations:[]};let W=this.runner.run("claude",["mcp","list"]),K=O(W),j=K.split(/\r?\n/).find((B)=>B.includes("plugin:ara:ara")&&d(B,this.mcpUrl)),A=K.split(/\r?\n/).find((B)=>B.includes("plugin:ara-handoff:ara")&&d(B,this.mcpUrl)),U=k(W)&&Boolean(j),F=k(W)&&A?["ara-handoff@ara"]:[],S=!k(W)?"error":j?.includes("Connected")?"connected":j?.includes("Failed")?"error":j?"configured":"unknown";return{id:q,label:J,available:!0,installed:U,connection:S,detail:j?.trim()||"The retired Reason plugin is installed but has no verified retired MCP registration",legacyInstallations:F}}statuses(){return p.map((q)=>this.status(q))}logout(q){let J=this.status(q);if(!J.available||!J.installed)return`${J.label}: not connected`;if(q==="cursor")return this.uninstall("cursor").replace("removed retired Reason","signed out and removed retired Reason");if(q==="codex")return I(this.runner,"codex",["mcp","logout","ara"]),"Codex: signed out of Reason";return I(this.runner,"claude",["mcp","logout","plugin:ara:ara"]),"Claude Code: signed out of Reason"}uninstall(q){let J=this.status(q);if(!J.available||!J.installed)return`${J.label}: Reason is not installed`;if(q==="cursor"){let x=w(this.home),Y=t(x),X={...Y.mcpServers??{}};return delete X.ara,Y.mcpServers=X,lq(x,Y),`Cursor: removed retired Reason MCP from ${x}`}if(q==="codex")return I(this.runner,"codex",["plugin","remove","ara@ara"]),"Codex: removed retired ara@ara";return I(this.runner,"claude",["plugin","uninstall","ara@ara","--scope","user"]),"Claude Code: removed retired ara@ara"}removeLegacyClaudePlugin(){if(!this.runner.exists("claude"))return"Claude Code: not installed";if(!this.status("claude").legacyInstallations.includes("ara-handoff@ara"))return"Claude Code: no legacy Reason plugin found";return I(this.runner,"claude",["plugin","uninstall","ara-handoff@ara","--scope","user"]),"Claude Code: removed obsolete ara-handoff@ara"}removeRetiredInstallations(){let q=[],J=[];for(let x of p){let Y;try{Y=this.status(x)}catch(X){J.push(`${r[x]}: ${X instanceof Error?X.message:String(X)}`);continue}if(Y.installed){if(x!=="cursor")try{q.push(this.logout(x))}catch(X){J.push(`${Y.label}: ${X instanceof Error?X.message:String(X)}`)}try{q.push(this.uninstall(x))}catch(X){J.push(`${Y.label}: ${X instanceof Error?X.message:String(X)}`)}}if(x==="claude"&&Y.legacyInstallations.includes("ara-handoff@ara"))try{q.push(this.removeLegacyClaudePlugin())}catch(X){J.push(`${Y.label}: ${X instanceof Error?X.message:String(X)}`)}}if(q.length===0&&J.length===0)q.push("No retired Reason MCP configuration found.");return{messages:q,failures:J}}}function n(q){return`claude mcp add --transport http reason ${q}`}function a(q){return`codex mcp add reason --url ${q}
 codex mcp login reason`}var P3=n("https://mcp.reasonmachines.com/mcp"),y3=a("https://mcp.reasonmachines.com/mcp"),R3=`https://claude.ai/settings/connectors?add=custom&url=${encodeURIComponent("https://mcp.reasonmachines.com/mcp")}`,N3=`https://cursor.com/install-mcp?name=reason&config=${encodeURIComponent(btoa(JSON.stringify({url:"https://mcp.reasonmachines.com/mcp"})))}`;var cq="https://github.com/reason-machines/reason-plugins",E3=`Connect a coding agent to Reason over MCP
 
 Usage:
@@ -52,7 +52,7 @@ Usage:
   reason mcp uninstall   Remove only this machine's registrations of the earlier, retired server
 
 Plugins for Claude Code and Codex: ${cq}
-`;function qq(q){if(!q.available)return"not detected";if(q.installed||q.legacyInstallations.length>0)return"retired configuration";return"not installed"}function iq(q,J){let x=J.toLowerCase();if(q==="codex")return x.includes("codex");if(q==="claude")return x.includes("claude");return x.includes("cursor")}function xq(q,J){return(J.mcp_connections??[]).filter((Y)=>iq(q.id,Y.client_name)).flatMap((Y)=>Y.last_used_at?[Y.last_used_at]:[]).sort().at(-1)??null}function Jq(q,J=new Date){if(!q)return"never";let x=Date.parse(q);if(!Number.isFinite(x))return"never";let Y=Math.max(0,Math.floor((J.getTime()-x)/1000));if(Y<45)return"just now";let X=Math.floor(Y/60);if(X<60)return`${X} ${X===1?"minute":"minutes"} ago`;let $=Math.floor(X/60);if($<24)return`${$} ${$===1?"hour":"hours"} ago`;let B=Math.floor($/24);return`${B} ${B===1?"day":"days"} ago`}function Xq(q){let J=q.name?.trim(),x=q.email?.trim();if(J&&x)return`${J} (${x})`;return J||x||q.id||"Reason user"}function Yq(q){let J=q.name?.trim(),x=q.slug?.trim();if(J&&x)return`${J} (${x})`;return J||x||q.id}var rq=G.enum(["granted","not_granted","unknown"]),Zq=G.object({status:rq,checkedAt:G.number().finite(),executablePath:G.string().min(1)});var J3=`Reason status
+`;function qq(q){if(!q.available)return"not detected";if(q.installed||q.legacyInstallations.length>0)return"retired configuration";return"not installed"}function iq(q,J){let x=J.toLowerCase();if(q==="codex")return x.includes("codex");if(q==="claude")return x.includes("claude");return x.includes("cursor")}function xq(q,J){return(J.mcp_connections??[]).filter((Y)=>iq(q.id,Y.client_name)).flatMap((Y)=>Y.last_used_at?[Y.last_used_at]:[]).sort().at(-1)??null}function Jq(q,J=new Date){if(!q)return"never";let x=Date.parse(q);if(!Number.isFinite(x))return"never";let Y=Math.max(0,Math.floor((J.getTime()-x)/1000));if(Y<45)return"just now";let X=Math.floor(Y/60);if(X<60)return`${X} ${X===1?"minute":"minutes"} ago`;let $=Math.floor(X/60);if($<24)return`${$} ${$===1?"hour":"hours"} ago`;let W=Math.floor($/24);return`${W} ${W===1?"day":"days"} ago`}function Xq(q){let J=q.name?.trim(),x=q.email?.trim();if(J&&x)return`${J} (${x})`;return J||x||q.id||"Reason user"}function Yq(q){let J=q.name?.trim(),x=q.slug?.trim();if(J&&x)return`${J} (${x})`;return J||x||q.id}var rq=G.enum(["granted","not_granted","unknown"]),Zq=G.object({status:rq,checkedAt:G.number().finite(),executablePath:G.string().min(1)});var J3=`Reason status
 
 Usage:
   reason status [--json]
@@ -62,15 +62,15 @@ computer's connection (\`reason connect\`) and the workspaces it serves, any
 retired MCP configuration that can be cleaned up, and automatic updates.
 `,X3=5000,Y3=300000,Z3=G.object({version:G.literal(1),key:G.string(),at:G.number(),self:G.object({principal_type:G.string(),user_id:G.string().optional(),user_name:G.string().nullish(),email:G.string().nullish(),org_id:G.string(),organization_name:G.string().nullish(),organization_slug:G.string().nullish(),mcp_connections:G.array(G.object({client_id:G.string(),client_name:G.string(),last_used_at:G.string().nullable()})).optional()})}),Pq=(q)=>`${q.apiOrigin}
 ${tq("sha256").update(q.accessToken).digest("hex")}`;function $3(q,J,x){try{let Y=Z3.safeParse(JSON.parse(eq(q,"utf8")));if(!Y.success||Y.data.key!==Pq(J))return null;let X=x-Y.data.at;return X>=0&&X<Y3?Y.data.self:null}catch{return null}}function G3(q,J,x,Y){let X=`${q}.${process.pid}.${sq(6).toString("hex")}.tmp`;try{let $={version:1,key:Pq(J),at:Y,self:x};q3(X,`${JSON.stringify($)}
-`,{mode:384,flag:"wx"}),nq(X,q)}catch{try{aq(X)}catch{}}}var Q3=30000;function W3(q,J=Date.now()){let x=Qq(q),Y=(()=>{if(x?.state!=="connected"&&x?.state!=="starting")return!1;try{return process.kill(x.pid,0),!0}catch{return!1}})(),X=Y&&x?.state==="connected",$=(K)=>X&&J-K>=0&&J-K<Q3,B=Zq.safeParse(x?.fullDiskAccess);return{full_disk_access:B.success&&$(B.data.checkedAt)?B.data.status:"unknown",keep_awake:{enabled:Dq(q)==="battery_and_ac",holding:x?.idleSleepHold===!0&&$(Date.parse(x.lastHeartbeatAt??""))},executable:Y&&B.success?B.data.executablePath:null}}function B3(q=H()){if(process.platform!=="darwin")return null;let J=kq(zq(Kq(Aq(l()),q),"worker.json"));return J?W3(Fq(J).daemon):null}var Gq={connected:"connected",starting:"starting",reconnecting:"reconnecting",stopping:"stopping",not_running:"not running",removed:"removed from Reason (run `reason connect` to connect it again)"};async function x1(q,J={}){let x=J.io??{stdout:process.stdout,stderr:process.stderr};if(q.includes("--help")||q.includes("-h"))return x.stdout.write(J3),0;if(q.some(($)=>$!=="--json"))return x.stderr.write(`Usage: reason status [--json]
-`),1;let Y=new AbortController,X=setTimeout(()=>Y.abort(Error("timed out reading the account")),X3);try{let $=J.now?.()??new Date,B=performance.now(),K=B,j=()=>{let Z=performance.now(),V=Math.round(Z-K);return K=Z,V},z=null,U=(Z)=>{return z=Z instanceof Error?Z.message:String(Z),null},F=await bq(J,Y.signal).catch(U),S=j(),W=F?.credentialKind==="api_key",D=F&&!W?zq(x3(Wq(J.env??process.env)),"status-account.json"):null,P=F&&D&&q.includes("--json")?$3(D,F,$.getTime()):null,Q=P??(F?await(J.getSelf??((Z,V)=>new Bq(Z).self(V)))(F,Y.signal).catch(U):null);if(F&&Q&&!P&&D)G3(D,F,Q,$.getTime());let h=j(),v=J.manager??new f,E=q.includes("--json")?[]:v.statuses(),M=(J.loadReceipt??jq)(),_=await(J.readConnection??(()=>Hq({channel:J.channel})))().catch(()=>null),A=null;try{if(_)A=(J.readConnectionMacState??(()=>B3(J.channel??H())))()}catch{}let b=_&&A?{..._,...A}:_,C=(()=>{try{return(J.readDisconnected??(()=>Vq(Aq(l()),J.channel??H())))()}catch{return!1}})(),yq=j(),o=Q?{id:Q.org_id,name:Q.organization_name??null,slug:Q.organization_slug??null}:null,N=Q?{id:Q.user_id??null,name:(W?Q.service_user_name:Q.user_name)??null,email:Q.email??null,credential:W?"api_key":"login"}:null,g=J.channel??H(),y={version:R,channel:g,api_origin:F?.apiOrigin??u(g),account:N,account_error:z,organization:o,mcp:E.map((Z)=>({client:Z.id,label:Z.label,status:qq(Z),installed_at:Z.installed?v.installationPath(Z.id):null,last_used_at:Q?xq(Z,Q):null})),connection:b,disconnected:C,installation:M?{background_mode:M.background_mode,automatic_updates:M.background_mode!=="cli_only",future_device_consent:M.device_consent?.decision??"disabled"}:null,timings_ms:{credentials:S,account:h,local:yq,total:Math.round(performance.now()-B)}};if(q.includes("--json"))return x.stdout.write(`${JSON.stringify(y,null,2)}
+`,{mode:384,flag:"wx"}),nq(X,q)}catch{try{aq(X)}catch{}}}var Q3=30000;function W3(q,J=Date.now()){let x=Qq(q),Y=(()=>{if(x?.state!=="connected"&&x?.state!=="starting")return!1;try{return process.kill(x.pid,0),!0}catch{return!1}})(),X=Y&&x?.state==="connected",$=(K)=>X&&J-K>=0&&J-K<Q3,W=Zq.safeParse(x?.fullDiskAccess);return{full_disk_access:W.success&&$(W.data.checkedAt)?W.data.status:"unknown",keep_awake:{enabled:Dq(q)==="battery_and_ac",holding:x?.idleSleepHold===!0&&$(Date.parse(x.lastHeartbeatAt??""))},executable:Y&&W.success?W.data.executablePath:null}}function B3(q=H()){if(process.platform!=="darwin")return null;let J=kq(Aq(Kq(zq(l()),q),"worker.json"));return J?W3(Fq(J).daemon):null}var Gq={connected:"connected",starting:"starting",reconnecting:"reconnecting",stopping:"stopping",not_running:"not running",removed:"removed from Reason (run `reason connect` to connect it again)"};async function x1(q,J={}){let x=J.io??{stdout:process.stdout,stderr:process.stderr};if(q.includes("--help")||q.includes("-h"))return x.stdout.write(J3),0;if(q.some(($)=>$!=="--json"))return x.stderr.write(`Usage: reason status [--json]
+`),1;let Y=new AbortController,X=setTimeout(()=>Y.abort(Error("timed out reading the account")),X3);try{let $=J.now?.()??new Date,W=performance.now(),K=W,j=()=>{let Z=performance.now(),V=Math.round(Z-K);return K=Z,V},A=null,U=(Z)=>{return A=Z instanceof Error?Z.message:String(Z),null},F=await bq(J,Y.signal).catch(U),S=j(),B=F?.credentialKind==="api_key",D=F&&!B?Aq(x3(Wq(J.env??process.env)),"status-account.json"):null,P=F&&D&&q.includes("--json")?$3(D,F,$.getTime()):null,Q=P??(F?await(J.getSelf??((Z,V)=>new Bq(Z).self(V)))(F,Y.signal).catch(U):null);if(F&&Q&&!P&&D)G3(D,F,Q,$.getTime());let h=j(),v=J.manager??new f,E=q.includes("--json")?[]:v.statuses(),M=(J.loadReceipt??jq)(),_=await(J.readConnection??(()=>Hq({channel:J.channel})))().catch(()=>null),z=null;try{if(_)z=(J.readConnectionMacState??(()=>B3(J.channel??H())))()}catch{}let b=_&&z?{..._,...z}:_,C=(()=>{try{return(J.readDisconnected??(()=>Vq(zq(l()),J.channel??H())))()}catch{return!1}})(),yq=j(),o=Q?{id:Q.org_id,name:Q.organization_name??null,slug:Q.organization_slug??null}:null,N=Q?{id:Q.user_id??null,name:(B?Q.service_user_name:Q.user_name)??null,email:Q.email??null,credential:B?"api_key":"login"}:null,g=J.channel??H(),y={version:R,channel:g,api_origin:F?.apiOrigin??u(g),account:N,account_error:A,organization:o,mcp:E.map((Z)=>({client:Z.id,label:Z.label,status:qq(Z),installed_at:Z.installed?v.installationPath(Z.id):null,last_used_at:Q?xq(Z,Q):null})),connection:b,disconnected:C,installation:M?{background_mode:M.background_mode,automatic_updates:M.background_mode!=="cli_only",future_device_consent:M.device_consent?.decision??"disabled"}:null,timings_ms:{process:Math.round(W),credentials:S,account:h,local:yq,total:Math.round(performance.now()-W)}};if(q.includes("--json"))return x.stdout.write(`${JSON.stringify(y,null,2)}
 `),0;if(g==="staging")x.stdout.write(`Reason ${R}  \xB7  channel: STAGING
 `),x.stdout.write(`API: ${y.api_origin}
 `);else x.stdout.write(`Reason ${R}
-`);if(N)x.stdout.write(W?`Account: API key (REASON_API_KEY)${N.name?`: ${N.name}`:""}
+`);if(N)x.stdout.write(B?`Account: API key (REASON_API_KEY)${N.name?`: ${N.name}`:""}
 `:`Account: ${Xq(N)}
 `),x.stdout.write(`Organization: ${Yq(o)}
-`);else if(z)x.stdout.write(`Account: unavailable (${z})
+`);else if(A)x.stdout.write(`Account: unavailable (${A})
 `);else x.stdout.write(`Account: signed out
 `),x.stdout.write(`Organization: none
 `);if(x.stdout.write(`
@@ -79,8 +79,8 @@ This computer
 `),b.version)x.stdout.write(`Version: ${b.version}${b.version===R?"":` (${R} is installed; \`reason connect\` restarts it on that)`}
 `);if(x.stdout.write(`Folder: ${b.folder}
 `),x.stdout.write(`Sessions: ${b.sessions_running===null?"":`${b.sessions_running} running, `}${b.sessions_max===1?"one at a time":`up to ${b.sessions_max} at once`}
-`),A){let Z=A,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-y4n9qc17.js"),{macScreenStatus:Oq}=await import("./local-display-mac-3zz66vzn.js");return Rq(await Nq({identity:()=>Iq(),grants:Oq,worker:async()=>Z}))}))().catch(()=>null);if(V)x.stdout.write(`${V}
-`);x.stdout.write(`Keep awake: ${A.keep_awake.enabled?"on":"off"}${A.keep_awake.holding?" (holding)":""}
+`),z){let Z=z,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-ch5zgbq0.js"),{macScreenStatus:Oq}=await import("./local-display-mac-3zz66vzn.js");return Rq(await Nq({identity:()=>Iq(),grants:Oq,worker:async()=>Z}))}))().catch(()=>null);if(V)x.stdout.write(`${V}
+`);x.stdout.write(`Keep awake: ${z.keep_awake.enabled?"on":"off"}${z.keep_awake.holding?" (holding)":""}
 `)}if(b.service)x.stdout.write(`Logs: ${b.service.logs}
 `);for(let Z of b.workspaces??[]){let V=Z.state==="removed"?"removed from that workspace":Z.blocked?"offline (this computer is outside that workspace's allowed networks)":Z.device_id?Gq[Z.state]:"connecting";x.stdout.write(`Also in workspace ${Z.name??Z.organization_id}${Z.account?" (another Reason account's)":""}: ${V}
 `)}if(b.workspaces_off==="sign_in")x.stdout.write("Other workspaces: off. This computer's sign-in is not one the Reason app or the setup command\n  Reason shows you made for it (or that sign-in ended, or it is in use on another computer), so it is\n  connected in one workspace only. Run the setup command from Reason here (it ends in --pair CODE);\n  if this computer was connected before that, run `reason disconnect` and `reason connect` once.\n")}let c=y.mcp.filter((Z)=>Z.installed_at||Z.status!=="not installed");if(c.length>0)x.stdout.write(`

package/bin/vm-hands/{version-yy031dwn.js → version-zdjskn9w.js}

@@ -1,2 +1,2 @@
 // @bun
-import{Ah as c,Bh as d,yh as a,zh as b}from"./vm-hands-entry-lite-t2xdqqqj.js";import"./vm-hands-entry-lite-cgm3es3w.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};
+import{Ah as c,Bh as d,yh as a,zh as b}from"./vm-hands-entry-lite-cw9qs82e.js";import"./vm-hands-entry-lite-kg5gmpvq.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};

package/bin/vm-hands/vm-hands-entry-lite-11qqexwe.js

@@ -0,0 +1,5 @@
+// @bun
+import{Ld as CJ,ad as jJ,id as EJ}from"./vm-hands-entry-lite-8st97h7b.js";import{createHash as H,randomBytes as $J}from"crypto";import{closeSync as UJ,fsyncSync as LJ,mkdirSync as vJ,openSync as NJ,renameSync as yJ,rmSync as IJ,statSync as qJ,writeSync as DJ,constants as S}from"fs";import{join as d}from"path";var RJ=1;var r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function GJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function BJ(J,Z){let{payload:z,authority:K}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!K||typeof K!=="object"||Array.isArray(K)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||K.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function AJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&r.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:GJ(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var g=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),V=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function v(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(v).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${v(J[Z])}`).join(",")}}`}async function zZ(J){let Z=await crypto.subtle.importKey("pkcs8",V(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=V(J.device_key.spki),K=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),C=new Uint8Array(await crypto.subtle.exportKey("spki",K.publicKey)),N=H("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:K,signingSpki:z,agreementSpki:C,fingerprint:N}}var fJ=4;class mJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;verifiedSinceRun=!1;unverified=new Set;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,K){this.init=J;this.keys=Z;this.hooks=z;this.options=K;if(!r.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let K=Date.now()+Z;;){let C=this.bound.get(J);if(!C)return!1;if(C.envInstalled)return!0;if(Date.now()>=K||z?.aborted)return!1;await new Promise((N)=>setTimeout(N,25))}}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:RJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:g(this.keys.signingSpki),env_public_key:g(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:g($J(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(v(Z)));return{...Z,device_signature:g(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),K=g($J(32)),C=CJ({method:"GET",pathAndQuery:jJ,timestamp:z,nonce:K,challenge:J,bodySha256:H("sha256").update("").digest("hex")}),N=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(C)));return{t:"hello",timestamp:z,nonce:K,signature:g(cJ(N)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new W("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!r.test(z))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(v({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new W("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=fJ)throw new W("vm_hands_busy","every bind slot is held");return this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,K=!1;try{if(Z.length===0){if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload(),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.verifiedSinceRun=!1,this.servedRun=!0,K=!0;let{launchId:C,applied:N,readyData:P}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),E=this.hooks.restatLayout(),D=null;if(J.env){let O=J.claim?.owner??{},k=BJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof O.device_id==="string"?O.device_id:"",rootId:J.claim?.root_id??""});D=this.hooks.installEnvironment(J.bind_id,k),z=this.writeJobEnvRootOnly(J.bind_id,k)}if(this.unbinding.has(J.bind_id))throw new W("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:C,envInstalled:D!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:C,snapshot_revision:D,layout:E,...P?{ready_data:P}:{},policy_digest:H("sha256").update(v({hands_confinement:N.hands_confinement??null,browser_egress:N.browser_egress??null})).digest("hex")}}catch(C){if(z)zJ(z);if(K){let P=[...this.bound.keys()];await this.hooks.killAndVerifyPayload(P.length?{bindId:J.bind_id,keep:P}:void 0).then(()=>{if(!P.length)this.verifiedSinceRun=!0,this.unverified.clear()},()=>{this.unverified.add(J.bind_id),this.verifiedSinceRun=!1})}this.binding.delete(J.bind_id);let N=C&&typeof C==="object"&&"code"in C&&typeof C.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(C.code)?C.code:"vm_hands_bind_failed";throw C instanceof W?C:new W(N,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new W("vm_hands_not_bound","environment delivered while not bound");if(!r.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let K=BJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),C=this.hooks.installEnvironment(Z.bindId,K);if(Z.envInstalled=!0,Z.envDirectory)zJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${C}`,K),{snapshot_id:J.snapshotId,installed_revision:C,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new W("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killAndVerifyPayload(),this.verifiedSinceRun=!0}catch{this.servedRun=!0,this.verifiedSinceRun=!1}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:H("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((K)=>K!==J);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:void 0)}catch(K){throw this.unverified.add(J),this.verifiedSinceRun=!1,K}if(!z.length)this.verifiedSinceRun=!0,this.unverified.clear();if(Z?.envDirectory)zJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},K=await crypto.subtle.importKey("spki",V(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),C=await crypto.subtle.deriveKey({name:"ECDH",public:K},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),N=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(J.iv),additionalData:new TextEncoder().encode(Z)},C,V(J.ct)).catch(z),P=JSON.parse(new TextDecoder().decode(N));if(!P||typeof P!=="object"||Array.isArray(P))throw new W("vm_hands_env_invalid","env not an object");return P}writeJobEnvRootOnly(J,Z){let z=d(this.options.envRoot,`bind-${J}`);vJ(z,{mode:448});let K=qJ(z);if(!K.isDirectory()||(K.mode&63)!==0||K.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let C=Z.variables&&typeof Z.variables==="object"?Z.variables:{},N=Object.entries(C).filter(([D,O])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(D)&&typeof O==="string").map(([D,O])=>`export ${D}='${String(O).replaceAll("'","'\\''")}'`).join(`
+`)+`
+`,P=d(z,`.job.env.${$J(8).toString("hex")}`),E=NJ(P,S.O_WRONLY|S.O_CREAT|S.O_EXCL|S.O_NOFOLLOW,384);try{DJ(E,N),LJ(E)}finally{UJ(E)}return yJ(P,d(z,"job.env")),z}}function zJ(J){try{let Z=d(J,"job.env"),z=qJ(Z).size,K=NJ(Z,S.O_WRONLY|S.O_NOFOLLOW);try{DJ(K,Buffer.alloc(z)),LJ(K)}finally{UJ(K)}}catch{}IJ(J,{recursive:!0,force:!0})}function cJ(J){if(J.length!==64)throw new W("vm_hands_signature_invalid","unexpected ECDSA signature length");let Z=(C)=>{let N=0;while(N<C.length-1&&C[N]===0)N++;let P=C.subarray(N),E=P[0]&128?Uint8Array.of(0,...P):P;return Uint8Array.of(2,E.length,...E)},z=Z(J.subarray(0,32)),K=Z(J.subarray(32));return Uint8Array.of(48,z.length+K.length,...z,...K)}import{randomUUID as bJ}from"crypto";var pJ="/app/local-runtime/session?register=vm_hands_v1",lJ="/app/local-runtime",MJ=25000,uJ=20000,oJ=1e4,dJ=5000,rJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),KJ=75000,iJ=2000,sJ=1e4,i=20000;class h extends Error{}var aJ=64;async function OJ(J,Z){let z=[...J.modelOps.get(Z)??[]];for(let K of z)K.abort.abort();await Promise.race([Promise.all(z.map((K)=>K.settled)),new Promise((K)=>setTimeout(K,dJ))])}async function y(J,Z,z){return await OJ(J,z),Z.unbind(z)}function s(J){for(let Z of J.outbox?.splice(0)??[])Z.reject(Error("vm_hands_attempt_ended"))}var xJ=15000,nJ=1e4;async function FZ(J){let Z=Date.now(),z={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map},K=J.log??(()=>{}),C=async(N)=>{for(let[P,E]of[...z.turns]){z.turns.delete(P),J.onTurn?.(P,null),s(E);let D=await y(z,J.agent,P).catch(()=>null);if(D)z.receipts.push({turn:E,failure:"vm_hands_bind_lost",unbound:D});K("vm_hands.bound_dropped",{reason:N})}};try{for(let N=0;!J.signal.aborted;N++){let P=await tJ(J,z).catch((D)=>{if(D instanceof W&&z.deviceId===null&&D.code==="vm_hands_no_session"&&Date.now()-Z<sJ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(D instanceof W&&z.deviceId===null)throw D;return{closeCode:0,closeReason:D instanceof Error?D.message:String(D)}});if(K("vm_hands.session_closed",{close_code:P.closeCode,reason:P.closeReason.slice(0,120),registered:z.deviceId!==null}),P.closeCode===4401||z.attest==="refused")return;if(J.signal.aborted)return;if(z.turns.size&&Date.now()-z.lostAt>=KJ)await C("reconnect_deadline");let E=P.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(N,5),2000):z.turns.size?Math.min(250*2**Math.min(N,5),5000,Math.max(0,z.lostAt+KJ-Date.now())):Math.min(500*2**N,30000);if(await new Promise((D)=>setTimeout(D,E)),z.turns.size&&Date.now()-z.lostAt>=KJ)await C("reconnect_deadline")}}finally{await C("session_ended")}}async function tJ(J,Z){let z=Z.deviceId,K=J.log??(()=>{}),C=z?`/app/local-runtime/session?device_id=${encodeURIComponent(z)}`:pJ,N=`${J.apiOrigin.replace(/^http/,"ws")}${C}`,P=new WebSocket(N),E=0,D="",O=new Map,k=[],I=null,_J=new Promise(($)=>{P.onclose=(Q)=>{E=Q.code,D=Q.reason;for(let G of O.values())G.reject(new h(`session closed ${Q.code}`));for(let G of Z.attestWaiters.splice(0))G(!1);O.clear(),$()}});P.onmessage=($)=>{let Q;try{Q=JSON.parse(String($.data))}catch{P.close(4400);return}if(Q.t==="res"){let G=Q;O.get(G.id)?.resolve({status:G.status,body:G.body}),O.delete(G.id);return}if(!I?.(Q))k.push(Q)};let R=($,Q)=>new Promise((G,X)=>{let j=k.findIndex((U)=>$.includes(U.t));if(j>=0){G(k.splice(j,1)[0]);return}let L=setTimeout(()=>{I=null,X(new W("vm_hands_no_register",`no ${$.join("/")} in ${Q} ms`))},Q);I=(U)=>{if(!$.includes(U.t))return!1;return clearTimeout(L),I=null,G(U),!0}}),f=($)=>P.send(JSON.stringify($)),w=($,Q)=>new Promise((G,X)=>{if(P.readyState!==WebSocket.OPEN){X(new h("session closed"));return}let j=bJ(),L=typeof Q.wait_ms==="number"?Q.wait_ms:0,U=setTimeout(()=>{if(!O.delete(j))return;X(new h(`no answer to ${$.split("/").pop()} in ${L+xJ} ms`)),P.close(4000,"request_timeout")},L+xJ);O.set(j,{reject:(Y)=>{clearTimeout(U),X(Y)},resolve:({status:Y,body:F})=>{clearTimeout(U);let B=null;try{B=F?JSON.parse(F):null}catch{}G({status:Y,json:B})}}),f({t:"req",id:j,path:`${lJ}${$}`,body:JSON.stringify(Q)})}),YJ=()=>P.close(1001,"stopping");J.signal.addEventListener("abort",YJ,{once:!0});let a,m=new Map,c=new Map,n=!1,t=new Set,e=new Set,JJ=Promise.resolve(),b=!1;try{await new Promise((Y,F)=>{let B=setTimeout(()=>F(Error("session open timeout")),nJ);P.onopen=()=>{clearTimeout(B),K("vm_hands.ws_open",{}),Y()},P.onerror=()=>{clearTimeout(B),F(Error("session socket error"))}});let $=await R(["challenge"],5000);K("vm_hands.challenge",{});let Q=[],G=null,X;if(z){f(await J.agent.helloFrame($.challenge,Z.connection));let Y=await R(["ready"],1e4);if(typeof Y.vm_hands_connection==="string")Z.connection=Y.vm_hands_connection;if(X={device_id:z,...Y.cadence?{cadence:Y.cadence}:{}},typeof Y.vm_hands_probe_script==="string"){if(G=Y.vm_hands_probe_script,b=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}K("vm_hands.reconnected",{device_id:z});let F=Array.isArray(Y.vm_hands_binds)?Y.vm_hands_binds:Y.vm_hands_bind?[Y.vm_hands_bind]:[];for(let[B,q]of[...Z.turns]){if(F.some((A)=>A&&A.operation_id===q.claim.operation_id&&A.attempt_id===q.claim.attempt_id)){Q.push(q),K("vm_hands.bound_resumed",{operation_id:q.claim.operation_id});continue}Z.turns.delete(B),J.onTurn?.(B,null),s(q);let x=await y(Z,J.agent,B).catch(()=>null);if(x)Z.receipts.push({turn:q,failure:"vm_hands_bind_lost",unbound:x});K("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{f(await J.agent.registerFrame($.challenge)),K("vm_hands.register_sent",{});let Y=await R(["registered","register_refused"],1e4);if(Y.t==="register_refused")throw new W(Y.code,"register refused");J.agent.registered();let F=Y;if(X=F,Z.deviceId=F.device_id,typeof F.vm_hands_connection==="string")Z.connection=F.vm_hands_connection;if(typeof F.vm_hands_probe_script==="string"){if(G=F.vm_hands_probe_script,b=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}K("vm_hands.registered",{device_id:X.device_id})}let j=async()=>{let Y=await w("/heartbeat",await J.heartbeat());if(Y.status>=300)throw Error(`heartbeat ${Y.status}`)};await j();let L=X.cadence?.presence_interval_ms??30000;if(a=setInterval(()=>{j().catch(()=>P.close())},L),G&&Z.attest!=="accepted"&&J.agent.phase==="registered"&&!Z.turns.size)hJ(G,$.challenge);let U=(Y,F)=>{c.set(Y,F().catch(async(B)=>{if(await QJ(B,Y),B instanceof h)P.close();else await ZJ().catch(()=>{return})}).finally(()=>{c.delete(Y)}))};try{await ZJ();for(let Y of Q)Y.flush=()=>XJ(Y),Y.flush(),U(Y.claim.attempt_id,()=>FJ(Y));while(!J.signal.aborted&&P.readyState===WebSocket.OPEN){let Y=await w("/operations/claim",{wait_ms:Math.min(X.cadence?.claim_wait_ms??MJ,MJ)});if(Y.status===204||!Y.json)continue;if(Y.status>=300)throw Error(`claim ${Y.status}`);let F=Y.json;if(F.capability==="hands.connect"){if(c.has(F.attempt_id)){_({claim:F,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}U(F.attempt_id,()=>wJ(F))}else kJ(F).catch(()=>{return})}}catch(Y){await QJ(Y,null)}}finally{if(a)clearInterval(a);J.signal.removeEventListener("abort",YJ);for(let $ of Z.turns.values())$.flush=null;P.close(),await _J,await Promise.all([...c.values()]);for(let $ of J.agent.liveBindIds){if(Z.turns.has($))continue;let Q=await y(Z,J.agent,$).catch(()=>null),G=m.get($);if(Q&&G)Z.receipts.push({turn:{...G,eventSeq:G.eventSeq+1},failure:"vm_hands_bind_lost",unbound:Q});K("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let $ of t)$.abort()}return{closeCode:E,closeReason:D};async function QJ($,Q){if($ instanceof h){if(!n&&Z.turns.size)Z.lostAt=Date.now();n=!0}else{let G=Q!==null?[Q]:[...new Set([...Z.turns.keys(),...J.agent.liveBindIds])];if(Q===null)n=!0;for(let X of G){let j=Z.turns.get(X);if(Z.turns.delete(X),j)s(j),J.onTurn?.(X,null);if(J.agent.liveBindIds.includes(X)){let L=await y(Z,J.agent,X).catch(()=>null),U=m.get(X)??j;if(L&&U)Z.receipts.push({turn:{...U,eventSeq:U.eventSeq+1},failure:"vm_hands_bind_lost",unbound:L})}}}K("vm_hands.session_lost",{error:$ instanceof Error?$.message:String($),bound_kept:Z.turns.size})}function _($){let Q=$.claim,G={attempt_id:Q.attempt_id,attempt_token:Q.attempt_token},X=encodeURIComponent(Q.operation_id);return{fence:G,op:X,complete:(L,U={})=>w(`/operations/${X}/complete`,{...G,status:L,...U}),emit:(L,U)=>{let Y=($.chain??Promise.resolve()).catch(()=>{return}).then(()=>j(L,U));return $.chain=Y,Y}};async function j(L,U){let Y=$.eventSeq,F=(A)=>w(`/operations/${X}/events`,{...G,event_seq_start:A,events:[{kind:L,payload:{sequence:A,capability:String(Q.capability??"hands.connect"),data:U}}]}),B=Y,q=await F(B),x=q.status===409?q.json?.expected_event_seq:void 0;if(typeof x==="number"&&x===Y+1)q={status:200,json:{duplicate:!0}};else if(typeof x==="number"&&x>=0&&x!==Y)B=x,q=await F(B);if(q.status<300)$.eventSeq=B+1;return q}}function TJ($){return(Q,G)=>new Promise((X,j)=>{if(Z.turns.get($.claim.attempt_id)!==$){j(Error("vm_hands_attempt_ended"));return}if($.outbox??=[],$.outbox.length>=aJ){j(Error("vm_hands_outbox_full"));return}$.outbox.push({kind:Q,data:G,resolve:X,reject:j}),$.flush?.()})}function XJ($){if(e.has($))return;e.add($),(async()=>{try{while($.outbox?.length&&Z.turns.get($.claim.attempt_id)===$&&P.readyState===WebSocket.OPEN){let Q=$.outbox[0],G;try{G=await _($).emit(Q.kind,Q.data)}catch(X){if(X instanceof h)return;G={status:500}}if($.outbox.shift(),G.status<300)Q.resolve();else Q.reject(Error(`${Q.kind} refused ${G.status}`))}}finally{e.delete($)}})()}async function hJ($,Q){try{let G=await J.agent.attestFrame($,Q);if(P.readyState!==WebSocket.OPEN)return;f(G);let X=await R(["attested","attest_refused"],15000);Z.attest=X.t==="attested"?"accepted":"refused";for(let j of Z.attestWaiters.splice(0))j(Z.attest==="accepted");if(K("vm_hands.attest",{result:Z.attest,exit_code:G.exit_code,...X.t==="attest_refused"?{code:String(X.code??"")}:{}}),Z.attest==="refused")P.close(4401,"attest_refused")}catch(G){K("vm_hands.attest_failed",{code:G instanceof W?G.code:"probe_error"});for(let X of Z.attestWaiters.splice(0))X(!1);if(Z.attest!=="accepted")P.close(4000,"attest_unanswered")}}async function wJ($){let Q=b&&Z.attest==="pending",G=$.vm_hands_attest,X=G;if(Z.attest==="refused"){K("vm_hands.claim_attest_refused",{said:typeof G==="string"?G.slice(0,16):typeof G,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(X==="accepted"){if(!Q&&Z.attest!=="accepted"){Z.attest="accepted";for(let A of Z.attestWaiters.splice(0))A(!0)}}else if(X!=="pending"||!Q){K("vm_hands.claim_attest_refused",{said:typeof G==="string"?G.slice(0,16):typeof G,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Z.attest!=="accepted"){let A=Date.parse($.lease_until)-Date.now()-5000,p=Math.max(0,Math.min(i,Number.isFinite(A)?A:i));if(!await new Promise((u)=>{let M=setTimeout(()=>u(!1),p);Z.attestWaiters.push((T)=>{clearTimeout(M),u(T)})})){await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let j={claim:$,eventSeq:0},{complete:L,emit:U}=_(j),Y;try{if($.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not hands.connect");Y=!GJ($)}catch(A){K("vm_hands.bind_refused",{code:A instanceof W?A.code:"unexpected"}),await L("failed",{error_code:A instanceof W?A.code:"vm_hands_bind_invalid"});return}let F;try{F=await J.agent.bind(AJ($))}catch(A){K("vm_hands.bind_refused",{code:A instanceof W?A.code:"unexpected"}),await L("failed",{error_code:A instanceof W?A.code:"vm_hands_bind_failed"});return}let B={...F.ready_data??J.readyData({launchId:F.launch_id,claim:$})};if(Y)delete B.environment_installed;m.set($.attempt_id,{claim:$,launchId:F.launch_id,readyData:B,eventSeq:j.eventSeq,ackSeq:-1});let q=await U("hands.ready",{...B,vm_hands:{layout:F.layout,policy_digest:F.policy_digest,launch_id:F.launch_id}});if(m.delete($.attempt_id),q.status>=300){await OJ(Z,$.attempt_id),await J.agent.boundRefused($.attempt_id),await L("failed",{error_code:String(q.json?.error??"vm_hands_probe_failed")});return}let x={claim:$,launchId:F.launch_id,readyData:B,eventSeq:j.eventSeq,ackSeq:-1};Z.turns.set($.attempt_id,x),x.flush=()=>XJ(x),J.onTurn?.($.attempt_id,TJ(x)),await FJ(x)}async function FJ($){let{fence:Q,op:G}=_($),X=null,j=null,L=J.agent.executorExited($.claim.attempt_id).then((U)=>{return j=U,null});J:for(;;){let U=await Promise.race([L,w(`/operations/${G}/heartbeat`,{...Q,control_ack_seq:$.ackSeq,wait_ms:uJ})]);if(!U){X="vm_hands_executor_exited",K("vm_hands.executor_exited",{reason:j});break}if(U.status>=300)break;let Y=(U.json?.controls??[]).slice().sort((F,B)=>F.seq-B.seq);for(let F of Y){if(F.seq<=$.ackSeq)continue;if(F.kind==="operation.cancel"||F.kind==="cancel"){$.ackSeq=F.seq;break J}if(F.kind===EJ)try{await SJ($,F.payload??{})}catch(B){if(B instanceof h)throw B;X=B instanceof W?B.code:"environment_unavailable",K("vm_hands.environment_refused",{code:X});break J}$.ackSeq=F.seq}}await gJ($,X)}async function kJ($){let Q=$,G={claim:Q,eventSeq:0},{complete:X,emit:j,fence:L,op:U}={..._(G)},Y=$.vm_hands_origin==="person"?"person":"model",F=String($.capability??"");if(!J.executeOp){await X("failed",{error_code:"vm_hands_op_unsupported"});return}if($.vm_hands_attest==="accepted"&&Z.attest==="pending"&&!(b&&Z.attest==="pending")){Z.attest="accepted";for(let M of Z.attestWaiters.splice(0))M(!0)}if(Z.attest!=="accepted"){let M=Date.parse(String($.lease_until??""))-Date.now()-5000,T=Z.attest==="refused"?0:Math.max(0,Math.min(i,Number.isFinite(M)?M:i));if(!(T>0&&await new Promise((PJ)=>{let HJ=setTimeout(()=>PJ(!1),T);Z.attestWaiters.push((VJ)=>{clearTimeout(HJ),PJ(VJ)})}))){await X("failed",{error_code:"vm_hands_unattested"});return}}let B=J.agent.bindIdForRun(Q.run_id);if(Y==="model"&&B===null){await X("failed",{error_code:"vm_hands_not_bound"});return}if(rJ.has(F)&&J.agent.liveBindIds.length===0){await X("failed",{error_code:"vm_hands_not_bound"});return}let q=new AbortController;t.add(q);let x,A=new Promise((M)=>{x=M}),p={abort:q,settled:A};if(Y==="model"&&B){let M=Z.modelOps.get(B)??new Set;M.add(p),Z.modelOps.set(B,M),await J.agent.environmentInstalled(B,iJ,q.signal)}let l=-1,u=setInterval(()=>{w(`/operations/${U}/heartbeat`,{...L,control_ack_seq:l,wait_ms:0}).then((M)=>{if(M.status>=300){q.abort();return}let T=M.json?.controls??[];for(let o of T)if(l=Math.max(l,o.seq),o.kind==="operation.cancel"||o.kind==="cancel")q.abort()},()=>q.abort())},oJ);try{let M=await J.executeOp({kind:Y,claim:$,...Y==="model"&&B?{bindId:B}:{},signal:q.signal,emit:async(T)=>{await j(T.kind,T.data??{})}});await X(M.status,{...M.result?{result:M.result}:{},...M.error_code!==void 0?{error_code:M.error_code}:{}}),K("vm_hands.op",{capability:F,kind:Y,status:M.status,code:M.error_code??null})}finally{if(clearInterval(u),t.delete(q),B)Z.modelOps.get(B)?.delete(p);x()}}async function gJ($,Q){let G=$.claim.attempt_id;if(Z.turns.get(G)===$)Z.turns.delete(G);J.onTurn?.(G,null),s($);let X=await y(Z,J.agent,G);Z.receipts.push({turn:$,failure:Q,unbound:X}),await ZJ()}function ZJ(){return JJ=JJ.then(WJ,WJ),JJ}async function WJ(){while(Z.receipts.length){let{turn:$,failure:Q,unbound:G}=Z.receipts[0],{complete:X,emit:j}=_($);try{if(await j("hands.stopped",{...$.readyData,reason_code:Q?"failed":"cancelled",killed_verified:G.killed_verified,shredded:G.shredded,...G.srt_fallbacks?{vm_hands_srt_fallbacks:G.srt_fallbacks}:{}}),Q)await X("failed",{error_code:Q});else await X("cancelled",{error_code:"driver_stopped"})}catch(L){if(L instanceof h)return}Z.receipts.shift()}}async function SJ($,Q){let{fence:G,op:X}=_($),j=Q.snapshot_id;if(Q.version!==1||typeof j!=="string"||Object.keys(Q).length!==2)throw new W("vm_hands_env_invalid","invalid environment delivery");let L=await w(`/operations/${X}/environment`,{...G,snapshot_id:j}),U=L.json?.environment_sealed;if(L.status!==200||!U||L.json?.payload!==void 0)throw new W("vm_hands_env_invalid","environment not delivered sealed");let Y=await J.agent.deliverEnvironment({attemptId:$.claim.attempt_id,snapshotId:j,deviceId:Z.deviceId??"",sealed:U});if((await w(`/operations/${X}/environment-ack`,{...G,...Y})).status>=300)throw new W("vm_hands_env_ack_refused","environment ack refused")}}
+export{zZ as u,mJ as v,FZ as w};

package/bin/vm-hands/{vm-hands-entry-lite-z93r72nn.js → vm-hands-entry-lite-32tgpj26.js}

@@ -1,5 +1,5 @@
 // @bun
-import{$a as n6,Ea as u6,Ga as w4,Ha as O4,Ma as l6,Na as s6,Xa as I4,ab as r6,bb as S4,cb as k4,eb as a6,ga as U4,gb as B8,hb as y0,ia as W2,ib as m0,ja as X4,jb as c1,ka as W4,la as Y4,ma as S6,mb as i6,na as f6,oa as M4,pa as b6,pb as V8,qa as A3,qb as A4,ra as x6,sa as y6,sb as o6,ta as h6,ua as m6,va as L4,wa as v6,xa as p6}from"./vm-hands-entry-lite-815h1kvr.js";import{Ab as n0,Bb as r0,Ib as P0,tb as i3,ub as q6,vb as E6}from"./vm-hands-entry-lite-rrk5g62b.js";import{Jb as t6,Mb as e6,Ob as $7,Pb as J7}from"./vm-hands-entry-lite-ya1a2eep.js";import{Ub as d6}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Vb as _6,Wb as R6,Xb as P6,Yb as z6,Zb as L0}from"./vm-hands-entry-lite-n07kxrd1.js";import{$b as o1,ac as t1,bc as S3,dc as k3,fc as f3,gc as b3,kc as x3}from"./vm-hands-entry-lite-0ergg2ky.js";import{Bc as r1,Ec as H7,Nc as D7}from"./vm-hands-entry-lite-sqdh029v.js";import{$c as d,$d as g8,Ad as w6,Cd as O6,Dd as j6,Ed as I6,Fd as A6,Gd as T6,Ld as D8,Md as M8,Nd as L8,Oc as L1,Od as w8,Pc as Q2,Pd as O8,Qc as e5,Qd as j8,Rc as I3,Sc as r3,Sd as I8,Tc as a3,Td as A8,Uc as M0,Ud as T8,Vd as _8,Wd as R8,Xd as P8,Yc as N0,Yd as z8,Zd as q8,_d as E8,ad as E1,dd as H8,fd as g1,hd as $6,id as J6,jd as Z6,kd as Q6,ld as K6,md as B6,nd as V6,od as G6,pd as U6,qd as X6,rd as W6,sd as Y6,td as F6,ud as N6,vd as C6,wd as H6,xd as D6,yd as M6,zd as L6}from"./vm-hands-entry-lite-8st97h7b.js";import{ae as V}from"./vm-hands-entry-lite-q6fshf3h.js";import{Ae as l1,be as W7,ce as Y7,de as F7,ee as N7,fe as C7,le as p5,pe as Q5,qe as T5,we as M7,ze as K5}from"./vm-hands-entry-lite-32mphjwz.js";import{Ze as j4,ef as c6}from"./vm-hands-entry-lite-pf1ft65e.js";import{jf as M3,wf as g6}from"./vm-hands-entry-lite-q2pb31vh.js";import{Bg as Z7,Cg as Q7,Dg as K7,Eg as B7,Gg as V7,Hg as G7,Jg as U7,Kg as X7}from"./vm-hands-entry-lite-6j2yaa4n.js";import{Yg as n1}from"./vm-hands-entry-lite-7k65s010.js";import{$g as k6,_g as j1,ah as H4,bh as D4}from"./vm-hands-entry-lite-em388nee.js";import{dh as D3,fh as $1,lh as K8,mh as J4}from"./vm-hands-entry-lite-yp315y25.js";import{Kh as H}from"./vm-hands-entry-lite-xsq25kmd.js";import{Oh as a4}from"./vm-hands-entry-lite-hf0mk7vd.js";import{request as m7}from"http";import{request as v7}from"https";async function p7($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?v7:m7)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:k3},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Error("custom_endpoint_timeout"))),K.end($.body)})}function u7($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function d7($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let W=Buffer.allocUnsafe(G.length*Q.length+B),Y=0;for(let X of G){while(B&&Z[B]!==X){let F=K[B-1];Y+=Z.copy(W,Y,0,B-F),B=F}if(Z[B]===X){if(B++,B===Z.length)Y+=Q.copy(W,Y),B=0}else W[Y++]=X}if(U)Y+=Z.copy(W,Y,0,B),B=0;return W.subarray(0,Y)}}async function y3($){$.signal.throwIfAborted();let J=b3.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=x3.parse(await $.credential($.signal));if(!f3(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,W=0,Y=u7(Q.apiKey),X=d7(Q.apiKey,Y),F=async(N,D)=>{$.signal.throwIfAborted(),await new Promise((w,M)=>{let I=()=>{$.signal.removeEventListener("abort",I),M($.signal.reason)};if($.signal.addEventListener("abort",I,{once:!0}),$.signal.aborted){I();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(N,D)}).then(()=>{$.signal.removeEventListener("abort",I),w()},(O)=>{$.signal.removeEventListener("abort",I),M(O)})})},C=async(N)=>{if(G+=N.length,G>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let D=0;D<N.length;D+=o1){if(W>=S3)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await F(`custom_endpoint.chunk.${W++}`,{eof:!1,data:N.subarray(D,D+o1).toString("base64")})}};try{let N=await p7({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=N.response,B=N.close;let D=K.statusCode??500;if(D>=300&&D<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let w={};for(let M of["content-type","retry-after","x-request-id","request-id"]){let I=K.headers[M];if(typeof I==="string")w[M]=I.replaceAll(Q.apiKey,Y).slice(0,4096)}await F("custom_endpoint.headers",{status:D,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,Y).slice(0,256),headers:w});for await(let M of K){$.signal.throwIfAborted();let I=Buffer.isBuffer(M)?M:Buffer.from(M);if(U+=I.length,U>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(X(I))}return await C(X(Buffer.alloc(0),!0)),await F(`custom_endpoint.chunk.${W}`,{eof:!0}),{bytes:G,chunks:W}}catch(N){if($.signal.throwIfAborted(),N instanceof H)throw N;throw new H("custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as h3}from"path";function l7($,J){return $===h3(J,".ara","workspace")||$===h3(J,".reason","workspace")}function m3($,J){let Z=$.filter((Q)=>l7(Q.path,J));return Z.length===1?Z[0].path:null}var s7=/^[a-f0-9]{64}$/;var e1=32,c7=/^\/[^\x00-\x1f\x7f\\]*$/;function H1($){if(typeof $!=="string"||$.length>4096||!c7.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function D1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!H1(J.home)||!Array.isArray(J.roots)||J.roots.length>e1)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!s7.test(K)||!H1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}import{spawn as r7}from"child_process";import*as z from"fs";import*as s from"path";import{homedir as a7}from"os";function $2($,J,Z,Q="gh"){if(!["gh","git"].includes(Q))throw Error("local_device_gh_unavailable");let K=$.realpathSync(Z),B=Q==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+Q;for(let G of["/opt/homebrew/bin/"+Q,"/usr/local/bin/"+Q,B])try{let U=$.realpathSync(G);if(U===K||U.startsWith(K+J.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...Q==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((Y)=>U.startsWith(Y)))continue;let W=$.statSync(U);if(!W.isFile()||(W.mode&18)!==0||![0,process.getuid()].includes(W.uid))continue;return $.accessSync(U,$.constants.X_OK),U}catch{continue}throw Error("local_device_gh_unavailable")}function v3($,J){let Z=1;for(let Q=0;Q<J;Q+=1)if($.charCodeAt(Q)===10)Z+=1;return Z}var p3=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function J2($){let J=$.trim().replaceAll("\\","/");if(!J)return{valid:!1,reason:"empty_path"};if(J.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(J.split("/").includes("..")||J.includes("../")||J.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(J===".git"||J.startsWith(".git/")||J.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function u3($){return[...new Set($.map((J)=>J.trim()).filter((J)=>J.length>=8))]}function d3($,J){return[...J.matchAll(new RegExp($.regex.source,`${$.regex.flags}g`))]}function M1($,J=[],Z={}){let Q=[],K=Z.published??new Set,B=u3(J).filter((G)=>!K.has(G));for(let G of $){let U=J2(G.path);if(!U.valid){Q.push({path:G.path,reason:U.reason??"invalid_path"});continue}let W=G.content??"",Y=B.map((X)=>({secret:X,offset:W.indexOf(X)})).filter((X)=>X.offset>=0).sort((X,F)=>X.offset-F.offset);if(Y.length>0){let X=[...new Set(Y.flatMap((F)=>Z.secretNames?.(F.secret)??[]))];Q.push({path:G.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:v3(W,Y[0].offset),...X.length>0?{secretNames:X}:{}})}for(let X of p3){let F=d3(X,W).find((C)=>!K.has(C[0]));if(F){Q.push({path:G.path,reason:`credential_pattern_detected: ${X.name}`,pattern:X.name,ruleId:X.name,line:v3(W,F.index)});break}}}return{clean:Q.length===0,violations:Q,scannedObjectCount:$.length}}function l3($,J=[]){let Z=u3(J),Q=new Set;for(let{content:K}of $){for(let B of Z)if(K.includes(B))Q.add(B);for(let B of p3)for(let G of d3(B,K))Q.add(G[0])}return[...Q]}function n7($,J){let Z=0;for(let Q=$.indexOf(J);Q>=0;Q=$.indexOf(J,Q+J.length))Z+=1;return Z}function s3($,J,Z){let Q=(K,B)=>K.reduce((G,U)=>G+n7(U,B),0);return new Set($.filter((K)=>Q(J,K)<=Q(Z,K)))}var T0=4194304,c3=536870912,Z2=/^[a-f0-9]{40}$/,i7=($,J,Z)=>new Promise((Q)=>{if(Z.signal?.aborted){Q({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let K;try{K=r7($,J,{cwd:Z.cwd,env:Z.env,detached:!0,stdio:["pipe","pipe","pipe"]})}catch{Q({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let B=Buffer.alloc(0),G=Buffer.alloc(0),U,W=!1,Y=(N)=>{if(U??=Error(N),K.pid)try{process.kill(-K.pid,"SIGKILL")}catch{}},X=()=>Y("cancelled"),F=setTimeout(()=>Y("timeout"),Z.timeout);Z.signal?.addEventListener("abort",X,{once:!0});let C=(N)=>{if(W)return;W=!0,clearTimeout(F),Z.signal?.removeEventListener("abort",X),Q({status:N,stdout:B,stderr:G,...U?{error:U}:{}})};if(K.stdout.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else B=Buffer.concat([B,N])}),K.stderr.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else G=Buffer.concat([G,N])}),K.on("error",()=>{if(Y("spawn_failed"),!K.pid)C(null)}),K.on("close",(N)=>C(N)),K.stdin.on("error",()=>Y("input_failed")),K.stdin.end(Z.input),Z.signal?.aborted)X()}),o7={command:i7,gh:($,J)=>$2(z,s,$,J),home:a7};function A($){throw Error($)}var t7=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),e7=($)=>JSON.stringify($,(J,Z)=>t7.has(J)?void 0:Z);function n3($,J,Z){let Q=[...new Set($.map((B)=>`${J(B.path)}${B.line?`:${B.line}`:""} (${B.reason==="literal_secret_detected"?`value of ${B.secretNames?.length?B.secretNames.slice(0,3).join(", "):"a session variable"}`:`${B.ruleId??"credential"} credential`})`))].slice(0,10),K=$.some((B)=>B.reason==="literal_secret_detected");A(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${Q.join("; ")}. Nothing was sent. ${Z}${K?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function o3($,J,Z=o7){let Q=L1.parse($);if(!["darwin","linux"].includes(process.platform))A("local_device_gh_platform_unavailable");J.assertCurrent();let K=z.realpathSync(J.root);if(K==="/")A("local_device_gh_root_unavailable");if(!M0(Q)&&!J.forbiddenSecretValues)A("local_device_gh_secret_scope_unavailable");if(!M0(Q)&&J.readOnly)A("local_device_gh_read_only");if(!M0(Q)){let L=M1([{path:"github-operation",content:e7(Q)}],J.forbiddenSecretValues,J.secretNames?{secretNames:J.secretNames}:{});if(!L.clean)n3(L.violations,()=>`the ${Q.kind} request text`,"Remove it from the pull request text and try again.")}let B=Z.gh(K),G=Z.home(),U=$2(z,s,K,"git"),W=J.privateDirectory?z.realpathSync(J.privateDirectory):z.realpathSync(G);if(!M0(Q)&&(!J.privateDirectory||W===K||W.startsWith(K+s.sep)))A("local_device_gh_private_scope_unavailable");let Y={PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:G,GH_CONFIG_DIR:s.join(G,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((L)=>process.env[L]?[[L,process.env[L]]]:[])):{}},X=async(L,T,P=W,k,x=T0)=>{J.assertCurrent();let y=await Z.command(L,T,{cwd:P,env:Y,input:k,maxBuffer:x,timeout:Math.max(1,Math.min(60000,(J.deadlineMs??Date.now()+60000)-Date.now())),signal:J.signal});if(J.assertCurrent(),y.error||y.status!==0)A("local_device_gh_command_failed");return y.stdout},F=async(L)=>(await X(B,L)).toString("utf8").trim(),C=async(L,T="application/vnd.github+json")=>{r3(Q.repoFullName,L,{headers:{accept:T}}),J.assertCurrent();let P=await Z.command(B,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${T}`,L],{cwd:W,env:Y,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal});if(J.assertCurrent(),P.error&&P.status===null)A("local_device_gh_response_unavailable");let k=P.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!k)A("local_device_gh_response_invalid");let x=Number(k[1]);if(x>=200&&x<300&&P.status!==0)A("local_device_gh_response_unavailable");if(Buffer.byteLength(k[3])>Q2)A("local_device_gh_response_too_large");let y={};for(let r of k[2].split(/\r?\n/)){let a=r.indexOf(":"),D0=r.slice(0,a).toLowerCase();if(["link","content-type"].includes(D0))y[D0]=r.slice(a+1).trim().slice(0,8192)}return{kind:"read",status:x,headers:y,body:x>=200&&x<300?k[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(Q.kind==="read")return C(Q.path,Q.accept);if(Q.kind==="pr_review_context"){let[L,T]=Q.repoFullName.split("/"),P=await F(["api","graphql","--hostname","github.com","-f",`query=${a3}`,"-f",`owner=${L}`,"-f",`repo=${T}`,"-F",`number=${Q.number}`,...Q.after?["-f",`after=${Q.after}`]:[]]);if(Buffer.byteLength(P)>Q2)A("local_device_gh_response_too_large");let k=JSON.parse(P);if(k.errors||k.data?.repository?.nameWithOwner?.toLowerCase()!==Q.repoFullName.toLowerCase()||k.data.repository.pullRequest?.number!==Q.number)A("local_device_gh_response_invalid");return{kind:"pr_review_context",body:P}}if(Q.kind==="pr_merge"){let L=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),T=JSON.parse(L.body),P=(y)=>y.number===Q.number&&y.html_url===`https://github.com/${Q.repoFullName}/pull/${Q.number}`&&y.base?.repo?.full_name?.toLowerCase()===Q.repoFullName.toLowerCase()&&y.base?.ref===Q.expectedBaseRef&&y.head?.sha===Q.expectedHeadSha;if(L.status!==200||!P(T)||T.state!=="open"||T.draft!==!1||T.head?.sha!==Q.expectedHeadSha||T.base?.repo?.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase())A("local_device_gh_merge_target_changed");await F(["pr","merge",String(Q.number),`--repo=${Q.repoFullName}`,`--${Q.method}`,"--match-head-commit",Q.expectedHeadSha]);let k=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),x=JSON.parse(k.body);if(k.status!==200||!P(x)||x.merged!==!0)A("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:Q.number,merged:!0}}if(Q.kind==="pr_create"){if(Q.head===Q.base)A("local_device_gh_default_branch");let L=await F(["pr","create","--repo",Q.repoFullName,"--head",Q.head,"--base",Q.base,`--title=${Q.title}`,`--body=${Q.body}`,...Q.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+Q.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(L))A("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:L}}if(Q.kind==="pr_mutation"){let L=Q.mutation,T=L.action==="edit"?["edit",...L.title!==void 0?[`--title=${L.title}`]:[],...L.body!==void 0?[`--body=${L.body}`]:[],...L.base?[`--base=${L.base}`]:[]]:L.action==="metadata"?["edit",`--${L.change}-${L.field}=${L.value}`]:L.action==="ready"?["ready"]:L.action==="draft"?["ready","--undo"]:["close"];return await F(["pr",...T,String(Q.number),"--repo",Q.repoFullName]),{kind:"pr_mutation",number:Q.number,applied:!0}}if(!J.repoPath)A("local_device_gh_workspace_unavailable");let N=z.realpathSync(J.repoPath);if(N!==K&&!N.startsWith(K+s.sep))A("local_device_gh_workspace_unavailable");let D=`https://github.com/${Q.repoFullName}.git`,w="!'"+B.replace(/'/g,"'\\''")+"' auth git-credential",M=Function("return ("+i3+")")(),I=(L,T,P)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",L,T,...P]]:[T,P],O=async(L,T,P,k=T0)=>{let x=L===W||L.startsWith(W+s.sep),y=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...x?["-c",`credential.https://github.com.helper=${w}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",...T];if(x)return X(U,y,L,P,k);let r=s.join(N,".ara-local-gh-tmp");if(z.mkdirSync(r,{recursive:!0,mode:448}),z.lstatSync(r).isSymbolicLink()||z.realpathSync(r)!==r)A("local_device_gh_workspace_unavailable");J.assertCurrent();let a=await Z.command(...I(M(N,r),U,y),{cwd:L,input:P,maxBuffer:k,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:N,TMPDIR:r,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),a.error||a.status!==0)A("local_device_gh_collection_failed");return a.stdout},R=async(L,T)=>(await O(L,T)).toString("utf8").trim(),E=async(L,T)=>{let P=s.join(L,".ara-local-gh-tmp");if(z.mkdirSync(P,{recursive:!0,mode:448}),z.lstatSync(P).isSymbolicLink()||z.realpathSync(P)!==P)A("local_device_gh_workspace_unavailable");J.assertCurrent();let k=await Z.command(...I(M(L,P),"/bin/sh",["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",T]),{cwd:L,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:L,TMPDIR:P}});if(J.assertCurrent(),k.error||k.status!==0)A("local_device_gh_materialization_failed")},v=async(L)=>{let T=new Map;if(L.length===0)return T;let P=await O(S,["cat-file","--batch"],[...new Set(L)].join(`
+import{$a as n6,Ea as u6,Ga as w4,Ha as O4,Ma as l6,Na as s6,Xa as I4,ab as r6,bb as S4,cb as k4,eb as a6,ga as U4,gb as B8,hb as y0,ia as W2,ib as m0,ja as X4,jb as c1,ka as W4,la as Y4,ma as S6,mb as i6,na as f6,oa as M4,pa as b6,pb as V8,qa as A3,qb as A4,ra as x6,sa as y6,sb as o6,ta as h6,ua as m6,va as L4,wa as v6,xa as p6}from"./vm-hands-entry-lite-dxxnp4nx.js";import{Ab as n0,Bb as r0,Ib as P0,tb as i3,ub as q6,vb as E6}from"./vm-hands-entry-lite-rrk5g62b.js";import{Jb as t6,Mb as e6,Ob as $7,Pb as J7}from"./vm-hands-entry-lite-ya1a2eep.js";import{Ub as d6}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Vb as _6,Wb as R6,Xb as P6,Yb as z6,Zb as L0}from"./vm-hands-entry-lite-n07kxrd1.js";import{$b as o1,ac as t1,bc as S3,dc as k3,fc as f3,gc as b3,kc as x3}from"./vm-hands-entry-lite-0ergg2ky.js";import{Bc as r1,Ec as H7,Nc as D7}from"./vm-hands-entry-lite-makvjdxz.js";import{$c as d,$d as g8,Ad as w6,Cd as O6,Dd as j6,Ed as I6,Fd as A6,Gd as T6,Ld as D8,Md as M8,Nd as L8,Oc as L1,Od as w8,Pc as Q2,Pd as O8,Qc as e5,Qd as j8,Rc as I3,Sc as r3,Sd as I8,Tc as a3,Td as A8,Uc as M0,Ud as T8,Vd as _8,Wd as R8,Xd as P8,Yc as N0,Yd as z8,Zd as q8,_d as E8,ad as E1,dd as H8,fd as g1,hd as $6,id as J6,jd as Z6,kd as Q6,ld as K6,md as B6,nd as V6,od as G6,pd as U6,qd as X6,rd as W6,sd as Y6,td as F6,ud as N6,vd as C6,wd as H6,xd as D6,yd as M6,zd as L6}from"./vm-hands-entry-lite-8st97h7b.js";import{ae as V}from"./vm-hands-entry-lite-q6fshf3h.js";import{Ae as l1,be as W7,ce as Y7,de as F7,ee as N7,fe as C7,le as p5,pe as Q5,qe as T5,we as M7,ze as K5}from"./vm-hands-entry-lite-n29bgmjx.js";import{Ze as j4,ef as c6}from"./vm-hands-entry-lite-pf1ft65e.js";import{jf as M3,wf as g6}from"./vm-hands-entry-lite-q2pb31vh.js";import{Bg as Z7,Cg as Q7,Dg as K7,Eg as B7,Gg as V7,Hg as G7,Jg as U7,Kg as X7}from"./vm-hands-entry-lite-6j2yaa4n.js";import{Yg as n1}from"./vm-hands-entry-lite-7k65s010.js";import{$g as k6,_g as j1,ah as H4,bh as D4}from"./vm-hands-entry-lite-em388nee.js";import{dh as D3,fh as $1,lh as K8,mh as J4}from"./vm-hands-entry-lite-yp315y25.js";import{Kh as H}from"./vm-hands-entry-lite-xsq25kmd.js";import{Oh as a4}from"./vm-hands-entry-lite-hf0mk7vd.js";import{request as m7}from"http";import{request as v7}from"https";async function p7($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?v7:m7)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:k3},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Error("custom_endpoint_timeout"))),K.end($.body)})}function u7($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function d7($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let W=Buffer.allocUnsafe(G.length*Q.length+B),Y=0;for(let X of G){while(B&&Z[B]!==X){let F=K[B-1];Y+=Z.copy(W,Y,0,B-F),B=F}if(Z[B]===X){if(B++,B===Z.length)Y+=Q.copy(W,Y),B=0}else W[Y++]=X}if(U)Y+=Z.copy(W,Y,0,B),B=0;return W.subarray(0,Y)}}async function y3($){$.signal.throwIfAborted();let J=b3.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=x3.parse(await $.credential($.signal));if(!f3(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,W=0,Y=u7(Q.apiKey),X=d7(Q.apiKey,Y),F=async(N,D)=>{$.signal.throwIfAborted(),await new Promise((w,M)=>{let I=()=>{$.signal.removeEventListener("abort",I),M($.signal.reason)};if($.signal.addEventListener("abort",I,{once:!0}),$.signal.aborted){I();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(N,D)}).then(()=>{$.signal.removeEventListener("abort",I),w()},(O)=>{$.signal.removeEventListener("abort",I),M(O)})})},C=async(N)=>{if(G+=N.length,G>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let D=0;D<N.length;D+=o1){if(W>=S3)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await F(`custom_endpoint.chunk.${W++}`,{eof:!1,data:N.subarray(D,D+o1).toString("base64")})}};try{let N=await p7({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=N.response,B=N.close;let D=K.statusCode??500;if(D>=300&&D<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let w={};for(let M of["content-type","retry-after","x-request-id","request-id"]){let I=K.headers[M];if(typeof I==="string")w[M]=I.replaceAll(Q.apiKey,Y).slice(0,4096)}await F("custom_endpoint.headers",{status:D,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,Y).slice(0,256),headers:w});for await(let M of K){$.signal.throwIfAborted();let I=Buffer.isBuffer(M)?M:Buffer.from(M);if(U+=I.length,U>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(X(I))}return await C(X(Buffer.alloc(0),!0)),await F(`custom_endpoint.chunk.${W}`,{eof:!0}),{bytes:G,chunks:W}}catch(N){if($.signal.throwIfAborted(),N instanceof H)throw N;throw new H("custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as h3}from"path";function l7($,J){return $===h3(J,".ara","workspace")||$===h3(J,".reason","workspace")}function m3($,J){let Z=$.filter((Q)=>l7(Q.path,J));return Z.length===1?Z[0].path:null}var s7=/^[a-f0-9]{64}$/;var e1=32,c7=/^\/[^\x00-\x1f\x7f\\]*$/;function H1($){if(typeof $!=="string"||$.length>4096||!c7.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function D1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!H1(J.home)||!Array.isArray(J.roots)||J.roots.length>e1)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!s7.test(K)||!H1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}import{spawn as r7}from"child_process";import*as z from"fs";import*as s from"path";import{homedir as a7}from"os";function $2($,J,Z,Q="gh"){if(!["gh","git"].includes(Q))throw Error("local_device_gh_unavailable");let K=$.realpathSync(Z),B=Q==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+Q;for(let G of["/opt/homebrew/bin/"+Q,"/usr/local/bin/"+Q,B])try{let U=$.realpathSync(G);if(U===K||U.startsWith(K+J.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...Q==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((Y)=>U.startsWith(Y)))continue;let W=$.statSync(U);if(!W.isFile()||(W.mode&18)!==0||![0,process.getuid()].includes(W.uid))continue;return $.accessSync(U,$.constants.X_OK),U}catch{continue}throw Error("local_device_gh_unavailable")}function v3($,J){let Z=1;for(let Q=0;Q<J;Q+=1)if($.charCodeAt(Q)===10)Z+=1;return Z}var p3=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function J2($){let J=$.trim().replaceAll("\\","/");if(!J)return{valid:!1,reason:"empty_path"};if(J.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(J.split("/").includes("..")||J.includes("../")||J.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(J===".git"||J.startsWith(".git/")||J.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function u3($){return[...new Set($.map((J)=>J.trim()).filter((J)=>J.length>=8))]}function d3($,J){return[...J.matchAll(new RegExp($.regex.source,`${$.regex.flags}g`))]}function M1($,J=[],Z={}){let Q=[],K=Z.published??new Set,B=u3(J).filter((G)=>!K.has(G));for(let G of $){let U=J2(G.path);if(!U.valid){Q.push({path:G.path,reason:U.reason??"invalid_path"});continue}let W=G.content??"",Y=B.map((X)=>({secret:X,offset:W.indexOf(X)})).filter((X)=>X.offset>=0).sort((X,F)=>X.offset-F.offset);if(Y.length>0){let X=[...new Set(Y.flatMap((F)=>Z.secretNames?.(F.secret)??[]))];Q.push({path:G.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:v3(W,Y[0].offset),...X.length>0?{secretNames:X}:{}})}for(let X of p3){let F=d3(X,W).find((C)=>!K.has(C[0]));if(F){Q.push({path:G.path,reason:`credential_pattern_detected: ${X.name}`,pattern:X.name,ruleId:X.name,line:v3(W,F.index)});break}}}return{clean:Q.length===0,violations:Q,scannedObjectCount:$.length}}function l3($,J=[]){let Z=u3(J),Q=new Set;for(let{content:K}of $){for(let B of Z)if(K.includes(B))Q.add(B);for(let B of p3)for(let G of d3(B,K))Q.add(G[0])}return[...Q]}function n7($,J){let Z=0;for(let Q=$.indexOf(J);Q>=0;Q=$.indexOf(J,Q+J.length))Z+=1;return Z}function s3($,J,Z){let Q=(K,B)=>K.reduce((G,U)=>G+n7(U,B),0);return new Set($.filter((K)=>Q(J,K)<=Q(Z,K)))}var T0=4194304,c3=536870912,Z2=/^[a-f0-9]{40}$/,i7=($,J,Z)=>new Promise((Q)=>{if(Z.signal?.aborted){Q({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let K;try{K=r7($,J,{cwd:Z.cwd,env:Z.env,detached:!0,stdio:["pipe","pipe","pipe"]})}catch{Q({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let B=Buffer.alloc(0),G=Buffer.alloc(0),U,W=!1,Y=(N)=>{if(U??=Error(N),K.pid)try{process.kill(-K.pid,"SIGKILL")}catch{}},X=()=>Y("cancelled"),F=setTimeout(()=>Y("timeout"),Z.timeout);Z.signal?.addEventListener("abort",X,{once:!0});let C=(N)=>{if(W)return;W=!0,clearTimeout(F),Z.signal?.removeEventListener("abort",X),Q({status:N,stdout:B,stderr:G,...U?{error:U}:{}})};if(K.stdout.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else B=Buffer.concat([B,N])}),K.stderr.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else G=Buffer.concat([G,N])}),K.on("error",()=>{if(Y("spawn_failed"),!K.pid)C(null)}),K.on("close",(N)=>C(N)),K.stdin.on("error",()=>Y("input_failed")),K.stdin.end(Z.input),Z.signal?.aborted)X()}),o7={command:i7,gh:($,J)=>$2(z,s,$,J),home:a7};function A($){throw Error($)}var t7=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),e7=($)=>JSON.stringify($,(J,Z)=>t7.has(J)?void 0:Z);function n3($,J,Z){let Q=[...new Set($.map((B)=>`${J(B.path)}${B.line?`:${B.line}`:""} (${B.reason==="literal_secret_detected"?`value of ${B.secretNames?.length?B.secretNames.slice(0,3).join(", "):"a session variable"}`:`${B.ruleId??"credential"} credential`})`))].slice(0,10),K=$.some((B)=>B.reason==="literal_secret_detected");A(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${Q.join("; ")}. Nothing was sent. ${Z}${K?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function o3($,J,Z=o7){let Q=L1.parse($);if(!["darwin","linux"].includes(process.platform))A("local_device_gh_platform_unavailable");J.assertCurrent();let K=z.realpathSync(J.root);if(K==="/")A("local_device_gh_root_unavailable");if(!M0(Q)&&!J.forbiddenSecretValues)A("local_device_gh_secret_scope_unavailable");if(!M0(Q)&&J.readOnly)A("local_device_gh_read_only");if(!M0(Q)){let L=M1([{path:"github-operation",content:e7(Q)}],J.forbiddenSecretValues,J.secretNames?{secretNames:J.secretNames}:{});if(!L.clean)n3(L.violations,()=>`the ${Q.kind} request text`,"Remove it from the pull request text and try again.")}let B=Z.gh(K),G=Z.home(),U=$2(z,s,K,"git"),W=J.privateDirectory?z.realpathSync(J.privateDirectory):z.realpathSync(G);if(!M0(Q)&&(!J.privateDirectory||W===K||W.startsWith(K+s.sep)))A("local_device_gh_private_scope_unavailable");let Y={PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:G,GH_CONFIG_DIR:s.join(G,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((L)=>process.env[L]?[[L,process.env[L]]]:[])):{}},X=async(L,T,P=W,k,x=T0)=>{J.assertCurrent();let y=await Z.command(L,T,{cwd:P,env:Y,input:k,maxBuffer:x,timeout:Math.max(1,Math.min(60000,(J.deadlineMs??Date.now()+60000)-Date.now())),signal:J.signal});if(J.assertCurrent(),y.error||y.status!==0)A("local_device_gh_command_failed");return y.stdout},F=async(L)=>(await X(B,L)).toString("utf8").trim(),C=async(L,T="application/vnd.github+json")=>{r3(Q.repoFullName,L,{headers:{accept:T}}),J.assertCurrent();let P=await Z.command(B,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${T}`,L],{cwd:W,env:Y,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal});if(J.assertCurrent(),P.error&&P.status===null)A("local_device_gh_response_unavailable");let k=P.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!k)A("local_device_gh_response_invalid");let x=Number(k[1]);if(x>=200&&x<300&&P.status!==0)A("local_device_gh_response_unavailable");if(Buffer.byteLength(k[3])>Q2)A("local_device_gh_response_too_large");let y={};for(let r of k[2].split(/\r?\n/)){let a=r.indexOf(":"),D0=r.slice(0,a).toLowerCase();if(["link","content-type"].includes(D0))y[D0]=r.slice(a+1).trim().slice(0,8192)}return{kind:"read",status:x,headers:y,body:x>=200&&x<300?k[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(Q.kind==="read")return C(Q.path,Q.accept);if(Q.kind==="pr_review_context"){let[L,T]=Q.repoFullName.split("/"),P=await F(["api","graphql","--hostname","github.com","-f",`query=${a3}`,"-f",`owner=${L}`,"-f",`repo=${T}`,"-F",`number=${Q.number}`,...Q.after?["-f",`after=${Q.after}`]:[]]);if(Buffer.byteLength(P)>Q2)A("local_device_gh_response_too_large");let k=JSON.parse(P);if(k.errors||k.data?.repository?.nameWithOwner?.toLowerCase()!==Q.repoFullName.toLowerCase()||k.data.repository.pullRequest?.number!==Q.number)A("local_device_gh_response_invalid");return{kind:"pr_review_context",body:P}}if(Q.kind==="pr_merge"){let L=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),T=JSON.parse(L.body),P=(y)=>y.number===Q.number&&y.html_url===`https://github.com/${Q.repoFullName}/pull/${Q.number}`&&y.base?.repo?.full_name?.toLowerCase()===Q.repoFullName.toLowerCase()&&y.base?.ref===Q.expectedBaseRef&&y.head?.sha===Q.expectedHeadSha;if(L.status!==200||!P(T)||T.state!=="open"||T.draft!==!1||T.head?.sha!==Q.expectedHeadSha||T.base?.repo?.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase())A("local_device_gh_merge_target_changed");await F(["pr","merge",String(Q.number),`--repo=${Q.repoFullName}`,`--${Q.method}`,"--match-head-commit",Q.expectedHeadSha]);let k=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),x=JSON.parse(k.body);if(k.status!==200||!P(x)||x.merged!==!0)A("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:Q.number,merged:!0}}if(Q.kind==="pr_create"){if(Q.head===Q.base)A("local_device_gh_default_branch");let L=await F(["pr","create","--repo",Q.repoFullName,"--head",Q.head,"--base",Q.base,`--title=${Q.title}`,`--body=${Q.body}`,...Q.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+Q.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(L))A("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:L}}if(Q.kind==="pr_mutation"){let L=Q.mutation,T=L.action==="edit"?["edit",...L.title!==void 0?[`--title=${L.title}`]:[],...L.body!==void 0?[`--body=${L.body}`]:[],...L.base?[`--base=${L.base}`]:[]]:L.action==="metadata"?["edit",`--${L.change}-${L.field}=${L.value}`]:L.action==="ready"?["ready"]:L.action==="draft"?["ready","--undo"]:["close"];return await F(["pr",...T,String(Q.number),"--repo",Q.repoFullName]),{kind:"pr_mutation",number:Q.number,applied:!0}}if(!J.repoPath)A("local_device_gh_workspace_unavailable");let N=z.realpathSync(J.repoPath);if(N!==K&&!N.startsWith(K+s.sep))A("local_device_gh_workspace_unavailable");let D=`https://github.com/${Q.repoFullName}.git`,w="!'"+B.replace(/'/g,"'\\''")+"' auth git-credential",M=Function("return ("+i3+")")(),I=(L,T,P)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",L,T,...P]]:[T,P],O=async(L,T,P,k=T0)=>{let x=L===W||L.startsWith(W+s.sep),y=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...x?["-c",`credential.https://github.com.helper=${w}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",...T];if(x)return X(U,y,L,P,k);let r=s.join(N,".ara-local-gh-tmp");if(z.mkdirSync(r,{recursive:!0,mode:448}),z.lstatSync(r).isSymbolicLink()||z.realpathSync(r)!==r)A("local_device_gh_workspace_unavailable");J.assertCurrent();let a=await Z.command(...I(M(N,r),U,y),{cwd:L,input:P,maxBuffer:k,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:N,TMPDIR:r,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),a.error||a.status!==0)A("local_device_gh_collection_failed");return a.stdout},R=async(L,T)=>(await O(L,T)).toString("utf8").trim(),E=async(L,T)=>{let P=s.join(L,".ara-local-gh-tmp");if(z.mkdirSync(P,{recursive:!0,mode:448}),z.lstatSync(P).isSymbolicLink()||z.realpathSync(P)!==P)A("local_device_gh_workspace_unavailable");J.assertCurrent();let k=await Z.command(...I(M(L,P),"/bin/sh",["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",T]),{cwd:L,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:L,TMPDIR:P}});if(J.assertCurrent(),k.error||k.status!==0)A("local_device_gh_materialization_failed")},v=async(L)=>{let T=new Map;if(L.length===0)return T;let P=await O(S,["cat-file","--batch"],[...new Set(L)].join(`
 `)+`
 `,T0*8);for(let k=0;k<P.length;){let x=P.indexOf(10,k),[y,r,a]=P.subarray(k,x).toString("utf8").split(" ");if(x<0||!y||r!=="blob"||!/^[0-9]+$/.test(a??""))A("local_device_gh_object_invalid");T.set(y,P.subarray(x+1,x+1+Number(a)).toString("utf8")),k=x+1+Number(a)+1}return T},j=async(L,T,P)=>{let k=s.join(N,".ara-local-gh-tmp"),x=M(N,k)+`
 (allow file-read* file-write* (subpath ${JSON.stringify(N)}))

package/bin/vm-hands/{vm-hands-entry-lite-t2xdqqqj.js → vm-hands-entry-lite-cw9qs82e.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Ch as $}from"./vm-hands-entry-lite-cgm3es3w.js";var O=$.version,Z=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function S(B,D){if(!Z.test(B)||!Z.test(D))throw Error("cannot compare invalid CLI versions");let J=(q)=>{let y=q.indexOf("-");return y===-1?[q,void 0]:[q.slice(0,y),q.slice(y+1)]},[j,F]=J(B),[w,G]=J(D),K=j.split(".").map(BigInt),M=w.split(".").map(BigInt);for(let q=0;q<3;q+=1){if(K[q]===M[q])continue;return K[q]<M[q]?-1:1}if(F===void 0||G===void 0){if(F===G)return 0;return F===void 0?1:-1}let Q=F.split("."),U=G.split("."),A=Math.max(Q.length,U.length);for(let q=0;q<A;q+=1){let y=Q[q],z=U[q];if(y===void 0||z===void 0){if(y===z)return 0;return y===void 0?-1:1}if(y===z)continue;let H=/^\d+$/.test(y),W=/^\d+$/.test(z);if(H&&W){let X=BigInt(y),Y=BigInt(z);if(X===Y)continue;return X<Y?-1:1}if(H!==W)return H?-1:1;return y<z?-1:1}return 0}function k(B,D){return D?`cli ${B} \xB7 agent ${D}`:`cli ${B}`}
+import{Ch as $}from"./vm-hands-entry-lite-kg5gmpvq.js";var O=$.version,Z=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function S(B,D){if(!Z.test(B)||!Z.test(D))throw Error("cannot compare invalid CLI versions");let J=(q)=>{let y=q.indexOf("-");return y===-1?[q,void 0]:[q.slice(0,y),q.slice(y+1)]},[j,F]=J(B),[w,G]=J(D),K=j.split(".").map(BigInt),M=w.split(".").map(BigInt);for(let q=0;q<3;q+=1){if(K[q]===M[q])continue;return K[q]<M[q]?-1:1}if(F===void 0||G===void 0){if(F===G)return 0;return F===void 0?1:-1}let Q=F.split("."),U=G.split("."),A=Math.max(Q.length,U.length);for(let q=0;q<A;q+=1){let y=Q[q],z=U[q];if(y===void 0||z===void 0){if(y===z)return 0;return y===void 0?-1:1}if(y===z)continue;let H=/^\d+$/.test(y),W=/^\d+$/.test(z);if(H&&W){let X=BigInt(y),Y=BigInt(z);if(X===Y)continue;return X<Y?-1:1}if(H!==W)return H?-1:1;return y<z?-1:1}return 0}function k(B,D){return D?`cli ${B} \xB7 agent ${D}`:`cli ${B}`}
 export{O as yh,Z as zh,S as Ah,k as Bh};

package/bin/vm-hands/{vm-hands-entry-lite-815h1kvr.js → vm-hands-entry-lite-dxxnp4nx.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ab as L9,Bb as n0,Ib as K0,wb as LQ,xb as Y8,yb as s9,zb as _0}from"./vm-hands-entry-lite-rrk5g62b.js";import{Qb as EQ,Rb as SQ,Sb as X4,Tb as J4,Ub as V8}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b0}from"./vm-hands-entry-lite-n07kxrd1.js";import{Bd as q0,Oc as t$,Rc as e$,ud as w9,vd as o0,wd as W8,xd as g0}from"./vm-hands-entry-lite-8st97h7b.js";import{ae as x}from"./vm-hands-entry-lite-q6fshf3h.js";import{Ke as mQ,Le as y8,Ze as fQ,df as i9,ef as f8}from"./vm-hands-entry-lite-pf1ft65e.js";import{Af as R8,Df as p9,Mf as I8,Nf as S0,Of as O0,Pf as u9,Wf as w8,Xf as XQ,Yf as i$,gf as jZ,jf as B9,sf as $Q,tf as QQ,vf as ZQ,xf as d9,yf as s$,zf as n$}from"./vm-hands-entry-lite-q2pb31vh.js";import{Yg as Q4}from"./vm-hands-entry-lite-7k65s010.js";import{$g as l9,_g as N8,ch as $4}from"./vm-hands-entry-lite-em388nee.js";import{dh as B8,eh as i0,fh as L8,gh as a0,hh as H9,ih as J8,jh as e8,kh as s0,lh as p0,mh as l$,xh as W$}from"./vm-hands-entry-lite-yp315y25.js";import{Ch as KZ}from"./vm-hands-entry-lite-cgm3es3w.js";import{Ih as Z4}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as q}from"./vm-hands-entry-lite-xsq25kmd.js";import{Lh as P1,Oh as YZ}from"./vm-hands-entry-lite-hf0mk7vd.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000,window:8};function h9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function P0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function E$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function S$($,Q){let Z=Buffer.from($,"latin1");return Buffer.concat([Buffer.from([Z.length]),Z,Q])}function I0($){if(!h9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(E$)||!P0($.attachmentRevision,0)||!P0($.grantRevision,1)||!P0($.generation,1)||!P0($.port,1024,65535)||!P0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function c0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function C9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function R$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function q9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function w$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function b$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!h9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello")return{type:"hello",binding:I0(Q.binding),...P0(Q.messages,v.chunk,v.upload)?{messages:Q.messages}:{},...P0(Q.window,1,v.window)?{window:Q.window}:{},...Q.bytes===!0?{bytes:!0}:{}};if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:I0(Q.binding),reason:Q.reason};if(!E$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return q9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&P0(Q.status,200,599)&&R$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&R$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return q9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:C9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function D8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((Y)=>Y.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function _8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function T9($){return await _8($)===!0}function v9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function k$($){if(!h9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:I0($.binding),deviceRelayUrl:v9($.deviceRelayUrl,"device")}}function f$($){if(!h9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:I0($.binding)}}import{request as C4}from"http";import{pipeline as T4}from"stream";import{constants as A8,createBrotliCompress as O4,createGzip as D4}from"zlib";import{WebSocket as O9}from"ws";import{randomBytes as M4,timingSafeEqual as j4}from"crypto";import{createServer as q4}from"net";var g$="x-preview-connection";async function m$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=M4(32).toString("base64url"),X=new Set,J=!1,Y=q4((G)=>{if(J||Q.aborted||X.size>=v.streams*2)return G.destroy();X.add(G);let F=new AbortController;G.once("close",()=>{X.delete(G),F.abort()}),G.on("error",()=>G.destroy()),G.setTimeout(2000,()=>G.destroy());let B=Buffer.alloc(0),H=(L)=>{B=Buffer.concat([B,L]);let W=B.indexOf(`\r
+import{Ab as L9,Bb as n0,Ib as K0,wb as LQ,xb as Y8,yb as s9,zb as _0}from"./vm-hands-entry-lite-rrk5g62b.js";import{Qb as EQ,Rb as SQ,Sb as X4,Tb as J4,Ub as V8}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b0}from"./vm-hands-entry-lite-n07kxrd1.js";import{Bd as q0,Oc as t$,Rc as e$,ud as w9,vd as o0,wd as W8,xd as g0}from"./vm-hands-entry-lite-8st97h7b.js";import{ae as x}from"./vm-hands-entry-lite-q6fshf3h.js";import{Ke as mQ,Le as y8,Ze as fQ,df as i9,ef as f8}from"./vm-hands-entry-lite-pf1ft65e.js";import{Af as R8,Df as p9,Mf as I8,Nf as S0,Of as O0,Pf as u9,Wf as w8,Xf as XQ,Yf as i$,gf as jZ,jf as B9,sf as $Q,tf as QQ,vf as ZQ,xf as d9,yf as s$,zf as n$}from"./vm-hands-entry-lite-q2pb31vh.js";import{Yg as Q4}from"./vm-hands-entry-lite-7k65s010.js";import{$g as l9,_g as N8,ch as $4}from"./vm-hands-entry-lite-em388nee.js";import{dh as B8,eh as i0,fh as L8,gh as a0,hh as H9,ih as J8,jh as e8,kh as s0,lh as p0,mh as l$,xh as W$}from"./vm-hands-entry-lite-yp315y25.js";import{Ch as KZ}from"./vm-hands-entry-lite-kg5gmpvq.js";import{Ih as Z4}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as q}from"./vm-hands-entry-lite-xsq25kmd.js";import{Lh as P1,Oh as YZ}from"./vm-hands-entry-lite-hf0mk7vd.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000,window:8};function h9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function P0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function E$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function S$($,Q){let Z=Buffer.from($,"latin1");return Buffer.concat([Buffer.from([Z.length]),Z,Q])}function I0($){if(!h9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(E$)||!P0($.attachmentRevision,0)||!P0($.grantRevision,1)||!P0($.generation,1)||!P0($.port,1024,65535)||!P0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function c0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function C9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function R$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function q9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function w$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function b$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!h9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello")return{type:"hello",binding:I0(Q.binding),...P0(Q.messages,v.chunk,v.upload)?{messages:Q.messages}:{},...P0(Q.window,1,v.window)?{window:Q.window}:{},...Q.bytes===!0?{bytes:!0}:{}};if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:I0(Q.binding),reason:Q.reason};if(!E$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return q9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&P0(Q.status,200,599)&&R$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&R$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return q9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:C9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function D8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((Y)=>Y.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function _8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function T9($){return await _8($)===!0}function v9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function k$($){if(!h9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:I0($.binding),deviceRelayUrl:v9($.deviceRelayUrl,"device")}}function f$($){if(!h9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:I0($.binding)}}import{request as C4}from"http";import{pipeline as T4}from"stream";import{constants as A8,createBrotliCompress as O4,createGzip as D4}from"zlib";import{WebSocket as O9}from"ws";import{randomBytes as M4,timingSafeEqual as j4}from"crypto";import{createServer as q4}from"net";var g$="x-preview-connection";async function m$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=M4(32).toString("base64url"),X=new Set,J=!1,Y=q4((G)=>{if(J||Q.aborted||X.size>=v.streams*2)return G.destroy();X.add(G);let F=new AbortController;G.once("close",()=>{X.delete(G),F.abort()}),G.on("error",()=>G.destroy()),G.setTimeout(2000,()=>G.destroy());let B=Buffer.alloc(0),H=(L)=>{B=Buffer.concat([B,L]);let W=B.indexOf(`\r
 \r
 `);if(W<0){if(B.length>16384)G.destroy();return}if(G.pause(),G.off("data",H),W>16384||B.length>v.upload+16384)return G.destroy();z(B,W).catch(()=>G.destroy())};G.on("data",H);async function z(L,W){let U=L.subarray(0,W).toString("latin1").split(`\r
 `),j=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(U.shift()??"");if(!j)throw Error("preview_request_invalid");C9(j[2]);let O=!1,C=0,A=[];for(let T of U){let S=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(T);if(!S)throw Error("preview_header_invalid");if(S[1].toLowerCase()===g$){C++;let g=Buffer.from(S[2].trim());O=g.length===Z.length&&j4(g,Buffer.from(Z))}else if(S[1].toLowerCase()!=="host")A.push(T)}if(!O||C!==1||J||F.signal.aborted)throw Error("preview_connection_denied");let R=await $.connect(F.signal);if(J||F.signal.aborted)throw R.destroy(),Error("preview_closed");X.add(R),R.on("error",()=>G.destroy()),R.once("close",()=>{X.delete(R),G.destroy()}),G.once("close",()=>R.destroy()),G.setTimeout(0);let P=[`${j[1]} ${j[2]} HTTP/1.1`,`Host: 127.0.0.1:${R.remotePort}`,...A,"",""].join(`\r

package/bin/vm-hands/{vm-hands-entry-lite-mmhbhj1y.js → vm-hands-entry-lite-gj0vxxcb.js}

@@ -1,5 +1,5 @@
 // @bun
-import{t as d0}from"./vm-hands-entry-lite-bswnp5ve.js";import{A as Y5,B as G5,C as A7,D as R7,E as v3,F as a5,G as V5,H as _0,I as l$,J as p$,K as S0,L as J2,M as i5,N as n0,O as q6,P as Z3,Q as J6,U as Z6,ba as I7,ca as x7,da as E7,ea as S7,fa as u3,y as d6,z as l6}from"./vm-hands-entry-lite-z93r72nn.js";import{Aa as B5,Ba as K5,Ca as W7,Da as L7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as F5,Ka as j7,La as W$,Oa as V4,Pa as H4,Qa as RJ,Ra as CJ,Sa as PJ,Ta as y0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as z7,db as N6,fb as h8,ha as n7,ib as u2,ka as j5,kb as s5,la as z5,lb as T3,nb as f5,oa as _5,qa as x5,rb as O7,sb as N3,ta as E5,ya as k5,za as y5}from"./vm-hands-entry-lite-815h1kvr.js";import{Ab as S5,Bb as w5,Ib as b5}from"./vm-hands-entry-lite-rrk5g62b.js";import{Nb as H5}from"./vm-hands-entry-lite-ya1a2eep.js";import{Ub as c5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Ac as G4,Ec as r5,Hc as C7,Kc as p6,Lc as c6,mc as i1,nc as G1,oc as F1,pc as L$,qc as VJ,rc as xJ,sc as EJ,tc as D$,uc as SJ,vc as e3,wc as wJ,xc as Y4,yc as W1,zc as E8}from"./vm-hands-entry-lite-sqdh029v.js";import{Bd as X5,Hd as $$,Rd as F2,Vc as b2,Zc as _7,_c as F7}from"./vm-hands-entry-lite-8st97h7b.js";import{ae as G}from"./vm-hands-entry-lite-q6fshf3h.js";import{ie as IJ,je as o2,me as P7,pe as n$,re as rJ,se as tJ,xe as $6}from"./vm-hands-entry-lite-32mphjwz.js";import{$e as h1,Be as k0,Ce as k$,Ee as x0,Fe as j4,He as e0,Ie as z0,Je as y9,Ke as OJ,Le as AJ,Me as E2,Ne as q2,Oe as f3,Pe as I8,Qe as x8,Re as Y$,Se as v$,Te as Y0,Ue as T2,Ve as k7,We as y7,Xe as e1,Ye as R4,_e as Q3,af as v0,bf as y$,cf as X3,ff as m1}from"./vm-hands-entry-lite-pf1ft65e.js";import{jf as I5}from"./vm-hands-entry-lite-q2pb31vh.js";import{ig as WJ,lg as n5,mg as h3,og as N5}from"./vm-hands-entry-lite-y6cp754a.js";import{Xg as Z2,Yg as p5}from"./vm-hands-entry-lite-7k65s010.js";import{_g as V0,ah as K7}from"./vm-hands-entry-lite-em388nee.js";import{yh as r}from"./vm-hands-entry-lite-t2xdqqqj.js";import{Fh as D7}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as g0}from"./vm-hands-entry-lite-xsq25kmd.js";import{spawn as bJ,spawnSync as eK}from"child_process";import{closeSync as kJ,mkdirSync as $V,openSync as yJ,readdirSync as JV,realpathSync as B1,rmSync as z$}from"fs";import{hostname as ZV}from"os";import{dirname as $9,join as F0,resolve as QV}from"path";var eJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function U9($){let J=typeof $==="string"?eJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as BZ,randomBytes as z9}from"crypto";import{createInterface as KZ}from"readline";import{randomBytes as $Z}from"crypto";import{chmodSync as M9,existsSync as T9,lstatSync as JZ,mkdirSync as ZZ,readFileSync as _9,renameSync as QZ,unlinkSync as F9,writeFileSync as W9}from"fs";import{homedir as XZ}from"os";import{dirname as YZ,join as q9}from"path";function $1($=process.env,J=XZ()){let Z=$.XDG_CONFIG_HOME?.trim()||q9(J,".config"),X=x0({env:$})==="staging"?["staging"]:[];return q9(q2(Z,...X),"credentials.json")}function L9($,J=$1()){return ZZ(YZ(J),{recursive:!0,mode:448}),W9(J,`${JSON.stringify($,null,2)}
+import{t as d0}from"./vm-hands-entry-lite-bswnp5ve.js";import{A as Y5,B as G5,C as A7,D as R7,E as v3,F as a5,G as V5,H as _0,I as l$,J as p$,K as S0,L as J2,M as i5,N as n0,O as q6,P as Z3,Q as J6,U as Z6,ba as I7,ca as x7,da as E7,ea as S7,fa as u3,y as d6,z as l6}from"./vm-hands-entry-lite-32tgpj26.js";import{Aa as B5,Ba as K5,Ca as W7,Da as L7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as F5,Ka as j7,La as W$,Oa as V4,Pa as H4,Qa as RJ,Ra as CJ,Sa as PJ,Ta as y0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as z7,db as N6,fb as h8,ha as n7,ib as u2,ka as j5,kb as s5,la as z5,lb as T3,nb as f5,oa as _5,qa as x5,rb as O7,sb as N3,ta as E5,ya as k5,za as y5}from"./vm-hands-entry-lite-dxxnp4nx.js";import{Ab as S5,Bb as w5,Ib as b5}from"./vm-hands-entry-lite-rrk5g62b.js";import{Nb as H5}from"./vm-hands-entry-lite-ya1a2eep.js";import{Ub as c5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Ac as G4,Ec as r5,Hc as C7,Kc as p6,Lc as c6,mc as i1,nc as G1,oc as F1,pc as L$,qc as VJ,rc as xJ,sc as EJ,tc as D$,uc as SJ,vc as e3,wc as wJ,xc as Y4,yc as W1,zc as E8}from"./vm-hands-entry-lite-makvjdxz.js";import{Bd as X5,Hd as $$,Rd as F2,Vc as b2,Zc as _7,_c as F7}from"./vm-hands-entry-lite-8st97h7b.js";import{ae as G}from"./vm-hands-entry-lite-q6fshf3h.js";import{ie as IJ,je as o2,me as P7,pe as n$,re as rJ,se as tJ,xe as $6}from"./vm-hands-entry-lite-n29bgmjx.js";import{$e as h1,Be as k0,Ce as k$,Ee as x0,Fe as j4,He as e0,Ie as z0,Je as y9,Ke as OJ,Le as AJ,Me as E2,Ne as q2,Oe as f3,Pe as I8,Qe as x8,Re as Y$,Se as v$,Te as Y0,Ue as T2,Ve as k7,We as y7,Xe as e1,Ye as R4,_e as Q3,af as v0,bf as y$,cf as X3,ff as m1}from"./vm-hands-entry-lite-pf1ft65e.js";import{jf as I5}from"./vm-hands-entry-lite-q2pb31vh.js";import{ig as WJ,lg as n5,mg as h3,og as N5}from"./vm-hands-entry-lite-qhexy1ws.js";import{Xg as Z2,Yg as p5}from"./vm-hands-entry-lite-7k65s010.js";import{_g as V0,ah as K7}from"./vm-hands-entry-lite-em388nee.js";import{yh as r}from"./vm-hands-entry-lite-cw9qs82e.js";import{Fh as D7}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as g0}from"./vm-hands-entry-lite-xsq25kmd.js";import{spawn as bJ,spawnSync as eK}from"child_process";import{closeSync as kJ,mkdirSync as $V,openSync as yJ,readdirSync as JV,realpathSync as B1,rmSync as z$}from"fs";import{hostname as ZV}from"os";import{dirname as $9,join as F0,resolve as QV}from"path";var eJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function U9($){let J=typeof $==="string"?eJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as BZ,randomBytes as z9}from"crypto";import{createInterface as KZ}from"readline";import{randomBytes as $Z}from"crypto";import{chmodSync as M9,existsSync as T9,lstatSync as JZ,mkdirSync as ZZ,readFileSync as _9,renameSync as QZ,unlinkSync as F9,writeFileSync as W9}from"fs";import{homedir as XZ}from"os";import{dirname as YZ,join as q9}from"path";function $1($=process.env,J=XZ()){let Z=$.XDG_CONFIG_HOME?.trim()||q9(J,".config"),X=x0({env:$})==="staging"?["staging"]:[];return q9(q2(Z,...X),"credentials.json")}function L9($,J=$1()){return ZZ(YZ(J),{recursive:!0,mode:448}),W9(J,`${JSON.stringify($,null,2)}
 `,{mode:384}),M9(J,384),J}function I$($=$1()){if(!T9($))return null;try{let J=_9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=e0(Q);if(X!==Q)GZ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function GZ($,J,Z){let Q=`${$}.${process.pid}.${$Z(6).toString("hex")}.tmp`;try{let X=JZ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(W9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
 `,{mode:384,flag:"wx"}),M9(Q,384),_9($,"utf8")!==J)throw Error("credentials_changed");QZ(Q,$)}catch{try{F9(Q)}catch{}}}function D9($=$1()){if(!T9($))return!1;return F9($),!0}var j9=["run","mcp:read","mcp:write","secrets:read","secrets:write","sessions:read","sessions:debug","devices:read","devices:write","devices:use","ssh:write","knowledge:read","memory:read","memory:write","skills:read","skills:write","repos:read","repos:write","reviews:read","reviews:write","deployment:read","analytics:read","org:read","org:write","attachments:read","attachments:write","guardrails:read","guardrails:write","network:read","network:write","automations:read","automations:write","agent_auth:read"];var gV=j9.filter(($)=>$!=="network:read"&&$!=="network:write");class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function A9(){let $=z9(48).toString("base64url"),J=BZ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:z9(32).toString("base64url")}}function VZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function HZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw VZ(Y,`OAuth token request failed (${X.status})`);return Y}var NZ=1e4;async function UZ($,J={}){let Z=J.fetchImpl??fetch,Q=await HZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(NZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return L9(X,J.path??$1()),X}var M2=new Map;function O9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function k1($={}){let J=$.path??$1(),Z=I$(J);if(!Z)return null;let Q=$.apiOrigin??k0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),B=M2.get(Y);if(B)return O9(B,$.signal);let V;return V=UZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=I$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return k1({fetchImpl:$.fetchImpl,path:J});return D9(J),null}).finally(()=>{if(M2.get(Y)===V)M2.delete(Y)}),M2.set(Y,V),O9(V,$.signal)}function R9($,J){return new Promise((Z)=>{let Q=KZ({input:$}),X=!1,Y=(V)=>{if(X)return;X=!0,J.removeEventListener("abort",B),Q.close(),$.pause(),Z(V)},B=()=>Y(null);J.addEventListener("abort",B,{once:!0}),Q.once("line",(V)=>Y(V)),Q.once("close",()=>Y(null))})}var qZ=G.object({label:G.string(),used_percent:G.number().min(0).max(100).nullable(),resets_at:G.string().nullable(),exhausted:G.boolean().nullable()}),MZ=G.object({groups:G.array(G.object({selectable:G.boolean().optional(),accounts:G.array(G.object({source_id:G.string().min(1),model_ids:G.array(G.string().min(1)).optional()}))}))});function TZ($){let J=MZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var _Z=["minimal","low","medium","high","xhigh","max"],FZ=G.object({id:G.string().min(1),kind:G.string(),name:G.string(),custom_name:G.string().nullish(),status:G.string(),online:G.boolean(),compatible:G.boolean().optional(),compatibility_reason:G.string().nullish(),folder_lane_of:G.string().nullish(),roots:G.array(G.object({id:G.string().min(1),label:G.string()}))}),WZ=G.object({devices:G.array(FZ),end_cursor:G.string().nullish(),has_next_page:G.boolean().optional()}),LZ=G.object({id:G.string().min(1),name:G.string()}),DZ=G.object({items:G.array(LZ)}),jZ=G.object({id:G.string().min(1),name:G.string(),main:G.boolean(),mine:G.boolean(),session_id:G.string().nullish(),appearance:G.object({color:G.string().nullish()}).nullish().catch(null)}),zZ=G.object({items:G.array(jZ)}),OZ=G.object({skill_id:G.string().min(1),name:G.string(),description:G.string().nullish(),activation_keywords:G.array(G.string()).default([]),is_enabled:G.boolean().default(!0)}),AZ=G.object({items:G.array(OZ).default([])}),RZ=G.object({id:G.string().min(1),kind:G.string(),enabled:G.boolean(),schedule:G.object({expression:G.string().nullish(),every_seconds:G.number().nullish(),next_run_at:G.string().nullish()}).nullish(),github:G.object({event:G.string().nullish(),action:G.string().nullish(),repo:G.string().nullish()}).nullish(),last_fired_at:G.string().nullish()}),P9=G.object({id:G.string().min(1),name:G.string().nullish(),instructions:G.string().nullish(),enabled:G.boolean(),triggers:G.array(RZ).default([])}),CZ=G.object({items:G.array(P9).default([]),end_cursor:G.string().nullish(),has_next_page:G.boolean().optional()}),PZ=G.object({id:G.string().min(1),slug:G.string().nullish(),name:G.string(),description:G.string().nullish(),transport:G.string().nullish(),url:G.string().nullish(),enabled:G.boolean()}),IZ=G.object({items:G.array(PZ).default([])}),xZ=G.object({status:G.string(),summary:G.string().nullish(),category:G.string().nullish(),outcome:G.string().nullish(),message_count:G.number().nullish(),pr_url:G.string().nullish(),cost_usd:G.number().nullish(),generated_at:G.string().nullish()}),C9=G.object({tags:G.array(G.string()).default([])}),EZ=G.enum(["linux","macos"]),I9=G.object({id:G.string().min(1),name:G.string().min(1),platform:EZ.nullable(),workers:G.object({total:G.number().int(),online:G.number().int(),busy:G.number().int(),idle:G.number().int()}),sessions:G.object({queued:G.number().int(),running:G.number().int()})}),SZ=G.object({machines:G.array(I9)}),wZ=G.object({machine:I9}),bZ=G.object({deleted:G.literal(!0),revoked_workers:G.number().int(),revoked_tokens:G.number().int()}),kZ=G.object({token:G.object({id:G.string().min(1),machine_id:G.string().min(1),token_prefix:G.string()}),secret:G.string().startsWith("rmt_")}),x9=G.looseObject({machine_id:G.string().min(1),machine_name:G.string().min(1)}),yZ=x9.extend({organization_id:G.string().min(1)}),cV=G.object({id:G.string().min(1),name:G.string().min(1),state:G.enum(["waiting","placed"]),queue_position:G.number().int().nullable()});var sV=G.union([G.object({kind:G.literal("cloud")}),G.object({kind:G.enum(["mac","headless"]),device_id:G.string().min(1),root_id:G.string().min(1)})]);function P0($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var fZ=G.object({error:G.object({type:G.string(),message:G.string()})});function E9($,J,Z){let Q=fZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,B=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",V=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${B}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(V)&&V>=0?V*1000:void 0)}async function S9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw E9(J.status,Z,J.headers.get("retry-after"));return P0(yZ,Z,"invalid_machine_ticket")}class U1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.raw?{"content-type":J.raw.contentType}:J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.raw?J.raw.bytes:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let B=await k1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(B)return this.credentials=B,this.request($,J,!0)}if(!X.ok)throw E9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return P0(SZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return P0(wZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return P0(bZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return P0(kZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return P0(x9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=DZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listReasons(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons`);return P0(zZ,$,"invalid_reason_list").items}async openReasonConversation($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons/${encodeURIComponent($)}/conversation`,{method:"POST"});return P0(G.object({session_id:G.string().min(1)}),J,"invalid_reason_conversation").session_id}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return P0(AZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=WZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...B})=>({...B,...Array.isArray(Q)?{reasoning_efforts:_Z.filter((V)=>Q.includes(V))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return U9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=qZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=TZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($,J){let Z=J?.fields.length?`?fields=${encodeURIComponent(J.fields.join(","))}`:"";return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${Z}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.branch?{branch:$.branch}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},...$.longRunning?{long_running:{enabled:!0}}:{},...$.spendLimitRcu?{spend_limit_rcu:$.spendLimitRcu}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((B)=>X.components[B]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($,J){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments${J?`?view=${J}`:""}`)).items??[]}catch(Z){if(Z instanceof G0&&(Z.status===403||Z.status===404))return[];throw Z}}async requireSessionAttachments(){let $=await this.request("/deployment",{headers:{"cache-control":"no-cache"}});if($.session_attachments!==!0){let J=typeof $.reason_version==="string"&&/^\d+\.\d+(?:\.\d+)?$/.test($.reason_version)?`Agent ${$.reason_version}`:null,Z=typeof $.commit_sha==="string"&&/^[a-f0-9]{40,64}$/i.test($.commit_sha)?`server ${$.commit_sha.slice(0,12)}`:null,Q=[J,Z].filter(Boolean).join(", ");throw Error(`This server does not support Session image attachments: ${new URL(this.credentials.apiOrigin).host}${Q?` (${Q})`:""}. The API server needs an attachment-capable deployment; updating the Agent version alone is not enough. Your image was not sent; retry after the server update.`)}}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{},...Z.delivery?{delivery:Z.delivery}:{}}})}async steerQueuedMessage($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages/${encodeURIComponent(J)}/steer`,{method:"POST",body:{}})}async withdrawQueuedMessage($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages/${encodeURIComponent(J)}/queued`,{method:"DELETE"})}async getConversation($){let J=[],Z=null;for(let Q=0;Q<50;Q+=1){let X=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/conversation${Z?`?after=${encodeURIComponent(Z)}`:""}`);if(J.push(...X.items??[]),!X.has_next_page||!X.end_cursor)break;Z=X.end_cursor}return J}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}sessionAction($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/${J}`,{method:"POST",body:Z})}renameSession($,J){return this.sessionAction($,"rename",{title:J||null})}moveSessionToProject($,J){return this.sessionAction($,"project",{project_id:J})}compactSession($){return this.sessionAction($,"compact")}retrySession($){return this.sessionAction($,"retry")}rewindSession($,J){return this.sessionAction($,"rewind",{message_id:J.messageId,content:J.content,request_id:J.requestId})}forkSession($,J){return this.sessionAction($,"fork",{...J.message?{message:J.message}:{},client_session_id:J.clientSessionId})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}sessionPath($,J=""){return`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${J}`}async archiveSession($){await this.request(this.sessionPath($,"/archive"),{method:"POST",body:{}})}async unarchiveSession($){await this.request(this.sessionPath($,"/unarchive"),{method:"POST",body:{}})}async deleteSession($){await this.request(this.sessionPath($),{method:"DELETE"})}async listSessionTags($){return P0(C9,await this.request(this.sessionPath($,"/tags")),"invalid_session_tags").tags}async appendSessionTags($,J){let Z=await this.request(this.sessionPath($,"/tags"),{method:"POST",body:{tags:J}});return P0(C9,Z,"invalid_session_tags").tags}async sessionInsight($,J=!1){let Z=await this.request(this.sessionPath($,J?"/insights/generate":"/insights"),J?{method:"POST",body:{}}:{});return P0(xZ,Z,"invalid_session_insight")}async listAutomations(){let $=[],J=null;for(let Z=0;Z<20;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations?first=100${J?`&after=${encodeURIComponent(J)}`:""}`),X=P0(CZ,Q,"invalid_automation_list");if($.push(...X.items),J=X.has_next_page?X.end_cursor??null:null,!J)break}return $}async createScheduledAutomation($,J){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations`,Q=P0(P9,await this.request(Z,{method:"POST",body:{name:$.name,instructions:$.instructions,...$.repo?{repo:$.repo.full_name,provider:$.repo.provider}:{}}}),"invalid_automation");try{await this.request(`${Z}/${encodeURIComponent(Q.id)}/triggers`,{method:"POST",body:J})}catch(X){throw await this.deleteAutomation(Q.id).catch(()=>{return}),X}return Q}async setAutomationEnabled($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent($)}`,{method:"PATCH",body:{enabled:J}})}async deleteAutomation($){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent($)}`,{method:"DELETE"})}async transcribe($,J){let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/transcribe`,{method:"POST",raw:{bytes:$,contentType:J}});return P0(G.object({transcript:G.string()}),Z,"invalid_transcript").transcript}async listMcpServers(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/mcp-servers`);return P0(IZ,$,"invalid_mcp_server_list").items}async setSkillEnabled($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills/${encodeURIComponent($)}`,{method:"PUT",body:{is_enabled:J}})}}function y1($,J){let Z=k0($,"REASON_API_URL")?.trim();if(!Z)return j4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function hZ($){return k0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function z4($){return k0($,"REASON_API_KEY")?.trim()||void 0}async function w9($,J){let Z=$.env??process.env,Q=z4(Z);if(!Q)return($.getCredentials??k1)({apiOrigin:hZ(Z),signal:J});let X=y1(Z,$.channel??x0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),B=await Y.json().catch(()=>({})),V=n0(B)?B:{};if(!Y.ok){let N=typeof V.detail==="string"?V.detail:typeof V.message==="string"?V.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof V.error==="string"?V.error:"api_key_auth_failed",N)}if(typeof V.org_id!=="string"||!V.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(V.scopes)?V.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:V.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as mZ}from"crypto";import{unlinkSync as vZ}from"fs";import{platform as gZ}from"os";import{join as uZ}from"path";var b9=G.discriminatedUnion("store",[G.strictObject({version:G.literal(1),store:G.literal("keychain")}),G.strictObject({version:G.literal(1),store:G.literal("file"),api_key:G.string().min(1).max(4096)})]),f1=($)=>uZ($,"api-key.json");function O1($){let J=mZ("sha256").update(`reason-connect-api-key
 ${$}`).digest("hex");return new e1(T2(),gZ(),J)}function O4($,J,Z=O1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof Y0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=O1($)){if(!u(f1($)))return null;let Z=b9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof Y0))throw Q;throw Error("worker_api_key_unreadable")}}function k9($,J=O1($)){if(!u(f1($)))return;if(b9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof Y0))throw Z}vZ(f1($))}async function A4($,J){let Z;try{Z=await w9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:y0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as GQ,renameSync as BQ,rmSync as v1}from"fs";import{join as M0}from"path";import{createHash as dZ}from"crypto";import{realpathSync as lZ,statSync as pZ,unlinkSync as _2}from"fs";import{platform as cZ}from"os";import{join as f0}from"path";function d($){return{state:f0(g($),"device.json"),control:f0(g($),"control.json"),lock:f0(g($),"lifecycle.lock"),socket:f0(g($),"control.sock"),daemon:f0(g($),"daemon.json"),releaseCheck:f0(g($),"release-check.json"),updateDeferral:f0(g($),"update-deferral.json"),firstHeartbeat:f0(g($),"first-heartbeat.json")}}var sZ=G.object({version:G.literal(1),device_id:G.string().min(1).max(160),offer:G.unknown().optional(),enrollment_ms:G.number().int().nonnegative().max($$).optional()});function f9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function C4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=sZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=f0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?P4($):new R4(g($))}function W2($,J){T0($,!0),nZ($);let Z=J??P4($),Q=new R4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof Y0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function P4($){return new e1(T2(),cZ(),aZ($))}function aZ($){let J=I4($);return dZ("sha256").update(`reason-worker

package/bin/vm-hands/{vm-hands-entry-lite-cgm3es3w.js → vm-hands-entry-lite-kg5gmpvq.js}

@@ -1,3 +1,3 @@
 // @bun
-var r={name:"github-native-engineer-device-worker-production",version:"0.2.310",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@anthropic-ai/sandbox-runtime":"^0.0.73","@earendil-works/pi-tui":"1.0.0","@modelcontextprotocol/sdk":"^1.29.0","@reason/runtime-distribution":"workspace:*","playwright-core":"1.60.0",zod:"^4.4.3"},overrides:{"@hono/node-server":"1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"1.20.0","basic-ftp":"6.2.1","@grpc/grpc-js":"1.14.5",browserslist:"4.28.8","engine.io":"6.6.7","fast-uri":"3.1.8",hono:"^4.13.7","ip-address":"10.7.1",nanoid:"3.3.18",dompurify:"3.4.13",postcss:"8.5.23",qs:"6.16.0","shell-quote":"1.11.0","socket.io-parser":"4.2.7",tmp:"0.2.7",toml:"4.2.0",undici:"8.10.2",ws:"^8.21.0","js-yaml":"4.3.2","@modelcontextprotocol/sdk":"1.31.0","proxy-addr":"2.0.8","source-map-js":"1.2.2"}};
+var r={name:"github-native-engineer-device-worker-production",version:"0.2.312",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@anthropic-ai/sandbox-runtime":"^0.0.73","@earendil-works/pi-tui":"1.0.0","@modelcontextprotocol/sdk":"^1.29.0","@reason/runtime-distribution":"workspace:*","playwright-core":"1.60.0",zod:"^4.4.3"},overrides:{"@hono/node-server":"1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"1.20.0","basic-ftp":"6.2.1","@grpc/grpc-js":"1.14.5",browserslist:"4.28.8","engine.io":"6.6.7","fast-uri":"3.1.8",hono:"^4.13.7","ip-address":"10.7.1",nanoid:"3.3.18",dompurify:"3.4.13",postcss:"8.5.23",qs:"6.16.0","shell-quote":"1.11.0","socket.io-parser":"4.2.7",tmp:"0.2.7",toml:"4.2.0",undici:"8.10.2",ws:"^8.21.0","js-yaml":"4.3.2","@modelcontextprotocol/sdk":"1.31.0","proxy-addr":"2.0.8","source-map-js":"1.2.2"}};
 export{r as Ch};

package/bin/vm-hands/{vm-hands-entry-lite-sqdh029v.js → vm-hands-entry-lite-makvjdxz.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Fd as xe}from"./vm-hands-entry-lite-8st97h7b.js";import{ge as W,he as se,je as ut,ke as Ne,ne as pt,oe as xt,pe as $,ye as z,ze as Je}from"./vm-hands-entry-lite-32mphjwz.js";import{Be as v,De as tt,Ee as D,Me as gt}from"./vm-hands-entry-lite-pf1ft65e.js";import{hg as zt,kg as St,ng as Z,pg as jt,qg as ie}from"./vm-hands-entry-lite-y6cp754a.js";import{Pg as Ae,Qg as ae}from"./vm-hands-entry-lite-6j2yaa4n.js";import{Yg as Se}from"./vm-hands-entry-lite-7k65s010.js";import{_g as q}from"./vm-hands-entry-lite-em388nee.js";import{Dh as pe,Jh as ye}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as _}from"./vm-hands-entry-lite-xsq25kmd.js";import{spawn as I}from"child_process";import{randomUUID as Oe}from"crypto";import{closeSync as Vr,copyFileSync as de,existsSync as mt,fstatSync as Er,mkdirSync as fe,openSync as vr,readdirSync as V,readFileSync as ge,readlinkSync as to,renameSync as eo,rmSync as ro,statSync as oo}from"fs";import{connect as so}from"net";import{userInfo as Te}from"os";import{basename as le,dirname as bt,join as b}from"path";var Nt=`import { spawn, execFileSync } from "node:child_process";
+import{Fd as xe}from"./vm-hands-entry-lite-8st97h7b.js";import{ge as W,he as se,je as ut,ke as Ne,ne as pt,oe as xt,pe as $,ye as z,ze as Je}from"./vm-hands-entry-lite-n29bgmjx.js";import{Be as v,De as tt,Ee as D,Me as gt}from"./vm-hands-entry-lite-pf1ft65e.js";import{hg as zt,kg as St,ng as Z,pg as jt,qg as ie}from"./vm-hands-entry-lite-qhexy1ws.js";import{Pg as Ae,Qg as ae}from"./vm-hands-entry-lite-6j2yaa4n.js";import{Yg as Se}from"./vm-hands-entry-lite-7k65s010.js";import{_g as q}from"./vm-hands-entry-lite-em388nee.js";import{Dh as pe,Jh as ye}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as _}from"./vm-hands-entry-lite-xsq25kmd.js";import{spawn as I}from"child_process";import{randomUUID as Oe}from"crypto";import{closeSync as Vr,copyFileSync as de,existsSync as mt,fstatSync as Er,mkdirSync as fe,openSync as vr,readdirSync as V,readFileSync as ge,readlinkSync as to,renameSync as eo,rmSync as ro,statSync as oo}from"fs";import{connect as so}from"net";import{userInfo as Te}from"os";import{basename as le,dirname as bt,join as b}from"path";var Nt=`import { spawn, execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
 import { tmpdir } from "node:os";

package/bin/vm-hands/{vm-hands-entry-lite-32mphjwz.js → vm-hands-entry-lite-n29bgmjx.js}

@@ -1,5 +1,5 @@
 // @bun
-import{ef as Z8}from"./vm-hands-entry-lite-pf1ft65e.js";import{nf as R0}from"./vm-hands-entry-lite-q2pb31vh.js";import{jg as Kq}from"./vm-hands-entry-lite-y6cp754a.js";import{Fg as p,Ig as V0,Lg as F0,Mg as C8,Ng as eq,Pg as g8,Sg as q0,Ug as x0}from"./vm-hands-entry-lite-6j2yaa4n.js";import{Zg as wq}from"./vm-hands-entry-lite-7k65s010.js";import{$g as C0,_g as o}from"./vm-hands-entry-lite-em388nee.js";import{mh as B0}from"./vm-hands-entry-lite-yp315y25.js";import{Dh as A0}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as Z}from"./vm-hands-entry-lite-xsq25kmd.js";import{execFile as V1,spawn as w0}from"child_process";import{randomBytes as F1}from"crypto";import{chmodSync as w1,existsSync as K0,lstatSync as K1,mkdirSync as M1,readFileSync as z1,rmSync as Y1,writeFileSync as Xq}from"fs";import{connect as _1}from"net";import{join as H}from"path";var Bq="./desktop-wallpaper-0pjhgyfk.jpg";var Rq="./dock-browser-afp005mt.png";var Cq="./dock-files-rywdm96b.png";var yq="./dock-terminal-s41cj1jp.png";var Sq=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
+import{ef as Z8}from"./vm-hands-entry-lite-pf1ft65e.js";import{nf as R0}from"./vm-hands-entry-lite-q2pb31vh.js";import{jg as Kq}from"./vm-hands-entry-lite-qhexy1ws.js";import{Fg as p,Ig as V0,Lg as F0,Mg as C8,Ng as eq,Pg as g8,Sg as q0,Ug as x0}from"./vm-hands-entry-lite-6j2yaa4n.js";import{Zg as wq}from"./vm-hands-entry-lite-7k65s010.js";import{$g as C0,_g as o}from"./vm-hands-entry-lite-em388nee.js";import{mh as B0}from"./vm-hands-entry-lite-yp315y25.js";import{Dh as A0}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as Z}from"./vm-hands-entry-lite-xsq25kmd.js";import{execFile as V1,spawn as w0}from"child_process";import{randomBytes as F1}from"crypto";import{chmodSync as w1,existsSync as K0,lstatSync as K1,mkdirSync as M1,readFileSync as z1,rmSync as Y1,writeFileSync as Xq}from"fs";import{connect as _1}from"net";import{join as H}from"path";var Bq="./desktop-wallpaper-0pjhgyfk.jpg";var Rq="./dock-browser-afp005mt.png";var Cq="./dock-files-rywdm96b.png";var yq="./dock-terminal-s41cj1jp.png";var Sq=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
 # The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
 # python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
 # Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE

package/bin/vm-hands/{vm-hands-entry-lite-y6cp754a.js → vm-hands-entry-lite-qhexy1ws.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Pg as wz,Qg as Nz}from"./vm-hands-entry-lite-6j2yaa4n.js";import{_g as N}from"./vm-hands-entry-lite-em388nee.js";import{yh as A}from"./vm-hands-entry-lite-t2xdqqqj.js";import{Oh as Fz}from"./vm-hands-entry-lite-hf0mk7vd.js";import{spawnSync as iz}from"child_process";import{dirname as g}from"path";import{spawn as cz}from"child_process";import{accessSync as lz,constants as sz}from"fs";import{basename as nz,join as pz}from"path";import{randomUUID as p}from"crypto";import{spawnSync as M}from"child_process";import{chmodSync as Hz,cpSync as Rz,existsSync as U,lstatSync as O,mkdirSync as i,readdirSync as Cz,readFileSync as E,readlinkSync as Lz,realpathSync as T,renameSync as R,rmdirSync as Mz,rmSync as P,symlinkSync as c,writeFileSync as Oz}from"fs";import{dirname as C,join as D,relative as Uz,resolve as Tz}from"path";var a="so.ara.cli",_z="5LJFSBRY2F";var o="ReasonBackgroundIdentity",r="Contents/Helpers/ReasonPermissionTile";var x="AraBackgroundIdentity",Az="Reason",Iz=`anchor apple generic and identifier "${a}" and certificate leaf[subject.OU] = "${_z}"`;class L extends Error{code;constructor(z,J){super(J);this.code=z;this.name="MacOSBackgroundIdentityError"}}var k="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function v(z=N()){return D(z,"Library","Application Support","Reason","Background","Reason.app")}function _(z=N()){return D(z,"Library","Application Support","Ara","Background","Ara.app")}function kz(z){try{return O(z).isFile()}catch{return!1}}function y(z){return[o,x].map((J)=>D(z,"Contents","MacOS",J)).find(kz)??null}function w(z){try{if(!O(z).isDirectory())return!1;let J=E(D(z,"Contents","Info.plist"),"utf8");return J.includes(`<string>${a}</string>`)&&(J.includes(`<string>${Az}</string>`)||J.includes("<string>Ara</string>"))&&y(z)!==null}catch{return!1}}function I(z=N()){let J=v(z);if(!w(J))return null;try{let Z=E(D(J,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(Z)?.[1]??null}catch{return null}}function Sz(z,J=N()){let Z=I(J);return Z===null||$z(S(Z.split(".")),S(z.split(/[.-]/).slice(0,3)))}var fz=1e4;function t(z,J){return M(z,[...J],{stdio:"ignore",timeout:fz}).status??1}var e=new Set;function zz(z){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let J=(Z)=>{try{return T(Z)}catch{return Tz(Z)}};if(z!==void 0&&J(z)!==J(N()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var Jz=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.ara(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,Zz=new Set(["ara","ara.exe","reason","reason.exe"]);function S(z){return z.map((J)=>Number(J))}function $z(z,J){for(let Z=0;Z<3;Z+=1)if(z[Z]!==J[Z])return z[Z]<J[Z];return!1}var Ez=[0,2,161];function xz(z){if(z===null)return!0;let J=Ez,Z=null;try{Z=T(process.execPath)}catch{}return z.some(($)=>{let j=Jz.exec($);if(j){let Q=j[1]===void 0?j.slice(4,7):j.slice(1,4);return $z(S(Q),J)}let q=$.slice($.lastIndexOf("/")+1);return Zz.has(q)&&$!==Z&&$!==process.execPath})}function yz(){let z=M("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(z.status!==0)return null;let J=[];for(let Z of z.stdout.split(`
+import{Pg as wz,Qg as Nz}from"./vm-hands-entry-lite-6j2yaa4n.js";import{_g as N}from"./vm-hands-entry-lite-em388nee.js";import{yh as A}from"./vm-hands-entry-lite-cw9qs82e.js";import{Oh as Fz}from"./vm-hands-entry-lite-hf0mk7vd.js";import{spawnSync as iz}from"child_process";import{dirname as g}from"path";import{spawn as cz}from"child_process";import{accessSync as lz,constants as sz}from"fs";import{basename as nz,join as pz}from"path";import{randomUUID as p}from"crypto";import{spawnSync as M}from"child_process";import{chmodSync as Hz,cpSync as Rz,existsSync as U,lstatSync as O,mkdirSync as i,readdirSync as Cz,readFileSync as E,readlinkSync as Lz,realpathSync as T,renameSync as R,rmdirSync as Mz,rmSync as P,symlinkSync as c,writeFileSync as Oz}from"fs";import{dirname as C,join as D,relative as Uz,resolve as Tz}from"path";var a="so.ara.cli",_z="5LJFSBRY2F";var o="ReasonBackgroundIdentity",r="Contents/Helpers/ReasonPermissionTile";var x="AraBackgroundIdentity",Az="Reason",Iz=`anchor apple generic and identifier "${a}" and certificate leaf[subject.OU] = "${_z}"`;class L extends Error{code;constructor(z,J){super(J);this.code=z;this.name="MacOSBackgroundIdentityError"}}var k="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function v(z=N()){return D(z,"Library","Application Support","Reason","Background","Reason.app")}function _(z=N()){return D(z,"Library","Application Support","Ara","Background","Ara.app")}function kz(z){try{return O(z).isFile()}catch{return!1}}function y(z){return[o,x].map((J)=>D(z,"Contents","MacOS",J)).find(kz)??null}function w(z){try{if(!O(z).isDirectory())return!1;let J=E(D(z,"Contents","Info.plist"),"utf8");return J.includes(`<string>${a}</string>`)&&(J.includes(`<string>${Az}</string>`)||J.includes("<string>Ara</string>"))&&y(z)!==null}catch{return!1}}function I(z=N()){let J=v(z);if(!w(J))return null;try{let Z=E(D(J,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(Z)?.[1]??null}catch{return null}}function Sz(z,J=N()){let Z=I(J);return Z===null||$z(S(Z.split(".")),S(z.split(/[.-]/).slice(0,3)))}var fz=1e4;function t(z,J){return M(z,[...J],{stdio:"ignore",timeout:fz}).status??1}var e=new Set;function zz(z){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let J=(Z)=>{try{return T(Z)}catch{return Tz(Z)}};if(z!==void 0&&J(z)!==J(N()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var Jz=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.ara(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,Zz=new Set(["ara","ara.exe","reason","reason.exe"]);function S(z){return z.map((J)=>Number(J))}function $z(z,J){for(let Z=0;Z<3;Z+=1)if(z[Z]!==J[Z])return z[Z]<J[Z];return!1}var Ez=[0,2,161];function xz(z){if(z===null)return!0;let J=Ez,Z=null;try{Z=T(process.execPath)}catch{}return z.some(($)=>{let j=Jz.exec($);if(j){let Q=j[1]===void 0?j.slice(4,7):j.slice(1,4);return $z(S(Q),J)}let q=$.slice($.lastIndexOf("/")+1);return Zz.has(q)&&$!==Z&&$!==process.execPath})}function yz(){let z=M("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(z.status!==0)return null;let J=[];for(let Z of z.stdout.split(`
 `)){let $=/^\s*(\d+)\s+(\S.*)$/.exec(Z);if(!$||Number($[1])===process.pid)continue;let j=$[2].trimEnd(),q=j.slice(j.lastIndexOf("/")+1);if(!Jz.test(j)&&Zz.has(q)){let V=M("/usr/sbin/lsof",["-a","-p",$[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
 `).find((X)=>X.startsWith("n/"));if(V)j=V.slice(1)}J.push(j)}return J}function bz(z){if(zz(z.home),!w(z.sourceApp))throw new L("identity_invalid","The packaged Reason background identity is missing or invalid.");let J=z.command??t,Z=v(z.home),$=C(Z);i($,{recursive:!0,mode:448}),Hz($,448);let j=T(z.sourceApp),q=null;try{q=T(Z)}catch{}if(j!==q){let Q=`${process.pid}.${p()}`,V=D($,`.Reason.app.${Q}.tmp`),X=D($,`.Reason.app.${Q}.old`),W=!1;try{if(Rz(j,V,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!w(V))throw new L("identity_invalid","The copied Reason background identity is invalid.");let Y=z.releaseSigned?["--test-requirement",`=${Iz}`]:[];if(J("/usr/bin/codesign",["--verify","--strict",...Y,V])!==0)throw new L("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let B=!1;for(let F=0;F<4;F+=1){let G=!1;try{R(Z,X),G=!0,W=!0}catch(K){if(K.code!=="ENOENT")throw K}if(F===0)z.beforePublish?.();try{R(V,Z),B=!0}catch(K){let m=K.code;if(!["EEXIST","ENOTEMPTY"].includes(m??""))throw K;if(G)P(X,{recursive:!0,force:!0}),W=!1;if(F===3)throw K;continue}if(G)P(X,{recursive:!0,force:!0}),W=!1;break}if(!B)throw Error("Could not publish Reason's background identity.")}catch(Y){if(W&&!U(Z)&&U(X))R(X,Z);throw Y}finally{P(V,{recursive:!0,force:!0}),P(X,{recursive:!0,force:!0})}}return Wz(Z,z,{verified:j!==q}),Z}function jz(z){return D(C(z),".Reason.app.registered")}function qz(z){try{let J=O(z);return J.isDirectory()?`${J.ino}:${J.birthtimeMs}`:null}catch{return null}}function f(z){let J=qz(z);try{return J!==null&&E(jz(z),"utf8")===J}catch{return!1}}function Qz(z){if(w(z))return"bundle";try{if(O(D(z,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return O(D(z,"Contents","MacOS",x)).isSymbolicLink()?"retired":null}catch{return null}}function Wz(z,J,Z={}){let $=J.command??t;if(!Z.verified&&$("/usr/bin/codesign",["--verify","--strict",z])!==0)throw new L("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if($(k,["-f",z])!==0)throw new L("identity_register_failed","Could not register Reason's macOS background identity.");let j=qz(z);try{if(j)Oz(jz(z),j,{mode:384})}catch{}try{gz(z,J.home,$,J.runningExecutables??yz)}catch(q){let Q=q.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${Q})
 `)}}function gz(z,J,Z,$){let j=y(z);if(!j)return;let q=_(J),Q=C(q),V=(K)=>D(K,"Contents","MacOS",x),X=Uz(C(V(q)),j),W=`${process.pid}.${p()}`,Y=Qz(q);if(Y===null)return;let B=Y==="bundle";if(B)Z(k,["-u",q]);let F=D(Q,`.Ara.app.${W}.old`);if(!e.has(q)&&!xz($())){if(!B)Z(k,["-u",q]);try{R(q,F)}catch(K){if(K.code==="ENOENT")return;throw K}P(F,{recursive:!0,force:!0}),uz(Q);return}if(!B){if(Lz(V(q))===X)return;let K=`${V(q)}.${W}`;c(X,K);try{R(K,V(q))}finally{P(K,{force:!0})}return}let G=D(Q,`.Ara.app.${W}.shim`);i(C(V(G)),{recursive:!0}),c(X,V(G));try{try{R(q,F)}catch(K){if(K.code==="ENOENT")return;throw K}try{R(G,q)}catch(K){if(U(q))return;throw R(F,q),K}}finally{P(G,{recursive:!0,force:!0}),P(F,{recursive:!0,force:!0})}}function uz(z){try{if(Cz(z).some((Z)=>Z!==".DS_Store"))return;P(D(z,".DS_Store"),{force:!0}),Mz(z)}catch{}}var l=new Map;function hz(z=N()){let J=l.get(z);if(J)return J;if(process.platform!=="darwin")return[];let Z=s(z);if(Z===null&&U(C(v(z))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),Z=s(z);if(Z===null)return[];return l.set(z,Z),Z}function s(z){let J=v(z),Z=_(z);if(!w(J)||!f(J))try{dz({home:z,skipWhenSettled:!0})}catch{}let $=w(J)&&(f(J)||!w(Z))?J:w(Z)?Z:null,j=$?y($):null;if(!j)return null;if($===Z)e.add(Z);let q=M(j,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return q.status===0&&q.stdout===`spawn
@@ -20,7 +20,7 @@ The macOS privacy permissions of this computer's Reason worker:
 allow asks for each missing one, or the one named. macOS cannot ask for Full
 Disk Access: allow disk opens its pane, shows the file to add in Finder and
 waits until the worker has it.
-`,u="x-apple.systempreferences:com.apple.preference.security",az="curl -fsSL https://reasonmachines.com/install.sh | bash",oz=180000,rz=2000,h=["screen","accessibility","disk"],d={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${u}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${u}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${u}?Privacy_AllFiles`}};function Bz(z){return z.executable}function tz(z,J){if(z==="computer_use_identity_missing")return`Reason's background identity is not installed (${z}); reinstall Reason: ${az}`;if(z==="computer_use_identity_outdated")return`Reason's background identity is outdated (${I(J)??"unknown"}; this CLI is ${A}) (${z}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${z}); run the installed \`reason\``}function ez(z=N()){let J=b(z);if(J.length>0)return{state:"ready",path:g(g(g(J[0]))),prefix:J};let Z=Kz(J,z)??"computer_use_identity_unavailable";return{state:Z,path:v(z),detail:tz(Z,z)}}function Pz(){return{identity:()=>ez(),grants:(z)=>wz(z),request:(z,J)=>Nz(z,J),worker:async()=>(await import("./status-v057fs9a.js")).connectionMacState(),open:(z)=>{iz("/usr/bin/open",z,{stdio:"ignore",timeout:1e4})},tile:Xz,restartConnection:async()=>(await import("./connect-cli-cs0mgjrv.js")).restartConnection(),sleep:(z)=>new Promise((J)=>setTimeout(J,z)),now:()=>Date.now()}}function Yz(z,J,Z){if(z.state!=="ready"||!J)return"unknown";return J[Z]?"granted":"missing"}async function vz(z){let J=z.identity(),Z=J.state==="ready"?await z.grants(J.prefix):null,$=await z.worker(),j=$?Bz($):null,q=!j||$?.full_disk_access==="unknown"?"unknown":$?.full_disk_access==="granted"?"granted":"missing",Q=(V,X,W)=>{let{label:Y,purpose:B,level:F}=d[V];return{id:V,label:Y,purpose:B,level:F,state:X,holder:W}};return{identity:{state:J.state,path:J.path,detail:J.state==="ready"?null:J.detail},worker_detail:j?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[Q("screen",Yz(J,Z,"screen"),J.path),Q("accessibility",Yz(J,Z,"accessibility"),J.path),Q("disk",q,j)]}}function MJ(z){let J=z.identity.state==="ready"?null:z.identity.state,Z=z.permissions.filter((q)=>q.state==="granted").length,$=[...J?[J]:[],...z.permissions.filter((q)=>q.state!=="granted"&&!(J&&q.id!=="disk")).map((q)=>`${q.label} ${q.state}`)],j=!J&&z.permissions.some((q)=>q.state==="missing");return`Permissions: ${Z} of ${z.permissions.length}${$.length>0?` (${$.join(", ")})`:""}`+(j?" \u2014 reason permissions allow":$.length>0?" \u2014 reason permissions":"")}function zJ(z){let J=[];if(z.identity.detail)J.push(z.identity.detail);J.push(`Reason: ${z.identity.path}`);let Z=z.permissions.find(($)=>$.id==="disk");J.push(Z?.holder?`Worker: ${Z.holder}`:`Worker: ${z.worker_detail}`),J.push("");for(let $ of z.permissions){let j=`${$.label}${$.level==="recommended"?" (recommended)":""}`;J.push(`  ${$.id.padEnd(13)}  ${$.state.padEnd(7)}  ${j}: ${$.purpose}`)}if(z.permissions.some(($)=>$.state==="missing"))J.push("","Allow the missing ones: reason permissions allow");return`${J.join(`
+`,u="x-apple.systempreferences:com.apple.preference.security",az="curl -fsSL https://reasonmachines.com/install.sh | bash",oz=180000,rz=2000,h=["screen","accessibility","disk"],d={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${u}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${u}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${u}?Privacy_AllFiles`}};function Bz(z){return z.executable}function tz(z,J){if(z==="computer_use_identity_missing")return`Reason's background identity is not installed (${z}); reinstall Reason: ${az}`;if(z==="computer_use_identity_outdated")return`Reason's background identity is outdated (${I(J)??"unknown"}; this CLI is ${A}) (${z}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${z}); run the installed \`reason\``}function ez(z=N()){let J=b(z);if(J.length>0)return{state:"ready",path:g(g(g(J[0]))),prefix:J};let Z=Kz(J,z)??"computer_use_identity_unavailable";return{state:Z,path:v(z),detail:tz(Z,z)}}function Pz(){return{identity:()=>ez(),grants:(z)=>wz(z),request:(z,J)=>Nz(z,J),worker:async()=>(await import("./status-71456987.js")).connectionMacState(),open:(z)=>{iz("/usr/bin/open",z,{stdio:"ignore",timeout:1e4})},tile:Xz,restartConnection:async()=>(await import("./connect-cli-x9pdtb0c.js")).restartConnection(),sleep:(z)=>new Promise((J)=>setTimeout(J,z)),now:()=>Date.now()}}function Yz(z,J,Z){if(z.state!=="ready"||!J)return"unknown";return J[Z]?"granted":"missing"}async function vz(z){let J=z.identity(),Z=J.state==="ready"?await z.grants(J.prefix):null,$=await z.worker(),j=$?Bz($):null,q=!j||$?.full_disk_access==="unknown"?"unknown":$?.full_disk_access==="granted"?"granted":"missing",Q=(V,X,W)=>{let{label:Y,purpose:B,level:F}=d[V];return{id:V,label:Y,purpose:B,level:F,state:X,holder:W}};return{identity:{state:J.state,path:J.path,detail:J.state==="ready"?null:J.detail},worker_detail:j?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[Q("screen",Yz(J,Z,"screen"),J.path),Q("accessibility",Yz(J,Z,"accessibility"),J.path),Q("disk",q,j)]}}function MJ(z){let J=z.identity.state==="ready"?null:z.identity.state,Z=z.permissions.filter((q)=>q.state==="granted").length,$=[...J?[J]:[],...z.permissions.filter((q)=>q.state!=="granted"&&!(J&&q.id!=="disk")).map((q)=>`${q.label} ${q.state}`)],j=!J&&z.permissions.some((q)=>q.state==="missing");return`Permissions: ${Z} of ${z.permissions.length}${$.length>0?` (${$.join(", ")})`:""}`+(j?" \u2014 reason permissions allow":$.length>0?" \u2014 reason permissions":"")}function zJ(z){let J=[];if(z.identity.detail)J.push(z.identity.detail);J.push(`Reason: ${z.identity.path}`);let Z=z.permissions.find(($)=>$.id==="disk");J.push(Z?.holder?`Worker: ${Z.holder}`:`Worker: ${z.worker_detail}`),J.push("");for(let $ of z.permissions){let j=`${$.label}${$.level==="recommended"?" (recommended)":""}`;J.push(`  ${$.id.padEnd(13)}  ${$.state.padEnd(7)}  ${j}: ${$.purpose}`)}if(z.permissions.some(($)=>$.state==="missing"))J.push("","Allow the missing ones: reason permissions allow");return`${J.join(`
 `)}
 `}async function Gz(z,J){let Z=J.now()+oz;for(;;){if(await z())return!0;if(J.now()>=Z)return!1;await J.sleep(rz)}}async function JJ(z,J){let Z=J.host??Pz(),{io:$}=J,j=await vz(Z),q=j.permissions.filter((W)=>z.includes(W.id)&&W.state!=="granted");if(q.length===0)return $.stdout.write(`Reason permissions: ${z.map((W)=>d[W].label).join(", ")} already allowed.
 `),0;let Q=!1,V=!1,X=Z.identity();for(let W of q){let{label:Y,pane:B}=d[W.id];if(W.id!=="disk"){if(X.state!=="ready"){if(!Q)$.stderr.write(`Reason permissions: ${X.detail}

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,2 +1,2 @@
 // @bun
-import"./vm-hands-entry-lite-z662b8yj.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import{Oh as A}from"./vm-hands-entry-lite-hf0mk7vd.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-d3h2f7t7.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-wrs4s3nb.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();
+import"./vm-hands-entry-lite-11qqexwe.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import{Oh as A}from"./vm-hands-entry-lite-hf0mk7vd.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-r73j7bvn.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-nn37vghe.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();

package/bin/vm-hands/vm-hands-executor-xwcv7e9g.js

@@ -0,0 +1,10 @@
+// @bun
+import{Ka as Kq,ob as Bq,qa as Yq,sb as Tq}from"./vm-hands-entry-lite-dxxnp4nx.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-kg5gmpvq.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";import{spawn as wq}from"child_process";import{chmodSync as Pq,chownSync as Dq,existsSync as t,lstatSync as s,mkdirSync as e,mkdtempSync as jq,readdirSync as p,readFileSync as A,realpathSync as Aq,rmdirSync as r,rmSync as fq,writeFileSync as c}from"fs";import{join as L}from"path";var Uq="/sys/fs/cgroup/reason-payload",S="vm-hands",Cq="/run/ara-srt/fallbacks.jsonl",u="/reason-person",qq=5000,vq=1e4,Xq="__VM_HANDS_PROOF_DIR__",Oq="__VM_HANDS_PROBE_NONCE__";class R extends Error{code;constructor(q,z){super(z);this.code=q}}function Vq(q,z){if(!/^[0-9a-f-]{36}$/i.test(z))throw new R("vm_hands_bind_invalid","bad bind id");return L(q,S,`b-${z.toLowerCase()}`)}var bq=30000,Lq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function lq(q){let z=q.cgroup??Uq,K=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,Y=new Map,B=0,O=()=>{try{let Z=A("/run/ara-srt/starts.jsonl","utf8"),$=Z.slice(B>Z.length?0:B).split(`
+`).filter(Boolean);B=Z.length;let Q=$.map((T)=>{try{return Number(JSON.parse(T).elapsed_ms)||0}catch{return 0}});if(Q.length)X("vm_hands.srt_server_starts",{count:Q.length,elapsed_ms:Q.slice(0,8)})}catch{}},j=null,_=!1,h=q.srtCgroup??"/sys/fs/cgroup/reason-srt",f=()=>{j??=Zq()},b=0,x=()=>{try{let Z=A(Cq,"utf8"),$=Z.slice(b>Z.length?0:b);b=Z.length;let Q=$.split(`
+`).filter(Boolean).slice(0,1000);if(!Q.length)return null;let T={},U=0;for(let N of Q)try{let M=JSON.parse(N),F=typeof M.code==="string"&&/^[a-z_]{1,40}$/.test(M.code)?M.code:"other";if(T[F]=(T[F]??0)+1,typeof M.elapsed_ms==="number")U=Math.max(U,M.elapsed_ms)}catch{T.unparsed=(T.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:Q.length,codes:T,max_elapsed_ms:U}),{count:Q.length,codes:T,max_elapsed_ms:U}}catch{return null}},w=!1,y=(Z,$,Q)=>{if(w)throw Error("vm_hands_pool_held");return n(Z,$,Q)},i=(Z)=>($,Q,T)=>wq("/bin/sh",["-c",`echo $$ > ${Lq(L(Z,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",$,...Q],T),n=i(L(z,S)),g=(Z)=>Vq(z,Z),Mq=(Z)=>{let $=g(Z);try{e($,{mode:493})}catch(Q){if(!(Q&&typeof Q==="object"&&("code"in Q)&&Q.code==="EEXIST"))throw new R("vm_hands_bind_failed","bind cgroup")}return $},Nq=(Z)=>{try{r(g(Z))}catch{}},I=q.prespawn?Kq({spawnProcess:y,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(Z,$)=>X(Z,$??{})}):null;I?.arm();let a=I?setInterval(()=>{I.arm()},bq):null;a?.unref?.();async function m(Z){let $=G.get(Z);if(G.delete(Z),!$)return;$.abort.abort(),await $.done}return{bindCgroup:g,async startExecutor(Z){if(f(),Y.set(Z.bindId,Zq()),_=!0,!Z.claim)throw new R("vm_hands_bind_invalid","an executor needs the claim it serves");await m(Z.bindId);let{claim:$,bindId:Q}=Z,T=Mq(Q),U=$.owner;if(!U||typeof U.device_id!=="string"||typeof $.root_id!=="string")throw new R("vm_hands_bind_invalid","claim without its owner Device or root");let N=new AbortController,M,F,D=new Promise((W,P)=>{M=W,F=P}),v,C=new Promise((W)=>{v=W}),V=Tq({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:U.device_id,rootId:$.root_id,apiOrigin:q.apiOrigin},claimOwner:$.owner,root:q.root,runId:$.run_id,operationId:$.operation_id,attemptId:$.attempt_id,payload:Object.fromEntries(Object.entries($.payload).filter(([W])=>!W.startsWith("vm_hands_"))),signal:N.signal,emitEvent:async(W,P)=>{if(W==="hands.ready"){M(P);return}if(W==="hands.started"||W==="hands.stopped"||W==="hands.failed")return;await q.forward(Q,W,P)}},{...q.relayDependencies,spawnWorker:(W)=>i(T)(W.command,W.args,W.options),...I?{takePrespawnedWorker:(W)=>{let P=I.take(W);if(!P?.pid)return P;try{return c(L(T,"cgroup.procs"),String(P.pid)),P}catch{try{P.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:I.adopt}:{}}).then(()=>{v("executor_stopped")},(W)=>{let P=W&&typeof W==="object"&&"code"in W?String(W.code):"executor_failed";F(new R(P,W instanceof Error?W.message:String(W))),v(P)}).finally(()=>F(new R("vm_hands_executor_exited","executor ended before it was ready")));G.set(Q,{abort:N,done:V,exited:C,operationId:$.operation_id,runId:$.run_id,expiresAtMs:Date.parse(String($.payload.expires_at??""))||0});let E=await D,J=E.executor_launch_id;if(typeof J!=="string")throw new R("vm_hands_bind_failed","executor ready without a launch id");return{launchId:J,readyData:E,applied:{hands_confinement:typeof $.payload.hands_confinement==="string"?$.payload.hands_confinement:null,browser_egress:$.payload.browser_egress??null}}},takeSrtFallbacks:x,executorExited(Z){return G.get(Z)?.exited??new Promise(()=>{})},freezeBind(Z){let $=g(Z);if(t(L($,"cgroup.freeze")))c(L($,"cgroup.freeze"),"1")},async killAndVerifyPayload(Z){let $=new Set(Z?.keep??[]);if($.size)return Rq(Z?.bindId??null,$);w=!0;let Q=Wq();try{await Jq();let T=Promise.all([...G.keys()].map((F)=>m(F).catch(()=>{return})));O();let U=Date.now()+qq;await d(z,U,"payload"),await T;let N=(_||q.srtWarmLate?.()===!0)&&t(L(h,"cgroup.events"));if(N)await d(h,U,"srt");let M=Qq(K).filter((F)=>!k(F,u));if(j!==null){let F=$q(j).filter((D)=>D!==process.pid&&!k(D,u));if(F.length)throw X("vm_hands.kill_strays",{strays:F.slice(0,16).map((D)=>{let v="?",C="?";try{v=A(`/proc/${D}/comm`,"utf8").trim().slice(0,32)}catch{}try{C=(A(`/proc/${D}/cgroup`,"utf8").split(`
+`).find((V)=>V.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:D,comm:v,cgroup:C}})}),new R("vm_hands_kill_unverified",`${F.length} process(es) the run started survived it`);j=null}if(_=!1,N)q.onSrtReset?.();if(M.length)throw X("vm_hands.kill_survivors",{pids:M.slice(0,16)}),new R("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside the payload cgroup`);Y.clear();for(let F of o())try{r(L(z,S,F))}catch{}}finally{w=!1,Q()}if(I)setTimeout(()=>{if(!G.size)I.arm()},100).unref?.()},async runProbe({nonce:Z,script:$}){if(f(),!$.includes(Xq))throw new R("vm_hands_probe_failed","probe names no proof directory");let Q=q.proofParent??"/tmp/reason-vm-hands-proof";e(Q,{mode:457,recursive:!0});let T=s(Q);if(T.isSymbolicLink()||!T.isDirectory()||T.uid!==(process.getuid?.()??-1)||(T.mode&4095)!==457)throw new R("vm_hands_probe_failed","proof parent is not root's 0711 directory");let U=jq(L(Q,"p-")),N=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(U)||!/^[A-Za-z0-9_-]{1,128}$/.test(Z))throw new R("vm_hands_probe_failed","proof directory path or nonce");Dq(U,K,K),Pq(U,448);let M=s(U).ino,F=n("/bin/bash",["-c",$.replaceAll(Xq,U).replaceAll(Oq,Z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),D="";F.stdout?.on("data",(C)=>{if(D.length<16384)D+=C.toString("utf8").slice(0,16384-D.length)});let v=await new Promise((C)=>{let V=setTimeout(()=>{N=!0,F.kill("SIGKILL"),C(124)},vq);F.once("error",()=>{clearTimeout(V),C(127)}),F.once("close",(E)=>{clearTimeout(V),C(E??1)})});return X("vm_hands.probe",{nonce_len:Z.length,exit_code:v}),{exitCode:v,markers:D,proofDirInode:M}}finally{if(!N)fq(U,{recursive:!0,force:!0})}},restatLayout(){let{session_root:Z,alias:$}=q.init.layout,Q="invalid";try{Bq(Z),Q="0:0:755"}catch{}let T=!1,U=-1;try{let N=s($);U=N.uid,T=Q==="0:0:755"&&$===L(Z,"repo")&&!N.isSymbolicLink()&&N.isDirectory()&&Aq($)===$&&N.uid===K}catch{}return{root_mode:Q,alias_ok:T,owner_uid:U}},installEnvironment(Z,$){let Q=G.get(Z);if(!Q)throw new R("environment_unavailable","no executor owns an environment");return Yq({root:q.root,operationId:Q.operationId,payload:$}).installed_revision},async stop(){if(a)clearInterval(a);I?.close(),await Promise.all([...G.keys()].map((Z)=>m(Z)))}};function o(){try{return p(L(z,S),{withFileTypes:!0}).filter((Z)=>Z.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(Z.name)).map((Z)=>Z.name)}catch{return[]}}async function Rq(Z,$){let Q=new Set([...$].map((U)=>U.toLowerCase())),T=Wq();try{await Jq();let U=Date.now()+qq,N=new Set(o().filter((J)=>!Q.has(J.slice(2))).map((J)=>J.slice(2)));if(Z)N.add(Z.toLowerCase());let M=null;for(let J of N){let W=m(J).catch(()=>{return}),P=Y.get(J);if(P!==void 0)M=M===null?P:Math.min(M,P);if(t(L(g(J),"cgroup.events")))await d(g(J),U,"bind");await W}let F=[...Q].map((J)=>g(J).replace(/^\/sys\/fs\/cgroup/,"")),D=[z,L(z,S)].map((J)=>J.replace(/^\/sys\/fs\/cgroup/,"")),v=h.replace(/^\/sys\/fs\/cgroup/,""),C=(J)=>k(J,u)||F.some((W)=>k(J,W)),V=Qq(K).filter((J)=>!C(J));if(V.length)throw X("vm_hands.kill_survivors",{pids:V.slice(0,16),beside:Q.size}),new R("vm_hands_kill_unverified",`${V.length} payload-uid process(es) outside a live bind`);let E=(J)=>!C(J)&&!k(J,"/reason-vm-hands")&&!k(J,v)&&!D.some((W)=>xq(J,W));if(M!==null){let J=$q(M).filter((W)=>W!==process.pid&&E(W));if(J.length)throw X("vm_hands.kill_strays",{strays:J.slice(0,16).map((W)=>({pid:W})),beside:Q.size}),new R("vm_hands_kill_unverified",`${J.length} process(es) the run started survived it`)}for(let J of N)Y.delete(J),Nq(J)}finally{T()}}}function xq(q,z,K="/proc"){try{return A(L(K,String(q),"cgroup"),"utf8").split(`
+`).find((G)=>G.startsWith("0::"))?.slice(3)===z}catch{return!1}}function k(q,z,K="/proc"){try{let G=A(L(K,String(q),"cgroup"),"utf8").split(`
+`).find((Y)=>Y.startsWith("0::"))?.slice(3)??"";return G===z||G.startsWith(`${z}/`)}catch{return!1}}var Iq=100;function Zq(){try{return Math.floor(Number(A("/proc/uptime","utf8").split(" ")[0])*Iq)}catch{return 0}}async function d(q,z,K){try{c(L(q,"cgroup.freeze"),"1")}catch(X){throw new R("vm_hands_kill_unverified",`${K} cgroup.freeze: ${X instanceof Error?X.message:String(X)}`)}while(!/^populated 0$/m.test(A(L(q,"cgroup.events"),"utf8"))){if(Date.now()>z)throw new R("vm_hands_kill_unverified",`${K} cgroup still populated (left frozen)`);for(let X of hq(q)){if(!_q(X,q))continue;try{process.kill(X,"SIGKILL")}catch{}}await new Promise((X)=>setTimeout(X,10))}try{c(L(q,"cgroup.freeze"),"0")}catch(X){throw new R("vm_hands_kill_unverified",`${K} cgroup thaw: ${X instanceof Error?X.message:String(X)}`)}}function _q(q,z){let K=z.replace(/^\/sys\/fs\/cgroup/,"")||"/",X="";try{X=A(`/proc/${q}/cgroup`,"utf8").split(`
+`).find((Y)=>Y.startsWith("0::"))??""}catch{return!1}let G=X.slice(3);return G===K||G.startsWith(`${K}/`)}function hq(q){let z=[],K=(X)=>{try{for(let Y of A(L(X,"cgroup.procs"),"utf8").split(`
+`))if(/^\d+$/.test(Y))z.push(Number(Y))}catch{}let G=[];try{G=p(X,{withFileTypes:!0}).filter((Y)=>Y.isDirectory()).map((Y)=>Y.name)}catch{}for(let Y of G)K(L(X,Y))};return K(q),z}function $q(q,z="/proc"){let K=[];for(let X of p(z)){if(!/^\d+$/.test(X))continue;let G;try{G=A(L(z,X,"stat"),"utf8")}catch{continue}let Y=G.slice(G.lastIndexOf(")")+2).split(" "),B=Number(Y[1]),O=Number(Y[6]),j=Number(Y[19]);if(!((O&2097152)!==0||B===2||X==="2")&&Y[0]!=="Z"&&j>=q)K.push(Number(X))}return K}function Qq(q,z="/proc"){let K=[];for(let X of p(z)){if(!/^\d+$/.test(X))continue;let G;try{G=A(L(z,X,"status"),"utf8")}catch{continue}let Y=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(G);if(Y&&Y.slice(1).some((B)=>Number(B)===q))K.push(Number(X))}return K}function zq(q="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(A(q,"utf8").trim())>=1}catch{return!1}}var H=0,Fq=[],l=new Set;function Wq(){H++;let q=!1;return()=>{if(q)return;if(q=!0,--H===0)for(let z of Fq.splice(0))z()}}function Hq(){return H===0?Promise.resolve():new Promise((q)=>{Fq.push(q)})}async function Gq(){while(H>0)await Hq()}async function Jq(){let q=Date.now()+1000;while(l.size&&Date.now()<q)await new Promise((z)=>setTimeout(z,2))}function gq(q,z){let K=z.replace(/^\/sys\/fs\/cgroup/,"");l.add(q);let X=()=>{let G="";try{G=A(`/proc/${q}/cgroup`,"utf8").split(`
+`).find((Y)=>Y.startsWith("0::"))??""}catch{l.delete(q);return}if(G.slice(3)===K){l.delete(q);return}setTimeout(X,1)};X()}function cq(q){let z={person:q.personCgroup??L("/sys/fs/cgroup",u,S),model:q.payloadCgroup??L(Uq,S)},K=q.entry??process.argv[1]??"",X={},G=(B)=>B.startsWith("model:")&&q.bindCgroup?q.bindCgroup(B.slice(6)):z[B.startsWith("model")?"model":"person"],Y=(B)=>{let O=B.startsWith("model")?"model":"person",j=new Map,_=String(q.payloadUid),h=String(q.payloadGid),f=Bun.spawn(["/bin/sh","-c",`echo $$ > ${Lq(L(G(B),"cgroup.procs"))} || exit 125; exec /usr/bin/setpriv --no-new-privs --reuid=${_} --regid=${h} --clear-groups -- "$@"`,"vm-hands-op-join",process.execPath,K,"--vm-hands-op-runner"],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:"/home/runner"},stdio:["ignore","ignore","ignore"],ipc(x){let w=x,y=j.get(w.id);if(!y)return;if(w.t==="event"&&w.event)y.onEvent(w.event);if(w.t==="done")j.delete(w.id),y.done(w.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});f.exited.then((x)=>{if(X[B]?.child===f)delete X[B];for(let[,w]of j)w.done({status:"failed",error_code:"vm_hands_op_runner_exited"});j.clear(),q.log?.("vm_hands.op_runner_exited",{kind:O,code:x})}),gq(f.pid,G(B));let b={child:f,pending:j};return X[B]=b,b};return{run(B,O,j,_,h){if(!zq())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let f=B==="model"&&h&&q.bindCgroup?`model:${h.toLowerCase()}`:B,b=async()=>{while(!X[f]&&H>0)await Gq()};return b().then(async()=>{if(!X[f]&&H>0)await b()}).then(()=>new Promise((x)=>{if(!X[f]&&H>0){x({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let w=X[f]??Y(f);w.pending.set(O.id,{onEvent:j,done:x}),_.addEventListener("abort",()=>{try{w.child.send({t:"cancel",id:O.id})}catch{}},{once:!0});try{w.child.send({t:"op",...O})}catch{w.pending.delete(O.id),x({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(B){if(!X[B]&&zq())Gq().then(()=>{if(!X[B]&&H===0)Y(B)})},stop(){for(let B of Object.keys(X))X[B]?.child.kill()}}}export{Vq as vmHandsBindCgroup,hq as subtreePids,zq as ptraceProtected,$q as processesStartedSince,Qq as payloadUidProcesses,k as inCgroup,cq as createVmHandsOpRunners,lq as createVmHandsExecutor,R as VmHandsExecutorError,Xq as VM_HANDS_PROOF_DIR_TOKEN,Oq as VM_HANDS_PROBE_NONCE_TOKEN,u as VM_HANDS_PERSON_CGROUP,S as VM_HANDS_PAYLOAD_JOIN,Uq as VM_HANDS_PAYLOAD_CGROUP};

package/bin/vm-hands/{vm-hands-op-runner-d3h2f7t7.js → vm-hands-op-runner-r73j7bvn.js}

@@ -1,2 +1,2 @@
 // @bun
-import{Oh as E}from"./vm-hands-entry-lite-hf0mk7vd.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-hdm858r9.js"),import("./desktop-account-axaenf68.js"),import("./worker-sandbox-snmfpfax.js")]);J();let K=(process.geteuid?.()??0)!==0,z=new Map,y=(B)=>{try{process.send?.(B)}catch{}};process.on("message",(B)=>{let j=B;if(j?.t==="cancel"){z.get(j.id)?.abort();return}if(j?.t!=="op")return;if(!K){y({t:"done",id:j.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let F=new AbortController;z.set(j.id,F),G(j.state,j.claim,{worker:j.worker,signal:F.signal,emit:(q)=>{let{deliverySignal:N,...M}=q;y({t:"event",id:j.id,event:M})}}).then((q)=>y({t:"done",id:j.id,completion:q}),(q)=>y({t:"done",id:j.id,completion:{status:"failed",error_code:q&&typeof q==="object"&&"code"in q&&typeof q.code==="string"?q.code:"vm_hands_op_failed"}})).finally(()=>z.delete(j.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}export{Q as runVmHandsOpRunner};
+import{Oh as E}from"./vm-hands-entry-lite-hf0mk7vd.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-88dfgxzc.js"),import("./desktop-account-axaenf68.js"),import("./worker-sandbox-snmfpfax.js")]);J();let K=(process.geteuid?.()??0)!==0,z=new Map,y=(B)=>{try{process.send?.(B)}catch{}};process.on("message",(B)=>{let j=B;if(j?.t==="cancel"){z.get(j.id)?.abort();return}if(j?.t!=="op")return;if(!K){y({t:"done",id:j.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let F=new AbortController;z.set(j.id,F),G(j.state,j.claim,{worker:j.worker,signal:F.signal,emit:(q)=>{let{deliverySignal:N,...M}=q;y({t:"event",id:j.id,event:M})}}).then((q)=>y({t:"done",id:j.id,completion:q}),(q)=>y({t:"done",id:j.id,completion:{status:"failed",error_code:q&&typeof q==="object"&&"code"in q&&typeof q.code==="string"?q.code:"vm_hands_op_failed"}})).finally(()=>z.delete(j.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}export{Q as runVmHandsOpRunner};

package/bin/vm-hands/vm-hands-runtime-nn37vghe.js

@@ -0,0 +1,4 @@
+// @bun
+import{u as k,v as m,w as l}from"./vm-hands-entry-lite-11qqexwe.js";import{Wc as v}from"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import{Oh as F}from"./vm-hands-entry-lite-hf0mk7vd.js";import{spawn as a}from"child_process";import{createHash as r}from"crypto";import{lstatSync as x,mkdirSync as s,readFileSync as i,statSync as t,writeFileSync as d}from"fs";var V="/run/reason-vm-hands",R="/run/reason-vm-hands/env",w="/home/runner",e=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,O="/sys/fs/cgroup/reason-srt",S="/usr/local/bin/ara-srt-exec",jj=65536,qj=21600000;function Jj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=x(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
+`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function p(Q,j){let J=(K)=>{return j("srt_warm_skipped",{reason:K}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>jj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let K=x(O);if(!K.isDirectory()||K.uid!==0||(K.mode&18)!==0)return J("cgroup_unsafe");for(let[W,g]of[[S,!1],["/usr/local/bin",!0]]){let B=x(W);if((g?!B.isDirectory():!B.isFile())||B.uid!==0||(B.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let z=performance.now(),X=r("sha256").update(Z).digest("hex"),N=`${V}/srt-base-settings.json`;try{d(N,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let H=a("/bin/sh",["-c",`echo $$ > ${O}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",S,"--settings",N,"--idle-ms",String(qj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((K)=>{H.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),K()}),H.once("close",(W)=>{j(W===0?"srt_warm_done":"srt_warm_failed",{exit_code:W,warm_ms:Math.round(performance.now()-z),settings_sha256:X}),K()})})}var y=3000;function Wj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,z=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&e.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!z&&typeof z.key_id==="string"&&Number.isSafeInteger(z.expires_at_ms)&&typeof z.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function u(Q){s(Q,{recursive:!0,mode:448});let j=t(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Qj(Q){let[{CLI_VERSION:j},J,Z,z]=await Promise.all([import("./version-zdjskn9w.js"),import("./hands-worker-source-w477y8ad.js"),import("./network-contract-ggqak7gp.js"),import("./device-workspace-ecq3hfd6.js")]),{REASON_HANDS_PROTOCOL_VERSION:X}=await import("./reason-hands-protocol-as5477xr.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:X,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:z.REASON_WORKSPACE_BASE,workspace_layout:z.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var C=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],Zj=new Set(["pty.start","jobs.control"]);function $j(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:w,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(C.map((X)=>[X,!0]))}}),Z=Q.capabilities,z={...Z.operation_constraints};for(let X of C)z[X]={...J.operation_constraints?.[X]??{},ready:!0,execution_mode:J.operation_constraints?.[X]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...C],operation_constraints:z}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
+`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Xj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:w,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Hj(Q,j){u(V),u(R),Jj(j);let J=p(Q,j),Z=!1,z=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),y).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:y})},[{configureDesktopAccount:X},{configureWorkerSandbox:N}]=await Promise.all([import("./desktop-account-axaenf68.js"),import("./worker-sandbox-snmfpfax.js")]);N();try{X({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let H=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>H.abort());let K=new Map,W,g=new Promise((q)=>{W=q}),B=g.then(()=>import("./vm-hands-executor-xwcv7e9g.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:w,runtimeDirectory:V,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=p(Q,j)},srtWarmLate:()=>Z,forward:(U,G,M)=>K.get(U)?.(G,M)??Promise.reject(Error("vm_hands_not_bound")),log:(U,G)=>j(U,G)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await B)[q](...$),D=null;B.then((q)=>{D=($)=>q.executorExited($)});let L={startExecutor:async(...q)=>{return await z(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),runProbe:async(...q)=>{return await z(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>D?D(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};B.then((q)=>{L.restatLayout=()=>q.restatLayout(),L.installEnvironment=($,U)=>q.installEnvironment($,U),L.freezeBind=($)=>q.freezeBind($),L.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,L,{envRoot:R}),h=Qj(Q),b=null,n=Promise.all([h,import("./local-capabilities-88dfgxzc.js")]).then(([q,$])=>{b=$j(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),T=g.then(()=>import("./vm-hands-executor-xwcv7e9g.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:U})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(G)=>$(U,G),log:(G,M)=>j(G,M)})).catch(()=>null);T.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:H.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:U,signal:G,emit:M})=>{let f=Xj(Q,$);if(!f)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:V,readiness:Object.fromEntries(C.map((Y)=>[Y,!0]))},_=(Y)=>{let P=typeof Y.kind==="string"?Y.kind:"";if(P)M({kind:P,...Y.data&&typeof Y.data==="object"?{data:Y.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};if(Zj.has(String($.capability))){let{executeLocalOperation:Y}=await import("./local-capabilities-88dfgxzc.js");return Y(f,$,{worker:E,signal:G,emit:(P)=>_(P)})}let I=await T;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:f,worker:E},_,G,U)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")W();j(q,$)},onTurn:(q,$)=>{if($)K.set(q,$);else K.delete(q)}}),await(await B).stop(),(await T)?.stop()}export{p as startBaseSrtServer,Hj as runVmHands,Wj as parseVmHandsInit,Qj as heartbeatBody,Jj as enableBaseKeyedSrt};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-arm64-musl",
-  "version": "0.2.310",
+  "version": "0.2.312",
   "description": "Reason CLI native binary for linux-arm64-musl",
   "os": [
     "linux"

package/bin/vm-hands/vm-hands-entry-lite-z662b8yj.js

@@ -1,5 +0,0 @@
-// @bun
-import{Ld as UJ,ad as CJ,id as qJ}from"./vm-hands-entry-lite-8st97h7b.js";import{createHash as v,randomBytes as t}from"crypto";import{closeSync as QJ,fsyncSync as FJ,mkdirSync as kJ,openSync as WJ,renameSync as SJ,rmSync as gJ,statSync as BJ,writeSync as PJ,constants as S}from"fs";import{join as V}from"path";var HJ=1;var d=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function e(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function jJ(J,Z){let{payload:z,authority:G}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!G||typeof G!=="object"||Array.isArray(G)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||G.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function NJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&d.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:e(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var g=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),y=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function R(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(R).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${R(J[Z])}`).join(",")}}`}async function aJ(J){let Z=await crypto.subtle.importKey("pkcs8",y(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=y(J.device_key.spki),G=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),N=new Uint8Array(await crypto.subtle.exportKey("spki",G.publicKey)),D=v("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:G,signingSpki:z,agreementSpki:N,fingerprint:D}}class VJ{init;keys;hooks;options;state="identity_free";lastBrainGeneration=0;bound=null;servedRun=!1;verifiedSinceRun=!1;envDirectory=null;constructor(J,Z,z,G){this.init=J;this.keys=Z;this.hooks=z;this.options=G;if(!d.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){return this.state}get boundRunId(){return this.state==="bound"?this.bound?.runId??null:null}canSpawn(J){return this.state==="bound"&&this.bound?.runId===J&&this.bound.envInstalled}async registerFrame(J){if(this.state!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:HJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:g(this.keys.signingSpki),env_public_key:g(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:g(t(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(R(Z)));return{...Z,device_signature:g(z)}}async helloFrame(J,Z){if(this.state==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),G=g(t(32)),N=UJ({method:"GET",pathAndQuery:CJ,timestamp:z,nonce:G,challenge:J,bodySha256:v("sha256").update("").digest("hex")}),D=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(N)));return{t:"hello",timestamp:z,nonce:G,signature:g(vJ(D)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.state!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.state="registered"}async bind(J){if(this.state!=="registered")throw new W("vm_hands_not_registered","bind before register or while bound");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let G of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!d.test(G))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=this.lastBrainGeneration)throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(v("sha256").update(R({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");this.lastBrainGeneration=J.brain_generation;let z=null;try{if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload();this.verifiedSinceRun=!1;let{launchId:G,applied:N,readyData:D}=await this.hooks.startExecutor({sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),B=this.hooks.restatLayout(),M=null;if(J.env){let A=J.claim?.owner??{},x=jJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof A.device_id==="string"?A.device_id:"",rootId:J.claim?.root_id??""});M=this.hooks.installEnvironment(x),z=this.writeJobEnvRootOnly(J.bind_id,x)}return this.servedRun=!0,this.bound={bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:G,envInstalled:M!==null,rootId:J.claim?.root_id??""},this.state="bound",{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:G,snapshot_revision:M,layout:B,...D?{ready_data:D}:{},policy_digest:v("sha256").update(R({hands_confinement:N.hands_confinement??null,browser_egress:N.browser_egress??null})).digest("hex")}}catch(G){if(this.servedRun=!0,z)this.shred();let N=G&&typeof G==="object"&&"code"in G&&typeof G.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(G.code)?G.code:"vm_hands_bind_failed";throw G instanceof W?G:new W(N,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound;if(this.state!=="bound"||!Z)throw new W("vm_hands_not_bound","environment delivered while not bound");if(J.attemptId!==Z.bindId)throw new W("vm_hands_env_invalid","environment for another attempt");if(!d.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let G=jJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),N=this.hooks.installEnvironment(G);return Z.envInstalled=!0,this.shred(),this.writeJobEnvRootOnly(`${Z.bindId}-r${N}`,G),{snapshot_id:J.snapshotId,installed_revision:N,installed:!0}}async attestFrame(J,Z){if(this.state==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killAndVerifyPayload(),this.verifiedSinceRun=!0}catch{this.servedRun=!0,this.verifiedSinceRun=!1}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:v("sha256").update(J).digest("hex")}}executorExited(){return this.hooks.executorExited?.()??new Promise(()=>{})}async boundRefused(){await this.unbind()}async unbind(){let J=this.bound?.bindId??null;return this.state="unbinding",this.bound=null,await this.hooks.killAndVerifyPayload(),this.verifiedSinceRun=!0,this.shred(),this.state="registered",{bind_id:J,killed_verified:!0,shredded:!0,srt_fallbacks:this.hooks.takeSrtFallbacks?.()??null}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},G=await crypto.subtle.importKey("spki",y(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),N=await crypto.subtle.deriveKey({name:"ECDH",public:G},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),D=await crypto.subtle.decrypt({name:"AES-GCM",iv:y(J.iv),additionalData:new TextEncoder().encode(Z)},N,y(J.ct)).catch(z),B=JSON.parse(new TextDecoder().decode(D));if(!B||typeof B!=="object"||Array.isArray(B))throw new W("vm_hands_env_invalid","env not an object");return B}writeJobEnvRootOnly(J,Z){let z=V(this.options.envRoot,`bind-${J}`);kJ(z,{mode:448});let G=BJ(z);if(!G.isDirectory()||(G.mode&63)!==0||G.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let N=Z.variables&&typeof Z.variables==="object"?Z.variables:{},D=Object.entries(N).filter(([A,x])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(A)&&typeof x==="string").map(([A,x])=>`export ${A}='${String(x).replaceAll("'","'\\''")}'`).join(`
-`)+`
-`,B=V(z,`.job.env.${t(8).toString("hex")}`),M=WJ(B,S.O_WRONLY|S.O_CREAT|S.O_EXCL|S.O_NOFOLLOW,384);try{PJ(M,D),FJ(M)}finally{QJ(M)}return SJ(B,V(z,"job.env")),this.envDirectory=z,V(z,"job.env")}shred(){let J=this.envDirectory;if(this.envDirectory=null,!J)return;try{let Z=V(J,"job.env"),z=BJ(Z).size,G=WJ(Z,S.O_WRONLY|S.O_NOFOLLOW);try{PJ(G,Buffer.alloc(z)),FJ(G)}finally{QJ(G)}}catch{}gJ(J,{recursive:!0,force:!0})}}function vJ(J){if(J.length!==64)throw new W("vm_hands_signature_invalid","unexpected ECDSA signature length");let Z=(N)=>{let D=0;while(D<N.length-1&&N[D]===0)D++;let B=N.subarray(D),M=B[0]&128?Uint8Array.of(0,...B):B;return Uint8Array.of(2,M.length,...M)},z=Z(J.subarray(0,32)),G=Z(J.subarray(32));return Uint8Array.of(48,z.length+G.length,...z,...G)}import{randomUUID as yJ}from"crypto";var RJ="/app/local-runtime/session?register=vm_hands_v1",fJ="/app/local-runtime",DJ=25000,bJ=20000,mJ=1e4,cJ=5000,pJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),JJ=75000,lJ=1e4,u=20000;class h extends Error{}var dJ=64;async function AJ(J){let Z=[...J.modelOps];for(let z of Z)z.abort.abort();await Promise.race([Promise.all(Z.map((z)=>z.settled)),new Promise((z)=>setTimeout(z,cJ))])}async function f(J,Z){return await AJ(J),Z.unbind()}function o(J){for(let Z of J.outbox?.splice(0)??[])Z.reject(Error("vm_hands_attempt_ended"))}var LJ=15000,uJ=1e4;async function zZ(J){let Z=Date.now(),z={deviceId:null,connection:null,turn:null,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],flush:null,modelOps:new Set},G=J.log??(()=>{}),N=async(D)=>{let B=z.turn;if(!B)return;z.turn=null,o(B);let M=await f(z,J.agent).catch(()=>null);if(M)z.receipts.push({turn:B,failure:"vm_hands_bind_lost",unbound:M});G("vm_hands.bound_dropped",{reason:D})};try{for(let D=0;!J.signal.aborted;D++){let B=await oJ(J,z).catch((A)=>{if(A instanceof W&&z.deviceId===null&&A.code==="vm_hands_no_session"&&Date.now()-Z<lJ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(A instanceof W&&z.deviceId===null)throw A;return{closeCode:0,closeReason:A instanceof Error?A.message:String(A)}});if(G("vm_hands.session_closed",{close_code:B.closeCode,reason:B.closeReason.slice(0,120),registered:z.deviceId!==null}),B.closeCode===4401||z.attest==="refused")return;if(J.signal.aborted)return;if(z.turn&&Date.now()-z.lostAt>=JJ)await N("reconnect_deadline");let M=B.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(D,5),2000):z.turn?Math.min(250*2**Math.min(D,5),5000,Math.max(0,z.lostAt+JJ-Date.now())):Math.min(500*2**D,30000);if(await new Promise((A)=>setTimeout(A,M)),z.turn&&Date.now()-z.lostAt>=JJ)await N("reconnect_deadline")}}finally{await N("session_ended")}}async function oJ(J,Z){let z=Z.deviceId,G=J.log??(()=>{}),N=z?`/app/local-runtime/session?device_id=${encodeURIComponent(z)}`:RJ,D=`${J.apiOrigin.replace(/^http/,"ws")}${N}`,B=new WebSocket(D),M=0,A="",x=new Map,i=[],b=null,MJ=new Promise(($)=>{B.onclose=(K)=>{M=K.code,A=K.reason;for(let Y of x.values())Y.reject(new h(`session closed ${K.code}`));for(let Y of Z.attestWaiters.splice(0))Y(!1);x.clear(),$()}});B.onmessage=($)=>{let K;try{K=JSON.parse(String($.data))}catch{B.close(4400);return}if(K.t==="res"){let Y=K;x.get(Y.id)?.resolve({status:Y.status,body:Y.body}),x.delete(Y.id);return}if(!b?.(K))i.push(K)};let m=($,K)=>new Promise((Y,F)=>{let P=i.findIndex((C)=>$.includes(C.t));if(P>=0){Y(i.splice(P,1)[0]);return}let U=setTimeout(()=>{b=null,F(new W("vm_hands_no_register",`no ${$.join("/")} in ${K} ms`))},K);b=(C)=>{if(!$.includes(C.t))return!1;return clearTimeout(U),b=null,Y(C),!0}}),c=($)=>B.send(JSON.stringify($)),w=($,K)=>new Promise((Y,F)=>{if(B.readyState!==WebSocket.OPEN){F(new h("session closed"));return}let P=yJ(),U=typeof K.wait_ms==="number"?K.wait_ms:0,C=setTimeout(()=>{if(!x.delete(P))return;F(new h(`no answer to ${$.split("/").pop()} in ${U+LJ} ms`)),B.close(4000,"request_timeout")},U+LJ);x.set(P,{reject:(X)=>{clearTimeout(C),F(X)},resolve:({status:X,body:Q})=>{clearTimeout(C);let j=null;try{j=Q?JSON.parse(Q):null}catch{}Y({status:X,json:j})}}),c({t:"req",id:P,path:`${fJ}${$}`,body:JSON.stringify(K)})}),ZJ=()=>B.close(1001,"stopping");J.signal.addEventListener("abort",ZJ,{once:!0});let r,p={turn:null},T=null,$J=!1,s=new Set,n=!1,l=!1;try{await new Promise((X,Q)=>{let j=setTimeout(()=>Q(Error("session open timeout")),uJ);B.onopen=()=>{clearTimeout(j),G("vm_hands.ws_open",{}),X()},B.onerror=()=>{clearTimeout(j),Q(Error("session socket error"))}});let $=await m(["challenge"],5000);G("vm_hands.challenge",{});let K=null,Y=null,F=null,P;if(z){c(await J.agent.helloFrame($.challenge,Z.connection));let X=await m(["ready"],1e4);if(typeof X.vm_hands_connection==="string")Z.connection=X.vm_hands_connection;if(P={device_id:z,...X.cadence?{cadence:X.cadence}:{}},typeof X.vm_hands_probe_script==="string"){if(F=X.vm_hands_probe_script,l=!0,J.agent.phase==="registered"&&!Z.turn)Z.attest="pending"}if(G("vm_hands.reconnected",{device_id:z}),Z.turn){let Q=X.vm_hands_bind;if(Q&&Q.operation_id===Z.turn.claim.operation_id&&Q.attempt_id===Z.turn.claim.attempt_id)K=Z.turn,G("vm_hands.bound_resumed",{operation_id:Q.operation_id});else{Y=Z.turn,Z.turn=null,o(Y);let j=await f(Z,J.agent).catch(()=>null);if(j)Z.receipts.push({turn:Y,failure:"vm_hands_bind_lost",unbound:j});G("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}}else{c(await J.agent.registerFrame($.challenge)),G("vm_hands.register_sent",{});let X=await m(["registered","register_refused"],1e4);if(X.t==="register_refused")throw new W(X.code,"register refused");J.agent.registered();let Q=X;if(P=Q,Z.deviceId=Q.device_id,typeof Q.vm_hands_connection==="string")Z.connection=Q.vm_hands_connection;if(typeof Q.vm_hands_probe_script==="string"){if(F=Q.vm_hands_probe_script,l=!0,J.agent.phase==="registered"&&!Z.turn)Z.attest="pending"}G("vm_hands.registered",{device_id:P.device_id})}let U=async()=>{let X=await w("/heartbeat",await J.heartbeat());if(X.status>=300)throw Error(`heartbeat ${X.status}`)};await U();let C=P.cadence?.presence_interval_ms??30000;if(r=setInterval(()=>{U().catch(()=>B.close())},C),F&&Z.attest!=="accepted"&&J.agent.phase==="registered"&&!Z.turn)IJ(F,$.challenge);try{if(await KJ(),K){let X=K;Z.flush=()=>zJ(X),Z.flush(),T=GJ(X).catch(async(Q)=>{await a(Q),B.close()}).finally(()=>{T=null})}while(!J.signal.aborted&&B.readyState===WebSocket.OPEN){let X=await w("/operations/claim",{wait_ms:Math.min(P.cadence?.claim_wait_ms??DJ,DJ)});if(X.status===204||!X.json)continue;if(X.status>=300)throw Error(`claim ${X.status}`);let Q=X.json;if(Q.capability==="hands.connect"){if(T){_({claim:Q,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}T=EJ(Q).catch(async(j)=>{await a(j),B.close()}).finally(()=>{T=null})}else _J(Q).catch(()=>{return})}}catch(X){await a(X)}}finally{if(r)clearInterval(r);if(J.signal.removeEventListener("abort",ZJ),Z.flush=null,B.close(),await MJ,await T,(J.agent.phase==="bound"||J.agent.phase==="unbinding")&&!Z.turn){let $=await f(Z,J.agent).catch(()=>null),K=p.turn;if($&&K)Z.receipts.push({turn:{...K,eventSeq:K.eventSeq+1},failure:"vm_hands_bind_lost",unbound:$});G("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let $ of s)$.abort()}return{closeCode:M,closeReason:A};async function a($){if($J)return;if($J=!0,Z.turn&&$ instanceof h)Z.lostAt=Date.now();else{let K=Z.turn;if(Z.turn=null,K)o(K),J.onTurn?.(null);if(J.agent.phase==="bound"||J.agent.phase==="unbinding"){let Y=await f(Z,J.agent).catch(()=>null),F=p.turn;if(Y&&F)Z.receipts.push({turn:{...F,eventSeq:F.eventSeq+1},failure:"vm_hands_bind_lost",unbound:Y})}}G("vm_hands.session_lost",{error:$ instanceof Error?$.message:String($),bound_kept:Z.turn!==null})}function _($){let K=$.claim,Y={attempt_id:K.attempt_id,attempt_token:K.attempt_token},F=encodeURIComponent(K.operation_id);return{fence:Y,op:F,complete:(U,C={})=>w(`/operations/${F}/complete`,{...Y,status:U,...C}),emit:(U,C)=>{let X=($.chain??Promise.resolve()).catch(()=>{return}).then(()=>P(U,C));return $.chain=X,X}};async function P(U,C){let X=$.eventSeq,Q=(L)=>w(`/operations/${F}/events`,{...Y,event_seq_start:L,events:[{kind:U,payload:{sequence:L,capability:String(K.capability??"hands.connect"),data:C}}]}),j=X,E=await Q(j),I=E.status===409?E.json?.expected_event_seq:void 0;if(typeof I==="number"&&I===X+1)E={status:200,json:{duplicate:!0}};else if(typeof I==="number"&&I>=0&&I!==X)j=I,E=await Q(j);if(E.status<300)$.eventSeq=j+1;return E}}function xJ($){return(K,Y)=>new Promise((F,P)=>{if(Z.turn!==$){P(Error("vm_hands_attempt_ended"));return}if($.outbox??=[],$.outbox.length>=dJ){P(Error("vm_hands_outbox_full"));return}$.outbox.push({kind:K,data:Y,resolve:F,reject:P}),Z.flush?.()})}function zJ($){if(n)return;n=!0,(async()=>{try{while($.outbox?.length&&Z.turn===$&&B.readyState===WebSocket.OPEN){let K=$.outbox[0],Y;try{Y=await _($).emit(K.kind,K.data)}catch(F){if(F instanceof h)return;Y={status:500}}if($.outbox.shift(),Y.status<300)K.resolve();else K.reject(Error(`${K.kind} refused ${Y.status}`))}}finally{n=!1}})()}async function IJ($,K){try{let Y=await J.agent.attestFrame($,K);if(B.readyState!==WebSocket.OPEN)return;c(Y);let F=await m(["attested","attest_refused"],15000);Z.attest=F.t==="attested"?"accepted":"refused";for(let P of Z.attestWaiters.splice(0))P(Z.attest==="accepted");if(G("vm_hands.attest",{result:Z.attest,exit_code:Y.exit_code,...F.t==="attest_refused"?{code:String(F.code??"")}:{}}),Z.attest==="refused")B.close(4401,"attest_refused")}catch(Y){G("vm_hands.attest_failed",{code:Y instanceof W?Y.code:"probe_error"});for(let F of Z.attestWaiters.splice(0))F(!1);if(Z.attest!=="accepted")B.close(4000,"attest_unanswered")}}async function EJ($){let K=l&&Z.attest==="pending",Y=$.vm_hands_attest,F=Y;if(Z.attest==="refused"){G("vm_hands.claim_attest_refused",{said:typeof Y==="string"?Y.slice(0,16):typeof Y,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(F==="accepted"){if(!K&&Z.attest!=="accepted"){Z.attest="accepted";for(let L of Z.attestWaiters.splice(0))L(!0)}}else if(F!=="pending"||!K){G("vm_hands.claim_attest_refused",{said:typeof Y==="string"?Y.slice(0,16):typeof Y,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Z.attest!=="accepted"){let L=Date.parse($.lease_until)-Date.now()-5000,H=Math.max(0,Math.min(u,Number.isFinite(L)?L:u));if(!await new Promise((q)=>{let O=setTimeout(()=>q(!1),H);Z.attestWaiters.push((k)=>{clearTimeout(O),q(k)})})){await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let P={claim:$,eventSeq:0},{complete:U,emit:C}=_(P),X;try{if($.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not hands.connect");X=!e($)}catch(L){G("vm_hands.bind_refused",{code:L instanceof W?L.code:"unexpected"}),await U("failed",{error_code:L instanceof W?L.code:"vm_hands_bind_invalid"});return}let Q;try{Q=await J.agent.bind(NJ($))}catch(L){G("vm_hands.bind_refused",{code:L instanceof W?L.code:"unexpected"}),await U("failed",{error_code:L instanceof W?L.code:"vm_hands_bind_failed"});return}let j={...Q.ready_data??J.readyData({launchId:Q.launch_id,claim:$})};if(X)delete j.environment_installed;p.turn={claim:$,launchId:Q.launch_id,readyData:j,eventSeq:P.eventSeq,ackSeq:-1};let E=await C("hands.ready",{...j,vm_hands:{layout:Q.layout,policy_digest:Q.policy_digest,launch_id:Q.launch_id}});if(p.turn=null,E.status>=300){await AJ(Z),await J.agent.boundRefused(),await U("failed",{error_code:String(E.json?.error??"vm_hands_probe_failed")});return}let I={claim:$,launchId:Q.launch_id,readyData:j,eventSeq:P.eventSeq,ackSeq:-1};Z.turn=I,Z.flush=()=>zJ(I),J.onTurn?.(xJ(I)),await GJ(I)}async function GJ($){let{fence:K,op:Y}=_($),F=null,P=null,U=J.agent.executorExited().then((C)=>{return P=C,null});J:for(;;){let C=await Promise.race([U,w(`/operations/${Y}/heartbeat`,{...K,control_ack_seq:$.ackSeq,wait_ms:bJ})]);if(!C){F="vm_hands_executor_exited",G("vm_hands.executor_exited",{reason:P});break}if(C.status>=300)break;let X=(C.json?.controls??[]).slice().sort((Q,j)=>Q.seq-j.seq);for(let Q of X){if(Q.seq<=$.ackSeq)continue;if(Q.kind==="operation.cancel"||Q.kind==="cancel"){$.ackSeq=Q.seq;break J}if(Q.kind===qJ)try{await wJ($,Q.payload??{})}catch(j){if(j instanceof h)throw j;F=j instanceof W?j.code:"environment_unavailable",G("vm_hands.environment_refused",{code:F});break J}$.ackSeq=Q.seq}}await OJ($,F)}async function _J($){let K=$,Y={claim:K,eventSeq:0},{complete:F,emit:P,fence:U,op:C}={..._(Y)},X=$.vm_hands_origin==="person"?"person":"model",Q=String($.capability??"");if(!J.executeOp){await F("failed",{error_code:"vm_hands_op_unsupported"});return}if($.vm_hands_attest==="accepted"&&Z.attest==="pending"&&!(l&&Z.attest==="pending")){Z.attest="accepted";for(let q of Z.attestWaiters.splice(0))q(!0)}if(Z.attest!=="accepted"){let q=Date.parse(String($.lease_until??""))-Date.now()-5000,O=Z.attest==="refused"?0:Math.max(0,Math.min(u,Number.isFinite(q)?q:u));if(!(O>0&&await new Promise((XJ)=>{let hJ=setTimeout(()=>XJ(!1),O);Z.attestWaiters.push((TJ)=>{clearTimeout(hJ),XJ(TJ)})}))){await F("failed",{error_code:"vm_hands_unattested"});return}}if(X==="model"&&(J.agent.phase!=="bound"||J.agent.boundRunId!==K.run_id)){await F("failed",{error_code:"vm_hands_not_bound"});return}if(pJ.has(Q)&&J.agent.phase!=="bound"){await F("failed",{error_code:"vm_hands_not_bound"});return}let j=new AbortController;s.add(j);let E,I=new Promise((q)=>{E=q}),L={abort:j,settled:I};if(X==="model")Z.modelOps.add(L);let H=-1,YJ=setInterval(()=>{w(`/operations/${C}/heartbeat`,{...U,control_ack_seq:H,wait_ms:0}).then((q)=>{if(q.status>=300){j.abort();return}let O=q.json?.controls??[];for(let k of O)if(H=Math.max(H,k.seq),k.kind==="operation.cancel"||k.kind==="cancel")j.abort()},()=>j.abort())},mJ);try{let q=await J.executeOp({kind:X,claim:$,signal:j.signal,emit:async(O)=>{await P(O.kind,O.data??{})}});await F(q.status,{...q.result?{result:q.result}:{},...q.error_code!==void 0?{error_code:q.error_code}:{}}),G("vm_hands.op",{capability:Q,kind:X,status:q.status,code:q.error_code??null})}finally{clearInterval(YJ),s.delete(j),Z.modelOps.delete(L),E()}}async function OJ($,K){if(Z.turn===$)Z.turn=null;J.onTurn?.(null),o($);let Y=await f(Z,J.agent);Z.receipts.push({turn:$,failure:K,unbound:Y}),await KJ()}async function KJ(){while(Z.receipts.length){let{turn:$,failure:K,unbound:Y}=Z.receipts[0],{complete:F,emit:P}=_($);try{if(await P("hands.stopped",{...$.readyData,reason_code:K?"failed":"cancelled",killed_verified:Y.killed_verified,shredded:Y.shredded,...Y.srt_fallbacks?{vm_hands_srt_fallbacks:Y.srt_fallbacks}:{}}),K)await F("failed",{error_code:K});else await F("cancelled",{error_code:"driver_stopped"})}catch(U){if(U instanceof h)return}Z.receipts.shift()}}async function wJ($,K){let{fence:Y,op:F}=_($),P=K.snapshot_id;if(K.version!==1||typeof P!=="string"||Object.keys(K).length!==2)throw new W("vm_hands_env_invalid","invalid environment delivery");let U=await w(`/operations/${F}/environment`,{...Y,snapshot_id:P}),C=U.json?.environment_sealed;if(U.status!==200||!C||U.json?.payload!==void 0)throw new W("vm_hands_env_invalid","environment not delivered sealed");let X=await J.agent.deliverEnvironment({attemptId:$.claim.attempt_id,snapshotId:P,deviceId:Z.deviceId??"",sealed:C});if((await w(`/operations/${F}/environment-ack`,{...Y,...X})).status>=300)throw new W("vm_hands_env_ack_refused","environment ack refused")}}
-export{aJ as u,VJ as v,zZ as w};

package/bin/vm-hands/vm-hands-executor-awmj0jkq.js

@@ -1,9 +0,0 @@
-// @bun
-import{Ka as s,ob as i,qa as t,sb as n}from"./vm-hands-entry-lite-815h1kvr.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-cgm3es3w.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";import{spawn as Zq}from"child_process";import{chmodSync as $q,chownSync as zq,existsSync as Qq,lstatSync as S,mkdirSync as Wq,mkdtempSync as Gq,readdirSync as m,readFileSync as F,realpathSync as Jq,rmSync as Yq,writeFileSync as u}from"fs";import{join as U}from"path";var o="/sys/fs/cgroup/reason-payload",k="vm-hands",Kq="/run/ara-srt/fallbacks.jsonl",E="/reason-person",Bq=5000,bq=1e4,c="__VM_HANDS_PROOF_DIR__",Tq="__VM_HANDS_PROBE_NONCE__";class L extends Error{code;constructor(q,W){super(W);this.code=q}}var Lq=30000,e=(q)=>`'${q.replaceAll("'","'\\''")}'`;function xq(q){let W=q.cgroup??o,J=q.init.layout.payload_uid,X=q.log??(()=>{}),Q=null,Z=0,T=()=>{try{let z=F("/run/ara-srt/starts.jsonl","utf8"),$=z.slice(Z>z.length?0:Z).split(`
-`).filter(Boolean);Z=z.length;let G=$.map((Y)=>{try{return Number(JSON.parse(Y).elapsed_ms)||0}catch{return 0}});if(G.length)X("vm_hands.srt_server_starts",{count:G.length,elapsed_ms:G.slice(0,8)})}catch{}},j=null,D=!1,C=q.srtCgroup??"/sys/fs/cgroup/reason-srt",R=()=>{j??=Iq()},N=0,A=()=>{try{let z=F(Kq,"utf8"),$=z.slice(N>z.length?0:N);N=z.length;let G=$.split(`
-`).filter(Boolean).slice(0,1000);if(!G.length)return null;let Y={},K=0;for(let b of G)try{let M=JSON.parse(b),I=typeof M.code==="string"&&/^[a-z_]{1,40}$/.test(M.code)?M.code:"other";if(Y[I]=(Y[I]??0)+1,typeof M.elapsed_ms==="number")K=Math.max(K,M.elapsed_ms)}catch{Y.unparsed=(Y.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:G.length,codes:Y,max_elapsed_ms:K}),{count:G.length,codes:Y,max_elapsed_ms:K}}catch{return null}},v=!1,qq=(z,$,G)=>{if(v)throw Error("vm_hands_pool_held");return H(z,$,G)},H=(z,$,G)=>Zq("/bin/sh",["-c",`echo $$ > ${e(U(W,k,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",z,...$],G),Xq=(z)=>H(z.command,z.args,z.options),P=q.prespawn?s({spawnProcess:qq,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(z,$)=>X(z,$??{})}):null;P?.arm();let h=P?setInterval(()=>{if(!Q)P.arm()},Lq):null;h?.unref?.();async function y(){let z=Q;if(Q=null,!z)return;z.abort.abort(),await z.done}return{async startExecutor(z){if(R(),D=!0,!z.claim)throw new L("vm_hands_bind_invalid","an executor needs the claim it serves");await y();let $=z.claim,G=$.owner;if(!G||typeof G.device_id!=="string"||typeof $.root_id!=="string")throw new L("vm_hands_bind_invalid","claim without its owner Device or root");let Y=new AbortController,K,b,M=new Promise((B,O)=>{K=B,b=O}),I,w=new Promise((B)=>{I=B}),g=n({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:G.device_id,rootId:$.root_id,apiOrigin:q.apiOrigin},claimOwner:$.owner,root:q.root,runId:$.run_id,operationId:$.operation_id,attemptId:$.attempt_id,payload:Object.fromEntries(Object.entries($.payload).filter(([B])=>!B.startsWith("vm_hands_"))),signal:Y.signal,emitEvent:async(B,O)=>{if(B==="hands.ready"){K(O);return}if(B==="hands.started"||B==="hands.stopped"||B==="hands.failed")return;await q.forward(B,O)}},{...q.relayDependencies,spawnWorker:Xq,...P?{takePrespawnedWorker:P.take,adoptSpawnedWorker:P.adopt}:{}}).then(()=>{I("executor_stopped")},(B)=>{let O=B&&typeof B==="object"&&"code"in B?String(B.code):"executor_failed";b(new L(O,B instanceof Error?B.message:String(B))),I(O)}).finally(()=>b(new L("vm_hands_executor_exited","executor ended before it was ready")));Q={abort:Y,done:g,exited:w,operationId:$.operation_id,runId:$.run_id,expiresAtMs:Date.parse(String($.payload.expires_at??""))||0};let V=await M,x=V.executor_launch_id;if(typeof x!=="string")throw new L("vm_hands_bind_failed","executor ready without a launch id");return{launchId:x,readyData:V,applied:{hands_confinement:typeof $.payload.hands_confinement==="string"?$.payload.hands_confinement:null,browser_egress:$.payload.browser_egress??null}}},takeSrtFallbacks:A,executorExited(){return Q?Q.exited:new Promise(()=>{})},async killAndVerifyPayload(){v=!0;let z=Aq();try{await Dq(),await y().catch(()=>{return}),T();let $=Date.now()+Bq;await p(W,$,"payload");let G=(D||q.srtWarmLate?.()===!0)&&Qq(U(C,"cgroup.events"));if(G)await p(C,$,"srt");let Y=Cq(J).filter((K)=>!l(K,E));if(j!==null){let K=Mq(j).filter((b)=>b!==process.pid&&!l(b,E));if(K.length)throw X("vm_hands.kill_strays",{strays:K.slice(0,16).map((b)=>{let M="?",I="?";try{M=F(`/proc/${b}/comm`,"utf8").trim().slice(0,32)}catch{}try{I=(F(`/proc/${b}/cgroup`,"utf8").split(`
-`).find((w)=>w.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:b,comm:M,cgroup:I}})}),new L("vm_hands_kill_unverified",`${K.length} process(es) the run started survived it`);j=null}if(D=!1,G)q.onSrtReset?.();if(Y.length)throw X("vm_hands.kill_survivors",{pids:Y.slice(0,16)}),new L("vm_hands_kill_unverified",`${Y.length} payload-uid process(es) outside the payload cgroup`)}finally{v=!1,z()}if(P)setTimeout(()=>{if(!Q)P.arm()},100).unref?.()},async runProbe({nonce:z,script:$}){if(R(),!$.includes(c))throw new L("vm_hands_probe_failed","probe names no proof directory");let G=q.proofParent??"/tmp/reason-vm-hands-proof";Wq(G,{mode:457,recursive:!0});let Y=S(G);if(Y.isSymbolicLink()||!Y.isDirectory()||Y.uid!==(process.getuid?.()??-1)||(Y.mode&4095)!==457)throw new L("vm_hands_probe_failed","proof parent is not root's 0711 directory");let K=Gq(U(G,"p-")),b=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(K)||!/^[A-Za-z0-9_-]{1,128}$/.test(z))throw new L("vm_hands_probe_failed","proof directory path or nonce");zq(K,J,J),$q(K,448);let M=S(K).ino,I=H("/bin/bash",["-c",$.replaceAll(c,K).replaceAll(Tq,z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),w="";I.stdout?.on("data",(V)=>{if(w.length<16384)w+=V.toString("utf8").slice(0,16384-w.length)});let g=await new Promise((V)=>{let x=setTimeout(()=>{b=!0,I.kill("SIGKILL"),V(124)},bq);I.once("error",()=>{clearTimeout(x),V(127)}),I.once("close",(B)=>{clearTimeout(x),V(B??1)})});return X("vm_hands.probe",{nonce_len:z.length,exit_code:g}),{exitCode:g,markers:w,proofDirInode:M}}finally{if(!b)Yq(K,{recursive:!0,force:!0})}},restatLayout(){let{session_root:z,alias:$}=q.init.layout,G="invalid";try{i(z),G="0:0:755"}catch{}let Y=!1,K=-1;try{let b=S($);K=b.uid,Y=G==="0:0:755"&&$===U(z,"repo")&&!b.isSymbolicLink()&&b.isDirectory()&&Jq($)===$&&b.uid===J}catch{}return{root_mode:G,alias_ok:Y,owner_uid:K}},installEnvironment(z){let $=Q;if(!$)throw new L("environment_unavailable","no executor owns an environment");return t({root:q.root,operationId:$.operationId,payload:z}).installed_revision},async stop(){if(h)clearInterval(h);P?.close(),await y()}}}function l(q,W,J="/proc"){try{let Q=F(U(J,String(q),"cgroup"),"utf8").split(`
-`).find((Z)=>Z.startsWith("0::"))?.slice(3)??"";return Q===W||Q.startsWith(`${W}/`)}catch{return!1}}var Uq=100;function Iq(){try{return Math.floor(Number(F("/proc/uptime","utf8").split(" ")[0])*Uq)}catch{return 0}}async function p(q,W,J){try{u(U(q,"cgroup.freeze"),"1")}catch(X){throw new L("vm_hands_kill_unverified",`${J} cgroup.freeze: ${X instanceof Error?X.message:String(X)}`)}while(!/^populated 0$/m.test(F(U(q,"cgroup.events"),"utf8"))){if(Date.now()>W)throw new L("vm_hands_kill_unverified",`${J} cgroup still populated (left frozen)`);for(let X of Nq(q)){if(!Fq(X,q))continue;try{process.kill(X,"SIGKILL")}catch{}}await new Promise((X)=>setTimeout(X,10))}try{u(U(q,"cgroup.freeze"),"0")}catch(X){throw new L("vm_hands_kill_unverified",`${J} cgroup thaw: ${X instanceof Error?X.message:String(X)}`)}}function Fq(q,W){let J=W.replace(/^\/sys\/fs\/cgroup/,"")||"/",X="";try{X=F(`/proc/${q}/cgroup`,"utf8").split(`
-`).find((Z)=>Z.startsWith("0::"))??""}catch{return!1}let Q=X.slice(3);return Q===J||Q.startsWith(`${J}/`)}function Nq(q){let W=[],J=(X)=>{try{for(let Z of F(U(X,"cgroup.procs"),"utf8").split(`
-`))if(/^\d+$/.test(Z))W.push(Number(Z))}catch{}let Q=[];try{Q=m(X,{withFileTypes:!0}).filter((Z)=>Z.isDirectory()).map((Z)=>Z.name)}catch{}for(let Z of Q)J(U(X,Z))};return J(q),W}function Mq(q,W="/proc"){let J=[];for(let X of m(W)){if(!/^\d+$/.test(X))continue;let Q;try{Q=F(U(W,X,"stat"),"utf8")}catch{continue}let Z=Q.slice(Q.lastIndexOf(")")+2).split(" "),T=Number(Z[1]),j=Number(Z[6]),D=Number(Z[19]);if(!((j&2097152)!==0||T===2||X==="2")&&Z[0]!=="Z"&&D>=q)J.push(Number(X))}return J}function Cq(q,W="/proc"){let J=[];for(let X of m(W)){if(!/^\d+$/.test(X))continue;let Q;try{Q=F(U(W,X,"status"),"utf8")}catch{continue}let Z=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(Q);if(Z&&Z.slice(1).some((T)=>Number(T)===q))J.push(Number(X))}return J}function d(q="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(F(q,"utf8").trim())>=1}catch{return!1}}var f=0,r=[],_=new Set;function Aq(){f++;let q=!1;return()=>{if(q)return;if(q=!0,--f===0)for(let W of r.splice(0))W()}}function jq(){return f===0?Promise.resolve():new Promise((q)=>{r.push(q)})}async function a(){while(f>0)await jq()}async function Dq(){let q=Date.now()+1000;while(_.size&&Date.now()<q)await new Promise((W)=>setTimeout(W,2))}function Rq(q,W){let J=W.replace(/^\/sys\/fs\/cgroup/,"");_.add(q);let X=()=>{let Q="";try{Q=F(`/proc/${q}/cgroup`,"utf8").split(`
-`).find((Z)=>Z.startsWith("0::"))??""}catch{_.delete(q);return}if(Q.slice(3)===J){_.delete(q);return}setTimeout(X,1)};X()}function gq(q){let W={person:q.personCgroup??U("/sys/fs/cgroup",E,k),model:q.payloadCgroup??U(o,k)},J=q.entry??process.argv[1]??"",X={},Q=(Z)=>{let T=new Map,j=String(q.payloadUid),D=String(q.payloadGid),C=Bun.spawn(["/bin/sh","-c",`echo $$ > ${e(U(W[Z],"cgroup.procs"))} || exit 125; exec /usr/bin/setpriv --no-new-privs --reuid=${j} --regid=${D} --clear-groups -- "$@"`,"vm-hands-op-join",process.execPath,J,"--vm-hands-op-runner"],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:"/home/runner"},stdio:["ignore","ignore","ignore"],ipc(N){let A=N,v=T.get(A.id);if(!v)return;if(A.t==="event"&&A.event)v.onEvent(A.event);if(A.t==="done")T.delete(A.id),v.done(A.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});C.exited.then((N)=>{if(X[Z]?.child===C)delete X[Z];for(let[,A]of T)A.done({status:"failed",error_code:"vm_hands_op_runner_exited"});T.clear(),q.log?.("vm_hands.op_runner_exited",{kind:Z,code:N})}),Rq(C.pid,W[Z]);let R={child:C,pending:T};return X[Z]=R,R};return{run(Z,T,j,D){if(!d())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let C=async()=>{while(!X[Z]&&f>0)await a()};return C().then(async()=>{if(!X[Z]&&f>0)await C()}).then(()=>new Promise((R)=>{if(!X[Z]&&f>0){R({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let N=X[Z]??Q(Z);N.pending.set(T.id,{onEvent:j,done:R}),D.addEventListener("abort",()=>{try{N.child.send({t:"cancel",id:T.id})}catch{}},{once:!0});try{N.child.send({t:"op",...T})}catch{N.pending.delete(T.id),R({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(Z){if(!X[Z]&&d())a().then(()=>{if(!X[Z]&&f===0)Q(Z)})},stop(){for(let Z of Object.keys(X))X[Z]?.child.kill()}}}export{Nq as subtreePids,d as ptraceProtected,Mq as processesStartedSince,Cq as payloadUidProcesses,l as inCgroup,gq as createVmHandsOpRunners,xq as createVmHandsExecutor,L as VmHandsExecutorError,c as VM_HANDS_PROOF_DIR_TOKEN,Tq as VM_HANDS_PROBE_NONCE_TOKEN,E as VM_HANDS_PERSON_CGROUP,k as VM_HANDS_PAYLOAD_JOIN,o as VM_HANDS_PAYLOAD_CGROUP};

package/bin/vm-hands/vm-hands-runtime-wrs4s3nb.js

@@ -1,4 +0,0 @@
-// @bun
-import{u as y,v as k,w as m}from"./vm-hands-entry-lite-z662b8yj.js";import{Wc as v}from"./vm-hands-entry-lite-8st97h7b.js";import"./vm-hands-entry-lite-q6fshf3h.js";import{Oh as K}from"./vm-hands-entry-lite-hf0mk7vd.js";import{spawn as n}from"child_process";import{createHash as i}from"crypto";import{lstatSync as T,mkdirSync as d,readFileSync as a,statSync as r,writeFileSync as l}from"fs";var A="/run/reason-vm-hands",E="/run/reason-vm-hands/env",f="/home/runner",t=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,O="/sys/fs/cgroup/reason-srt",R="/usr/local/bin/ara-srt-exec",e=65536,jj=21600000;function qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;d(j,{recursive:!0,mode:448});let q=T(j);if(!q.isDirectory()||q.uid!==0||(q.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}l(`${j}/base-keyed`,`1
-`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function S(Q,j){let q=(G)=>{return j("srt_warm_skipped",{reason:G}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return q("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>e||Z.toString("base64")!==Q.srt_base_settings)return q("settings_invalid");try{let G=T(O);if(!G.isDirectory()||G.uid!==0||(G.mode&18)!==0)return q("cgroup_unsafe");for(let[Y,N]of[[R,!1],["/usr/local/bin",!0]]){let B=T(Y);if((N?!B.isDirectory():!B.isFile())||B.uid!==0||(B.mode&18)!==0)return q("srt_exec_unsafe")}}catch{return q("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return q("not_root");let z=performance.now(),X=i("sha256").update(Z).digest("hex"),M=`${A}/srt-base-settings.json`;try{l(M,Z,{mode:384,flag:"w"})}catch{return q("settings_write")}let H=n("/bin/sh",["-c",`echo $$ > ${O}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",R,"--settings",M,"--idle-ms",String(jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((G)=>{H.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),G()}),H.once("close",(Y)=>{j(Y===0?"srt_warm_done":"srt_warm_failed",{exit_code:Y,warm_ms:Math.round(performance.now()-z),settings_sha256:X}),G()})})}var p=3000;function Yj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,q=j.layout,Z=j.device_key,z=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&t.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!z&&typeof z.key_id==="string"&&Number.isSafeInteger(z.expires_at_ms)&&typeof z.signature==="string"&&!!q&&typeof q.session_root==="string"&&typeof q.alias==="string"&&Number.isSafeInteger(q.payload_uid)&&typeof q.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function u(Q){d(Q,{recursive:!0,mode:448});let j=r(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Jj(Q){let[{CLI_VERSION:j},q,Z,z]=await Promise.all([import("./version-yy031dwn.js"),import("./hands-worker-source-w477y8ad.js"),import("./network-contract-ggqak7gp.js"),import("./device-workspace-ecq3hfd6.js")]),{REASON_HANDS_PROTOCOL_VERSION:X}=await import("./reason-hands-protocol-as5477xr.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:q.REASON_HANDS_WORKER_VERSION,protocol_version:X,worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:z.REASON_WORKSPACE_BASE,workspace_layout:z.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var g=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],Qj=new Set(["pty.start","jobs.control"]);function Zj(Q,j){let q=j([{id:"vm-hands",label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(g.map((X)=>[X,!0]))}}),Z=Q.capabilities,z={...Z.operation_constraints};for(let X of g)z[X]={...q.operation_constraints?.[X]??{},ready:!0,execution_mode:q.operation_constraints?.[X]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...g],operation_constraints:z}}}function $j(Q){for(let j of a("/etc/passwd","utf8").split(`
-`)){let q=j.split(":");if(q.length>=4&&Number(q[2])===Q&&/^\d+$/.test(q[3]??"")&&Number(q[3])>0)return Number(q[3])}throw Error("vm_hands_payload_account_unavailable")}function zj(Q,j){let q=j.owner;if(!q||typeof q.organization_id!=="string"||typeof q.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Hj(Q,j){u(A),u(E),qj(j);let q=S(Q,j),Z=!1,z=async()=>{if(!await Promise.race([q.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),p).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:p})},[{configureDesktopAccount:X},{configureWorkerSandbox:M}]=await Promise.all([import("./desktop-account-axaenf68.js"),import("./worker-sandbox-snmfpfax.js")]);M();try{X({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let H=new AbortController;for(let J of["SIGTERM","SIGINT"])process.on(J,()=>H.abort());let G=null,Y,N=new Promise((J)=>{Y=J}),B=N.then(()=>import("./vm-hands-executor-awmj0jkq.js")).then(({createVmHandsExecutor:J})=>{let $=J({init:Q,root:f,runtimeDirectory:A,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,q=S(Q,j)},srtWarmLate:()=>Z,forward:(U,L)=>G?G(U,L):Promise.reject(Error("vm_hands_not_bound")),log:(U,L)=>j(U,L)});return j("executor_loaded"),$}),C=(J)=>async(...$)=>(await B)[J](...$),V=null;B.then((J)=>{V=()=>J.executorExited()});let W={startExecutor:async(...J)=>{return await z(),C("startExecutor")(...J)},killAndVerifyPayload:C("killAndVerifyPayload"),runProbe:async(...J)=>{return await z(),C("runProbe")(...J)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:()=>V?V():new Promise(()=>{}),takeSrtFallbacks:()=>null};B.then((J)=>{W.restatLayout=()=>J.restatLayout(),W.installEnvironment=($)=>J.installEnvironment($),W.takeSrtFallbacks=()=>J.takeSrtFallbacks?.()??null});let s=await y(Q),c=new k(Q,s,W,{envRoot:E}),x=Jj(Q),I=null,o=Promise.all([x,import("./local-capabilities-hdm858r9.js")]).then(([J,$])=>{I=Zj(J,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((J)=>j("device_ops_unavailable",{error:J instanceof Error?J.name:"error"})),D=N.then(()=>import("./vm-hands-executor-awmj0jkq.js")).then(({createVmHandsOpRunners:J})=>J({payloadUid:Q.layout.payload_uid,payloadGid:$j(Q.layout.payload_uid),log:($,U)=>j($,U)})).catch(()=>null);D.then((J)=>J?.warm("person")),j("agent_ready"),await m({apiOrigin:Q.api_origin,agent:c,signal:H.signal,heartbeat:async()=>I??await x,executeOp:async({kind:J,claim:$,signal:U,emit:L})=>{let b=zj(Q,$);if(!b)return{status:"failed",error_code:"vm_hands_bind_invalid"};let w={executionMode:"unsandboxed",runtimeDirectory:A,readiness:Object.fromEntries(g.map((F)=>[F,!0]))},h=(F)=>{let P=typeof F.kind==="string"?F.kind:"";if(P)L({kind:P,...F.data&&typeof F.data==="object"?{data:F.data}:{}})};if($.capability==="exec.full"&&J!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&J!=="model")return{status:"failed",error_code:"capability_not_granted"};if(Qj.has(String($.capability))){let{executeLocalOperation:F}=await import("./local-capabilities-hdm858r9.js");return F(b,$,{worker:w,signal:U,emit:(P)=>h(P)})}let _=await D;if(!_)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return _.run(J,{id:String($.attempt_id),claim:$,state:b,worker:w},h,U)},readyData:({launchId:J})=>({executor_launch_id:J}),log:(J,$)=>{if(J==="vm_hands.registered"||J==="vm_hands.reconnected")Y();j(J,$)},onTurn:(J)=>{G=J}}),await(await B).stop(),(await D)?.stop()}export{S as startBaseSrtServer,Hj as runVmHands,Yj as parseVmHandsInit,Jj as heartbeatBody,qj as enableBaseKeyedSrt};