@reason-machines/cli-linux-arm64-musl 0.2.314 → 0.2.315
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/ara +2 -2
- package/bin/vm-hands/{connect-cli-edkrs4p6.js → connect-cli-kxkvwnwa.js} +1 -1
- package/bin/vm-hands/{local-automation-3tg97fb8.js → local-automation-7w9j1nws.js} +1 -1
- package/bin/vm-hands/{local-capabilities-rb17efqw.js → local-capabilities-6smn23kd.js} +1 -1
- package/bin/vm-hands/{local-display-session-4jnfvpv1.js → local-display-session-7pds34s8.js} +1 -1
- package/bin/vm-hands/{network-contract-ggqak7gp.js → network-contract-57qe40tm.js} +1 -1
- package/bin/vm-hands/{permissions-5kqh2dqz.js → permissions-hy10xxeg.js} +1 -1
- package/bin/vm-hands/{status-gp9kxbq1.js → status-b63rer3v.js} +2 -2
- package/bin/vm-hands/{version-jp149s8j.js → version-ktk9b8p6.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-qssnr12b.js → vm-hands-entry-lite-53cyjs1a.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-3tp9yvsn.js → vm-hands-entry-lite-5z6prrcd.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-njt12v46.js → vm-hands-entry-lite-79ww0h62.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-btwvn63p.js +42 -0
- package/bin/vm-hands/{vm-hands-entry-lite-hzkc742v.js → vm-hands-entry-lite-c3jqrn7n.js} +23 -23
- package/bin/vm-hands/{vm-hands-entry-lite-fws38v57.js → vm-hands-entry-lite-gx1z18j4.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-11qqexwe.js → vm-hands-entry-lite-mgn96c0f.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-hmff1sqa.js → vm-hands-entry-lite-msgz8sgz.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-abfcsza2.js → vm-hands-entry-lite-t4hkghhm.js} +37 -37
- package/bin/vm-hands/{vm-hands-entry-lite-ksd4969g.js → vm-hands-entry-lite-v2wx52wn.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
- package/bin/vm-hands/{vm-hands-executor-rzz9q5jj.js → vm-hands-executor-sd4qj8xc.js} +1 -1
- package/bin/vm-hands/{vm-hands-op-runner-mwmgvdh0.js → vm-hands-op-runner-krvw3y2n.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-rkpxmsd0.js → vm-hands-runtime-t87hg6ne.js} +3 -3
- package/package.json +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-8st97h7b.js +0 -42
|
@@ -1,31 +1,31 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{$a as a6,Ea as l6,Ga as O4,Ha as j4,Ma as c6,Na as n6,Xa as A4,ab as i6,bb as k4,cb as f4,eb as o6,ga as X4,gb as V8,hb as y0,ia as Y2,ib as m0,ja as W4,jb as n1,ka as Y4,la as F4,ma as f6,mb as t6,na as x6,oa as L4,pa as y6,pb as G8,qa as T3,qb as T4,ra as h6,sa as m6,sb as e6,ta as v6,ua as p6,va as w4,wa as u6,xa as d6}from"./vm-hands-entry-lite-hzkc742v.js";import{Ab as n0,Bb as r0,Ib as P0,tb as o3,ub as g6,vb as S6}from"./vm-hands-entry-lite-rrk5g62b.js";import{Jb as $7,Mb as J7,Ob as Z7,Pb as Q7}from"./vm-hands-entry-lite-ya1a2eep.js";import{Ub as s6}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Vb as P6,Wb as z6,Xb as q6,Yb as E6,Zb as L0}from"./vm-hands-entry-lite-n07kxrd1.js";import{$b as t1,ac as e1,bc as k3,dc as f3,fc as b3,gc as x3,kc as y3}from"./vm-hands-entry-lite-0ergg2ky.js";import{Bc as a1,Ec as M7,Nc as L7}from"./vm-hands-entry-lite-ksd4969g.js";import{$c as d,$d as k8,Ad as j6,Cd as I6,Dd as A6,Ed as T6,Fd as _6,Gd as R6,Ld as L8,Md as w8,Nd as O8,Oc as L1,Od as j8,Pc as K2,Pd as I8,Qc as J6,Qd as A8,Rc as A3,Sc as a3,Sd as T8,Tc as i3,Td as _8,Uc as M0,Ud as R8,Vd as P8,Wd as z8,Xd as q8,Yc as N0,Yd as E8,Zd as g8,_d as S8,ad as E1,dd as M8,fd as g1,hd as Z6,id as Q6,jd as K6,kd as B6,ld as V6,md as G6,nd as U6,od as X6,pd as W6,qd as Y6,rd as F6,sd as N6,td as C6,ud as H6,vd as D6,wd as M6,xd as L6,yd as w6,zd as O6}from"./vm-hands-entry-lite-8st97h7b.js";import{ae as V}from"./vm-hands-entry-lite-q6fshf3h.js";import{Ae as s1,be as F7,ce as N7,de as C7,ee as H7,fe as D7,le as d5,pe as B5,qe as R5,we as w7,ze as V5}from"./vm-hands-entry-lite-hmff1sqa.js";import{Ze as I4,ef as r6}from"./vm-hands-entry-lite-pf1ft65e.js";import{jf as L3,wf as k6}from"./vm-hands-entry-lite-q2pb31vh.js";import{Bg as K7,Cg as B7,Dg as V7,Eg as G7,Gg as U7,Hg as X7,Jg as W7,Kg as Y7}from"./vm-hands-entry-lite-6j2yaa4n.js";import{Yg as r1}from"./vm-hands-entry-lite-7k65s010.js";import{$g as b6,_g as j1,ah as D4,bh as M4}from"./vm-hands-entry-lite-em388nee.js";import{dh as M3,fh as $1,lh as B8,mh as Z4}from"./vm-hands-entry-lite-yp315y25.js";import{Kh as H}from"./vm-hands-entry-lite-xsq25kmd.js";import{Oh as i4}from"./vm-hands-entry-lite-hf0mk7vd.js";import{request as p7}from"http";import{request as u7}from"https";async function d7($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?u7:p7)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:f3},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Error("custom_endpoint_timeout"))),K.end($.body)})}function l7($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function s7($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let W=Buffer.allocUnsafe(G.length*Q.length+B),Y=0;for(let X of G){while(B&&Z[B]!==X){let N=K[B-1];Y+=Z.copy(W,Y,0,B-N),B=N}if(Z[B]===X){if(B++,B===Z.length)Y+=Q.copy(W,Y),B=0}else W[Y++]=X}if(U)Y+=Z.copy(W,Y,0,B),B=0;return W.subarray(0,Y)}}async function h3($){$.signal.throwIfAborted();let J=x3.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=y3.parse(await $.credential($.signal));if(!b3(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,W=0,Y=l7(Q.apiKey),X=s7(Q.apiKey,Y),N=async(F,D)=>{$.signal.throwIfAborted(),await new Promise((w,M)=>{let j=()=>{$.signal.removeEventListener("abort",j),M($.signal.reason)};if($.signal.addEventListener("abort",j,{once:!0}),$.signal.aborted){j();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(F,D)}).then(()=>{$.signal.removeEventListener("abort",j),w()},(O)=>{$.signal.removeEventListener("abort",j),M(O)})})},C=async(F)=>{if(G+=F.length,G>e1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let D=0;D<F.length;D+=t1){if(W>=k3)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await N(`custom_endpoint.chunk.${W++}`,{eof:!1,data:F.subarray(D,D+t1).toString("base64")})}};try{let F=await d7({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=F.response,B=F.close;let D=K.statusCode??500;if(D>=300&&D<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let w={};for(let M of["content-type","retry-after","x-request-id","request-id"]){let j=K.headers[M];if(typeof j==="string")w[M]=j.replaceAll(Q.apiKey,Y).slice(0,4096)}await N("custom_endpoint.headers",{status:D,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,Y).slice(0,256),headers:w});for await(let M of K){$.signal.throwIfAborted();let j=Buffer.isBuffer(M)?M:Buffer.from(M);if(U+=j.length,U>e1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(X(j))}return await C(X(Buffer.alloc(0),!0)),await N(`custom_endpoint.chunk.${W}`,{eof:!0}),{bytes:G,chunks:W}}catch(F){if($.signal.throwIfAborted(),F instanceof H)throw F;throw new H("custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as m3}from"path";function c7($,J){return $===m3(J,".ara","workspace")||$===m3(J,".reason","workspace")}function v3($,J){let Z=$.filter((Q)=>c7(Q.path,J));return Z.length===1?Z[0].path:null}var n7=/^[a-f0-9]{64}$/;var $2=32,r7=/^\/[^\x00-\x1f\x7f\\]*$/;function H1($){if(typeof $!=="string"||$.length>4096||!r7.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function D1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!H1(J.home)||!Array.isArray(J.roots)||J.roots.length>$2)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!n7.test(K)||!H1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}import{spawn as i7}from"child_process";import*as z from"fs";import*as s from"path";import{homedir as o7}from"os";function J2($,J,Z,Q="gh"){if(!["gh","git"].includes(Q))throw Error("local_device_gh_unavailable");let K=$.realpathSync(Z),B=Q==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+Q;for(let G of["/opt/homebrew/bin/"+Q,"/usr/local/bin/"+Q,B])try{let U=$.realpathSync(G);if(U===K||U.startsWith(K+J.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...Q==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((Y)=>U.startsWith(Y)))continue;let W=$.statSync(U);if(!W.isFile()||(W.mode&18)!==0||![0,process.getuid()].includes(W.uid))continue;return $.accessSync(U,$.constants.X_OK),U}catch{continue}throw Error("local_device_gh_unavailable")}function p3($,J){let Z=1;for(let Q=0;Q<J;Q+=1)if($.charCodeAt(Q)===10)Z+=1;return Z}var u3=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function Z2($){let J=$.trim().replaceAll("\\","/");if(!J)return{valid:!1,reason:"empty_path"};if(J.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(J.split("/").includes("..")||J.includes("../")||J.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(J===".git"||J.startsWith(".git/")||J.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function d3($){return[...new Set($.map((J)=>J.trim()).filter((J)=>J.length>=8))]}function l3($,J){return[...J.matchAll(new RegExp($.regex.source,`${$.regex.flags}g`))]}function M1($,J=[],Z={}){let Q=[],K=Z.published??new Set,B=d3(J).filter((G)=>!K.has(G));for(let G of $){let U=Z2(G.path);if(!U.valid){Q.push({path:G.path,reason:U.reason??"invalid_path"});continue}let W=G.content??"",Y=B.map((X)=>({secret:X,offset:W.indexOf(X)})).filter((X)=>X.offset>=0).sort((X,N)=>X.offset-N.offset);if(Y.length>0){let X=[...new Set(Y.flatMap((N)=>Z.secretNames?.(N.secret)??[]))];Q.push({path:G.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:p3(W,Y[0].offset),...X.length>0?{secretNames:X}:{}})}for(let X of u3){let N=l3(X,W).find((C)=>!K.has(C[0]));if(N){Q.push({path:G.path,reason:`credential_pattern_detected: ${X.name}`,pattern:X.name,ruleId:X.name,line:p3(W,N.index)});break}}}return{clean:Q.length===0,violations:Q,scannedObjectCount:$.length}}function s3($,J=[]){let Z=d3(J),Q=new Set;for(let{content:K}of $){for(let B of Z)if(K.includes(B))Q.add(B);for(let B of u3)for(let G of l3(B,K))Q.add(G[0])}return[...Q]}function a7($,J){let Z=0;for(let Q=$.indexOf(J);Q>=0;Q=$.indexOf(J,Q+J.length))Z+=1;return Z}function c3($,J,Z){let Q=(K,B)=>K.reduce((G,U)=>G+a7(U,B),0);return new Set($.filter((K)=>Q(J,K)<=Q(Z,K)))}var T0=4194304,n3=536870912,Q2=/^[a-f0-9]{40}$/,t7=($,J,Z)=>new Promise((Q)=>{if(Z.signal?.aborted){Q({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let K;try{K=i7($,J,{cwd:Z.cwd,env:Z.env,detached:!0,stdio:["pipe","pipe","pipe"]})}catch{Q({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let B=Buffer.alloc(0),G=Buffer.alloc(0),U,W=!1,Y=(F)=>{if(U??=Error(F),K.pid)try{process.kill(-K.pid,"SIGKILL")}catch{}},X=()=>Y("cancelled"),N=setTimeout(()=>Y("timeout"),Z.timeout);Z.signal?.addEventListener("abort",X,{once:!0});let C=(F)=>{if(W)return;W=!0,clearTimeout(N),Z.signal?.removeEventListener("abort",X),Q({status:F,stdout:B,stderr:G,...U?{error:U}:{}})};if(K.stdout.on("data",(F)=>{if(B.length+G.length+F.length>Z.maxBuffer)Y("output_limit");else B=Buffer.concat([B,F])}),K.stderr.on("data",(F)=>{if(B.length+G.length+F.length>Z.maxBuffer)Y("output_limit");else G=Buffer.concat([G,F])}),K.on("error",()=>{if(Y("spawn_failed"),!K.pid)C(null)}),K.on("close",(F)=>C(F)),K.stdin.on("error",()=>Y("input_failed")),K.stdin.end(Z.input),Z.signal?.aborted)X()}),e7={command:t7,gh:($,J)=>J2(z,s,$,J),home:o7};function A($){throw Error($)}var $9=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),J9=($)=>JSON.stringify($,(J,Z)=>$9.has(J)?void 0:Z);function r3($,J,Z){let Q=[...new Set($.map((B)=>`${J(B.path)}${B.line?`:${B.line}`:""} (${B.reason==="literal_secret_detected"?`value of ${B.secretNames?.length?B.secretNames.slice(0,3).join(", "):"a session variable"}`:`${B.ruleId??"credential"} credential`})`))].slice(0,10),K=$.some((B)=>B.reason==="literal_secret_detected");A(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${Q.join("; ")}. Nothing was sent. ${Z}${K?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function t3($,J,Z=e7){let Q=L1.parse($);if(!["darwin","linux"].includes(process.platform))A("local_device_gh_platform_unavailable");J.assertCurrent();let K=z.realpathSync(J.root);if(K==="/")A("local_device_gh_root_unavailable");if(!M0(Q)&&!J.forbiddenSecretValues)A("local_device_gh_secret_scope_unavailable");if(!M0(Q)&&J.readOnly)A("local_device_gh_read_only");if(!M0(Q)){let L=M1([{path:"github-operation",content:J9(Q)}],J.forbiddenSecretValues,J.secretNames?{secretNames:J.secretNames}:{});if(!L.clean)r3(L.violations,()=>`the ${Q.kind} request text`,"Remove it from the pull request text and try again.")}let B=Z.gh(K),G=Z.home(),U=J2(z,s,K,"git"),W=J.privateDirectory?z.realpathSync(J.privateDirectory):z.realpathSync(G);if(!M0(Q)&&(!J.privateDirectory||W===K||W.startsWith(K+s.sep)))A("local_device_gh_private_scope_unavailable");let Y={PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:G,GH_CONFIG_DIR:s.join(G,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((L)=>process.env[L]?[[L,process.env[L]]]:[])):{}},X=async(L,T,P=W,k,x=T0)=>{J.assertCurrent();let y=await Z.command(L,T,{cwd:P,env:Y,input:k,maxBuffer:x,timeout:Math.max(1,Math.min(60000,(J.deadlineMs??Date.now()+60000)-Date.now())),signal:J.signal});if(J.assertCurrent(),y.error||y.status!==0)A("local_device_gh_command_failed");return y.stdout},N=async(L)=>(await X(B,L)).toString("utf8").trim(),C=async(L,T="application/vnd.github+json")=>{a3(Q.repoFullName,L,{headers:{accept:T}}),J.assertCurrent();let P=await Z.command(B,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${T}`,L],{cwd:W,env:Y,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal});if(J.assertCurrent(),P.error&&P.status===null)A("local_device_gh_response_unavailable");let k=P.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!k)A("local_device_gh_response_invalid");let x=Number(k[1]);if(x>=200&&x<300&&P.status!==0)A("local_device_gh_response_unavailable");if(Buffer.byteLength(k[3])>K2)A("local_device_gh_response_too_large");let y={};for(let r of k[2].split(/\r?\n/)){let a=r.indexOf(":"),D0=r.slice(0,a).toLowerCase();if(["link","content-type"].includes(D0))y[D0]=r.slice(a+1).trim().slice(0,8192)}return{kind:"read",status:x,headers:y,body:x>=200&&x<300?k[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(Q.kind==="read")return C(Q.path,Q.accept);if(Q.kind==="pr_review_context"){let[L,T]=Q.repoFullName.split("/"),P=await N(["api","graphql","--hostname","github.com","-f",`query=${i3}`,"-f",`owner=${L}`,"-f",`repo=${T}`,"-F",`number=${Q.number}`,...Q.after?["-f",`after=${Q.after}`]:[]]);if(Buffer.byteLength(P)>K2)A("local_device_gh_response_too_large");let k=JSON.parse(P);if(k.errors||k.data?.repository?.nameWithOwner?.toLowerCase()!==Q.repoFullName.toLowerCase()||k.data.repository.pullRequest?.number!==Q.number)A("local_device_gh_response_invalid");return{kind:"pr_review_context",body:P}}if(Q.kind==="pr_merge"){let L=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),T=JSON.parse(L.body),P=(y)=>y.number===Q.number&&y.html_url===`https://github.com/${Q.repoFullName}/pull/${Q.number}`&&y.base?.repo?.full_name?.toLowerCase()===Q.repoFullName.toLowerCase()&&y.base?.ref===Q.expectedBaseRef&&y.head?.sha===Q.expectedHeadSha;if(L.status!==200||!P(T)||T.state!=="open"||T.draft!==!1||T.head?.sha!==Q.expectedHeadSha||T.base?.repo?.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase())A("local_device_gh_merge_target_changed");await N(["pr","merge",String(Q.number),`--repo=${Q.repoFullName}`,`--${Q.method}`,"--match-head-commit",Q.expectedHeadSha]);let k=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),x=JSON.parse(k.body);if(k.status!==200||!P(x)||x.merged!==!0)A("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:Q.number,merged:!0}}if(Q.kind==="pr_create"){if(Q.head===Q.base)A("local_device_gh_default_branch");let L=await N(["pr","create","--repo",Q.repoFullName,"--head",Q.head,"--base",Q.base,`--title=${Q.title}`,`--body=${Q.body}`,...Q.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+Q.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(L))A("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:L}}if(Q.kind==="pr_mutation"){let L=Q.mutation,T=L.action==="edit"?["edit",...L.title!==void 0?[`--title=${L.title}`]:[],...L.body!==void 0?[`--body=${L.body}`]:[],...L.base?[`--base=${L.base}`]:[]]:L.action==="metadata"?["edit",`--${L.change}-${L.field}=${L.value}`]:L.action==="ready"?["ready"]:L.action==="draft"?["ready","--undo"]:["close"];return await N(["pr",...T,String(Q.number),"--repo",Q.repoFullName]),{kind:"pr_mutation",number:Q.number,applied:!0}}if(!J.repoPath)A("local_device_gh_workspace_unavailable");let F=z.realpathSync(J.repoPath);if(F!==K&&!F.startsWith(K+s.sep))A("local_device_gh_workspace_unavailable");let D=`https://github.com/${Q.repoFullName}.git`,w="!'"+B.replace(/'/g,"'\\''")+"' auth git-credential",M=Function("return ("+o3+")")(),j=(L,T,P)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",L,T,...P]]:[T,P],O=async(L,T,P,k=T0)=>{let x=L===W||L.startsWith(W+s.sep),y=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...x?["-c",`credential.https://github.com.helper=${w}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",...T];if(x)return X(U,y,L,P,k);let r=s.join(F,".ara-local-gh-tmp");if(z.mkdirSync(r,{recursive:!0,mode:448}),z.lstatSync(r).isSymbolicLink()||z.realpathSync(r)!==r)A("local_device_gh_workspace_unavailable");J.assertCurrent();let a=await Z.command(...j(M(F,r),U,y),{cwd:L,input:P,maxBuffer:k,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:F,TMPDIR:r,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),a.error||a.status!==0)A("local_device_gh_collection_failed");return a.stdout},R=async(L,T)=>(await O(L,T)).toString("utf8").trim(),E=async(L,T)=>{let P=s.join(L,".ara-local-gh-tmp");if(z.mkdirSync(P,{recursive:!0,mode:448}),z.lstatSync(P).isSymbolicLink()||z.realpathSync(P)!==P)A("local_device_gh_workspace_unavailable");J.assertCurrent();let k=await Z.command(...j(M(L,P),"/bin/sh",["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",T]),{cwd:L,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:L,TMPDIR:P}});if(J.assertCurrent(),k.error||k.status!==0)A("local_device_gh_materialization_failed")},v=async(L)=>{let T=new Map;if(L.length===0)return T;let P=await O(S,["cat-file","--batch"],[...new Set(L)].join(`
|
|
2
|
+
import{$a as t6,Ea as n6,Ga as A4,Ha as T4,Ma as a6,Na as i6,Xa as R4,ab as e6,bb as x4,cb as y4,eb as $7,ga as F4,gb as X8,hb as y0,ia as Y2,ib as m0,ja as N4,jb as r1,ka as C4,la as H4,ma as y6,mb as J7,na as m6,oa as j4,pa as v6,pb as W8,qa as T3,qb as P4,ra as p6,sa as u6,sb as Z7,ta as d6,ua as l6,va as I4,wa as s6,xa as c6}from"./vm-hands-entry-lite-c3jqrn7n.js";import{Ab as r0,Bb as a0,Ib as P0,tb as $4,ub as f6,vb as b6}from"./vm-hands-entry-lite-rrk5g62b.js";import{Jb as Q7,Mb as K7,Ob as B7,Pb as V7}from"./vm-hands-entry-lite-ya1a2eep.js";import{Ub as r6}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Vb as q6,Wb as g6,Xb as S6,Yb as k6,Zb as L0}from"./vm-hands-entry-lite-n07kxrd1.js";import{$b as e1,ac as $2,bc as b3,dc as x3,fc as y3,gc as h3,kc as m3}from"./vm-hands-entry-lite-0ergg2ky.js";import{Bc as i1,Ec as O7,Nc as j7}from"./vm-hands-entry-lite-v2wx52wn.js";import{$c as d,$d as x8,Ad as T6,Cd as _6,Dd as R6,Ed as P6,Fd as z6,Gd as E6,Ld as j8,Md as I8,Nd as A8,Oc as w1,Od as T8,Pc as K2,Pd as _8,Qc as K6,Qd as R8,Rc as A3,Sc as t3,Sd as P8,Tc as e3,Td as z8,Uc as M0,Ud as E8,Vd as q8,Wd as g8,Xd as S8,Yc as N0,Yd as k8,Zd as f8,_d as b8,ad as g1,dd as O8,fd as S1,hd as B6,id as V6,jd as G6,kd as U6,ld as X6,md as W6,nd as Y6,od as F6,pd as N6,qd as C6,rd as H6,sd as D6,td as M6,ud as L6,vd as w6,wd as O6,xd as j6,yd as I6,zd as A6}from"./vm-hands-entry-lite-btwvn63p.js";import{ae as V}from"./vm-hands-entry-lite-q6fshf3h.js";import{Ae as c1,be as H7,ce as D7,de as M7,ee as L7,fe as w7,le as c5,pe as U5,qe as E5,we as I7,ze as X5}from"./vm-hands-entry-lite-msgz8sgz.js";import{Ze as _4,ef as o6}from"./vm-hands-entry-lite-pf1ft65e.js";import{jf as L3,wf as x6}from"./vm-hands-entry-lite-q2pb31vh.js";import{Bg as G7,Cg as U7,Dg as X7,Eg as W7,Gg as Y7,Hg as F7,Jg as N7,Kg as C7}from"./vm-hands-entry-lite-6j2yaa4n.js";import{Yg as a1}from"./vm-hands-entry-lite-7k65s010.js";import{$g as h6,_g as I1,ah as w4,bh as O4}from"./vm-hands-entry-lite-em388nee.js";import{dh as M3,fh as J1,lh as U8,mh as B4}from"./vm-hands-entry-lite-yp315y25.js";import{Kh as H}from"./vm-hands-entry-lite-xsq25kmd.js";import{Oh as e4}from"./vm-hands-entry-lite-hf0mk7vd.js";import{request as l7}from"http";import{request as s7}from"https";async function c7($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?s7:l7)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:x3},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Error("custom_endpoint_timeout"))),K.end($.body)})}function n7($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function r7($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let W=Buffer.allocUnsafe(G.length*Q.length+B),Y=0;for(let X of G){while(B&&Z[B]!==X){let N=K[B-1];Y+=Z.copy(W,Y,0,B-N),B=N}if(Z[B]===X){if(B++,B===Z.length)Y+=Q.copy(W,Y),B=0}else W[Y++]=X}if(U)Y+=Z.copy(W,Y,0,B),B=0;return W.subarray(0,Y)}}async function v3($){$.signal.throwIfAborted();let J=h3.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=m3.parse(await $.credential($.signal));if(!y3(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,W=0,Y=n7(Q.apiKey),X=r7(Q.apiKey,Y),N=async(F,D)=>{$.signal.throwIfAborted(),await new Promise((w,M)=>{let j=()=>{$.signal.removeEventListener("abort",j),M($.signal.reason)};if($.signal.addEventListener("abort",j,{once:!0}),$.signal.aborted){j();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(F,D)}).then(()=>{$.signal.removeEventListener("abort",j),w()},(O)=>{$.signal.removeEventListener("abort",j),M(O)})})},C=async(F)=>{if(G+=F.length,G>$2)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let D=0;D<F.length;D+=e1){if(W>=b3)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await N(`custom_endpoint.chunk.${W++}`,{eof:!1,data:F.subarray(D,D+e1).toString("base64")})}};try{let F=await c7({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=F.response,B=F.close;let D=K.statusCode??500;if(D>=300&&D<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let w={};for(let M of["content-type","retry-after","x-request-id","request-id"]){let j=K.headers[M];if(typeof j==="string")w[M]=j.replaceAll(Q.apiKey,Y).slice(0,4096)}await N("custom_endpoint.headers",{status:D,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,Y).slice(0,256),headers:w});for await(let M of K){$.signal.throwIfAborted();let j=Buffer.isBuffer(M)?M:Buffer.from(M);if(U+=j.length,U>$2)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(X(j))}return await C(X(Buffer.alloc(0),!0)),await N(`custom_endpoint.chunk.${W}`,{eof:!0}),{bytes:G,chunks:W}}catch(F){if($.signal.throwIfAborted(),F instanceof H)throw F;throw new H("custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as p3}from"path";function a7($,J){return $===p3(J,".ara","workspace")||$===p3(J,".reason","workspace")}function u3($,J){let Z=$.filter((Q)=>a7(Q.path,J));return Z.length===1?Z[0].path:null}var i7=/^[a-f0-9]{64}$/;var J2=32,o7=/^\/[^\x00-\x1f\x7f\\]*$/;function D1($){if(typeof $!=="string"||$.length>4096||!o7.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function M1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!D1(J.home)||!Array.isArray(J.roots)||J.roots.length>J2)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!i7.test(K)||!D1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}import{spawn as e7}from"child_process";import*as q from"fs";import*as r from"path";import{homedir as $9}from"os";function d3($,J,Z,Q="gh"){if(!["gh","git"].includes(Q))throw Error("local_device_gh_unavailable");let K=$.realpathSync(Z),B=Q==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+Q;for(let G of["/opt/homebrew/bin/"+Q,"/usr/local/bin/"+Q,B])try{let U=$.realpathSync(G);if(U===K||U.startsWith(K+J.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...Q==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((Y)=>U.startsWith(Y)))continue;let W=$.statSync(U);if(!W.isFile()||(W.mode&18)!==0||![0,process.getuid()].includes(W.uid))continue;return $.accessSync(U,$.constants.X_OK),U}catch{continue}throw Error("local_device_gh_unavailable")}function l3($,J){let Z=1;for(let Q=0;Q<J;Q+=1)if($.charCodeAt(Q)===10)Z+=1;return Z}var s3=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function Z2($){let J=$.trim().replaceAll("\\","/");if(!J)return{valid:!1,reason:"empty_path"};if(J.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(J.split("/").includes("..")||J.includes("../")||J.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(J===".git"||J.startsWith(".git/")||J.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function c3($){return[...new Set($.map((J)=>J.trim()).filter((J)=>J.length>=8))]}function n3($,J){return[...J.matchAll(new RegExp($.regex.source,`${$.regex.flags}g`))]}function L1($,J=[],Z={}){let Q=[],K=Z.published??new Set,B=c3(J).filter((G)=>!K.has(G));for(let G of $){let U=Z2(G.path);if(!U.valid){Q.push({path:G.path,reason:U.reason??"invalid_path"});continue}let W=G.content??"",Y=B.map((X)=>({secret:X,offset:W.indexOf(X)})).filter((X)=>X.offset>=0).sort((X,N)=>X.offset-N.offset);if(Y.length>0){let X=[...new Set(Y.flatMap((N)=>Z.secretNames?.(N.secret)??[]))];Q.push({path:G.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:l3(W,Y[0].offset),...X.length>0?{secretNames:X}:{}})}for(let X of s3){let N=n3(X,W).find((C)=>!K.has(C[0]));if(N){Q.push({path:G.path,reason:`credential_pattern_detected: ${X.name}`,pattern:X.name,ruleId:X.name,line:l3(W,N.index)});break}}}return{clean:Q.length===0,violations:Q,scannedObjectCount:$.length}}function r3($,J=[]){let Z=c3(J),Q=new Set;for(let{content:K}of $){for(let B of Z)if(K.includes(B))Q.add(B);for(let B of s3)for(let G of n3(B,K))Q.add(G[0])}return[...Q]}function t7($,J){let Z=0;for(let Q=$.indexOf(J);Q>=0;Q=$.indexOf(J,Q+J.length))Z+=1;return Z}function a3($,J,Z){let Q=(K,B)=>K.reduce((G,U)=>G+t7(U,B),0);return new Set($.filter((K)=>Q(J,K)<=Q(Z,K)))}var T0=4194304,i3=536870912,Q2=/^[a-f0-9]{40}$/,J9=($,J,Z)=>new Promise((Q)=>{if(Z.signal?.aborted){Q({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let K;try{K=e7($,J,{cwd:Z.cwd,env:Z.env,detached:!0,stdio:["pipe","pipe","pipe"]})}catch{Q({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let B=Buffer.alloc(0),G=Buffer.alloc(0),U,W=!1,Y=(F)=>{if(U??=Error(F),K.pid)try{process.kill(-K.pid,"SIGKILL")}catch{}},X=()=>Y("cancelled"),N=setTimeout(()=>Y("timeout"),Z.timeout);Z.signal?.addEventListener("abort",X,{once:!0});let C=(F)=>{if(W)return;W=!0,clearTimeout(N),Z.signal?.removeEventListener("abort",X),Q({status:F,stdout:B,stderr:G,...U?{error:U}:{}})};if(K.stdout.on("data",(F)=>{if(B.length+G.length+F.length>Z.maxBuffer)Y("output_limit");else B=Buffer.concat([B,F])}),K.stderr.on("data",(F)=>{if(B.length+G.length+F.length>Z.maxBuffer)Y("output_limit");else G=Buffer.concat([G,F])}),K.on("error",()=>{if(Y("spawn_failed"),!K.pid)C(null)}),K.on("close",(F)=>C(F)),K.stdin.on("error",()=>Y("input_failed")),K.stdin.end(Z.input),Z.signal?.aborted)X()}),Z9={command:J9,gh:($,J)=>d3(q,r,$,J),home:$9};function A($){throw Error($)}function Q9($,J){let Z=(K)=>K.trim().replace(/^co-authored-by:\s*/i,"Co-authored-by: "),Q=new Set($.split(/\r?\n/).map(Z));return[...new Set(J)].filter((K)=>!Q.has(Z(K)))}var K9=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),B9=($)=>JSON.stringify($,(J,Z)=>K9.has(J)?void 0:Z);function o3($,J,Z){let Q=[...new Set($.map((B)=>`${J(B.path)}${B.line?`:${B.line}`:""} (${B.reason==="literal_secret_detected"?`value of ${B.secretNames?.length?B.secretNames.slice(0,3).join(", "):"a session variable"}`:`${B.ruleId??"credential"} credential`})`))].slice(0,10),K=$.some((B)=>B.reason==="literal_secret_detected");A(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${Q.join("; ")}. Nothing was sent. ${Z}${K?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function J4($,J,Z=Z9){let Q=w1.parse($);if(!["darwin","linux"].includes(process.platform))A("local_device_gh_platform_unavailable");J.assertCurrent();let K=q.realpathSync(J.root);if(K==="/")A("local_device_gh_root_unavailable");if(!M0(Q)&&!J.forbiddenSecretValues)A("local_device_gh_secret_scope_unavailable");if(!M0(Q)&&J.readOnly)A("local_device_gh_read_only");if(!M0(Q)){let L=L1([{path:"github-operation",content:B9(Q)}],J.forbiddenSecretValues,J.secretNames?{secretNames:J.secretNames}:{});if(!L.clean)o3(L.violations,()=>`the ${Q.kind} request text`,"Remove it from the pull request text and try again.")}let B=Z.gh(K),G=Z.home(),U=Z.gh(K,"git"),W=J.privateDirectory?q.realpathSync(J.privateDirectory):q.realpathSync(G);if(!M0(Q)&&(!J.privateDirectory||W===K||W.startsWith(K+r.sep)))A("local_device_gh_private_scope_unavailable");let Y={PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:G,GH_CONFIG_DIR:r.join(G,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((L)=>process.env[L]?[[L,process.env[L]]]:[])):{}},X=async(L,T,P=W,k,x=T0)=>{J.assertCurrent();let y=await Z.command(L,T,{cwd:P,env:Y,input:k,maxBuffer:x,timeout:Math.max(1,Math.min(60000,(J.deadlineMs??Date.now()+60000)-Date.now())),signal:J.signal});if(J.assertCurrent(),y.error||y.status!==0)A("local_device_gh_command_failed");return y.stdout},N=async(L)=>(await X(B,L)).toString("utf8").trim(),C=async(L,T="application/vnd.github+json")=>{t3(Q.repoFullName,L,{headers:{accept:T}}),J.assertCurrent();let P=await Z.command(B,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${T}`,L],{cwd:W,env:Y,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal});if(J.assertCurrent(),P.error&&P.status===null)A("local_device_gh_response_unavailable");let k=P.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!k)A("local_device_gh_response_invalid");let x=Number(k[1]);if(x>=200&&x<300&&P.status!==0)A("local_device_gh_response_unavailable");if(Buffer.byteLength(k[3])>K2)A("local_device_gh_response_too_large");let y={};for(let i of k[2].split(/\r?\n/)){let e=i.indexOf(":"),D0=i.slice(0,e).toLowerCase();if(["link","content-type"].includes(D0))y[D0]=i.slice(e+1).trim().slice(0,8192)}return{kind:"read",status:x,headers:y,body:x>=200&&x<300?k[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(Q.kind==="read")return C(Q.path,Q.accept);if(Q.kind==="pr_review_context"){let[L,T]=Q.repoFullName.split("/"),P=await N(["api","graphql","--hostname","github.com","-f",`query=${e3}`,"-f",`owner=${L}`,"-f",`repo=${T}`,"-F",`number=${Q.number}`,...Q.after?["-f",`after=${Q.after}`]:[]]);if(Buffer.byteLength(P)>K2)A("local_device_gh_response_too_large");let k=JSON.parse(P);if(k.errors||k.data?.repository?.nameWithOwner?.toLowerCase()!==Q.repoFullName.toLowerCase()||k.data.repository.pullRequest?.number!==Q.number)A("local_device_gh_response_invalid");return{kind:"pr_review_context",body:P}}if(Q.kind==="pr_merge"){let L=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),T=JSON.parse(L.body),P=(y)=>y.number===Q.number&&y.html_url===`https://github.com/${Q.repoFullName}/pull/${Q.number}`&&y.base?.repo?.full_name?.toLowerCase()===Q.repoFullName.toLowerCase()&&y.base?.ref===Q.expectedBaseRef&&y.head?.sha===Q.expectedHeadSha;if(L.status!==200||!P(T)||T.state!=="open"||T.draft!==!1||T.head?.sha!==Q.expectedHeadSha||T.base?.repo?.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase())A("local_device_gh_merge_target_changed");await N(["pr","merge",String(Q.number),`--repo=${Q.repoFullName}`,`--${Q.method}`,"--match-head-commit",Q.expectedHeadSha,...Q.commitBody!==void 0&&Q.method!=="rebase"?[`--body=${Q.commitBody}`]:[]]);let k=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),x=JSON.parse(k.body);if(k.status!==200||!P(x)||x.merged!==!0)A("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:Q.number,merged:!0}}if(Q.kind==="pr_create"){if(Q.head===Q.base)A("local_device_gh_default_branch");let L=await N(["pr","create","--repo",Q.repoFullName,"--head",Q.head,"--base",Q.base,`--title=${Q.title}`,`--body=${Q.body}`,...Q.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+Q.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(L))A("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:L}}if(Q.kind==="pr_mutation"){let L=Q.mutation,T=L.action==="edit"?["edit",...L.title!==void 0?[`--title=${L.title}`]:[],...L.body!==void 0?[`--body=${L.body}`]:[],...L.base?[`--base=${L.base}`]:[]]:L.action==="metadata"?["edit",`--${L.change}-${L.field}=${L.value}`]:L.action==="ready"?["ready"]:L.action==="draft"?["ready","--undo"]:["close"];return await N(["pr",...T,String(Q.number),"--repo",Q.repoFullName]),{kind:"pr_mutation",number:Q.number,applied:!0}}if(!J.repoPath)A("local_device_gh_workspace_unavailable");let F=q.realpathSync(J.repoPath);if(F!==K&&!F.startsWith(K+r.sep))A("local_device_gh_workspace_unavailable");let D=`https://github.com/${Q.repoFullName}.git`,w="!'"+B.replace(/'/g,"'\\''")+"' auth git-credential",M=Function("return ("+$4+")")(),j=(L,T,P)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",L,T,...P]]:[T,P],O=async(L,T,P,k=T0)=>{let x=L===W||L.startsWith(W+r.sep),y=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...x?["-c",`credential.https://github.com.helper=${w}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",...T];if(x)return X(U,y,L,P,k);let i=r.join(F,".ara-local-gh-tmp");if(q.mkdirSync(i,{recursive:!0,mode:448}),q.lstatSync(i).isSymbolicLink()||q.realpathSync(i)!==i)A("local_device_gh_workspace_unavailable");J.assertCurrent();let e=await Z.command(...j(M(F,i),U,y),{cwd:L,input:P,maxBuffer:k,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:F,TMPDIR:i,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),e.error||e.status!==0)A("local_device_gh_collection_failed");return e.stdout},R=async(L,T)=>(await O(L,T)).toString("utf8").trim(),g=async(L,T)=>{let P=r.join(L,".ara-local-gh-tmp");if(q.mkdirSync(P,{recursive:!0,mode:448}),q.lstatSync(P).isSymbolicLink()||q.realpathSync(P)!==P)A("local_device_gh_workspace_unavailable");J.assertCurrent();let k=await Z.command(...j(M(L,P),"/bin/sh",["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",T]),{cwd:L,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:L,TMPDIR:P}});if(J.assertCurrent(),k.error||k.status!==0)A("local_device_gh_materialization_failed")},v=async(L)=>{let T=new Map;if(L.length===0)return T;let P=await O(E,["cat-file","--batch"],[...new Set(L)].join(`
|
|
3
3
|
`)+`
|
|
4
|
-
`,T0*8);for(let k=0;k<P.length;){let x=P.indexOf(10,k),[y,
|
|
4
|
+
`,T0*8);for(let k=0;k<P.length;){let x=P.indexOf(10,k),[y,i,e]=P.subarray(k,x).toString("utf8").split(" ");if(x<0||!y||i!=="blob"||!/^[0-9]+$/.test(e??""))A("local_device_gh_object_invalid");T.set(y,P.subarray(x+1,x+1+Number(e)).toString("utf8")),k=x+1+Number(e)+1}return T},I=async(L,T,P)=>{let k=r.join(F,".ara-local-gh-tmp"),x=M(F,k)+`
|
|
5
5
|
(allow file-read* file-write* (subpath ${JSON.stringify(F)}))
|
|
6
6
|
(allow file-read* (subpath ${JSON.stringify(L)}))
|
|
7
|
-
(allow file-read-metadata (path-ancestors ${JSON.stringify(L)}))`,y=async(
|
|
8
|
-
`,
|
|
7
|
+
(allow file-read-metadata (path-ancestors ${JSON.stringify(L)}))`,y=async(e,D0)=>{J.assertCurrent();let d0=await Z.command(...j(x,e,D0),{cwd:F,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:F,TMPDIR:k,GIT_INDEX_FILE:r.join(F,".git","index"),OPENSSL_CONF:"/dev/null",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),d0.error||d0.status!==0)A("local_device_gh_materialization_failed")},i=["--git-dir="+L,"--work-tree="+F,"-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=","-c","protocol.allow=never"];await y(U,[...i,"read-tree",T]),await y(U,[...i,"checkout-index","--all","--index"]),await O(F,["update-ref","refs/heads/"+P,T]),await O(F,["symbolic-ref","HEAD","refs/heads/"+P])},z=await C(`/repos/${Q.repoFullName}`);if(z.status!==200)A("local_device_gh_repository_unavailable");let _=JSON.parse(z.body);if(_.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase()||_.default_branch!==Q.defaultBranch||Q.kind==="publish"&&_.permissions?.push!==!0)A("local_device_gh_repository_authority_changed");if(Q.branch===Q.defaultBranch)A("local_device_gh_default_branch");let E=q.mkdtempSync(r.join(W,"github-publication-"));q.chmodSync(E,448);try{if(await O(E,["init","--bare","--template="]),Q.kind==="prepare"){if(await O(E,["fetch","--depth=1","--no-tags","--no-recurse-submodules",D,Q.baseSha]),await R(E,["rev-parse","FETCH_HEAD"])!==Q.baseSha)A("local_device_gh_base_changed");let p=r.join(F,".git"),K0=!1;if(q.existsSync(p)){if(!q.lstatSync(p).isDirectory()||q.lstatSync(p).isSymbolicLink()||["objects/info/alternates","info/grafts"].some((n)=>q.existsSync(r.join(p,n))))A("local_device_gh_repository_layout_invalid");let t=await O(F,["rev-parse","--verify","-q","HEAD"]).then((n)=>n.toString("utf8").trim(),()=>null),B0=await O(F,["config","--local","--get","remote.origin.url"]).then((n)=>n.toString("utf8").trim(),()=>"");if(t!==null||B0){if(t!==Q.baseSha||await R(F,["branch","--show-current"])!==Q.branch)A("local_device_gh_checkout_exists");return{kind:"prepare",headSha:Q.baseSha}}K0=!0}let $0=q.readdirSync(F).filter((t)=>!(K0&&t===".git")),U0=[".ara-local-gh-tmp",".reason-local-gh-tmp"];if($0.some((t)=>!U0.includes(t))||$0.some((t)=>{let B0=r.join(F,t);return!q.lstatSync(B0).isDirectory()||q.lstatSync(B0).isSymbolicLink()||q.readdirSync(B0).length>0}))A("local_device_gh_checkout_not_empty");if(!K0)await O(F,["init","--template="]);let F0=await O(E,["pack-objects","--stdout","--revs"],Q.baseSha+`
|
|
8
|
+
`,i3);return await g(F,Q.baseSha),await O(F,["index-pack","--strict","--stdin"],F0,65536),await O(F,["remote","add","origin",D]),await I(E,Q.baseSha,Q.branch),{kind:"prepare",headSha:Q.baseSha}}let L=r.join(F,".git");if(!q.lstatSync(L).isDirectory()||q.lstatSync(L).isSymbolicLink()||["objects/info/alternates","info/grafts"].some((p)=>q.existsSync(r.join(L,p))))A("local_device_gh_repository_layout_invalid");if(await R(F,["branch","--show-current"])!==Q.branch)A("local_device_gh_branch_changed");let T=await R(F,["rev-parse","--verify","HEAD"]);if(!Q2.test(T))A("local_device_gh_head_invalid");let P=await C(`/repos/${Q.repoFullName}/commits/${Q.baseSha}`);if(P.status!==200||JSON.parse(P.body).sha!==Q.baseSha)A("local_device_gh_base_unverified");let k=await C(`/repos/${Q.repoFullName}/git/ref/heads/${encodeURIComponent(Q.branch)}`);if(Q.remoteHeadSha===null?k.status!==404:k.status!==200||JSON.parse(k.body).object?.sha!==Q.remoteHeadSha)A("local_device_gh_remote_changed");let x=[...(await R(F,["rev-list","--objects","--no-object-names",T,"--not",Q.baseSha])).split(`
|
|
9
9
|
`),...(await R(F,["rev-list","--objects","--no-object-names","--no-walk",Q.baseSha])).split(`
|
|
10
10
|
`)].filter(Boolean);if(x.some((p)=>!Q2.test(p)))A("local_device_gh_object_invalid");let y=await O(F,["pack-objects","--stdout"],[...new Set(x)].join(`
|
|
11
11
|
`)+`
|
|
12
|
-
`,
|
|
13
|
-
`,{flag:"wx",mode:384}),await O(
|
|
14
|
-
`).filter(Boolean);if(r.length>5000)A("local_device_gh_collection_too_large");let a=[],D0=0;for(let p of r){if(!Q2.test(p))A("local_device_gh_object_invalid");let K0=await R(S,["cat-file","-t",p]);if(!["blob","commit","tree"].includes(K0))A("local_device_gh_object_invalid");let $0=await O(S,["cat-file",K0,p]);if(D0+=$0.length,D0>T0)A("local_device_gh_collection_too_large");if(K0==="tree"){let U0=0;while(U0<$0.length){let F0=$0.indexOf(32,U0),e=$0.indexOf(0,F0+1);if(F0<U0||e<=F0||e+21>$0.length)A("local_device_gh_object_invalid");let B0=$0.subarray(F0+1,e).toString("utf8");if(B0.includes("/")||!Z2(B0).valid)A("local_device_gh_object_invalid");U0=e+21}}a.push({path:`object-${p}`,content:$0.toString("utf8")})}let d0=J.secretNames?{secretNames:J.secretNames}:{},l0=M1(a,J.forbiddenSecretValues,d0),g3=new Map;if(!l0.clean)try{let p=(await O(S,["diff","--no-renames","--no-abbrev","--raw","-z",Q.baseSha,T])).toString("utf8").split("\x00"),K0=[],$0=[];for(let i=0;i+1<p.length;i+=2){let[,m7,v7,o1,C1]=p[i].slice(1).match(/^([0-7]{6}) ([0-7]{6}) ([0-9a-f]{40}) ([0-9a-f]{40}) /)??[];if(!o1||!C1)continue;if(m7!=="160000"&&!/^0+$/.test(o1))K0.push(o1);if(v7!=="160000"&&!/^0+$/.test(C1))$0.push(C1),g3.set(`object-${C1}`,p[i+1])}let U0=await v([...K0,...$0]),F0=new Set(l0.violations.map((i)=>i.path)),e=s3(a.filter((i)=>F0.has(i.path)),J.forbiddenSecretValues),B0=c3(e,$0.map((i)=>U0.get(i)??""),K0.map((i)=>U0.get(i)??""));if(B0.size>0)l0=M1(a,J.forbiddenSecretValues,{...d0,published:B0})}catch{}if(!l0.clean)r3(l0.violations,(p)=>g3.get(p)??`an object in the pushed history (${p})`,"Remove it from the files and commit again; a commit or message in the pushed history that holds it must be amended before this branch can be pushed.");await O(S,["push","--no-recurse-submodules",D,`${T}:refs/heads/${Q.branch}`]);let S3=await C(`/repos/${Q.repoFullName}/git/ref/heads/${encodeURIComponent(Q.branch)}`);if(S3.status!==200||JSON.parse(S3.body).object?.sha!==T)A("local_device_gh_push_unconfirmed");return{kind:"publish",headSha:T,scannedObjectCount:a.length}}finally{z.rmSync(S,{recursive:!0,force:!0})}}var _0=V.object({profile:V.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:V.string().min(1).max(1024)}).strict(),B2={ready:V.literal(!0),boot_generation:V.string().uuid(),proof_ready:V.literal(!1),result:V.literal("metadata_only")},Z9=V.object({...B2,version:V.literal(2),development_only:V.literal(!1),image:V.literal(!0),video:V.literal(!1),source_bound:V.literal(!1),profiles:V.array(_0.shape.profile).min(1).max(16),extension_instance_ids:V.array(_0.shape.extension_instance_id.max(512)).min(1).max(16)}).strict().refine(($)=>new Set($.profiles).size===$.profiles.length&&$.profiles.length===$.extension_instance_ids.length),Q9=V.object({...B2,version:V.literal(3),development_only:V.literal(!1),image:V.literal(!0),video:V.literal(!0),source_bound:V.literal(!1),max_seconds:V.literal(15),profiles:V.array(_0.shape.profile).min(1).max(16),extension_instance_ids:V.array(_0.shape.extension_instance_id.max(512)).min(1).max(16)}).strict().refine(($)=>new Set($.profiles).size===$.profiles.length&&$.profiles.length===$.extension_instance_ids.length),V2=V.union([Z9,Q9]),rQ=V.union([V.object({...B2,version:V.literal(1),development_only:V.literal(!0),profile:_0.shape.profile,extension_instance_id:_0.shape.extension_instance_id,max_seconds:V.literal(15)}).strict(),V2]);import{randomUUID as N2}from"crypto";import{spawn as M9}from"child_process";import{existsSync as C2,lstatSync as _4,mkdirSync as L9,readFileSync as w9,realpathSync as w1,rmSync as O9,writeFileSync as j9}from"fs";import{dirname as R4,join as X0,relative as I9,sep as A9}from"path";var K9=["process.run.v1","process.full.v1"],B9=600000,V9=1800000,G9=20000,e3="process.cancel.v1",$4=V.object({action:V.literal("start"),request_id:V.string().uuid(),command:V.string().min(1).max(16000).refine(($)=>!$.includes("\x00")),cwd:V.string().min(1).max(4096).refine(($)=>!$.includes("\x00")&&!$.startsWith("/")&&!$.split(/[\\/]/).includes("..")).describe("Path relative to the granted device root; omit to use that root. Must not start with /, contain a .. path segment, or contain a NUL character.").optional(),mode:V.enum(["host","confined"]).default("host"),timeout_ms:V.number().int().min(1000).max(V9).default(B9).describe("Absolute process budget including queue and startup time. Defaults to ten minutes; longer explicit requests require the selected root's advertised max_timeout_ms. Retrying never renews the deadline.")}).strict(),G2={device_id:V.string().uuid(),root_id:V.string().uuid()},U9=V.discriminatedUnion("action",[$4.extend(G2),V.object({...G2,action:V.literal("inspect"),process_id:V.string().uuid(),after:V.number().int().min(0).default(0),wait_ms:V.number().int().min(0).max(G9).default(0).describe("Wait for new output or a state change, bounded by this call's wait budget. Expiring this wait does not cancel the process or extend its deadline.")}).strict(),V.object({...G2,action:V.literal("cancel"),process_id:V.string().uuid()}).strict()]),oQ=V.toJSONSchema(U9,{io:"input"}),tQ=$4.extend({process_brain_fence:V.string().uuid(),process_expires_at:V.iso.datetime()}).strict(),s0=V.object({version:V.literal(1),process_id:V.string().uuid(),state:V.enum(["starting","running","exited","cancelled","expired","uncertain"]),exit_code:V.number().int().nullable(),first_cursor:V.number().int().min(0),next_cursor:V.number().int().min(0),truncated:V.boolean(),observed_at:V.iso.datetime(),output:V.array(V.object({cursor:V.number().int().min(1),stream:V.enum(["stdout","stderr"]),text:V.string().max(32768)}).strict()).max(128)}).strict().refine(($)=>{if(Buffer.byteLength(JSON.stringify($))>1e5||$.next_cursor<$.first_cursor-1)return!1;if(($.state==="starting"||$.state==="running"||$.state==="uncertain")&&$.exit_code!==null)return!1;if($.state==="exited"&&($.exit_code===null||$.exit_code<0||$.exit_code>255))return!1;if($.state==="cancelled"&&$.exit_code!==130||$.state==="expired"&&$.exit_code!==124)return!1;let Z=$.first_cursor-1;for(let Q of $.output){if(Q.cursor<=Z||Q.cursor>$.next_cursor)return!1;Z=Q.cursor}return!0});function J4($){return K9.includes($)}var eQ=V.object({operation_constraints:V.record(V.string(),V.unknown())}),$K=V.object({ready:V.literal(!0),version:V.literal(1),execution_mode:V.enum(["host","confined"]),max_timeout_ms:V.number().int().min(1000).optional()});var X9=V.object({version:V.literal(1),process_id:V.string().uuid(),state:V.enum(["queued","cancelled_before_start","not_started"]),exit_code:V.null(),output:V.array(V.never()).length(0),first_cursor:V.literal(0),next_cursor:V.literal(0),truncated:V.literal(!1),cancellation_requested:V.literal(!1),reason_code:V.enum(["cancelled_before_start","process_journal_capacity","path_not_found","process_timeout_unsupported"]).optional(),expires_at:V.iso.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it.")}).strict(),W9=V.object({...s0.shape,state:V.enum(["queued","starting","running","exited","cancelled","expired","uncertain","cancelled_before_start","not_started"]),observed_at:V.iso.datetime().optional(),expires_at:V.iso.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it."),cancellation_requested:V.boolean(),reason_code:V.string().nullable().optional(),execution_authority:V.literal("lost").optional().describe("Historical receipt only; the current Brain cannot control this older-generation process."),recovery:V.object({cause:V.literal("brain_generation_changed"),terminal_confirmed:V.boolean(),next_step:V.enum(["inspect_until_terminal","reconcile_effects_before_new_intent"])}).strict().optional().describe("Historical process recovery only. An unconfirmed outcome forbids replay. A confirmed terminal observation proves the old process stopped, not that its command had no effects. Reconcile the result; only restart still-needed, safely repeatable work with a new request_id and current authority. Respect user cancellation."),last_observed_state:s0.shape.state.or(V.literal("cancelled_before_start")).nullable().optional().describe("Last saved observation before authority was lost; a running observation does not establish current child liveness.")}).strict(),JK=V.toJSONSchema(W9),ZK=V.union([s0,X9.refine(($)=>$.state==="cancelled_before_start")]),U2=V.object({version:V.literal(1),process_id:V.string().uuid(),state:V.enum(["exited","cancelled","expired"]),exit_code:V.number().int().min(0).max(255),observed_at:V.iso.datetime()}).strict().refine(($)=>($.state!=="cancelled"||$.exit_code===130)&&($.state!=="expired"||$.exit_code===124)),Y9=V.object({process_terminal_observation:U2}).strict();function QK($,J){let Z=Y9.safeParse($);return Z.success&&Z.data.process_terminal_observation.process_id===J?Z.data:null}var Q4="preview.serve.v1",K4=43200000;var GK=3,B4="preview.open.v1",V4=1,X2="gid_proxy_v1",G4="egress",W2=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::[1-9][0-9]{0,4})?$/,F9=V.object({version:V.literal(X2),allowed_domains:V.array(V.string().max(260).regex(W2)).max(1024)}).strict(),N9=V.custom(($)=>Z4($)!==null,"invalid workspace"),C9=V.object({version:V.literal(1),request_id:V.uuid(),session_id:V.uuid(),command:V.string().min(1).max(16000).refine(($)=>!$.includes("\x00")),port:V.number().int().min(1024).max(65535),workspace:N9,egress:F9.optional()}).strict(),U4=C9.extend({expires_at:V.iso.datetime()}).strict();var H9=4,D9=5000;function F2($,J,Z){let Q=null;try{Q=Y2($)}catch{}W4({deviceRelayUrl:Q?.deviceRelayUrl??"",binding:Q?.binding??null,jobId:J,port:Q?.binding.port??0,reason:Q?Z:"binding_invalid"})}function N4($){let J=new Map;return{open(Z){let Q=(X)=>F2(Z,$.claim.operation_id,X),K;try{K=Y2(Z)}catch{return Q("binding_invalid")}let{binding:B,deviceRelayUrl:G}=K,U=$.claim.owner;if(!U||B.organizationId!==U.organization_id||B.userId!==U.user_id||B.deviceId!==U.device_id||B.rootId!==$.claim.root_id||B.jobId!==$.claim.operation_id||B.fenceId!==$.claim.operation_id||B.generation!==V4||B.expiresAtMs>Math.min(Date.now()+X4.lifetimeMs+D9,$.expiresAtMs))return Q("binding_mismatch");if(B.expiresAtMs<=Date.now())return Q("binding_expired");if(J.get(B.port)?.abort(),J.delete(B.port),J.size>=H9)return Q("preview_capacity");let W=new AbortController;J.set(B.port,W);let Y=F4({binding:B,deniedPorts:$.deniedPorts,readCurrentJob:async()=>{if(W.signal.aborted)return null;let X=await $.inspect();return X?{binding:B,executorLaunchId:$.executorLaunchId,job:X}:null}});Y4({binding:B,deviceRelayUrl:G,port:Y,signal:W.signal}).then((X)=>X.closed,(X)=>{let N=X instanceof Error?X.message:"preview_failed";if(N!=="preview_not_authorized")process.stderr.write(`${JSON.stringify({event:"worker_preview.open_failed",job_id:B.jobId,port:B.port,reason_code:N})}
|
|
15
|
-
`)}).finally(()=>{if(J.get(B.port)===W)J.delete(B.port)})},dispose(){for(let Z of J.values())Z.abort();J.clear()}}}class
|
|
12
|
+
`,i3);if(q.writeFileSync(r.join(E,"shallow"),Q.baseSha+`
|
|
13
|
+
`,{flag:"wx",mode:384}),await O(E,["index-pack","--strict","--stdin"],y,65536),await O(E,["merge-base","--is-ancestor",Q.baseSha,T]),Q.remoteHeadSha)await O(E,["merge-base","--is-ancestor",Q.remoteHeadSha,T]);let i=await O(E,["show","-s","--format=%B",T]),e=(await O(E,["interpret-trailers","--parse"],i)).toString("utf8"),D0=Q.contributorTrailers?{expectedTrailers:Q.contributorTrailers,missingFromHead:Q9(e,Q.contributorTrailers)}:void 0,d0=(await R(E,["rev-list","--objects","--no-object-names",T,"--not",Q.baseSha,...Q.remoteHeadSha?[Q.remoteHeadSha]:[]])).split(`
|
|
14
|
+
`).filter(Boolean);if(d0.length>5000)A("local_device_gh_collection_too_large");let l0=[],g3=0;for(let p of d0){if(!Q2.test(p))A("local_device_gh_object_invalid");let K0=await R(E,["cat-file","-t",p]);if(!["blob","commit","tree"].includes(K0))A("local_device_gh_object_invalid");let $0=await O(E,["cat-file",K0,p]);if(g3+=$0.length,g3>T0)A("local_device_gh_collection_too_large");if(K0==="tree"){let U0=0;while(U0<$0.length){let F0=$0.indexOf(32,U0),t=$0.indexOf(0,F0+1);if(F0<U0||t<=F0||t+21>$0.length)A("local_device_gh_object_invalid");let B0=$0.subarray(F0+1,t).toString("utf8");if(B0.includes("/")||!Z2(B0).valid)A("local_device_gh_object_invalid");U0=t+21}}l0.push({path:`object-${p}`,content:$0.toString("utf8")})}let S3=J.secretNames?{secretNames:J.secretNames}:{},s0=L1(l0,J.forbiddenSecretValues,S3),k3=new Map;if(!s0.clean)try{let p=(await O(E,["diff","--no-renames","--no-abbrev","--raw","-z",Q.baseSha,T])).toString("utf8").split("\x00"),K0=[],$0=[];for(let n=0;n+1<p.length;n+=2){let[,u7,d7,t1,H1]=p[n].slice(1).match(/^([0-7]{6}) ([0-7]{6}) ([0-9a-f]{40}) ([0-9a-f]{40}) /)??[];if(!t1||!H1)continue;if(u7!=="160000"&&!/^0+$/.test(t1))K0.push(t1);if(d7!=="160000"&&!/^0+$/.test(H1))$0.push(H1),k3.set(`object-${H1}`,p[n+1])}let U0=await v([...K0,...$0]),F0=new Set(s0.violations.map((n)=>n.path)),t=r3(l0.filter((n)=>F0.has(n.path)),J.forbiddenSecretValues),B0=a3(t,$0.map((n)=>U0.get(n)??""),K0.map((n)=>U0.get(n)??""));if(B0.size>0)s0=L1(l0,J.forbiddenSecretValues,{...S3,published:B0})}catch{}if(!s0.clean)o3(s0.violations,(p)=>k3.get(p)??`an object in the pushed history (${p})`,"Remove it from the files and commit again; a commit or message in the pushed history that holds it must be amended before this branch can be pushed.");await O(E,["push","--no-recurse-submodules",D,`${T}:refs/heads/${Q.branch}`]);let f3=await C(`/repos/${Q.repoFullName}/git/ref/heads/${encodeURIComponent(Q.branch)}`);if(f3.status!==200||JSON.parse(f3.body).object?.sha!==T)A("local_device_gh_push_unconfirmed");return{kind:"publish",headSha:T,scannedObjectCount:l0.length,...D0?{attribution:D0}:{}}}finally{q.rmSync(E,{recursive:!0,force:!0})}}var _0=V.object({profile:V.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:V.string().min(1).max(1024)}).strict(),B2={ready:V.literal(!0),boot_generation:V.string().uuid(),proof_ready:V.literal(!1),result:V.literal("metadata_only")},V9=V.object({...B2,version:V.literal(2),development_only:V.literal(!1),image:V.literal(!0),video:V.literal(!1),source_bound:V.literal(!1),profiles:V.array(_0.shape.profile).min(1).max(16),extension_instance_ids:V.array(_0.shape.extension_instance_id.max(512)).min(1).max(16)}).strict().refine(($)=>new Set($.profiles).size===$.profiles.length&&$.profiles.length===$.extension_instance_ids.length),G9=V.object({...B2,version:V.literal(3),development_only:V.literal(!1),image:V.literal(!0),video:V.literal(!0),source_bound:V.literal(!1),max_seconds:V.literal(15),profiles:V.array(_0.shape.profile).min(1).max(16),extension_instance_ids:V.array(_0.shape.extension_instance_id.max(512)).min(1).max(16)}).strict().refine(($)=>new Set($.profiles).size===$.profiles.length&&$.profiles.length===$.extension_instance_ids.length),V2=V.union([V9,G9]),tQ=V.union([V.object({...B2,version:V.literal(1),development_only:V.literal(!0),profile:_0.shape.profile,extension_instance_id:_0.shape.extension_instance_id,max_seconds:V.literal(15)}).strict(),V2]);import{randomUUID as N2}from"crypto";import{spawn as j9}from"child_process";import{existsSync as C2,lstatSync as z4,mkdirSync as I9,readFileSync as A9,realpathSync as O1,rmSync as T9,writeFileSync as _9}from"fs";import{dirname as E4,join as X0,relative as R9,sep as P9}from"path";var U9=["process.run.v1","process.full.v1"],X9=600000,W9=1800000,Y9=20000,Z4="process.cancel.v1",Q4=V.object({action:V.literal("start"),request_id:V.string().uuid(),command:V.string().min(1).max(16000).refine(($)=>!$.includes("\x00")),cwd:V.string().min(1).max(4096).refine(($)=>!$.includes("\x00")&&!$.startsWith("/")&&!$.split(/[\\/]/).includes("..")).describe("Path relative to the granted device root; omit to use that root. Must not start with /, contain a .. path segment, or contain a NUL character.").optional(),mode:V.enum(["host","confined"]).default("host"),timeout_ms:V.number().int().min(1000).max(W9).default(X9).describe("Absolute process budget including queue and startup time. Defaults to ten minutes; longer explicit requests require the selected root's advertised max_timeout_ms. Retrying never renews the deadline.")}).strict(),G2={device_id:V.string().uuid(),root_id:V.string().uuid()},F9=V.discriminatedUnion("action",[Q4.extend(G2),V.object({...G2,action:V.literal("inspect"),process_id:V.string().uuid(),after:V.number().int().min(0).default(0),wait_ms:V.number().int().min(0).max(Y9).default(0).describe("Wait for new output or a state change, bounded by this call's wait budget. Expiring this wait does not cancel the process or extend its deadline.")}).strict(),V.object({...G2,action:V.literal("cancel"),process_id:V.string().uuid()}).strict()]),JK=V.toJSONSchema(F9,{io:"input"}),ZK=Q4.extend({process_brain_fence:V.string().uuid(),process_expires_at:V.iso.datetime()}).strict(),c0=V.object({version:V.literal(1),process_id:V.string().uuid(),state:V.enum(["starting","running","exited","cancelled","expired","uncertain"]),exit_code:V.number().int().nullable(),first_cursor:V.number().int().min(0),next_cursor:V.number().int().min(0),truncated:V.boolean(),observed_at:V.iso.datetime(),output:V.array(V.object({cursor:V.number().int().min(1),stream:V.enum(["stdout","stderr"]),text:V.string().max(32768)}).strict()).max(128)}).strict().refine(($)=>{if(Buffer.byteLength(JSON.stringify($))>1e5||$.next_cursor<$.first_cursor-1)return!1;if(($.state==="starting"||$.state==="running"||$.state==="uncertain")&&$.exit_code!==null)return!1;if($.state==="exited"&&($.exit_code===null||$.exit_code<0||$.exit_code>255))return!1;if($.state==="cancelled"&&$.exit_code!==130||$.state==="expired"&&$.exit_code!==124)return!1;let Z=$.first_cursor-1;for(let Q of $.output){if(Q.cursor<=Z||Q.cursor>$.next_cursor)return!1;Z=Q.cursor}return!0});function K4($){return U9.includes($)}var QK=V.object({operation_constraints:V.record(V.string(),V.unknown())}),KK=V.object({ready:V.literal(!0),version:V.literal(1),execution_mode:V.enum(["host","confined"]),max_timeout_ms:V.number().int().min(1000).optional()});var N9=V.object({version:V.literal(1),process_id:V.string().uuid(),state:V.enum(["queued","cancelled_before_start","not_started"]),exit_code:V.null(),output:V.array(V.never()).length(0),first_cursor:V.literal(0),next_cursor:V.literal(0),truncated:V.literal(!1),cancellation_requested:V.literal(!1),reason_code:V.enum(["cancelled_before_start","process_journal_capacity","path_not_found","process_timeout_unsupported"]).optional(),expires_at:V.iso.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it.")}).strict(),C9=V.object({...c0.shape,state:V.enum(["queued","starting","running","exited","cancelled","expired","uncertain","cancelled_before_start","not_started"]),observed_at:V.iso.datetime().optional(),expires_at:V.iso.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it."),cancellation_requested:V.boolean(),reason_code:V.string().nullable().optional(),execution_authority:V.literal("lost").optional().describe("Historical receipt only; the current Brain cannot control this older-generation process."),recovery:V.object({cause:V.literal("brain_generation_changed"),terminal_confirmed:V.boolean(),next_step:V.enum(["inspect_until_terminal","reconcile_effects_before_new_intent"])}).strict().optional().describe("Historical process recovery only. An unconfirmed outcome forbids replay. A confirmed terminal observation proves the old process stopped, not that its command had no effects. Reconcile the result; only restart still-needed, safely repeatable work with a new request_id and current authority. Respect user cancellation."),last_observed_state:c0.shape.state.or(V.literal("cancelled_before_start")).nullable().optional().describe("Last saved observation before authority was lost; a running observation does not establish current child liveness.")}).strict(),BK=V.toJSONSchema(C9),VK=V.union([c0,N9.refine(($)=>$.state==="cancelled_before_start")]),U2=V.object({version:V.literal(1),process_id:V.string().uuid(),state:V.enum(["exited","cancelled","expired"]),exit_code:V.number().int().min(0).max(255),observed_at:V.iso.datetime()}).strict().refine(($)=>($.state!=="cancelled"||$.exit_code===130)&&($.state!=="expired"||$.exit_code===124)),H9=V.object({process_terminal_observation:U2}).strict();function GK($,J){let Z=H9.safeParse($);return Z.success&&Z.data.process_terminal_observation.process_id===J?Z.data:null}var V4="preview.serve.v1",G4=43200000;var YK=3,U4="preview.open.v1",X4=1,X2="gid_proxy_v1",W4="egress",W2=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::[1-9][0-9]{0,4})?$/,D9=V.object({version:V.literal(X2),allowed_domains:V.array(V.string().max(260).regex(W2)).max(1024)}).strict(),M9=V.custom(($)=>B4($)!==null,"invalid workspace"),L9=V.object({version:V.literal(1),request_id:V.uuid(),session_id:V.uuid(),command:V.string().min(1).max(16000).refine(($)=>!$.includes("\x00")),port:V.number().int().min(1024).max(65535),workspace:M9,egress:D9.optional()}).strict(),Y4=L9.extend({expires_at:V.iso.datetime()}).strict();var w9=4,O9=5000;function F2($,J,Z){let Q=null;try{Q=Y2($)}catch{}N4({deviceRelayUrl:Q?.deviceRelayUrl??"",binding:Q?.binding??null,jobId:J,port:Q?.binding.port??0,reason:Q?Z:"binding_invalid"})}function D4($){let J=new Map;return{open(Z){let Q=(X)=>F2(Z,$.claim.operation_id,X),K;try{K=Y2(Z)}catch{return Q("binding_invalid")}let{binding:B,deviceRelayUrl:G}=K,U=$.claim.owner;if(!U||B.organizationId!==U.organization_id||B.userId!==U.user_id||B.deviceId!==U.device_id||B.rootId!==$.claim.root_id||B.jobId!==$.claim.operation_id||B.fenceId!==$.claim.operation_id||B.generation!==X4||B.expiresAtMs>Math.min(Date.now()+F4.lifetimeMs+O9,$.expiresAtMs))return Q("binding_mismatch");if(B.expiresAtMs<=Date.now())return Q("binding_expired");if(J.get(B.port)?.abort(),J.delete(B.port),J.size>=w9)return Q("preview_capacity");let W=new AbortController;J.set(B.port,W);let Y=H4({binding:B,deniedPorts:$.deniedPorts,readCurrentJob:async()=>{if(W.signal.aborted)return null;let X=await $.inspect();return X?{binding:B,executorLaunchId:$.executorLaunchId,job:X}:null}});C4({binding:B,deviceRelayUrl:G,port:Y,signal:W.signal}).then((X)=>X.closed,(X)=>{let N=X instanceof Error?X.message:"preview_failed";if(N!=="preview_not_authorized")process.stderr.write(`${JSON.stringify({event:"worker_preview.open_failed",job_id:B.jobId,port:B.port,reason_code:N})}
|
|
15
|
+
`)}).finally(()=>{if(J.get(B.port)===W)J.delete(B.port)})},dispose(){for(let Z of J.values())Z.abort();J.clear()}}}class n0 extends H{observation;constructor($){super("process_authority_lost","Process authority was lost; the owned process group has stopped.");this.observation=$}}var q4=256,j1=new Map,g4="preview.serve.v1",R0=new Map;function S4($){let J=R0.get($.operation_id);if(J){if(J.claim!==$)throw V0("process_authority_lost");return J}if(R0.size>=q4)throw V0("process_journal_capacity");let Z={claim:$,executing:!1,cancelRequested:!1,phase:"pending"};return R0.set($.operation_id,Z),Z}function M4($){return{version:1,process_id:$,state:"cancelled_before_start",exit_code:null,output:[],first_cursor:0,next_cursor:0,truncated:!1,cancellation_requested:!1,reason_code:"cancelled_before_start"}}var L4=($)=>new Promise((J)=>setTimeout(J,$)),V0=($="process_outcome_uncertain")=>new H($,"The managed process outcome could not be confirmed; inspect its saved receipt before starting another intent.");function z9($=I1(),J=E9()){let Z=E4(_4({},$)),Q=R9(w4($),Z),[K,...B]=Q.split(P9);return{directory:X0(J,Q,"processes"),previous:[X0(Z,"processes"),...K==="reason"?[X0(J,"ara",...B,"processes")]:[]]}}function E9(){if(process.platform!=="darwin")throw new H("process_unavailable","Managed Mac process execution is unavailable.");let $=O4();if(!$)throw new H("process_unavailable","The private per-user process directory is unavailable.");return $}async function A1($){if(!$.claim.owner||$.signal.aborted||$.expiresAtMs<=Date.now())throw V0("process_authority_lost");let J=S4($.claim);if(J.executing)throw V0("process_busy");if(J.executing=!0,J.cancelRequested)return J.phase="settling",M4($.claim.operation_id);J.phase="starting";let Z=$.journals??z9();I9(Z.directory,{recursive:!0,mode:448});let Q=j4({runtimeDirectory:O1(Z.directory),previousRuntimeDirectories:(Z.previous??[]).filter((I)=>C2(I)).map((I)=>O1(I)),root:$.root,runId:JSON.stringify([$.claim.owner,$.claim.run_id,$.claim.root_id,$.claim.operation_id]),maxScopes:q4});try{for(let I of[$.root,$.cwd])if(!R4(O1(I),Q.journalDirectory))throw new H("process_journal_inside_workspace","The selected root contains the private process journal. Select an existing narrower granted workspace root outside the journal; no command was dispatched.")}catch(I){throw Q.disposeSocket(),I}let K=z4(Q.journalDirectory),B=$.claim.capability===g4,G=()=>j1.set($.claim.operation_id,{path:Q.journalDirectory,ino:K.ino,dev:K.dev,anyCompletion:B}),U=E4(Q.socketPath),W=X0(U,"config.json"),Y={url:"",transport:"local_job_ipc",directShell:{mode:$.mode,executable:$.shell,jobId:$.claim.operation_id},workerVersion:r0,protocolVersion:2,workerArtifactSha256:P0,workerEntrypoint:a0,targetGeneration:1,fenceId:N2(),workRoot:$.root,workspaceAliasPath:$.root,repoPath:$.cwd,jobEnvPath:X0(U,"unused.env"),replSocketPath:X0(U,"unused.sock"),readyPath:X0(U,"ready.json"),directTerminalReceiptPath:X0(U,"terminal.json"),launchId:N2(),expiresAtMs:$.expiresAtMs+5000,bashTimeoutMs:60000,replTimeoutMs:1000,allowedTools:["bash"],managedJobs:{journalDirectory:Q.journalDirectory,scopeId:Q.scopeId},jobControlSocketPath:Q.socketPath,...$.prefix?{bashCommandPrefix:$.prefix}:{},...$.jobsUser?{jobsUser:$.jobsUser}:{}},X;try{_9(W,JSON.stringify(Y),{mode:384});let I=P4({configPath:W,root:$.cwd,grantedRoot:$.root,workRoot:$.root,temporaryDirectory:U});X=$.spawnWorker?.(W,Y)??j9(I.command,I.args,{...I.options,env:$.environment,stdio:["ignore","ignore","ignore"]})}catch(I){throw Q.disposeSocket(),I}let N=!1,C=new Promise((I,z)=>{X.once("exit",(_)=>{N=!0,I(_)}),X.once("error",(_)=>{N=!0,z(_)})});C.catch(()=>{});let F={root:$.root,runId:$.claim.run_id,scopeId:Q.scopeId,socketPath:Q.socketPath,generation:1,fenceId:Y.fenceId,executorLaunchId:Y.launchId,expiresAtMs:Y.expiresAtMs},D=async(I)=>{let z=await I4(F,{type:"job",version:2,generation:1,id:N2(),jobId:$.claim.operation_id,...I==="start"?{action:I,input:{script:$.command,leaseExpiresAtMs:$.expiresAtMs}}:I==="inspect"?{action:I,input:{after:0}}:I==="probe"?{action:"inspect",input:{after:Number.MAX_SAFE_INTEGER}}:{action:I,input:{}}},new AbortController().signal);if(!z.ok)throw V0(z.error);return z.job},w=!1,M=!1,j,O=()=>{w=!0,X.kill("SIGTERM")};$.signal.addEventListener("abort",O,{once:!0});let R,g=0,v=async(I)=>{let z=[...I.output],_={version:1,process_id:$.claim.operation_id,state:I.state,exit_code:I.exitCode,first_cursor:I.firstCursor,next_cursor:I.nextCursor,truncated:I.truncated,output:z,observed_at:new Date().toISOString()};while(Buffer.byteLength(JSON.stringify(_))>90000&&z.length)z.shift(),_.truncated=!0,_.first_cursor=z[0]?.cursor??_.next_cursor+1;R=c0.parse(_),await $.emit(R),g=Date.now()};try{let I=Math.min(Date.now()+1e4,$.expiresAtMs);while(!C2(Y.readyPath)){if(N)throw new H("process_start_failed","The managed process supervisor exited before accepting a command; no command was dispatched.");if($.signal.aborted||Date.now()>=I)throw V0("process_start_unconfirmed");await L4(25)}let z=JSON.parse(A9(Y.readyPath,"utf8"));if(z.launchId!==Y.launchId||z.fenceId!==Y.fenceId||z.workerArtifactSha256!==P0)throw V0();if($.signal.throwIfAborted(),J.cancelRequested)return M4($.claim.operation_id);let _;try{M=!0,_=await D("start")}catch(E){if(!(E instanceof H)||E.code!=="hands_job_result_unknown")throw E;_=await D("inspect")}if(J.phase="running",J.cancel=async()=>{await D("cancel")},B&&$.preview)J.tunnels=D4({claim:$.claim,executorLaunchId:Y.launchId,expiresAtMs:$.expiresAtMs,deniedPorts:$.preview.deniedPorts,inspect:async()=>J.phase==="running"&&!N?await D("probe"):null});if(J.cancelRequested)await J.cancel(),_=await D("inspect");for(;;){if(!["starting","running"].includes(_.state))J.phase="settling",J.cancel=void 0;if(!R||R.state!==_.state||R.next_cursor!==_.nextCursor&&Date.now()-g>=5000)await v(_);if(!["starting","running"].includes(_.state))break;if($.signal.aborted||N)throw V0();await L4(1000);try{_=await D("inspect"),j=void 0}catch(E){if(!(E instanceof H)||E.code!=="hands_job_result_unknown"||$.signal.aborted||N||Date.now()-(j??=Date.now())>120000)throw E}}if(!R||R.state==="uncertain")throw V0();return R}finally{if(J.phase="settling",J.cancel=void 0,J.tunnels?.dispose(),J.tunnels=void 0,await J.cancelInFlight?.catch(()=>{}),$.signal.removeEventListener("abort",O),!N&&!w)X.kill("SIGTERM");let I,z=await Promise.race([C.then((_)=>({code:_})),new Promise((_)=>{I=setTimeout(()=>_(null),6000)})]).finally(()=>{clearTimeout(I)});if(!z){X.kill("SIGKILL");try{await C}finally{if(N)Q.disposeSocket()}throw V0("process_cleanup_unconfirmed")}try{if((w||$.signal.aborted)&&z.code===0&&M){A4(U);let _=JSON.parse(T4(Y.directTerminalReceiptPath)),E=U2.safeParse(_.observation);if(Object.keys(_).length===4&&_.launch_id===Y.launchId&&_.fence_id===Y.fenceId&&_.scope_id===Q.scopeId&&E.success&&E.data.process_id===$.claim.operation_id){if(B)G();throw new n0(E.data)}}}catch(_){if(_ instanceof n0)throw _}finally{if(N)Q.disposeSocket()}if(z.code!==0&&!w&&M)throw V0("process_cleanup_unconfirmed");if(!w&&z.code===0&&(R&&["exited","cancelled","expired"].includes(R.state)||!M&&J.cancelRequested)||B&&z.code===0&&!M)G()}}async function kK($,J){if(J.kind===U4&&$.capability===g4){let K=R0.get($.operation_id);if(K?.claim===$&&K.tunnels)K.tunnels.open(J.payload);else F2(J.payload,$.operation_id,"server_not_running");return!0}if(J.kind!==Z4||!K4($.capability)||!$.owner||J.payload.process_id!==$.operation_id)return!1;let Z=R0.get($.operation_id);if(Z&&Z.claim!==$)return!1;let Q=S4($);if(Q.cancelRequested=!0,Q.phase==="running"&&Q.cancel)Q.cancelInFlight??=Q.cancel(),await Q.cancelInFlight;return!0}function fK($,J){R0.delete($);let Z=j1.get($);if(!Z||J!=="succeeded"&&!Z.anyCompletion)return j1.delete($),!1;try{let Q=z4(Z.path);if(!Q.isDirectory()||Q.isSymbolicLink()||Q.ino!==Z.ino||Q.dev!==Z.dev||Q.uid!==process.getuid?.()||(Q.mode&63)!==0||O1(Z.path)!==Z.path||C2(X0(Z.path,"owner.lock")))return!1;return T9(Z.path,{recursive:!0}),j1.delete($),!0}catch{return!1}}import{createServer as q9,request as g9}from"http";import{connect as S9,isIP as k9}from"net";var h4=120000,f9=15000;function b9($,J,Z){let Q=x4(J).toLowerCase().replace(/\.$/,"");if(!Q||k9(Q))return!1;return $.some((K)=>{if(!W2.test(K))return!1;let B=K.lastIndexOf(":"),G=B>0?K.slice(0,B):K;if(B>0&&Number(K.slice(B+1))!==Z)return!1;return G.startsWith("*.")?Q.endsWith(G.slice(1)):Q===G})}function x9($,J){let Z=/^\[?([^\]]+?)\]?:([0-9]{1,5})$/.exec($),Q=Z?Z[1]:$,K=Z?Number(Z[2]):J;return Q&&K>=1&&K<=65535?{host:Q,port:K}:null}async function H2($,J,Z){if(!b9(Z,$,J))return null;let Q=await y4($);return Q.ok?Q.addresses[0]:null}function i0($,J){$.end(`HTTP/1.1 ${J} ${J===403?"Forbidden":"Bad Gateway"}\r
|
|
16
16
|
Connection: close\r
|
|
17
17
|
Content-Length: 0\r
|
|
18
18
|
\r
|
|
19
|
-
`)}function
|
|
19
|
+
`)}function k4($,J){return new Promise((Z,Q)=>{let K=S9({host:$,port:J}),B=setTimeout(()=>K.destroy(Error("connect_timeout")),f9);K.once("connect",()=>{clearTimeout(B),Z(K)}),K.once("error",(G)=>{clearTimeout(B),Q(G)})})}function f4($,J,Z){for(let Q of[$,J])Q.on("error",()=>{$.destroy(),J.destroy()}),Q.on("close",()=>{$.destroy(),J.destroy()});if(J.setTimeout(h4,()=>J.destroy()),Z.length)J.write(Z);$.pipe(J).pipe($)}function b4($,J){let Z={...$,host:J};return delete Z["proxy-authorization"],delete Z["proxy-connection"],Z}async function m4($,J=()=>{}){let Z=[...$],Q=new Set,K=(U)=>{Q.add(U),U.once("close",()=>Q.delete(U))},B=q9((U,W)=>{(async()=>{let Y;try{Y=new URL(U.url??"")}catch{Y=new URL("invalid:")}let X=Number(Y.port||80),N=Y.protocol==="http:"?await H2(Y.hostname,X,Z):null;if(!N){J(),W.writeHead(403,{connection:"close"}).end();return}let C=g9({host:N,port:X,method:U.method,path:`${Y.pathname}${Y.search}`,headers:b4(U.headers,Y.host),agent:!1,timeout:h4},(F)=>{W.writeHead(F.statusCode??502,F.headers),F.pipe(W)});C.on("timeout",()=>C.destroy()),C.on("error",()=>{if(!W.headersSent)W.writeHead(502);W.end()}),W.on("close",()=>C.destroy()),U.pipe(C)})().catch(()=>{if(!W.headersSent)W.writeHead(502);W.end()})});B.on("connection",K),B.on("connect",(U,W,Y)=>{K(W),W.on("error",()=>W.destroy()),(async()=>{let X=x9(U.url??"",443),N=X?await H2(X.host,X.port,Z):null;if(!X||!N){J(),i0(W,403);return}let C=await k4(N,X.port).catch(()=>null);if(!C){i0(W,502);return}if(W.destroyed){C.destroy();return}K(C),W.write(`HTTP/1.1 200 Connection Established\r
|
|
20
20
|
\r
|
|
21
|
-
`),
|
|
21
|
+
`),f4(W,C,Y)})().catch(()=>W.destroy())}),B.on("upgrade",(U,W,Y)=>{K(W),W.on("error",()=>W.destroy()),(async()=>{let X;try{X=new URL(U.url??"")}catch{i0(W,403);return}let N=Number(X.port||80),C=["http:","ws:"].includes(X.protocol)?await H2(X.hostname,N,Z):null;if(!C){J(),i0(W,403);return}let F=await k4(C,N).catch(()=>null);if(!F){i0(W,502);return}K(F);let D=b4(U.headers,X.host),w=[`${U.method} ${X.pathname}${X.search} HTTP/1.1`];for(let[M,j]of Object.entries(D))for(let O of Array.isArray(j)?j:j===void 0?[]:[j])w.push(`${M}: ${O}`);F.write(`${w.join(`\r
|
|
22
22
|
`)}\r
|
|
23
23
|
\r
|
|
24
|
-
`),g4(W,F,Y)})().catch(()=>W.destroy())}),await new Promise((U,W)=>{B.once("error",W),B.listen(0,"127.0.0.1",()=>U())});let{port:G}=B.address();return{url:`http://127.0.0.1:${G}`,close(){B.close();for(let U of Q)U.destroy()}}}import{createHash as j2,randomUUID as x9}from"crypto";import{closeSync as t0,constants as c,fchownSync as y9,fstatSync as z0,fsyncSync as h9,linkSync as m9,mkdirSync as v9,openSync as o4,readSync as t4,unlinkSync as p9,writeSync as u9}from"fs";import{platform as r4}from"os";import{getSystemErrorName as d9}from"util";var y4={type:"string",format:"uuid"},p4=String.raw`^(?![\\/])(?![A-Za-z]:[\\/])(?!.*(?:^|[\\/])\.\.(?:[\\/]|$))(?!.*\u0000)(?=.*\S)[\s\S]+$`,A1={type:"string",minLength:1,maxLength:4096,pattern:p4},D2=V.string().min(1).max(4096).regex(new RegExp(p4)),T1={device_id:V.string().uuid(),root_id:V.string().uuid(),timeout_ms:V.number().int().min(1000).max(60000).optional()},_1={device_id:y4,root_id:y4,timeout_ms:{type:"integer",minimum:1000,maximum:60000}},hK={read:{schema:V.object({...T1,path:D2,offset:V.number().int().min(0).optional(),max_bytes:V.number().int().min(1).max(131072).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path"],properties:{..._1,path:A1,offset:{type:"integer",minimum:0},max_bytes:{type:"integer",minimum:1,maximum:131072}},additionalProperties:!1}},write:{schema:V.object({...T1,path:D2,content:V.string().max(131072),mode:V.enum(["overwrite","append"]).optional(),create_parents:V.boolean().optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path","content"],properties:{..._1,path:A1,content:{type:"string",maxLength:131072},mode:{type:"string",enum:["overwrite","append"]},create_parents:{type:"boolean"}},additionalProperties:!1}},exec:{schema:V.object({...T1,command:V.string().min(1).max(16000),cwd:D2.optional(),mode:V.enum(["confined","host"]).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","command"],properties:{..._1,command:{type:"string",minLength:1,maxLength:16000},cwd:A1,mode:{type:"string",enum:["confined","host"],description:"Defaults to host: the existing permitted login shell with OS/account access, requiring execute and environment-discovery permission. Request confined explicitly for a scrubbed shell without network."}},additionalProperties:!1}}},W0=1073741824,i0=600000,h4=String.raw`(?!\.{1,2}(?:/|(?![\s\S])))[^/\\\u0000]+`,u4=String.raw`^(?![A-Za-z]:/)(?=[\s\S]*\S)${h4}(?:/${h4})*(?![\s\S])`,d4=new RegExp(u4);function l4($){return typeof $==="string"&&$.length>0&&$.length<=4096&&d4.test($)}var M2=V.string().min(1).max(4096).regex(d4),L2={...A1,pattern:u4},s4=V.string().regex(/^[a-f0-9]{64}$/),c4=V.object({kind:V.literal("workspace"),path:M2}).strict(),k9=V.discriminatedUnion("kind",[c4,V.object({kind:V.literal("attachment"),attachment_id:V.string().min(1).max(120),sha256:s4}).strict()]),R1=1,o0="cloud_workspace_id",w2="cloud_workspace",O2=1,f9=V.discriminatedUnion("kind",[c4,V.object({kind:V.literal("attachment"),download_url:V.string().min(1).max(16384),size_bytes:V.number().int().min(0).max(W0),sha256:s4}).strict()]),n4=V.object({source_version:V.literal(R1),source:f9,url:V.string().min(1).max(16384),transfer_cloud_scope:V.object({sandboxId:V.string().min(1).max(256),revision:V.number().int().nonnegative(),brainFence:V.string().uuid()}).strict().optional(),[o0]:V.string().min(1).max(160).optional()}).strict(),mK=V.object({ready:V.literal(!0),cloud_source_version:V.literal(R1),source_kinds:V.array(V.enum(["workspace","attachment"]))});var m4=V.object({...T1,timeout_ms:V.number().int().min(1000).max(i0).optional(),source_path:M2,destination_path:M2,idempotency_key:V.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/).optional()}).strict(),v4={type:"object",required:["device_id","root_id","source_path","destination_path"],properties:{..._1,timeout_ms:{type:"integer",minimum:1000,maximum:i0},source_path:L2,destination_path:L2,idempotency_key:{type:"string",minLength:1,maxLength:160,pattern:"^[A-Za-z0-9._:-]+$"}},additionalProperties:!1},b9={oneOf:[{type:"object",required:["kind","path"],properties:{kind:{type:"string",const:"workspace"},path:L2},additionalProperties:!1},{type:"object",required:["kind","attachment_id","sha256"],properties:{kind:{type:"string",const:"attachment"},attachment_id:{type:"string",minLength:1,maxLength:120},sha256:{type:"string",pattern:"^[a-f0-9]{64}$"}},additionalProperties:!1}]},vK=V.union([m4,m4.omit({source_path:!0}).extend({source:k9}).strict()]),pK={...v4,required:["device_id","root_id","destination_path"],properties:{...v4.properties,source:b9},oneOf:[{required:["source_path"],not:{required:["source"]}},{required:["source"],not:{required:["source_path"]}}]};var I2=65536;function u($){throw new H($,$)}function z1($){return typeof $==="object"&&$!==null&&"code"in $&&typeof $.code==="string"?$.code:void 0}function P1($,J,Z){if(J.throwIfAborted(),$ instanceof H||$ instanceof Error&&$.name==="AbortError")throw $;return u(Z)}function l9($,J,Z){let Q;switch(z1($)){case"ENOENT":Q=Z==="export"?"transfer_source_missing":"transfer_path_unavailable";break;case"EACCES":case"EPERM":case"EROFS":Q="transfer_permission_denied";break;case"ELOOP":case"ENOTDIR":Q="transfer_path_unsafe";break;case"EEXIST":Q="transfer_destination_exists";break;default:Q="transfer_path_unavailable"}return P1($,J,Q)}function s9($){if(typeof $!=="string"||$.length>16384)return u("transfer_url_invalid");let J;try{J=new URL($)}catch{return u("transfer_url_invalid")}if(J.protocol!=="https:"||J.username||J.password||J.hash)return u("transfer_url_invalid");return J.href}async function c9(){if(r4()==="linux")return{open:(U,W,Y,X=384)=>o4(`/proc/self/fd/${U}/${W}`,Y,X),mkdir:(U,W)=>v9(`/proc/self/fd/${U}/${W}`,{mode:448}),link:(U,W,Y)=>m9(`/proc/self/fd/${U}/${W}`,`/proc/self/fd/${U}/${Y}`),unlink:(U,W)=>p9(`/proc/self/fd/${U}/${W}`),close:()=>{}};if(r4()!=="darwin")return u("transfer_platform_unsupported");let{dlopen:$,FFIType:J,ptr:Z,read:Q}=await import("bun:ffi"),K=$("/usr/lib/libSystem.B.dylib",{__error:{args:[],returns:J.ptr},openat:{args:[J.i32,J.ptr,J.i32,J.i32,J.i32,J.i32,J.i32,J.i32,J.i32],returns:J.i32},mkdirat:{args:[J.i32,J.ptr,J.i32],returns:J.i32},linkat:{args:[J.i32,J.ptr,J.i32,J.ptr,J.i32],returns:J.i32},unlinkat:{args:[J.i32,J.ptr,J.i32],returns:J.i32}}),B=K.symbols.__error();if(B===null)return K.close(),u("transfer_path_unavailable");let G=(U)=>{if(U<0){let W=d9(-Q.i32(B));throw Object.assign(Error("transfer_path_unavailable"),{code:W})}return U};return{open:(U,W,Y,X=384)=>G(K.symbols.openat(U,Z(Buffer.from(`${W}\x00`)),Y,X,0,0,0,0,X)),mkdir:(U,W)=>{G(K.symbols.mkdirat(U,Z(Buffer.from(`${W}\x00`)),448))},link:(U,W,Y)=>{G(K.symbols.linkat(U,Z(Buffer.from(`${W}\x00`)),U,Z(Buffer.from(`${Y}\x00`)),0))},unlink:(U,W)=>{G(K.symbols.unlinkat(U,Z(Buffer.from(`${W}\x00`)),0))},close:()=>K.close()}}function e4($,J){let Z=z0($),Q=z0(J);if(Q.uid!==Z.uid||Q.gid!==Z.gid)y9(J,Z.uid,Z.gid)}function n9($,J,Z,Q){if(!l4(Z))return u("transfer_path_invalid");let K=Z.split("/"),B=o4(J,c.O_RDONLY|c.O_DIRECTORY|c.O_NOFOLLOW);try{for(let G of K.slice(0,-1)){let U;try{U=$.open(B,G,c.O_RDONLY|c.O_DIRECTORY|c.O_NOFOLLOW)}catch(W){if(!Q||z1(W)!=="ENOENT")throw W;try{$.mkdir(B,G)}catch(Y){if(z1(Y)!=="EEXIST")throw Y}U=$.open(B,G,c.O_RDONLY|c.O_DIRECTORY|c.O_NOFOLLOW),e4(B,U)}t0(B),B=U}return{fd:B,leaf:K.at(-1)}}catch(G){throw t0(B),G}}function a4($,J){let Z=z0($,{bigint:!0});if(!Z.isFile()||Z.size>W0)return u("transfer_file_invalid");let Q=j2("sha256"),K=Buffer.alloc(I2),B=0;while(!0){J.throwIfAborted();let U=t4($,K,0,K.length,B);if(!U)break;if(B+=U,B>W0)return u("transfer_size_exceeded");Q.update(K.subarray(0,U))}let G=z0($,{bigint:!0});if(BigInt(B)!==Z.size||G.size!==Z.size||G.mtimeNs!==Z.mtimeNs||G.ctimeNs!==Z.ctimeNs)return u("transfer_source_changed");return{size_bytes:B,sha256:Q.digest("hex")}}async function q0($){$.signal.throwIfAborted();try{let J=s9($.payload.url),Z=await c9(),Q,K,B;try{if(Q=n9(Z,$.root,$.path,$.direction==="import"),$.direction==="export"){K=Z.open(Q.fd,Q.leaf,c.O_RDONLY|c.O_NOFOLLOW|c.O_NONBLOCK);let C=z0(K,{bigint:!0});if(!C.isFile()||C.size>W0)return u("transfer_file_invalid");let F=j2("sha256"),D=0,w=K,M,j=new ReadableStream({pull(v){try{$.signal.throwIfAborted();let I=Buffer.alloc(I2),q=t4(w,I,0,I.length,D);if(!q){v.close();return}if(D+=q,D>C.size)return u("transfer_source_changed");F.update(I.subarray(0,q)),v.enqueue(I.subarray(0,q))}catch(I){throw M=I,I}}});try{let v=await($.fetchImpl??fetch)(J,Object.assign({method:"PUT",body:j,redirect:"error",signal:$.signal,headers:{"content-type":"application/octet-stream","content-length":String(C.size)}},{duplex:"half"}));if(M!==void 0)throw M;if(!v.ok)return u("transfer_upload_failed");await v.body?.cancel()}catch(v){if(M!==void 0)throw M;return P1(v,$.signal,"transfer_upload_failed")}let O=z0(K,{bigint:!0});if(BigInt(D)!==C.size||O.size!==C.size||O.mtimeNs!==C.mtimeNs||O.ctimeNs!==C.ctimeNs)return u("transfer_source_changed");let R=F.digest("hex"),E=a4(K,$.signal);if(E.size_bytes!==D||E.sha256!==R)return u("transfer_source_changed");return{size_bytes:D,sha256:R,outcome:"copied"}}let G=$.payload.size_bytes,U=$.payload.sha256;if(typeof G!=="number"||!Number.isSafeInteger(G)||G<0||G>W0||typeof U!=="string"||!/^[a-f0-9]{64}$/.test(U))return u("transfer_receipt_invalid");let W;try{W=Z.open(Q.fd,Q.leaf,c.O_RDONLY|c.O_NOFOLLOW|c.O_NONBLOCK)}catch(C){if(z1(C)!=="ENOENT")throw C}if(W!==void 0){try{let C=a4(W,$.signal);if(C.size_bytes===G&&C.sha256===U)return{...C,outcome:"already_present"}}finally{t0(W)}return u("transfer_destination_exists")}B=`.reason-copy-${x9()}`,K=Z.open(Q.fd,B,c.O_CREAT|c.O_EXCL|c.O_WRONLY|c.O_NOFOLLOW,384),e4(Q.fd,K);let Y;try{let C=await($.fetchImpl??fetch)(J,{redirect:"error",signal:$.signal});if(!C.ok||!C.body)return u("transfer_download_failed");Y=C.body.getReader()}catch(C){return P1(C,$.signal,"transfer_download_failed")}let X=j2("sha256"),N=0;try{while(!0){$.signal.throwIfAborted();let C=await Y.read().catch((F)=>P1(F,$.signal,"transfer_download_failed"));if(C.done)break;if(N+=C.value.length,N>G)return u("transfer_size_mismatch");X.update(C.value);for(let F=0;F<C.value.length;)$.signal.throwIfAborted(),F+=u9(K,C.value,F,Math.min(I2,C.value.length-F))}}finally{await Y.cancel().catch(()=>{})}if(N!==G||X.digest("hex")!==U)return u("transfer_hash_mismatch");return h9(K),await $.beforeCommit?.(),$.signal.throwIfAborted(),Z.link(Q.fd,B,Q.leaf),{size_bytes:G,sha256:U,outcome:"copied"}}finally{try{if(K!==void 0)t0(K)}finally{try{if(Q){if(B)try{Z.unlink(Q.fd,B)}catch{}t0(Q.fd)}}finally{Z.close()}}}}catch(J){return l9(J,$.signal,$.direction)}}import{spawn as a9}from"child_process";import{mkdtempSync as i9,rmSync as o9,writeFileSync as t9}from"fs";import{constants as e9,platform as $$,tmpdir as J$}from"os";import{join as Q8}from"path";import{gunzipSync as r9,gzipSync as oK}from"zlib";var J8=900000,eK=J8+60000,e0=49152,$8=($)=>V.string().min(1).max($).regex(/^[A-Za-z0-9+/]+=*$/),Z8=V.object({version:V.literal(1),script_gzip:$8(163840),stdin_gzip:$8(65536),cwd:V.string().min(1).max(4096).startsWith("/"),env:V.record(V.string().regex(/^[A-Z_][A-Z0-9_]{0,63}$/),V.string().max(4096)).refine(($)=>Object.keys($).length<=16,"too many variables"),timeout_ms:V.number().int().min(1000).max(J8)}).strict(),A2=V.string().max(e0+256),$B=V.object({exit_code:V.number().int().min(0).max(255),stdout:A2,stderr:A2,combined:A2.optional()}).strict();function T2($){return r9(Buffer.from($,"base64")).toString("utf8")}var Z$="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",Q$=["RUSTUP_HOME","TZ","LC_ALL"],K$=2000,B$=100;function R2(){return $$()==="linux"&&process.geteuid?.()===0}function _2($){let J=Math.floor($/2),Z=[],Q=0,K=Buffer.alloc(0),B=0;return{push(G){B+=G.length;let U=G;if(Q<J){let W=U.subarray(0,J-Q);Z.push(W),Q+=W.length,U=U.subarray(W.length)}if(U.length)K=Buffer.concat([K,U]).subarray(-J)},text(){let G=B-Q-K.length;return Buffer.concat(Z).toString("utf8")+(G>0?`
|
|
24
|
+
`),f4(W,F,Y)})().catch(()=>W.destroy())}),await new Promise((U,W)=>{B.once("error",W),B.listen(0,"127.0.0.1",()=>U())});let{port:G}=B.address();return{url:`http://127.0.0.1:${G}`,close(){B.close();for(let U of Q)U.destroy()}}}import{createHash as j2,randomUUID as v9}from"crypto";import{closeSync as e0,constants as s,fchownSync as p9,fstatSync as z0,fsyncSync as u9,linkSync as d9,mkdirSync as l9,openSync as $8,readSync as J8,unlinkSync as s9,writeSync as c9}from"fs";import{platform as o4}from"os";import{getSystemErrorName as n9}from"util";var v4={type:"string",format:"uuid"},l4=String.raw`^(?![\\/])(?![A-Za-z]:[\\/])(?!.*(?:^|[\\/])\.\.(?:[\\/]|$))(?!.*\u0000)(?=.*\S)[\s\S]+$`,T1={type:"string",minLength:1,maxLength:4096,pattern:l4},D2=V.string().min(1).max(4096).regex(new RegExp(l4)),_1={device_id:V.string().uuid(),root_id:V.string().uuid(),timeout_ms:V.number().int().min(1000).max(60000).optional()},R1={device_id:v4,root_id:v4,timeout_ms:{type:"integer",minimum:1000,maximum:60000}},uK={read:{schema:V.object({..._1,path:D2,offset:V.number().int().min(0).optional(),max_bytes:V.number().int().min(1).max(131072).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path"],properties:{...R1,path:T1,offset:{type:"integer",minimum:0},max_bytes:{type:"integer",minimum:1,maximum:131072}},additionalProperties:!1}},write:{schema:V.object({..._1,path:D2,content:V.string().max(131072),mode:V.enum(["overwrite","append"]).optional(),create_parents:V.boolean().optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path","content"],properties:{...R1,path:T1,content:{type:"string",maxLength:131072},mode:{type:"string",enum:["overwrite","append"]},create_parents:{type:"boolean"}},additionalProperties:!1}},exec:{schema:V.object({..._1,command:V.string().min(1).max(16000),cwd:D2.optional(),mode:V.enum(["confined","host"]).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","command"],properties:{...R1,command:{type:"string",minLength:1,maxLength:16000},cwd:T1,mode:{type:"string",enum:["confined","host"],description:"Defaults to host: the existing permitted login shell with OS/account access, requiring execute and environment-discovery permission. Request confined explicitly for a scrubbed shell without network."}},additionalProperties:!1}}},W0=1073741824,o0=600000,p4=String.raw`(?!\.{1,2}(?:/|(?![\s\S])))[^/\\\u0000]+`,s4=String.raw`^(?![A-Za-z]:/)(?=[\s\S]*\S)${p4}(?:/${p4})*(?![\s\S])`,c4=new RegExp(s4);function n4($){return typeof $==="string"&&$.length>0&&$.length<=4096&&c4.test($)}var M2=V.string().min(1).max(4096).regex(c4),L2={...T1,pattern:s4},r4=V.string().regex(/^[a-f0-9]{64}$/),a4=V.object({kind:V.literal("workspace"),path:M2}).strict(),y9=V.discriminatedUnion("kind",[a4,V.object({kind:V.literal("attachment"),attachment_id:V.string().min(1).max(120),sha256:r4}).strict()]),P1=1,t0="cloud_workspace_id",w2="cloud_workspace",O2=1,h9=V.discriminatedUnion("kind",[a4,V.object({kind:V.literal("attachment"),download_url:V.string().min(1).max(16384),size_bytes:V.number().int().min(0).max(W0),sha256:r4}).strict()]),i4=V.object({source_version:V.literal(P1),source:h9,url:V.string().min(1).max(16384),transfer_cloud_scope:V.object({sandboxId:V.string().min(1).max(256),revision:V.number().int().nonnegative(),brainFence:V.string().uuid()}).strict().optional(),[t0]:V.string().min(1).max(160).optional()}).strict(),dK=V.object({ready:V.literal(!0),cloud_source_version:V.literal(P1),source_kinds:V.array(V.enum(["workspace","attachment"]))});var u4=V.object({..._1,timeout_ms:V.number().int().min(1000).max(o0).optional(),source_path:M2,destination_path:M2,idempotency_key:V.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/).optional()}).strict(),d4={type:"object",required:["device_id","root_id","source_path","destination_path"],properties:{...R1,timeout_ms:{type:"integer",minimum:1000,maximum:o0},source_path:L2,destination_path:L2,idempotency_key:{type:"string",minLength:1,maxLength:160,pattern:"^[A-Za-z0-9._:-]+$"}},additionalProperties:!1},m9={oneOf:[{type:"object",required:["kind","path"],properties:{kind:{type:"string",const:"workspace"},path:L2},additionalProperties:!1},{type:"object",required:["kind","attachment_id","sha256"],properties:{kind:{type:"string",const:"attachment"},attachment_id:{type:"string",minLength:1,maxLength:120},sha256:{type:"string",pattern:"^[a-f0-9]{64}$"}},additionalProperties:!1}]},lK=V.union([u4,u4.omit({source_path:!0}).extend({source:y9}).strict()]),sK={...d4,required:["device_id","root_id","destination_path"],properties:{...d4.properties,source:m9},oneOf:[{required:["source_path"],not:{required:["source"]}},{required:["source"],not:{required:["source_path"]}}]};var I2=65536;function u($){throw new H($,$)}function E1($){return typeof $==="object"&&$!==null&&"code"in $&&typeof $.code==="string"?$.code:void 0}function z1($,J,Z){if(J.throwIfAborted(),$ instanceof H||$ instanceof Error&&$.name==="AbortError")throw $;return u(Z)}function r9($,J,Z){let Q;switch(E1($)){case"ENOENT":Q=Z==="export"?"transfer_source_missing":"transfer_path_unavailable";break;case"EACCES":case"EPERM":case"EROFS":Q="transfer_permission_denied";break;case"ELOOP":case"ENOTDIR":Q="transfer_path_unsafe";break;case"EEXIST":Q="transfer_destination_exists";break;default:Q="transfer_path_unavailable"}return z1($,J,Q)}function a9($){if(typeof $!=="string"||$.length>16384)return u("transfer_url_invalid");let J;try{J=new URL($)}catch{return u("transfer_url_invalid")}if(J.protocol!=="https:"||J.username||J.password||J.hash)return u("transfer_url_invalid");return J.href}async function i9(){if(o4()==="linux")return{open:(U,W,Y,X=384)=>$8(`/proc/self/fd/${U}/${W}`,Y,X),mkdir:(U,W)=>l9(`/proc/self/fd/${U}/${W}`,{mode:448}),link:(U,W,Y)=>d9(`/proc/self/fd/${U}/${W}`,`/proc/self/fd/${U}/${Y}`),unlink:(U,W)=>s9(`/proc/self/fd/${U}/${W}`),close:()=>{}};if(o4()!=="darwin")return u("transfer_platform_unsupported");let{dlopen:$,FFIType:J,ptr:Z,read:Q}=await import("bun:ffi"),K=$("/usr/lib/libSystem.B.dylib",{__error:{args:[],returns:J.ptr},openat:{args:[J.i32,J.ptr,J.i32,J.i32,J.i32,J.i32,J.i32,J.i32,J.i32],returns:J.i32},mkdirat:{args:[J.i32,J.ptr,J.i32],returns:J.i32},linkat:{args:[J.i32,J.ptr,J.i32,J.ptr,J.i32],returns:J.i32},unlinkat:{args:[J.i32,J.ptr,J.i32],returns:J.i32}}),B=K.symbols.__error();if(B===null)return K.close(),u("transfer_path_unavailable");let G=(U)=>{if(U<0){let W=n9(-Q.i32(B));throw Object.assign(Error("transfer_path_unavailable"),{code:W})}return U};return{open:(U,W,Y,X=384)=>G(K.symbols.openat(U,Z(Buffer.from(`${W}\x00`)),Y,X,0,0,0,0,X)),mkdir:(U,W)=>{G(K.symbols.mkdirat(U,Z(Buffer.from(`${W}\x00`)),448))},link:(U,W,Y)=>{G(K.symbols.linkat(U,Z(Buffer.from(`${W}\x00`)),U,Z(Buffer.from(`${Y}\x00`)),0))},unlink:(U,W)=>{G(K.symbols.unlinkat(U,Z(Buffer.from(`${W}\x00`)),0))},close:()=>K.close()}}function Z8($,J){let Z=z0($),Q=z0(J);if(Q.uid!==Z.uid||Q.gid!==Z.gid)p9(J,Z.uid,Z.gid)}function o9($,J,Z,Q){if(!n4(Z))return u("transfer_path_invalid");let K=Z.split("/"),B=$8(J,s.O_RDONLY|s.O_DIRECTORY|s.O_NOFOLLOW);try{for(let G of K.slice(0,-1)){let U;try{U=$.open(B,G,s.O_RDONLY|s.O_DIRECTORY|s.O_NOFOLLOW)}catch(W){if(!Q||E1(W)!=="ENOENT")throw W;try{$.mkdir(B,G)}catch(Y){if(E1(Y)!=="EEXIST")throw Y}U=$.open(B,G,s.O_RDONLY|s.O_DIRECTORY|s.O_NOFOLLOW),Z8(B,U)}e0(B),B=U}return{fd:B,leaf:K.at(-1)}}catch(G){throw e0(B),G}}function t4($,J){let Z=z0($,{bigint:!0});if(!Z.isFile()||Z.size>W0)return u("transfer_file_invalid");let Q=j2("sha256"),K=Buffer.alloc(I2),B=0;while(!0){J.throwIfAborted();let U=J8($,K,0,K.length,B);if(!U)break;if(B+=U,B>W0)return u("transfer_size_exceeded");Q.update(K.subarray(0,U))}let G=z0($,{bigint:!0});if(BigInt(B)!==Z.size||G.size!==Z.size||G.mtimeNs!==Z.mtimeNs||G.ctimeNs!==Z.ctimeNs)return u("transfer_source_changed");return{size_bytes:B,sha256:Q.digest("hex")}}async function E0($){$.signal.throwIfAborted();try{let J=a9($.payload.url),Z=await i9(),Q,K,B;try{if(Q=o9(Z,$.root,$.path,$.direction==="import"),$.direction==="export"){K=Z.open(Q.fd,Q.leaf,s.O_RDONLY|s.O_NOFOLLOW|s.O_NONBLOCK);let C=z0(K,{bigint:!0});if(!C.isFile()||C.size>W0)return u("transfer_file_invalid");let F=j2("sha256"),D=0,w=K,M,j=new ReadableStream({pull(v){try{$.signal.throwIfAborted();let I=Buffer.alloc(I2),z=J8(w,I,0,I.length,D);if(!z){v.close();return}if(D+=z,D>C.size)return u("transfer_source_changed");F.update(I.subarray(0,z)),v.enqueue(I.subarray(0,z))}catch(I){throw M=I,I}}});try{let v=await($.fetchImpl??fetch)(J,Object.assign({method:"PUT",body:j,redirect:"error",signal:$.signal,headers:{"content-type":"application/octet-stream","content-length":String(C.size)}},{duplex:"half"}));if(M!==void 0)throw M;if(!v.ok)return u("transfer_upload_failed");await v.body?.cancel()}catch(v){if(M!==void 0)throw M;return z1(v,$.signal,"transfer_upload_failed")}let O=z0(K,{bigint:!0});if(BigInt(D)!==C.size||O.size!==C.size||O.mtimeNs!==C.mtimeNs||O.ctimeNs!==C.ctimeNs)return u("transfer_source_changed");let R=F.digest("hex"),g=t4(K,$.signal);if(g.size_bytes!==D||g.sha256!==R)return u("transfer_source_changed");return{size_bytes:D,sha256:R,outcome:"copied"}}let G=$.payload.size_bytes,U=$.payload.sha256;if(typeof G!=="number"||!Number.isSafeInteger(G)||G<0||G>W0||typeof U!=="string"||!/^[a-f0-9]{64}$/.test(U))return u("transfer_receipt_invalid");let W;try{W=Z.open(Q.fd,Q.leaf,s.O_RDONLY|s.O_NOFOLLOW|s.O_NONBLOCK)}catch(C){if(E1(C)!=="ENOENT")throw C}if(W!==void 0){try{let C=t4(W,$.signal);if(C.size_bytes===G&&C.sha256===U)return{...C,outcome:"already_present"}}finally{e0(W)}return u("transfer_destination_exists")}B=`.reason-copy-${v9()}`,K=Z.open(Q.fd,B,s.O_CREAT|s.O_EXCL|s.O_WRONLY|s.O_NOFOLLOW,384),Z8(Q.fd,K);let Y;try{let C=await($.fetchImpl??fetch)(J,{redirect:"error",signal:$.signal});if(!C.ok||!C.body)return u("transfer_download_failed");Y=C.body.getReader()}catch(C){return z1(C,$.signal,"transfer_download_failed")}let X=j2("sha256"),N=0;try{while(!0){$.signal.throwIfAborted();let C=await Y.read().catch((F)=>z1(F,$.signal,"transfer_download_failed"));if(C.done)break;if(N+=C.value.length,N>G)return u("transfer_size_mismatch");X.update(C.value);for(let F=0;F<C.value.length;)$.signal.throwIfAborted(),F+=c9(K,C.value,F,Math.min(I2,C.value.length-F))}}finally{await Y.cancel().catch(()=>{})}if(N!==G||X.digest("hex")!==U)return u("transfer_hash_mismatch");return u9(K),await $.beforeCommit?.(),$.signal.throwIfAborted(),Z.link(Q.fd,B,Q.leaf),{size_bytes:G,sha256:U,outcome:"copied"}}finally{try{if(K!==void 0)e0(K)}finally{try{if(Q){if(B)try{Z.unlink(Q.fd,B)}catch{}e0(Q.fd)}}finally{Z.close()}}}}catch(J){return r9(J,$.signal,$.direction)}}import{spawn as e9}from"child_process";import{mkdtempSync as $$,rmSync as J$,writeFileSync as Z$}from"fs";import{constants as Q$,platform as K$,tmpdir as B$}from"os";import{join as V8}from"path";import{gunzipSync as t9,gzipSync as JB}from"zlib";var K8=900000,QB=K8+60000,$1=49152,Q8=($)=>V.string().min(1).max($).regex(/^[A-Za-z0-9+/]+=*$/),B8=V.object({version:V.literal(1),script_gzip:Q8(163840),stdin_gzip:Q8(65536),cwd:V.string().min(1).max(4096).startsWith("/"),env:V.record(V.string().regex(/^[A-Z_][A-Z0-9_]{0,63}$/),V.string().max(4096)).refine(($)=>Object.keys($).length<=16,"too many variables"),timeout_ms:V.number().int().min(1000).max(K8)}).strict(),A2=V.string().max($1+256),KB=V.object({exit_code:V.number().int().min(0).max(255),stdout:A2,stderr:A2,combined:A2.optional()}).strict();function T2($){return t9(Buffer.from($,"base64")).toString("utf8")}var V$="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",G$=["RUSTUP_HOME","TZ","LC_ALL"],U$=2000,X$=100;function R2(){return K$()==="linux"&&process.geteuid?.()===0}function _2($){let J=Math.floor($/2),Z=[],Q=0,K=Buffer.alloc(0),B=0;return{push(G){B+=G.length;let U=G;if(Q<J){let W=U.subarray(0,J-Q);Z.push(W),Q+=W.length,U=U.subarray(W.length)}if(U.length)K=Buffer.concat([K,U]).subarray(-J)},text(){let G=B-Q-K.length;return Buffer.concat(Z).toString("utf8")+(G>0?`
|
|
25
25
|
[reason: ${G} bytes of output omitted]
|
|
26
|
-
`:"")+K.toString("utf8")}}}async function K8($,J){if(!R2())throw new H("workspace_setup_requires_root","Workspace setup runs only on a root Linux worker.");let Z=Z8.safeParse($);if(!Z.success)throw new H("invalid_request","Reason sent an invalid workspace setup.");let Q=Z.data,K,B;try{K=T2(Q.script_gzip),B=T2(Q.stdin_gzip)}catch{throw new H("invalid_request","Reason sent an unreadable workspace setup.")}J.throwIfAborted();let G=i9(Q8(J$(),"reason-workspace-setup-"));try{let U=Q8(G,"setup.sh");t9(U,K,{mode:384});let W={PATH:Z$,LANG:"C.UTF-8",HOME:"/root",USER:"root",LOGNAME:"root",SHELL:"/bin/bash",TMPDIR:"/tmp"};for(let E of Q$)if(process.env[E])W[E]=process.env[E];Object.assign(W,Q.env);let Y=a9("/bin/bash",[U],{cwd:Q.cwd,env:W,detached:!0,stdio:["pipe","pipe","pipe"]}),X=_2(e0),N=_2(e0),C=_2(e0);Y.stdout.on("data",(E)=>{X.push(E),C.push(E)}),Y.stderr.on("data",(E)=>{N.push(E),C.push(E)}),Y.stdin.on("error",()=>{}),Y.stdin.end(B);let F=(E)=>{try{if(Y.pid)process.kill(-Y.pid,E)}catch{}},D=!1,w,M=()=>{F("SIGTERM"),w??=setTimeout(()=>F("SIGKILL"),K$)},j=setTimeout(()=>{D=!0,M()},Q.timeout_ms);J.addEventListener("abort",M,{once:!0});let O=await new Promise((E,v)=>{Y.once("error",()=>v(new H("workspace_setup_start_failed","The workspace setup did not start."))),Y.once("exit",(I,q)=>E({code:I,signal:q}))}).finally(()=>{clearTimeout(j),clearTimeout(w),J.removeEventListener("abort",M)});await new Promise((E)=>{let v=setTimeout(E,B$);Y.once("close",()=>{clearTimeout(v),E()})}),Y.stdout.destroy(),Y.stderr.destroy(),J.throwIfAborted();let R=D?124:O.signal?128+(e9.signals[O.signal]??0):O.code??1;return{exit_code:Math.min(255,R),stdout:X.text(),stderr:N.text(),...R!==0?{combined:C.text()}:{}}}finally{o9(G,{recursive:!0,force:!0})}}import{chmodSync as V$,mkdtempSync as G$,realpathSync as U8,rmSync as U$}from"fs";import{tmpdir as X$}from"os";import{dirname as W$,join as P2,sep as Y$}from"path";function z2($){return G8($,V8($)!==null).repoPath}function X8($,J){let Z;try{if(typeof J!=="string")throw Error("invalid");Z=[$1,void 0].map((K)=>W$(B8({kind:"managed",workspaceId:J,...K?{layout:K}:{}})))}catch{throw new H("cloud_copy_workspace_invalid","The Cloud copy workspace is invalid.")}let Q;for(let K of Z)try{Q=U8(P2($,K));break}catch{}if(Q===void 0)throw new H("cloud_copy_workspace_unavailable","The Session workspace is not on this computer.");if(!Q.startsWith(`${$}${Y$}`))throw new H("cloud_copy_workspace_invalid","The Cloud copy workspace is outside this worker's root.");return Q}async function W8($){$.signal.throwIfAborted();let J=$.source;if(J.kind==="workspace"){let Q=z2($.runtimeRoot);if(L0(Q)||L0(P2(Q,J.path)))throw new H("protected_path","Credential and secret paths are unavailable to local tasks.");return q0({direction:"export",root:Q,path:J.path,payload:{url:$.url},signal:$.signal,fetchImpl:$.fetchImpl})}let Z=G$(P2(X$(),`reason-cloud-copy-${process.pid}-`));try{V$(Z,448);let Q=U8(Z);await q0({direction:"import",root:Q,path:"source",payload:{url:J.download_url,size_bytes:J.size_bytes,sha256:J.sha256},signal:$.signal,fetchImpl:$.fetchImpl});let K=await q0({direction:"export",root:Q,path:"source",payload:{url:$.url},signal:$.signal,fetchImpl:$.fetchImpl});if(K.size_bytes!==J.size_bytes||K.sha256!==J.sha256)throw new H("transfer_source_changed","The verified attachment changed before export.");return K}finally{U$(Z,{recursive:!0,force:!0})}}import{constants as A0}from"fs";import{closeSync as O7,existsSync as G0,fstatSync as j7,lstatSync as I7,mkdirSync as dZ,mkdtempSync as A7,openSync as T7,readSync as lZ,realpathSync as J0,rmSync as _7,statSync as N1,writeSync as sZ}from"fs";import{homedir as W1,platform as l,tmpdir as R7}from"os";import{dirname as Y1,isAbsolute as cZ,join as _3,relative as w3,resolve as nZ,sep as rZ}from"path";import{spawn as aZ}from"child_process";import{createHash as D$,randomBytes as M$}from"crypto";var q2=30000,F$=1800000,N$=5000,q1=30000,C$=g1+15000,Y8=/^\/app\/local-runtime\/operations\/[0-9a-fA-F-]{36}\/heartbeat$/,H$=[/^\/app\/local-runtime\/operations\/claim$/,Y8];class E2{options;current=null;connecting=null;retryAt=0;failures=0;nextId=0;closed=!1;reconnectTimer=null;constructor($){this.options=$}now(){return(this.options.now??Date.now)()}jitter($){return Math.floor((this.options.random??Math.random)()*$)}async request($,J,Z){Z?.throwIfAborted();let Q=this.current;if(!Q)return this.connect(),null;if(Q.pending.size>=Q.maxInFlight)return null;let K=String(++this.nextId),B=new Promise((W)=>Q.pending.set(K,{path:$,resolve:W}));if(!this.send(Q,{t:"req",id:K,path:$,body:J}))return Q.pending.delete(K),null;let G;if(H$.some((W)=>W.test($)))G=setTimeout(()=>{if(Q.pending.has(K))this.drop(Q)},C$);else{let W=()=>{if(!Q.pending.has(K))return;let Y=this.now()-Q.lastFrameAt;if(Y>=q1)this.drop(Q);else G=setTimeout(W,q1-Y)};G=setTimeout(W,q1)}if(B.finally(()=>clearTimeout(G)),!Z)return await B;let U=new Promise((W,Y)=>{let X=()=>{if(Q.pending.delete(K),clearTimeout(G),this.send(Q,{t:"abort",id:K}),this.now()-Q.lastFrameAt>q1)this.drop(Q);Y(Z.reason)};if(Z.aborted)X();else Z.addEventListener("abort",X,{once:!0}),B.finally(()=>Z.removeEventListener("abort",X))});return await Promise.race([B,U])}cadence(){return this.current?.cadence??null}close(){if(this.closed=!0,this.reconnectTimer)clearTimeout(this.reconnectTimer);for(let $ of[this.current,this.connecting])if($)this.drop($)}send($,J){try{return $.socket.send(JSON.stringify(J)),!0}catch{return this.drop($),!1}}drop($){if($.dropped)return;$.dropped=!0,this.settle($);try{$.socket.close()}catch{}}settle($){for(let J of $.pending.values())J.resolve(null);if($.pending.clear(),this.current===$)this.current=null,this.retryAt=Math.max(this.retryAt,this.now()+this.jitter(N$));if(this.connecting===$){this.connecting=null,this.failures+=1;let J=Math.min(F$,q2*2**Math.min(this.failures-1,10));this.retryAt=Math.max(this.retryAt,this.now()+J/2+this.jitter(J/2))}}connect(){if(this.closed||this.connecting||this.now()<this.retryAt)return;let $=this.options.WebSocket??globalThis.WebSocket;if(!$){this.retryAt=Number.POSITIVE_INFINITY;return}let J=new URL(E1,this.options.apiOrigin);J.protocol=J.protocol==="https:"?"wss:":"ws:",J.searchParams.set("device_id",this.options.deviceId);let Z;try{Z=new $(J.toString())}catch{this.failures+=1,this.retryAt=this.now()+q2;return}let Q={socket:Z,pending:new Map,maxInFlight:0,cadence:null,lastFrameAt:this.now(),dropped:!1};this.connecting=Q,Z.onmessage=(K)=>this.receive(Q,K.data),Z.onclose=()=>this.settle(Q),Z.onerror=()=>this.settle(Q)}receive($,J){if(typeof J!=="string")return;let Z;try{Z=JSON.parse(J)}catch{return}if($.lastFrameAt=this.now(),Z.t==="res"){let Q=$.pending.get(Z.id);$.pending.delete(Z.id),Q?.resolve({status:Z.status,body:Z.body,retryAfter:Z.retry_after??null});return}if(Z.t==="challenge"&&this.connecting===$){let Q;try{Q=this.options.signHello(Z.challenge)}catch{this.drop($);return}this.send($,{t:"hello",...Q});return}if(Z.t==="ready"&&this.connecting===$){this.connecting=null,this.failures=0,$.maxInFlight=Math.max(1,Math.min(Z.max_in_flight,1000)),$.cadence=Z.cadence??null;let Q=this.current;if(this.current=$,Q){for(let[K,B]of Q.pending){if(!Y8.test(B.path))continue;Q.pending.delete(K),this.send(Q,{t:"abort",id:K}),B.resolve(null)}if(Q.pending.size===0)this.drop(Q)}return}if(Z.t==="fallback"){this.retryAt=this.now()+Math.max(q2,Math.min(Z.retry_after_ms,86400000)),this.drop($);return}if(Z.t==="reconnect"&&this.current===$&&!this.reconnectTimer)this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.retryAt=0,this.connect()},Math.max(0,Math.min(Z.after_ms,60000)))}}var S2=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.run.v1","process.full.v1","preview.serve.v1","pty.start","git.run","process.list","ports.list","computer.use","browser.use","browser.recording.v1","browser.pr-proof.v1","hands.connect","jobs.control","environment.install","github.local.v1","inference.custom.v1","display.stream.v1","automation.call.v1","simulator.call.v1","simulator.stream.v1","tunnel.open","tunnel.close","workspace.setup.v1"];function RB($,J={}){let Z=L$($),Q=J.rootPathsSupported===!0?D1($.root_paths):void 0;return{supported_operations:[...$.supported_operations],...J.accountRootMetadataSupported===!0&&typeof $.account_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test($.account_root_fingerprint)?{account_root_fingerprint:$.account_root_fingerprint}:{},...J.workspaceRootMetadataSupported===!0&&typeof $.workspace_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test($.workspace_root_fingerprint)?{workspace_root_fingerprint:$.workspace_root_fingerprint}:{},...J.accountRootPathSupported===!0&&typeof $.account_root_path==="string"&&$.account_root_path.startsWith("/")&&$.account_root_path.length<=4096?{account_root_path:$.account_root_path}:{},...J.homeContainedRootsSupported===!0&&Array.isArray($.home_contained_root_fingerprints)&&$.home_contained_root_fingerprints.length<=32&&$.home_contained_root_fingerprints.every((K)=>/^[a-f0-9]{64}$/.test(K))?{home_contained_root_fingerprints:[...$.home_contained_root_fingerprints]}:{},...Q?{root_paths:Q}:{},...Object.keys(Z).length?{operation_constraints:Z}:{},...$.hands_worker_artifact_sha256&&$.hands_worker_entrypoint?{hands_worker_artifact_sha256:$.hands_worker_artifact_sha256,hands_worker_entrypoint:$.hands_worker_entrypoint}:{},...$.hands_slots!==void 0?{hands_slots:$.hands_slots}:{}}}function L$($){let J=(Q)=>Q===null||typeof Q==="boolean"||typeof Q==="number"&&Number.isFinite(Q)||typeof Q==="string"&&Q.length<=512,Z={};for(let Q of $.supported_operations){let K=$.operation_constraints?.[Q];if(!K||typeof K!=="object"||Array.isArray(K))continue;if(!("ready"in K)||typeof K.ready!=="boolean")continue;let B={};for(let[G,U]of Object.entries(K).slice(0,32)){if(!G.length||G.length>64||["__proto__","constructor","prototype"].includes(G))continue;if(J(U)||Array.isArray(U)&&U.length<=64&&U.every(J))B[G]=U}if(Object.keys(B).length)Z[Q]=B}return Z}class Y0 extends Error{status;code;retryAfter;constructor($,J,Z,Q=null){super(Z);this.status=$;this.code=J;this.retryAfter=Q;this.name="LocalRuntimeHttpError"}}class S1 extends Error{timeoutMs;constructor($){super(`Reason Device request did not answer within ${$}ms.`);this.timeoutMs=$;this.name="LocalRuntimeRequestTimeoutError"}}function w$($){return $===408||$===429||$===500||$===502||$===503||$===504}function O$($){if($ instanceof Y0)return!1;if($ instanceof S1)return!0;if(!($ instanceof Error))return!1;if($.name==="AbortError")return!1;if($ instanceof TypeError&&$.message.toLowerCase().includes("fetch failed"))return!0;for(let J of[$,$.cause])if(J&&typeof J==="object"&&"code"in J){let Z=String(J.code);if(["ECONNRESET","ECONNREFUSED","ETIMEDOUT","EHOSTUNREACH","ENOTFOUND","EAI_AGAIN","ConnectionClosed","ConnectionRefused","UND_ERR_SOCKET","UND_ERR_CONNECT_TIMEOUT"].includes(Z))return!0}return!1}function j$($,J,Z=500){if(J instanceof Y0&&J.retryAfter){let B=parseFloat(J.retryAfter);if(Number.isFinite(B)&&B>0)return Math.min(B*1000,1e4)}let Q=Z*2**$,K=Math.floor(Math.random()*200);return Math.min(Q+K,5000)}async function I$($,J){if(J?.aborted)throw J.reason??new DOMException("The operation was aborted.","AbortError");await new Promise((Z,Q)=>{let K=()=>{clearTimeout(B),Q(J?.reason??new DOMException("The operation was aborted.","AbortError"))},B=setTimeout(()=>{J?.removeEventListener("abort",K),Z()},$);J?.addEventListener("abort",K,{once:!0})})}function PB($){return $ instanceof Y0&&$.status===401&&($.code==="device_revoked"||$.code==="invalid_device_credential")}function F8($){return Buffer.byteLength(JSON.stringify($)??"null","utf8")}function N8($){return D$("sha256").update($??"").digest("hex")}function A$($){return L8({method:$.method,pathAndQuery:$.route,timestamp:$.timestamp,nonce:$.nonce,challenge:$.challenge,bodySha256:$.bodySha256})}function C8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}var T$=20000,_$=1e4,H8=[2000,4000],R$=30000,P$=15000;function D8($){return $?{keepalive:!1}:{}}class g2 extends Error{constructor($){super(`Reason Device proof challenge did not answer within ${$}ms.`)}}class z${fetchImpl;proofStore;proofOptions;apiOrigin;spareChallenge=null;sessions=new Map;sessionsClosed=!1;constructor($,J=fetch,Z,Q={}){this.fetchImpl=J;this.proofStore=Z;this.proofOptions=Q;let K=new URL($);if(K.protocol!=="https:"&&K.hostname!=="127.0.0.1"&&K.hostname!=="localhost"&&K.hostname!=="[::1]"&&K.hostname!=="::1")throw Error("Reason Device API must use HTTPS, except for localhost development.");this.apiOrigin=K.origin}async parseResponse($){if($.status===204)return null;let J=await $.json().catch(()=>({}));if(!$.ok){let{code:Z,message:Q}=w8(J,$.status),K=$.headers?.get?.("retry-after")??null;throw new Y0($.status,Z,Q,K)}return J}async challenge($,J,Z={fresh:!1}){let Q=this.proofOptions.challengeAttemptTimeoutsMs??H8;for(let K of Q)try{return await this.challengeAttempt($,J,K,Z.fresh)}catch(B){if(J?.aborted||!(B instanceof g2))throw B;Z.fresh=!0}return await this.challengeAttempt($,J,null,Z.fresh)}async challengeAttempt($,J,Z,Q=!1){let K=JSON.stringify({device_id:$}),B=Z===null?null:new AbortController,G=B&&Z!==null?setTimeout(()=>B.abort(new g2(Z)),Z):null;try{let U=await this.fetchImpl(`${this.apiOrigin}${d.authChallenge.path}`,{method:"POST",redirect:"error",headers:{accept:"application/json","content-type":"application/json"},body:K,...D8(Q),signal:B?J?AbortSignal.any([J,B.signal]):B.signal:J});return O8(await this.parseResponse(U))}catch(U){if(!J?.aborted&&B?.signal.aborted)throw B.signal.reason;throw U}finally{if(G)clearTimeout(G)}}async takeSpareChallenge($){let J=this.spareChallenge;if(this.spareChallenge=null,!J||J.deviceId!==$)return null;let Z=await J.challenge,Q=(this.proofOptions.now??Date.now)();return Z&&Date.parse(Z.expires_at)-Q>=T$?Z:null}refillSpareChallenge($){let J=this.challengeAttempt($,void 0,H8[0]??2000).catch(()=>null);this.spareChallenge={deviceId:$,challenge:J}}async proofHeaders($,J,Z,Q,K=!1,B,G){let U=B&&Date.parse(B.expires_at)-(this.proofOptions.now??Date.now)()>=_$?B:null,W=!U&&K?await this.takeSpareChallenge(Z.deviceId):null,Y=U??W??await this.challenge(Z.deviceId,Q,G);if(K)this.refillSpareChallenge(Z.deviceId);let X=N8(J),N=this.signProof("POST",$,Y.challenge,X);return{"x-device-id":Z.deviceId,"x-device-timestamp":N.timestamp,"x-device-nonce":N.nonce,"x-device-challenge":Y.challenge,"x-device-body-sha256":X,"x-device-signature":N.signature}}signProof($,J,Z,Q){let K=String(Math.trunc((this.proofOptions.now??Date.now)())),B=(this.proofOptions.nonce??(()=>M$(24)))();if(B.byteLength<16||B.byteLength>32)throw Error("Invalid Reason Device proof nonce.");let G=Buffer.from(B).toString("base64url"),U=this.proofStore.sign(A$({method:$,route:J,timestamp:K,nonce:G,challenge:Z,bodySha256:Q}));if(!/^[A-Za-z0-9_-]{8,128}$/.test(U))throw Error("Reason Device proof boundary returned an invalid signature.");return{timestamp:K,nonce:G,signature:U}}sessionFor($,J){if(!this.proofOptions.deviceSession||this.sessionsClosed||!J||!M8($.path))return null;let Z=this.sessions.get(J.deviceId);if(!Z)Z=new E2({apiOrigin:this.apiOrigin,deviceId:J.deviceId,signHello:(Q)=>this.signProof("GET",E1,Q,N8("")),...this.proofOptions.webSocket?{WebSocket:this.proofOptions.webSocket}:{},...this.proofOptions.now?{now:this.proofOptions.now}:{}}),this.sessions.set(J.deviceId,Z);return Z}sessionCadence($){let J=this.proofOptions.deviceSession&&!this.sessionsClosed?this.sessions.get($.deviceId)?.cadence()??null:null;return J?{presenceIntervalMs:J.presence_interval_ms,claimWaitMs:J.claim_wait_ms}:null}close(){this.sessionsClosed=!0;for(let $ of this.sessions.values())$.close();this.sessions.clear()}async request($,J){if(J.body!==void 0&&F8(J.body)>N0)throw Error("Reason Device request exceeds the 256 KB protocol limit.");if(J.authorization!==void 0&&J.device!==void 0)throw Error("Reason Device request cannot combine bearer and proof authentication.");let Z=J.authorization!==void 0,Q=J.device!==void 0;if(!($.auth==="none"?!Z&&!Q:$.auth==="registration_bearer"?Z&&!Q:Z!==Q))throw Error(`Reason Device request used invalid authentication for ${$.path}.`);let B=J.body===void 0?void 0:JSON.stringify(J.body),G=this.proofOptions.maxAttempts??4,U=this.proofOptions.sleep??I$,W=this.sessionFor($,J.device),Y=Math.max(R$,(J.holdMs??0)+P$),X={fresh:!1},N;for(let C=0;C<G;C+=1)try{let F=await W?.request($.path,J.sessionBody===void 0?B??"":JSON.stringify(J.sessionBody),J.signal)??null;if(F)return await this.parseResponse(new Response(F.status===204?null:F.body,{status:F.status,headers:F.retryAfter===null?{}:{"retry-after":F.retryAfter}}));let D=new AbortController,w=setTimeout(()=>D.abort(new S1(Y)),Y),M=J.signal?AbortSignal.any([J.signal,D.signal]):D.signal;try{let j=J.device===void 0?{}:await this.proofHeaders($.path,B,J.device,M,J.useSpareChallenge===!0&&C===0,C===0?J.issuedChallenge:void 0,X),O=await this.fetchImpl(`${this.apiOrigin}${$.path}`,{method:"POST",redirect:"error",headers:{...J.authorization===void 0?{}:{authorization:`Bearer ${J.authorization}`},...j,accept:"application/json",...J.body===void 0?{}:{"content-type":"application/json"}},body:B,...D8(X.fresh),signal:M});return await this.parseResponse(O)}catch(j){if(!J.signal?.aborted&&D.signal.aborted)throw D.signal.reason;throw j}finally{clearTimeout(w)}}catch(F){if(N=F,F instanceof S1)X.fresh=!0;if(J.signal?.aborted)throw F;let D=J.device!==void 0&&F instanceof Y0&&F.status===401&&["invalid_device_proof","device_proof_replayed"].includes(F.code),w=F instanceof Y0&&w$(F.status),M=O$(F),j=J.transientRetryOwner!=="caller"&&(w||M);if((D||j)&&C+1<G){let O=D?0:j$(C,F,this.proofOptions.retryBaseDelayMs??500);if(O>0)await U(O,J.signal);continue}if(D&&C+1>=G)throw Error("Reason Device proof retry was exhausted.");throw F}throw N??Error("Reason Device request failed.")}async register($,J,Z){let Q=await this.request(d.register,{authorization:$,body:J,signal:Z});return j8(Q)}async enroll($,J,Z,Q){let K=await this.request(d.enroll,{body:{...Z,enrollment_ticket:$,code_verifier:J},signal:Q});return I8(K)}async heartbeat($,J,Z,Q){let K=await this.request(d.heartbeat,{device:$,body:J,signal:Z,...Q?{issuedChallenge:Q}:{}});return A8(K)}async syncRoots($,J,Z){let Q=await this.request(d.rootsSync,{device:$,body:{roots:J},signal:Z});return T8(Q)}async identity($,J){let Z=await this.request(d.identity,{device:$,signal:J});return _8(Z)}async disconnect($,J,Z,Q=[]){let K=await this.request(d.disconnect,{device:$,body:Z?{successor_device_id:Z,...Q.length?{successor_roots:Q}:{}}:{},signal:J});return R8(K)}async deviceLifecycle($,J,Z){let Q=await this.request(d.lifecycle,{device:$,body:J,signal:Z});z8(Q)}async localSubscription($,J,Z){return P8(await this.request(d.localSubscription,{device:$,body:J,signal:Z}))}async ownerWorkspaces($,J){let Q=(await this.request(d.ownerWorkspaces,{device:$,body:{},signal:J}))?.organizations;if(!Array.isArray(Q))throw Error("Reason returned an invalid workspace list.");return Q.flatMap((K)=>{let B=K;return typeof B?.id==="string"?[{id:B.id,...typeof B.name==="string"&&B.name.trim()?{name:B.name.trim()}:{},blocked:B.blocked===!0}]:[]})}async ownerWorkspaceEnrollment($,J,Z){return this.request(d.ownerWorkspaceEnrollment,{device:$,body:J,signal:Z})}async liveSessionWorktrees($,J,Z){let Q=await this.request(d.sessionWorktrees,{device:$,body:{worktree_ids:[...J]},signal:Z}).catch((K)=>{if(K instanceof Y0&&K.status===404)return null;throw K});if(Q===null)return null;if(!C8(Q)||!Array.isArray(Q.live)||!Q.live.every((K)=>typeof K==="string"&&J.includes(K)))throw Error("Reason returned an invalid Session worktree answer.");return Q.live}async claimOperation($,J={}){let Z=Math.max(J.waitMs??25000,0),Q=(G)=>({wait_ms:Math.min(Z,G),...J.instanceGeneration===void 0?{}:{instance_generation:J.instanceGeneration}}),K=this.sessionCadence($)?.claimWaitMs,B=await this.request(d.operationClaim,{device:$,body:Q(30000),holdMs:Math.min(Z,30000),...K===void 0?{}:{sessionBody:Q(Math.min(K,g1))},signal:J.signal});if(B===null)return null;return q8(B,S2)}async operationHeartbeat($,J,Z={}){let Q=(G)=>this.request(d.operationHeartbeat.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,...Z.controlAckSeq===void 0?{}:{control_ack_seq:Z.controlAckSeq},...G?{client_retry_count:Z.clientRetryCount}:{},...G&&Z.waitMs!==void 0?{wait_ms:Math.min(Math.max(Z.waitMs,0),30000)}:{}},signal:Z.signal,transientRetryOwner:Z.transientRetryOwner,...G&&Z.waitMs!==void 0?{holdMs:Math.min(Math.max(Z.waitMs,0),30000)}:{}}),K=(Z.clientRetryCount??0)>0||Z.waitMs!==void 0,B;try{B=await Q(K)}catch(G){if(!K||!(G instanceof Y0)||G.status!==400||G.code!=="invalid_operation_heartbeat")throw G;B=await Q(!1)}return E8(B)}async operationEvents($,J,Z){if(!Number.isInteger(Z.eventSeqStart)||Z.eventSeqStart<0||Z.events.length<1||Z.events.length>100||Z.events.some((K)=>!/^[A-Za-z0-9._:-]{1,64}$/.test(K.kind)||!C8(K.payload)))throw Error("Invalid Reason Device operation event batch.");let Q=await this.request(d.operationEvents.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,event_seq_start:Z.eventSeqStart,events:Z.events},signal:Z.signal,transientRetryOwner:Z.transientRetryOwner,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return g8(Q)}async completeOperation($,J,Z,Q){let K={attempt_id:J.attempt_id,attempt_token:J.attempt_token,status:Z.status,...Z.result===void 0?{}:{result:Z.result},...Z.error_code?{error_code:Z.error_code}:{}};if(F8(K)>N0)throw Error("Reason Device operation result exceeds the 256 KB protocol limit.");let B=await this.request(d.operationComplete.forOperation(J.operation_id),{device:$,body:K,signal:Q});return k8(B)}async operationCustomEndpointCredential($,J,Z){let{CustomEndpointDeviceCredentialSchema:Q}=await import("./custom-endpoint-device-p2bvtf6p.js");return Q.parse(await this.request(d.operationCustomEndpointCredential.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token},signal:Z}))}async operationEnvironment($,J,Z,Q){let K=await this.request(d.operationEnvironment.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,snapshot_id:Z},signal:Q,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return S8(K)}async acknowledgeOperationEnvironment($,J,Z,Q){await this.request(d.operationEnvironmentAck.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,...Z},signal:Q,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}})}}var q$=new Set(["process.run.v1","process.full.v1","computer.use","browser.use"]),J1=new Set(["jobs.control","environment.install","tunnel.open","tunnel.close","display.stream.v1","automation.call.v1","workspace.setup.v1","simulator.call.v1","simulator.stream.v1"]);function k1($,J){if(q$.has($))return!1;if(J1.has($)&&!J.runtimeDirectory)return!1;if(($==="inference.custom.v1"||$==="preview.serve.v1"||$==="simulator.call.v1"||$==="simulator.stream.v1")&&(J.executionMode!=="unsandboxed"||!J.runtimeDirectory))return!1;if(J.executionMode!=="unsandboxed"&&(["exec.full","hands.connect","pty.start","browser.pr-proof.v1"].includes($)||J1.has($)))return!1;return!0}import{accessSync as E$,constants as g$,existsSync as S$,statSync as k$}from"fs";import{basename as f$,isAbsolute as b$}from"path";var Z1=["-lic"],x$="/bin/zsh",y$=new Set(["zsh","bash"]),f8=20000,k2=60000,h$=65536,m$=64,v$=8192,p$=new Set(["NODE_OPTIONS","PATH","ZDOTDIR","BASH_ENV","ENV"]),u$=["DYLD_","LD_"];function d$($){let J=$.toUpperCase();return p$.has(J)||u$.some((Z)=>J.startsWith(Z))}function b8($=process.env){return!0}function l$($){if(!b$($)||$.includes("\x00"))return!1;if(!y$.has(f$($)))return!1;try{if(!k$($).isFile())return!1;return E$($,g$.X_OK),!0}catch{return!1}}function E0($=process.env){let J=$.SHELL?.trim();if(J&&l$(J))return J;return x$}function f2($=process.env){return b8($)&&S$(E0($))}function b2($=process.env){if(!b8($))throw new H("full_control_disabled","Full-control execution is unavailable on this Reason Device.")}function x2($){if(typeof $!=="string"||$.length===0||$.includes("\x00")||Buffer.byteLength($,"utf8")>h$)throw new H("invalid_payload","command is missing or too large.");return $}function y2($){if($===void 0||$===null)return{forwarded:{},ignored:[]};if(typeof $!=="object"||Array.isArray($))throw new H("invalid_payload","env must be an object of strings.");let J=Object.entries($);if(J.length>m$)throw new H("invalid_payload","env has too many entries.");let Z={},Q=[];for(let[K,B]of J){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(K)||typeof B!=="string"||B.includes("\x00")||Buffer.byteLength(B,"utf8")>v$)throw new H("invalid_payload","env entry is invalid or too large.");if(d$(K)){Q.push(K);continue}Z[K]=B}return{forwarded:Z,ignored:Q}}async function x8($){let J=$.processEnv??process.env;if(b2(J),$.signal.aborted)throw new H("cancelled","Operation was cancelled.");let Z=x2($.command),Q=E0(J),{forwarded:K,ignored:B}=y2($.requestEnv),G=await $.spawn(Q,[...Z1,Z],{cwd:$.cwd,timeoutMs:$.timeoutMs,signal:$.signal,env:{...J,...K}});return{exit_code:G.exitCode,signal:G.signal,stdout:G.stdout,stderr:G.stderr,timed_out:G.timedOut,truncated:G.truncated,shell:Q,shell_flags:[...Z1],login:!0,interactive:!0,sandbox:"none",ignored_env:B}}function y8($=process.env){return{transport:"shell",shell:`${E0($)} ${Z1.join(" ")}`,login_shell:!0,interactive_shell:!0,rc_files_loaded:!0,sandbox:"none",network:!0,environment:"inherited",privilege:"user",sudo:"argv_exact_nopasswd_only",activation:"explicit_device_grant",max_timeout_ms:k2}}import{readFile as s$,readdir as c$,readlink as n$,realpath as r$}from"fs/promises";import{basename as a$,relative as i$,sep as o$}from"path";var w0="/proc",t$=250,h8=500,e$=50,$J=250,JJ=1024,m8=4096,ZJ=1,QJ=3,v8=9,KJ="0A",BJ=/^socket:\[(\d+)\]$/,h2={readDirectory:($)=>c$($),readLink:($)=>n$($),readTextFile:($)=>s$($,"utf8"),realPath:($)=>r$($)};function u8($,J){return J===$||J.startsWith(`${$}${o$}`)}function VJ($,J){return i$($,J)||"."}async function d8($){let J;try{J=await $.readDirectory(w0)}catch{return[]}return J.filter((Z)=>/^[0-9]+$/.test(Z)).map((Z)=>Number(Z)).filter((Z)=>Number.isSafeInteger(Z)&&Z>0).sort((Z,Q)=>Z-Q)}async function l8($,J){try{let Q=(await J.readTextFile(`${w0}/${$}/comm`)).slice(0,m8).split(`
|
|
27
|
-
`,1)[0]?.trim();if(Q)return Q}catch{}try{let Q=(await J.readTextFile(`${w0}/${$}/cmdline`)).slice(0,
|
|
28
|
-
`).slice(1)){if(Z.length>=J)break;let K=Q.trim().split(/\s+/);if(K.length<=v8)continue;if(K[QJ]?.toUpperCase()!==KJ)continue;let B=K[ZJ]??"",G=B.lastIndexOf(":");if(G<0)continue;let U=Number.parseInt(B.slice(G+1),16);if(!Number.isInteger(U)||U<=0||U>65535)continue;let W=UJ(B.slice(0,G),U),Y=K[v8];if(!W||!Y||!/^[0-9]+$/.test(Y))continue;Z.push({inode:Y,port:U,address:W})}return Z}async function WJ($){let J=[];for(let Z of["tcp","tcp6"]){if(J.length>=h8)break;let Q;try{Q=await $.readTextFile(`${w0}/net/${Z}`)}catch{continue}J.push(...XJ(Q,h8-J.length))}return J}async function YJ($,J){let Z=new Map;if($.size===0)return Z;for(let Q of await d8(J)){if(Z.size>=$.size)break;let K;try{K=await J.readDirectory(`${w0}/${Q}/fd`)}catch{continue}for(let B of K.slice(0,JJ)){let G;try{G=await J.readLink(`${w0}/${Q}/fd/${B}`)}catch{continue}let U=G.match(BJ)?.[1];if(!U||!$.has(U)||Z.has(U))continue;Z.set(U,Q)}}return Z}async function n8($,J=h2){let Z=await WJ(J),Q=await YJ(new Set(Z.map((X)=>X.inode)),J),K=[];for(let X of Z){let N=Q.get(X.inode);if(N===void 0)continue;K.push({pid:N,port:X.port,address:X.address})}K.sort((X,N)=>X.pid-N.pid||X.port-N.port||(X.address<N.address?-1:X.address>N.address?1:0));let B=[...new Set(K.map((X)=>X.pid))].slice(0,e$),G=await Promise.all(B.map(async(X)=>[X,await s8(X,J)])),U=new Map(G),W=K.filter((X)=>{let N=U.get(X.pid);return Boolean(N&&u8($,N))}),Y=new Map(await Promise.all([...new Set(W.map((X)=>X.pid))].map(async(X)=>[X,await l8(X,J)])));return{ports:W.slice(0,$J).map((X)=>({pid:X.pid,command:Y.get(X.pid)??null,address:X.address}))}}import{posix as v2}from"path";var f1=200,FJ=250,NJ=250;async function b1($,J){let Z=await $(J);if(Z.timedOut||Z.truncated||Z.exitCode!==0&&Z.exitCode!==1)throw new H("process_inspection_failed","Reading this Mac's processes did not complete.");let Q=[],K=null;for(let B of Z.stdout.split(/\r?\n/))if(B.startsWith("p")){let G=Number(B.slice(1));if(K=Number.isInteger(G)&&G>0?{pid:G,command:null,names:[]}:null,K)Q.push(K)}else if(K&&B.startsWith("c"))K.command=B.slice(1)||null;else if(K&&B.startsWith("n"))K.names.push(B.slice(1));return Q}function m2($,J){return J===$||J.startsWith($==="/"?$:`${$}/`)}var r8="/System/Volumes/Data",CJ=["/tmp","/var","/etc"];function p2($){let J=v2.normalize($);if(J.startsWith(`${r8}/`))J=J.slice(r8.length);return CJ.find((Q)=>J===Q||J.startsWith(`${Q}/`))?`/private${J}`:J}function a8($){return $&&v2.isAbsolute($)?p2($):null}async function i8($,J){let Z=new Map;for(let Q=0;Q<J.length;Q+=f1){let K=J.slice(Q,Q+f1).join(",");for(let B of await b1($,["-a","-p",K,"-d","cwd","-Fpcn"]))Z.set(B.pid,{command:B.command,cwd:a8(B.names[0])})}return Z}async function o8($,J){let Z=p2($),Q=(await b1(J,["-d","cwd","-Fpn"])).filter((B)=>{let G=a8(B.names[0]);return G!==null&&m2(Z,G)}).map((B)=>B.pid).slice(0,FJ),K=await i8(J,Q);return{processes:Q.flatMap((B)=>{let G=K.get(B);return G?.cwd&&m2(Z,G.cwd)?[{pid:B,command:G.command,cwd:v2.relative(Z,G.cwd)||"."}]:[]})}}async function t8($,J){let Z=p2($),Q=["-nP","-iTCP","-sTCP:LISTEN","-Fpcn"],K=await b1(J,Q),B=await i8(J,K.map((Y)=>Y.pid)),G=K.map((Y)=>Y.pid).filter((Y)=>{let X=B.get(Y)?.cwd;return Boolean(X&&m2(Z,X))});if(G.length===0)return{ports:[]};let U=new Set(K.flatMap((Y)=>Y.names.map((X)=>`${Y.pid} ${X}`))),W=[];for(let Y=0;Y<G.length;Y+=f1){let X=G.slice(Y,Y+f1).join(",");for(let N of await b1(J,["-a","-p",X,...Q]))for(let C of N.names)if(U.has(`${N.pid} ${C}`))W.push({pid:N.pid,command:N.command,address:C})}return{ports:W.slice(0,NJ)}}import{join as PJ}from"path";import{spawn as jJ}from"child_process";import{randomUUID as IJ}from"crypto";import{chmodSync as J5,lstatSync as Z5,mkdirSync as AJ,readdirSync as TJ,statSync as _J,unlinkSync as RJ}from"fs";import{join as d2}from"path";function Q1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}var u2={targets:24,assets:128,sourceFiles:2000,sourceBytes:20000000,outputBytes:20000000};var x1=($,J=0,Z=1e6)=>typeof $==="number"&&Number.isFinite($)&&$>=J&&$<=Z;var O0=()=>{throw Error("proof_visual_contract_invalid")};class e8 extends Error{constructor(){super("proof_visual_contract_invalid")}}function DJ($){if(!Q1($)||$.version!==1)return O0();if(typeof $.route!=="string"||!$.route.startsWith("/")||$.route.length>512||/[\x00-\x20\x7f\\?#%]/.test($.route)||$.route.startsWith("//"))throw new e8;if(!Q1($.viewport)||!x1($.viewport.width,1,4096)||!x1($.viewport.height,1,4096)||!Array.isArray($.targets)||$.targets.length<1||$.targets.length>u2.targets||Object.keys($).some((Q)=>!["version","route","viewport","targets","additionalViewports"].includes(Q)))return O0();let J=$.targets.map((Q)=>{if(!Q1(Q)||typeof Q.id!=="string"||!/^[a-zA-Z0-9_-]{1,64}$/.test(Q.id)||typeof Q.selector!=="string"||!Q.selector.trim()||Q.selector.length>256||/[\x00-\x1f\x7f]/.test(Q.selector)||Object.keys(Q).some((K)=>!["id","selector"].includes(K)))return O0();return{id:Q.id,selector:Q.selector}});if(new Set(J.map((Q)=>Q.id)).size!==J.length)return O0();let Z;if($.additionalViewports!==void 0){if(!Array.isArray($.additionalViewports)||$.additionalViewports.length<1||$.additionalViewports.length>3)return O0();Z=$.additionalViewports.map((K)=>{if(!Q1(K)||!x1(K.width,1,4096)||!Number.isInteger(K.width)||!x1(K.height,1,4096)||!Number.isInteger(K.height)||Object.keys(K).some((B)=>!["width","height"].includes(B)))return O0();return{width:K.width,height:K.height}});let Q=[$.viewport,...Z].map((K)=>`${K.width}x${K.height}`);if(new Set(Q).size!==Q.length)return O0()}return{version:1,route:$.route,viewport:{width:$.viewport.width,height:$.viewport.height},targets:J,...Z?{additionalViewports:Z}:{}}}var LJ=["organizationId","userId","sessionId","runId"],wJ=[...LJ,"prUrl","headSha","skillDigest","evidenceKind"],nB=[...wJ,"contextId","preparedAt","captureId","startedAt","finishedAt","sha256","kind","visualPlan","visualObservation"];var OJ={"image/png":{kind:"image",directory:"/tmp/ara-public-screenshots",extension:"png",maxBytes:8388608},"video/webm":{kind:"video",directory:"/tmp/ara-public-recordings",extension:"webm",maxBytes:10551296}};function $5($){return OJ[$].directory}var Q5=10485760;function K5($={}){let J=$.directory??$5("video/webm"),Z=null;return{async start(Q){if(Z)throw Error("cloud_browser_recording_active");let K=Q?.seconds;if(!Number.isInteger(K)||Number(K)<1||Number(K)>15||!Q||Object.keys(Q).some((M)=>M!=="seconds"))throw Error("cloud_browser_recording_seconds_1_to_15_required");AJ(J,{recursive:!0,mode:457});let B=Z5(J);if(!B.isDirectory()||B.isSymbolicLink()||B.uid!==process.getuid?.())throw Error("cloud_browser_recording_directory_invalid");J5(J,457);let G=TJ(J).filter((M)=>/^[a-f0-9-]{36}\.webm$/.test(M)).map((M)=>({name:M,time:_J(d2(J,M)).mtimeMs})).sort((M,j)=>j.time-M.time);for(let M of G.slice(9))RJ(d2(J,M.name));let U=d2(J,`${IJ()}.webm`),W=["-f","x11grab","-framerate","12","-i",$.display??":99"],Y=($.spawn??jJ)($.ffmpeg??"ffmpeg",["-nostdin","-hide_banner","-loglevel","error","-y",...W,"-t",String(K),"-vf","scale=1280:-2","-c:v","libvpx","-deadline","realtime","-b:v","700k","-an","-fs",String(Q5),"-progress","pipe:1",U],{stdio:["ignore","pipe","ignore"],...$.env?{env:$.env}:{}}),X,N,C=!1,F=new Promise((M,j)=>{X=M,N=j});Y.stdout.on("data",(M)=>{if(/frame=\s*[1-9]/.test(String(M)))C=!0,X()});let D=new Promise((M,j)=>{Y.once("error",()=>{N(Error("cloud_browser_recording_unavailable")),j(Error("cloud_browser_recording_unavailable"))}),Y.once("exit",(O)=>{try{if(O!==0&&O!==255)throw Error();let R=Z5(U);if(!C||!R.isFile()||R.isSymbolicLink()||R.uid!==process.getuid?.()||R.size<128||R.size>Q5+65536)throw Error();J5(U,420),X(),M({path:U,mimeType:"video/webm"})}catch{N(Error("cloud_browser_recording_failed")),j(Error("cloud_browser_recording_failed"))}})});D.catch(()=>{});let w=setTimeout(()=>Y.kill("SIGKILL"),(Number(K)+5)*1000);D.finally(()=>clearTimeout(w)).catch(()=>{}),Z={done:D,stop:()=>{return Y.kill("SIGINT"),D}};try{await F}catch(M){throw Z=null,M}return{recording:!0,seconds:Number(K)}},async stop(){if(!Z)throw Error("cloud_browser_recording_not_started");let Q=Z;return Z=null,Q.stop()},async close(){if(Z)await this.stop().catch(()=>{})}}}function G5($,J={}){if($.executionMode!=="unsandboxed"||!$.runtimeDirectory||(J.platform??process.platform)!=="linux")return null;let Z=(J.components??B5)(),Q=Z?.features.display?Z.ffmpeg:null;if(!Q)return null;let K=PJ($.runtimeDirectory,"recordings"),B=null;return{async start(G){let U=await(J.desktop??V5)();return B??=K5({directory:K,display:U.display,ffmpeg:Q,env:{HOME:j1(),PATH:"/usr/local/bin:/usr/bin:/bin",XAUTHORITY:U.xauthority},...J.spawn?{spawn:J.spawn}:{}}),B.start(G)},async stop(){if(!B)throw Error("cloud_browser_recording_not_started");return B.stop()},async close(){await B?.close()}}}import{spawn as U3}from"child_process";import{createHash as dJ,randomUUID as lJ}from"crypto";import{existsSync as Q0,mkdirSync as Q3,mkdtempSync as X3,readdirSync as l1,readFileSync as W3,renameSync as sJ,rmSync as V1,statSync as v1,writeFileSync as cJ}from"fs";import{homedir as Y3,tmpdir as P5}from"os";import{basename as z5,dirname as K3,join as g,relative as q5,resolve as B3,sep as E5}from"path";var o=V.string().min(1).max(200),Z0=V.number().finite().min(0).max(1e4),y1=V.string().min(1).max(4096).refine(($)=>!$.includes("\x00")),U5=V.string().regex(/^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/),s2=V.object({id:V.string().min(1).max(500).optional(),label:V.string().min(1).max(500).optional()}).strict(),c2=["home","lock","side_button","siri","apple_pay"],zJ=V.enum(["tree","screenshot","both","none"]),qJ=V.object({...s2.shape,gone:V.boolean().optional()}).strict().refine(($)=>Boolean($.id||$.label),"wait_for needs an id or label"),C0={observe:zJ.optional(),wait_for:qJ.optional(),timeout:V.number().min(0).max(20).optional()},l2=V.discriminatedUnion("action",[V.object({action:V.literal("tap"),x:Z0.optional(),y:Z0.optional(),...s2.shape,duration:V.number().min(0).max(10).optional()}).strict().refine(($)=>$.x!==void 0&&$.y!==void 0||Boolean($.id||$.label),"pass x and y, or an id or label"),V.object({action:V.literal("swipe"),x:Z0,y:Z0,x2:Z0,y2:Z0,duration:V.number().min(0.05).max(5).optional()}).strict(),V.object({action:V.literal("type"),text:V.string().min(1).max(4000)}).strict(),V.object({action:V.literal("button"),name:V.enum(c2)}).strict(),V.object({action:V.literal("sleep"),seconds:V.number().min(0).max(10)}).strict()]),n2=V.discriminatedUnion("action",[V.object({action:V.literal("devices")}).strict(),V.object({action:V.literal("boot"),device:o}).strict(),V.object({action:V.literal("shutdown"),device:o}).strict(),V.object({action:V.literal("build"),path:y1.optional(),scheme:V.string().min(1).max(200).optional(),configuration:V.string().min(1).max(100).optional(),device:o.optional(),wait:V.boolean().optional()}).strict(),V.object({action:V.literal("run"),path:y1.optional(),scheme:V.string().min(1).max(200).optional(),configuration:V.string().min(1).max(100).optional(),device:o.optional(),steps:V.array(V.lazy(()=>l2)).max(30).optional(),...C0}).strict(),V.object({action:V.literal("build_status"),build_id:V.string().regex(/^build-[0-9a-z-]{4,64}$/),device:o.optional(),wait:V.boolean().optional()}).strict(),V.object({action:V.literal("launch"),device:o.optional(),app_path:y1.optional(),bundle_id:U5.optional(),steps:V.array(V.lazy(()=>l2)).max(30).optional(),...C0}).strict().refine(($)=>Boolean($.app_path)!==Boolean($.bundle_id),"pass exactly one of app_path or bundle_id"),V.object({action:V.literal("terminate"),device:o.optional(),bundle_id:U5}).strict(),V.object({action:V.literal("logs"),device:o.optional(),after:V.number().int().min(0).optional()}).strict(),V.object({action:V.literal("screenshot"),device:o.optional(),scale:V.union([V.literal(1),V.literal(2)]).optional(),save_path:y1.optional()}).strict(),V.object({action:V.literal("chrome"),device:o.optional()}).strict(),V.object({action:V.literal("inspect"),device:o.optional()}).strict(),V.object({action:V.literal("tap"),device:o.optional(),x:Z0.optional(),y:Z0.optional(),...s2.shape,duration:V.number().min(0).max(10).optional(),...C0}).strict().refine(($)=>$.x!==void 0&&$.y!==void 0||Boolean($.id||$.label),"pass x and y, or an id or label"),V.object({action:V.literal("swipe"),device:o.optional(),x:Z0,y:Z0,x2:Z0,y2:Z0,duration:V.number().min(0.05).max(5).optional(),...C0}).strict(),V.object({action:V.literal("type"),device:o.optional(),text:V.string().min(1).max(4000),...C0}).strict(),V.object({action:V.literal("button"),device:o.optional(),name:V.enum(c2),...C0}).strict(),V.object({action:V.literal("open_url"),device:o.optional(),url:V.string().min(1).max(4000),...C0}).strict(),V.object({action:V.literal("steps"),device:o.optional(),steps:V.array(l2).min(1).max(30),...C0}).strict(),V.object({action:V.literal("appearance"),device:o.optional(),mode:V.enum(["light","dark"])}).strict()]),X5=V.object({udid:V.string(),name:V.string(),runtime:V.string(),state:V.enum(["booted","shutdown","booting","shutting_down"]),kind:V.enum(["iphone","ipad","other"])}).strict(),FV=V.object({text:V.string(),error:V.string().optional(),device:X5.optional(),devices:V.array(X5).optional(),image:V.object({mime:V.literal("image/jpeg"),data:V.string(),width:V.number(),height:V.number()}).strict().optional(),build:V.object({id:V.string(),status:V.enum(["running","succeeded","failed"]),app_path:V.string().optional(),bundle_id:V.string().optional(),errors:V.array(V.string()),log_tail:V.string(),elapsed_ms:V.number()}).strict().optional(),logs:V.object({lines:V.array(V.string()),next:V.number()}).strict().optional(),screen:V.string().optional(),chrome:V.object({identifier:V.string(),screen:V.object({width:V.number(),height:V.number()}).strict(),inset:V.object({top:V.number(),left:V.number(),bottom:V.number(),right:V.number()}).strict(),padding:V.object({top:V.number(),left:V.number(),bottom:V.number(),right:V.number()}).strict(),screen_mask:V.string().optional(),pieces:V.record(V.enum(["topLeft","top","topRight","right","bottomRight","bottom","bottomLeft","left"]),V.object({image:V.string(),width:V.number(),height:V.number()}).strict()),buttons:V.array(V.object({name:V.string(),image:V.string(),x:V.number(),y:V.number(),width:V.number(),height:V.number()}).strict())}).strict().optional()}).strict();var NV=V.object({device_id:V.uuid().optional(),root_id:V.uuid().optional()}),CV={type:"object",properties:{action:{type:"string",enum:n2.options.map(($)=>$.shape.action.value).filter(($)=>$!=="chrome")},device_id:{type:"string",format:"uuid",description:"Reason machine id from devices.list; omit for the machine this Session runs on."},root_id:{type:"string",format:"uuid"},device:{type:"string",description:"Simulator UDID or exact name; omit for the booted one."},path:{type:"string",description:"build or run: a .xcodeproj, .xcworkspace, or a folder holding one (project.yml is generated with XcodeGen), absolute or relative to the Session's folder. Omit it when the folder holds one app project."},scheme:{type:"string"},configuration:{type:"string"},build_id:{type:"string"},app_path:{type:"string",description:"launch: the built .app from build_status."},bundle_id:{type:"string"},after:{type:"integer",minimum:0,description:"logs: only lines after this sequence number."},x:{type:"number"},y:{type:"number"},x2:{type:"number"},y2:{type:"number"},id:{type:"string",description:"tap: accessibility identifier from inspect."},label:{type:"string",description:"tap: accessibility label from inspect."},duration:{type:"number",description:"tap: seconds held (above 0.5 is a long press); swipe: seconds."},text:{type:"string"},name:{type:"string",enum:[...c2]},url:{type:"string"},mode:{type:"string",enum:["light","dark"]},steps:{type:"array",maxItems:30,description:"steps (or launch): run in order in one call (after launch, once the app is up). Each item is {action:'tap', id|label|x,y} | {action:'swipe', x,y,x2,y2} | {action:'type', text} | {action:'button', name} | {action:'sleep', seconds}. Taps by id or label wait for their element to appear.",items:{type:"object"}},observe:{type:"string",enum:["tree","screenshot","both","none"],description:"After tap, swipe, type, button, open_url, launch or steps: what to return about the settled screen. Default tree (the accessibility tree, so no separate inspect is needed); screenshot or both to see it."},wait_for:{type:"object",description:"After the action, wait until this element is on screen: {id} or {label}; add gone:true to wait for it to disappear.",properties:{id:{type:"string"},label:{type:"string"},gone:{type:"boolean"}},additionalProperties:!1},timeout:{type:"number",description:"Seconds to wait for wait_for (default 5, max 20)."},wait:{type:"boolean",description:"build or build_status: wait for the build to finish (up to ~45 s) instead of returning at once."},save_path:{type:"string",description:"screenshot: also save the full-resolution PNG at this path (absolute or relative to the Session's folder), for example to show the user."}},required:["action"],additionalProperties:!1};import{spawn as o2}from"child_process";import{createHash as gJ}from"crypto";import{existsSync as a2,mkdirSync as h1,mkdtempSync as SJ,readdirSync as W5,readFileSync as Y5,renameSync as kJ,rmSync as F5,symlinkSync as i2,writeFileSync as K1}from"fs";import{homedir as fJ}from"os";import{dirname as D5,join as b}from"path";import{createInterface as bJ}from"readline";var r2=`// Reason's simulator host: one warm process per booted iOS Simulator.
|
|
26
|
+
`:"")+K.toString("utf8")}}}async function G8($,J){if(!R2())throw new H("workspace_setup_requires_root","Workspace setup runs only on a root Linux worker.");let Z=B8.safeParse($);if(!Z.success)throw new H("invalid_request","Reason sent an invalid workspace setup.");let Q=Z.data,K,B;try{K=T2(Q.script_gzip),B=T2(Q.stdin_gzip)}catch{throw new H("invalid_request","Reason sent an unreadable workspace setup.")}J.throwIfAborted();let G=$$(V8(B$(),"reason-workspace-setup-"));try{let U=V8(G,"setup.sh");Z$(U,K,{mode:384});let W={PATH:V$,LANG:"C.UTF-8",HOME:"/root",USER:"root",LOGNAME:"root",SHELL:"/bin/bash",TMPDIR:"/tmp"};for(let g of G$)if(process.env[g])W[g]=process.env[g];Object.assign(W,Q.env);let Y=e9("/bin/bash",[U],{cwd:Q.cwd,env:W,detached:!0,stdio:["pipe","pipe","pipe"]}),X=_2($1),N=_2($1),C=_2($1);Y.stdout.on("data",(g)=>{X.push(g),C.push(g)}),Y.stderr.on("data",(g)=>{N.push(g),C.push(g)}),Y.stdin.on("error",()=>{}),Y.stdin.end(B);let F=(g)=>{try{if(Y.pid)process.kill(-Y.pid,g)}catch{}},D=!1,w,M=()=>{F("SIGTERM"),w??=setTimeout(()=>F("SIGKILL"),U$)},j=setTimeout(()=>{D=!0,M()},Q.timeout_ms);J.addEventListener("abort",M,{once:!0});let O=await new Promise((g,v)=>{Y.once("error",()=>v(new H("workspace_setup_start_failed","The workspace setup did not start."))),Y.once("exit",(I,z)=>g({code:I,signal:z}))}).finally(()=>{clearTimeout(j),clearTimeout(w),J.removeEventListener("abort",M)});await new Promise((g)=>{let v=setTimeout(g,X$);Y.once("close",()=>{clearTimeout(v),g()})}),Y.stdout.destroy(),Y.stderr.destroy(),J.throwIfAborted();let R=D?124:O.signal?128+(Q$.signals[O.signal]??0):O.code??1;return{exit_code:Math.min(255,R),stdout:X.text(),stderr:N.text(),...R!==0?{combined:C.text()}:{}}}finally{J$(G,{recursive:!0,force:!0})}}import{chmodSync as W$,mkdtempSync as Y$,realpathSync as Y8,rmSync as F$}from"fs";import{tmpdir as N$}from"os";import{dirname as C$,join as P2,sep as H$}from"path";function z2($){return W8($,X8($)!==null).repoPath}function F8($,J){let Z;try{if(typeof J!=="string")throw Error("invalid");Z=[J1,void 0].map((K)=>C$(U8({kind:"managed",workspaceId:J,...K?{layout:K}:{}})))}catch{throw new H("cloud_copy_workspace_invalid","The Cloud copy workspace is invalid.")}let Q;for(let K of Z)try{Q=Y8(P2($,K));break}catch{}if(Q===void 0)throw new H("cloud_copy_workspace_unavailable","The Session workspace is not on this computer.");if(!Q.startsWith(`${$}${H$}`))throw new H("cloud_copy_workspace_invalid","The Cloud copy workspace is outside this worker's root.");return Q}async function N8($){$.signal.throwIfAborted();let J=$.source;if(J.kind==="workspace"){let Q=z2($.runtimeRoot);if(L0(Q)||L0(P2(Q,J.path)))throw new H("protected_path","Credential and secret paths are unavailable to local tasks.");return E0({direction:"export",root:Q,path:J.path,payload:{url:$.url},signal:$.signal,fetchImpl:$.fetchImpl})}let Z=Y$(P2(N$(),`reason-cloud-copy-${process.pid}-`));try{W$(Z,448);let Q=Y8(Z);await E0({direction:"import",root:Q,path:"source",payload:{url:J.download_url,size_bytes:J.size_bytes,sha256:J.sha256},signal:$.signal,fetchImpl:$.fetchImpl});let K=await E0({direction:"export",root:Q,path:"source",payload:{url:$.url},signal:$.signal,fetchImpl:$.fetchImpl});if(K.size_bytes!==J.size_bytes||K.sha256!==J.sha256)throw new H("transfer_source_changed","The verified attachment changed before export.");return K}finally{F$(Z,{recursive:!0,force:!0})}}import{constants as A0}from"fs";import{closeSync as A7,existsSync as G0,fstatSync as T7,lstatSync as _7,mkdirSync as nZ,mkdtempSync as R7,openSync as P7,readSync as rZ,realpathSync as J0,rmSync as z7,statSync as C1,writeSync as aZ}from"fs";import{homedir as Y1,platform as l,tmpdir as E7}from"os";import{dirname as F1,isAbsolute as iZ,join as _3,relative as w3,resolve as oZ,sep as tZ}from"path";import{spawn as eZ}from"child_process";import{createHash as O$,randomBytes as j$}from"crypto";var E2=30000,D$=1800000,M$=5000,q1=30000,L$=S1+15000,C8=/^\/app\/local-runtime\/operations\/[0-9a-fA-F-]{36}\/heartbeat$/,w$=[/^\/app\/local-runtime\/operations\/claim$/,C8];class q2{options;current=null;connecting=null;retryAt=0;failures=0;nextId=0;closed=!1;reconnectTimer=null;constructor($){this.options=$}now(){return(this.options.now??Date.now)()}jitter($){return Math.floor((this.options.random??Math.random)()*$)}async request($,J,Z){Z?.throwIfAborted();let Q=this.current;if(!Q)return this.connect(),null;if(Q.pending.size>=Q.maxInFlight)return null;let K=String(++this.nextId),B=new Promise((W)=>Q.pending.set(K,{path:$,resolve:W}));if(!this.send(Q,{t:"req",id:K,path:$,body:J}))return Q.pending.delete(K),null;let G;if(w$.some((W)=>W.test($)))G=setTimeout(()=>{if(Q.pending.has(K))this.drop(Q)},L$);else{let W=()=>{if(!Q.pending.has(K))return;let Y=this.now()-Q.lastFrameAt;if(Y>=q1)this.drop(Q);else G=setTimeout(W,q1-Y)};G=setTimeout(W,q1)}if(B.finally(()=>clearTimeout(G)),!Z)return await B;let U=new Promise((W,Y)=>{let X=()=>{if(Q.pending.delete(K),clearTimeout(G),this.send(Q,{t:"abort",id:K}),this.now()-Q.lastFrameAt>q1)this.drop(Q);Y(Z.reason)};if(Z.aborted)X();else Z.addEventListener("abort",X,{once:!0}),B.finally(()=>Z.removeEventListener("abort",X))});return await Promise.race([B,U])}cadence(){return this.current?.cadence??null}close(){if(this.closed=!0,this.reconnectTimer)clearTimeout(this.reconnectTimer);for(let $ of[this.current,this.connecting])if($)this.drop($)}send($,J){try{return $.socket.send(JSON.stringify(J)),!0}catch{return this.drop($),!1}}drop($){if($.dropped)return;$.dropped=!0,this.settle($);try{$.socket.close()}catch{}}settle($){for(let J of $.pending.values())J.resolve(null);if($.pending.clear(),this.current===$)this.current=null,this.retryAt=Math.max(this.retryAt,this.now()+this.jitter(M$));if(this.connecting===$){this.connecting=null,this.failures+=1;let J=Math.min(D$,E2*2**Math.min(this.failures-1,10));this.retryAt=Math.max(this.retryAt,this.now()+J/2+this.jitter(J/2))}}connect(){if(this.closed||this.connecting||this.now()<this.retryAt)return;let $=this.options.WebSocket??globalThis.WebSocket;if(!$){this.retryAt=Number.POSITIVE_INFINITY;return}let J=new URL(g1,this.options.apiOrigin);J.protocol=J.protocol==="https:"?"wss:":"ws:",J.searchParams.set("device_id",this.options.deviceId);let Z;try{Z=new $(J.toString())}catch{this.failures+=1,this.retryAt=this.now()+E2;return}let Q={socket:Z,pending:new Map,maxInFlight:0,cadence:null,lastFrameAt:this.now(),dropped:!1};this.connecting=Q,Z.onmessage=(K)=>this.receive(Q,K.data),Z.onclose=()=>this.settle(Q),Z.onerror=()=>this.settle(Q)}receive($,J){if(typeof J!=="string")return;let Z;try{Z=JSON.parse(J)}catch{return}if($.lastFrameAt=this.now(),Z.t==="res"){let Q=$.pending.get(Z.id);$.pending.delete(Z.id),Q?.resolve({status:Z.status,body:Z.body,retryAfter:Z.retry_after??null});return}if(Z.t==="challenge"&&this.connecting===$){let Q;try{Q=this.options.signHello(Z.challenge)}catch{this.drop($);return}this.send($,{t:"hello",...Q});return}if(Z.t==="ready"&&this.connecting===$){this.connecting=null,this.failures=0,$.maxInFlight=Math.max(1,Math.min(Z.max_in_flight,1000)),$.cadence=Z.cadence??null;let Q=this.current;if(this.current=$,Q){for(let[K,B]of Q.pending){if(!C8.test(B.path))continue;Q.pending.delete(K),this.send(Q,{t:"abort",id:K}),B.resolve(null)}if(Q.pending.size===0)this.drop(Q)}return}if(Z.t==="fallback"){this.retryAt=this.now()+Math.max(E2,Math.min(Z.retry_after_ms,86400000)),this.drop($);return}if(Z.t==="reconnect"&&this.current===$&&!this.reconnectTimer)this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.retryAt=0,this.connect()},Math.max(0,Math.min(Z.after_ms,60000)))}}var S2=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.run.v1","process.full.v1","preview.serve.v1","pty.start","git.run","process.list","ports.list","computer.use","browser.use","browser.recording.v1","browser.pr-proof.v1","hands.connect","jobs.control","environment.install","github.local.v1","inference.custom.v1","display.stream.v1","automation.call.v1","simulator.call.v1","simulator.stream.v1","tunnel.open","tunnel.close","workspace.setup.v1"];function qB($,J={}){let Z=I$($),Q=J.rootPathsSupported===!0?M1($.root_paths):void 0;return{supported_operations:[...$.supported_operations],...J.accountRootMetadataSupported===!0&&typeof $.account_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test($.account_root_fingerprint)?{account_root_fingerprint:$.account_root_fingerprint}:{},...J.workspaceRootMetadataSupported===!0&&typeof $.workspace_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test($.workspace_root_fingerprint)?{workspace_root_fingerprint:$.workspace_root_fingerprint}:{},...J.accountRootPathSupported===!0&&typeof $.account_root_path==="string"&&$.account_root_path.startsWith("/")&&$.account_root_path.length<=4096?{account_root_path:$.account_root_path}:{},...J.homeContainedRootsSupported===!0&&Array.isArray($.home_contained_root_fingerprints)&&$.home_contained_root_fingerprints.length<=32&&$.home_contained_root_fingerprints.every((K)=>/^[a-f0-9]{64}$/.test(K))?{home_contained_root_fingerprints:[...$.home_contained_root_fingerprints]}:{},...Q?{root_paths:Q}:{},...Object.keys(Z).length?{operation_constraints:Z}:{},...$.hands_worker_artifact_sha256&&$.hands_worker_entrypoint?{hands_worker_artifact_sha256:$.hands_worker_artifact_sha256,hands_worker_entrypoint:$.hands_worker_entrypoint}:{},...$.hands_slots!==void 0?{hands_slots:$.hands_slots}:{}}}function I$($){let J=(Q)=>Q===null||typeof Q==="boolean"||typeof Q==="number"&&Number.isFinite(Q)||typeof Q==="string"&&Q.length<=512,Z={};for(let Q of $.supported_operations){let K=$.operation_constraints?.[Q];if(!K||typeof K!=="object"||Array.isArray(K))continue;if(!("ready"in K)||typeof K.ready!=="boolean")continue;let B={};for(let[G,U]of Object.entries(K).slice(0,32)){if(!G.length||G.length>64||["__proto__","constructor","prototype"].includes(G))continue;if(J(U)||Array.isArray(U)&&U.length<=64&&U.every(J))B[G]=U}if(Object.keys(B).length)Z[Q]=B}return Z}class Y0 extends Error{status;code;retryAfter;constructor($,J,Z,Q=null){super(Z);this.status=$;this.code=J;this.retryAfter=Q;this.name="LocalRuntimeHttpError"}}class k1 extends Error{timeoutMs;constructor($){super(`Reason Device request did not answer within ${$}ms.`);this.timeoutMs=$;this.name="LocalRuntimeRequestTimeoutError"}}function A$($){return $===408||$===429||$===500||$===502||$===503||$===504}function T$($){if($ instanceof Y0)return!1;if($ instanceof k1)return!0;if(!($ instanceof Error))return!1;if($.name==="AbortError")return!1;if($ instanceof TypeError&&$.message.toLowerCase().includes("fetch failed"))return!0;for(let J of[$,$.cause])if(J&&typeof J==="object"&&"code"in J){let Z=String(J.code);if(["ECONNRESET","ECONNREFUSED","ETIMEDOUT","EHOSTUNREACH","ENOTFOUND","EAI_AGAIN","ConnectionClosed","ConnectionRefused","UND_ERR_SOCKET","UND_ERR_CONNECT_TIMEOUT"].includes(Z))return!0}return!1}function _$($,J,Z=500){if(J instanceof Y0&&J.retryAfter){let B=parseFloat(J.retryAfter);if(Number.isFinite(B)&&B>0)return Math.min(B*1000,1e4)}let Q=Z*2**$,K=Math.floor(Math.random()*200);return Math.min(Q+K,5000)}async function R$($,J){if(J?.aborted)throw J.reason??new DOMException("The operation was aborted.","AbortError");await new Promise((Z,Q)=>{let K=()=>{clearTimeout(B),Q(J?.reason??new DOMException("The operation was aborted.","AbortError"))},B=setTimeout(()=>{J?.removeEventListener("abort",K),Z()},$);J?.addEventListener("abort",K,{once:!0})})}function gB($){return $ instanceof Y0&&$.status===401&&($.code==="device_revoked"||$.code==="invalid_device_credential")}function H8($){return Buffer.byteLength(JSON.stringify($)??"null","utf8")}function D8($){return O$("sha256").update($??"").digest("hex")}function P$($){return j8({method:$.method,pathAndQuery:$.route,timestamp:$.timestamp,nonce:$.nonce,challenge:$.challenge,bodySha256:$.bodySha256})}function M8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}var z$=20000,E$=1e4,L8=[2000,4000],q$=30000,g$=15000;function w8($){return $?{keepalive:!1}:{}}class g2 extends Error{constructor($){super(`Reason Device proof challenge did not answer within ${$}ms.`)}}class S${fetchImpl;proofStore;proofOptions;apiOrigin;spareChallenge=null;sessions=new Map;sessionsClosed=!1;constructor($,J=fetch,Z,Q={}){this.fetchImpl=J;this.proofStore=Z;this.proofOptions=Q;let K=new URL($);if(K.protocol!=="https:"&&K.hostname!=="127.0.0.1"&&K.hostname!=="localhost"&&K.hostname!=="[::1]"&&K.hostname!=="::1")throw Error("Reason Device API must use HTTPS, except for localhost development.");this.apiOrigin=K.origin}async parseResponse($){if($.status===204)return null;let J=await $.json().catch(()=>({}));if(!$.ok){let{code:Z,message:Q}=I8(J,$.status),K=$.headers?.get?.("retry-after")??null;throw new Y0($.status,Z,Q,K)}return J}async challenge($,J,Z={fresh:!1}){let Q=this.proofOptions.challengeAttemptTimeoutsMs??L8;for(let K of Q)try{return await this.challengeAttempt($,J,K,Z.fresh)}catch(B){if(J?.aborted||!(B instanceof g2))throw B;Z.fresh=!0}return await this.challengeAttempt($,J,null,Z.fresh)}async challengeAttempt($,J,Z,Q=!1){let K=JSON.stringify({device_id:$}),B=Z===null?null:new AbortController,G=B&&Z!==null?setTimeout(()=>B.abort(new g2(Z)),Z):null;try{let U=await this.fetchImpl(`${this.apiOrigin}${d.authChallenge.path}`,{method:"POST",redirect:"error",headers:{accept:"application/json","content-type":"application/json"},body:K,...w8(Q),signal:B?J?AbortSignal.any([J,B.signal]):B.signal:J});return A8(await this.parseResponse(U))}catch(U){if(!J?.aborted&&B?.signal.aborted)throw B.signal.reason;throw U}finally{if(G)clearTimeout(G)}}async takeSpareChallenge($){let J=this.spareChallenge;if(this.spareChallenge=null,!J||J.deviceId!==$)return null;let Z=await J.challenge,Q=(this.proofOptions.now??Date.now)();return Z&&Date.parse(Z.expires_at)-Q>=z$?Z:null}refillSpareChallenge($){let J=this.challengeAttempt($,void 0,L8[0]??2000).catch(()=>null);this.spareChallenge={deviceId:$,challenge:J}}async proofHeaders($,J,Z,Q,K=!1,B,G){let U=B&&Date.parse(B.expires_at)-(this.proofOptions.now??Date.now)()>=E$?B:null,W=!U&&K?await this.takeSpareChallenge(Z.deviceId):null,Y=U??W??await this.challenge(Z.deviceId,Q,G);if(K)this.refillSpareChallenge(Z.deviceId);let X=D8(J),N=this.signProof("POST",$,Y.challenge,X);return{"x-device-id":Z.deviceId,"x-device-timestamp":N.timestamp,"x-device-nonce":N.nonce,"x-device-challenge":Y.challenge,"x-device-body-sha256":X,"x-device-signature":N.signature}}signProof($,J,Z,Q){let K=String(Math.trunc((this.proofOptions.now??Date.now)())),B=(this.proofOptions.nonce??(()=>j$(24)))();if(B.byteLength<16||B.byteLength>32)throw Error("Invalid Reason Device proof nonce.");let G=Buffer.from(B).toString("base64url"),U=this.proofStore.sign(P$({method:$,route:J,timestamp:K,nonce:G,challenge:Z,bodySha256:Q}));if(!/^[A-Za-z0-9_-]{8,128}$/.test(U))throw Error("Reason Device proof boundary returned an invalid signature.");return{timestamp:K,nonce:G,signature:U}}sessionFor($,J){if(!this.proofOptions.deviceSession||this.sessionsClosed||!J||!O8($.path))return null;let Z=this.sessions.get(J.deviceId);if(!Z)Z=new q2({apiOrigin:this.apiOrigin,deviceId:J.deviceId,signHello:(Q)=>this.signProof("GET",g1,Q,D8("")),...this.proofOptions.webSocket?{WebSocket:this.proofOptions.webSocket}:{},...this.proofOptions.now?{now:this.proofOptions.now}:{}}),this.sessions.set(J.deviceId,Z);return Z}sessionCadence($){let J=this.proofOptions.deviceSession&&!this.sessionsClosed?this.sessions.get($.deviceId)?.cadence()??null:null;return J?{presenceIntervalMs:J.presence_interval_ms,claimWaitMs:J.claim_wait_ms}:null}close(){this.sessionsClosed=!0;for(let $ of this.sessions.values())$.close();this.sessions.clear()}async request($,J){if(J.body!==void 0&&H8(J.body)>N0)throw Error("Reason Device request exceeds the 256 KB protocol limit.");if(J.authorization!==void 0&&J.device!==void 0)throw Error("Reason Device request cannot combine bearer and proof authentication.");let Z=J.authorization!==void 0,Q=J.device!==void 0;if(!($.auth==="none"?!Z&&!Q:$.auth==="registration_bearer"?Z&&!Q:Z!==Q))throw Error(`Reason Device request used invalid authentication for ${$.path}.`);let B=J.body===void 0?void 0:JSON.stringify(J.body),G=this.proofOptions.maxAttempts??4,U=this.proofOptions.sleep??R$,W=this.sessionFor($,J.device),Y=Math.max(q$,(J.holdMs??0)+g$),X={fresh:!1},N;for(let C=0;C<G;C+=1)try{let F=await W?.request($.path,J.sessionBody===void 0?B??"":JSON.stringify(J.sessionBody),J.signal)??null;if(F)return await this.parseResponse(new Response(F.status===204?null:F.body,{status:F.status,headers:F.retryAfter===null?{}:{"retry-after":F.retryAfter}}));let D=new AbortController,w=setTimeout(()=>D.abort(new k1(Y)),Y),M=J.signal?AbortSignal.any([J.signal,D.signal]):D.signal;try{let j=J.device===void 0?{}:await this.proofHeaders($.path,B,J.device,M,J.useSpareChallenge===!0&&C===0,C===0?J.issuedChallenge:void 0,X),O=await this.fetchImpl(`${this.apiOrigin}${$.path}`,{method:"POST",redirect:"error",headers:{...J.authorization===void 0?{}:{authorization:`Bearer ${J.authorization}`},...j,accept:"application/json",...J.body===void 0?{}:{"content-type":"application/json"}},body:B,...w8(X.fresh),signal:M});return await this.parseResponse(O)}catch(j){if(!J.signal?.aborted&&D.signal.aborted)throw D.signal.reason;throw j}finally{clearTimeout(w)}}catch(F){if(N=F,F instanceof k1)X.fresh=!0;if(J.signal?.aborted)throw F;let D=J.device!==void 0&&F instanceof Y0&&F.status===401&&["invalid_device_proof","device_proof_replayed"].includes(F.code),w=F instanceof Y0&&A$(F.status),M=T$(F),j=J.transientRetryOwner!=="caller"&&(w||M);if((D||j)&&C+1<G){let O=D?0:_$(C,F,this.proofOptions.retryBaseDelayMs??500);if(O>0)await U(O,J.signal);continue}if(D&&C+1>=G)throw Error("Reason Device proof retry was exhausted.");throw F}throw N??Error("Reason Device request failed.")}async register($,J,Z){let Q=await this.request(d.register,{authorization:$,body:J,signal:Z});return T8(Q)}async enroll($,J,Z,Q){let K=await this.request(d.enroll,{body:{...Z,enrollment_ticket:$,code_verifier:J},signal:Q});return _8(K)}async heartbeat($,J,Z,Q){let K=await this.request(d.heartbeat,{device:$,body:J,signal:Z,...Q?{issuedChallenge:Q}:{}});return R8(K)}async syncRoots($,J,Z){let Q=await this.request(d.rootsSync,{device:$,body:{roots:J},signal:Z});return P8(Q)}async identity($,J){let Z=await this.request(d.identity,{device:$,signal:J});return z8(Z)}async disconnect($,J,Z,Q=[]){let K=await this.request(d.disconnect,{device:$,body:Z?{successor_device_id:Z,...Q.length?{successor_roots:Q}:{}}:{},signal:J});return E8(K)}async deviceLifecycle($,J,Z){let Q=await this.request(d.lifecycle,{device:$,body:J,signal:Z});g8(Q)}async localSubscription($,J,Z){return q8(await this.request(d.localSubscription,{device:$,body:J,signal:Z}))}async ownerWorkspaces($,J){let Q=(await this.request(d.ownerWorkspaces,{device:$,body:{},signal:J}))?.organizations;if(!Array.isArray(Q))throw Error("Reason returned an invalid workspace list.");return Q.flatMap((K)=>{let B=K;return typeof B?.id==="string"?[{id:B.id,...typeof B.name==="string"&&B.name.trim()?{name:B.name.trim()}:{},blocked:B.blocked===!0}]:[]})}async ownerWorkspaceEnrollment($,J,Z){return this.request(d.ownerWorkspaceEnrollment,{device:$,body:J,signal:Z})}async liveSessionWorktrees($,J,Z){let Q=await this.request(d.sessionWorktrees,{device:$,body:{worktree_ids:[...J]},signal:Z}).catch((K)=>{if(K instanceof Y0&&K.status===404)return null;throw K});if(Q===null)return null;if(!M8(Q)||!Array.isArray(Q.live)||!Q.live.every((K)=>typeof K==="string"&&J.includes(K)))throw Error("Reason returned an invalid Session worktree answer.");return Q.live}async claimOperation($,J={}){let Z=Math.max(J.waitMs??25000,0),Q=(G)=>({wait_ms:Math.min(Z,G),...J.instanceGeneration===void 0?{}:{instance_generation:J.instanceGeneration}}),K=this.sessionCadence($)?.claimWaitMs,B=await this.request(d.operationClaim,{device:$,body:Q(30000),holdMs:Math.min(Z,30000),...K===void 0?{}:{sessionBody:Q(Math.min(K,S1))},signal:J.signal});if(B===null)return null;return S8(B,S2)}async operationHeartbeat($,J,Z={}){let Q=(G)=>this.request(d.operationHeartbeat.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,...Z.controlAckSeq===void 0?{}:{control_ack_seq:Z.controlAckSeq},...G?{client_retry_count:Z.clientRetryCount}:{},...G&&Z.waitMs!==void 0?{wait_ms:Math.min(Math.max(Z.waitMs,0),30000)}:{}},signal:Z.signal,transientRetryOwner:Z.transientRetryOwner,...G&&Z.waitMs!==void 0?{holdMs:Math.min(Math.max(Z.waitMs,0),30000)}:{}}),K=(Z.clientRetryCount??0)>0||Z.waitMs!==void 0,B;try{B=await Q(K)}catch(G){if(!K||!(G instanceof Y0)||G.status!==400||G.code!=="invalid_operation_heartbeat")throw G;B=await Q(!1)}return k8(B)}async operationEvents($,J,Z){if(!Number.isInteger(Z.eventSeqStart)||Z.eventSeqStart<0||Z.events.length<1||Z.events.length>100||Z.events.some((K)=>!/^[A-Za-z0-9._:-]{1,64}$/.test(K.kind)||!M8(K.payload)))throw Error("Invalid Reason Device operation event batch.");let Q=await this.request(d.operationEvents.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,event_seq_start:Z.eventSeqStart,events:Z.events},signal:Z.signal,transientRetryOwner:Z.transientRetryOwner,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return f8(Q)}async completeOperation($,J,Z,Q){let K={attempt_id:J.attempt_id,attempt_token:J.attempt_token,status:Z.status,...Z.result===void 0?{}:{result:Z.result},...Z.error_code?{error_code:Z.error_code}:{}};if(H8(K)>N0)throw Error("Reason Device operation result exceeds the 256 KB protocol limit.");let B=await this.request(d.operationComplete.forOperation(J.operation_id),{device:$,body:K,signal:Q});return x8(B)}async operationCustomEndpointCredential($,J,Z){let{CustomEndpointDeviceCredentialSchema:Q}=await import("./custom-endpoint-device-p2bvtf6p.js");return Q.parse(await this.request(d.operationCustomEndpointCredential.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token},signal:Z}))}async operationEnvironment($,J,Z,Q){let K=await this.request(d.operationEnvironment.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,snapshot_id:Z},signal:Q,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return b8(K)}async acknowledgeOperationEnvironment($,J,Z,Q){await this.request(d.operationEnvironmentAck.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,...Z},signal:Q,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}})}}var k$=new Set(["process.run.v1","process.full.v1","computer.use","browser.use"]),Z1=new Set(["jobs.control","environment.install","tunnel.open","tunnel.close","display.stream.v1","automation.call.v1","workspace.setup.v1","simulator.call.v1","simulator.stream.v1"]);function f1($,J){if(k$.has($))return!1;if(Z1.has($)&&!J.runtimeDirectory)return!1;if(($==="inference.custom.v1"||$==="preview.serve.v1"||$==="simulator.call.v1"||$==="simulator.stream.v1")&&(J.executionMode!=="unsandboxed"||!J.runtimeDirectory))return!1;if(J.executionMode!=="unsandboxed"&&(["exec.full","hands.connect","pty.start","browser.pr-proof.v1"].includes($)||Z1.has($)))return!1;return!0}import{accessSync as f$,constants as b$,existsSync as x$,statSync as y$}from"fs";import{basename as h$,isAbsolute as m$}from"path";var Q1=["-lic"],v$="/bin/zsh",p$=new Set(["zsh","bash"]),y8=20000,k2=60000,u$=65536,d$=64,l$=8192,s$=new Set(["NODE_OPTIONS","PATH","ZDOTDIR","BASH_ENV","ENV"]),c$=["DYLD_","LD_"];function n$($){let J=$.toUpperCase();return s$.has(J)||c$.some((Z)=>J.startsWith(Z))}function h8($=process.env){return!0}function r$($){if(!m$($)||$.includes("\x00"))return!1;if(!p$.has(h$($)))return!1;try{if(!y$($).isFile())return!1;return f$($,b$.X_OK),!0}catch{return!1}}function q0($=process.env){let J=$.SHELL?.trim();if(J&&r$(J))return J;return v$}function f2($=process.env){return h8($)&&x$(q0($))}function b2($=process.env){if(!h8($))throw new H("full_control_disabled","Full-control execution is unavailable on this Reason Device.")}function x2($){if(typeof $!=="string"||$.length===0||$.includes("\x00")||Buffer.byteLength($,"utf8")>u$)throw new H("invalid_payload","command is missing or too large.");return $}function y2($){if($===void 0||$===null)return{forwarded:{},ignored:[]};if(typeof $!=="object"||Array.isArray($))throw new H("invalid_payload","env must be an object of strings.");let J=Object.entries($);if(J.length>d$)throw new H("invalid_payload","env has too many entries.");let Z={},Q=[];for(let[K,B]of J){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(K)||typeof B!=="string"||B.includes("\x00")||Buffer.byteLength(B,"utf8")>l$)throw new H("invalid_payload","env entry is invalid or too large.");if(n$(K)){Q.push(K);continue}Z[K]=B}return{forwarded:Z,ignored:Q}}async function m8($){let J=$.processEnv??process.env;if(b2(J),$.signal.aborted)throw new H("cancelled","Operation was cancelled.");let Z=x2($.command),Q=q0(J),{forwarded:K,ignored:B}=y2($.requestEnv),G=await $.spawn(Q,[...Q1,Z],{cwd:$.cwd,timeoutMs:$.timeoutMs,signal:$.signal,env:{...J,...K}});return{exit_code:G.exitCode,signal:G.signal,stdout:G.stdout,stderr:G.stderr,timed_out:G.timedOut,truncated:G.truncated,shell:Q,shell_flags:[...Q1],login:!0,interactive:!0,sandbox:"none",ignored_env:B}}function v8($=process.env){return{transport:"shell",shell:`${q0($)} ${Q1.join(" ")}`,login_shell:!0,interactive_shell:!0,rc_files_loaded:!0,sandbox:"none",network:!0,environment:"inherited",privilege:"user",sudo:"argv_exact_nopasswd_only",activation:"explicit_device_grant",max_timeout_ms:k2}}import{readFile as a$,readdir as i$,readlink as o$,realpath as t$}from"fs/promises";import{basename as e$,relative as $J,sep as JJ}from"path";var w0="/proc",ZJ=250,p8=500,QJ=50,KJ=250,BJ=1024,u8=4096,VJ=1,GJ=3,d8=9,UJ="0A",XJ=/^socket:\[(\d+)\]$/,h2={readDirectory:($)=>i$($),readLink:($)=>o$($),readTextFile:($)=>a$($,"utf8"),realPath:($)=>t$($)};function s8($,J){return J===$||J.startsWith(`${$}${JJ}`)}function WJ($,J){return $J($,J)||"."}async function c8($){let J;try{J=await $.readDirectory(w0)}catch{return[]}return J.filter((Z)=>/^[0-9]+$/.test(Z)).map((Z)=>Number(Z)).filter((Z)=>Number.isSafeInteger(Z)&&Z>0).sort((Z,Q)=>Z-Q)}async function n8($,J){try{let Q=(await J.readTextFile(`${w0}/${$}/comm`)).slice(0,u8).split(`
|
|
27
|
+
`,1)[0]?.trim();if(Q)return Q}catch{}try{let Q=(await J.readTextFile(`${w0}/${$}/cmdline`)).slice(0,u8).split("\x00",1)[0]?.trim();return Q?e$(Q):null}catch{return null}}async function r8($,J=h2){let Z;try{Z=await J.readLink(`${w0}/${$}/cwd`)}catch{return null}if(!Z)return null;try{return await J.realPath(Z)}catch{return null}}async function a8($,J=h2){let Z=[];for(let Q of await c8(J)){if(Z.length>=ZJ)break;let K=await r8(Q,J);if(!K||!s8($,K))continue;Z.push({pid:Q,command:await n8(Q,J),cwd:WJ($,K)})}return{processes:Z}}function l8($){let J=[];for(let Z=0;Z<8;Z+=2)J.unshift(Number.parseInt($.slice(Z,Z+2),16));return J}function YJ($){let J=[];for(let W=0;W<16;W+=2)J.push($[W]<<8|$[W+1]);if(J.slice(0,5).every((W)=>W===0)&&J[5]===65535)return`::ffff:${$.slice(12).join(".")}`;let Z=-1,Q=0,K=-1;for(let W=0;W<=J.length;W+=1){if(W<J.length&&J[W]===0){if(K<0)K=W;continue}if(K>=0){let Y=W-K;if(Y>Q)Z=K,Q=Y;K=-1}}let B=J.map((W)=>W.toString(16));if(Q<2)return B.join(":");let G=B.slice(0,Z).join(":"),U=B.slice(Z+Q).join(":");return`${G}::${U}`}function FJ($,J){if(/^[0-9A-Fa-f]{8}$/.test($)){let Z=l8($);if(Z.every((Q)=>Q===0))return`*:${J}`;return`${Z.join(".")}:${J}`}if(/^[0-9A-Fa-f]{32}$/.test($)){let Z=[];for(let Q=0;Q<4;Q+=1)Z.push(...l8($.slice(Q*8,Q*8+8)));if(Z.every((Q)=>Q===0))return`*:${J}`;return`[${YJ(Z)}]:${J}`}return null}function NJ($,J){let Z=[];for(let Q of $.split(`
|
|
28
|
+
`).slice(1)){if(Z.length>=J)break;let K=Q.trim().split(/\s+/);if(K.length<=d8)continue;if(K[GJ]?.toUpperCase()!==UJ)continue;let B=K[VJ]??"",G=B.lastIndexOf(":");if(G<0)continue;let U=Number.parseInt(B.slice(G+1),16);if(!Number.isInteger(U)||U<=0||U>65535)continue;let W=FJ(B.slice(0,G),U),Y=K[d8];if(!W||!Y||!/^[0-9]+$/.test(Y))continue;Z.push({inode:Y,port:U,address:W})}return Z}async function CJ($){let J=[];for(let Z of["tcp","tcp6"]){if(J.length>=p8)break;let Q;try{Q=await $.readTextFile(`${w0}/net/${Z}`)}catch{continue}J.push(...NJ(Q,p8-J.length))}return J}async function HJ($,J){let Z=new Map;if($.size===0)return Z;for(let Q of await c8(J)){if(Z.size>=$.size)break;let K;try{K=await J.readDirectory(`${w0}/${Q}/fd`)}catch{continue}for(let B of K.slice(0,BJ)){let G;try{G=await J.readLink(`${w0}/${Q}/fd/${B}`)}catch{continue}let U=G.match(XJ)?.[1];if(!U||!$.has(U)||Z.has(U))continue;Z.set(U,Q)}}return Z}async function i8($,J=h2){let Z=await CJ(J),Q=await HJ(new Set(Z.map((X)=>X.inode)),J),K=[];for(let X of Z){let N=Q.get(X.inode);if(N===void 0)continue;K.push({pid:N,port:X.port,address:X.address})}K.sort((X,N)=>X.pid-N.pid||X.port-N.port||(X.address<N.address?-1:X.address>N.address?1:0));let B=[...new Set(K.map((X)=>X.pid))].slice(0,QJ),G=await Promise.all(B.map(async(X)=>[X,await r8(X,J)])),U=new Map(G),W=K.filter((X)=>{let N=U.get(X.pid);return Boolean(N&&s8($,N))}),Y=new Map(await Promise.all([...new Set(W.map((X)=>X.pid))].map(async(X)=>[X,await n8(X,J)])));return{ports:W.slice(0,KJ).map((X)=>({pid:X.pid,command:Y.get(X.pid)??null,address:X.address}))}}import{posix as v2}from"path";var b1=200,DJ=250,MJ=250;async function x1($,J){let Z=await $(J);if(Z.timedOut||Z.truncated||Z.exitCode!==0&&Z.exitCode!==1)throw new H("process_inspection_failed","Reading this Mac's processes did not complete.");let Q=[],K=null;for(let B of Z.stdout.split(/\r?\n/))if(B.startsWith("p")){let G=Number(B.slice(1));if(K=Number.isInteger(G)&&G>0?{pid:G,command:null,names:[]}:null,K)Q.push(K)}else if(K&&B.startsWith("c"))K.command=B.slice(1)||null;else if(K&&B.startsWith("n"))K.names.push(B.slice(1));return Q}function m2($,J){return J===$||J.startsWith($==="/"?$:`${$}/`)}var o8="/System/Volumes/Data",LJ=["/tmp","/var","/etc"];function p2($){let J=v2.normalize($);if(J.startsWith(`${o8}/`))J=J.slice(o8.length);return LJ.find((Q)=>J===Q||J.startsWith(`${Q}/`))?`/private${J}`:J}function t8($){return $&&v2.isAbsolute($)?p2($):null}async function e8($,J){let Z=new Map;for(let Q=0;Q<J.length;Q+=b1){let K=J.slice(Q,Q+b1).join(",");for(let B of await x1($,["-a","-p",K,"-d","cwd","-Fpcn"]))Z.set(B.pid,{command:B.command,cwd:t8(B.names[0])})}return Z}async function $5($,J){let Z=p2($),Q=(await x1(J,["-d","cwd","-Fpn"])).filter((B)=>{let G=t8(B.names[0]);return G!==null&&m2(Z,G)}).map((B)=>B.pid).slice(0,DJ),K=await e8(J,Q);return{processes:Q.flatMap((B)=>{let G=K.get(B);return G?.cwd&&m2(Z,G.cwd)?[{pid:B,command:G.command,cwd:v2.relative(Z,G.cwd)||"."}]:[]})}}async function J5($,J){let Z=p2($),Q=["-nP","-iTCP","-sTCP:LISTEN","-Fpcn"],K=await x1(J,Q),B=await e8(J,K.map((Y)=>Y.pid)),G=K.map((Y)=>Y.pid).filter((Y)=>{let X=B.get(Y)?.cwd;return Boolean(X&&m2(Z,X))});if(G.length===0)return{ports:[]};let U=new Set(K.flatMap((Y)=>Y.names.map((X)=>`${Y.pid} ${X}`))),W=[];for(let Y=0;Y<G.length;Y+=b1){let X=G.slice(Y,Y+b1).join(",");for(let N of await x1(J,["-a","-p",X,...Q]))for(let C of N.names)if(U.has(`${N.pid} ${C}`))W.push({pid:N.pid,command:N.command,address:C})}return{ports:W.slice(0,MJ)}}import{join as gJ}from"path";import{spawn as _J}from"child_process";import{randomUUID as RJ}from"crypto";import{chmodSync as K5,lstatSync as B5,mkdirSync as PJ,readdirSync as zJ,statSync as EJ,unlinkSync as qJ}from"fs";import{join as d2}from"path";function K1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}var u2={targets:24,assets:128,sourceFiles:2000,sourceBytes:20000000,outputBytes:20000000};var y1=($,J=0,Z=1e6)=>typeof $==="number"&&Number.isFinite($)&&$>=J&&$<=Z;var O0=()=>{throw Error("proof_visual_contract_invalid")};class Z5 extends Error{constructor(){super("proof_visual_contract_invalid")}}function OJ($){if(!K1($)||$.version!==1)return O0();if(typeof $.route!=="string"||!$.route.startsWith("/")||$.route.length>512||/[\x00-\x20\x7f\\?#%]/.test($.route)||$.route.startsWith("//"))throw new Z5;if(!K1($.viewport)||!y1($.viewport.width,1,4096)||!y1($.viewport.height,1,4096)||!Array.isArray($.targets)||$.targets.length<1||$.targets.length>u2.targets||Object.keys($).some((Q)=>!["version","route","viewport","targets","additionalViewports"].includes(Q)))return O0();let J=$.targets.map((Q)=>{if(!K1(Q)||typeof Q.id!=="string"||!/^[a-zA-Z0-9_-]{1,64}$/.test(Q.id)||typeof Q.selector!=="string"||!Q.selector.trim()||Q.selector.length>256||/[\x00-\x1f\x7f]/.test(Q.selector)||Object.keys(Q).some((K)=>!["id","selector"].includes(K)))return O0();return{id:Q.id,selector:Q.selector}});if(new Set(J.map((Q)=>Q.id)).size!==J.length)return O0();let Z;if($.additionalViewports!==void 0){if(!Array.isArray($.additionalViewports)||$.additionalViewports.length<1||$.additionalViewports.length>3)return O0();Z=$.additionalViewports.map((K)=>{if(!K1(K)||!y1(K.width,1,4096)||!Number.isInteger(K.width)||!y1(K.height,1,4096)||!Number.isInteger(K.height)||Object.keys(K).some((B)=>!["width","height"].includes(B)))return O0();return{width:K.width,height:K.height}});let Q=[$.viewport,...Z].map((K)=>`${K.width}x${K.height}`);if(new Set(Q).size!==Q.length)return O0()}return{version:1,route:$.route,viewport:{width:$.viewport.width,height:$.viewport.height},targets:J,...Z?{additionalViewports:Z}:{}}}var IJ=["organizationId","userId","sessionId","runId"],AJ=[...IJ,"prUrl","headSha","skillDigest","evidenceKind"],oB=[...AJ,"contextId","preparedAt","captureId","startedAt","finishedAt","sha256","kind","visualPlan","visualObservation"];var TJ={"image/png":{kind:"image",directory:"/tmp/ara-public-screenshots",extension:"png",maxBytes:8388608},"video/webm":{kind:"video",directory:"/tmp/ara-public-recordings",extension:"webm",maxBytes:10551296}};function Q5($){return TJ[$].directory}var V5=10485760;function G5($={}){let J=$.directory??Q5("video/webm"),Z=null;return{async start(Q){if(Z)throw Error("cloud_browser_recording_active");let K=Q?.seconds;if(!Number.isInteger(K)||Number(K)<1||Number(K)>15||!Q||Object.keys(Q).some((M)=>M!=="seconds"))throw Error("cloud_browser_recording_seconds_1_to_15_required");PJ(J,{recursive:!0,mode:457});let B=B5(J);if(!B.isDirectory()||B.isSymbolicLink()||B.uid!==process.getuid?.())throw Error("cloud_browser_recording_directory_invalid");K5(J,457);let G=zJ(J).filter((M)=>/^[a-f0-9-]{36}\.webm$/.test(M)).map((M)=>({name:M,time:EJ(d2(J,M)).mtimeMs})).sort((M,j)=>j.time-M.time);for(let M of G.slice(9))qJ(d2(J,M.name));let U=d2(J,`${RJ()}.webm`),W=["-f","x11grab","-framerate","12","-i",$.display??":99"],Y=($.spawn??_J)($.ffmpeg??"ffmpeg",["-nostdin","-hide_banner","-loglevel","error","-y",...W,"-t",String(K),"-vf","scale=1280:-2","-c:v","libvpx","-deadline","realtime","-b:v","700k","-an","-fs",String(V5),"-progress","pipe:1",U],{stdio:["ignore","pipe","ignore"],...$.env?{env:$.env}:{}}),X,N,C=!1,F=new Promise((M,j)=>{X=M,N=j});Y.stdout.on("data",(M)=>{if(/frame=\s*[1-9]/.test(String(M)))C=!0,X()});let D=new Promise((M,j)=>{Y.once("error",()=>{N(Error("cloud_browser_recording_unavailable")),j(Error("cloud_browser_recording_unavailable"))}),Y.once("exit",(O)=>{try{if(O!==0&&O!==255)throw Error();let R=B5(U);if(!C||!R.isFile()||R.isSymbolicLink()||R.uid!==process.getuid?.()||R.size<128||R.size>V5+65536)throw Error();K5(U,420),X(),M({path:U,mimeType:"video/webm"})}catch{N(Error("cloud_browser_recording_failed")),j(Error("cloud_browser_recording_failed"))}})});D.catch(()=>{});let w=setTimeout(()=>Y.kill("SIGKILL"),(Number(K)+5)*1000);D.finally(()=>clearTimeout(w)).catch(()=>{}),Z={done:D,stop:()=>{return Y.kill("SIGINT"),D}};try{await F}catch(M){throw Z=null,M}return{recording:!0,seconds:Number(K)}},async stop(){if(!Z)throw Error("cloud_browser_recording_not_started");let Q=Z;return Z=null,Q.stop()},async close(){if(Z)await this.stop().catch(()=>{})}}}function W5($,J={}){if($.executionMode!=="unsandboxed"||!$.runtimeDirectory||(J.platform??process.platform)!=="linux")return null;let Z=(J.components??U5)(),Q=Z?.features.display?Z.ffmpeg:null;if(!Q)return null;let K=gJ($.runtimeDirectory,"recordings"),B=null;return{async start(G){let U=await(J.desktop??X5)();return B??=G5({directory:K,display:U.display,ffmpeg:Q,env:{HOME:I1(),PATH:"/usr/local/bin:/usr/bin:/bin",XAUTHORITY:U.xauthority},...J.spawn?{spawn:J.spawn}:{}}),B.start(G)},async stop(){if(!B)throw Error("cloud_browser_recording_not_started");return B.stop()},async close(){await B?.close()}}}import{spawn as U3}from"child_process";import{createHash as nJ,randomUUID as rJ}from"crypto";import{existsSync as Q0,mkdirSync as Q3,mkdtempSync as X3,readdirSync as s1,readFileSync as W3,renameSync as aJ,rmSync as G1,statSync as p1,writeFileSync as iJ}from"fs";import{homedir as Y3,tmpdir as q5}from"os";import{basename as g5,dirname as K3,join as S,relative as S5,resolve as B3,sep as k5}from"path";var a=V.string().min(1).max(200),Z0=V.number().finite().min(0).max(1e4),h1=V.string().min(1).max(4096).refine(($)=>!$.includes("\x00")),Y5=V.string().regex(/^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/),s2=V.object({id:V.string().min(1).max(500).optional(),label:V.string().min(1).max(500).optional()}).strict(),c2=["home","lock","side_button","siri","apple_pay"],SJ=V.enum(["tree","screenshot","both","none"]),kJ=V.object({...s2.shape,gone:V.boolean().optional()}).strict().refine(($)=>Boolean($.id||$.label),"wait_for needs an id or label"),C0={observe:SJ.optional(),wait_for:kJ.optional(),timeout:V.number().min(0).max(20).optional()},l2=V.discriminatedUnion("action",[V.object({action:V.literal("tap"),x:Z0.optional(),y:Z0.optional(),...s2.shape,duration:V.number().min(0).max(10).optional()}).strict().refine(($)=>$.x!==void 0&&$.y!==void 0||Boolean($.id||$.label),"pass x and y, or an id or label"),V.object({action:V.literal("swipe"),x:Z0,y:Z0,x2:Z0,y2:Z0,duration:V.number().min(0.05).max(5).optional()}).strict(),V.object({action:V.literal("type"),text:V.string().min(1).max(4000)}).strict(),V.object({action:V.literal("button"),name:V.enum(c2)}).strict(),V.object({action:V.literal("sleep"),seconds:V.number().min(0).max(10)}).strict()]),n2=V.discriminatedUnion("action",[V.object({action:V.literal("devices")}).strict(),V.object({action:V.literal("boot"),device:a}).strict(),V.object({action:V.literal("shutdown"),device:a}).strict(),V.object({action:V.literal("build"),path:h1.optional(),scheme:V.string().min(1).max(200).optional(),configuration:V.string().min(1).max(100).optional(),device:a.optional(),wait:V.boolean().optional()}).strict(),V.object({action:V.literal("run"),path:h1.optional(),scheme:V.string().min(1).max(200).optional(),configuration:V.string().min(1).max(100).optional(),device:a.optional(),steps:V.array(V.lazy(()=>l2)).max(30).optional(),...C0}).strict(),V.object({action:V.literal("build_status"),build_id:V.string().regex(/^build-[0-9a-z-]{4,64}$/),device:a.optional(),wait:V.boolean().optional()}).strict(),V.object({action:V.literal("launch"),device:a.optional(),app_path:h1.optional(),bundle_id:Y5.optional(),steps:V.array(V.lazy(()=>l2)).max(30).optional(),...C0}).strict().refine(($)=>Boolean($.app_path)!==Boolean($.bundle_id),"pass exactly one of app_path or bundle_id"),V.object({action:V.literal("terminate"),device:a.optional(),bundle_id:Y5}).strict(),V.object({action:V.literal("logs"),device:a.optional(),after:V.number().int().min(0).optional()}).strict(),V.object({action:V.literal("screenshot"),device:a.optional(),scale:V.union([V.literal(1),V.literal(2)]).optional(),save_path:h1.optional()}).strict(),V.object({action:V.literal("chrome"),device:a.optional()}).strict(),V.object({action:V.literal("inspect"),device:a.optional()}).strict(),V.object({action:V.literal("tap"),device:a.optional(),x:Z0.optional(),y:Z0.optional(),...s2.shape,duration:V.number().min(0).max(10).optional(),...C0}).strict().refine(($)=>$.x!==void 0&&$.y!==void 0||Boolean($.id||$.label),"pass x and y, or an id or label"),V.object({action:V.literal("swipe"),device:a.optional(),x:Z0,y:Z0,x2:Z0,y2:Z0,duration:V.number().min(0.05).max(5).optional(),...C0}).strict(),V.object({action:V.literal("type"),device:a.optional(),text:V.string().min(1).max(4000),...C0}).strict(),V.object({action:V.literal("button"),device:a.optional(),name:V.enum(c2),...C0}).strict(),V.object({action:V.literal("open_url"),device:a.optional(),url:V.string().min(1).max(4000),...C0}).strict(),V.object({action:V.literal("steps"),device:a.optional(),steps:V.array(l2).min(1).max(30),...C0}).strict(),V.object({action:V.literal("appearance"),device:a.optional(),mode:V.enum(["light","dark"])}).strict()]),F5=V.object({udid:V.string(),name:V.string(),runtime:V.string(),state:V.enum(["booted","shutdown","booting","shutting_down"]),kind:V.enum(["iphone","ipad","other"])}).strict(),DV=V.object({text:V.string(),error:V.string().optional(),device:F5.optional(),devices:V.array(F5).optional(),image:V.object({mime:V.literal("image/jpeg"),data:V.string(),width:V.number(),height:V.number()}).strict().optional(),build:V.object({id:V.string(),status:V.enum(["running","succeeded","failed"]),app_path:V.string().optional(),bundle_id:V.string().optional(),errors:V.array(V.string()),log_tail:V.string(),elapsed_ms:V.number()}).strict().optional(),logs:V.object({lines:V.array(V.string()),next:V.number()}).strict().optional(),screen:V.string().optional(),chrome:V.object({identifier:V.string(),screen:V.object({width:V.number(),height:V.number()}).strict(),inset:V.object({top:V.number(),left:V.number(),bottom:V.number(),right:V.number()}).strict(),padding:V.object({top:V.number(),left:V.number(),bottom:V.number(),right:V.number()}).strict(),screen_mask:V.string().optional(),pieces:V.record(V.enum(["topLeft","top","topRight","right","bottomRight","bottom","bottomLeft","left"]),V.object({image:V.string(),width:V.number(),height:V.number()}).strict()),buttons:V.array(V.object({name:V.string(),image:V.string(),x:V.number(),y:V.number(),width:V.number(),height:V.number()}).strict())}).strict().optional()}).strict();var MV=V.object({device_id:V.uuid().optional(),root_id:V.uuid().optional()}),LV={type:"object",properties:{action:{type:"string",enum:n2.options.map(($)=>$.shape.action.value).filter(($)=>$!=="chrome")},device_id:{type:"string",format:"uuid",description:"Reason machine id from devices.list; omit for the machine this Session runs on."},root_id:{type:"string",format:"uuid"},device:{type:"string",description:"Simulator UDID or exact name; omit for the booted one."},path:{type:"string",description:"build or run: a .xcodeproj, .xcworkspace, or a folder holding one (project.yml is generated with XcodeGen), absolute or relative to the Session's folder. Omit it when the folder holds one app project."},scheme:{type:"string"},configuration:{type:"string"},build_id:{type:"string"},app_path:{type:"string",description:"launch: the built .app from build_status."},bundle_id:{type:"string"},after:{type:"integer",minimum:0,description:"logs: only lines after this sequence number."},x:{type:"number"},y:{type:"number"},x2:{type:"number"},y2:{type:"number"},id:{type:"string",description:"tap: accessibility identifier from inspect."},label:{type:"string",description:"tap: accessibility label from inspect."},duration:{type:"number",description:"tap: seconds held (above 0.5 is a long press); swipe: seconds."},text:{type:"string"},name:{type:"string",enum:[...c2]},url:{type:"string"},mode:{type:"string",enum:["light","dark"]},steps:{type:"array",maxItems:30,description:"steps (or launch): run in order in one call (after launch, once the app is up). Each item is {action:'tap', id|label|x,y} | {action:'swipe', x,y,x2,y2} | {action:'type', text} | {action:'button', name} | {action:'sleep', seconds}. Taps by id or label wait for their element to appear.",items:{type:"object"}},observe:{type:"string",enum:["tree","screenshot","both","none"],description:"After tap, swipe, type, button, open_url, launch or steps: what to return about the settled screen. Default tree (the accessibility tree, so no separate inspect is needed); screenshot or both to see it."},wait_for:{type:"object",description:"After the action, wait until this element is on screen: {id} or {label}; add gone:true to wait for it to disappear.",properties:{id:{type:"string"},label:{type:"string"},gone:{type:"boolean"}},additionalProperties:!1},timeout:{type:"number",description:"Seconds to wait for wait_for (default 5, max 20)."},wait:{type:"boolean",description:"build or build_status: wait for the build to finish (up to ~45 s) instead of returning at once."},save_path:{type:"string",description:"screenshot: also save the full-resolution PNG at this path (absolute or relative to the Session's folder), for example to show the user."}},required:["action"],additionalProperties:!1};import{spawn as o2}from"child_process";import{createHash as bJ}from"crypto";import{existsSync as a2,mkdirSync as m1,mkdtempSync as xJ,readdirSync as N5,readFileSync as C5,renameSync as yJ,rmSync as H5,symlinkSync as i2,writeFileSync as B1}from"fs";import{homedir as hJ}from"os";import{dirname as w5,join as b}from"path";import{createInterface as mJ}from"readline";var r2=`// Reason's simulator host: one warm process per booted iOS Simulator.
|
|
29
29
|
//
|
|
30
30
|
// Built on the Mac on first use (cli/simulator-host.ts) against the MIT
|
|
31
31
|
// FBSimulatorControl frameworks that the pinned AXe ships, so loading
|
|
@@ -484,33 +484,33 @@ case "stream":
|
|
|
484
484
|
default:
|
|
485
485
|
fail("usage: simulator-host serve|stream <udid> ...")
|
|
486
486
|
}
|
|
487
|
-
`;var
|
|
487
|
+
`;var D5=process.arch==="arm64"?"arm64-apple-macos":"x86_64-apple-macos",vJ=180000,pJ=15000,uJ=30000,dJ=600000,lJ=["SimDevice","SimDeviceSet","SimDeviceType","SimRuntime"].map(($)=>`@interface ${$} : NSObject
|
|
488
488
|
@end
|
|
489
|
-
`).join("");function
|
|
489
|
+
`).join("");function M5($,J,Z){return new Promise((Q)=>{let K=o2($,J,{stdio:["ignore","pipe","pipe"],timeout:Z}),B="";K.stdout.on("data",(G)=>{B+=G}),K.stderr.on("data",(G)=>{B+=G}),K.once("error",(G)=>Q({code:-1,output:String(G)})),K.once("close",(G)=>Q({code:G??-1,output:B}))})}var L5=new Map;function t2($){let J=b(w5($),"Frameworks"),Z=L5.get(J);if(!Z)L5.set(J,Z=sJ(J));return Z}async function sJ($){if(process.platform!=="darwin"||!a2(b($,"FBSimulatorControl.framework")))return null;let J=await M5("xcrun",["swiftc","--version"],30000);if(J.code!==0)return null;let Z=bJ("sha256").update(r2).update(J.output).update($).digest("hex").slice(0,16),Q=b(hJ(),".local","share","reason","simulator","host"),K=b(Q,Z,"simulator-host");if(a2(K))return K;m1(Q,{recursive:!0,mode:448});let B=xJ(b(Q,".staging-"));try{let G=b(B,"Frameworks"),U=b(G,"FBSimulatorControl.framework"),W=b(U,"Modules","FBSimulatorControl.swiftmodule");m1(W,{recursive:!0});for(let w of N5($))if(w!=="FBSimulatorControl.framework")i2(b($,w),b(G,w));let Y=b($,"FBSimulatorControl.framework");i2(b(Y,"FBSimulatorControl"),b(U,"FBSimulatorControl")),i2(b(Y,"Headers"),b(U,"Headers")),B1(b(U,"Modules","module.modulemap"),C5(b(Y,"Modules","module.modulemap")));let X=C5(b(Y,"Modules","FBSimulatorControl.swiftmodule",`${D5}.swiftinterface`),"utf8");B1(b(W,`${D5}.swiftinterface`),X.replace(/FBSimulatorControl\.(?=[A-Za-z_])/g,"").replace(/IOSurface\.IOSurface/g,"IOSurface"));let N=b(B,"include","CoreSimulator");m1(N,{recursive:!0}),B1(b(N,"module.modulemap"),`module CoreSimulator {
|
|
490
490
|
header "CoreSimulator.h"
|
|
491
491
|
export *
|
|
492
492
|
}
|
|
493
|
-
`),
|
|
494
|
-
${
|
|
493
|
+
`),B1(b(N,"CoreSimulator.h"),`#import <Foundation/Foundation.h>
|
|
494
|
+
${lJ}`);let C=b(B,"main.swift");B1(C,r2);let F=b(B,"simulator-host"),D=await M5("xcrun",["swiftc","-O","-F",G,"-I",b(B,"include"),"-module-cache-path",b(B,"cache"),"-Xlinker","-rpath","-Xlinker",$,C,"-o",F],vJ);if(D.code!==0||!a2(F))return process.stderr.write(`Reason: the simulator host did not build; simulator actions use AXe.
|
|
495
495
|
${D.output.slice(-2000)}
|
|
496
|
-
`),null;
|
|
497
|
-
`)})}close(){if(this.child.exitCode===null&&this.child.signalCode===null)this.child.kill("SIGTERM");this.end()}touch(){clearTimeout(this.idle),this.idle=setTimeout(()=>this.close(),
|
|
498
|
-
`).slice(0,800))}),J}async function
|
|
499
|
-
`);if(C=w.pop()??"",X.log.push(...w),X.log.length>5000)X.log.splice(0,X.log.length-5000)};return N.stdout.on("data",F),N.stderr.on("data",F),N.on("error",(D)=>{X.log.push(`error: ${D.message}`),X.status="failed",X.ended=Date.now()}),N.on("close",(D)=>{if(C)X.log.push(C);
|
|
500
|
-
`).slice(-4000),elapsed_ms:($.ended??Date.now())-$.started,...$.appPath?{app_path:$.appPath}:{},...$.bundleId?{bundle_id:$.bundleId}:{}}}var
|
|
501
|
-
`);K=U.pop()??"",Q.lines.push(...U);let W=Q.lines.length-
|
|
502
|
-
`).match(new RegExp(`${J.replace(/\./g,"\\.")}: (\\d+)`))?.[1];if(Y)clearTimeout(U),G(Number(Y))};Z.stdout.on("data",W),Z.on("close",()=>{clearTimeout(U),G(null)})})}async function
|
|
496
|
+
`),null;m1(w5(K),{recursive:!0}),yJ(F,K);for(let w of N5(Q))if(w!==Z&&!w.startsWith(".staging-"))H5(b(Q,w),{recursive:!0,force:!0});return K}catch{return null}finally{H5(B,{recursive:!0,force:!0})}}class V1 extends Error{}class S0 extends Error{}class O5{child;onGone;nextId=1;pending=new Map;idle;gone=!1;constructor($,J){this.child=$;this.onGone=J;mJ({input:$.stdout}).on("line",(Q)=>{let K;try{K=JSON.parse(Q)}catch{return}let B=this.pending.get(Number(K.id));if(!B)return;if(this.pending.delete(Number(K.id)),clearTimeout(B.timer),K.ok===!0)B.resolve(K);else B.reject(new V1(String(K.error??"The simulator refused the action.")))}),$.once("exit",()=>this.end()),$.once("error",()=>this.end()),this.touch()}call($){if(this.gone)return Promise.reject(new S0("The simulator host has exited."));this.touch();let J=this.nextId++;return new Promise((Z,Q)=>{let K=setTimeout(()=>{this.pending.delete(J),Q(new S0("The simulator host did not answer.")),this.close()},uJ);this.pending.set(J,{resolve:Z,reject:Q,timer:K}),this.child.stdin.write(`${JSON.stringify({id:J,...$})}
|
|
497
|
+
`)})}close(){if(this.child.exitCode===null&&this.child.signalCode===null)this.child.kill("SIGTERM");this.end()}touch(){clearTimeout(this.idle),this.idle=setTimeout(()=>this.close(),dJ),this.idle.unref?.()}end(){if(this.gone)return;this.gone=!0,clearTimeout(this.idle);for(let $ of this.pending.values())clearTimeout($.timer),$.reject(new S0("The simulator host has exited."));this.pending.clear(),this.onGone()}}var g0=new Map;async function v1($,J,Z=!1){let Q=g0.get(J);if(!Q){let K={started:cJ($,J)};g0.set(J,Q=K),K.started.then((B)=>{if(K.host=B,!B&&g0.get(J)===K)g0.delete(J)})}if(Q.host!==void 0)return Q.host;return Z?Q.started:null}async function cJ($,J){let Z=await t2($);if(!Z)return null;let Q=o2(Z,["serve",J],{stdio:["pipe","pipe","ignore"]});if(!await new Promise((G)=>{let U=setTimeout(()=>G(!1),pJ);Q.stdout.once("data",(W)=>{clearTimeout(U),G(String(W).includes('"ready":true'))}),Q.once("exit",()=>{clearTimeout(U),G(!1)}),Q.once("error",()=>{clearTimeout(U),G(!1)})})){if(Q.exitCode===null)Q.kill("SIGTERM");return null}let B=new O5(Q,()=>{let G=g0.get(J);if(G&&(G.host===B||G.host===void 0))g0.delete(J)});return B}function j5($,J,Z,Q,K){return o2($,["stream",J,String(Z),String(Math.round(Q)),String(K)],{stdio:["pipe","pipe","ignore"]})}var k0={version:"1.8.0",url:"https://github.com/cameroncooke/AXe/releases/download/v1.8.0/AXe-macOS-v1.8.0-universal.tar.gz",sha256:"7b76340b72e90d0f211bc7c4636f15009076eff07acef2f2b632b175debd8834"},oJ=50000,tJ=112640,eJ=174080,e2=2,$Z=60000,JZ=2000,ZZ=300,QZ=40,KZ=new Set(["file:","javascript:","data:","vbscript:","blob:"]);function x0($,J,Z={}){return new Promise((Q,K)=>{let B=U3($,J,{cwd:Z.cwd,stdio:["ignore","pipe","pipe"],signal:Z.signal}),G=[],U=[];B.stdout.on("data",(Y)=>G.push(Y)),B.stderr.on("data",(Y)=>U.push(Y));let W=setTimeout(()=>B.kill("SIGKILL"),Z.timeoutMs??oJ);B.on("error",(Y)=>{clearTimeout(W),K(Y)}),B.on("close",(Y)=>{clearTimeout(W),Q({code:Y??-1,stdout:Buffer.concat(G).toString("utf8"),stderr:Buffer.concat(U).toString("utf8")})})})}function f($,J){throw new H($,J)}async function c($,J,Z,Q={}){let K=await x0($,J,Q);if(K.code!==0)f("simulator_command_failed",`${Z} failed: ${(K.stderr||K.stdout).trim().slice(-1500)}`);return K.stdout}function U1(){return process.platform==="darwin"&&Q0("/Library/Developer/PrivateFrameworks/CoreSimulator.framework")&&Q0("/usr/bin/xcrun")}var $3=null;function j0(){return S(Y3(),".local","share","reason","simulator","axe")}function F3(){let $=S(j0(),k0.version,"axe");if(Q0($))return Promise.resolve($);return $3??=(async()=>{Q3(j0(),{recursive:!0,mode:448});let J=X3(S(j0(),".staging-"));try{let Z=S(J,"axe.tgz");await E5(k0.url,k0.sha256,Z);let Q=S(J,"tree");if(Q3(Q),await c("tar",["-xzf",Z,"-C",Q],"Extracting AXe"),!Q0(S(Q,"axe"))||!Q0(S(Q,"Frameworks")))f("simulator_axe_missing","The AXe archive has an unexpected layout.");G1(S(j0(),k0.version),{recursive:!0,force:!0}),aJ(Q,S(j0(),k0.version));for(let K of s1(j0()))if(K!==k0.version&&!K.startsWith(".staging-"))G1(S(j0(),K),{recursive:!0,force:!0});return $}finally{G1(J,{recursive:!0,force:!0}),$3=null}})(),$3}var f5=F3;async function b5($){let J=await F3().catch(()=>null);return J?v1(J,$.udid).catch(()=>null):null}async function u1($,J,Z){let Q=await F3().catch(()=>f("simulator_axe_missing","AXe could not be installed on this Mac.")),K=await x0(Q,[...$,"--udid",J]);if(K.code===0)return K.stdout;let B=(K.stderr||K.stdout).trim();if(/no (matching |accessibility )?element|element not found|could not find|no elements? match/i.test(B))f("simulator_element_not_found",B.slice(-500));return f("simulator_command_failed",`${Z} failed: ${B.slice(-1500)}`)}function BZ($){let J=$.match(/SimRuntime\.([A-Za-z]+)-(\d+)-(\d+)(?:-(\d+))?$/);return J?`${J[1]} ${J[2]}.${J[3]}${J[4]?`.${J[4]}`:""}`:$}function VZ($){switch($){case"Booted":return"booted";case"Booting":return"booting";case"Shutting Down":return"shutting_down";default:return"shutdown"}}async function N3(){let J=JSON.parse(await c("xcrun",["simctl","list","devices","available","-j"],"Listing simulators")).devices??{},Z=[];for(let[Q,K]of Object.entries(J)){if(!Q.includes("SimRuntime.iOS"))continue;for(let B of K){if(B.isAvailable===!1)continue;let G=B.name.toLowerCase();if(B.deviceTypeIdentifier)V3.set(B.udid,B.deviceTypeIdentifier);Z.push({udid:B.udid,name:B.name,runtime:BZ(Q),state:VZ(B.state),kind:G.includes("iphone")?"iphone":G.includes("ipad")?"ipad":"other"})}}return Z.sort((Q,K)=>Number(K.state==="booted")-Number(Q.state==="booted")||K.runtime.localeCompare(Q.runtime,void 0,{numeric:!0})||Q.name.localeCompare(K.name))}var V3=new Map,G3=null;async function o($,J){let Z=await N3(),Q;if($){let K=Z.filter((B)=>B.udid===$||B.name===$);if(Q=K.find((B)=>B.state==="booted")??K[0],!Q)f("simulator_device_not_found",`No simulator named "${$}". Call devices to list them.`)}else{let K=Z.filter((B)=>B.state==="booted");if(Q=K.find((B)=>B.udid===G3)??K.find((B)=>B.kind==="iphone")??K[0],!Q)f("simulator_not_booted","No simulator is booted. Call devices, then boot one.")}if(J.booted&&Q.state!=="booted")f("simulator_not_booted",`${Q.name} is not booted. Boot it first.`);return G3=Q.udid,Q}function h($){return`${$.name} (${$.runtime})`}async function GZ($){if($.state!=="booted"){let J=await x0("xcrun",["simctl","boot",$.udid]);if(J.code!==0&&!/current state: Booted/i.test(J.stderr))f("simulator_command_failed",`Booting ${$.name} failed: ${J.stderr.trim().slice(-1000)}`);await c("xcrun",["simctl","bootstatus",$.udid,"-b"],`Waiting for ${$.name} to boot`,{timeoutMs:45000})}return G3=$.udid,{...$,state:"booted"}}function C3($,J){let Z=B3($,J),Q=S5($,Z);if(Q.startsWith("..")||Q.startsWith(k5)||B3($,Q)!==Z)f("simulator_path_outside_root",`${J} is outside this machine's granted folder (${$}). Pass a path inside it, or one relative to it.`);return Z}var I5=4,UZ=new Set(["node_modules","Pods","DerivedData","build","Carthage","vendor"]);function XZ($){let J=[],Z=(Q,K)=>{let B;try{B=s1(Q)}catch{return}if(B.includes("project.yml")||B.some((G)=>G.endsWith(".xcworkspace")||G.endsWith(".xcodeproj"))){J.push(Q);return}if(K>=I5)return;for(let G of B.sort()){if(G.startsWith(".")||UZ.has(G))continue;let U=S(Q,G);try{if(p1(U).isDirectory())Z(U,K+1)}catch{}}};if(Z($,0),J.length===1)return J[0];if(!J.length)f("simulator_project_not_found",`No Xcode project or project.yml within ${I5} folders of ${$}; pass path.`);return f("simulator_project_not_found",`${$} holds several Xcode projects; pass path as one of: ${J.map((Q)=>S5($,Q)||".").join(", ")}.`)}var b0=new Map;async function WZ($){if($.endsWith(".xcworkspace"))return{flag:"-workspace",path:$,dir:K3($)};if($.endsWith(".xcodeproj"))return{flag:"-project",path:$,dir:K3($)};if(!p1($).isDirectory())f("simulator_project_not_found",`${$} is not a project, workspace or folder.`);let J=(K)=>s1($).filter((B)=>B.endsWith(K)).sort();if(Q0(S($,"project.yml")))await c("xcodegen",["generate","--quiet"],"xcodegen generate",{cwd:$,timeoutMs:45000}).catch((K)=>Q0("/opt/homebrew/bin/xcodegen")?c("/opt/homebrew/bin/xcodegen",["generate","--quiet"],"xcodegen generate",{cwd:$,timeoutMs:45000}):Promise.reject(K));let Z=J(".xcworkspace")[0];if(Z)return{flag:"-workspace",path:S($,Z),dir:$};let Q=J(".xcodeproj")[0];if(Q)return{flag:"-project",path:S($,Q),dir:$};return f("simulator_project_not_found",`No .xcodeproj or .xcworkspace in ${$}.`)}async function x5($){let J=JSON.parse(await c("xcodebuild",["-list","-json",$.flag,$.path],"Listing schemes"));return J.workspace?.schemes??J.project?.schemes??[]}async function YZ($){let J=(await x5($))[0];if(!J)f("simulator_build_no_scheme",`${$.path} has no schemes; pass scheme.`);return J}function FZ($){let J=[],Z=new Set;return $.forEach((Q,K)=>{if(J.length>=20||!/(^|\s)error: /.test(Q)||Q.startsWith("note:")||Z.has(Q))return;Z.add(Q);let B=$.slice(K+1,K+3).filter((G)=>G.trim()!==""&&!/(^|\s)(error|warning|note): /.test(G));J.push([Q,...B].join(`
|
|
498
|
+
`).slice(0,800))}),J}async function NZ($,J,Z){if($.ended=Date.now(),J!==0){if($.log.some((B)=>B.includes("does not contain a scheme named"))){let B=await x5(Z).catch(()=>[]);if(B.length)$.log.push(`error: this project's schemes are: ${B.join(", ")}`)}$.status="failed";return}let Q=S($.productsDir,`${$.configuration}-iphonesimulator`),K=Q0(Q)?s1(Q).filter((B)=>B.endsWith(".app")).map((B)=>S(Q,B)).sort((B,G)=>p1(G).mtimeMs-p1(B).mtimeMs):[];if($.appPath=K[0],$.appPath)$.bundleId=await m5($.appPath).catch(()=>{return});if($.status=$.appPath?"succeeded":"failed",!$.appPath)$.log.push("error: the build succeeded but produced no .app for the iOS Simulator")}async function A5($,J){let Z=$.path?C3(J,$.path):XZ(J),Q=await WZ(Z),K=$.scheme??await YZ(Q),B=$.configuration??"Debug",G=await o($.device,{booted:!1}).catch(()=>null),U=G?`platform=iOS Simulator,id=${G.udid}`:"generic/platform=iOS Simulator",W=nJ("sha256").update(Q.path).digest("hex").slice(0,16),Y=S(Y3(),"Library","Caches","reason","simulator-builds",W),X={id:`build-${rJ().slice(0,8)}`,status:"running",started:Date.now(),log:[],productsDir:S(Y,"Build","Products"),configuration:B};b0.set(X.id,X);for(let[D,w]of b0)if(b0.size>20&&w.status!=="running")b0.delete(D);let N=U3("xcodebuild",[Q.flag,Q.path,"-scheme",K,"-configuration",B,"-destination",U,"-derivedDataPath",Y,"-skipMacroValidation","build"],{cwd:Q.dir,stdio:["ignore","pipe","pipe"]}),C="",F=(D)=>{let w=(C+D.toString("utf8")).split(`
|
|
499
|
+
`);if(C=w.pop()??"",X.log.push(...w),X.log.length>5000)X.log.splice(0,X.log.length-5000)};return N.stdout.on("data",F),N.stderr.on("data",F),N.on("error",(D)=>{X.log.push(`error: ${D.message}`),X.status="failed",X.ended=Date.now()}),N.on("close",(D)=>{if(C)X.log.push(C);NZ(X,D??-1,Q)}),{text:`Build ${X.id} started: ${K} (${B}) for ${G?h(G):"the iOS Simulator"}. Poll build_status with this build_id; a first build can take minutes, later ones are incremental.`,build:y5(X)}}function y5($){return{id:$.id,status:$.status,errors:FZ($.log),log_tail:$.log.slice(-QZ).join(`
|
|
500
|
+
`).slice(-4000),elapsed_ms:($.ended??Date.now())-$.started,...$.appPath?{app_path:$.appPath}:{},...$.bundleId?{bundle_id:$.bundleId}:{}}}var CZ=45000,HZ=30000;async function J3($,J=CZ){let Z=Date.now()+J;while(b0.get($)?.status==="running"&&Date.now()<Z)await Bun.sleep(500);let Q=h5($);return Q.build?.status==="running"?{...Q,text:`${Q.text} Still running: call build_status with wait again.`}:Q}function h5($){let J=b0.get($);if(!J)f("simulator_build_not_found",`No build ${$} on this Mac (a worker restart forgets builds); start a new one.`);let Z=y5(J);return{text:J.status==="running"?`Build ${$} is running (${Math.round(Z.elapsed_ms/1000)} s).`:J.status==="succeeded"?`Build ${$} succeeded: ${J.appPath}. Launch it with app_path.`:`Build ${$} failed with ${Z.errors.length} error(s).`,build:Z}}async function m5($){return(await c("plutil",["-extract","CFBundleIdentifier","raw","-o","-",S($,"Info.plist")],"Reading the bundle id")).trim()}var H0=new Map;function DZ($,J){H0.get($.udid)?.stop();let Z=U3("script",["-q","/dev/null","xcrun","simctl","launch","--console-pty","--terminate-running-process",$.udid,J],{stdio:["ignore","pipe","pipe"]}),Q={udid:$.udid,bundleId:J,lines:[],first:0,stop:()=>Z.kill("SIGTERM")};H0.set($.udid,Q);let K="",B=(G)=>{let U=(K+G.toString("utf8").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\r]/g,"")).split(`
|
|
501
|
+
`);K=U.pop()??"",Q.lines.push(...U);let W=Q.lines.length-JZ;if(W>0)Q.lines.splice(0,W),Q.first+=W};return Z.stdout.on("data",B),Z.stderr.on("data",B),new Promise((G)=>{let U=setTimeout(()=>G(null),15000),W=()=>{let Y=Q.lines.concat(K).join(`
|
|
502
|
+
`).match(new RegExp(`${J.replace(/\./g,"\\.")}: (\\d+)`))?.[1];if(Y)clearTimeout(U),G(Number(Y))};Z.stdout.on("data",W),Z.on("close",()=>{clearTimeout(U),G(null)})})}async function MZ($,J){let Z=await o($.device,{booted:!0}),Q=$.bundle_id;if($.app_path){let B=LZ(J,$.app_path);await c("xcrun",["simctl","install",Z.udid,B],`Installing ${g5(B)}`),Q=await m5(B)}if($.bundle_id){if((await x0("xcrun",["simctl","get_app_container",Z.udid,$.bundle_id])).code!==0)f("simulator_app_not_installed",`${$.bundle_id} is not installed on ${h(Z)}.`)}let K=await DZ(Z,Q);if(K===null){let B=H0.get(Z.udid)?.lines.slice(-20).join(`
|
|
503
503
|
`)??"";f("simulator_launch_failed",`${Q} did not start on ${h(Z)}.${B?`
|
|
504
|
-
${B}`:""}`)}return{text:`Launched ${Q} on ${h(Z)} (pid ${K}). Its console is captured; read it with logs.`,device:Z}}function
|
|
504
|
+
${B}`:""}`)}return{text:`Launched ${Q} on ${h(Z)} (pid ${K}). Its console is captured; read it with logs.`,device:Z}}function LZ($,J){let Z=B3(J),Q=S(Y3(),"Library","Caches","reason","simulator-builds")+k5;return Z.startsWith(Q)&&Z.endsWith(".app")?Z:C3($,Z)}function wZ($,J){let Z=H0.get($.udid);if(!Z)return{text:`No app launched by Reason is running on ${h($)}; launch one to capture its capture.`,logs:{lines:[],next:0}};let Q=Math.max(J??0,Z.first,Z.first+Z.lines.length-ZZ),K=Z.lines.slice(Q-Z.first).map((B)=>B.slice(0,2000));return{text:`${K.length} console line(s) from ${Z.bundleId} on ${h($)}.`,logs:{lines:K,next:Z.first+Z.lines.length}}}var d1=new Map;function T5($,...J){let Z=d1.get($.udid);if(!Z)return;for(let[Q,K]of J)if(Q>Z.width||K>Z.height)f("simulator_point_off_screen",`(${Q}, ${K}) is off ${$.name}'s ${Z.width}x${Z.height}-point screen.`)}function _5($,J){if($.kind==="ipad")return 2;return J===750||J===828||J===640?2:3}async function H3($,J=1,Z){let Q=X3(S(q5(),"reason-sim-"));try{let K=S(Q,"screen.png");if(await c("xcrun",["simctl","io",$.udid,"screenshot","--type=png",K],"Taking a screenshot"),Z){Q3(K3(Z),{recursive:!0});let F=await c("sips",["-g","pixelWidth","-g","pixelHeight",K],"Reading the screenshot size"),D=Number(F.match(/pixelWidth: (\d+)/)?.[1]),w=Number(F.match(/pixelHeight: (\d+)/)?.[1]),M=2/_5($,D);await c("sips",["-z",String(Math.round(w*M)),String(Math.round(D*M)),K,"--out",Z],"Saving the screenshot")}let B=await c("sips",["-g","pixelWidth","-g","pixelHeight",K],"Reading the screenshot size"),G=Number(B.match(/pixelWidth: (\d+)/)?.[1]),U=Number(B.match(/pixelHeight: (\d+)/)?.[1]),W=_5($,G),Y=Math.round(G/W),X=Math.round(U/W);d1.set($.udid,{width:Y,height:X});let N=Buffer.alloc(0),C=J===2?eJ:tJ;for(let F of[70,50,35]){let D=S(Q,`screen-${F}.jpg`);if(await c("sips",["-z",String(X*J),String(Y*J),"-s","format","jpeg","-s","formatOptions",String(F),K,"--out",D],"Encoding the screenshot"),N=W3(D),N.byteLength<=C)break}return{text:`Screenshot of ${h($)} at ${Y}x${X} points: image pixels are tap coordinates.`+(Z?` Saved at ${Z}.`:""),device:$,image:{mime:"image/jpeg",data:N.toString("base64"),width:Y,height:X}}}finally{G1(Q,{recursive:!0,force:!0})}}async function OZ($){let J=await b5($);if(J)try{return String((await J.call({op:"tree"})).tree)}catch{}return u1(["describe-ui"],$.udid,"Reading the accessibility tree")}async function l1($){let J=JSON.parse(await OZ($)),Z={lines:[],compact:[],ids:new Set,labels:new Set,targets:[]},Q=(K,B,G="")=>{let U=(K.role??K.type??"?").replace(/^AX/,""),W=K.AXLabel||K.title||"",Y=K.AXValue?` value="${String(K.AXValue).slice(0,120)}"`:"",X=K.AXUniqueId?` id=${K.AXUniqueId}`:"";if(K.AXUniqueId)Z.ids.add(K.AXUniqueId);if(W)Z.labels.add(W);let N=K.frame;if(U==="Application"&&N&&!Z.bounds)Z.bounds={width:N.width,height:N.height};if(N&&N.width>0&&N.height>0&&(K.AXUniqueId||K.AXLabel))Z.targets.push({...K.AXUniqueId?{id:K.AXUniqueId.trim()}:{},...K.AXLabel?{label:K.AXLabel.trim()}:{},role:U,frame:N});let C=Boolean(W||X||Y||!["Group","Other"].includes(U));if(C){let F=`${" ".repeat(Math.min(B,12))}${U} "${W.slice(0,160)}"${X}${Y}`+(N?` (${Math.round(N.x)},${Math.round(N.y)} ${Math.round(N.width)}x${Math.round(N.height)})`:"")+(K.enabled===!1?" disabled":"");Z.lines.push(F);let D=U==="Image"&&!X,w=(U==="StaticText"||U==="Image")&&!X&&W!==""&&G.includes(W);if(!D&&!w)Z.compact.push(F)}for(let F of K.children??[])Q(F,C?B+1:B,W||G)};for(let K of J)Q(K,0);return Z}function v5($,J,Z=!1){let Q=(Z?$.compact:$.lines).join(`
|
|
505
505
|
`);return Q.length>J?`${Q.slice(0,J)}
|
|
506
|
-
\u2026 (truncated)`:Q}async function
|
|
507
|
-
${
|
|
506
|
+
\u2026 (truncated)`:Q}async function jZ($){let J=await l1($);return{text:`Accessibility tree of ${h($)} (frames in points; tap by id or label):
|
|
507
|
+
${v5(J,$Z)}`,device:$}}var IZ=450,AZ=1e4;function TZ($,J){let Z=J.id?$.ids.has(J.id):[...$.labels].some((Q)=>Q===J.label||Q.includes(J.label));return J.gone?!Z:Z}async function I0($,J,Z){let Q=J.observe??"tree";if(Q==="none"&&!J.wait_for)return Z;let K=null,B="";if(J.wait_for){let U=Date.now()+(J.timeout??5)*1000,W=J.wait_for,Y=W.id?`id ${W.id}`:`"${W.label}"`;for(;;){if(K=await l1($),TZ(K,W)){B=` ${Y} is ${W.gone?"gone":"on screen"}.`;break}if(Date.now()>=U){B=W.gone?` Waited ${J.timeout??5} s: ${Y} is still on screen.`:` Waited ${J.timeout??5} s: ${Y} is not in the visible accessibility tree. Lists only build their visible rows, so check the screen below: it may be open with that element further down (scroll to it), or wait for something at its top.`;break}await Bun.sleep(250)}}else await Bun.sleep(IZ);let G={...Z,text:`${Z.text}${B}`};if(Q==="tree"||Q==="both")K??=await l1($),G.screen=v5(K,AZ,!0),G.text+=`
|
|
508
508
|
Screen now:
|
|
509
|
-
${G.screen}`;if(Q==="screenshot"||Q==="both"){let U=await H3($);G.image=U.image}return G}function
|
|
509
|
+
${G.screen}`;if(Q==="screenshot"||Q==="both"){let U=await H3($);G.image=U.image}return G}function R5($){return`'${$.replace(/'/g,"'\\''")}'`}function _Z($){switch($.action){case"tap":if($.x!==void 0&&$.y!==void 0)return $.duration?`touch -x ${$.x} -y ${$.y} --down --up --delay ${$.duration}`:`tap -x ${$.x} -y ${$.y}`;return $.id?`tap --id ${R5($.id)}`:`tap --label ${R5($.label)}`;case"swipe":return`swipe --start-x ${$.x} --start-y ${$.y} --end-x ${$.x2} --end-y ${$.y2} --duration ${$.duration??0.3}`;case"button":return`button ${$.name.replace("_","-")}`;case"sleep":return`sleep ${$.seconds}`}}var p5=0.35,RZ=new Set(["Button","Link","Cell","MenuItem","Switch","Toggle","CheckBox","PopUpButton","TextField","SecureTextField","SearchField","TextArea","Slider","Tab","RadioButton"]);function PZ($,J){let Z=$.targets.filter((Y)=>J.id!==void 0?Y.id===J.id.trim():Y.label===J.label?.trim()),Q=(Y)=>({x:Y.frame.x+Y.frame.width/2,y:Y.frame.y+Y.frame.height/2}),K=$.bounds,B=K?Z.filter((Y)=>{let{x:X,y:N}=Q(Y);return X>=0&&N>=0&&X<=K.width&&N<=K.height}):Z,G=B.length?B:Z,U=G.filter((Y)=>RZ.has(Y.role)),W=(U.length?U:G)[0];return W?Q(W):null}async function zZ($,J,Z,Q,K){let B=Date.now()+Z*1000;for(;;){let G=PZ(await l1($),J);if(G)return G;if(Date.now()>=B){let U=J.id!==void 0?`--id '${J.id}'`:`--label '${J.label}'`;return f("simulator_element_not_found",`Error: Step ${Q} failed: [tap]
|
|
510
510
|
No accessibility element matched ${U}. Make sure the app is on the expected screen, then inspect it and prefer an id when there is one.
|
|
511
|
-
(${Q-1} of ${K} steps had completed.)`)}await Bun.sleep(250)}}async function f0($,J,Z){let Q=await
|
|
512
|
-
(${K} of ${J.length} steps had completed.)`);throw U}let G=J[K+1];if(B.action!=="sleep"&&G&&G.action!=="sleep")await Bun.sleep(
|
|
513
|
-
(${G} of ${J.length} steps had completed before this batch.)`)}throw Y}G+=B,Q=[],K=[],B=0};for(let[W,Y]of J.entries()){if(Y.action==="type"){await U(),await
|
|
511
|
+
(${Q-1} of ${K} steps had completed.)`)}await Bun.sleep(250)}}async function f0($,J,Z){let Q=await b5($);if(!Q)return P5($,J,Z);for(let[K,B]of J.entries()){try{switch(B.action){case"tap":{let U=B.x!==void 0&&B.y!==void 0?{x:B.x,y:B.y}:await zZ($,B,Z,K+1,J.length);await Q.call(B.duration?{op:"tap",...U,duration:B.duration}:{op:"tap",...U});break}case"swipe":await Q.call({op:"swipe",x:B.x,y:B.y,x2:B.x2,y2:B.y2,duration:B.duration??0.3});break;case"button":await Q.call({op:"button",name:B.name});break;case"type":await Q.call({op:"text",text:B.text}).catch((U)=>U instanceof V1?u1(["type",B.text],$.udid,`Step ${K+1} (typing)`):Promise.reject(U));break;case"sleep":await Bun.sleep(B.seconds*1000);break}}catch(U){if(U instanceof S0)return await P5($,J.slice(K),Z),`Ran ${J.length} step(s) on ${h($)}.`;if(U instanceof V1)f("simulator_command_failed",`Step ${K+1} failed: ${U.message}
|
|
512
|
+
(${K} of ${J.length} steps had completed.)`);throw U}let G=J[K+1];if(B.action!=="sleep"&&G&&G.action!=="sleep")await Bun.sleep(p5*1000)}return`Ran ${J.length} step(s) on ${h($)}.`}async function P5($,J,Z){let Q=[],K=[],B=0,G=0,U=async()=>{if(Q.length===0)return;let W=["batch","--ax-cache","perStep","--wait-timeout",String(Z)];for(let Y of Q)W.push("--step",Y);try{await u1(W,$.udid,`Steps ${G+1}-${G+B}`)}catch(Y){if(Y instanceof H){let X=Y.message.replace(/Step (\d+) failed/,(N,C)=>{let F=K[Number(C)-1];return F?`Step ${F} failed`:N});f(Y.code,`${X}
|
|
513
|
+
(${G} of ${J.length} steps had completed before this batch.)`)}throw Y}G+=B,Q=[],K=[],B=0};for(let[W,Y]of J.entries()){if(Y.action==="type"){await U(),await u1(["type",Y.text],$.udid,`Step ${G+1} (typing)`),G+=1;continue}Q.push(_Z(Y)),B+=1,K.push(W+1);let X=J[W+1];if(Y.action!=="sleep"&&X&&X.action!=="sleep")Q.push(`sleep ${p5}`),K.push(W+1)}return await U(),`Ran ${J.length} step(s) on ${h($)}.`}var EZ=["topLeft","top","topRight","right","bottomRight","bottom","bottomLeft","left"],z5=new Map,qZ=`ObjC.import("AppKit");
|
|
514
514
|
function run(argv) {
|
|
515
515
|
const [input, output, width, height] = argv;
|
|
516
516
|
const w = Number(width), h = Number(height);
|
|
@@ -522,8 +522,8 @@ function run(argv) {
|
|
|
522
522
|
image.drawInRectFromRectOperationFraction($.NSMakeRect(0, 0, w, h), $.NSZeroRect, $.NSCompositingOperationCopy, 1);
|
|
523
523
|
$.NSGraphicsContext.restoreGraphicsState;
|
|
524
524
|
rep.representationUsingTypeProperties($.NSBitmapImageFileTypePNG, $()).writeToFileAtomically(output, true);
|
|
525
|
-
}`;async function Z3($,J,Z){let Q=await
|
|
526
|
-
`:U>=32&&U<=126?String.fromCharCode(U):null;if(W===null)return;Q+=W,clearTimeout(K),K=setTimeout(()=>{let Y=Q;Q="",B({action:"type",text:Y})},250)},clipboard(G){
|
|
527
|
-
`)}async function
|
|
528
|
-
`):J.data.command;try{return{...await I1({claim:$.claim,root:G,cwd:G,command:M,mode:"host",shell:C,expiresAtMs:U,signal:$.signal,emit:W,...F?{jobsUser:{...F,...D!==null?{modelGid:D}:{}}}:{},environment:{...N.variables,HOME:N.home,PATH:N.path,TMPDIR:N.temporaryDirectory,SHELL:C},journals:Y,preview:X})}}finally{w?.close()}}function MQ($){if(!G0("/usr/bin/sandbox-exec"))throw new H("local_device_gh_confinement_unavailable","This Mac cannot confine a local GitHub Session's dev server.");let J=J0($),Z=J0(A7(_3(J0(R7()),"reason-preview-"))),Q="/bin/bash";return{shell:Q,prefix:["/usr/bin/sandbox-exec","-p",S6(J,Z)],environment:{HOME:Z,PATH:g6,TMPDIR:Z,TMP:Z,TEMP:Z,SHELL:Q,BASH_ENV:"/dev/null",ENV:"/dev/null",OPENSSL_CONF:"/dev/null"},dispose:()=>_7(Z,{recursive:!0,force:!0})}}async function LQ($){b2();let J=m($.root),Z=x2($.payload.command),Q=p0(J,u0($.payload,"cwd")??".");if(!N1(Q).isDirectory())throw new H("invalid_cwd","cwd is not a directory.");let K=F1($.payload.timeout_ms,f8,100,k2),{ignored:B}=y2($.payload.env);return await $.emit("progress",{shell:E0(),shell_flags:[...Z1],sandbox:"none",ignored_env:B}),x8({command:Z,cwd:Q,timeoutMs:K,signal:$.signal,spawn:$.spawnFullControl,requestEnv:$.payload.env})}async function wQ($){let J=m($.root),Z=XQ($.payload),Q=Z[0];if(!Q||!q7.has(Q)&&!O3.has(Q))throw new H("git_command_not_allowed","Git subcommand is not in the Device allowlist.");if(Z.some((G)=>G==="-C"||G==="-c"||G.startsWith("--git-dir")||G.startsWith("--work-tree")||G.startsWith("--config-env")||G.startsWith("--exec-path")))throw new H("git_argument_not_allowed","Git path/config overrides are not allowed.");let K=O3.has(Q);if(K&&!$.root.permissions.write)throw new H("permission_denied","Mutating Git commands require the write grant.");let B=p0(J,u0($.payload,"cwd")??".");return f7($,"git",["-c","core.hooksPath=/dev/null","-c","credential.helper=",...Z],{cwd:B,allowWrite:K,timeoutMs:F1($.payload.timeout_ms,P3,100,R3)})}function y7($,J){return async(Z)=>{let Q=await $.runCommand("/usr/sbin/lsof",Z,{cwd:J,root:J,allowWrite:!1,allowProcessInspection:!0,timeoutMs:1e4,signal:$.signal});if($.signal.aborted)throw new H("cancelled","Operation was cancelled.");return Q}}async function OQ($){let J=m($.root);if(l()==="linux")return c8(J);return o8(J,y7($,J))}async function jQ($){let J=m($.root);if(l()==="linux")return n8(J);return t8(J,y7($,J))}async function IQ($){let J=$.worker?G5($.worker):null,Z=$.claim.environment;delete $.claim.environment;let Q=$.worker&&Z&&E3({deviceId:$.deviceId},$.root.id,$.runId,Z.payload,Z.authority)?Z.payload:void 0;return $.runHandsRelay({...$.claimedAtMs===void 0?{}:{claimedAtMs:$.claimedAtMs},claimOwner:$.claimOwner,...Q?{claimEnvironment:Q}:{},localGithubConfinement:Boolean($.claim.local_github_authority),...$.worker?{headless:!0,runtimeDirectory:$.worker.runtimeDirectory,...$.worker.handsSlots?{handsSlots:$.worker.handsSlots}:{},hostExecution:$.worker.executionMode==="unsandboxed",...$.worker.executionMode==="unsandboxed"&&$.worker.readiness?.["pty.start"]===!0?{managedPty:{version:1,startupVerified:!0}}:{},deviceIdentity:{deviceId:$.deviceId,rootId:$.root.id,apiOrigin:$.apiOrigin},...J?{desktopRecording:J}:{}}:{},root:m($.root),runId:$.runId,operationId:$.operationId,attemptId:$.attemptId,payload:$.payload,signal:$.signal,emitEvent:(K,B,G)=>$.emit(K,B,G)})}async function AQ($){if($.worker){if(!$.root.permissions.read||!$.root.permissions.write)throw new H("permission_denied","Bound Hands terminals require the workspace read/write grants.");let{workspace:J,session:Z}=x6($.payload,$.operationId);return v6({root:m($.root),runId:$.runId,deviceId:$.deviceId,rootId:$.root.id,workspace:J,session:Z,owner:$.claimOwner,authority:$.claimAuthority,signal:$.signal,emit:(Q,K)=>$.emit(Q,K)})}return $.runPtySession({root:m($.root),runId:$.runId,operationId:$.operationId,payload:$.payload,signal:$.signal,emitEvent:(J,Z)=>$.emit(J,Z)})}function e5($,J){let Z=m0()?r1():null;return Z?a1(Z,{op:"transfer",direction:J,root:$.root,payload:$.payload,worker:Boolean($.worker)},$.signal).then((Q)=>Q.value):TQ(J,{root:$.root,payload:$.payload,signal:$.signal,worker:Boolean($.worker),fetchImpl:$.fetchImpl,beforeCommit:()=>$.emit("progress",{phase:"file_transfer_verified"})})}async function TQ($,J){let Z=m(J.root),Q=o0 in J.payload;if(Q&&!J.worker)throw new H("cloud_copy_workspace_invalid","Only a worker resolves a Cloud copy workspace.");let K=Q?X8(Z,J.payload[o0]):Z;if("source"in J.payload||"source_version"in J.payload){if($!=="export"||!Q)throw new H("cloud_copy_source_unsupported","Explicit sources require the private Cloud exporter.");let U=n4.safeParse(J.payload);if(!U.success)throw new H("invalid_payload","Invalid Cloud export request.");return W8({runtimeRoot:K,source:U.data.source,url:U.data.url,signal:J.signal,fetchImpl:J.fetchImpl})}let B=i1(J.payload,"path",4096),G=$==="import"&&Q?z2(K):K;return h0(z3(G,B)),q0({direction:$,root:G,path:B,payload:J.payload,signal:J.signal,fetchImpl:J.fetchImpl,beforeCommit:J.beforeCommit})}var h7={"inference.custom.v1":{requiredPermission:"read",additionalPermissions:["execute","discover_environment"],execute:($)=>{if(!$.customEndpointCredential||!$.claimOwner)throw new H("custom_endpoint_credential_unavailable","Local model credentials require a signed Device claim.");return h3({payload:$.payload,signal:$.signal,credential:$.customEndpointCredential,emit:(J,Z)=>$.emit(J,Z,$.signal)})}},"fs.read":{requiredPermission:"read",execute:($)=>t5("fs.read",$)},"fs.write":{requiredPermission:"write",execute:($)=>t5("fs.write",$)},"fs.export":{requiredPermission:"read",execute:($)=>e5($,"export")},"fs.import":{requiredPermission:"write",execute:($)=>e5($,"import")},"preview.serve.v1":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:()=>l()==="darwin"&&f2(),execute:DQ},"exec.run":{requiredPermission:"execute",available:j3,execute:HQ},"exec.full":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:()=>f2(),execute:LQ},"git.run":{requiredPermission:"execute",available:()=>j3()&&JQ("git"),execute:wQ},"process.list":{requiredPermission:"read",additionalPermissions:["discover_environment"],available:i5,execute:OQ},"ports.list":{requiredPermission:"read",additionalPermissions:["discover_environment"],available:i5,execute:jQ},"hands.connect":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],available:()=>l()==="darwin"||Boolean(o6()),execute:IQ},"pty.start":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:H7,execute:AQ},"display.stream.v1":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:w7,execute:($)=>{let J=r1();return J?a1(J,{op:"display",payload:$.payload,proxy:($.relay.loadProxy??r6)()},$.signal):s1({payload:$.payload,signal:$.signal},$.relay)}},"automation.call.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:()=>M7(),execute:($)=>L7({runId:$.runId,payload:$.payload,signal:$.signal,...$.worker?.userChrome?{userChrome:$.worker.userChrome}:{}})},"simulator.call.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:G1,execute:($)=>U1({payload:$.payload,root:m($.root)})},"simulator.stream.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:s5,execute:($)=>n5({payload:$.payload,root:m($.root),signal:$.signal},$.relay)},"jobs.control":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],available:()=>!0,execute:($)=>p6({root:m($.root),runId:$.runId,payload:$.payload,signal:$.signal})},"github.local.v1":{requiredPermission:"read",additionalPermissions:["execute","discover_environment"],available:()=>l()==="darwin"?G0("/usr/bin/sandbox-exec"):l()==="linux",execute:async($)=>{let J=L1.parse($.payload),Z=A3.parse($.claim.local_github_authority);if(Z.userId!==$.claimOwner?.user_id||Z.deviceId!==$.deviceId||Z.rootId!==$.root.id||Z.runId!==$.runId||Z.repoFullName!==J.repoFullName||!Z.readOnly&&!$.root.permissions.write||!M0(J)&&(Z.readOnly||Z.generation===null&&!(J.kind==="pr_merge"&&Z.merge?.source==="human")))throw Error("local_device_gh_authority_changed");return u6({root:m($.root),runId:$.runId,request:J,authority:Z,signal:$.signal,leaseUntil:$.claim.lease_until},(Q)=>t3(J,Q))}},"environment.install":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:async($)=>T3({root:m($.root),runId:$.runId,payload:$.payload})},"browser.pr-proof.v1":{requiredPermission:"read",additionalPermissions:["execute"],available:()=>!1,execute:async($)=>{if(!$.proveMac)throw new H("capability_unsupported","PR proof host is not installed.");return $.proveMac()}},"tunnel.open":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:($)=>h6({root:m($.root),runId:$.runId,owner:$.claimOwner,payload:$.payload,signal:$.signal})},"tunnel.close":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:($)=>m6({root:m($.root),runId:$.runId,owner:$.claimOwner,payload:$.payload,signal:$.signal})},"workspace.setup.v1":{requiredPermission:"execute",additionalPermissions:["read","write"],available:R2,execute:($)=>K8($.payload,$.signal)}};function _Q($,J){try{let Z=v3($,J0(J)),Q=Z?$.find((K)=>K.path===Z):void 0;return Q&&/^[a-f0-9]{64}$/.test(Q.pathFingerprint)?Q.pathFingerprint:void 0}catch{return}}function RQ($,J){try{let Z=J0(J);return $.some((Q)=>Q.path===Z)?Z:void 0}catch{return}}function PQ($,J){try{let Z=J0(J),Q=$.find((K)=>K.path===Z);return Q&&/^[a-f0-9]{64}$/.test(Q.pathFingerprint)?Q.pathFingerprint:void 0}catch{return}}function zQ($,J){try{let Z=J0(J);if(!$.some((Q)=>Q.path===Z))return;return $.filter((Q)=>Q.path!==Z&&v0(Z,Q.path)&&/^[a-f0-9]{64}$/.test(Q.pathFingerprint)).map((Q)=>Q.pathFingerprint)}catch{return}}function qQ($,J){try{return D1({home:J0(J),roots:$.filter((Z)=>/^[a-f0-9]{64}$/.test(Z.pathFingerprint)&&H1(Z.path)).slice(0,$2).map((Z)=>({path_fingerprint:Z.pathFingerprint,path:Z.path}))})}catch{return}}function nG($,J={}){let Z=J.worker?J.worker.handsSlots??1:J.handsSlots===1?1:void 0,Q=Boolean(J.worker)||l()==="darwin",K=Q?PQ($,W1()):void 0,B=!J.worker&&l()==="darwin"?_Q($,W1()):void 0,G=Q?RQ($,W1()):void 0,U=!J.worker&&l()==="darwin"?zQ($,W1()):void 0,W=Q?qQ($,W1()):void 0,Y=S2.filter((X)=>{if(J1.has(X)&&!J.worker)return!1;if(J.worker&&!k1(X,J.worker))return!1;let N=h7[X];if(!N)return!1;return(X==="hands.connect"&&(J.terminalOnlyHands===!0||Boolean(J.worker))||(X==="pty.start"||X==="preview.serve.v1")&&Boolean(J.worker)||X==="browser.pr-proof.v1"&&Boolean(J.productionProof)?!0:N.available?.()??!0)&&$.some((F)=>(!J.worker||X!=="pty.start"||F.permissions.read&&F.permissions.write)&&E7(N).every((D)=>F.permissions[D]))});return{supported_operations:Y,...K?{account_root_fingerprint:K}:{},...B?{workspace_root_fingerprint:B}:{},...G?{account_root_path:G}:{},...U?{home_contained_root_fingerprints:U}:{},...W?{root_paths:W}:{},...Y.includes("hands.connect")?{hands_worker_artifact_sha256:P0,hands_worker_entrypoint:r0,...Z?{hands_slots:Z}:{}}:{},max_payload_bytes:N0,max_result_bytes:N0,operation_constraints:{...Y.includes("browser.pr-proof.v1")&&J.productionProof?{"browser.pr-proof.v1":V2.parse(J.productionProof)}:{},"exec.run":{transport:"shell",shell:g7(),sandbox:l()==="linux"?"linux_sandbox_runtime":"macos_seatbelt",network:!1,max_timeout_ms:R3},...Y.includes("exec.full")?{"exec.full":y8()}:{},"git.run":{read_only_subcommands:[...q7].sort(),mutating_subcommands:[...O3].sort(),push:!1,credential_helpers:!1},"fs.export":{transport:"https_signed_url",max_bytes:W0,max_timeout_ms:i0,result:"sha256_and_size"},"fs.import":{transport:"https_signed_url",max_bytes:W0,max_timeout_ms:i0,atomic:!0,overwrite:!1},"hands.connect":{transport:"wss_relay",worker:"ara_hands",worker_version:n0,protocol_version:L3,worker_artifact_sha256:P0,worker_entrypoint:r0,policy_mode:"full_access",policy_version:1,workspace_base:M3,workspace_layout:$1,...Z?{slots:Z}:{},browser_state:J.worker?"optional_headless":J.terminalOnlyHands===!0?"disabled_terminal_only":l()==="darwin"?"optional_isolated_per_session":"isolated_per_session",max_session_ms:43200000},...Y.includes("pty.start")?{"pty.start":{transport:"wss_relay",shell:"login_shell",resize:!0,slots:C7,max_session_ms:F7,max_buffered_output_bytes:N7}}:{},...J.worker?Object.fromEntries(Y.filter((X)=>X!=="browser.pr-proof.v1").map((X)=>[X,{ready:J.worker?.readiness?.[X]===!0,...J.worker?.readiness?.[X]!==!0&&J.worker?.probing?.includes(X)?{probing:!0}:{},execution_mode:k1(X,{...J.worker,executionMode:"sandboxed"})?"confined":"host",...X==="pty.start"?{transport:"wss_relay",worker:"ara_hands",shell:"bound_job",protocol_version:k6,environment:"private_snapshot",receipt:"metadata_only",...J.worker?.persistentTerminals&&!m0()?{persistent_terminals:!0}:{}}:{},...X==="github.local.v1"&&J.worker?.githubSignedIn!==void 0?{gh_authenticated:J.worker.githubSignedIn}:{},...X==="hands.connect"?{transport:"wss_relay",worker:"ara_hands",slots:Z,session_group:j6,workspace_base:M3,workspace_layout:$1,browser_state:"optional_headless",desktop:!1,worker_version:n0,protocol_version:L3,...J.worker?.readiness?.["environment.install"]===!0&&Y.includes("environment.install")?{environment_delivery:Z6,[B6]:K6}:{},...J.worker?{[G6]:V6}:{},...J.worker?.handsBrowser?{[F6]:Y6}:{},[W6]:X6,[C6]:N6,...y0(J.worker?.executionMode==="unsandboxed")?{[D6]:H6}:{},...y0(J.worker?.executionMode==="unsandboxed")&&n1()!==null?{[L6]:M6}:{},...y0(J.worker?.executionMode==="unsandboxed")&&m0()?{[O6]:w6}:{}}:{},...X==="fs.export"?{cloud_source_version:R1,source_kinds:["workspace","attachment"],[w2]:O2}:{},...X==="fs.import"?{[w2]:O2}:{},...X===Q4&&n1()!==null&&y0(J.worker?.executionMode==="unsandboxed")?{[G4]:X2}:{},...X==="tunnel.open"?{carried_jobs:I6}:{},...X==="jobs.control"?{[T6]:A6}:{},...X==="display.stream.v1"&&J.worker?.displayVideo?{[B7]:K7,[G7]:V7.join(","),[U7]:X7,[W7]:Y7}:{},...X==="automation.call.v1"&&J.worker?.userChrome?{[_6]:!0}:{},...X==="automation.call.v1"&&J.worker?.cloudSessions?{[R6]:!0}:{}}])):{}}}}function E3($,J,Z,Q,K){let B=l6.safeParse(Q);return B.success&&K!==void 0&&K.device_id===$.deviceId&&B.data.device_id===$.deviceId&&B.data.root_id===J&&B.data.run_id===Z&&B.data.binding.kind===K.binding&&B.data.binding.target_revision===K.target_revision&&B.data.binding.root_grant_revision===K.root_grant_revision&&B.data.binding.target_generation===K.target_generation&&B.data.binding.target_fence_id===K.target_fence_id}async function rG($,J,Z,Q,K){if(J.capability!=="hands.connect"||Z.kind!==Q6||!Q.operationEnvironment||!Q.acknowledgeOperationEnvironment)return!1;let B=Z.payload.snapshot_id;if(Z.payload.version!==1||typeof B!=="string"||Object.keys(Z.payload).length!==2)throw new H("environment_unavailable","Reason sent an invalid environment delivery.");let G=$.roots.find((Y)=>Y.id===J.root_id);if(!G)throw new H("root_not_granted","The Hands root is no longer granted.");let U=await Q.operationEnvironment($,J,B,K);if(!E3($,G.id,J.run_id,U.payload,U.authority)||U.payload.snapshot_id!==B)throw new H("environment_unavailable","The delivered environment does not match this Hands.");let W=T3({root:m(G),operationId:J.operation_id,payload:U.payload});return await Q.acknowledgeOperationEnvironment($,J,{snapshot_id:W.snapshot_id,installed_revision:W.installed_revision,installed:!0},K),!0}async function aG($,J,Z,Q){if(J.capability!=="hands.connect"||Z.kind!==U6)return!1;let{version:K,run_id:B,target_generation:G,target_fence_id:U}=Z.payload;if(K!==1||Object.keys(Z.payload).length!==4||typeof B!=="string"||typeof G!=="number"||typeof U!=="string")throw new H("hands_rebind_unavailable","Reason sent an invalid Hands rebind.");let W=$.roots.find((Y)=>Y.id===J.root_id);if(!W)throw new H("root_not_granted","The Hands root is no longer granted.");return await y6({operationId:J.operation_id,root:m(W),runId:B,targetGeneration:G,fenceId:U,...Q?{signal:Q}:{}}),!0}async function iG($,J,Z){if(J.capability!=="github.local.v1")return $6($,J,Z);try{let Q=await $6($,J,Z);if(Q.status==="succeeded")return Q;return{status:Q.status,error_code:Q.status==="cancelled"?"operation_cancelled":"local_github_unavailable"}}catch{return{status:Z.signal.aborted?"cancelled":"failed",error_code:Z.signal.aborted?"operation_cancelled":"local_github_unavailable"}}}async function $6($,J,Z){if(J1.has(J.capability)&&!Z.worker)return{status:"failed",error_code:"capability_not_granted"};if(Z.worker&&!k1(J.capability,Z.worker))return{status:"failed",error_code:"capability_not_granted"};if(Z.worker&&Z.worker.readiness?.[J.capability]!==!0)return{status:"failed",error_code:"capability_unavailable"};if(J.local_github_authority){let X=A3.safeParse(J.local_github_authority);if(!X.success||X.data.deviceId!==$.deviceId||X.data.rootId!==J.root_id||X.data.runId!==J.run_id||X.data.userId!==J.owner?.user_id||!["github.local.v1","hands.connect","environment.install","jobs.control","preview.serve.v1"].includes(J.capability))return{status:"failed",error_code:"local_device_gh_capability_denied"}}let Q=h7[J.capability];if(!Q)return{status:"failed",error_code:"capability_unsupported"};if(Q.available&&!Q.available()&&!(["hands.connect","pty.start","preview.serve.v1"].includes(J.capability)&&Z.worker)&&!Z.runCommand&&!Z.runHandsRelay&&!Z.spawnFullControl&&!Z.runPtySession&&!(J.capability==="browser.pr-proof.v1"&&Z.proveMac))return{status:"failed",error_code:"capability_unavailable"};if(J.protocol_version!==2)return{status:"failed",error_code:"protocol_unsupported"};let K=$.roots.find((X)=>X.id===J.root_id);if(!K)return{status:"failed",error_code:"root_not_granted"};if((J.capability==="fs.export"||J.capability==="fs.import")&&I3(J.payload)&&(("source"in J.payload)||("source_version"in J.payload))){let X=Boolean(Z.worker||$.worker)&&o0 in J.payload;if(J.capability!=="fs.export"||!X)return{status:"failed",error_code:"cloud_copy_source_unsupported"}}if(J.owner&&(J.owner.device_id!==$.deviceId||J.owner.organization_id!==$.orgId))return{status:"failed",error_code:"capability_not_granted"};if((J.capability==="tunnel.open"||J.capability==="tunnel.close")&&!J.owner)return{status:"failed",error_code:"preview_unavailable"};if(J.capability==="environment.install"&&!E3($,K.id,J.run_id,J.payload,J.authority))return{status:"failed",error_code:"environment_unavailable"};if(E7(Q).some((X)=>!K.permissions[X]))return{status:"failed",error_code:"permission_denied"};let B=0,G=async(X,N,C)=>{if(["environment.install","github.local.v1"].includes(J.capability)||J.capability==="inference.custom.v1"&&(X==="started"||X==="completed"))return;await Z.emit?.({sequence:B++,kind:X,capability:J.capability,data:N,...(X==="hands.reconnected"||J.capability==="inference.custom.v1")&&C?{deliverySignal:C}:{}})},U=J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||eZ.has(J.capability)||J.capability==="pty.start",W,Y=async(X,N,C)=>{let F=W;W=void 0,await Promise.all([F,G(X,N,C)])};try{if(U)W=G("started"),W.catch(()=>{return});else await G("started");let X={...Z.proxy===void 0?{}:{loadProxy:()=>Z.proxy??null},...Z.handsLaunch?.takePrespawnedWorker?{takePrespawnedWorker:Z.handsLaunch.takePrespawnedWorker}:{},...Z.handsLaunch?.adoptSpawnedWorker?{adoptSpawnedWorker:Z.handsLaunch.adoptSpawnedWorker}:{}},N=await Q.execute({...Z.proveMac?{proveMac:()=>Z.proveMac(J,Z.signal,(C)=>G("pr-proof.started.v1",C))}:{},claim:J,worker:Z.worker,claimOwner:J.owner,claimAuthority:J.authority,organizationId:$.orgId,deviceId:$.deviceId,apiOrigin:$.apiOrigin,root:K,payload:ZQ(J.payload),runId:J.run_id,operationId:J.operation_id,attemptId:J.attempt_id,...Z.handsLaunch?{claimedAtMs:Z.handsLaunch.claimedAtMs}:{},signal:Z.signal,...Z.customEndpointCredential?{customEndpointCredential:Z.customEndpointCredential}:{},fetchImpl:Z.fetchImpl??fetch,relay:X,runCommand:Z.runCommand??UQ,spawnFullControl:Z.spawnFullControl??q3,emit:U?Y:G,runHandsRelay:Z.runHandsRelay??((C)=>e6(C,X)),runPtySession:Z.runPtySession??D7});if(J.capability==="github.local.v1")J6.parse(N);if(!I3(N))throw new H("invalid_result","Operation result must be a JSON object.");if(Buffer.byteLength(JSON.stringify(N)??"null","utf8")>N0)throw new H("result_too_large","Operation result exceeds 256 KB.");return await(U?Y:G)("completed",{ok:!0}),{status:"succeeded",result:N,error_code:null}}catch(X){let N=Z.signal.reason instanceof H&&r5.has(Z.signal.reason.code)?Z.signal.reason.code:X instanceof H&&r5.has(X.code)?X.code:null;if(Z.signal.aborted||N)return{status:"cancelled",...X instanceof c0?{result:{process_terminal_observation:X.observation}}:{},error_code:["environment.install","github.local.v1","inference.custom.v1"].includes(J.capability)?"operation_cancelled":N??"cancelled"};let C=J.capability==="inference.custom.v1"?"custom_endpoint_unavailable":J.capability==="github.local.v1"?"local_github_unavailable":J.capability==="environment.install"?"environment_install_failed":X instanceof H&&tZ.test(X.code)?X.code:"capability_failed",F=J.capability==="hands.connect"&&X instanceof t6?d6(X.expiryDiagnostic):null;return await G("completed",{ok:!1,error_code:C,...F?{expiry_diagnostic:F}:{}}),{status:"failed",error_code:C}}}
|
|
529
|
-
export{
|
|
525
|
+
}`;async function Z3($,J,Z){let Q=await c("sips",["-g","pixelWidth","-g","pixelHeight",$],"Reading the frame size"),K=Number(Q.match(/pixelWidth: ([\d.]+)/)?.[1]),B=Number(Q.match(/pixelHeight: ([\d.]+)/)?.[1]);if(Z!==void 0)K=K*Z/B,B=Z;let G=X3(S(q5(),"reason-chrome-"));try{let U=S(G,"render.js"),W=S(G,"out.png");if(iJ(U,qZ),await c("osascript",["-l","JavaScript",U,$,W,String(Math.max(1,Math.round(K*J))),String(Math.max(1,Math.round(B*J)))],"Rendering the frame"),!Q0(W))f("simulator_command_failed",`Rendering ${g5($)} produced no image.`);return{image:W3(W).toString("base64"),width:K,height:B}}finally{G1(G,{recursive:!0,force:!0})}}async function gZ($){if(!V3.has($.udid))await N3();let J=V3.get($.udid),Q=JSON.parse(await c("xcrun",["simctl","list","devicetypes","-j"],"Listing device types")).devicetypes?.find((K)=>K.identifier===J)?.bundlePath;if(!Q)f("simulator_command_failed",`No device type bundle for ${$.name}.`);return Q}async function SZ($){let J=await gZ($),Z=d1.get($.udid)??($.state==="booted"?(await H3($),d1.get($.udid)):void 0);if(!Z)f("simulator_not_booted",`${$.name} is not booted.`);let Q=z5.get(J);if(Q)return{text:`Frame of ${h($)}.`,device:$,chrome:Q};let K=S(J,"Contents","Resources"),B=JSON.parse(await c("plutil",["-convert","json","-o","-",S(K,"profile.plist")],"Reading the device profile")),G=B.framebufferMask?S(K,`${B.framebufferMask}.pdf`):null,U=G&&Q0(G)?await Z3(G,e2,Z.height):null,W=B.chromeIdentifier?.split(".").pop(),Y=W?S("/Library/Developer/DeviceKit/Chrome",`${W}.devicechrome`,"Contents","Resources"):"";if(!W||!Q0(S(Y,"chrome.json")))f("simulator_command_failed",`${$.name} has no device frame in this Xcode.`);let X=JSON.parse(W3(S(Y,"chrome.json"),"utf8")),N={};for(let O of EZ){let R=X.images[O];if(!R)f("simulator_command_failed",`${$.name}'s frame has no ${O} piece.`);N[O]=await Z3(S(Y,`${R}.pdf`),e2)}let{sizing:C}=X.images,F={top:C.topHeight,left:C.leftWidth,bottom:C.bottomHeight,right:C.rightWidth},D=Z.width+F.left+F.right,w=Z.height+F.top+F.bottom,M=[];for(let O of X.inputs??[]){let R=S(Y,`${O.image}.pdf`);if(!Q0(R))continue;let g=await Z3(R,e2),{x:v,y:I}=O.offsets.normal,z=(E,L,T)=>E<0?L+E-T:E,_=O.anchor==="left"?{x:v-g.width,y:z(I,w,g.height)}:O.anchor==="right"?{x:D+v,y:z(I,w,g.height)}:O.anchor==="top"?{x:z(v,D,g.width),y:I-g.height}:{x:z(v,D,g.width),y:w+I};M.push({name:O.name,image:g.image,..._,width:g.width,height:g.height})}let j={identifier:X.identifier,screen:{width:Z.width,height:Z.height},inset:F,padding:X.images.devicePadding??{top:0,left:0,bottom:0,right:0},pieces:N,buttons:M,...U?{screen_mask:U.image}:{}};return z5.set(J,j),{text:`Frame of ${h($)}.`,device:$,chrome:j}}var kZ=new Set(["simulator_command_failed","simulator_launch_failed","simulator_point_off_screen","simulator_build_no_scheme","simulator_element_not_found","simulator_path_outside_root","simulator_project_not_found"]);async function X1($){try{return await u5($)}catch(J){if(J instanceof H&&kZ.has(J.code))return{text:J.message,error:J.code};throw J}}async function u5($){if(!U1())f("simulator_xcode_missing","Xcode's iOS Simulator is not available on this Mac.");let J=n2.safeParse($.payload);if(!J.success)f("simulator_invalid_request",J.error.issues.map((Q)=>Q.message).join("; "));let Z=J.data;switch(Z.action){case"devices":{let Q=await N3(),K=Q.filter((B)=>B.state==="booted");return{text:`${K.length} booted (${K.map(h).join(", ")||"none"}), ${Q.length} available.`,devices:Q}}case"boot":{let Q=await GZ(await o(Z.device,{booted:!1}));return{text:`${h(Q)} is booted.`,device:Q}}case"shutdown":{let Q=await o(Z.device,{booted:!1});H0.get(Q.udid)?.stop(),H0.delete(Q.udid);let K=await x0("xcrun",["simctl","shutdown",Q.udid]);if(K.code!==0&&!/current state: Shutdown/i.test(K.stderr))f("simulator_command_failed",K.stderr.trim().slice(-1000));return{text:`${h(Q)} is shut down.`,device:{...Q,state:"shutdown"}}}case"build":{let Q=await A5(Z,$.root);return Z.wait&&Q.build?J3(Q.build.id):Q}case"build_status":return Z.wait?J3(Z.build_id):h5(Z.build_id);case"run":{let Q=await A5({...Z,action:"build"},$.root),K=await J3(Q.build.id,HZ);if(K.build?.status!=="succeeded"||!K.build.app_path)return K;let B=await u5({root:$.root,payload:{action:"launch",app_path:K.build.app_path,...Z.device?{device:Z.device}:{},...Z.steps?{steps:Z.steps}:{},...Z.observe?{observe:Z.observe}:{},...Z.wait_for?{wait_for:Z.wait_for}:{},...Z.timeout!==void 0?{timeout:Z.timeout}:{}}});return{...B,text:`Built in ${Math.round(K.build.elapsed_ms/1000)} s. ${B.text}`,build:K.build}}case"launch":{let Q=await MZ(Z,$.root);if(!Q.device)return Q;if(Z.steps?.length)Q.text+=` ${await f0(Q.device,Z.steps,Z.timeout??8)}`;else if(!Z.wait_for)await Bun.sleep(1000);return I0(Q.device,Z,Q)}case"steps":{let Q=await o(Z.device,{booted:!0});return I0(Q,Z,{text:await f0(Q,Z.steps,Z.timeout??5),device:Q})}case"terminate":{let Q=await o(Z.device,{booted:!0});if(H0.get(Q.udid)?.bundleId===Z.bundle_id)H0.get(Q.udid)?.stop();return await x0("xcrun",["simctl","terminate",Q.udid,Z.bundle_id]),{text:`Terminated ${Z.bundle_id} on ${h(Q)}.`,device:Q}}case"logs":return wZ(await o(Z.device,{booted:!1}),Z.after);case"screenshot":return H3(await o(Z.device,{booted:!0}),Z.scale,Z.save_path?C3($.root,Z.save_path):void 0);case"chrome":return SZ(await o(Z.device,{booted:!1}));case"inspect":return jZ(await o(Z.device,{booted:!0}));case"tap":{let Q=await o(Z.device,{booted:!0}),K=Z.x!==void 0&&Z.y!==void 0;if(K)T5(Q,[Z.x,Z.y]);await f0(Q,[K?{action:"tap",x:Z.x,y:Z.y,...Z.duration&&Z.duration>0?{duration:Z.duration}:{}}:Z.id?{action:"tap",id:Z.id}:{action:"tap",label:Z.label}],3);let B=K?`(${Z.x}, ${Z.y})`:Z.id?`id ${Z.id}`:`"${Z.label}"`;return I0(Q,Z,{text:`Tapped ${B} on ${h(Q)}.`,device:Q})}case"swipe":{let Q=await o(Z.device,{booted:!0});return T5(Q,[Z.x,Z.y],[Z.x2,Z.y2]),await f0(Q,[{action:"swipe",x:Z.x,y:Z.y,x2:Z.x2,y2:Z.y2,...Z.duration!==void 0?{duration:Z.duration}:{}}],3),I0(Q,Z,{text:`Swiped (${Z.x}, ${Z.y}) \u2192 (${Z.x2}, ${Z.y2}) on ${h(Q)}.`,device:Q})}case"type":{let Q=await o(Z.device,{booted:!0});return await f0(Q,[{action:"type",text:Z.text}],3),I0(Q,Z,{text:`Typed ${Z.text.length} character(s) on ${h(Q)}.`,device:Q})}case"button":{let Q=await o(Z.device,{booted:!0});return await f0(Q,[{action:"button",name:Z.name}],3),I0(Q,Z,{text:`Pressed ${Z.name} on ${h(Q)}.`,device:Q})}case"open_url":{let Q=await o(Z.device,{booted:!0}),K;try{K=new URL(Z.url)}catch{f("simulator_invalid_request","open_url needs an absolute URL.")}if(KZ.has(K.protocol))f("simulator_invalid_request",`${K.protocol} URLs are not allowed.`);return await c("xcrun",["simctl","openurl",Q.udid,K.href],"Opening the URL"),I0(Q,Z,{text:`Opened ${K.href} on ${h(Q)}.`,device:Q})}case"appearance":{let Q=await o(Z.device,{booted:!0});return await c("xcrun",["simctl","ui",Q.udid,"appearance",Z.mode],"Setting the appearance"),{text:`${h(Q)} is in ${Z.mode} mode.`,device:Q}}}}import{mkdtempSync as fZ,readFileSync as bZ,rmSync as xZ}from"fs";import{tmpdir as yZ}from"os";import{join as d5}from"path";import{spawn as n5}from"child_process";var hZ=/^[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}$/i,W1=1,mZ=[{bit:8,dx:0,dy:1},{bit:16,dx:0,dy:-1},{bit:32,dx:1,dy:0},{bit:64,dx:-1,dy:0}],l5=60,vZ=8,r5=U1;var s5={65293:40,65421:40,65307:41,65288:42,65289:43,65535:76,65360:74,65367:77,65365:75,65366:78,65361:80,65362:82,65363:79,65364:81,65505:225,65506:229,65507:224,65508:228,65513:226,65514:230,65515:227,65516:231,65511:227,65512:231,65509:57},pZ=(()=>{let $={" ":44};"abcdefghijklmnopqrstuvwxyz".split("").forEach((Z,Q)=>{$[Z]=4+Q,$[Z.toUpperCase()]=4+Q}),"1234567890".split("").forEach((Z,Q)=>{$[Z]=30+Q}),"!@#$%^&*()".split("").forEach((Z,Q)=>{$[Z]=30+Q});let J=[["-","_",45],["=","+",46],["[","{",47],["]","}",48],["\\","|",49],[";",":",51],["'",'"',52],["`","~",53],[",","<",54],[".",">",55],["/","?",56]];for(let[Z,Q,K]of J)$[Z]=K,$[Q]=K;return $})();function uZ($){if(s5[$]!==void 0)return s5[$];return $>=32&&$<=126?pZ[String.fromCharCode($)]??null:null}function a5($,J){let Z=n5("xcrun",["simctl","pbcopy",$],{stdio:["pipe","ignore","ignore"]});Z.once("error",()=>{}),Z.stdin.end(J)}function dZ($,J){let Z=0,Q={x:0,y:0},K=(B)=>{J.call(B).catch(()=>{})};return{pointer(B,G,U){let W=(U&W1)!==0;if(W&&!(Z&W1))K({op:"touch",phase:"down",x:B,y:G});else if(W&&(B!==Q.x||G!==Q.y))K({op:"touch",phase:"move",x:B,y:G});else if(!W&&Z&W1)K({op:"touch",phase:"up",x:B,y:G});for(let Y of mZ)if(U&Y.bit&&!(Z&Y.bit))K({op:"swipe",x:B,y:G,x2:B+Y.dx*l5,y2:G+Y.dy*l5,duration:0.08});Z=U,Q={x:B,y:G}},key(B,G){let U=uZ(G);if(U!==null)K({op:"key",usage:U,down:B})},clipboard(B){a5($,B)},close(){if(Z&W1)K({op:"touch",phase:"up",...Q});Z=0}}}function lZ($,J){let Z=null,Q="",K,B=(G)=>{X1({payload:{...G,device:$,observe:"none"},root:J}).catch(()=>{})};return{pointer(G,U,W){let Y=(W&W1)!==0;if(Y&&!Z)Z={x:G,y:U,at:Date.now()};if(!Y&&Z){let X=(Date.now()-Z.at)/1000;if(Math.hypot(G-Z.x,U-Z.y)>vZ)B({action:"swipe",x:Z.x,y:Z.y,x2:G,y2:U,duration:Math.min(Math.max(X,0.05),1)});else B({action:"tap",x:Z.x,y:Z.y,...X>0.5?{duration:Math.min(X,10)}:{}});Z=null}},key(G,U){if(!G)return;let W=U===65293?`
|
|
526
|
+
`:U>=32&&U<=126?String.fromCharCode(U):null;if(W===null)return;Q+=W,clearTimeout(K),K=setTimeout(()=>{let Y=Q;Q="",B({action:"type",text:Y})},250)},clipboard(G){a5($,G)},close(){clearTimeout(K),Z=null}}}function sZ($,J,Z){return new Promise((Q,K)=>{let B=n5($,J,{stdio:"ignore",signal:Z});B.once("error",K),B.once("exit",(G)=>Q(G??-1))})}async function cZ($,J){let Z=fZ(d5(yZ(),"reason-simulator-stream-"));try{let Q=d5(Z,"screen.png");if(await sZ("xcrun",["simctl","io",$,"screenshot","--type=png",Q],J)!==0)throw new H("simulator_not_booted","That simulator is not booted.");let K=bZ(Q).subarray(16,24);return{width:K.readUInt32BE(0),height:K.readUInt32BE(4)}}finally{xZ(Z,{recursive:!0,force:!0})}}async function i5($,J={}){let{udid:Z,...Q}=$.payload;if(typeof Z!=="string"||!hZ.test(Z)||!Q.video)throw new H("invalid_display_request","Reason simulator stream request is malformed.");let K=await f5().catch(()=>{throw new H("simulator_axe_missing","AXe could not be installed on this Mac.")}),B=await X1({payload:{action:"screenshot",device:Z},root:$.root});if(B.error||!B.image)throw new H("simulator_not_booted","That simulator is not booted.");let G={width:B.image.width,height:B.image.height},U=await t2(K),W=U?await v1(K,Z,!0):null,Y=U?null:await c5();if(!U&&!Y)throw new H("display_video_unsupported","This Mac can build neither the simulator host nor find an H.264 ffmpeg.");let X={kind:"simulator",udid:Z,axe:K,points:G,sound:null,size:U?G:await cZ(Z,$.signal),stream:U?(N,C,F)=>j5(U,Z,Math.min(N,60),F,C):null,input:W?dZ(Z,W):lZ(Z,$.root)};return await c1({payload:Q,signal:$.signal},{...J,video:{desktop:async()=>X,...Y?{ffmpeg:()=>Y}:{}}})}var q7=131072,$Q=131072,JQ=128,g7=8192,R3=30000,P3=15000,ZQ=/^[a-z][a-z0-9_]{0,63}$/,QQ=new Set(["jobs.control","fs.read","fs.write"]),o5=new Set(["cancelled","run_finished","run_cancelled","driver_handoff","driver_stopped"]);function n1($){return $.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(J)=>`[${J.toLowerCase()}${J.toUpperCase()}]`)}function t5($){return $.map(n1).join("/")}function D3($,J){let Z=[];for(let Q=0;Q<$.length;Q+=J)Z.push($.slice(Q,Q+J));return Z}var KQ=[...D3(q6,4).map(($)=>`/(${$.map(t5).join("|")})(/|$)`),...D3(g6,4).map(($)=>`/(${$.map(t5).join("|")})$`),...D3([...S6],6).map(($)=>`/(${$.map(n1).join("|")})$`),`/${n1(".env")}\\.[^/]+$`,`/[^/]+(${k6.map(n1).join("|")})$`],O3=new Set(["add","am","apply","branch","checkout","cherry-pick","clean","commit","merge","mv","rebase","remote","reset","restore","revert","rm","stash","switch","tag"]),S7=new Set(["blame","diff","for-each-ref","grep","log","ls-files","rev-list","rev-parse","shortlog","show","status"]);function k7($){return[$.requiredPermission,...$.additionalPermissions??[]]}function BQ($){return Q7($)}function j3(){if(l()==="darwin")return G0("/usr/bin/sandbox-exec");if(l()==="linux")return K7();return!1}function e5(){if(l()==="linux")return G0("/proc");if(!j3())return!1;if(l()==="darwin")return G0("/usr/sbin/lsof");return!1}function f7(){return l()==="darwin"?"/bin/zsh":B7()}function I3($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function VQ($){if(!I3($))throw new H("invalid_payload","Operation payload must be an object.");if(Buffer.byteLength(JSON.stringify($),"utf8")>N0)throw new H("payload_too_large","Operation payload exceeds 256 KB.");return $}function u0($,J){let Z=$[J];if(Z===void 0||Z===null)return;if(typeof Z!=="string")throw new H("invalid_payload",`${J} must be a string.`);return Z}function o1($,J,Z=g7){let Q=u0($,J);if(!Q||Buffer.byteLength(Q,"utf8")>Z||Q.includes("\x00"))throw new H("invalid_payload",`${J} is missing or too large.`);return Q}function GQ($,J,Z){let Q=$[J];if(typeof Q!=="string"||Q.includes("\x00")||Buffer.byteLength(Q,"utf8")>Z)throw new H("invalid_payload",`${J} is missing or too large.`);return Q}function N1($,J,Z,Q){if($===void 0||$===null)return J;if(typeof $!=="number"||!Number.isInteger($))throw new H("invalid_payload","Expected a bounded integer.");return Math.min(Math.max($,Z),Q)}function v0($,J){return J===$||J.startsWith(`${$}${tZ}`)}function h0($){if(L0($))throw new H("protected_path","Credential and secret paths are unavailable to local tasks.")}function m($){let J;try{J=J0($.path)}catch(Z){if(process.platform==="darwin"&&t6(Z))throw e6($.path);throw new H("root_unavailable","The granted root is unavailable.")}if(J!==$.path||!C1(J).isDirectory())throw new H("root_changed","The granted root changed after registration.");return h0(J),J}function z3($,J="."){if(!J||J.includes("\x00")||iZ(J))throw new H("path_outside_root","Paths must be relative to the granted root.");let Z=oZ($,J);if(!v0($,Z))throw new H("path_outside_root","Path escapes the granted root.");return Z}function p0($,J=".",Z=!1){let Q=z3($,J),K;try{K=J0(Q)}catch(B){if(h7(B))throw m7();throw new H("path_not_found","Path does not exist.")}if(!v0($,K))throw new H("symlink_escape","Path resolves outside the granted root.");if(!Z)h0(K);return K}function UQ($,J){let Z=z3($,J);if(h0(Z),G0(Z)){let B=J0(Z);if(!v0($,B))throw new H("symlink_escape","Write target resolves outside the granted root.");if(_7(Z).isSymbolicLink())throw new H("symlink_escape","Writing through a symlink is not allowed.");return h0(B),B}let Q=F1(Z);while(!G0(Q)){let B=F1(Q);if(B===Q)throw new H("path_outside_root","No safe write parent.");Q=B}let K=J0(Q);if(!v0($,K))throw new H("symlink_escape","Write parent resolves outside the granted root.");return h0(K),Z}function b7($,J){return w3($,J)||"."}function XQ($,J=q7){let Z=Buffer.from($,"utf8");if(Z.byteLength<=J)return{value:$,truncated:!1};return{value:Z.subarray(0,J).toString("utf8"),truncated:!0}}function x7($,J){return{...r6({home:$,temporaryDirectory:J}),ZDOTDIR:J,BASH_ENV:"/dev/null",ENV:"/dev/null",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_OPTIONAL_LOCKS:"0"}}function WQ($,J,Z,Q=!1){return["(version 1)","(deny default)",'(import "system.sb")',"(allow process*)",'(allow file-read* (subpath "/opt/homebrew") (subpath "/usr/local"))',...Q?['(allow file-read* (subpath "/dev"))']:[],`(allow file-read* (subpath ${JSON.stringify($)}))`,`(allow file-read* file-write* (subpath ${JSON.stringify(J)}))`,...Z?[`(allow file-write* (subpath ${JSON.stringify($)}))`]:[],...KQ.map((K)=>`(deny file-read* file-write* (regex #"${K}"))`),"(deny network*)"].join(`
|
|
527
|
+
`)}async function E3($,J,Z){return new Promise((Q,K)=>{let B="",G="",U=!1,W=!1,Y=!1,X;try{X=eZ($,J,{cwd:Z.cwd,env:Z.env,shell:!1,stdio:["ignore","pipe","pipe"],detached:!0})}catch(w){K(w);return}let N=(w,M)=>{if(Y)return;Y=!0,clearTimeout(D),Z.signal.removeEventListener("abort",F),Q({exitCode:w,signal:M,stdout:B,stderr:G,timedOut:W,truncated:U})},C=(w,M)=>{let j=`${w}${String(M)}`,O=XQ(j);return U||=O.truncated,O.value};X.stdout.on("data",(w)=>{B=C(B,w)}),X.stderr.on("data",(w)=>{G=C(G,w)}),X.once("error",K),X.once("exit",N);let F=()=>{try{X.kill("SIGTERM")}catch{}};Z.signal.addEventListener("abort",F,{once:!0});let D=setTimeout(()=>{W=!0,F()},Z.timeoutMs)})}var $6=null;function YQ(){return $6??=V7({scrubEnvironment:x7,spawnCaptured:E3,isProtectedPath:L0}),$6}var FQ=async($,J,Z)=>{if(l()==="linux")return YQ()($,J,Z);if(l()!=="darwin"||!G0("/usr/bin/sandbox-exec"))throw new H("sandbox_unavailable","Confined command execution is unavailable on this operating system.");let Q=R7(_3(E7(),"reason-device-"));try{return await E3("/usr/bin/sandbox-exec",["-p",WQ(Z.root,Q,Z.allowWrite,Z.allowProcessInspection===!0),$,...J],{cwd:Z.cwd,timeoutMs:Z.timeoutMs,signal:Z.signal,env:x7(Z.root,Q)})}finally{z7(Q,{recursive:!0,force:!0})}};function NQ($){let J=$.args;if(J===void 0)return[];if(!Array.isArray(J)||J.length>JQ)throw new H("invalid_payload","args must be a bounded string array.");return J.map((Z)=>{if(typeof Z!=="string"||Z.includes("\x00")||Buffer.byteLength(Z,"utf8")>g7)throw new H("invalid_payload","Command argument is invalid or too large.");return Z})}async function y7($,J,Z,Q={}){if($.signal.aborted)throw new H("cancelled","Operation was cancelled.");let K=m($.root),B=Q.cwd??K,G=await $.runCommand(J,Z,{cwd:B,root:K,allowWrite:Q.allowWrite===!0,timeoutMs:Q.timeoutMs??P3,signal:$.signal});return{exit_code:G.exitCode,signal:G.signal,stdout:G.stdout,stderr:G.stderr,timed_out:G.timedOut,truncated:G.truncated}}function h7($){let J=$ instanceof Error&&"code"in $?$.code:null;return J==="EACCES"||J==="EPERM"}var m7=()=>new H("path_unreadable","The path is not readable.");function CQ($){try{return P7($,A0.O_RDONLY)}catch(J){throw h7(J)?m7():J}}function J6($,J){let Z=m0()?a1():null;return Z?i1(Z,{op:"fs",capability:$,root:J.root,payload:J.payload},J.signal).then((Q)=>Q.value):HQ($,J)}function HQ($,J){return $==="fs.read"?DQ(J):LQ(J)}async function DQ($){let J=m($.root),Z=p0(J,o1($.payload,"path"));if(!C1(Z).isFile())throw new H("not_a_file","Read target is not a file.");let Q=N1($.payload.offset,0,0,Number.MAX_SAFE_INTEGER),K=N1($.payload.max_bytes,65536,1,q7),B=u0($.payload,"encoding");if(B!==void 0&&B!=="base64")throw new H("invalid_payload","encoding must be base64.");let G=CQ(Z),U,W;try{U=T7(G).size;let X=Buffer.alloc(Math.max(0,Math.min(K,U-Q)));W=X.subarray(0,X.byteLength?rZ(G,X,0,X.byteLength,Q):0)}finally{A7(G)}let Y=B==="base64"||W.includes(0);return{path:b7(J,Z),content:Y?W.toString("base64"):W.toString("utf8"),encoding:Y?"base64":"utf8",offset:Q,bytes:W.byteLength,size:U,truncated:Q+W.byteLength<U}}function MQ($,J){let Z=$==="append"?A0.O_APPEND:A0.O_TRUNC;return A0.O_WRONLY|A0.O_NOFOLLOW|Z|(J?0:A0.O_CREAT|A0.O_EXCL)}async function LQ($){let J=m($.root),Z=o1($.payload,"path"),Q=GQ($.payload,"content",$Q),K=u0($.payload,"mode")??"overwrite";if(!["create","overwrite","append"].includes(K))throw new H("invalid_payload","mode must be create, overwrite, or append.");let B=UQ(J,Z);if($.payload.create_parents===!0||$.payload.create_directories===!0){nZ(F1(B),{recursive:!0,mode:448});let Y=J0(F1(B));if(!v0(J,Y))throw new H("symlink_escape","Write parent escaped root.")}if(!G0(F1(B)))throw new H("path_not_found","Write parent does not exist.");if(K==="create"&&G0(B))throw new H("path_exists","Create mode will not overwrite an existing file.");let G=G0(B),U=G?_7(B):null,W=P7(B,MQ(K,G),384);try{if(U){let Y=T7(W);if(Y.ino!==U.ino||Y.dev!==U.dev)throw new H("symlink_escape","The write target changed between validation and opening.")}aZ(W,Q,null,"utf8")}finally{A7(W)}return{path:b7(J,B),bytes_written:Buffer.byteLength(Q,"utf8"),mode:K}}async function wQ($){let J=m($.root),Z=o1($.payload,"command",65536),Q=p0(J,u0($.payload,"cwd")??".");if(!C1(Q).isDirectory())throw new H("invalid_cwd","cwd is not a directory.");let K=N1($.payload.timeout_ms,P3,100,R3);return y7($,f7(),["-lc",Z],{cwd:Q,allowWrite:$.root.permissions.write,timeoutMs:K})}async function OQ($){let J=Y4.safeParse($.payload),Z=$.worker;if(!J.success||!$.claimOwner||(Z?!Z.runtimeDirectory:l()!=="darwin"))throw new H("preview_unavailable","Preview servers are unavailable on this computer.");let Q=m($.root),K=h6(Q,J.data.workspace),B=K.boundary===Q?Q:p0(K.anchor,w3(K.anchor,K.boundary)||"."),G=p0(B,w3(B,K.path)||".");if(!C1(G).isDirectory())throw new H("invalid_cwd","The Session checkout is not a directory.");let U=Math.min(Date.parse(J.data.expires_at),Date.now()+G4);if(!(U>Date.now()))throw new H("process_authority_lost","The preview server lease is unavailable.");let W=(j)=>$.emit("progress",{process:j});if(!Z?.runtimeDirectory){if($.claim.local_github_authority)throw new H("local_device_gh_confinement_unavailable","Only a worker runs a local GitHub Session's dev server.");return{...await A1({claim:$.claim,root:B,cwd:G,command:J.data.command,mode:"host",shell:q0(),environment:process.env,expiresAtMs:U,signal:$.signal,emit:W})}}let Y={directory:_3(Z.runtimeDirectory,"processes")},X={deniedPorts:y6([$.apiOrigin])};if($.claim.local_github_authority&&l()==="darwin"){let j=jQ(G);try{return{...await A1({claim:$.claim,root:G,cwd:G,command:J.data.command,mode:"confined",shell:j.shell,prefix:j.prefix,environment:j.environment,expiresAtMs:U,signal:$.signal,emit:W,journals:Y,preview:X})}}finally{j.dispose()}}let N=a6(),C=i6(),F=m0(),D=J.data.egress?r1(F):null;if(J.data.egress&&(D===null||!y0(Z.executionMode==="unsandboxed")))throw new H("preview_egress_unavailable","This computer cannot hold a dev server to the run's network allowlist; no command was dispatched.");let w=J.data.egress?await m4(J.data.egress.allowed_domains):null,M=w?[`export ${["HTTP_PROXY","HTTPS_PROXY","http_proxy","https_proxy"].map((j)=>`${j}=${w.url}`).join(" ")}`,"export NO_PROXY=localhost,127.0.0.1,::1 no_proxy=localhost,127.0.0.1,::1 NODE_USE_ENV_PROXY=1",J.data.command].join(`
|
|
528
|
+
`):J.data.command;try{return{...await A1({claim:$.claim,root:G,cwd:G,command:M,mode:"host",shell:C,expiresAtMs:U,signal:$.signal,emit:W,...F?{jobsUser:{...F,...D!==null?{modelGid:D}:{}}}:{},environment:{...N.variables,HOME:N.home,PATH:N.path,TMPDIR:N.temporaryDirectory,SHELL:C},journals:Y,preview:X})}}finally{w?.close()}}function jQ($){if(!G0("/usr/bin/sandbox-exec"))throw new H("local_device_gh_confinement_unavailable","This Mac cannot confine a local GitHub Session's dev server.");let J=J0($),Z=J0(R7(_3(J0(E7()),"reason-preview-"))),Q="/bin/bash";return{shell:Q,prefix:["/usr/bin/sandbox-exec","-p",b6(J,Z)],environment:{HOME:Z,PATH:f6,TMPDIR:Z,TMP:Z,TEMP:Z,SHELL:Q,BASH_ENV:"/dev/null",ENV:"/dev/null",OPENSSL_CONF:"/dev/null"},dispose:()=>z7(Z,{recursive:!0,force:!0})}}async function IQ($){b2();let J=m($.root),Z=x2($.payload.command),Q=p0(J,u0($.payload,"cwd")??".");if(!C1(Q).isDirectory())throw new H("invalid_cwd","cwd is not a directory.");let K=N1($.payload.timeout_ms,y8,100,k2),{ignored:B}=y2($.payload.env);return await $.emit("progress",{shell:q0(),shell_flags:[...Q1],sandbox:"none",ignored_env:B}),m8({command:Z,cwd:Q,timeoutMs:K,signal:$.signal,spawn:$.spawnFullControl,requestEnv:$.payload.env})}async function AQ($){let J=m($.root),Z=NQ($.payload),Q=Z[0];if(!Q||!S7.has(Q)&&!O3.has(Q))throw new H("git_command_not_allowed","Git subcommand is not in the Device allowlist.");if(Z.some((G)=>G==="-C"||G==="-c"||G.startsWith("--git-dir")||G.startsWith("--work-tree")||G.startsWith("--config-env")||G.startsWith("--exec-path")))throw new H("git_argument_not_allowed","Git path/config overrides are not allowed.");let K=O3.has(Q);if(K&&!$.root.permissions.write)throw new H("permission_denied","Mutating Git commands require the write grant.");let B=p0(J,u0($.payload,"cwd")??".");return y7($,"git",["-c","core.hooksPath=/dev/null","-c","credential.helper=",...Z],{cwd:B,allowWrite:K,timeoutMs:N1($.payload.timeout_ms,P3,100,R3)})}function v7($,J){return async(Z)=>{let Q=await $.runCommand("/usr/sbin/lsof",Z,{cwd:J,root:J,allowWrite:!1,allowProcessInspection:!0,timeoutMs:1e4,signal:$.signal});if($.signal.aborted)throw new H("cancelled","Operation was cancelled.");return Q}}async function TQ($){let J=m($.root);if(l()==="linux")return a8(J);return $5(J,v7($,J))}async function _Q($){let J=m($.root);if(l()==="linux")return i8(J);return J5(J,v7($,J))}async function RQ($){let J=$.worker?W5($.worker):null,Z=$.claim.environment;delete $.claim.environment;let Q=$.worker&&Z&&q3({deviceId:$.deviceId},$.root.id,$.runId,Z.payload,Z.authority)?Z.payload:void 0;return $.runHandsRelay({...$.claimedAtMs===void 0?{}:{claimedAtMs:$.claimedAtMs},claimOwner:$.claimOwner,...Q?{claimEnvironment:Q}:{},localGithubConfinement:Boolean($.claim.local_github_authority),...$.worker?{headless:!0,runtimeDirectory:$.worker.runtimeDirectory,...$.worker.handsSlots?{handsSlots:$.worker.handsSlots}:{},hostExecution:$.worker.executionMode==="unsandboxed",...$.worker.executionMode==="unsandboxed"&&$.worker.readiness?.["pty.start"]===!0?{managedPty:{version:1,startupVerified:!0}}:{},deviceIdentity:{deviceId:$.deviceId,rootId:$.root.id,apiOrigin:$.apiOrigin},...J?{desktopRecording:J}:{}}:{},root:m($.root),runId:$.runId,operationId:$.operationId,attemptId:$.attemptId,payload:$.payload,signal:$.signal,emitEvent:(K,B,G)=>$.emit(K,B,G)})}async function PQ($){if($.worker){if(!$.root.permissions.read||!$.root.permissions.write)throw new H("permission_denied","Bound Hands terminals require the workspace read/write grants.");let{workspace:J,session:Z}=m6($.payload,$.operationId);return d6({root:m($.root),runId:$.runId,deviceId:$.deviceId,rootId:$.root.id,workspace:J,session:Z,owner:$.claimOwner,authority:$.claimAuthority,signal:$.signal,emit:(Q,K)=>$.emit(Q,K)})}return $.runPtySession({root:m($.root),runId:$.runId,operationId:$.operationId,payload:$.payload,signal:$.signal,emitEvent:(J,Z)=>$.emit(J,Z)})}function Z6($,J){let Z=m0()?a1():null;return Z?i1(Z,{op:"transfer",direction:J,root:$.root,payload:$.payload,worker:Boolean($.worker)},$.signal).then((Q)=>Q.value):zQ(J,{root:$.root,payload:$.payload,signal:$.signal,worker:Boolean($.worker),fetchImpl:$.fetchImpl,beforeCommit:()=>$.emit("progress",{phase:"file_transfer_verified"})})}async function zQ($,J){let Z=m(J.root),Q=t0 in J.payload;if(Q&&!J.worker)throw new H("cloud_copy_workspace_invalid","Only a worker resolves a Cloud copy workspace.");let K=Q?F8(Z,J.payload[t0]):Z;if("source"in J.payload||"source_version"in J.payload){if($!=="export"||!Q)throw new H("cloud_copy_source_unsupported","Explicit sources require the private Cloud exporter.");let U=i4.safeParse(J.payload);if(!U.success)throw new H("invalid_payload","Invalid Cloud export request.");return N8({runtimeRoot:K,source:U.data.source,url:U.data.url,signal:J.signal,fetchImpl:J.fetchImpl})}let B=o1(J.payload,"path",4096),G=$==="import"&&Q?z2(K):K;return h0(z3(G,B)),E0({direction:$,root:G,path:B,payload:J.payload,signal:J.signal,fetchImpl:J.fetchImpl,beforeCommit:J.beforeCommit})}var p7={"inference.custom.v1":{requiredPermission:"read",additionalPermissions:["execute","discover_environment"],execute:($)=>{if(!$.customEndpointCredential||!$.claimOwner)throw new H("custom_endpoint_credential_unavailable","Local model credentials require a signed Device claim.");return v3({payload:$.payload,signal:$.signal,credential:$.customEndpointCredential,emit:(J,Z)=>$.emit(J,Z,$.signal)})}},"fs.read":{requiredPermission:"read",execute:($)=>J6("fs.read",$)},"fs.write":{requiredPermission:"write",execute:($)=>J6("fs.write",$)},"fs.export":{requiredPermission:"read",execute:($)=>Z6($,"export")},"fs.import":{requiredPermission:"write",execute:($)=>Z6($,"import")},"preview.serve.v1":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:()=>l()==="darwin"&&f2(),execute:OQ},"exec.run":{requiredPermission:"execute",available:j3,execute:wQ},"exec.full":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:()=>f2(),execute:IQ},"git.run":{requiredPermission:"execute",available:()=>j3()&&BQ("git"),execute:AQ},"process.list":{requiredPermission:"read",additionalPermissions:["discover_environment"],available:e5,execute:TQ},"ports.list":{requiredPermission:"read",additionalPermissions:["discover_environment"],available:e5,execute:_Q},"hands.connect":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],available:()=>l()==="darwin"||Boolean($7()),execute:RQ},"pty.start":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:L7,execute:PQ},"display.stream.v1":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:I7,execute:($)=>{let J=a1();return J?i1(J,{op:"display",payload:$.payload,proxy:($.relay.loadProxy??o6)()},$.signal):c1({payload:$.payload,signal:$.signal},$.relay)}},"automation.call.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:()=>O7(),execute:($)=>j7({runId:$.runId,payload:$.payload,signal:$.signal,...$.worker?.userChrome?{userChrome:$.worker.userChrome}:{}})},"simulator.call.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:U1,execute:($)=>X1({payload:$.payload,root:m($.root)})},"simulator.stream.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:r5,execute:($)=>i5({payload:$.payload,root:m($.root),signal:$.signal},$.relay)},"jobs.control":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],available:()=>!0,execute:($)=>l6({root:m($.root),runId:$.runId,payload:$.payload,signal:$.signal})},"github.local.v1":{requiredPermission:"read",additionalPermissions:["execute","discover_environment"],available:()=>l()==="darwin"?G0("/usr/bin/sandbox-exec"):l()==="linux",execute:async($)=>{let J=w1.parse($.payload),Z=A3.parse($.claim.local_github_authority);if(Z.userId!==$.claimOwner?.user_id||Z.deviceId!==$.deviceId||Z.rootId!==$.root.id||Z.runId!==$.runId||Z.repoFullName!==J.repoFullName||!Z.readOnly&&!$.root.permissions.write||!M0(J)&&(Z.readOnly||Z.generation===null&&!(J.kind==="pr_merge"&&Z.merge?.source==="human")&&!(J.kind==="pr_mutation"&&Z.contributorRefresh)))throw Error("local_device_gh_authority_changed");return s6({root:m($.root),runId:$.runId,request:J,authority:Z,signal:$.signal,leaseUntil:$.claim.lease_until},(Q)=>J4(J,Q))}},"environment.install":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:async($)=>T3({root:m($.root),runId:$.runId,payload:$.payload})},"browser.pr-proof.v1":{requiredPermission:"read",additionalPermissions:["execute"],available:()=>!1,execute:async($)=>{if(!$.proveMac)throw new H("capability_unsupported","PR proof host is not installed.");return $.proveMac()}},"tunnel.open":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:($)=>p6({root:m($.root),runId:$.runId,owner:$.claimOwner,payload:$.payload,signal:$.signal})},"tunnel.close":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:($)=>u6({root:m($.root),runId:$.runId,owner:$.claimOwner,payload:$.payload,signal:$.signal})},"workspace.setup.v1":{requiredPermission:"execute",additionalPermissions:["read","write"],available:R2,execute:($)=>G8($.payload,$.signal)}};function EQ($,J){try{let Z=u3($,J0(J)),Q=Z?$.find((K)=>K.path===Z):void 0;return Q&&/^[a-f0-9]{64}$/.test(Q.pathFingerprint)?Q.pathFingerprint:void 0}catch{return}}function qQ($,J){try{let Z=J0(J);return $.some((Q)=>Q.path===Z)?Z:void 0}catch{return}}function gQ($,J){try{let Z=J0(J),Q=$.find((K)=>K.path===Z);return Q&&/^[a-f0-9]{64}$/.test(Q.pathFingerprint)?Q.pathFingerprint:void 0}catch{return}}function SQ($,J){try{let Z=J0(J);if(!$.some((Q)=>Q.path===Z))return;return $.filter((Q)=>Q.path!==Z&&v0(Z,Q.path)&&/^[a-f0-9]{64}$/.test(Q.pathFingerprint)).map((Q)=>Q.pathFingerprint)}catch{return}}function kQ($,J){try{return M1({home:J0(J),roots:$.filter((Z)=>/^[a-f0-9]{64}$/.test(Z.pathFingerprint)&&D1(Z.path)).slice(0,J2).map((Z)=>({path_fingerprint:Z.pathFingerprint,path:Z.path}))})}catch{return}}function oG($,J={}){let Z=J.worker?J.worker.handsSlots??1:J.handsSlots===1?1:void 0,Q=Boolean(J.worker)||l()==="darwin",K=Q?gQ($,Y1()):void 0,B=!J.worker&&l()==="darwin"?EQ($,Y1()):void 0,G=Q?qQ($,Y1()):void 0,U=!J.worker&&l()==="darwin"?SQ($,Y1()):void 0,W=Q?kQ($,Y1()):void 0,Y=S2.filter((X)=>{if(Z1.has(X)&&!J.worker)return!1;if(J.worker&&!f1(X,J.worker))return!1;let N=p7[X];if(!N)return!1;return(X==="hands.connect"&&(J.terminalOnlyHands===!0||Boolean(J.worker))||(X==="pty.start"||X==="preview.serve.v1")&&Boolean(J.worker)||X==="browser.pr-proof.v1"&&Boolean(J.productionProof)?!0:N.available?.()??!0)&&$.some((F)=>(!J.worker||X!=="pty.start"||F.permissions.read&&F.permissions.write)&&k7(N).every((D)=>F.permissions[D]))});return{supported_operations:Y,...K?{account_root_fingerprint:K}:{},...B?{workspace_root_fingerprint:B}:{},...G?{account_root_path:G}:{},...U?{home_contained_root_fingerprints:U}:{},...W?{root_paths:W}:{},...Y.includes("hands.connect")?{hands_worker_artifact_sha256:P0,hands_worker_entrypoint:a0,...Z?{hands_slots:Z}:{}}:{},max_payload_bytes:N0,max_result_bytes:N0,operation_constraints:{...Y.includes("browser.pr-proof.v1")&&J.productionProof?{"browser.pr-proof.v1":V2.parse(J.productionProof)}:{},"exec.run":{transport:"shell",shell:f7(),sandbox:l()==="linux"?"linux_sandbox_runtime":"macos_seatbelt",network:!1,max_timeout_ms:R3},...Y.includes("exec.full")?{"exec.full":v8()}:{},"git.run":{read_only_subcommands:[...S7].sort(),mutating_subcommands:[...O3].sort(),push:!1,credential_helpers:!1},"fs.export":{transport:"https_signed_url",max_bytes:W0,max_timeout_ms:o0,result:"sha256_and_size"},"fs.import":{transport:"https_signed_url",max_bytes:W0,max_timeout_ms:o0,atomic:!0,overwrite:!1},"hands.connect":{transport:"wss_relay",worker:"ara_hands",worker_version:r0,protocol_version:L3,worker_artifact_sha256:P0,worker_entrypoint:a0,policy_mode:"full_access",policy_version:1,workspace_base:M3,workspace_layout:J1,...Z?{slots:Z}:{},browser_state:J.worker?"optional_headless":J.terminalOnlyHands===!0?"disabled_terminal_only":l()==="darwin"?"optional_isolated_per_session":"isolated_per_session",max_session_ms:43200000},...Y.includes("pty.start")?{"pty.start":{transport:"wss_relay",shell:"login_shell",resize:!0,slots:M7,max_session_ms:H7,max_buffered_output_bytes:D7}}:{},...J.worker?Object.fromEntries(Y.filter((X)=>X!=="browser.pr-proof.v1").map((X)=>[X,{ready:J.worker?.readiness?.[X]===!0,...J.worker?.readiness?.[X]!==!0&&J.worker?.probing?.includes(X)?{probing:!0}:{},execution_mode:f1(X,{...J.worker,executionMode:"sandboxed"})?"confined":"host",...X==="pty.start"?{transport:"wss_relay",worker:"ara_hands",shell:"bound_job",protocol_version:x6,environment:"private_snapshot",receipt:"metadata_only",...J.worker?.persistentTerminals&&!m0()?{persistent_terminals:!0}:{}}:{},...X==="github.local.v1"?{contributor_attribution:1,...J.worker?.githubSignedIn!==void 0?{gh_authenticated:J.worker.githubSignedIn}:{}}:{},...X==="hands.connect"?{transport:"wss_relay",worker:"ara_hands",slots:Z,session_group:T6,workspace_base:M3,workspace_layout:J1,browser_state:"optional_headless",desktop:!1,worker_version:r0,protocol_version:L3,...J.worker?.readiness?.["environment.install"]===!0&&Y.includes("environment.install")?{environment_delivery:B6,[U6]:G6}:{},...J.worker?{[W6]:X6}:{},...J.worker?.handsBrowser?{[H6]:C6}:{},[N6]:F6,[M6]:D6,...y0(J.worker?.executionMode==="unsandboxed")?{[w6]:L6}:{},...y0(J.worker?.executionMode==="unsandboxed")&&r1()!==null?{[j6]:O6}:{},...y0(J.worker?.executionMode==="unsandboxed")&&m0()?{[A6]:I6}:{}}:{},...X==="fs.export"?{cloud_source_version:P1,source_kinds:["workspace","attachment"],[w2]:O2}:{},...X==="fs.import"?{[w2]:O2}:{},...X===V4&&r1()!==null&&y0(J.worker?.executionMode==="unsandboxed")?{[W4]:X2}:{},...X==="tunnel.open"?{carried_jobs:_6}:{},...X==="jobs.control"?{[P6]:R6}:{},...X==="display.stream.v1"&&J.worker?.displayVideo?{[U7]:G7,[W7]:X7.join(","),[Y7]:F7,[N7]:C7}:{},...X==="automation.call.v1"&&J.worker?.userChrome?{[z6]:!0}:{},...X==="automation.call.v1"&&J.worker?.cloudSessions?{[E6]:!0}:{}}])):{}}}}function q3($,J,Z,Q,K){let B=n6.safeParse(Q);return B.success&&K!==void 0&&K.device_id===$.deviceId&&B.data.device_id===$.deviceId&&B.data.root_id===J&&B.data.run_id===Z&&B.data.binding.kind===K.binding&&B.data.binding.target_revision===K.target_revision&&B.data.binding.root_grant_revision===K.root_grant_revision&&B.data.binding.target_generation===K.target_generation&&B.data.binding.target_fence_id===K.target_fence_id}async function tG($,J,Z,Q,K){if(J.capability!=="hands.connect"||Z.kind!==V6||!Q.operationEnvironment||!Q.acknowledgeOperationEnvironment)return!1;let B=Z.payload.snapshot_id;if(Z.payload.version!==1||typeof B!=="string"||Object.keys(Z.payload).length!==2)throw new H("environment_unavailable","Reason sent an invalid environment delivery.");let G=$.roots.find((Y)=>Y.id===J.root_id);if(!G)throw new H("root_not_granted","The Hands root is no longer granted.");let U=await Q.operationEnvironment($,J,B,K);if(!q3($,G.id,J.run_id,U.payload,U.authority)||U.payload.snapshot_id!==B)throw new H("environment_unavailable","The delivered environment does not match this Hands.");let W=T3({root:m(G),operationId:J.operation_id,payload:U.payload});return await Q.acknowledgeOperationEnvironment($,J,{snapshot_id:W.snapshot_id,installed_revision:W.installed_revision,installed:!0},K),!0}async function eG($,J,Z,Q){if(J.capability!=="hands.connect"||Z.kind!==Y6)return!1;let{version:K,run_id:B,target_generation:G,target_fence_id:U}=Z.payload;if(K!==1||Object.keys(Z.payload).length!==4||typeof B!=="string"||typeof G!=="number"||typeof U!=="string")throw new H("hands_rebind_unavailable","Reason sent an invalid Hands rebind.");let W=$.roots.find((Y)=>Y.id===J.root_id);if(!W)throw new H("root_not_granted","The Hands root is no longer granted.");return await v6({operationId:J.operation_id,root:m(W),runId:B,targetGeneration:G,fenceId:U,...Q?{signal:Q}:{}}),!0}async function $U($,J,Z){if(J.capability!=="github.local.v1")return Q6($,J,Z);try{let Q=await Q6($,J,Z);if(Q.status==="succeeded")return Q;return{status:Q.status,error_code:Q.status==="cancelled"?"operation_cancelled":"local_github_unavailable"}}catch{return{status:Z.signal.aborted?"cancelled":"failed",error_code:Z.signal.aborted?"operation_cancelled":"local_github_unavailable"}}}async function Q6($,J,Z){if(Z1.has(J.capability)&&!Z.worker)return{status:"failed",error_code:"capability_not_granted"};if(Z.worker&&!f1(J.capability,Z.worker))return{status:"failed",error_code:"capability_not_granted"};if(Z.worker&&Z.worker.readiness?.[J.capability]!==!0)return{status:"failed",error_code:"capability_unavailable"};if(J.local_github_authority){let X=A3.safeParse(J.local_github_authority);if(!X.success||X.data.deviceId!==$.deviceId||X.data.rootId!==J.root_id||X.data.runId!==J.run_id||X.data.userId!==J.owner?.user_id||!["github.local.v1","hands.connect","environment.install","jobs.control","preview.serve.v1"].includes(J.capability))return{status:"failed",error_code:"local_device_gh_capability_denied"}}let Q=p7[J.capability];if(!Q)return{status:"failed",error_code:"capability_unsupported"};if(Q.available&&!Q.available()&&!(["hands.connect","pty.start","preview.serve.v1"].includes(J.capability)&&Z.worker)&&!Z.runCommand&&!Z.runHandsRelay&&!Z.spawnFullControl&&!Z.runPtySession&&!(J.capability==="browser.pr-proof.v1"&&Z.proveMac))return{status:"failed",error_code:"capability_unavailable"};if(J.protocol_version!==2)return{status:"failed",error_code:"protocol_unsupported"};let K=$.roots.find((X)=>X.id===J.root_id);if(!K)return{status:"failed",error_code:"root_not_granted"};if((J.capability==="fs.export"||J.capability==="fs.import")&&I3(J.payload)&&(("source"in J.payload)||("source_version"in J.payload))){let X=Boolean(Z.worker||$.worker)&&t0 in J.payload;if(J.capability!=="fs.export"||!X)return{status:"failed",error_code:"cloud_copy_source_unsupported"}}if(J.owner&&(J.owner.device_id!==$.deviceId||J.owner.organization_id!==$.orgId))return{status:"failed",error_code:"capability_not_granted"};if((J.capability==="tunnel.open"||J.capability==="tunnel.close")&&!J.owner)return{status:"failed",error_code:"preview_unavailable"};if(J.capability==="environment.install"&&!q3($,K.id,J.run_id,J.payload,J.authority))return{status:"failed",error_code:"environment_unavailable"};if(k7(Q).some((X)=>!K.permissions[X]))return{status:"failed",error_code:"permission_denied"};let B=0,G=async(X,N,C)=>{if(["environment.install","github.local.v1"].includes(J.capability)||J.capability==="inference.custom.v1"&&(X==="started"||X==="completed"))return;await Z.emit?.({sequence:B++,kind:X,capability:J.capability,data:N,...(X==="hands.reconnected"||J.capability==="inference.custom.v1")&&C?{deliverySignal:C}:{}})},U=J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||QQ.has(J.capability)||J.capability==="pty.start",W,Y=async(X,N,C)=>{let F=W;W=void 0,await Promise.all([F,G(X,N,C)])};try{if(U)W=G("started"),W.catch(()=>{return});else await G("started");let X={...Z.proxy===void 0?{}:{loadProxy:()=>Z.proxy??null},...Z.handsLaunch?.takePrespawnedWorker?{takePrespawnedWorker:Z.handsLaunch.takePrespawnedWorker}:{},...Z.handsLaunch?.adoptSpawnedWorker?{adoptSpawnedWorker:Z.handsLaunch.adoptSpawnedWorker}:{}},N=await Q.execute({...Z.proveMac?{proveMac:()=>Z.proveMac(J,Z.signal,(C)=>G("pr-proof.started.v1",C))}:{},claim:J,worker:Z.worker,claimOwner:J.owner,claimAuthority:J.authority,organizationId:$.orgId,deviceId:$.deviceId,apiOrigin:$.apiOrigin,root:K,payload:VQ(J.payload),runId:J.run_id,operationId:J.operation_id,attemptId:J.attempt_id,...Z.handsLaunch?{claimedAtMs:Z.handsLaunch.claimedAtMs}:{},signal:Z.signal,...Z.customEndpointCredential?{customEndpointCredential:Z.customEndpointCredential}:{},fetchImpl:Z.fetchImpl??fetch,relay:X,runCommand:Z.runCommand??FQ,spawnFullControl:Z.spawnFullControl??E3,emit:U?Y:G,runHandsRelay:Z.runHandsRelay??((C)=>Z7(C,X)),runPtySession:Z.runPtySession??w7});if(J.capability==="github.local.v1")K6.parse(N);if(!I3(N))throw new H("invalid_result","Operation result must be a JSON object.");if(Buffer.byteLength(JSON.stringify(N)??"null","utf8")>N0)throw new H("result_too_large","Operation result exceeds 256 KB.");return await(U?Y:G)("completed",{ok:!0}),{status:"succeeded",result:N,error_code:null}}catch(X){let N=Z.signal.reason instanceof H&&o5.has(Z.signal.reason.code)?Z.signal.reason.code:X instanceof H&&o5.has(X.code)?X.code:null;if(Z.signal.aborted||N)return{status:"cancelled",...X instanceof n0?{result:{process_terminal_observation:X.observation}}:{},error_code:["environment.install","github.local.v1","inference.custom.v1"].includes(J.capability)?"operation_cancelled":N??"cancelled"};let C=J.capability==="inference.custom.v1"?"custom_endpoint_unavailable":J.capability==="github.local.v1"?"local_github_unavailable":J.capability==="environment.install"?"environment_install_failed":X instanceof H&&ZQ.test(X.code)?X.code:"capability_failed",F=J.capability==="hands.connect"&&X instanceof J7?c6(X.expiryDiagnostic):null;return await G("completed",{ok:!1,error_code:C,...F?{expiry_diagnostic:F}:{}}),{status:"failed",error_code:C}}}
|
|
529
|
+
export{V9 as y,G9 as z,K4 as A,GK as B,YK as C,kK as D,fK as E,R2 as F,qB as G,Y0 as H,A$ as I,T$ as J,gB as K,S$ as L,q0 as M,K1 as N,OJ as O,QQ as P,f7 as Q,x7 as R,WQ as S,E3 as T,FQ as U,HQ as V,jQ as W,zQ as X,p7 as Y,EQ as Z,qQ as _,gQ as $,SQ as aa,kQ as ba,oG as ca,tG as da,eG as ea,$U as fa};
|