@reason-machines/cli-linux-arm64-musl 0.2.315 → 0.2.317

package/bin/vm-hands/{vm-hands-entry-lite-pf1ft65e.js → vm-hands-entry-lite-wh0qp1gf.js}

@@ -1,5 +1,5 @@
 // @bun
-import{_g as c}from"./vm-hands-entry-lite-em388nee.js";var g={REASON_API_KEY:"ARA_API_KEY",REASON_API_URL:"ARA_API_URL",REASON_CLI_CHANNEL:"ARA_CLI_CHANNEL",REASON_CLI_LAUNCHER_PATH:"ARA_CLI_LAUNCHER_PATH",REASON_MANAGED_RUNTIME_ROOT:"ARA_MANAGED_RUNTIME_ROOT",REASON_INSTALL_ALIAS_PATH:"ARA_INSTALL_ALIAS_PATH",REASON_INSTALL_DIR:"ARA_INSTALL_DIR",REASON_INSTALL_METHOD:"ARA_INSTALL_METHOD",REASON_INSTALL_PINNED_VERSION:"ARA_INSTALL_PINNED_VERSION",REASON_INSTALL_UPGRADE:"ARA_INSTALL_UPGRADE"},g0=Object.values(g),jZ=new Set;function MQ(Q,Z){let $=Q[Z];if($?.trim())return $;let X=Q[g[Z]];if(X?.trim())jZ.add(g[Z]);return X}function KZ(Q,Z){return{[Q]:Z,[g[Q]]:Z}}import{basename as BZ}from"path";var i=["production","staging"],OZ="https://api.reasonmachines.com",kZ="https://staging-api.reasonmachines.com";var l={production:{api:"https://api.reasonmachines.ai",app:"https://reasonmachines.ai"},staging:{api:"https://staging-api.reasonmachines.ai",app:"https://staging.reasonmachines.ai"}},AZ=new Set(["ara-staging","reason-staging"]);function KQ(Q={}){let Z=MQ(Q.env??process.env,"REASON_CLI_CHANNEL")?.trim().toLowerCase();if(Z){if(i.includes(Z))return Z;throw Error(`Unknown Reason CLI channel: ${Z}`)}let $=BZ(Q.executablePath??process.execPath).toLowerCase();return AZ.has($)?"staging":"production"}function h(Q){return Q==="staging"?kZ:OZ}function y0(Q){return`${h(Q)}/mcp/ara`}var BQ={production:["https://api.ara.so",l.production.api],staging:["https://api-staging.ara.so",l.staging.api]};function jQ(Q){let Z;try{Z=new URL(Q).origin}catch{return Q}let $=i.find((X)=>BQ[X].includes(Z));return $?h($):Z}function p0(Q,Z){return Q===Z||jQ(Q)===jQ(Z)}function OQ(Q,Z){return i.some(($)=>BQ[$].includes(Q)&&Z===h($))}function u0(Q,Z){try{let $=new URL(Z);return!$.username&&!$.password&&($.origin===h(Q)||$.origin===l[Q].api)}catch{return!1}}function d0(Q){try{let Z=new URL(Q).hostname.replace(/^\[|\]$/g,"").toLowerCase();return Z==="localhost"||Z==="127.0.0.1"||Z==="::1"}catch{return!1}}import{randomBytes as xQ}from"crypto";import{chmodSync as LQ,closeSync as FQ,constants as _Z,linkSync as bQ,lstatSync as x,mkdirSync as fQ,openSync as NZ,readdirSync as P,readFileSync as TQ,readlinkSync as D,renameSync as N,rmdirSync as CQ,symlinkSync as _,unlinkSync as B}from"fs";import{createRequire as xZ}from"module";import{constants as LZ}from"os";import{basename as f,join as U,sep as bZ}from"path";import{existsSync as m,lstatSync as AQ,readdirSync as PZ,readFileSync as FZ,readlinkSync as TZ,realpathSync as DZ}from"fs";import{join as K,sep as RZ}from"path";function o(Q,...Z){let $=K(Q,"ara"),X=K(Q,"reason");if(!v($))return K(X,...Z);if(!m(X))return K($,...Z);return m(K($,...Z))&&!m(K(X,...Z))?K($,...Z):K(X,...Z)}function v(Q){try{let Z=AQ(Q);if(!Z.isSymbolicLink())return Z.isDirectory();return TZ(Q)!=="reason"&&m(Q)}catch{return!1}}function PQ(Q,Z=[]){if(!v(Q))return!1;let $;try{$=[Q,...PZ(Q,{withFileTypes:!0}).filter((X)=>X.isDirectory()).map((X)=>K(Q,X.name))]}catch{return!1}return $.some((X)=>["connect","connect-once"].filter((z)=>!Z.includes(K(X,z))).some((z)=>{let W=K(X,z,"worker.json");try{AQ(W)}catch{return!1}try{let q=JSON.parse(FZ(W,"utf8"))?.stateDirectory;if(typeof q!=="string")return!0;let V=(J,w)=>J===w||J.startsWith(w+RZ);return V(q,Q)||V(kQ(q),kQ(Q))}catch{return!0}}))}function kQ(Q){try{return DZ(Q)}catch{return Q}}var u=new Set(["credentials.json","local-device.json","local-device.revoked.json","local-device.auth-migration.json","local-device.json.registration-pending.json","local-daemon.json","local-daemon.json.workspaces.json","local-root-fingerprint-key.json","instances","workspaces"]),n=new Set(["local-device.proxy.json"]),fZ=new Set(["local-device.key","local-device.binding"]),DQ=new Map;function r(Q,Z,$){let X=U(Q,"ara");if(/[/\\]\.reason-ssh[/\\][^/\\]+[/\\]installer-home[/\\]\.config$/.test(Q))return{state:G(X)?.isDirectory()?"kept":"absent"};return EQ(X,U(Q,"reason"),{linkAlways:!0,kept:(z)=>PQ(z,$??[]),native:Z===void 0?pQ:()=>Z},$!==void 0)}function SQ(Q,...Z){return r(Q),o(Q,...Z)}function z1(Q,Z=process.platform){let $=U(Q,"Library","Logs");if(Z==="darwin")for(let X of[""," Staging"," Development"])EQ(U($,`Ara${X}`),U($,`Reason${X}`),{linkAlways:!1,kept:()=>!1,native:pQ});return U($,"Reason")}var IQ="config_rename_unavailable:busy";function EQ(Q,Z,$,X=!1){let z=X?void 0:DQ.get(Q);if(z)return z;let W;try{W=CZ(Q,Z,$)}catch(q){let V=`config_rename_unavailable:${A(q)??"failed"}`;try{return{state:G(Q)?.isDirectory()?"kept":"absent",problem:V}}catch{return{state:"kept",problem:V}}}if(!(W.state==="absent"&&$.linkAlways)&&W.problem!==IQ&&!(W.state==="kept"&&!W.problem))DQ.set(Q,W);return W}function CZ(Q,Z,$){IZ(Z,$.native);let X=!1;for(let z=0;z<8;z+=1){let W=G(Q);if(W?.isSymbolicLink())return D(Q)===f(Z)?{state:X?"renamed":"linked"}:{state:"kept"};if(!W){if(p(Z))M(()=>B(Z),"ENOENT");if(!(X||$.linkAlways)||!R(Z))return{state:"absent"};let J=b(Z,"link");_(f(Z),J);try{M(()=>N(J,Q),"EISDIR","ENOTEMPTY","EEXIST","ENOTDIR")}finally{M(()=>B(J),"ENOENT")}continue}if(!W.isDirectory())return{state:"absent"};if($.kept(Q))return RQ(Z),{state:"kept"};let q=$.native();if(!q)return RQ(Z),{state:"kept",problem:"config_rename_unavailable:no_native"};let V=EZ(q,Q);if(!V)return{state:"kept",problem:IQ};try{if(x(Q).isSymbolicLink())continue;let J=SZ(q,Q,Z);if(J)return{state:"kept",problem:J};X=!0}finally{V()}}throw Object.assign(Error("legacy directory rename did not settle"),{code:"unsettled"})}function SZ(Q,Z,$){let X=G($);if(!X||p($)){if(!X)_(f($),$);try{Q.exchange(Z,$)}catch(J){if(p($))M(()=>B($),"ENOENT");return`config_rename_unavailable:${A(J)??"exchange_failed"}`}return null}if(!X.isDirectory())return"config_rename_unavailable:ENOTDIR";if(X.dev!==x(Z).dev)return"config_rename_unavailable:EXDEV";let z=[b($,"probe"),b($,"probe")];try{_("a",z[0]),_("b",z[1]),Q.exchange(z[0],z[1])}catch(J){return`config_rename_unavailable:${A(J)??"exchange_failed"}`}finally{for(let J of z)M(()=>B(J),"ENOENT")}let W=yQ($);for(let J of fZ){let w=G(U($,J)),j=G(U(Z,J));if(w&&j&&w.ino!==j.ino)fQ(`${W}-replaced`,{mode:448,recursive:!0}),N(U($,J),U(`${W}-replaced`,J))}let q={linked:new Map,unitsKept:new Set};gQ(Z,$,"",q);let V=b($,"rename");_(f($),V);try{Q.exchange(Z,V)}catch(J){return M(()=>B(V),"ENOENT"),`config_rename_unavailable:${A(J)??"exchange_failed"}`}return hQ(V,$,q,W),null}function t(Q){return Q===""||!Q.includes(bZ)}function gQ(Q,Z,$,X){let z=t($)&&y(U(Z,$),U(Q,$));if(z)X.unitsKept.add($);for(let W of P(U(Q,$))){if(z&&(u.has(W)||n.has(W)))continue;let q=U($,W),V=U(Q,q),J=U(Z,q),w=G(V);if(!w)continue;let j=G(J);if(w.isDirectory()){if(!j)M(()=>fQ(J,{mode:w.mode&4095}),"EEXIST"),LQ(J,w.mode&4095);if(R(J))gQ(Q,Z,q,X)}else if(!j){if(w.isSymbolicLink())M(()=>_(D(V),J),"EEXIST");else if(M(()=>bQ(V,J),"EEXIST","ENOENT"))X.linked.set(q,w.ino)}}}function IZ(Q,Z){let $;try{if(!R(Q))return;$=P(Q)}catch{return}for(let X of $){let z=/^\.(rename|link|probe|claim)-(\d+)-[0-9a-f]+$/.exec(X);if(!z)continue;let W=U(Q,X),q=G(W);if(!q)continue;if(!q.isDirectory()){if(!_Q(Number(z[2])))M(()=>B(W),"ENOENT");continue}let V=Z(),J=null;if(V){try{J=V.lock(W)}catch{continue}if(!J)continue}else if(_Q(Number(z[2])))continue;try{let w=b(Q,"claim");if(M(()=>N(W,w),"ENOENT"))hQ(w,Q,null,yQ(Q))}finally{J?.()}}}function hQ(Q,Z,$,X){for(let[z,W]of $?.linked??[])if(!G(U(Q,z))&&G(U(Z,z))?.ino===W)M(()=>B(U(Z,z)),"ENOENT");if(mQ(Q,Z,"",$),M(()=>CQ(Q),"ENOTEMPTY","EEXIST"))return;N(Q,X),LQ(X,448)}function mQ(Q,Z,$,X){let z=t($)&&(X?X.unitsKept.has($):y(U(Z,$),U(Q,$)));for(let W of P(U(Q,$))){let q=U($,W),V=U(Q,q),J=U(Z,q),w=x(V),j=G(J);if(j&&w.ino===j.ino&&w.dev===j.dev){B(V);continue}if(w.isFile()&&j?.isFile()&&X?.linked.get(q)===j.ino){N(V,J);continue}if(z&&(u.has(W)||n.has(W)))continue;if(!j){if(w.isFile()){if(M(()=>bQ(V,J),"EEXIST"))B(V)}else M(()=>N(V,J),"EEXIST","ENOTEMPTY");continue}if(w.isDirectory()&&j.isDirectory())mQ(Q,Z,q,X),M(()=>CQ(V),"ENOTEMPTY","EEXIST")}}function W1(Q){let Z=U(Q,"ara"),$=U(Q,"reason");if(!R(Z)||!R($))return null;let X=["",...P(Z,{withFileTypes:!0}).filter((z)=>z.isDirectory()&&!z.name.startsWith(".")).map((z)=>z.name)];for(let z of X){let W=U(Z,z),q=U($,z);if(!y(W,q)||!y(q,W))continue;if([...u,...n].some((J)=>a(U(W,J),U(q,J))===!1))return z}return null}function q1(Q){let Z=U(Q,"ara"),$=U(Q,"reason");if(!R(Z)||!R($))return null;let X=(z)=>{for(let W of P(U(Z,z))){let q=U(z,W);if(t(z)&&(W==="connect"||W==="connect-once"))continue;let V=x(U(Z,q)),J=G(U($,q));if(!J||V.ino===J.ino&&V.dev===J.dev)continue;if(V.isDirectory()&&J.isDirectory()&&!J.isSymbolicLink()){let w=X(q);if(w!==null)return w}else if(V.isSymbolicLink()||J.isSymbolicLink()){if(!(V.isSymbolicLink()&&J.isSymbolicLink()&&D(U(Z,q))===D(U($,q))))return q}else if(a(U(Z,q),U($,q))!==!0)return q}return null};return X("")}function a(Q,Z){let $=G(Q),X=G(Z);if(!$&&!X)return null;if(!$||!X||$.isDirectory()!==X.isDirectory())return!1;if($.ino===X.ino&&$.dev===X.dev)return!0;if($.isDirectory())return[...new Set([...P(Q),...P(Z)])].every((W)=>a(U(Q,W),U(Z,W))===!0);try{return TQ(Q).equals(TQ(Z))}catch{return!1}}function y(Q,Z){for(let $ of u)if(vQ(U(Q,$),U(Z,$)))return!0;return!1}function vQ(Q,Z){let $=G(Q);if(!$)return!1;let X=G(Z);if(!X)return!0;if($.isDirectory()){if(!X.isDirectory())return!0;return P(Q).some((z)=>vQ(U(Q,z),U(Z,z)))}if($.isSymbolicLink())return!X.isSymbolicLink()||D(Q)!==D(Z);return $.ino!==X.ino||$.dev!==X.dev}function RQ(Q){if(p(Q))M(()=>B(Q),"ENOENT")}function yQ(Q){return U(Q,`.pre-rename-${new Date().toISOString().replace(/[:.]/g,"-")}-${xQ(3).toString("hex")}`)}function p(Q){try{return x(Q).isSymbolicLink()&&D(Q)===f(Q)}catch{return!1}}function R(Q){let Z=G(Q);return Z!==null&&Z.isDirectory()}function EZ(Q,Z){for(let $=0;$<40;$+=1){let X=Q.lock(Z);if(X)return X;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}return null}function b(Q,Z){return U(Q,`.${Z}-${process.pid}-${xQ(6).toString("hex")}`)}function _Q(Q){if(Q===process.pid)return!1;try{return process.kill(Q,0),!0}catch(Z){return A(Z)==="EPERM"}}function G(Q){try{return x(Q)}catch(Z){if(A(Z)==="ENOENT"||A(Z)==="ENOTDIR")return null;throw Z}}function M(Q,...Z){try{return Q(),!0}catch($){if(Z.includes(A($)??""))return!1;throw $}}function A(Q){return Q instanceof Error&&"code"in Q&&typeof Q.code==="string"?Q.code:void 0}var L,gZ=2,hZ=4,mZ=2,vZ=2,NQ=-100;function pQ(){if(L!==void 0)return L;if(L=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let Q;try{Q=xZ(import.meta.url)("bun:ffi")}catch{return null}let Z=process.platform==="darwin",$=Z?"__error":"__errno_location",X=Z?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`],{FFIType:z}=Q;for(let W of X)try{let q=Z?"renamex_np":"renameat2",J=Q.dlopen(W,{flock:{args:[z.i32,z.i32],returns:z.i32},[$]:{args:[],returns:z.ptr},[q]:Z?{args:[z.ptr,z.ptr,z.u32],returns:z.i32}:{args:[z.i32,z.ptr,z.i32,z.ptr,z.u32],returns:z.i32}}).symbols,w=J[$]();if(w===null)continue;let j=(T)=>{let k=Q.read.i32(w),O=Object.entries(LZ.errno).find(([,E])=>E===k)?.[0]??`errno_${k}`;return Object.assign(Error(`${T} failed: ${O}`),{code:O})},HQ=(T)=>Buffer.from(`${T}\x00`,"utf8");return L={exchange(T,k){let O=HQ(T),E=HQ(k);if((Z?J[q](Q.ptr(O),Q.ptr(E),mZ):J[q](NQ,Q.ptr(O),NQ,Q.ptr(E),vZ))!==0)throw j("exchange")},lock(T){let k=NZ(T,_Z.O_RDONLY);if(J.flock(k,gZ|hZ)===0)return()=>FQ(k);let O=j("lock");if(FQ(k),O.code==="EWOULDBLOCK"||O.code==="EAGAIN")return null;throw O}},L}catch{}return null}import{createHmac as V0,createPublicKey as w0,randomBytes as G0,randomUUID as zZ,verify as H0}from"crypto";import{chmodSync as qQ,existsSync as WZ,mkdirSync as M0,readFileSync as j0,realpathSync as K0,renameSync as B0,statSync as O0,unlinkSync as k0,writeFileSync as A0}from"fs";import{basename as P0,dirname as YQ,isAbsolute as qZ,join as s,resolve as F0}from"path";var Y1=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var yZ="REASON_DESKTOP_RUNTIME",pZ="REASON_DESKTOP_RUNTIME_CHANNEL",uZ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",dZ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",M1={[yZ]:"ARA_DESKTOP_RUNTIME",[pZ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[uZ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[dZ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function uQ(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as QQ,existsSync as F,mkdirSync as ZQ,readFileSync as lQ,realpathSync as lZ,renameSync as iZ,unlinkSync as $Q,writeFileSync as XQ}from"fs";import{createPrivateKey as oZ,createPublicKey as nZ,generateKeyPairSync as rZ,randomUUID as tZ,sign as aZ}from"crypto";import{createRequire as eZ}from"module";import{homedir as Q0,platform as rQ}from"os";import{dirname as Z0,join as C}from"path";import{existsSync as sZ}from"fs";import{join as cQ}from"path";var e="libara_device_keychain.dylib",dQ="libreason_device_keychain.dylib";class cZ extends Error{code;constructor(Q,Z){super(Z);this.code=Q;this.name="ManagedRuntimeError"}}function sQ(Q){let Z=cQ(Q,dQ);return sZ(Z)?Z:cQ(Q,e)}var iQ=1,$0=16384,S=65536,X0=128,z0=128,tQ=65536;class Y extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function aQ(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var zQ=null;function eQ(){if(!zQ)try{zQ=eZ(import.meta.url)("bun:ffi")}catch{throw new Y("native_boundary_unavailable")}return zQ}function W0(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function q0(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new Y("invalid_credential_record");let Z=Q,$=W0(Z.apiOrigin);if(Z.version!==iQ||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new Y("invalid_credential_record");return{version:iQ,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function J0(Q=process.execPath){let Z=Q;try{Z=lZ(Q)}catch{}return sQ(Z0(Z))}function H(Q){return eQ().ptr(Q)}function Y0(Q){if(!F(Q))throw new Y("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=eQ();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(X){if(X instanceof Y)throw X;throw new Y("native_boundary_unavailable")}}function oQ(Q){return Buffer.from(Q).toString("base64url")}function I(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function QZ(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class ZZ{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=J0(),Z=rQ(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;uQ($)}symbols(){if(this.runtimePlatform!=="darwin")throw new Y("unsupported_platform");this.library??=Y0(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(H(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new Y("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(X0),$=new BigUint64Array(1),X=Q==="load"?this.symbols().ara_device_key_load_public(H(Z),BigInt(Z.byteLength),H($)):this.symbols().ara_device_key_create_fresh_public(H(Z),BigInt(Z.byteLength),H($));if(X!==0)throw new Y(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",X);let z=Number($[0]);if(!Number.isSafeInteger(z)||z!==65)throw new Y("invalid_public_key");let W=oQ(Z.subarray(0,z));if(!I(W))throw new Y("invalid_public_key");return W}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>tQ)throw new Y("proof_sign_failed");let Z=new Uint8Array(z0),$=new BigUint64Array(1),X=this.symbols().ara_device_key_sign(H(Q),BigInt(Q.byteLength),H(Z),BigInt(Z.byteLength),H($));if(X!==0)throw new Y("proof_sign_failed",X);let z=Number($[0]);if(!Number.isSafeInteger(z)||z<1||z>Z.byteLength)throw new Y("invalid_signature");let W=Z.subarray(0,z);if(!QZ(W))throw new Y("invalid_signature");return oQ(W)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(H(Q));if(Z!==0||Q[0]!==1)throw new Y("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(H(Q));if(Z!==0)throw new Y("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(S),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(H(Q),BigInt(Q.byteLength),H(Z));if($===1)return null;if($!==0)throw new Y("binding_read_failed",$);let X=Number(Z[0]);if(!Number.isSafeInteger(X)||X<1||X>Q.byteLength)throw new Y("invalid_binding");return Q.slice(0,X)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");let Z=this.symbols().ara_device_binding_create(H(Q),BigInt(Q.byteLength));if(Z!==0)throw new Y("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");let Z=this.symbols().ara_device_binding_update(H(Q),BigInt(Q.byteLength));if(Z!==0)throw new Y("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(H(Q));if(Z!==0)throw new Y("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array($0),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(H(Q),BigInt(Q.byteLength),H(Z));if($===1)return null;if($!==0)throw new Y("legacy_credential_read_failed",$);let X=Number(Z[0]);if(!Number.isSafeInteger(X)||X<1||X>Q.byteLength)throw new Y("invalid_credential_record");try{let z=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,X));return q0(JSON.parse(z))}catch(z){if(z instanceof Y)throw z;throw new Y("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(H(Q));if(Z!==0)throw new Y("legacy_credential_delete_failed",Z);return Q[0]===1}}function nQ(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new Y("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),X=Buffer.from(Z.y,"base64url");if($.byteLength!==32||X.byteLength!==32)throw new Y("invalid_public_key");let z=Buffer.concat([Buffer.of(4),$,X]).toString("base64url");if(!I(z))throw new Y("invalid_public_key");return z}function U0(){let Q=process.env.XDG_CONFIG_HOME?.trim()||C(Q0(),".config");r(Q);let Z=C(Q,"ara");return v(Z)?Z:C(Q,"reason")}class $Z{directory;constructor(Q=U0()){this.directory=Q}keyPath(){return C(this.directory,"local-device.key")}bindingPath(){return C(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!F(Q))throw new Y("proof_key_read_failed");try{let Z=lQ(Q,"utf8");return oZ({key:Z,format:"pem"})}catch{throw new Y("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=nZ(Q);return nQ(Z)}createFreshPublicKey(){ZQ(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=rZ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),X=this.keyPath();return XQ(X,$,{mode:384}),QQ(X,384),nQ(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>tQ)throw new Y("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=aZ("sha256",Q,Z)}catch{throw new Y("proof_sign_failed")}if(!QZ($))throw new Y("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!F(Q))return!1;return $Q(Q),!0}loadBinding(){let Q=this.bindingPath();if(!F(Q))return null;try{return new Uint8Array(lQ(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");ZQ(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(F(Z))throw new Y("binding_create_failed");XQ(Z,Q,{mode:384}),QQ(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");ZQ(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!F(Z))throw new Y("binding_update_failed");let $=`${Z}.${tZ()}`;try{XQ($,Q,{mode:384,flag:"wx"}),QQ($,384),iZ($,Z)}finally{if(F($))$Q($)}}deleteBinding(){let Q=this.bindingPath();if(!F(Q))return!1;return $Q(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function WQ(){return rQ()==="darwin"?new ZZ:new $Z}var UQ=4;var d="macos-keychain-p256-v1",JZ=1,T0=`ARA-DEVICE-BINDING-V1
+import{ch as c}from"./vm-hands-entry-lite-cp1wqjs5.js";var g={REASON_API_KEY:"ARA_API_KEY",REASON_API_URL:"ARA_API_URL",REASON_CLI_CHANNEL:"ARA_CLI_CHANNEL",REASON_CLI_LAUNCHER_PATH:"ARA_CLI_LAUNCHER_PATH",REASON_MANAGED_RUNTIME_ROOT:"ARA_MANAGED_RUNTIME_ROOT",REASON_INSTALL_ALIAS_PATH:"ARA_INSTALL_ALIAS_PATH",REASON_INSTALL_DIR:"ARA_INSTALL_DIR",REASON_INSTALL_METHOD:"ARA_INSTALL_METHOD",REASON_INSTALL_PINNED_VERSION:"ARA_INSTALL_PINNED_VERSION",REASON_INSTALL_UPGRADE:"ARA_INSTALL_UPGRADE"},g0=Object.values(g),jZ=new Set;function MQ(Q,Z){let $=Q[Z];if($?.trim())return $;let X=Q[g[Z]];if(X?.trim())jZ.add(g[Z]);return X}function KZ(Q,Z){return{[Q]:Z,[g[Q]]:Z}}import{basename as BZ}from"path";var i=["production","staging"],OZ="https://api.reasonmachines.com",kZ="https://staging-api.reasonmachines.com";var l={production:{api:"https://api.reasonmachines.ai",app:"https://reasonmachines.ai"},staging:{api:"https://staging-api.reasonmachines.ai",app:"https://staging.reasonmachines.ai"}},AZ=new Set(["ara-staging","reason-staging"]);function KQ(Q={}){let Z=MQ(Q.env??process.env,"REASON_CLI_CHANNEL")?.trim().toLowerCase();if(Z){if(i.includes(Z))return Z;throw Error(`Unknown Reason CLI channel: ${Z}`)}let $=BZ(Q.executablePath??process.execPath).toLowerCase();return AZ.has($)?"staging":"production"}function h(Q){return Q==="staging"?kZ:OZ}function y0(Q){return`${h(Q)}/mcp/ara`}var BQ={production:["https://api.ara.so",l.production.api],staging:["https://api-staging.ara.so",l.staging.api]};function jQ(Q){let Z;try{Z=new URL(Q).origin}catch{return Q}let $=i.find((X)=>BQ[X].includes(Z));return $?h($):Z}function p0(Q,Z){return Q===Z||jQ(Q)===jQ(Z)}function OQ(Q,Z){return i.some(($)=>BQ[$].includes(Q)&&Z===h($))}function u0(Q,Z){try{let $=new URL(Z);return!$.username&&!$.password&&($.origin===h(Q)||$.origin===l[Q].api)}catch{return!1}}function d0(Q){try{let Z=new URL(Q).hostname.replace(/^\[|\]$/g,"").toLowerCase();return Z==="localhost"||Z==="127.0.0.1"||Z==="::1"}catch{return!1}}import{randomBytes as xQ}from"crypto";import{chmodSync as LQ,closeSync as FQ,constants as _Z,linkSync as bQ,lstatSync as x,mkdirSync as fQ,openSync as NZ,readdirSync as P,readFileSync as TQ,readlinkSync as D,renameSync as N,rmdirSync as CQ,symlinkSync as _,unlinkSync as B}from"fs";import{createRequire as xZ}from"module";import{constants as LZ}from"os";import{basename as f,join as U,sep as bZ}from"path";import{existsSync as m,lstatSync as AQ,readdirSync as PZ,readFileSync as FZ,readlinkSync as TZ,realpathSync as DZ}from"fs";import{join as K,sep as RZ}from"path";function o(Q,...Z){let $=K(Q,"ara"),X=K(Q,"reason");if(!v($))return K(X,...Z);if(!m(X))return K($,...Z);return m(K($,...Z))&&!m(K(X,...Z))?K($,...Z):K(X,...Z)}function v(Q){try{let Z=AQ(Q);if(!Z.isSymbolicLink())return Z.isDirectory();return TZ(Q)!=="reason"&&m(Q)}catch{return!1}}function PQ(Q,Z=[]){if(!v(Q))return!1;let $;try{$=[Q,...PZ(Q,{withFileTypes:!0}).filter((X)=>X.isDirectory()).map((X)=>K(Q,X.name))]}catch{return!1}return $.some((X)=>["connect","connect-once"].filter((z)=>!Z.includes(K(X,z))).some((z)=>{let W=K(X,z,"worker.json");try{AQ(W)}catch{return!1}try{let q=JSON.parse(FZ(W,"utf8"))?.stateDirectory;if(typeof q!=="string")return!0;let V=(J,w)=>J===w||J.startsWith(w+RZ);return V(q,Q)||V(kQ(q),kQ(Q))}catch{return!0}}))}function kQ(Q){try{return DZ(Q)}catch{return Q}}var u=new Set(["credentials.json","local-device.json","local-device.revoked.json","local-device.auth-migration.json","local-device.json.registration-pending.json","local-daemon.json","local-daemon.json.workspaces.json","local-root-fingerprint-key.json","instances","workspaces"]),n=new Set(["local-device.proxy.json"]),fZ=new Set(["local-device.key","local-device.binding"]),DQ=new Map;function r(Q,Z,$){let X=U(Q,"ara");if(/[/\\]\.reason-ssh[/\\][^/\\]+[/\\]installer-home[/\\]\.config$/.test(Q))return{state:G(X)?.isDirectory()?"kept":"absent"};return EQ(X,U(Q,"reason"),{linkAlways:!0,kept:(z)=>PQ(z,$??[]),native:Z===void 0?pQ:()=>Z},$!==void 0)}function SQ(Q,...Z){return r(Q),o(Q,...Z)}function z1(Q,Z=process.platform){let $=U(Q,"Library","Logs");if(Z==="darwin")for(let X of[""," Staging"," Development"])EQ(U($,`Ara${X}`),U($,`Reason${X}`),{linkAlways:!1,kept:()=>!1,native:pQ});return U($,"Reason")}var IQ="config_rename_unavailable:busy";function EQ(Q,Z,$,X=!1){let z=X?void 0:DQ.get(Q);if(z)return z;let W;try{W=CZ(Q,Z,$)}catch(q){let V=`config_rename_unavailable:${A(q)??"failed"}`;try{return{state:G(Q)?.isDirectory()?"kept":"absent",problem:V}}catch{return{state:"kept",problem:V}}}if(!(W.state==="absent"&&$.linkAlways)&&W.problem!==IQ&&!(W.state==="kept"&&!W.problem))DQ.set(Q,W);return W}function CZ(Q,Z,$){IZ(Z,$.native);let X=!1;for(let z=0;z<8;z+=1){let W=G(Q);if(W?.isSymbolicLink())return D(Q)===f(Z)?{state:X?"renamed":"linked"}:{state:"kept"};if(!W){if(p(Z))M(()=>B(Z),"ENOENT");if(!(X||$.linkAlways)||!R(Z))return{state:"absent"};let J=b(Z,"link");_(f(Z),J);try{M(()=>N(J,Q),"EISDIR","ENOTEMPTY","EEXIST","ENOTDIR")}finally{M(()=>B(J),"ENOENT")}continue}if(!W.isDirectory())return{state:"absent"};if($.kept(Q))return RQ(Z),{state:"kept"};let q=$.native();if(!q)return RQ(Z),{state:"kept",problem:"config_rename_unavailable:no_native"};let V=EZ(q,Q);if(!V)return{state:"kept",problem:IQ};try{if(x(Q).isSymbolicLink())continue;let J=SZ(q,Q,Z);if(J)return{state:"kept",problem:J};X=!0}finally{V()}}throw Object.assign(Error("legacy directory rename did not settle"),{code:"unsettled"})}function SZ(Q,Z,$){let X=G($);if(!X||p($)){if(!X)_(f($),$);try{Q.exchange(Z,$)}catch(J){if(p($))M(()=>B($),"ENOENT");return`config_rename_unavailable:${A(J)??"exchange_failed"}`}return null}if(!X.isDirectory())return"config_rename_unavailable:ENOTDIR";if(X.dev!==x(Z).dev)return"config_rename_unavailable:EXDEV";let z=[b($,"probe"),b($,"probe")];try{_("a",z[0]),_("b",z[1]),Q.exchange(z[0],z[1])}catch(J){return`config_rename_unavailable:${A(J)??"exchange_failed"}`}finally{for(let J of z)M(()=>B(J),"ENOENT")}let W=yQ($);for(let J of fZ){let w=G(U($,J)),j=G(U(Z,J));if(w&&j&&w.ino!==j.ino)fQ(`${W}-replaced`,{mode:448,recursive:!0}),N(U($,J),U(`${W}-replaced`,J))}let q={linked:new Map,unitsKept:new Set};gQ(Z,$,"",q);let V=b($,"rename");_(f($),V);try{Q.exchange(Z,V)}catch(J){return M(()=>B(V),"ENOENT"),`config_rename_unavailable:${A(J)??"exchange_failed"}`}return hQ(V,$,q,W),null}function t(Q){return Q===""||!Q.includes(bZ)}function gQ(Q,Z,$,X){let z=t($)&&y(U(Z,$),U(Q,$));if(z)X.unitsKept.add($);for(let W of P(U(Q,$))){if(z&&(u.has(W)||n.has(W)))continue;let q=U($,W),V=U(Q,q),J=U(Z,q),w=G(V);if(!w)continue;let j=G(J);if(w.isDirectory()){if(!j)M(()=>fQ(J,{mode:w.mode&4095}),"EEXIST"),LQ(J,w.mode&4095);if(R(J))gQ(Q,Z,q,X)}else if(!j){if(w.isSymbolicLink())M(()=>_(D(V),J),"EEXIST");else if(M(()=>bQ(V,J),"EEXIST","ENOENT"))X.linked.set(q,w.ino)}}}function IZ(Q,Z){let $;try{if(!R(Q))return;$=P(Q)}catch{return}for(let X of $){let z=/^\.(rename|link|probe|claim)-(\d+)-[0-9a-f]+$/.exec(X);if(!z)continue;let W=U(Q,X),q=G(W);if(!q)continue;if(!q.isDirectory()){if(!_Q(Number(z[2])))M(()=>B(W),"ENOENT");continue}let V=Z(),J=null;if(V){try{J=V.lock(W)}catch{continue}if(!J)continue}else if(_Q(Number(z[2])))continue;try{let w=b(Q,"claim");if(M(()=>N(W,w),"ENOENT"))hQ(w,Q,null,yQ(Q))}finally{J?.()}}}function hQ(Q,Z,$,X){for(let[z,W]of $?.linked??[])if(!G(U(Q,z))&&G(U(Z,z))?.ino===W)M(()=>B(U(Z,z)),"ENOENT");if(mQ(Q,Z,"",$),M(()=>CQ(Q),"ENOTEMPTY","EEXIST"))return;N(Q,X),LQ(X,448)}function mQ(Q,Z,$,X){let z=t($)&&(X?X.unitsKept.has($):y(U(Z,$),U(Q,$)));for(let W of P(U(Q,$))){let q=U($,W),V=U(Q,q),J=U(Z,q),w=x(V),j=G(J);if(j&&w.ino===j.ino&&w.dev===j.dev){B(V);continue}if(w.isFile()&&j?.isFile()&&X?.linked.get(q)===j.ino){N(V,J);continue}if(z&&(u.has(W)||n.has(W)))continue;if(!j){if(w.isFile()){if(M(()=>bQ(V,J),"EEXIST"))B(V)}else M(()=>N(V,J),"EEXIST","ENOTEMPTY");continue}if(w.isDirectory()&&j.isDirectory())mQ(Q,Z,q,X),M(()=>CQ(V),"ENOTEMPTY","EEXIST")}}function W1(Q){let Z=U(Q,"ara"),$=U(Q,"reason");if(!R(Z)||!R($))return null;let X=["",...P(Z,{withFileTypes:!0}).filter((z)=>z.isDirectory()&&!z.name.startsWith(".")).map((z)=>z.name)];for(let z of X){let W=U(Z,z),q=U($,z);if(!y(W,q)||!y(q,W))continue;if([...u,...n].some((J)=>a(U(W,J),U(q,J))===!1))return z}return null}function q1(Q){let Z=U(Q,"ara"),$=U(Q,"reason");if(!R(Z)||!R($))return null;let X=(z)=>{for(let W of P(U(Z,z))){let q=U(z,W);if(t(z)&&(W==="connect"||W==="connect-once"))continue;let V=x(U(Z,q)),J=G(U($,q));if(!J||V.ino===J.ino&&V.dev===J.dev)continue;if(V.isDirectory()&&J.isDirectory()&&!J.isSymbolicLink()){let w=X(q);if(w!==null)return w}else if(V.isSymbolicLink()||J.isSymbolicLink()){if(!(V.isSymbolicLink()&&J.isSymbolicLink()&&D(U(Z,q))===D(U($,q))))return q}else if(a(U(Z,q),U($,q))!==!0)return q}return null};return X("")}function a(Q,Z){let $=G(Q),X=G(Z);if(!$&&!X)return null;if(!$||!X||$.isDirectory()!==X.isDirectory())return!1;if($.ino===X.ino&&$.dev===X.dev)return!0;if($.isDirectory())return[...new Set([...P(Q),...P(Z)])].every((W)=>a(U(Q,W),U(Z,W))===!0);try{return TQ(Q).equals(TQ(Z))}catch{return!1}}function y(Q,Z){for(let $ of u)if(vQ(U(Q,$),U(Z,$)))return!0;return!1}function vQ(Q,Z){let $=G(Q);if(!$)return!1;let X=G(Z);if(!X)return!0;if($.isDirectory()){if(!X.isDirectory())return!0;return P(Q).some((z)=>vQ(U(Q,z),U(Z,z)))}if($.isSymbolicLink())return!X.isSymbolicLink()||D(Q)!==D(Z);return $.ino!==X.ino||$.dev!==X.dev}function RQ(Q){if(p(Q))M(()=>B(Q),"ENOENT")}function yQ(Q){return U(Q,`.pre-rename-${new Date().toISOString().replace(/[:.]/g,"-")}-${xQ(3).toString("hex")}`)}function p(Q){try{return x(Q).isSymbolicLink()&&D(Q)===f(Q)}catch{return!1}}function R(Q){let Z=G(Q);return Z!==null&&Z.isDirectory()}function EZ(Q,Z){for(let $=0;$<40;$+=1){let X=Q.lock(Z);if(X)return X;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}return null}function b(Q,Z){return U(Q,`.${Z}-${process.pid}-${xQ(6).toString("hex")}`)}function _Q(Q){if(Q===process.pid)return!1;try{return process.kill(Q,0),!0}catch(Z){return A(Z)==="EPERM"}}function G(Q){try{return x(Q)}catch(Z){if(A(Z)==="ENOENT"||A(Z)==="ENOTDIR")return null;throw Z}}function M(Q,...Z){try{return Q(),!0}catch($){if(Z.includes(A($)??""))return!1;throw $}}function A(Q){return Q instanceof Error&&"code"in Q&&typeof Q.code==="string"?Q.code:void 0}var L,gZ=2,hZ=4,mZ=2,vZ=2,NQ=-100;function pQ(){if(L!==void 0)return L;if(L=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let Q;try{Q=xZ(import.meta.url)("bun:ffi")}catch{return null}let Z=process.platform==="darwin",$=Z?"__error":"__errno_location",X=Z?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`],{FFIType:z}=Q;for(let W of X)try{let q=Z?"renamex_np":"renameat2",J=Q.dlopen(W,{flock:{args:[z.i32,z.i32],returns:z.i32},[$]:{args:[],returns:z.ptr},[q]:Z?{args:[z.ptr,z.ptr,z.u32],returns:z.i32}:{args:[z.i32,z.ptr,z.i32,z.ptr,z.u32],returns:z.i32}}).symbols,w=J[$]();if(w===null)continue;let j=(T)=>{let k=Q.read.i32(w),O=Object.entries(LZ.errno).find(([,E])=>E===k)?.[0]??`errno_${k}`;return Object.assign(Error(`${T} failed: ${O}`),{code:O})},HQ=(T)=>Buffer.from(`${T}\x00`,"utf8");return L={exchange(T,k){let O=HQ(T),E=HQ(k);if((Z?J[q](Q.ptr(O),Q.ptr(E),mZ):J[q](NQ,Q.ptr(O),NQ,Q.ptr(E),vZ))!==0)throw j("exchange")},lock(T){let k=NZ(T,_Z.O_RDONLY);if(J.flock(k,gZ|hZ)===0)return()=>FQ(k);let O=j("lock");if(FQ(k),O.code==="EWOULDBLOCK"||O.code==="EAGAIN")return null;throw O}},L}catch{}return null}import{createHmac as V0,createPublicKey as w0,randomBytes as G0,randomUUID as zZ,verify as H0}from"crypto";import{chmodSync as qQ,existsSync as WZ,mkdirSync as M0,readFileSync as j0,realpathSync as K0,renameSync as B0,statSync as O0,unlinkSync as k0,writeFileSync as A0}from"fs";import{basename as P0,dirname as YQ,isAbsolute as qZ,join as s,resolve as F0}from"path";var Y1=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var yZ="REASON_DESKTOP_RUNTIME",pZ="REASON_DESKTOP_RUNTIME_CHANNEL",uZ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",dZ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",M1={[yZ]:"ARA_DESKTOP_RUNTIME",[pZ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[uZ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[dZ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function uQ(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as QQ,existsSync as F,mkdirSync as ZQ,readFileSync as lQ,realpathSync as lZ,renameSync as iZ,unlinkSync as $Q,writeFileSync as XQ}from"fs";import{createPrivateKey as oZ,createPublicKey as nZ,generateKeyPairSync as rZ,randomUUID as tZ,sign as aZ}from"crypto";import{createRequire as eZ}from"module";import{homedir as Q0,platform as rQ}from"os";import{dirname as Z0,join as C}from"path";import{existsSync as sZ}from"fs";import{join as cQ}from"path";var e="libara_device_keychain.dylib",dQ="libreason_device_keychain.dylib";class cZ extends Error{code;constructor(Q,Z){super(Z);this.code=Q;this.name="ManagedRuntimeError"}}function sQ(Q){let Z=cQ(Q,dQ);return sZ(Z)?Z:cQ(Q,e)}var iQ=1,$0=16384,S=65536,X0=128,z0=128,tQ=65536;class Y extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function aQ(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var zQ=null;function eQ(){if(!zQ)try{zQ=eZ(import.meta.url)("bun:ffi")}catch{throw new Y("native_boundary_unavailable")}return zQ}function W0(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function q0(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new Y("invalid_credential_record");let Z=Q,$=W0(Z.apiOrigin);if(Z.version!==iQ||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new Y("invalid_credential_record");return{version:iQ,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function J0(Q=process.execPath){let Z=Q;try{Z=lZ(Q)}catch{}return sQ(Z0(Z))}function H(Q){return eQ().ptr(Q)}function Y0(Q){if(!F(Q))throw new Y("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=eQ();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(X){if(X instanceof Y)throw X;throw new Y("native_boundary_unavailable")}}function oQ(Q){return Buffer.from(Q).toString("base64url")}function I(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function QZ(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class ZZ{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=J0(),Z=rQ(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;uQ($)}symbols(){if(this.runtimePlatform!=="darwin")throw new Y("unsupported_platform");this.library??=Y0(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(H(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new Y("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(X0),$=new BigUint64Array(1),X=Q==="load"?this.symbols().ara_device_key_load_public(H(Z),BigInt(Z.byteLength),H($)):this.symbols().ara_device_key_create_fresh_public(H(Z),BigInt(Z.byteLength),H($));if(X!==0)throw new Y(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",X);let z=Number($[0]);if(!Number.isSafeInteger(z)||z!==65)throw new Y("invalid_public_key");let W=oQ(Z.subarray(0,z));if(!I(W))throw new Y("invalid_public_key");return W}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>tQ)throw new Y("proof_sign_failed");let Z=new Uint8Array(z0),$=new BigUint64Array(1),X=this.symbols().ara_device_key_sign(H(Q),BigInt(Q.byteLength),H(Z),BigInt(Z.byteLength),H($));if(X!==0)throw new Y("proof_sign_failed",X);let z=Number($[0]);if(!Number.isSafeInteger(z)||z<1||z>Z.byteLength)throw new Y("invalid_signature");let W=Z.subarray(0,z);if(!QZ(W))throw new Y("invalid_signature");return oQ(W)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(H(Q));if(Z!==0||Q[0]!==1)throw new Y("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(H(Q));if(Z!==0)throw new Y("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(S),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(H(Q),BigInt(Q.byteLength),H(Z));if($===1)return null;if($!==0)throw new Y("binding_read_failed",$);let X=Number(Z[0]);if(!Number.isSafeInteger(X)||X<1||X>Q.byteLength)throw new Y("invalid_binding");return Q.slice(0,X)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");let Z=this.symbols().ara_device_binding_create(H(Q),BigInt(Q.byteLength));if(Z!==0)throw new Y("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");let Z=this.symbols().ara_device_binding_update(H(Q),BigInt(Q.byteLength));if(Z!==0)throw new Y("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(H(Q));if(Z!==0)throw new Y("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array($0),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(H(Q),BigInt(Q.byteLength),H(Z));if($===1)return null;if($!==0)throw new Y("legacy_credential_read_failed",$);let X=Number(Z[0]);if(!Number.isSafeInteger(X)||X<1||X>Q.byteLength)throw new Y("invalid_credential_record");try{let z=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,X));return q0(JSON.parse(z))}catch(z){if(z instanceof Y)throw z;throw new Y("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(H(Q));if(Z!==0)throw new Y("legacy_credential_delete_failed",Z);return Q[0]===1}}function nQ(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new Y("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),X=Buffer.from(Z.y,"base64url");if($.byteLength!==32||X.byteLength!==32)throw new Y("invalid_public_key");let z=Buffer.concat([Buffer.of(4),$,X]).toString("base64url");if(!I(z))throw new Y("invalid_public_key");return z}function U0(){let Q=process.env.XDG_CONFIG_HOME?.trim()||C(Q0(),".config");r(Q);let Z=C(Q,"ara");return v(Z)?Z:C(Q,"reason")}class $Z{directory;constructor(Q=U0()){this.directory=Q}keyPath(){return C(this.directory,"local-device.key")}bindingPath(){return C(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!F(Q))throw new Y("proof_key_read_failed");try{let Z=lQ(Q,"utf8");return oZ({key:Z,format:"pem"})}catch{throw new Y("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=nZ(Q);return nQ(Z)}createFreshPublicKey(){ZQ(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=rZ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),X=this.keyPath();return XQ(X,$,{mode:384}),QQ(X,384),nQ(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>tQ)throw new Y("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=aZ("sha256",Q,Z)}catch{throw new Y("proof_sign_failed")}if(!QZ($))throw new Y("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!F(Q))return!1;return $Q(Q),!0}loadBinding(){let Q=this.bindingPath();if(!F(Q))return null;try{return new Uint8Array(lQ(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");ZQ(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(F(Z))throw new Y("binding_create_failed");XQ(Z,Q,{mode:384}),QQ(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");ZQ(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!F(Z))throw new Y("binding_update_failed");let $=`${Z}.${tZ()}`;try{XQ($,Q,{mode:384,flag:"wx"}),QQ($,384),iZ($,Z)}finally{if(F($))$Q($)}}deleteBinding(){let Q=this.bindingPath();if(!F(Q))return!1;return $Q(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function WQ(){return rQ()==="darwin"?new ZZ:new $Z}var UQ=4;var d="macos-keychain-p256-v1",JZ=1,T0=`ARA-DEVICE-BINDING-V1
 `;function D0(Q){return Q===void 0||typeof Q==="number"&&Number.isInteger(Q)&&Q>=1&&Q<=4}function YZ(Q={},Z=c()){let $=KQ({env:{...process.env,...Q}}),X=Q.XDG_CONFIG_HOME?.trim()||s(Z,".config");return SQ(X,...$==="staging"?["staging"]:[])}function VQ(Q={},Z=c()){return s(YZ(Q,Z),"local-device.json")}function UZ(Q={},Z=c()){return s(YZ(Q,Z),"local-daemon.json")}function wQ(Q,Z){M0(YQ(Q),{recursive:!0,mode:448}),qQ(YQ(Q),448);let $=`${Q}.${process.pid}.${zZ()}.tmp`;try{A0($,`${JSON.stringify(Z,null,2)}
 `,{mode:384,flag:"wx"}),qQ($,384),B0($,Q),qQ(Q,384)}finally{if(WZ($))k0($)}return Q}function GQ(Q){if(!WZ(Q))return null;try{return JSON.parse(j0(Q,"utf8"))}catch{return null}}function JQ(Q,Z,$){try{Q.onCredentialLifecycle?.({event:Z,...$?{reasonCode:$}:{}})}catch{}}function R0(Q){if(!Array.isArray(Q))return null;let Z=[];for(let $ of Q){if(!$||typeof $!=="object")return null;let X=$;if(typeof X.id!=="string"||typeof X.label!=="string"||typeof X.path!=="string"||typeof X.pathFingerprint!=="string"||!X.permissions||typeof X.permissions.read!=="boolean"||typeof X.permissions.write!=="boolean"||typeof X.permissions.execute!=="boolean"||typeof X.permissions.discover_environment!=="boolean"||typeof X.permissions.expose_mcp!=="boolean")return null;Z.push({id:X.id,label:X.label,path:X.path,pathFingerprint:X.pathFingerprint,permissions:X.permissions})}return Z}function VZ(Q,Z,$=[]){let X=Object.keys(Q);return Z.every((z)=>Object.hasOwn(Q,z))&&X.every((z)=>Z.includes(z)||$.includes(z))}function _0(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost")return null;return Z.origin}catch{return null}}function wZ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q,$=R0(Z.roots),X=_0(Z.apiOrigin);if(!X||typeof Z.orgId!=="string"||typeof Z.deviceId!=="string"||typeof Z.displayName!=="string"||typeof Z.registeredAt!=="string"||!D0(Z.handsSlots)||Z.worker!==void 0&&(!Z.worker||!/^[a-f0-9]{64}$/.test(Z.worker.configDigest)||!["persistent","ephemeral"].includes(Z.worker.lifetime)||!Number.isFinite(Date.parse(Z.worker.expiresAt)))||!$)return null;return{apiOrigin:X,orgId:Z.orgId,deviceId:Z.deviceId,displayName:Z.displayName,registeredAt:Z.registeredAt,...Z.handsSlots!==void 0?{handsSlots:Z.handsSlots}:{},...Z.worker!==void 0?{worker:Z.worker}:{},roots:$}}function N0(Q){return{...Q,credentialStorage:d}}function x0(Q){return{version:UQ,apiOrigin:Q.apiOrigin,orgId:Q.orgId,deviceId:Q.deviceId,devicePublicKey:Q.devicePublicKey,displayName:Q.displayName,registeredAt:Q.registeredAt,...Q.handsSlots!==void 0?{handsSlots:Q.handsSlots}:{},...Q.worker!==void 0?{worker:Q.worker}:{},roots:Q.roots.map((Z)=>({id:Z.id,label:Z.label,path:Z.path,pathFingerprint:Z.pathFingerprint,permissions:{read:Z.permissions.read,write:Z.permissions.write,execute:Z.permissions.execute,discover_environment:Z.permissions.discover_environment,expose_mcp:Z.permissions.expose_mcp}})),credentialStorage:d}}function GZ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q;if(!VZ(Z,["version","apiOrigin","orgId","deviceId","devicePublicKey","displayName","registeredAt","roots","credentialStorage"],["handsSlots","worker"]))return null;let $=wZ(Z);if(!$||Z.version!==UQ||Z.credentialStorage!==d||!I(Z.devicePublicKey))return null;return{version:UQ,...$,devicePublicKey:Z.devicePublicKey,credentialStorage:d}}function HZ(Q){return new TextEncoder().encode(`${T0}${JSON.stringify(x0(Q))}`)}function L0(Q){let Z=Buffer.from(Q,"base64url");return w0({format:"jwk",key:{kty:"EC",crv:"P-256",x:Z.subarray(1,33).toString("base64url"),y:Z.subarray(33,65).toString("base64url")}})}function b0(Q,Z){let $={version:JZ,state:Q,signature:Z.sign(HZ(Q))};return new TextEncoder().encode(JSON.stringify($))}function MZ(Q){let Z;try{Z=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(Q))}catch{throw new Y("invalid_binding")}if(!Z||typeof Z!=="object"||Array.isArray(Z))throw new Y("invalid_binding");let $=Z;if(!VZ($,["version","state","signature"])||$.version!==JZ||typeof $.signature!=="string"||!/^[A-Za-z0-9_-]{10,128}$/.test($.signature))throw new Y("invalid_binding");let X=GZ($.state);if(!X)throw new Y("invalid_binding");let z=!1;try{z=H0("sha256",HZ(X),L0(X.devicePublicKey),Buffer.from($.signature,"base64url"))}catch{z=!1}if(!z)throw new Y("invalid_binding");return X}function f0(Q){let{credentialStorage:Z,...$}=Q;return $}function C0(Q){return Q instanceof Y?aQ(Q):"credential_boundary_failed"}function v1(Q=VQ(),Z={}){let $=GQ(Q),X=Z.proofStore??Z.credentialStore??WQ(),z=X.loadBinding();if(!z){if($&&typeof $==="object"&&!Array.isArray($)&&S0($))return null;if($!==null)throw new Y("invalid_binding");return null}let W=MZ(z),q=X.loadPublicKey();if(X.privateKeyIsNonExtractable(),q!==W.devicePublicKey)throw new Y("invalid_public_key");let V=GZ($);if(Z.repair!==!1&&(!V||JSON.stringify(V)!==JSON.stringify(W)))wQ(Q,W);return f0(W)}function S0(Q){let Z=Q,$=wZ(Q);if(!$)return null;if(Z.version===2){if(typeof Z.deviceCredential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.deviceCredential)||Z.deviceCredential.length>4096)return null;return{state:$,credentialSource:"plaintext-v2"}}if(Z.version!==3||Z.credentialStorage!=="macos-keychain-v1"||"deviceCredential"in Z)return null;return{state:$,credentialSource:"keychain-v3"}}function y1(Q,Z=VQ(),$={}){let X=$.proofStore??$.credentialStore??WQ();JQ($,"credential.store_started");try{if(!I(Q.devicePublicKey)||X.loadPublicKey()!==Q.devicePublicKey)throw new Y("invalid_public_key");X.privateKeyIsNonExtractable();let z=N0(Q),W=X.loadBinding();if(W){let V=MZ(W);if(V.devicePublicKey!==Q.devicePublicKey||V.orgId!==Q.orgId||V.deviceId!==Q.deviceId||V.apiOrigin!==Q.apiOrigin&&!OQ(V.apiOrigin,Q.apiOrigin))throw new Y("invalid_binding")}let q=b0(z,X);if(W)X.updateBinding(q);else X.createBinding(q);return wQ(Z,z),JQ($,"credential.store_completed"),Z}catch(z){throw JQ($,"credential.store_failed",C0(z)),z}}function p1(Q=UZ()){let Z=GQ(Q);if(!Z||typeof Z!=="object")return null;let $=Z;if($.version!==1||typeof $.pid!=="number"||!Number.isInteger($.pid)||!["starting","connected","stopped","error"].includes($.state??"")||typeof $.startedAt!=="string"||$.lastHeartbeatAt!==void 0&&typeof $.lastHeartbeatAt!=="string"||$.lastUsedAt!==void 0&&typeof $.lastUsedAt!=="string"||$.organizationId!==void 0&&typeof $.organizationId!=="string"||$.organizationName!==void 0&&typeof $.organizationName!=="string"||$.organizationSlug!==void 0&&typeof $.organizationSlug!=="string"||$.error!==void 0&&typeof $.error!=="string"||$.reconnectingSince!==void 0&&typeof $.reconnectingSince!=="string"||$.workspace!==void 0&&typeof $.workspace!=="string")return null;return $}function u1(Q,Z=UZ()){return wQ(Z,Q)}var XZ=1;function I0(Q=VQ()){return s(YQ(Q),"local-device.proxy.json")}function d1(Q=I0()){let Z=GQ(Q);if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let $=Z;if($.version!==XZ||typeof $.url!=="string"||$.url.length===0||$.caFile!==void 0&&(typeof $.caFile!=="string"||!qZ($.caFile)))return null;return{version:XZ,url:$.url,...$.caFile?{caFile:$.caFile}:{}}}function c1(Q,Z={read:!0,write:!1,execute:!1,discover_environment:!1,expose_mcp:!1},$=G0(32)){let X=new Set,z=[];for(let W of Q){let q=K0(qZ(W)?W:F0(W));if(!O0(q).isDirectory())throw Error(`Local execution root is not a directory: ${W}`);if(X.has(q))continue;X.add(q),z.push({id:zZ(),label:P0(q)||q,path:q,pathFingerprint:V0("sha256",$).update(q).digest("hex"),permissions:{...Z}})}if(z.length===0)throw Error("At least one explicit local execution root is required.");return z}
-export{MQ as Be,KZ as Ce,i as De,KQ as Ee,h as Fe,y0 as Ge,jQ as He,p0 as Ie,OQ as Je,u0 as Ke,d0 as Le,r as Me,SQ as Ne,z1 as Oe,W1 as Pe,q1 as Qe,pQ as Re,cZ as Se,Y as Te,J0 as Ue,I as Ve,QZ as We,ZZ as Xe,$Z as Ye,VQ as Ze,UZ as _e,v1 as $e,y1 as af,p1 as bf,u1 as cf,XZ as df,d1 as ef,c1 as ff};
+export{MQ as Fe,KZ as Ge,i as He,KQ as Ie,h as Je,y0 as Ke,jQ as Le,p0 as Me,OQ as Ne,u0 as Oe,d0 as Pe,r as Qe,SQ as Re,z1 as Se,W1 as Te,q1 as Ue,pQ as Ve,cZ as We,Y as Xe,J0 as Ye,I as Ze,QZ as _e,ZZ as $e,$Z as af,VQ as bf,UZ as cf,v1 as df,y1 as ef,p1 as ff,u1 as gf,XZ as hf,d1 as if,c1 as jf};

package/bin/vm-hands/{vm-hands-entry-lite-bswnp5ve.js → vm-hands-entry-lite-xf6schkk.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Kb as j,Lb as q}from"./vm-hands-entry-lite-ya1a2eep.js";function y(v=process.platform){if(j(),v==="linux")q("strict")}
+import{Kb as j,Lb as q}from"./vm-hands-entry-lite-93ejmwqn.js";function y(v=process.platform){if(j(),v==="linux")q("strict")}
 export{y as t};

package/bin/vm-hands/{vm-hands-entry-lite-q2pb31vh.js → vm-hands-entry-lite-yhz6sv35.js}

@@ -1,4 +1,4 @@
 // @bun
-import{mh as f}from"./vm-hands-entry-lite-yp315y25.js";var j=["Click browser element","Double click browser element","Type text","Clear browser field","Press key","Scroll browser element into view","Drag on computer","Select browser option","Check browser control","Uncheck browser control","Hover browser element","Focus browser element","Open browser page","Reload browser page","Go back in browser","Go forward in browser","Take browser screenshot"],$A=32;function R(x){if(!Array.isArray(x)||x.length>32||!x.every((A)=>typeof A==="string"&&j.includes(A)))return;return x.slice()}var KA="__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__",QA=262144;function Y(x){if(!x||typeof x!=="object"||Array.isArray(x))return!1;let A=x,W=Object.keys(A);return W.length===2&&W.includes("template")&&W.includes("quoteDepth")&&typeof A.template==="string"&&A.template.length<=262144&&!A.template.includes("\x00")&&A.template.split("__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__").length===2&&(A.quoteDepth===1||A.quoteDepth===2||A.quoteDepth===3)}var I=2,b=33554432,K=200000,D=4000000,_=240000,YA=`
+import{qh as f}from"./vm-hands-entry-lite-ne8kkvk4.js";var j=["Click browser element","Double click browser element","Type text","Clear browser field","Press key","Scroll browser element into view","Drag on computer","Select browser option","Check browser control","Uncheck browser control","Hover browser element","Focus browser element","Open browser page","Reload browser page","Go back in browser","Go forward in browser","Take browser screenshot"],$A=32;function R(x){if(!Array.isArray(x)||x.length>32||!x.every((A)=>typeof A==="string"&&j.includes(A)))return;return x.slice()}var KA="__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__",QA=262144;function Y(x){if(!x||typeof x!=="object"||Array.isArray(x))return!1;let A=x,W=Object.keys(A);return W.length===2&&W.includes("template")&&W.includes("quoteDepth")&&typeof A.template==="string"&&A.template.length<=262144&&!A.template.includes("\x00")&&A.template.split("__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__").length===2&&(A.quoteDepth===1||A.quoteDepth===2||A.quoteDepth===3)}var I=2,b=33554432,K=200000,D=4000000,_=240000,YA=`
 ...[executor output truncated]`,p=2000,k=1,i=16384,d=32768,y=128,LA=64,s=2097152,H=1,m=16384,c=32768,OA=8388608,n=1000,t=2500,r=2000,zA=t+r,o=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/,v=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,l={text_only:4430,invalid_json:4431,invalid_cancel_request:4432,invalid_sdk_response:4433,claim_required:4434,invalid_claim:4435,executor_mismatch:4436,stale_generation:4437,fence_conflict:4438,frame_too_large:4439,result_too_large:4440,progress_too_large:4441,terminal_cleanup_started:4442,job_journal_unavailable:4443},u=new Map(Object.entries(l).map(([x,A])=>[A,x]));function SA(x,A){return A||(u.get(x)??"")}var a=["cancelled","command_failed","duplicate_request_id","duplicate_result_evicted","invalid_repl_response","invalid_request","process_group_cleanup_unconfirmed","repl_failed","result_too_large","repl_response_too_large","repl_transport_failed","request_ledger_full","request_journal_unavailable","request_outcome_uncertain","maintenance_held","request_not_found","resume_digest_mismatch","spawn_failed","stale_generation","timeout"],e=new Set(a),w=16384,AA=200,xA=2000,WA=["maintenance_held","invalid_job_request","jobs_disabled","job_not_found","job_conflict","job_capacity","job_journal_unavailable","job_not_running","job_lease_expired","job_input_sequence","job_input_backpressure","stale_generation","pty_unsupported","job_mode_mismatch"];class G extends Error{code;constructor(x){super(x);this.name="HandsProtocolError",this.code=x}}function g(x){return new TextEncoder().encode(x).byteLength}function U(x){return typeof x==="object"&&x!==null&&!Array.isArray(x)}function B(x,A){let W=new Set(A);return Object.keys(x).every((N)=>W.has(N))}function M(x){return typeof x==="string"&&o.test(x)}function Z(x){return Number.isSafeInteger(x)&&Number(x)>=1}function J(x){return typeof x==="string"&&v.test(x)}function C(x){return typeof x==="string"&&x.startsWith("pty-")&&J(x.slice(4))}function z(x){return[x.cols,x.rows].every((A)=>Number.isSafeInteger(A)&&Number(A)>=1&&Number(A)<=n)}function E(x){if(typeof x!=="string"||x.length>Math.ceil(m/3)*4||x.length%4!==0||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(x))return-1;let A=x.endsWith("==")?2:x.endsWith("=")?1:0;if(A&&"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(x[x.length-A-1])&(A===2?15:3))return-1;let N=x.length/4*3-A;return N<=m?N:-1}function S(x){return typeof x==="string"&&/^[0-9a-f]{64}$/.test(x)}function $(x){if(g(x)>b)throw new G("frame_too_large");try{return JSON.parse(x)}catch{throw new G("invalid_json")}}function BA(x){let A=$(x);if(!U(A)||!B(A,["version","generation","id","tool","input","semanticDigest","lifecycleLeaseId","workspaceBefore"])||A.version!==I||!Z(A.generation)||!M(A.id)||!["bash","repl","resume","read","edit","write","pi_tool"].includes(String(A.tool))||!U(A.input)||A.lifecycleLeaseId!==void 0&&(A.tool!=="bash"||!J(A.lifecycleLeaseId))||A.workspaceBefore!==void 0&&(!(A.tool==="bash"||A.tool==="repl"||A.tool==="pi_tool"&&A.input.tool==="bash")||!U(A.workspaceBefore)||!B(A.workspaceBefore,["script"])||typeof A.workspaceBefore.script!=="string"||A.workspaceBefore.script.length>K))throw new G("invalid_request");let W=U(A.workspaceBefore)&&typeof A.workspaceBefore.script==="string"?{workspaceBefore:{script:A.workspaceBefore.script}}:{};if(A.tool==="bash"){if(!B(A.input,["script","retainBackground","machineSdk"])||typeof A.input.script!=="string"||A.input.script.length>K||A.input.retainBackground!==void 0&&A.input.retainBackground!==!0||A.input.machineSdk!==void 0&&A.input.machineSdk!==!0||A.semanticDigest!==void 0&&!S(A.semanticDigest))throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"bash",input:{script:A.input.script,...A.input.retainBackground===!0?{retainBackground:!0}:{},...A.input.machineSdk===!0?{machineSdk:!0}:{}},...A.semanticDigest===void 0?{}:{semanticDigest:A.semanticDigest},...A.lifecycleLeaseId===void 0?{}:{lifecycleLeaseId:A.lifecycleLeaseId},...W}}if(A.tool==="resume"){if(A.semanticDigest!==void 0||!B(A.input,["semanticDigest"])||!S(A.input.semanticDigest))throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"resume",input:{semanticDigest:A.input.semanticDigest}}}if(A.tool==="repl"){if(!B(A.input,["code"])||typeof A.input.code!=="string"||A.input.code.length>K||A.semanticDigest!==void 0)throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"repl",input:{code:A.input.code},...W}}if(A.tool==="pi_tool"){let N=A.semanticDigest===void 0?GA(A.input):null;if(!N)throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"pi_tool",input:N,...W}}if(A.tool==="read"){if(!B(A.input,["path","offset","limit"])||typeof A.input.path!=="string"||A.input.path.length<1||A.input.path.length>K||A.semanticDigest!==void 0||A.input.offset!==void 0&&(!Number.isSafeInteger(A.input.offset)||Number(A.input.offset)<1)||A.input.limit!==void 0&&(!Number.isSafeInteger(A.input.limit)||Number(A.input.limit)<1||Number(A.input.limit)>2000))throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"read",input:{path:A.input.path,...A.input.offset===void 0?{}:{offset:Number(A.input.offset)},...A.input.limit===void 0?{}:{limit:Number(A.input.limit)}}}}if(A.tool==="edit"){if(!B(A.input,["path","edits"])||typeof A.input.path!=="string"||A.input.path.length<1||!Array.isArray(A.input.edits)||A.input.edits.length<1||A.input.edits.length>128||A.semanticDigest!==void 0)throw new G("invalid_request");let N=A.input.path.length,X=[];for(let V of A.input.edits){if(!U(V)||!B(V,["oldText","newText"])||typeof V.oldText!=="string"||V.oldText.length<1||typeof V.newText!=="string")throw new G("invalid_request");if(N+=V.oldText.length+V.newText.length,N>D)throw new G("invalid_request");X.push({oldText:V.oldText,newText:V.newText})}return{version:I,generation:A.generation,id:A.id,tool:"edit",input:{path:A.input.path,edits:X}}}if(A.tool!=="write"||!B(A.input,["path","content"])||typeof A.input.path!=="string"||A.input.path.length<1||typeof A.input.content!=="string"||A.input.path.length+A.input.content.length>D||A.semanticDigest!==void 0)throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"write",input:{path:A.input.path,content:A.input.content}}}function L(x){return x===void 0||typeof x==="number"&&Number.isFinite(x)}function GA(x){let A=x.args;if(!B(x,["tool","args"])||!U(A))return null;if(x.tool==="bash")return B(A,["command","timeout"])&&typeof A.command==="string"&&A.command.length<=K&&L(A.timeout)?{tool:"bash",args:{command:A.command,...A.timeout===void 0?{}:{timeout:Number(A.timeout)}}}:null;if(typeof A.path!=="string"||A.path.length>K)return null;if(x.tool==="read")return B(A,["path","offset","limit"])&&L(A.offset)&&L(A.limit)?{tool:"read",args:{path:A.path,...A.offset===void 0?{}:{offset:Number(A.offset)},...A.limit===void 0?{}:{limit:Number(A.limit)}}}:null;if(x.tool==="write")return B(A,["path","content"])&&typeof A.content==="string"&&A.path.length+A.content.length<=D?{tool:"write",args:{path:A.path,content:A.content}}:null;if(x.tool!=="edit"||!B(A,["path","edits"])||!Array.isArray(A.edits))return null;let W=A.path.length,N=[];for(let X of A.edits){if(!U(X)||!B(X,["oldText","newText"])||typeof X.oldText!=="string"||typeof X.newText!=="string")return null;if(W+=X.oldText.length+X.newText.length,W>D)return null;N.push({oldText:X.oldText,newText:X.newText})}return{tool:"edit",args:{path:A.path,edits:N}}}function NA(x){if(!U(x))return null;if("thrown"in x)return B(x,["thrown"])&&typeof x.thrown==="string"?{thrown:x.thrown}:null;let A=x.structuredContent;if(!B(x,["content","details","structuredContent","isError"])||!Array.isArray(x.content)||x.isError!==void 0&&x.isError!==!0||A!==void 0&&(!U(A)||!B(A,["output","truncated","full_output_path","exit_code","wall_time_seconds"])||typeof A.output!=="string"||typeof A.truncated!=="boolean"||A.full_output_path!==void 0&&typeof A.full_output_path!=="string"||typeof A.exit_code!=="number"||typeof A.wall_time_seconds!=="number"))return null;let W=[];for(let N of x.content)if(U(N)&&N.type==="text"&&B(N,["type","text"])&&typeof N.text==="string")W.push({type:"text",text:N.text});else if(U(N)&&N.type==="image"&&B(N,["type","data","mimeType"])&&typeof N.data==="string"&&typeof N.mimeType==="string")W.push({type:"image",data:N.data,mimeType:N.mimeType});else return null;return{content:W,...x.details===void 0?{}:{details:x.details},...U(A)?{structuredContent:{output:String(A.output),truncated:A.truncated===!0,...typeof A.full_output_path==="string"?{full_output_path:A.full_output_path}:{},exit_code:Number(A.exit_code),wall_time_seconds:Number(A.wall_time_seconds)}}:{},...x.isError===!0?{isError:!0}:{}}}function UA(x){let A=$(x);if(!U(A)||!B(A,["version","generation","id","ok","exitCode","stdout","stderr","cwd","error","resumed","browserActions","automaticProgressImage","piToolOutcome","workerElapsedMs","environmentWaitMs","workspaceBefore"])||A.version!==I||!Z(A.generation)||!M(A.id)||typeof A.ok!=="boolean"||!Number.isSafeInteger(A.exitCode)||Number(A.exitCode)<0||Number(A.exitCode)>255||typeof A.stdout!=="string"||A.stdout.length>_||typeof A.stderr!=="string"||A.stderr.length>_||A.cwd!==void 0&&(typeof A.cwd!=="string"||A.cwd.length<1||A.cwd.length>4096||!A.cwd.startsWith("/")||A.cwd.includes("\x00"))||A.error!==void 0&&(typeof A.error!=="string"||A.error.length<1||A.error.length>p||!e.has(A.error))||A.browserActions!==void 0&&!R(A.browserActions)||A.automaticProgressImage!==void 0&&(A.automaticProgressImage!==!0||!A.ok)||A.resumed!==void 0&&A.resumed!==!0||A.workerElapsedMs!==void 0&&(!Number.isSafeInteger(A.workerElapsedMs)||Number(A.workerElapsedMs)<0)||A.environmentWaitMs!==void 0&&(!Number.isSafeInteger(A.environmentWaitMs)||Number(A.environmentWaitMs)<0)||A.workspaceBefore!==void 0&&!h(A.workspaceBefore)||A.ok&&(A.exitCode!==0||A.error!==void 0)||!A.ok&&A.exitCode===0)throw new G("invalid_result");let W=A.piToolOutcome===void 0?void 0:NA(A.piToolOutcome);if(W===null||W&&!A.ok)throw new G("invalid_result");return{version:I,generation:A.generation,id:A.id,ok:A.ok,exitCode:Number(A.exitCode),stdout:A.stdout,stderr:A.stderr,...typeof A.cwd==="string"?{cwd:A.cwd}:{},...A.browserActions!==void 0?{browserActions:R(A.browserActions)}:{},...typeof A.error==="string"?{error:A.error}:{},...A.automaticProgressImage===!0?{automaticProgressImage:!0}:{},...A.resumed===!0?{resumed:!0}:{},...W?{piToolOutcome:W}:{},...A.workerElapsedMs!==void 0?{workerElapsedMs:Number(A.workerElapsedMs)}:{},...A.environmentWaitMs!==void 0?{environmentWaitMs:Number(A.environmentWaitMs)}:{},...h(A.workspaceBefore)?{workspaceBefore:{exitCode:A.workspaceBefore.exitCode,stdout:A.workspaceBefore.stdout,stderr:A.workspaceBefore.stderr}}:{}}}function h(x){return U(x)&&B(x,["exitCode","stdout","stderr"])&&Number.isSafeInteger(x.exitCode)&&Number(x.exitCode)>=0&&Number(x.exitCode)<=255&&typeof x.stdout==="string"&&x.stdout.length<=w&&typeof x.stderr==="string"&&x.stderr.length<=w}function FA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","id","sequence","stdout","stderr"])||A.type!=="progress"||A.version!==I||!Z(A.generation)||!M(A.id)||!Number.isSafeInteger(A.sequence)||Number(A.sequence)<1||typeof A.stdout!=="string"||A.stdout.length>_||typeof A.stderr!=="string"||A.stderr.length>_)throw new G("invalid_progress");return{type:"progress",version:I,generation:Number(A.generation),id:A.id,sequence:Number(A.sequence),stdout:A.stdout,stderr:A.stderr}}function IA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","fenceId","executorLaunchId","requestCancelVersion","managedJobsVersion","browserRunEnvelopeVersion","terminalCleanupVersion","guestMemoryVersion","guestMemoryDiagnosticsVersion","piToolsVersion","piToolsConfinement","backgroundBashVersion","machineSdkVersion","executionTimingVersion","environmentWaitVersion","workspaceBeforeVersion"])||A.type!=="claim"||A.version!==I||!Z(A.generation)||!J(A.fenceId)||!J(A.executorLaunchId)||A.requestCancelVersion!==void 0&&A.requestCancelVersion!==1||A.managedJobsVersion!==void 0&&A.managedJobsVersion!==k||A.guestMemoryVersion!==void 0&&A.guestMemoryVersion!==1||A.guestMemoryDiagnosticsVersion!==void 0&&(A.guestMemoryDiagnosticsVersion!==1||A.guestMemoryVersion!==1)||A.terminalCleanupVersion!==void 0&&A.terminalCleanupVersion!==1||A.browserRunEnvelopeVersion!==void 0&&A.browserRunEnvelopeVersion!==1||A.piToolsVersion!==void 0&&A.piToolsVersion!==1||A.piToolsConfinement!==void 0&&(!Y(A.piToolsConfinement)||A.piToolsVersion!==1)||A.backgroundBashVersion!==void 0&&A.backgroundBashVersion!==1||A.machineSdkVersion!==void 0&&A.machineSdkVersion!==1||A.executionTimingVersion!==void 0&&A.executionTimingVersion!==1||A.environmentWaitVersion!==void 0&&(A.environmentWaitVersion!==1||A.executionTimingVersion!==1)||A.workspaceBeforeVersion!==void 0&&A.workspaceBeforeVersion!==1)throw new G("invalid_claim");return{type:"claim",version:I,generation:A.generation,fenceId:A.fenceId,executorLaunchId:A.executorLaunchId,...A.requestCancelVersion===1?{requestCancelVersion:1}:{},...A.managedJobsVersion===1?{managedJobsVersion:1}:{},...A.guestMemoryVersion===1?{guestMemoryVersion:1}:{},...A.guestMemoryDiagnosticsVersion===1?{guestMemoryDiagnosticsVersion:1}:{},...A.terminalCleanupVersion===1?{terminalCleanupVersion:1}:{},...A.browserRunEnvelopeVersion===1?{browserRunEnvelopeVersion:1}:{},...A.piToolsVersion===1?{piToolsVersion:1}:{},...Y(A.piToolsConfinement)?{piToolsConfinement:{template:A.piToolsConfinement.template,quoteDepth:A.piToolsConfinement.quoteDepth}}:{},...A.backgroundBashVersion===1?{backgroundBashVersion:1}:{},...A.machineSdkVersion===1?{machineSdkVersion:1}:{},...A.executionTimingVersion===1?{executionTimingVersion:1}:{},...A.environmentWaitVersion===1?{environmentWaitVersion:1}:{},...A.workspaceBeforeVersion===1?{workspaceBeforeVersion:1}:{}}}function XA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","fenceId","executorLaunchId","workerVersion","workerArtifactSha256","requestCancelVersion","managedJobsVersion","lifecycleVersion","browserRunEnvelopeVersion","terminalCleanupVersion","guestMemoryVersion","guestMemoryDiagnosticsVersion","piToolsVersion","piToolsConfinementVersion","backgroundBashVersion","machineSdkVersion","executionTimingVersion","environmentWaitVersion","workspaceBeforeVersion"])||A.lifecycleVersion!==void 0&&A.lifecycleVersion!==1||A.workspaceBeforeVersion!==void 0&&A.workspaceBeforeVersion!==1||A.piToolsVersion!==void 0&&A.piToolsVersion!==1||A.piToolsConfinementVersion!==void 0&&(A.piToolsConfinementVersion!==1||A.piToolsVersion!==1)||A.backgroundBashVersion!==void 0&&A.backgroundBashVersion!==1||A.machineSdkVersion!==void 0&&A.machineSdkVersion!==1||A.executionTimingVersion!==void 0&&A.executionTimingVersion!==1||A.environmentWaitVersion!==void 0&&(A.environmentWaitVersion!==1||A.executionTimingVersion!==1)||A.guestMemoryVersion!==void 0&&A.guestMemoryVersion!==1||A.guestMemoryDiagnosticsVersion!==void 0&&(A.guestMemoryDiagnosticsVersion!==1||A.guestMemoryVersion!==1)||A.terminalCleanupVersion!==void 0&&A.terminalCleanupVersion!==1||A.browserRunEnvelopeVersion!==void 0&&A.browserRunEnvelopeVersion!==1||A.type!=="claim_ack"||A.version!==I||!Z(A.generation)||!J(A.fenceId)||!J(A.executorLaunchId)||!Number.isSafeInteger(A.workerVersion)||Number(A.workerVersion)<1||!S(A.workerArtifactSha256)||A.requestCancelVersion!==void 0&&A.requestCancelVersion!==1||A.managedJobsVersion!==void 0&&A.managedJobsVersion!==k)throw new G("invalid_claim_ack");return{type:"claim_ack",...A.guestMemoryVersion===1?{guestMemoryVersion:1}:{},...A.guestMemoryDiagnosticsVersion===1?{guestMemoryDiagnosticsVersion:1}:{},...A.terminalCleanupVersion===1?{terminalCleanupVersion:1}:{},...A.browserRunEnvelopeVersion===1?{browserRunEnvelopeVersion:1}:{},...A.lifecycleVersion===1?{lifecycleVersion:1}:{},...A.piToolsVersion===1?{piToolsVersion:1}:{},...A.piToolsConfinementVersion===1?{piToolsConfinementVersion:1}:{},...A.backgroundBashVersion===1?{backgroundBashVersion:1}:{},...A.machineSdkVersion===1?{machineSdkVersion:1}:{},...A.executionTimingVersion===1?{executionTimingVersion:1}:{},...A.environmentWaitVersion===1?{environmentWaitVersion:1}:{},...A.workspaceBeforeVersion===1?{workspaceBeforeVersion:1}:{},version:I,generation:A.generation,fenceId:A.fenceId,executorLaunchId:A.executorLaunchId,workerVersion:Number(A.workerVersion),workerArtifactSha256:A.workerArtifactSha256,...A.requestCancelVersion===1?{requestCancelVersion:1}:{},...A.managedJobsVersion===1?{managedJobsVersion:1}:{}}}function TA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","id","jobId","action","input"])||A.type!=="job"||A.version!==I||!Z(A.generation)||!M(A.id)||!M(A.jobId)||!U(A.input))throw new G("invalid_job_request");let W=A.input,N=Number.isSafeInteger(W.leaseExpiresAtMs)&&Number(W.leaseExpiresAtMs)>0,X=Number.isSafeInteger(W.sequence)&&Number(W.sequence)>=1;if(!(A.action==="start"?W.mode==="pty"?B(W,["mode","cols","rows","leaseExpiresAtMs"])&&C(A.jobId)&&z(W)&&N:B(W,["script","leaseExpiresAtMs"])&&typeof W.script==="string"&&W.script.length<=K&&N:A.action==="inspect"?B(W,["after"])&&Number.isSafeInteger(W.after)&&Number(W.after)>=0:A.action==="input"?"dataBase64"in W?B(W,["sequence","dataBase64"])&&C(A.jobId)&&X&&E(W.dataBase64)>0:B(W,["sequence","data","eof"])&&X&&typeof W.data==="string"&&W.data.length<=i&&typeof W.eof==="boolean":A.action==="resize"?B(W,["sequence","cols","rows"])&&C(A.jobId)&&X&&z(W):A.action==="renew"?B(W,["leaseExpiresAtMs"])&&N:A.action==="cancel"&&B(W,[])))throw new G("invalid_job_request");return A}function MA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","id","ok","job","error"])||A.type!=="job_result"||A.version!==I||!Z(A.generation)||!M(A.id))throw new G("invalid_job_result");if(A.ok===!1&&A.job===void 0&&typeof A.error==="string"&&WA.some((F)=>F===A.error))return A;let W=A.job;if(A.ok!==!0||A.error!==void 0||!U(W)||!B(W,["jobId","state","startedAtMs","finishedAtMs","leaseExpiresAtMs","exitCode","inputSequence","output","firstCursor","nextCursor","truncated","process","environmentRevision","environmentSnapshotId","pty"])||!M(W.jobId)||!["starting","running","exited","cancelled","expired","uncertain"].includes(String(W.state))||!Number.isSafeInteger(W.startedAtMs)||Number(W.startedAtMs)<1||!Number.isSafeInteger(W.leaseExpiresAtMs)||Number(W.leaseExpiresAtMs)<1||W.finishedAtMs!==null&&(!Number.isSafeInteger(W.finishedAtMs)||Number(W.finishedAtMs)<Number(W.startedAtMs))||W.exitCode!==null&&(!Number.isSafeInteger(W.exitCode)||Number(W.exitCode)<0||Number(W.exitCode)>255)||!Number.isSafeInteger(W.inputSequence)||Number(W.inputSequence)<0||!Number.isSafeInteger(W.firstCursor)||Number(W.firstCursor)<1||!Number.isSafeInteger(W.nextCursor)||Number(W.nextCursor)<Number(W.firstCursor)-1||typeof W.truncated!=="boolean"||!Array.isArray(W.output)||W.output.length>y)throw new G("invalid_job_result");if(W.environmentRevision===void 0!==(W.environmentSnapshotId===void 0)||W.environmentRevision!==void 0&&(!Number.isSafeInteger(W.environmentRevision)||Number(W.environmentRevision)<1||!J(W.environmentSnapshotId)))throw new G("invalid_job_result");let N=Number(W.firstCursor)-1,X=0;for(let F of W.output){if(!U(F)||!B(F,["cursor","stream","text"])||!Number.isSafeInteger(F.cursor)||Number(F.cursor)<=N||Number(F.cursor)>Number(W.nextCursor)||!["stdout","stderr"].includes(String(F.stream))||typeof F.text!=="string")throw new G("invalid_job_result");X+=F.text.length,N=Number(F.cursor)}if(X>d)throw new G("invalid_job_result");let V=W.state==="starting"||W.state==="running";if(V&&(W.finishedAtMs!==null||W.exitCode!==null)||!V&&W.finishedAtMs===null||W.state==="uncertain"&&W.exitCode!==null||W.state==="exited"&&W.exitCode===null||W.state==="cancelled"&&W.exitCode!==130||W.state==="expired"&&W.exitCode!==124)throw new G("invalid_job_result");if(W.process!==void 0){let F=W.process;if(!U(F)||!B(F,["pid","processGroupId","executorLaunchId"])||!Number.isSafeInteger(F.pid)||Number(F.pid)<1||F.processGroupId!==F.pid||!J(F.executorLaunchId)||!["starting","running"].includes(String(W.state)))throw new G("invalid_job_result")}if(W.pty!==void 0){let F=W.pty;if(!U(F)||!B(F,["version","cols","rows","output","cleanup"])||F.version!==H||!C(W.jobId)||!z(F)||W.output.length!==0||!Array.isArray(F.output)||F.output.length>y||(V?F.cleanup!=="pending":W.state==="uncertain"?F.cleanup!=="unconfirmed":F.cleanup!=="confirmed")||W.state==="running"&&(W.process===void 0||W.environmentRevision===void 0))throw new G("invalid_job_result");let T=Number(W.firstCursor)-1,P=0;for(let Q of F.output){if(!U(Q)||!B(Q,["cursor","dataBase64"])||!Number.isSafeInteger(Q.cursor)||Number(Q.cursor)<=T||Number(Q.cursor)>Number(W.nextCursor))throw new G("invalid_job_result");let q=E(Q.dataBase64);if(q<=0||(P+=q)>c)throw new G("invalid_job_result");T=Number(Q.cursor)}}return A}function qA(x){if(g(x)>s)throw new G("frame_too_large");let A=$(x);if(!U(A)||!B(A,["version","sessionId","operationId","runId","deviceId","rootId","workspace","binding","targetRevision","rootGrantRevision","generation","fenceId","executorLaunchId","job"])||A.version!==H||![A.sessionId,A.operationId,A.runId].every(M)||![A.deviceId,A.rootId,A.fenceId,A.executorLaunchId].every(J)||!Z(A.generation)||!Number.isSafeInteger(A.rootGrantRevision)||Number(A.rootGrantRevision)<1||!["workspace_source","mcp_control"].includes(String(A.binding))||!Number.isSafeInteger(A.targetRevision)||Number(A.targetRevision)<0||A.binding==="workspace_source"&&A.targetRevision!==0||!U(A.workspace))throw new G("invalid_pty_receipt");if(!f(A.workspace))throw new G("invalid_pty_receipt");let W=MA(JSON.stringify({type:"job_result",version:I,generation:A.generation,id:A.operationId,ok:!0,job:A.job}));if(!W.ok||!W.job.pty||W.job.pty.output.length!==0||W.job.process&&W.job.process.executorLaunchId!==A.executorLaunchId)throw new G("invalid_pty_receipt");return A}function yA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","id","targetId"])||A.type!=="cancel_request"||A.version!==I||!Z(A.generation)||!M(A.id)||!M(A.targetId))throw new G("invalid_cancel_request");return A}function mA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","id","targetId","status"])||A.type!=="cancel_ack"||A.version!==I||!Z(A.generation)||!M(A.id)||!M(A.targetId)||!["cancelled","settled","not_found","unsupported","unconfirmed"].includes(String(A.status)))throw new G("invalid_cancel_ack");return A}function wA(x){let A=JSON.stringify(x);return BA(A),A}function hA(x){let A=JSON.stringify(x);return UA(A),A}function fA(x){let A=JSON.stringify(x);return FA(A),A}function kA(x){let A=JSON.stringify(x);return IA(A),A}function HA(x){let A=JSON.stringify(x);return XA(A),A}function O(x){return typeof x==="string"&&x.length>=1&&x.length<=AA&&!x.includes("\x00")}function VA(x){let A=["type","version","generation","id","jobRequestId","verb"];if(x.verb==="help")return B(x,A)?{verb:"help"}:null;if(x.verb==="describe"||x.verb==="namespace")return B(x,[...A,"name"])&&O(x.name)?{verb:x.verb,name:x.name}:null;if(x.verb==="search"){let W=x.args;if(!B(x,[...A,"query","args"])||typeof x.query!=="string"||x.query.trim().length<1||x.query.length>xA)return null;if(W===void 0)return{verb:"search",query:x.query};if(!U(W)||!B(W,["namespace","limit"])||W.namespace!==void 0&&!O(W.namespace)||W.limit!==void 0&&(!Number.isSafeInteger(W.limit)||Number(W.limit)<1||Number(W.limit)>50))return null;return{verb:"search",query:x.query,args:{...typeof W.namespace==="string"?{namespace:W.namespace}:{},...W.limit===void 0?{}:{limit:Number(W.limit)}}}}if(x.verb!=="call"||!B(x,[...A,"name","args"])||!O(x.name)||!U(x.args)||JSON.stringify(x.args).length>K)return null;return{verb:"call",name:x.name,args:x.args}}function gA(x){let A=$(x);if(!U(A)||A.type!=="sdk_request"||A.version!==I||!Z(A.generation)||!M(A.id)||!M(A.jobRequestId))throw new G("invalid_sdk_request");let W=VA(A);if(!W)throw new G("invalid_sdk_request");return{type:"sdk_request",version:I,generation:Number(A.generation),id:A.id,jobRequestId:A.jobRequestId,...W}}function ZA(x){let A=$(x);if(!U(A)||A.type!=="sdk_response"||A.version!==I||!Z(A.generation)||!M(A.id))throw new G("invalid_sdk_response");let W={type:"sdk_response",version:I,generation:Number(A.generation),id:A.id},N=["type","version","generation","id","ok"];if(A.ok===!0&&B(A,[...N,"result"])&&typeof A.result==="string"&&A.result.length<=_)return{...W,ok:!0,result:A.result};if(A.ok===!1&&B(A,[...N,"error"])&&typeof A.error==="string"&&A.error.length>=1&&A.error.length<=_)return{...W,ok:!1,error:A.error};throw new G("invalid_sdk_response")}function EA(x){let A=JSON.stringify(x);return ZA(A),A}
-export{$A as gf,KA as hf,QA as if,I as jf,b as kf,K as lf,D as mf,_ as nf,YA as of,p as pf,k as qf,i as rf,d as sf,y as tf,LA as uf,s as vf,H as wf,m as xf,c as yf,OA as zf,n as Af,t as Bf,r as Cf,zA as Df,l as Ef,SA as Ff,a as Gf,w as Hf,AA as If,xA as Jf,WA as Kf,G as Lf,M as Mf,Z as Nf,J as Of,C as Pf,S as Qf,BA as Rf,UA as Sf,FA as Tf,IA as Uf,XA as Vf,TA as Wf,MA as Xf,qA as Yf,yA as Zf,mA as _f,wA as $f,hA as ag,fA as bg,kA as cg,HA as dg,gA as eg,ZA as fg,EA as gg};
+export{$A as kf,KA as lf,QA as mf,I as nf,b as of,K as pf,D as qf,_ as rf,YA as sf,p as tf,k as uf,i as vf,d as wf,y as xf,LA as yf,s as zf,H as Af,m as Bf,c as Cf,OA as Df,n as Ef,t as Ff,r as Gf,zA as Hf,l as If,SA as Jf,a as Kf,w as Lf,AA as Mf,xA as Nf,WA as Of,G as Pf,M as Qf,Z as Rf,J as Sf,C as Tf,S as Uf,BA as Vf,UA as Wf,FA as Xf,IA as Yf,XA as Zf,TA as _f,MA as $f,qA as ag,yA as bg,mA as cg,wA as dg,hA as eg,fA as fg,kA as gg,HA as hg,gA as ig,ZA as jg,EA as kg};

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,2 +1,2 @@
 // @bun
-import"./vm-hands-entry-lite-mgn96c0f.js";import"./vm-hands-entry-lite-btwvn63p.js";import"./vm-hands-entry-lite-q6fshf3h.js";import{Oh as A}from"./vm-hands-entry-lite-hf0mk7vd.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-krvw3y2n.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-t87hg6ne.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();
+import"./vm-hands-entry-lite-7ve198cs.js";import"./vm-hands-entry-lite-n4xx6qfr.js";import"./vm-hands-entry-lite-kqn1bkrr.js";import{Sh as A}from"./vm-hands-entry-lite-t3gpbwqp.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-4a4e5cmr.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-wv3mr81c.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();

package/bin/vm-hands/{vm-hands-executor-sd4qj8xc.js → vm-hands-executor-ggktb5tz.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ka as Kq,ob as Bq,qa as Yq,sb as Tq}from"./vm-hands-entry-lite-c3jqrn7n.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-btwvn63p.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-gx1z18j4.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";import{spawn as wq}from"child_process";import{chmodSync as Pq,chownSync as Dq,existsSync as t,lstatSync as s,mkdirSync as e,mkdtempSync as jq,readdirSync as p,readFileSync as A,realpathSync as Aq,rmdirSync as r,rmSync as fq,writeFileSync as c}from"fs";import{join as L}from"path";var Uq="/sys/fs/cgroup/reason-payload",S="vm-hands",Cq="/run/ara-srt/fallbacks.jsonl",u="/reason-person",qq=5000,vq=1e4,Xq="__VM_HANDS_PROOF_DIR__",Oq="__VM_HANDS_PROBE_NONCE__";class R extends Error{code;constructor(q,z){super(z);this.code=q}}function Vq(q,z){if(!/^[0-9a-f-]{36}$/i.test(z))throw new R("vm_hands_bind_invalid","bad bind id");return L(q,S,`b-${z.toLowerCase()}`)}var bq=30000,Lq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function lq(q){let z=q.cgroup??Uq,K=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,Y=new Map,B=0,O=()=>{try{let Z=A("/run/ara-srt/starts.jsonl","utf8"),$=Z.slice(B>Z.length?0:B).split(`
+import{Ka as Kq,ob as Bq,qa as Yq,sb as Tq}from"./vm-hands-entry-lite-m8tb88zv.js";import"./vm-hands-entry-lite-q8b738zj.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-n4xx6qfr.js";import"./vm-hands-entry-lite-kqn1bkrr.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-vreqarwc.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-t3gpbwqp.js";import{spawn as wq}from"child_process";import{chmodSync as Pq,chownSync as Dq,existsSync as t,lstatSync as s,mkdirSync as e,mkdtempSync as jq,readdirSync as p,readFileSync as A,realpathSync as Aq,rmdirSync as r,rmSync as fq,writeFileSync as c}from"fs";import{join as L}from"path";var Uq="/sys/fs/cgroup/reason-payload",S="vm-hands",Cq="/run/ara-srt/fallbacks.jsonl",u="/reason-person",qq=5000,vq=1e4,Xq="__VM_HANDS_PROOF_DIR__",Oq="__VM_HANDS_PROBE_NONCE__";class R extends Error{code;constructor(q,z){super(z);this.code=q}}function Vq(q,z){if(!/^[0-9a-f-]{36}$/i.test(z))throw new R("vm_hands_bind_invalid","bad bind id");return L(q,S,`b-${z.toLowerCase()}`)}var bq=30000,Lq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function lq(q){let z=q.cgroup??Uq,K=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,Y=new Map,B=0,O=()=>{try{let Z=A("/run/ara-srt/starts.jsonl","utf8"),$=Z.slice(B>Z.length?0:B).split(`
 `).filter(Boolean);B=Z.length;let Q=$.map((T)=>{try{return Number(JSON.parse(T).elapsed_ms)||0}catch{return 0}});if(Q.length)X("vm_hands.srt_server_starts",{count:Q.length,elapsed_ms:Q.slice(0,8)})}catch{}},j=null,_=!1,h=q.srtCgroup??"/sys/fs/cgroup/reason-srt",f=()=>{j??=Zq()},b=0,x=()=>{try{let Z=A(Cq,"utf8"),$=Z.slice(b>Z.length?0:b);b=Z.length;let Q=$.split(`
 `).filter(Boolean).slice(0,1000);if(!Q.length)return null;let T={},U=0;for(let N of Q)try{let M=JSON.parse(N),F=typeof M.code==="string"&&/^[a-z_]{1,40}$/.test(M.code)?M.code:"other";if(T[F]=(T[F]??0)+1,typeof M.elapsed_ms==="number")U=Math.max(U,M.elapsed_ms)}catch{T.unparsed=(T.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:Q.length,codes:T,max_elapsed_ms:U}),{count:Q.length,codes:T,max_elapsed_ms:U}}catch{return null}},w=!1,y=(Z,$,Q)=>{if(w)throw Error("vm_hands_pool_held");return n(Z,$,Q)},i=(Z)=>($,Q,T)=>wq("/bin/sh",["-c",`echo $$ > ${Lq(L(Z,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",$,...Q],T),n=i(L(z,S)),g=(Z)=>Vq(z,Z),Mq=(Z)=>{let $=g(Z);try{e($,{mode:493})}catch(Q){if(!(Q&&typeof Q==="object"&&("code"in Q)&&Q.code==="EEXIST"))throw new R("vm_hands_bind_failed","bind cgroup")}return $},Nq=(Z)=>{try{r(g(Z))}catch{}},I=q.prespawn?Kq({spawnProcess:y,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(Z,$)=>X(Z,$??{})}):null;I?.arm();let a=I?setInterval(()=>{I.arm()},bq):null;a?.unref?.();async function m(Z){let $=G.get(Z);if(G.delete(Z),!$)return;$.abort.abort(),await $.done}return{bindCgroup:g,async startExecutor(Z){if(f(),Y.set(Z.bindId,Zq()),_=!0,!Z.claim)throw new R("vm_hands_bind_invalid","an executor needs the claim it serves");await m(Z.bindId);let{claim:$,bindId:Q}=Z,T=Mq(Q),U=$.owner;if(!U||typeof U.device_id!=="string"||typeof $.root_id!=="string")throw new R("vm_hands_bind_invalid","claim without its owner Device or root");let N=new AbortController,M,F,D=new Promise((W,P)=>{M=W,F=P}),v,C=new Promise((W)=>{v=W}),V=Tq({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:U.device_id,rootId:$.root_id,apiOrigin:q.apiOrigin},claimOwner:$.owner,root:q.root,runId:$.run_id,operationId:$.operation_id,attemptId:$.attempt_id,payload:Object.fromEntries(Object.entries($.payload).filter(([W])=>!W.startsWith("vm_hands_"))),signal:N.signal,emitEvent:async(W,P)=>{if(W==="hands.ready"){M(P);return}if(W==="hands.started"||W==="hands.stopped"||W==="hands.failed")return;await q.forward(Q,W,P)}},{...q.relayDependencies,spawnWorker:(W)=>i(T)(W.command,W.args,W.options),...I?{takePrespawnedWorker:(W)=>{let P=I.take(W);if(!P?.pid)return P;try{return c(L(T,"cgroup.procs"),String(P.pid)),P}catch{try{P.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:I.adopt}:{}}).then(()=>{v("executor_stopped")},(W)=>{let P=W&&typeof W==="object"&&"code"in W?String(W.code):"executor_failed";F(new R(P,W instanceof Error?W.message:String(W))),v(P)}).finally(()=>F(new R("vm_hands_executor_exited","executor ended before it was ready")));G.set(Q,{abort:N,done:V,exited:C,operationId:$.operation_id,runId:$.run_id,expiresAtMs:Date.parse(String($.payload.expires_at??""))||0});let E=await D,J=E.executor_launch_id;if(typeof J!=="string")throw new R("vm_hands_bind_failed","executor ready without a launch id");return{launchId:J,readyData:E,applied:{hands_confinement:typeof $.payload.hands_confinement==="string"?$.payload.hands_confinement:null,browser_egress:$.payload.browser_egress??null}}},takeSrtFallbacks:x,executorExited(Z){return G.get(Z)?.exited??new Promise(()=>{})},freezeBind(Z){let $=g(Z);if(t(L($,"cgroup.freeze")))c(L($,"cgroup.freeze"),"1")},async killAndVerifyPayload(Z){let $=new Set(Z?.keep??[]);if($.size)return Rq(Z?.bindId??null,$);w=!0;let Q=Wq();try{await Jq();let T=Promise.all([...G.keys()].map((F)=>m(F).catch(()=>{return})));O();let U=Date.now()+qq;await d(z,U,"payload"),await T;let N=(_||q.srtWarmLate?.()===!0)&&t(L(h,"cgroup.events"));if(N)await d(h,U,"srt");let M=Qq(K).filter((F)=>!k(F,u));if(j!==null){let F=$q(j).filter((D)=>D!==process.pid&&!k(D,u));if(F.length)throw X("vm_hands.kill_strays",{strays:F.slice(0,16).map((D)=>{let v="?",C="?";try{v=A(`/proc/${D}/comm`,"utf8").trim().slice(0,32)}catch{}try{C=(A(`/proc/${D}/cgroup`,"utf8").split(`
 `).find((V)=>V.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:D,comm:v,cgroup:C}})}),new R("vm_hands_kill_unverified",`${F.length} process(es) the run started survived it`);j=null}if(_=!1,N)q.onSrtReset?.();if(M.length)throw X("vm_hands.kill_survivors",{pids:M.slice(0,16)}),new R("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside the payload cgroup`);Y.clear();for(let F of o())try{r(L(z,S,F))}catch{}}finally{w=!1,Q()}if(I)setTimeout(()=>{if(!G.size)I.arm()},100).unref?.()},async runProbe({nonce:Z,script:$}){if(f(),!$.includes(Xq))throw new R("vm_hands_probe_failed","probe names no proof directory");let Q=q.proofParent??"/tmp/reason-vm-hands-proof";e(Q,{mode:457,recursive:!0});let T=s(Q);if(T.isSymbolicLink()||!T.isDirectory()||T.uid!==(process.getuid?.()??-1)||(T.mode&4095)!==457)throw new R("vm_hands_probe_failed","proof parent is not root's 0711 directory");let U=jq(L(Q,"p-")),N=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(U)||!/^[A-Za-z0-9_-]{1,128}$/.test(Z))throw new R("vm_hands_probe_failed","proof directory path or nonce");Dq(U,K,K),Pq(U,448);let M=s(U).ino,F=n("/bin/bash",["-c",$.replaceAll(Xq,U).replaceAll(Oq,Z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),D="";F.stdout?.on("data",(C)=>{if(D.length<16384)D+=C.toString("utf8").slice(0,16384-D.length)});let v=await new Promise((C)=>{let V=setTimeout(()=>{N=!0,F.kill("SIGKILL"),C(124)},vq);F.once("error",()=>{clearTimeout(V),C(127)}),F.once("close",(E)=>{clearTimeout(V),C(E??1)})});return X("vm_hands.probe",{nonce_len:Z.length,exit_code:v}),{exitCode:v,markers:D,proofDirInode:M}}finally{if(!N)fq(U,{recursive:!0,force:!0})}},restatLayout(){let{session_root:Z,alias:$}=q.init.layout,Q="invalid";try{Bq(Z),Q="0:0:755"}catch{}let T=!1,U=-1;try{let N=s($);U=N.uid,T=Q==="0:0:755"&&$===L(Z,"repo")&&!N.isSymbolicLink()&&N.isDirectory()&&Aq($)===$&&N.uid===K}catch{}return{root_mode:Q,alias_ok:T,owner_uid:U}},installEnvironment(Z,$){let Q=G.get(Z);if(!Q)throw new R("environment_unavailable","no executor owns an environment");return Yq({root:q.root,operationId:Q.operationId,payload:$}).installed_revision},async stop(){if(a)clearInterval(a);I?.close(),await Promise.all([...G.keys()].map((Z)=>m(Z)))}};function o(){try{return p(L(z,S),{withFileTypes:!0}).filter((Z)=>Z.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(Z.name)).map((Z)=>Z.name)}catch{return[]}}async function Rq(Z,$){let Q=new Set([...$].map((U)=>U.toLowerCase())),T=Wq();try{await Jq();let U=Date.now()+qq,N=new Set(o().filter((J)=>!Q.has(J.slice(2))).map((J)=>J.slice(2)));if(Z)N.add(Z.toLowerCase());let M=null;for(let J of N){let W=m(J).catch(()=>{return}),P=Y.get(J);if(P!==void 0)M=M===null?P:Math.min(M,P);if(t(L(g(J),"cgroup.events")))await d(g(J),U,"bind");await W}let F=[...Q].map((J)=>g(J).replace(/^\/sys\/fs\/cgroup/,"")),D=[z,L(z,S)].map((J)=>J.replace(/^\/sys\/fs\/cgroup/,"")),v=h.replace(/^\/sys\/fs\/cgroup/,""),C=(J)=>k(J,u)||F.some((W)=>k(J,W)),V=Qq(K).filter((J)=>!C(J));if(V.length)throw X("vm_hands.kill_survivors",{pids:V.slice(0,16),beside:Q.size}),new R("vm_hands_kill_unverified",`${V.length} payload-uid process(es) outside a live bind`);let E=(J)=>!C(J)&&!k(J,"/reason-vm-hands")&&!k(J,v)&&!D.some((W)=>xq(J,W));if(M!==null){let J=$q(M).filter((W)=>W!==process.pid&&E(W));if(J.length)throw X("vm_hands.kill_strays",{strays:J.slice(0,16).map((W)=>({pid:W})),beside:Q.size}),new R("vm_hands_kill_unverified",`${J.length} process(es) the run started survived it`)}for(let J of N)Y.delete(J),Nq(J)}finally{T()}}}function xq(q,z,K="/proc"){try{return A(L(K,String(q),"cgroup"),"utf8").split(`

package/bin/vm-hands/{vm-hands-op-runner-krvw3y2n.js → vm-hands-op-runner-4a4e5cmr.js}

@@ -1,2 +1,2 @@
 // @bun
-import{Oh as E}from"./vm-hands-entry-lite-hf0mk7vd.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-6smn23kd.js"),import("./desktop-account-axaenf68.js"),import("./worker-sandbox-snmfpfax.js")]);J();let K=(process.geteuid?.()??0)!==0,z=new Map,y=(B)=>{try{process.send?.(B)}catch{}};process.on("message",(B)=>{let j=B;if(j?.t==="cancel"){z.get(j.id)?.abort();return}if(j?.t!=="op")return;if(!K){y({t:"done",id:j.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let F=new AbortController;z.set(j.id,F),G(j.state,j.claim,{worker:j.worker,signal:F.signal,emit:(q)=>{let{deliverySignal:N,...M}=q;y({t:"event",id:j.id,event:M})}}).then((q)=>y({t:"done",id:j.id,completion:q}),(q)=>y({t:"done",id:j.id,completion:{status:"failed",error_code:q&&typeof q==="object"&&"code"in q&&typeof q.code==="string"?q.code:"vm_hands_op_failed"}})).finally(()=>z.delete(j.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}export{Q as runVmHandsOpRunner};
+import{Sh as E}from"./vm-hands-entry-lite-t3gpbwqp.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-nx9mgygs.js"),import("./desktop-account-e9asw4vf.js"),import("./worker-sandbox-7zfttr2t.js")]);J();let K=(process.geteuid?.()??0)!==0,z=new Map,y=(B)=>{try{process.send?.(B)}catch{}};process.on("message",(B)=>{let j=B;if(j?.t==="cancel"){z.get(j.id)?.abort();return}if(j?.t!=="op")return;if(!K){y({t:"done",id:j.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let F=new AbortController;z.set(j.id,F),G(j.state,j.claim,{worker:j.worker,signal:F.signal,emit:(q)=>{let{deliverySignal:N,...M}=q;y({t:"event",id:j.id,event:M})}}).then((q)=>y({t:"done",id:j.id,completion:q}),(q)=>y({t:"done",id:j.id,completion:{status:"failed",error_code:q&&typeof q==="object"&&"code"in q&&typeof q.code==="string"?q.code:"vm_hands_op_failed"}})).finally(()=>z.delete(j.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}export{Q as runVmHandsOpRunner};

package/bin/vm-hands/{vm-hands-runtime-t87hg6ne.js → vm-hands-runtime-wv3mr81c.js}

@@ -1,4 +1,4 @@
 // @bun
-import{u as k,v as m,w as l}from"./vm-hands-entry-lite-mgn96c0f.js";import{Wc as v}from"./vm-hands-entry-lite-btwvn63p.js";import"./vm-hands-entry-lite-q6fshf3h.js";import{Oh as F}from"./vm-hands-entry-lite-hf0mk7vd.js";import{spawn as a}from"child_process";import{createHash as r}from"crypto";import{lstatSync as x,mkdirSync as s,readFileSync as i,statSync as t,writeFileSync as d}from"fs";var V="/run/reason-vm-hands",R="/run/reason-vm-hands/env",w="/home/runner",e=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,O="/sys/fs/cgroup/reason-srt",S="/usr/local/bin/ara-srt-exec",jj=65536,qj=21600000;function Jj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=x(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
-`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function p(Q,j){let J=(K)=>{return j("srt_warm_skipped",{reason:K}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>jj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let K=x(O);if(!K.isDirectory()||K.uid!==0||(K.mode&18)!==0)return J("cgroup_unsafe");for(let[W,g]of[[S,!1],["/usr/local/bin",!0]]){let B=x(W);if((g?!B.isDirectory():!B.isFile())||B.uid!==0||(B.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let z=performance.now(),X=r("sha256").update(Z).digest("hex"),N=`${V}/srt-base-settings.json`;try{d(N,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let H=a("/bin/sh",["-c",`echo $$ > ${O}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",S,"--settings",N,"--idle-ms",String(qj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((K)=>{H.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),K()}),H.once("close",(W)=>{j(W===0?"srt_warm_done":"srt_warm_failed",{exit_code:W,warm_ms:Math.round(performance.now()-z),settings_sha256:X}),K()})})}var y=3000;function Wj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,z=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&e.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!z&&typeof z.key_id==="string"&&Number.isSafeInteger(z.expires_at_ms)&&typeof z.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function u(Q){s(Q,{recursive:!0,mode:448});let j=t(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Qj(Q){let[{CLI_VERSION:j},J,Z,z]=await Promise.all([import("./version-ktk9b8p6.js"),import("./hands-worker-source-w477y8ad.js"),import("./network-contract-57qe40tm.js"),import("./device-workspace-ecq3hfd6.js")]),{REASON_HANDS_PROTOCOL_VERSION:X}=await import("./reason-hands-protocol-as5477xr.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:X,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:z.REASON_WORKSPACE_BASE,workspace_layout:z.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var C=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],Zj=new Set(["pty.start","jobs.control"]);function $j(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:w,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(C.map((X)=>[X,!0]))}}),Z=Q.capabilities,z={...Z.operation_constraints};for(let X of C)z[X]={...J.operation_constraints?.[X]??{},ready:!0,execution_mode:J.operation_constraints?.[X]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...C],operation_constraints:z}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
-`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Xj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:w,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Hj(Q,j){u(V),u(R),Jj(j);let J=p(Q,j),Z=!1,z=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),y).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:y})},[{configureDesktopAccount:X},{configureWorkerSandbox:N}]=await Promise.all([import("./desktop-account-axaenf68.js"),import("./worker-sandbox-snmfpfax.js")]);N();try{X({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let H=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>H.abort());let K=new Map,W,g=new Promise((q)=>{W=q}),B=g.then(()=>import("./vm-hands-executor-sd4qj8xc.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:w,runtimeDirectory:V,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=p(Q,j)},srtWarmLate:()=>Z,forward:(U,G,M)=>K.get(U)?.(G,M)??Promise.reject(Error("vm_hands_not_bound")),log:(U,G)=>j(U,G)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await B)[q](...$),D=null;B.then((q)=>{D=($)=>q.executorExited($)});let L={startExecutor:async(...q)=>{return await z(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),runProbe:async(...q)=>{return await z(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>D?D(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};B.then((q)=>{L.restatLayout=()=>q.restatLayout(),L.installEnvironment=($,U)=>q.installEnvironment($,U),L.freezeBind=($)=>q.freezeBind($),L.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,L,{envRoot:R}),h=Qj(Q),b=null,n=Promise.all([h,import("./local-capabilities-6smn23kd.js")]).then(([q,$])=>{b=$j(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),T=g.then(()=>import("./vm-hands-executor-sd4qj8xc.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:U})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(G)=>$(U,G),log:(G,M)=>j(G,M)})).catch(()=>null);T.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:H.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:U,signal:G,emit:M})=>{let f=Xj(Q,$);if(!f)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:V,readiness:Object.fromEntries(C.map((Y)=>[Y,!0]))},_=(Y)=>{let P=typeof Y.kind==="string"?Y.kind:"";if(P)M({kind:P,...Y.data&&typeof Y.data==="object"?{data:Y.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};if(Zj.has(String($.capability))){let{executeLocalOperation:Y}=await import("./local-capabilities-6smn23kd.js");return Y(f,$,{worker:E,signal:G,emit:(P)=>_(P)})}let I=await T;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:f,worker:E},_,G,U)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")W();j(q,$)},onTurn:(q,$)=>{if($)K.set(q,$);else K.delete(q)}}),await(await B).stop(),(await T)?.stop()}export{p as startBaseSrtServer,Hj as runVmHands,Wj as parseVmHandsInit,Qj as heartbeatBody,Jj as enableBaseKeyedSrt};
+import{u as k,v as m,w as l}from"./vm-hands-entry-lite-7ve198cs.js";import{_c as v}from"./vm-hands-entry-lite-n4xx6qfr.js";import"./vm-hands-entry-lite-kqn1bkrr.js";import{Sh as F}from"./vm-hands-entry-lite-t3gpbwqp.js";import{spawn as a}from"child_process";import{createHash as r}from"crypto";import{lstatSync as x,mkdirSync as s,readFileSync as i,statSync as t,writeFileSync as d}from"fs";var V="/run/reason-vm-hands",R="/run/reason-vm-hands/env",w="/home/runner",e=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,O="/sys/fs/cgroup/reason-srt",S="/usr/local/bin/ara-srt-exec",jj=65536,qj=21600000;function Jj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=x(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
+`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function p(Q,j){let J=(K)=>{return j("srt_warm_skipped",{reason:K}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>jj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let K=x(O);if(!K.isDirectory()||K.uid!==0||(K.mode&18)!==0)return J("cgroup_unsafe");for(let[W,g]of[[S,!1],["/usr/local/bin",!0]]){let B=x(W);if((g?!B.isDirectory():!B.isFile())||B.uid!==0||(B.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let z=performance.now(),X=r("sha256").update(Z).digest("hex"),N=`${V}/srt-base-settings.json`;try{d(N,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let H=a("/bin/sh",["-c",`echo $$ > ${O}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",S,"--settings",N,"--idle-ms",String(qj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((K)=>{H.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),K()}),H.once("close",(W)=>{j(W===0?"srt_warm_done":"srt_warm_failed",{exit_code:W,warm_ms:Math.round(performance.now()-z),settings_sha256:X}),K()})})}var y=3000;function Wj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,z=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&e.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!z&&typeof z.key_id==="string"&&Number.isSafeInteger(z.expires_at_ms)&&typeof z.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function u(Q){s(Q,{recursive:!0,mode:448});let j=t(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Qj(Q){let[{CLI_VERSION:j},J,Z,z]=await Promise.all([import("./version-6qnegds2.js"),import("./hands-worker-source-snbsr08g.js"),import("./network-contract-kxgvk10y.js"),import("./device-workspace-1dm2ry6e.js")]),{REASON_HANDS_PROTOCOL_VERSION:X}=await import("./reason-hands-protocol-7t7mewye.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:X,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:z.REASON_WORKSPACE_BASE,workspace_layout:z.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var C=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],Zj=new Set(["pty.start","jobs.control"]);function $j(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:w,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(C.map((X)=>[X,!0]))}}),Z=Q.capabilities,z={...Z.operation_constraints};for(let X of C)z[X]={...J.operation_constraints?.[X]??{},ready:!0,execution_mode:J.operation_constraints?.[X]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...C],operation_constraints:z}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
+`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Xj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:w,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Hj(Q,j){u(V),u(R),Jj(j);let J=p(Q,j),Z=!1,z=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),y).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:y})},[{configureDesktopAccount:X},{configureWorkerSandbox:N}]=await Promise.all([import("./desktop-account-e9asw4vf.js"),import("./worker-sandbox-7zfttr2t.js")]);N();try{X({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let H=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>H.abort());let K=new Map,W,g=new Promise((q)=>{W=q}),B=g.then(()=>import("./vm-hands-executor-ggktb5tz.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:w,runtimeDirectory:V,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=p(Q,j)},srtWarmLate:()=>Z,forward:(U,G,M)=>K.get(U)?.(G,M)??Promise.reject(Error("vm_hands_not_bound")),log:(U,G)=>j(U,G)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await B)[q](...$),D=null;B.then((q)=>{D=($)=>q.executorExited($)});let L={startExecutor:async(...q)=>{return await z(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),runProbe:async(...q)=>{return await z(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>D?D(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};B.then((q)=>{L.restatLayout=()=>q.restatLayout(),L.installEnvironment=($,U)=>q.installEnvironment($,U),L.freezeBind=($)=>q.freezeBind($),L.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,L,{envRoot:R}),h=Qj(Q),b=null,n=Promise.all([h,import("./local-capabilities-nx9mgygs.js")]).then(([q,$])=>{b=$j(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),T=g.then(()=>import("./vm-hands-executor-ggktb5tz.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:U})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(G)=>$(U,G),log:(G,M)=>j(G,M)})).catch(()=>null);T.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:H.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:U,signal:G,emit:M})=>{let f=Xj(Q,$);if(!f)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:V,readiness:Object.fromEntries(C.map((Y)=>[Y,!0]))},_=(Y)=>{let P=typeof Y.kind==="string"?Y.kind:"";if(P)M({kind:P,...Y.data&&typeof Y.data==="object"?{data:Y.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};if(Zj.has(String($.capability))){let{executeLocalOperation:Y}=await import("./local-capabilities-nx9mgygs.js");return Y(f,$,{worker:E,signal:G,emit:(P)=>_(P)})}let I=await T;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:f,worker:E},_,G,U)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")W();j(q,$)},onTurn:(q,$)=>{if($)K.set(q,$);else K.delete(q)}}),await(await B).stop(),(await T)?.stop()}export{p as startBaseSrtServer,Hj as runVmHands,Wj as parseVmHandsInit,Qj as heartbeatBody,Jj as enableBaseKeyedSrt};

package/bin/vm-hands/worker-sandbox-7zfttr2t.js

@@ -0,0 +1,2 @@
+// @bun
+import{t as a}from"./vm-hands-entry-lite-xf6schkk.js";import"./vm-hands-entry-lite-93ejmwqn.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-t3gpbwqp.js";export{a as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-arm64-musl",
-  "version": "0.2.315",
+  "version": "0.2.317",
   "description": "Reason CLI native binary for linux-arm64-musl",
   "os": [
     "linux"

package/bin/vm-hands/connect-cli-kxkvwnwa.js

@@ -1,2 +0,0 @@
-// @bun
-import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-79ww0h62.js";import"./vm-hands-entry-lite-bswnp5ve.js";import"./vm-hands-entry-lite-t4hkghhm.js";import"./vm-hands-entry-lite-c3jqrn7n.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-ya1a2eep.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-0ergg2ky.js";import"./vm-hands-entry-lite-v2wx52wn.js";import"./vm-hands-entry-lite-btwvn63p.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-msgz8sgz.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-53cyjs1a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-5z6prrcd.js";import"./vm-hands-entry-lite-gx1z18j4.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};

package/bin/vm-hands/custom-endpoint-device-p2bvtf6p.js

@@ -1,2 +0,0 @@
-// @bun
-import{$b as b,_b as a,ac as c,bc as d,cc as e,dc as f,ec as g,fc as h,gc as i,hc as j,ic as k,jc as l,kc as m}from"./vm-hands-entry-lite-0ergg2ky.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{h as customEndpointRequestMatchesConfig,i as CustomEndpointDeviceRequestSchema,l as CustomEndpointDeviceReceiptSchema,j as CustomEndpointDeviceHeadersSchema,m as CustomEndpointDeviceCredentialSchema,k as CustomEndpointDeviceChunkSchema,f as CUSTOM_ENDPOINT_DEVICE_TIMEOUT_MS,g as CUSTOM_ENDPOINT_DEVICE_SAFE_HEADERS,c as CUSTOM_ENDPOINT_DEVICE_MAX_RESPONSE_BYTES,d as CUSTOM_ENDPOINT_DEVICE_MAX_CHUNKS,e as CUSTOM_ENDPOINT_DEVICE_MAX_BODY_BYTES,b as CUSTOM_ENDPOINT_DEVICE_CHUNK_BYTES,a as CUSTOM_ENDPOINT_DEVICE_CAPABILITY};

package/bin/vm-hands/desktop-account-axaenf68.js

@@ -1,2 +0,0 @@
-// @bun
-import{Vg as a,Wg as b,Xg as c,Yg as d,Zg as e}from"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{b as passwdAccount,e as desktopHome,d as desktopAccount,c as configureDesktopAccount,a as DESKTOP_USER_ENV};

package/bin/vm-hands/local-automation-7w9j1nws.js

@@ -1,2 +0,0 @@
-// @bun
-import{Cc as a,Dc as b,Ec as c,Fc as d,Gc as e,Hc as f,Ic as g,Jc as h,Kc as i,Lc as j,Mc as k,Nc as l}from"./vm-hands-entry-lite-v2wx52wn.js";import"./vm-hands-entry-lite-btwvn63p.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-msgz8sgz.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-53cyjs1a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-5z6prrcd.js";import"./vm-hands-entry-lite-gx1z18j4.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};

package/bin/vm-hands/local-capabilities-6smn23kd.js

@@ -1,2 +0,0 @@
-// @bun
-import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-t4hkghhm.js";import"./vm-hands-entry-lite-c3jqrn7n.js";import"./vm-hands-entry-lite-rrk5g62b.js";import"./vm-hands-entry-lite-ya1a2eep.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b}from"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-0ergg2ky.js";import"./vm-hands-entry-lite-v2wx52wn.js";import"./vm-hands-entry-lite-btwvn63p.js";import"./vm-hands-entry-lite-q6fshf3h.js";import"./vm-hands-entry-lite-msgz8sgz.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-53cyjs1a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-5z6prrcd.js";import"./vm-hands-entry-lite-gx1z18j4.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as a}from"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};

package/bin/vm-hands/local-desktop-users-4756c92y.js

@@ -1,2 +0,0 @@
-// @bun
-import{Dh as a,Eh as b,Fh as c,Gh as d,Hh as e,Ih as f,Jh as g}from"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{f as trackDesktopRun,c as releaseLocalDesktop,a as noteLocalDesktopUse,g as holdLocalDesktop,b as forgetLocalDesktopUse,e as DESKTOP_WAIT_MS,d as DESKTOP_IDLE_MS};

package/bin/vm-hands/local-display-mac-3zz66vzn.js

@@ -1,2 +0,0 @@
-// @bun
-import{Og as a,Pg as b,Qg as c,Rg as d,Sg as e,Tg as f,Ug as g}from"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{c as requestMacScreenAccess,d as parseMacWindowBounds,a as parseMacScreenStatus,e as openMacWindowBounds,g as openMacInput,b as macScreenStatus,f as MacInputTranslator};

package/bin/vm-hands/local-display-session-7pds34s8.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ae as h,te as a,ue as b,ve as c,we as d,xe as e,ye as f,ze as g}from"./vm-hands-entry-lite-msgz8sgz.js";import"./vm-hands-entry-lite-pf1ft65e.js";import"./vm-hands-entry-lite-q2pb31vh.js";import"./vm-hands-entry-lite-53cyjs1a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-7k65s010.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-5z6prrcd.js";import"./vm-hands-entry-lite-gx1z18j4.js";import"./vm-hands-entry-lite-wgx7z7gt.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};

package/bin/vm-hands/package-s6y0j1as.js

@@ -1,2 +0,0 @@
-// @bun
-import{x as a}from"./vm-hands-entry-lite-21qkhpm0.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export default a();

package/bin/vm-hands/permissions-hy10xxeg.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ag as j,rg as a,sg as b,tg as c,ug as d,vg as e,wg as f,xg as g,yg as h,zg as i}from"./vm-hands-entry-lite-53cyjs1a.js";import"./vm-hands-entry-lite-6j2yaa4n.js";import"./vm-hands-entry-lite-em388nee.js";import"./vm-hands-entry-lite-yp315y25.js";import"./vm-hands-entry-lite-5z6prrcd.js";import"./vm-hands-entry-lite-gx1z18j4.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};

package/bin/vm-hands/version-ktk9b8p6.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ah as c,Bh as d,yh as a,zh as b}from"./vm-hands-entry-lite-5z6prrcd.js";import"./vm-hands-entry-lite-gx1z18j4.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};

package/bin/vm-hands/vm-hands-entry-lite-0ergg2ky.js

@@ -1,3 +0,0 @@
-// @bun
-import{ae as j}from"./vm-hands-entry-lite-q6fshf3h.js";var p="inference.custom.v1",R=32768,$=67108864,x=16384,A=204800,z=600000,P=["content-type","anthropic-version","user-agent"],W=j.enum(["openai-completions","openai-responses","anthropic-messages"]),U=new Set(P),V=j.record(j.string(),j.string().max(2048)).refine((w)=>Object.keys(w).every((F)=>U.has(F))&&Object.values(w).every((F)=>!/[\r\n\0]/.test(F)),"Only non-secret custom endpoint request headers are permitted");function J(w){try{let F=new URL(w);return["http:","https:"].includes(F.protocol)&&!F.username&&!F.password&&!F.search&&!F.hash?F:null}catch{return null}}function X(w,F){let G=J(w.baseUrl),K=J(F.baseUrl),H=J(w.url);if(!G||!K||!H||w.method!=="POST"||F.execution!=="device")return!1;let L=(Q)=>Q.origin+Q.pathname.replace(/\/+$/,"");if(L(G)!==L(K)||H.origin!==G.origin)return!1;let Z=F.api==="openai-completions"?"/chat/completions":F.api==="openai-responses"?"/responses":"/v1/messages";return H.pathname===G.pathname.replace(/\/+$/,"")+Z}var B=j.object({baseUrl:j.string().max(2048),url:j.string().max(4096),method:j.literal("POST"),body:j.string().refine((w)=>new TextEncoder().encode(w).byteLength<=A).optional(),headers:V,credentialOrganizationId:j.string().uuid(),accountKey:j.string().min(1).max(256).optional()}).strict().refine((w)=>W.options.some((F)=>X(w,{baseUrl:w.baseUrl,api:F,execution:"device"})),"Invalid custom endpoint inference URL"),C=j.object({status:j.number().int().min(200).max(599),statusText:j.string().max(256).refine((w)=>!/[\r\n\0]/.test(w)),headers:j.record(j.string(),j.string().max(4096)).refine((w)=>Object.keys(w).every((F)=>["content-type","retry-after","x-request-id","request-id"].includes(F))&&Object.values(w).every((F)=>!/[\r\n\0]/.test(F)))}).strict(),I=j.union([j.object({eof:j.literal(!0)}).strict(),j.object({eof:j.literal(!1),data:j.string().max(Math.ceil(R/3)*4).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/).refine((w)=>w.length>0&&w.length*3/4-(w.endsWith("==")?2:w.endsWith("=")?1:0)<=R)}).strict()]),M=j.object({bytes:j.number().int().min(0).max($),chunks:j.number().int().min(0).max(x)}).strict(),N=j.object({apiKey:j.string().min(1).max(16384).refine((w)=>!/[\r\n\0]/.test(w)),api:W}).strict();
-export{p as _b,R as $b,$ as ac,x as bc,A as cc,z as dc,P as ec,X as fc,B as gc,C as hc,I as ic,M as jc,N as kc};

package/bin/vm-hands/worker-sandbox-snmfpfax.js

@@ -1,2 +0,0 @@
-// @bun
-import{t as a}from"./vm-hands-entry-lite-bswnp5ve.js";import"./vm-hands-entry-lite-ya1a2eep.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-xsq25kmd.js";import"./vm-hands-entry-lite-hf0mk7vd.js";export{a as configureWorkerSandbox};