@reason-machines/cli-linux-arm64-musl 0.2.322 → 0.2.324
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/ara +1 -1
- package/bin/vm-hands/{connect-cli-cyt0kpyr.js → connect-cli-m442331x.js} +1 -1
- package/bin/vm-hands/{hands-worker-source-ws7x23xe.js → hands-worker-source-ea5ywzxx.js} +1 -1
- package/bin/vm-hands/{local-automation-5wj4326w.js → local-automation-47saskrh.js} +1 -1
- package/bin/vm-hands/{local-capabilities-aya670gj.js → local-capabilities-3grwqfjy.js} +1 -1
- package/bin/vm-hands/{local-display-session-2y9fgh2a.js → local-display-session-0fvcveme.js} +1 -1
- package/bin/vm-hands/{permissions-dfbchv02.js → permissions-tkfbkjgn.js} +1 -1
- package/bin/vm-hands/{status-ghjnryz1.js → status-0hwr3g05.js} +2 -2
- package/bin/vm-hands/{version-rkf1f8kn.js → version-g7z5w73d.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-59gwvfx9.js +5 -0
- package/bin/vm-hands/{vm-hands-entry-lite-gycydjw0.js → vm-hands-entry-lite-bhsy5j5m.js} +21 -21
- package/bin/vm-hands/{vm-hands-entry-lite-1gbvtqgy.js → vm-hands-entry-lite-fmbrf3ms.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-q8b738zj.js → vm-hands-entry-lite-fq0zr7an.js} +6 -1
- package/bin/vm-hands/{vm-hands-entry-lite-wh9g92n9.js → vm-hands-entry-lite-g000tgq4.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-b92849ds.js → vm-hands-entry-lite-km2gm0ag.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-m1c4h4me.js → vm-hands-entry-lite-r40z2t3v.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-et7c3583.js → vm-hands-entry-lite-zba2cswt.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-88x8hevx.js → vm-hands-entry-lite-zmctncwj.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-n2k92e7f.js → vm-hands-entry-lite-zvkgbra5.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
- package/bin/vm-hands/{vm-hands-executor-bjswhqrs.js → vm-hands-executor-8j76h2s9.js} +1 -1
- package/bin/vm-hands/{vm-hands-op-runner-766rq98c.js → vm-hands-op-runner-76f3p26g.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-xa917sav.js → vm-hands-runtime-x4v4ann1.js} +3 -3
- package/package.json +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-tsd17dcd.js +0 -5
package/bin/ara
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-
|
|
2
|
+
import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-fmbrf3ms.js";import"./vm-hands-entry-lite-xf6schkk.js";import"./vm-hands-entry-lite-zmctncwj.js";import"./vm-hands-entry-lite-bhsy5j5m.js";import"./vm-hands-entry-lite-fq0zr7an.js";import"./vm-hands-entry-lite-93ejmwqn.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-b2wdaq7x.js";import"./vm-hands-entry-lite-km2gm0ag.js";import"./vm-hands-entry-lite-t497ewn2.js";import"./vm-hands-entry-lite-psybjyay.js";import"./vm-hands-entry-lite-r40z2t3v.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-g000tgq4.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-zvkgbra5.js";import"./vm-hands-entry-lite-zba2cswt.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ab as a,Bb as b,Cb as c,Db as d,Eb as e,Fb as f,Gb as g,Hb as h,Ib as i}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ab as a,Bb as b,Cb as c,Db as d,Eb as e,Fb as f,Gb as g,Hb as h,Ib as i}from"./vm-hands-entry-lite-fq0zr7an.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{e as selectCloudChildPath,a as REASON_HANDS_WORKER_VERSION,h as REASON_HANDS_WORKER_SOURCE,b as REASON_HANDS_WORKER_ENTRYPOINT,i as REASON_HANDS_WORKER_ARTIFACT_SHA256,f as REASON_HANDS_MAC_PTY_MEMBER_SOURCE,g as REASON_HANDS_LINUX_PTY_PROBE_SOURCE,d as REASON_HANDS_CLOUD_CHILD_PATH_MACOS,c as REASON_HANDS_CLOUD_CHILD_PATH_LINUX};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Gc as a,Hc as b,Ic as c,Jc as d,Kc as e,Lc as f,Mc as g,Nc as h,Oc as i,Pc as j,Qc as k,Rc as l}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Gc as a,Hc as b,Ic as c,Jc as d,Kc as e,Lc as f,Mc as g,Nc as h,Oc as i,Pc as j,Qc as k,Rc as l}from"./vm-hands-entry-lite-km2gm0ag.js";import"./vm-hands-entry-lite-t497ewn2.js";import"./vm-hands-entry-lite-psybjyay.js";import"./vm-hands-entry-lite-r40z2t3v.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-g000tgq4.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-zvkgbra5.js";import"./vm-hands-entry-lite-zba2cswt.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-
|
|
2
|
+
import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-zmctncwj.js";import"./vm-hands-entry-lite-bhsy5j5m.js";import"./vm-hands-entry-lite-fq0zr7an.js";import"./vm-hands-entry-lite-93ejmwqn.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b}from"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-b2wdaq7x.js";import"./vm-hands-entry-lite-km2gm0ag.js";import"./vm-hands-entry-lite-t497ewn2.js";import"./vm-hands-entry-lite-psybjyay.js";import"./vm-hands-entry-lite-r40z2t3v.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-g000tgq4.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-zvkgbra5.js";import"./vm-hands-entry-lite-zba2cswt.js";import"./vm-hands-entry-lite-14t846kp.js";import{Oh as a}from"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};
|
package/bin/vm-hands/{local-display-session-2y9fgh2a.js → local-display-session-0fvcveme.js}
RENAMED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ae as d,Be as e,Ce as f,De as g,Ee as h,xe as a,ye as b,ze as c}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ae as d,Be as e,Ce as f,De as g,Ee as h,xe as a,ye as b,ze as c}from"./vm-hands-entry-lite-r40z2t3v.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-g000tgq4.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-zvkgbra5.js";import"./vm-hands-entry-lite-zba2cswt.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ag as f,Bg as g,Cg as h,Dg as i,Eg as j,vg as a,wg as b,xg as c,yg as d,zg as e}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ag as f,Bg as g,Cg as h,Dg as i,Eg as j,vg as a,wg as b,xg as c,yg as d,zg as e}from"./vm-hands-entry-lite-g000tgq4.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-zvkgbra5.js";import"./vm-hands-entry-lite-zba2cswt.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{a as Wq,b as Bq,c as bq,d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-
|
|
2
|
+
import{a as Wq,b as Bq,c as bq,d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-fmbrf3ms.js";import"./vm-hands-entry-lite-xf6schkk.js";import"./vm-hands-entry-lite-zmctncwj.js";import"./vm-hands-entry-lite-bhsy5j5m.js";import"./vm-hands-entry-lite-fq0zr7an.js";import"./vm-hands-entry-lite-93ejmwqn.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-b2wdaq7x.js";import{pc as jq}from"./vm-hands-entry-lite-km2gm0ag.js";import"./vm-hands-entry-lite-t497ewn2.js";import{ee as G}from"./vm-hands-entry-lite-psybjyay.js";import"./vm-hands-entry-lite-r40z2t3v.js";import{Ie as H,Je as u,Ke as s,ff as Qq}from"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-g000tgq4.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-mzxhng4z.js";import{ch as l}from"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import{Ch as R}from"./vm-hands-entry-lite-zvkgbra5.js";import"./vm-hands-entry-lite-zba2cswt.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import{Uh as $q}from"./vm-hands-entry-lite-cxs89wzv.js";import{createHash as tq,randomBytes as sq}from"crypto";import{readFileSync as eq,realpathSync as zq,renameSync as nq,unlinkSync as aq,writeFileSync as q3}from"fs";import{dirname as x3,join as Aq}from"path";import{spawnSync as Mq}from"child_process";import{accessSync as _q,constants as wq,existsSync as L,mkdirSync as Lq,readFileSync as fq,renameSync as Sq,writeFileSync as hq}from"fs";import{homedir as Cq}from"os";import{delimiter as gq,dirname as mq,join as T}from"path";import{existsSync as Tq,readFileSync as Uq}from"fs";import{join as vq}from"path";var Eq=`---
|
|
3
3
|
name: reason
|
|
4
4
|
description: Integrate software with Reason's public REST API using a scoped API key. Use for API clients, CI, service integrations, or cloud coding-session automation.
|
|
5
5
|
---
|
|
@@ -79,7 +79,7 @@ This computer
|
|
|
79
79
|
`),b.version)x.stdout.write(`Version: ${b.version}${b.version===R?"":` (${R} is installed; \`reason connect\` restarts it on that)`}
|
|
80
80
|
`);if(x.stdout.write(`Folder: ${b.folder}
|
|
81
81
|
`),x.stdout.write(`Sessions: ${b.sessions_running===null?"":`${b.sessions_running} running, `}${b.sessions_max===1?"one at a time":`up to ${b.sessions_max} at once`}
|
|
82
|
-
`),z){let Z=z,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-
|
|
82
|
+
`),z){let Z=z,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-tkfbkjgn.js"),{macScreenStatus:Oq}=await import("./local-display-mac-9qqvjs82.js");return Rq(await Nq({identity:()=>Iq(),grants:Oq,worker:async()=>Z}))}))().catch(()=>null);if(V)x.stdout.write(`${V}
|
|
83
83
|
`);x.stdout.write(`Keep awake: ${z.keep_awake.enabled?"on":"off"}${z.keep_awake.holding?" (holding)":""}
|
|
84
84
|
`)}if(b.service)x.stdout.write(`Logs: ${b.service.logs}
|
|
85
85
|
`);for(let Z of b.workspaces??[]){let V=Z.state==="removed"?"removed from that workspace":Z.blocked?"offline (this computer is outside that workspace's allowed networks)":Z.device_id?Gq[Z.state]:"connecting";x.stdout.write(`Also in workspace ${Z.name??Z.organization_id}${Z.account?" (another Reason account's)":""}: ${V}
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ch as a,Dh as b,Eh as c,Fh as d}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ch as a,Dh as b,Eh as c,Fh as d}from"./vm-hands-entry-lite-zvkgbra5.js";import"./vm-hands-entry-lite-zba2cswt.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
// @bun
|
|
2
|
+
import{Pd as UJ,ed as jJ,md as EJ}from"./vm-hands-entry-lite-t497ewn2.js";import{createHash as H,randomBytes as $J}from"crypto";import{closeSync as CJ,fsyncSync as LJ,mkdirSync as vJ,openSync as qJ,renameSync as yJ,rmSync as IJ,statSync as NJ,writeSync as DJ,constants as S}from"fs";import{join as d}from"path";var RJ=1;var r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function GJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function BJ(J,Z){let{payload:z,authority:K}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!K||typeof K!=="object"||Array.isArray(K)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||K.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function AJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&r.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:GJ(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var g=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),V=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function v(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(v).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${v(J[Z])}`).join(",")}}`}async function GZ(J){let Z=await crypto.subtle.importKey("pkcs8",V(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=V(J.device_key.spki),K=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),U=new Uint8Array(await crypto.subtle.exportKey("spki",K.publicKey)),L=H("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:K,signingSpki:z,agreementSpki:U,fingerprint:L}}var fJ=4;class mJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;verifiedSinceRun=!1;unverified=new Set;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,K){this.init=J;this.keys=Z;this.hooks=z;this.options=K;if(!r.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let K=Date.now()+Z;;){let U=this.bound.get(J);if(!U)return!1;if(U.envInstalled)return!0;if(Date.now()>=K||z?.aborted)return!1;await new Promise((L)=>setTimeout(L,25))}}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:RJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:g(this.keys.signingSpki),env_public_key:g(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:g($J(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(v(Z)));return{...Z,device_signature:g(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),K=g($J(32)),U=UJ({method:"GET",pathAndQuery:jJ,timestamp:z,nonce:K,challenge:J,bodySha256:H("sha256").update("").digest("hex")}),L=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(U)));return{t:"hello",timestamp:z,nonce:K,signature:g(cJ(L)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new W("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!r.test(z))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(v({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new W("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=fJ)throw new W("vm_hands_busy","every bind slot is held");return this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,K=!1;try{if(Z.length===0){if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload(),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.verifiedSinceRun=!1,this.servedRun=!0,K=!0;let{launchId:U,applied:L,readyData:P}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),E=this.hooks.restatLayout(),D=null;if(J.env){let O=J.claim?.owner??{},k=BJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof O.device_id==="string"?O.device_id:"",rootId:J.claim?.root_id??""});D=this.hooks.installEnvironment(J.bind_id,k),z=this.writeJobEnvRootOnly(J.bind_id,k)}if(this.unbinding.has(J.bind_id))throw new W("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:D!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:D,layout:E,...P?{ready_data:P}:{},policy_digest:H("sha256").update(v({hands_confinement:L.hands_confinement??null,browser_egress:L.browser_egress??null})).digest("hex")}}catch(U){if(z)zJ(z);if(K){let P=[...this.bound.keys()];await this.hooks.killAndVerifyPayload(P.length?{bindId:J.bind_id,keep:P}:void 0).then(()=>{if(!P.length)this.verifiedSinceRun=!0,this.unverified.clear()},()=>{this.unverified.add(J.bind_id),this.verifiedSinceRun=!1})}this.binding.delete(J.bind_id);let L=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof W?U:new W(L,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new W("vm_hands_not_bound","environment delivered while not bound");if(!r.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let K=BJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),U=this.hooks.installEnvironment(Z.bindId,K);if(Z.envInstalled=!0,Z.envDirectory)zJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${U}`,K),{snapshot_id:J.snapshotId,installed_revision:U,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new W("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killAndVerifyPayload(),this.verifiedSinceRun=!0}catch{this.servedRun=!0,this.verifiedSinceRun=!1}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:H("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((K)=>K!==J);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:void 0)}catch(K){throw this.unverified.add(J),this.verifiedSinceRun=!1,K}if(!z.length)this.verifiedSinceRun=!0,this.unverified.clear();if(Z?.envDirectory)zJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},K=await crypto.subtle.importKey("spki",V(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),U=await crypto.subtle.deriveKey({name:"ECDH",public:K},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),L=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(J.iv),additionalData:new TextEncoder().encode(Z)},U,V(J.ct)).catch(z),P=JSON.parse(new TextDecoder().decode(L));if(!P||typeof P!=="object"||Array.isArray(P))throw new W("vm_hands_env_invalid","env not an object");return P}writeJobEnvRootOnly(J,Z){let z=d(this.options.envRoot,`bind-${J}`);vJ(z,{mode:448});let K=NJ(z);if(!K.isDirectory()||(K.mode&63)!==0||K.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let U=Z.variables&&typeof Z.variables==="object"?Z.variables:{},L=Object.entries(U).filter(([D,O])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(D)&&typeof O==="string").map(([D,O])=>`export ${D}='${String(O).replaceAll("'","'\\''")}'`).join(`
|
|
3
|
+
`)+`
|
|
4
|
+
`,P=d(z,`.job.env.${$J(8).toString("hex")}`),E=qJ(P,S.O_WRONLY|S.O_CREAT|S.O_EXCL|S.O_NOFOLLOW,384);try{DJ(E,L),LJ(E)}finally{CJ(E)}return yJ(P,d(z,"job.env")),z}}function zJ(J){try{let Z=d(J,"job.env"),z=NJ(Z).size,K=qJ(Z,S.O_WRONLY|S.O_NOFOLLOW);try{DJ(K,Buffer.alloc(z)),LJ(K)}finally{CJ(K)}}catch{}IJ(J,{recursive:!0,force:!0})}function cJ(J){if(J.length!==64)throw new W("vm_hands_signature_invalid","unexpected ECDSA signature length");let Z=(U)=>{let L=0;while(L<U.length-1&&U[L]===0)L++;let P=U.subarray(L),E=P[0]&128?Uint8Array.of(0,...P):P;return Uint8Array.of(2,E.length,...E)},z=Z(J.subarray(0,32)),K=Z(J.subarray(32));return Uint8Array.of(48,z.length+K.length,...z,...K)}import{randomUUID as bJ}from"crypto";var pJ="/app/local-runtime/session?register=vm_hands_v1",lJ="/app/local-runtime",xJ=25000,uJ=20000,oJ=1e4,dJ=5000,rJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),KJ=75000,iJ=2000,sJ=1e4,i=20000;class h extends Error{}var aJ=64;async function OJ(J,Z){let z=[...J.modelOps.get(Z)??[]];for(let K of z)K.abort.abort();await Promise.race([Promise.all(z.map((K)=>K.settled)),new Promise((K)=>setTimeout(K,dJ))])}async function y(J,Z,z){return await OJ(J,z),Z.unbind(z)}function s(J){for(let Z of J.outbox?.splice(0)??[])Z.reject(Error("vm_hands_attempt_ended"))}var MJ=15000,nJ=1e4,tJ=1000;async function WZ(J){let Z=Date.now(),z={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map},K=J.log??(()=>{}),U=async(L)=>{for(let[P,E]of[...z.turns]){z.turns.delete(P),J.onTurn?.(P,null),s(E);let D=await y(z,J.agent,P).catch(()=>null);if(D)z.receipts.push({turn:E,failure:"vm_hands_bind_lost",unbound:D});K("vm_hands.bound_dropped",{reason:L})}};try{for(let L=0;!J.signal.aborted;L++){let P=await eJ(J,z).catch((D)=>{if(D instanceof W&&z.deviceId===null&&D.code==="vm_hands_no_session"&&Date.now()-Z<sJ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(D instanceof W&&z.deviceId===null)throw D;return{closeCode:0,closeReason:D instanceof Error?D.message:String(D)}});if(K("vm_hands.session_closed",{close_code:P.closeCode,reason:P.closeReason.slice(0,120),registered:z.deviceId!==null}),P.closeCode===4401||z.attest==="refused")return;if(J.signal.aborted)return;if(z.turns.size&&Date.now()-z.lostAt>=KJ)await U("reconnect_deadline");if(z.served)z.served=!1,L=0;let E=P.closeReason==="drain_reconnect"?0:P.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(L,5),2000):z.turns.size?Math.min(250*2**Math.min(L,5),5000,Math.max(0,z.lostAt+KJ-Date.now())):Math.min(500*2**L,30000);if(await new Promise((D)=>setTimeout(D,E)),z.turns.size&&Date.now()-z.lostAt>=KJ)await U("reconnect_deadline")}}finally{await U("session_ended")}}async function eJ(J,Z){let z=Z.deviceId,K=J.log??(()=>{}),U=z?`/app/local-runtime/session?device_id=${encodeURIComponent(z)}`:pJ,L=`${J.apiOrigin.replace(/^http/,"ws")}${U}`,P=new WebSocket(L),E=0,D="",O=new Map,k=[],I=null,_J=new Promise(($)=>{P.onclose=(Y)=>{E=Y.code,D=Y.reason;for(let G of O.values())G.reject(new h(`session closed ${Y.code}`));for(let G of Z.attestWaiters.splice(0))G(!1);O.clear(),$()}});P.onmessage=($)=>{let Y;try{Y=JSON.parse(String($.data))}catch{P.close(4400);return}if(Y.t==="res"){let G=Y;O.get(G.id)?.resolve({status:G.status,body:G.body}),O.delete(G.id);return}if(Y.t==="reconnect"){let G=Math.max(0,Math.min(Number(Y.after_ms)||0,tJ));K("vm_hands.drain_reconnect",{after_ms:G}),setTimeout(()=>{try{P.close(4001,"drain_reconnect")}catch{}},G).unref?.();return}if(!I?.(Y))k.push(Y)};let R=($,Y)=>new Promise((G,X)=>{let j=k.findIndex((C)=>$.includes(C.t));if(j>=0){G(k.splice(j,1)[0]);return}let q=setTimeout(()=>{I=null,X(new W("vm_hands_no_register",`no ${$.join("/")} in ${Y} ms`))},Y);I=(C)=>{if(!$.includes(C.t))return!1;return clearTimeout(q),I=null,G(C),!0}}),f=($)=>P.send(JSON.stringify($)),w=($,Y)=>new Promise((G,X)=>{if(P.readyState!==WebSocket.OPEN){X(new h("session closed"));return}let j=bJ(),q=typeof Y.wait_ms==="number"?Y.wait_ms:0,C=setTimeout(()=>{if(!O.delete(j))return;X(new h(`no answer to ${$.split("/").pop()} in ${q+MJ} ms`)),P.close(4000,"request_timeout")},q+MJ);O.set(j,{reject:(Q)=>{clearTimeout(C),X(Q)},resolve:({status:Q,body:F})=>{clearTimeout(C);let B=null;try{B=F?JSON.parse(F):null}catch{}G({status:Q,json:B})}}),f({t:"req",id:j,path:`${lJ}${$}`,body:JSON.stringify(Y)})}),YJ=()=>P.close(1001,"stopping");J.signal.addEventListener("abort",YJ,{once:!0});let a,m=new Map,c=new Map,n=!1,t=new Set,e=new Set,JJ=Promise.resolve(),b=!1;try{await new Promise((Q,F)=>{let B=setTimeout(()=>F(Error("session open timeout")),nJ);P.onopen=()=>{clearTimeout(B),K("vm_hands.ws_open",{}),Q()},P.onerror=()=>{clearTimeout(B),F(Error("session socket error"))}});let $=await R(["challenge"],5000);K("vm_hands.challenge",{});let Y=[],G=null,X;if(z){f(await J.agent.helloFrame($.challenge,Z.connection));let Q=await R(["ready"],1e4);if(typeof Q.vm_hands_connection==="string")Z.connection=Q.vm_hands_connection;if(X={device_id:z,...Q.cadence?{cadence:Q.cadence}:{}},typeof Q.vm_hands_probe_script==="string"){if(G=Q.vm_hands_probe_script,b=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,K("vm_hands.reconnected",{device_id:z});let F=Array.isArray(Q.vm_hands_binds)?Q.vm_hands_binds:Q.vm_hands_bind?[Q.vm_hands_bind]:[];for(let[B,N]of[...Z.turns]){if(F.some((A)=>A&&A.operation_id===N.claim.operation_id&&A.attempt_id===N.claim.attempt_id)){Y.push(N),K("vm_hands.bound_resumed",{operation_id:N.claim.operation_id});continue}Z.turns.delete(B),J.onTurn?.(B,null),s(N);let M=await y(Z,J.agent,B).catch(()=>null);if(M)Z.receipts.push({turn:N,failure:"vm_hands_bind_lost",unbound:M});K("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{f(await J.agent.registerFrame($.challenge)),K("vm_hands.register_sent",{});let Q=await R(["registered","register_refused"],1e4);if(Q.t==="register_refused")throw new W(Q.code,"register refused");J.agent.registered();let F=Q;if(X=F,Z.deviceId=F.device_id,typeof F.vm_hands_connection==="string")Z.connection=F.vm_hands_connection;if(typeof F.vm_hands_probe_script==="string"){if(G=F.vm_hands_probe_script,b=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,K("vm_hands.registered",{device_id:X.device_id})}let j=async()=>{let Q=await w("/heartbeat",await J.heartbeat());if(Q.status>=300)throw Error(`heartbeat ${Q.status}`)};await j();let q=X.cadence?.presence_interval_ms??30000;if(a=setInterval(()=>{j().catch(()=>P.close())},q),G&&Z.attest!=="accepted"&&J.agent.phase==="registered"&&!Z.turns.size)hJ(G,$.challenge);let C=(Q,F)=>{c.set(Q,F().catch(async(B)=>{if(await QJ(B,Q),B instanceof h)P.close();else await ZJ().catch(()=>{return})}).finally(()=>{c.delete(Q)}))};try{await ZJ();for(let Q of Y)Q.flush=()=>XJ(Q),Q.flush(),C(Q.claim.attempt_id,()=>FJ(Q));while(!J.signal.aborted&&P.readyState===WebSocket.OPEN){let Q=await w("/operations/claim",{wait_ms:Math.min(X.cadence?.claim_wait_ms??xJ,xJ)});if(Q.status===204||!Q.json)continue;if(Q.status>=300)throw Error(`claim ${Q.status}`);let F=Q.json;if(F.capability==="hands.connect"){if(c.has(F.attempt_id)){_({claim:F,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}C(F.attempt_id,()=>wJ(F))}else kJ(F).catch(()=>{return})}}catch(Q){await QJ(Q,null)}}finally{if(a)clearInterval(a);J.signal.removeEventListener("abort",YJ);for(let $ of Z.turns.values())$.flush=null;P.close(),await _J,await Promise.all([...c.values()]);for(let $ of J.agent.liveBindIds){if(Z.turns.has($))continue;let Y=await y(Z,J.agent,$).catch(()=>null),G=m.get($);if(Y&&G)Z.receipts.push({turn:{...G,eventSeq:G.eventSeq+1},failure:"vm_hands_bind_lost",unbound:Y});K("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let $ of t)$.abort()}return{closeCode:E,closeReason:D};async function QJ($,Y){if($ instanceof h){if(!n&&Z.turns.size)Z.lostAt=Date.now();n=!0}else{let G=Y!==null?[Y]:[...new Set([...Z.turns.keys(),...J.agent.liveBindIds])];if(Y===null)n=!0;for(let X of G){let j=Z.turns.get(X);if(Z.turns.delete(X),j)s(j),J.onTurn?.(X,null);if(J.agent.liveBindIds.includes(X)){let q=await y(Z,J.agent,X).catch(()=>null),C=m.get(X)??j;if(q&&C)Z.receipts.push({turn:{...C,eventSeq:C.eventSeq+1},failure:"vm_hands_bind_lost",unbound:q})}}}K("vm_hands.session_lost",{error:$ instanceof Error?$.message:String($),bound_kept:Z.turns.size})}function _($){let Y=$.claim,G={attempt_id:Y.attempt_id,attempt_token:Y.attempt_token},X=encodeURIComponent(Y.operation_id);return{fence:G,op:X,complete:(q,C={})=>w(`/operations/${X}/complete`,{...G,status:q,...C}),emit:(q,C)=>{let Q=($.chain??Promise.resolve()).catch(()=>{return}).then(()=>j(q,C));return $.chain=Q,Q}};async function j(q,C){let Q=$.eventSeq,F=(A)=>w(`/operations/${X}/events`,{...G,event_seq_start:A,events:[{kind:q,payload:{sequence:A,capability:String(Y.capability??"hands.connect"),data:C}}]}),B=Q,N=await F(B),M=N.status===409?N.json?.expected_event_seq:void 0;if(typeof M==="number"&&M===Q+1)N={status:200,json:{duplicate:!0}};else if(typeof M==="number"&&M>=0&&M!==Q)B=M,N=await F(B);if(N.status<300)$.eventSeq=B+1;return N}}function TJ($){return(Y,G)=>new Promise((X,j)=>{if(Z.turns.get($.claim.attempt_id)!==$){j(Error("vm_hands_attempt_ended"));return}if($.outbox??=[],$.outbox.length>=aJ){j(Error("vm_hands_outbox_full"));return}$.outbox.push({kind:Y,data:G,resolve:X,reject:j}),$.flush?.()})}function XJ($){if(e.has($))return;e.add($),(async()=>{try{while($.outbox?.length&&Z.turns.get($.claim.attempt_id)===$&&P.readyState===WebSocket.OPEN){let Y=$.outbox[0],G;try{G=await _($).emit(Y.kind,Y.data)}catch(X){if(X instanceof h)return;G={status:500}}if($.outbox.shift(),G.status<300)Y.resolve();else Y.reject(Error(`${Y.kind} refused ${G.status}`))}}finally{e.delete($)}})()}async function hJ($,Y){try{let G=await J.agent.attestFrame($,Y);if(P.readyState!==WebSocket.OPEN)return;f(G);let X=await R(["attested","attest_refused"],15000);Z.attest=X.t==="attested"?"accepted":"refused";for(let j of Z.attestWaiters.splice(0))j(Z.attest==="accepted");if(K("vm_hands.attest",{result:Z.attest,exit_code:G.exit_code,...X.t==="attest_refused"?{code:String(X.code??"")}:{}}),Z.attest==="refused")P.close(4401,"attest_refused")}catch(G){K("vm_hands.attest_failed",{code:G instanceof W?G.code:"probe_error"});for(let X of Z.attestWaiters.splice(0))X(!1);if(Z.attest!=="accepted")P.close(4000,"attest_unanswered")}}async function wJ($){let Y=b&&Z.attest==="pending",G=$.vm_hands_attest,X=G;if(Z.attest==="refused"){K("vm_hands.claim_attest_refused",{said:typeof G==="string"?G.slice(0,16):typeof G,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(X==="accepted"){if(!Y&&Z.attest!=="accepted"){Z.attest="accepted";for(let A of Z.attestWaiters.splice(0))A(!0)}}else if(X!=="pending"||!Y&&Z.attest!=="accepted"){K("vm_hands.claim_attest_refused",{said:typeof G==="string"?G.slice(0,16):typeof G,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Z.attest!=="accepted"){let A=Date.parse($.lease_until)-Date.now()-5000,p=Math.max(0,Math.min(i,Number.isFinite(A)?A:i));if(!await new Promise((u)=>{let x=setTimeout(()=>u(!1),p);Z.attestWaiters.push((T)=>{clearTimeout(x),u(T)})})){await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let j={claim:$,eventSeq:0},{complete:q,emit:C}=_(j),Q;try{if($.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not hands.connect");Q=!GJ($)}catch(A){K("vm_hands.bind_refused",{code:A instanceof W?A.code:"unexpected"}),await q("failed",{error_code:A instanceof W?A.code:"vm_hands_bind_invalid"});return}let F;try{F=await J.agent.bind(AJ($))}catch(A){K("vm_hands.bind_refused",{code:A instanceof W?A.code:"unexpected"}),await q("failed",{error_code:A instanceof W?A.code:"vm_hands_bind_failed"});return}let B={...F.ready_data??J.readyData({launchId:F.launch_id,claim:$})};if(Q)delete B.environment_installed;m.set($.attempt_id,{claim:$,launchId:F.launch_id,readyData:B,eventSeq:j.eventSeq,ackSeq:-1});let N=await C("hands.ready",{...B,vm_hands:{layout:F.layout,policy_digest:F.policy_digest,launch_id:F.launch_id}});if(m.delete($.attempt_id),N.status>=300){await OJ(Z,$.attempt_id),await J.agent.boundRefused($.attempt_id),await q("failed",{error_code:String(N.json?.error??"vm_hands_probe_failed")});return}let M={claim:$,launchId:F.launch_id,readyData:B,eventSeq:j.eventSeq,ackSeq:-1};Z.turns.set($.attempt_id,M),M.flush=()=>XJ(M),J.onTurn?.($.attempt_id,TJ(M)),await FJ(M)}async function FJ($){let{fence:Y,op:G}=_($),X=null,j=null,q=J.agent.executorExited($.claim.attempt_id).then((C)=>{return j=C,null});J:for(;;){let C=await Promise.race([q,w(`/operations/${G}/heartbeat`,{...Y,control_ack_seq:$.ackSeq,wait_ms:uJ})]);if(!C){X="vm_hands_executor_exited",K("vm_hands.executor_exited",{reason:j});break}if(C.status>=300)break;let Q=(C.json?.controls??[]).slice().sort((F,B)=>F.seq-B.seq);for(let F of Q){if(F.seq<=$.ackSeq)continue;if(F.kind==="operation.cancel"||F.kind==="cancel"){$.ackSeq=F.seq;break J}if(F.kind===EJ)try{await SJ($,F.payload??{})}catch(B){if(B instanceof h)throw B;X=B instanceof W?B.code:"environment_unavailable";let N=B&&typeof B==="object"&&"code"in B&&typeof B.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(B.code)?B.code:null;K("vm_hands.environment_refused",{code:X,cause:N});break J}$.ackSeq=F.seq}}await gJ($,X)}async function kJ($){let Y=$,G={claim:Y,eventSeq:0},{complete:X,emit:j,fence:q,op:C}={..._(G)},Q=$.vm_hands_origin==="person"?"person":"model",F=String($.capability??"");if(!J.executeOp){await X("failed",{error_code:"vm_hands_op_unsupported"});return}if($.vm_hands_attest==="accepted"&&Z.attest==="pending"&&!(b&&Z.attest==="pending")){Z.attest="accepted";for(let x of Z.attestWaiters.splice(0))x(!0)}if(Z.attest!=="accepted"){let x=Date.parse(String($.lease_until??""))-Date.now()-5000,T=Z.attest==="refused"?0:Math.max(0,Math.min(i,Number.isFinite(x)?x:i));if(!(T>0&&await new Promise((PJ)=>{let HJ=setTimeout(()=>PJ(!1),T);Z.attestWaiters.push((VJ)=>{clearTimeout(HJ),PJ(VJ)})}))){await X("failed",{error_code:"vm_hands_unattested"});return}}let B=J.agent.bindIdForRun(Y.run_id);if(Q==="model"&&B===null){await X("failed",{error_code:"vm_hands_not_bound"});return}if(rJ.has(F)&&J.agent.liveBindIds.length===0){await X("failed",{error_code:"vm_hands_not_bound"});return}let N=new AbortController;t.add(N);let M,A=new Promise((x)=>{M=x}),p={abort:N,settled:A};if(Q==="model"&&B){let x=Z.modelOps.get(B)??new Set;x.add(p),Z.modelOps.set(B,x),await J.agent.environmentInstalled(B,iJ,N.signal)}let l=-1,u=setInterval(()=>{w(`/operations/${C}/heartbeat`,{...q,control_ack_seq:l,wait_ms:0}).then((x)=>{if(x.status>=300){N.abort();return}let T=x.json?.controls??[];for(let o of T)if(l=Math.max(l,o.seq),o.kind==="operation.cancel"||o.kind==="cancel")N.abort()},()=>N.abort())},oJ);try{let x=await J.executeOp({kind:Q,claim:$,...Q==="model"&&B?{bindId:B}:{},signal:N.signal,emit:async(T)=>{await j(T.kind,T.data??{})}});await X(x.status,{...x.result?{result:x.result}:{},...x.error_code!==void 0?{error_code:x.error_code}:{}}),K("vm_hands.op",{capability:F,kind:Q,status:x.status,code:x.error_code??null})}finally{if(clearInterval(u),t.delete(N),B)Z.modelOps.get(B)?.delete(p);M()}}async function gJ($,Y){let G=$.claim.attempt_id;if(Z.turns.get(G)===$)Z.turns.delete(G);J.onTurn?.(G,null),s($);let X=await y(Z,J.agent,G);Z.receipts.push({turn:$,failure:Y,unbound:X}),await ZJ()}function ZJ(){return JJ=JJ.then(WJ,WJ),JJ}async function WJ(){while(Z.receipts.length){let{turn:$,failure:Y,unbound:G}=Z.receipts[0],{complete:X,emit:j}=_($);try{if(await j("hands.stopped",{...$.readyData,reason_code:Y?"failed":"cancelled",killed_verified:G.killed_verified,shredded:G.shredded,...G.srt_fallbacks?{vm_hands_srt_fallbacks:G.srt_fallbacks}:{}}),Y)await X("failed",{error_code:Y});else await X("cancelled",{error_code:"driver_stopped"})}catch(q){if(q instanceof h)return}Z.receipts.shift()}}async function SJ($,Y){let{fence:G,op:X}=_($),j=Y.snapshot_id;if(Y.version!==1||typeof j!=="string"||Object.keys(Y).length!==2)throw new W("vm_hands_env_invalid","invalid environment delivery");let q=await w(`/operations/${X}/environment`,{...G,snapshot_id:j}),C=q.json?.environment_sealed;if(q.status!==200||!C||q.json?.payload!==void 0)throw new W("vm_hands_env_invalid","environment not delivered sealed");let Q=await J.agent.deliverEnvironment({attemptId:$.claim.attempt_id,snapshotId:j,deviceId:Z.deviceId??"",sealed:C});if((await w(`/operations/${X}/environment-ack`,{...G,...Q})).status>=300)throw new W("vm_hands_env_ack_refused","environment ack refused")}}
|
|
5
|
+
export{GZ as u,mJ as v,WZ as w};
|