@reason-machines/cli-linux-arm64-musl 0.2.327 → 0.2.328
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/ara +1 -1
- package/bin/vm-hands/{connect-cli-44va9379.js → connect-cli-25a18p4x.js} +1 -1
- package/bin/vm-hands/{local-automation-7cypstyv.js → local-automation-0tsy8ca8.js} +1 -1
- package/bin/vm-hands/{local-capabilities-nywse9m3.js → local-capabilities-bkfwqn2s.js} +1 -1
- package/bin/vm-hands/{local-display-session-gtk92n5e.js → local-display-session-e02rm1ap.js} +1 -1
- package/bin/vm-hands/{permissions-rgfr52fz.js → permissions-96taxgby.js} +1 -1
- package/bin/vm-hands/{status-t6acadsj.js → status-8m39p3xw.js} +2 -2
- package/bin/vm-hands/{version-rm84p9qv.js → version-8qzmmn7c.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-472z7kjx.js → vm-hands-entry-lite-7q2gywdm.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-cx4z34jh.js → vm-hands-entry-lite-e0cj5ma7.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-7jmj7peg.js → vm-hands-entry-lite-f8f057tx.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-fbbd8e32.js → vm-hands-entry-lite-p40ka01q.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-mgx65dde.js → vm-hands-entry-lite-pwzz9ntw.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-ep1me9q3.js → vm-hands-entry-lite-qgse6zav.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-7t05ea2h.js → vm-hands-entry-lite-qwba7w42.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-rm0jf774.js → vm-hands-entry-lite-rv6k8wy8.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-28ta42wn.js → vm-hands-entry-lite-yjzz85pt.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
- package/bin/vm-hands/vm-hands-executor-r34x5748.js +10 -0
- package/bin/vm-hands/{vm-hands-op-runner-b484wkc9.js → vm-hands-op-runner-yex7kse5.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-mew62849.js → vm-hands-runtime-ck24pzen.js} +3 -3
- package/package.json +1 -1
- package/bin/vm-hands/vm-hands-executor-2pqe40rp.js +0 -10
package/bin/ara
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-
|
|
2
|
+
import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-p40ka01q.js";import"./vm-hands-entry-lite-xf6schkk.js";import"./vm-hands-entry-lite-f8f057tx.js";import"./vm-hands-entry-lite-pwzz9ntw.js";import"./vm-hands-entry-lite-fq0zr7an.js";import"./vm-hands-entry-lite-93ejmwqn.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-b2wdaq7x.js";import"./vm-hands-entry-lite-qwba7w42.js";import"./vm-hands-entry-lite-t497ewn2.js";import"./vm-hands-entry-lite-psybjyay.js";import"./vm-hands-entry-lite-yjzz85pt.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-7q2gywdm.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-qgse6zav.js";import"./vm-hands-entry-lite-e0cj5ma7.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Gc as a,Hc as b,Ic as c,Jc as d,Kc as e,Lc as f,Mc as g,Nc as h,Oc as i,Pc as j,Qc as k,Rc as l}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Gc as a,Hc as b,Ic as c,Jc as d,Kc as e,Lc as f,Mc as g,Nc as h,Oc as i,Pc as j,Qc as k,Rc as l}from"./vm-hands-entry-lite-qwba7w42.js";import"./vm-hands-entry-lite-t497ewn2.js";import"./vm-hands-entry-lite-psybjyay.js";import"./vm-hands-entry-lite-yjzz85pt.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-7q2gywdm.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-qgse6zav.js";import"./vm-hands-entry-lite-e0cj5ma7.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-
|
|
2
|
+
import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-f8f057tx.js";import"./vm-hands-entry-lite-pwzz9ntw.js";import"./vm-hands-entry-lite-fq0zr7an.js";import"./vm-hands-entry-lite-93ejmwqn.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b}from"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-b2wdaq7x.js";import"./vm-hands-entry-lite-qwba7w42.js";import"./vm-hands-entry-lite-t497ewn2.js";import"./vm-hands-entry-lite-psybjyay.js";import"./vm-hands-entry-lite-yjzz85pt.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-7q2gywdm.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-qgse6zav.js";import"./vm-hands-entry-lite-e0cj5ma7.js";import"./vm-hands-entry-lite-14t846kp.js";import{Oh as a}from"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};
|
package/bin/vm-hands/{local-display-session-gtk92n5e.js → local-display-session-e02rm1ap.js}
RENAMED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ae as d,Be as e,Ce as f,De as g,Ee as h,xe as a,ye as b,ze as c}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ae as d,Be as e,Ce as f,De as g,Ee as h,xe as a,ye as b,ze as c}from"./vm-hands-entry-lite-yjzz85pt.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-7q2gywdm.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-qgse6zav.js";import"./vm-hands-entry-lite-e0cj5ma7.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ag as f,Bg as g,Cg as h,Dg as i,Eg as j,vg as a,wg as b,xg as c,yg as d,zg as e}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ag as f,Bg as g,Cg as h,Dg as i,Eg as j,vg as a,wg as b,xg as c,yg as d,zg as e}from"./vm-hands-entry-lite-7q2gywdm.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-qgse6zav.js";import"./vm-hands-entry-lite-e0cj5ma7.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{a as Wq,b as Bq,c as bq,d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-
|
|
2
|
+
import{a as Wq,b as Bq,c as bq,d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-p40ka01q.js";import"./vm-hands-entry-lite-xf6schkk.js";import"./vm-hands-entry-lite-f8f057tx.js";import"./vm-hands-entry-lite-pwzz9ntw.js";import"./vm-hands-entry-lite-fq0zr7an.js";import"./vm-hands-entry-lite-93ejmwqn.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-b2wdaq7x.js";import{pc as jq}from"./vm-hands-entry-lite-qwba7w42.js";import"./vm-hands-entry-lite-t497ewn2.js";import{ee as G}from"./vm-hands-entry-lite-psybjyay.js";import"./vm-hands-entry-lite-yjzz85pt.js";import{Ie as H,Je as u,Ke as s,ff as Qq}from"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-7q2gywdm.js";import"./vm-hands-entry-lite-22jgncrd.js";import"./vm-hands-entry-lite-mzxhng4z.js";import{ch as l}from"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import{Ch as R}from"./vm-hands-entry-lite-qgse6zav.js";import"./vm-hands-entry-lite-e0cj5ma7.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import{Uh as $q}from"./vm-hands-entry-lite-cxs89wzv.js";import{createHash as tq,randomBytes as sq}from"crypto";import{readFileSync as eq,realpathSync as zq,renameSync as nq,unlinkSync as aq,writeFileSync as q3}from"fs";import{dirname as x3,join as Aq}from"path";import{spawnSync as Mq}from"child_process";import{accessSync as _q,constants as wq,existsSync as L,mkdirSync as Lq,readFileSync as fq,renameSync as Sq,writeFileSync as hq}from"fs";import{homedir as Cq}from"os";import{delimiter as gq,dirname as mq,join as T}from"path";import{existsSync as Tq,readFileSync as Uq}from"fs";import{join as vq}from"path";var Eq=`---
|
|
3
3
|
name: reason
|
|
4
4
|
description: Integrate software with Reason's public REST API using a scoped API key. Use for API clients, CI, service integrations, or cloud coding-session automation.
|
|
5
5
|
---
|
|
@@ -79,7 +79,7 @@ This computer
|
|
|
79
79
|
`),b.version)x.stdout.write(`Version: ${b.version}${b.version===R?"":` (${R} is installed; \`reason connect\` restarts it on that)`}
|
|
80
80
|
`);if(x.stdout.write(`Folder: ${b.folder}
|
|
81
81
|
`),x.stdout.write(`Sessions: ${b.sessions_running===null?"":`${b.sessions_running} running, `}${b.sessions_max===1?"one at a time":`up to ${b.sessions_max} at once`}
|
|
82
|
-
`),z){let Z=z,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-
|
|
82
|
+
`),z){let Z=z,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-96taxgby.js"),{macScreenStatus:Oq}=await import("./local-display-mac-9qqvjs82.js");return Rq(await Nq({identity:()=>Iq(),grants:Oq,worker:async()=>Z}))}))().catch(()=>null);if(V)x.stdout.write(`${V}
|
|
83
83
|
`);x.stdout.write(`Keep awake: ${z.keep_awake.enabled?"on":"off"}${z.keep_awake.holding?" (holding)":""}
|
|
84
84
|
`)}if(b.service)x.stdout.write(`Logs: ${b.service.logs}
|
|
85
85
|
`);for(let Z of b.workspaces??[]){let V=Z.state==="removed"?"removed from that workspace":Z.blocked?"offline (this computer is outside that workspace's allowed networks)":Z.device_id?Gq[Z.state]:"connecting";x.stdout.write(`Also in workspace ${Z.name??Z.organization_id}${Z.account?" (another Reason account's)":""}: ${V}
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ch as a,Dh as b,Eh as c,Fh as d}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ch as a,Dh as b,Eh as c,Fh as d}from"./vm-hands-entry-lite-qgse6zav.js";import"./vm-hands-entry-lite-e0cj5ma7.js";import"./vm-hands-entry-lite-cxs89wzv.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Tg as wz,Ug as Nz}from"./vm-hands-entry-lite-22jgncrd.js";import{ch as N}from"./vm-hands-entry-lite-cp1wqjs5.js";import{Ch as A}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Tg as wz,Ug as Nz}from"./vm-hands-entry-lite-22jgncrd.js";import{ch as N}from"./vm-hands-entry-lite-cp1wqjs5.js";import{Ch as A}from"./vm-hands-entry-lite-qgse6zav.js";import{Uh as Fz}from"./vm-hands-entry-lite-cxs89wzv.js";import{spawnSync as iz}from"child_process";import{dirname as g}from"path";import{spawn as cz}from"child_process";import{accessSync as lz,constants as sz}from"fs";import{basename as nz,join as pz}from"path";import{randomUUID as p}from"crypto";import{spawnSync as M}from"child_process";import{chmodSync as Hz,cpSync as Rz,existsSync as U,lstatSync as O,mkdirSync as i,readdirSync as Cz,readFileSync as E,readlinkSync as Lz,realpathSync as T,renameSync as R,rmdirSync as Mz,rmSync as P,symlinkSync as c,writeFileSync as Oz}from"fs";import{dirname as C,join as D,relative as Uz,resolve as Tz}from"path";var a="so.ara.cli",_z="5LJFSBRY2F";var o="ReasonBackgroundIdentity",r="Contents/Helpers/ReasonPermissionTile";var x="AraBackgroundIdentity",Az="Reason",Iz=`anchor apple generic and identifier "${a}" and certificate leaf[subject.OU] = "${_z}"`;class L extends Error{code;constructor(z,J){super(J);this.code=z;this.name="MacOSBackgroundIdentityError"}}var k="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function v(z=N()){return D(z,"Library","Application Support","Reason","Background","Reason.app")}function _(z=N()){return D(z,"Library","Application Support","Ara","Background","Ara.app")}function kz(z){try{return O(z).isFile()}catch{return!1}}function y(z){return[o,x].map((J)=>D(z,"Contents","MacOS",J)).find(kz)??null}function w(z){try{if(!O(z).isDirectory())return!1;let J=E(D(z,"Contents","Info.plist"),"utf8");return J.includes(`<string>${a}</string>`)&&(J.includes(`<string>${Az}</string>`)||J.includes("<string>Ara</string>"))&&y(z)!==null}catch{return!1}}function I(z=N()){let J=v(z);if(!w(J))return null;try{let Z=E(D(J,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(Z)?.[1]??null}catch{return null}}function Sz(z,J=N()){let Z=I(J);return Z===null||$z(S(Z.split(".")),S(z.split(/[.-]/).slice(0,3)))}var fz=1e4;function t(z,J){return M(z,[...J],{stdio:"ignore",timeout:fz}).status??1}var e=new Set;function zz(z){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let J=(Z)=>{try{return T(Z)}catch{return Tz(Z)}};if(z!==void 0&&J(z)!==J(N()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var Jz=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.ara(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,Zz=new Set(["ara","ara.exe","reason","reason.exe"]);function S(z){return z.map((J)=>Number(J))}function $z(z,J){for(let Z=0;Z<3;Z+=1)if(z[Z]!==J[Z])return z[Z]<J[Z];return!1}var Ez=[0,2,161];function xz(z){if(z===null)return!0;let J=Ez,Z=null;try{Z=T(process.execPath)}catch{}return z.some(($)=>{let j=Jz.exec($);if(j){let Q=j[1]===void 0?j.slice(4,7):j.slice(1,4);return $z(S(Q),J)}let q=$.slice($.lastIndexOf("/")+1);return Zz.has(q)&&$!==Z&&$!==process.execPath})}function yz(){let z=M("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(z.status!==0)return null;let J=[];for(let Z of z.stdout.split(`
|
|
3
3
|
`)){let $=/^\s*(\d+)\s+(\S.*)$/.exec(Z);if(!$||Number($[1])===process.pid)continue;let j=$[2].trimEnd(),q=j.slice(j.lastIndexOf("/")+1);if(!Jz.test(j)&&Zz.has(q)){let V=M("/usr/sbin/lsof",["-a","-p",$[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
|
|
4
4
|
`).find((X)=>X.startsWith("n/"));if(V)j=V.slice(1)}J.push(j)}return J}function bz(z){if(zz(z.home),!w(z.sourceApp))throw new L("identity_invalid","The packaged Reason background identity is missing or invalid.");let J=z.command??t,Z=v(z.home),$=C(Z);i($,{recursive:!0,mode:448}),Hz($,448);let j=T(z.sourceApp),q=null;try{q=T(Z)}catch{}if(j!==q){let Q=`${process.pid}.${p()}`,V=D($,`.Reason.app.${Q}.tmp`),X=D($,`.Reason.app.${Q}.old`),W=!1;try{if(Rz(j,V,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!w(V))throw new L("identity_invalid","The copied Reason background identity is invalid.");let Y=z.releaseSigned?["--test-requirement",`=${Iz}`]:[];if(J("/usr/bin/codesign",["--verify","--strict",...Y,V])!==0)throw new L("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let B=!1;for(let F=0;F<4;F+=1){let G=!1;try{R(Z,X),G=!0,W=!0}catch(K){if(K.code!=="ENOENT")throw K}if(F===0)z.beforePublish?.();try{R(V,Z),B=!0}catch(K){let m=K.code;if(!["EEXIST","ENOTEMPTY"].includes(m??""))throw K;if(G)P(X,{recursive:!0,force:!0}),W=!1;if(F===3)throw K;continue}if(G)P(X,{recursive:!0,force:!0}),W=!1;break}if(!B)throw Error("Could not publish Reason's background identity.")}catch(Y){if(W&&!U(Z)&&U(X))R(X,Z);throw Y}finally{P(V,{recursive:!0,force:!0}),P(X,{recursive:!0,force:!0})}}return Wz(Z,z,{verified:j!==q}),Z}function jz(z){return D(C(z),".Reason.app.registered")}function qz(z){try{let J=O(z);return J.isDirectory()?`${J.ino}:${J.birthtimeMs}`:null}catch{return null}}function f(z){let J=qz(z);try{return J!==null&&E(jz(z),"utf8")===J}catch{return!1}}function Qz(z){if(w(z))return"bundle";try{if(O(D(z,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return O(D(z,"Contents","MacOS",x)).isSymbolicLink()?"retired":null}catch{return null}}function Wz(z,J,Z={}){let $=J.command??t;if(!Z.verified&&$("/usr/bin/codesign",["--verify","--strict",z])!==0)throw new L("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if($(k,["-f",z])!==0)throw new L("identity_register_failed","Could not register Reason's macOS background identity.");let j=qz(z);try{if(j)Oz(jz(z),j,{mode:384})}catch{}try{gz(z,J.home,$,J.runningExecutables??yz)}catch(q){let Q=q.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${Q})
|
|
5
5
|
`)}}function gz(z,J,Z,$){let j=y(z);if(!j)return;let q=_(J),Q=C(q),V=(K)=>D(K,"Contents","MacOS",x),X=Uz(C(V(q)),j),W=`${process.pid}.${p()}`,Y=Qz(q);if(Y===null)return;let B=Y==="bundle";if(B)Z(k,["-u",q]);let F=D(Q,`.Ara.app.${W}.old`);if(!e.has(q)&&!xz($())){if(!B)Z(k,["-u",q]);try{R(q,F)}catch(K){if(K.code==="ENOENT")return;throw K}P(F,{recursive:!0,force:!0}),uz(Q);return}if(!B){if(Lz(V(q))===X)return;let K=`${V(q)}.${W}`;c(X,K);try{R(K,V(q))}finally{P(K,{force:!0})}return}let G=D(Q,`.Ara.app.${W}.shim`);i(C(V(G)),{recursive:!0}),c(X,V(G));try{try{R(q,F)}catch(K){if(K.code==="ENOENT")return;throw K}try{R(G,q)}catch(K){if(U(q))return;throw R(F,q),K}}finally{P(G,{recursive:!0,force:!0}),P(F,{recursive:!0,force:!0})}}function uz(z){try{if(Cz(z).some((Z)=>Z!==".DS_Store"))return;P(D(z,".DS_Store"),{force:!0}),Mz(z)}catch{}}var l=new Map;function hz(z=N()){let J=l.get(z);if(J)return J;if(process.platform!=="darwin")return[];let Z=s(z);if(Z===null&&U(C(v(z))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),Z=s(z);if(Z===null)return[];return l.set(z,Z),Z}function s(z){let J=v(z),Z=_(z);if(!w(J)||!f(J))try{dz({home:z,skipWhenSettled:!0})}catch{}let $=w(J)&&(f(J)||!w(Z))?J:w(Z)?Z:null,j=$?y($):null;if(!j)return null;if($===Z)e.add(Z);let q=M(j,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return q.status===0&&q.stdout===`spawn
|
|
@@ -20,7 +20,7 @@ The macOS privacy permissions of this computer's Reason worker:
|
|
|
20
20
|
allow asks for each missing one, or the one named. macOS cannot ask for Full
|
|
21
21
|
Disk Access: allow disk opens its pane, shows the file to add in Finder and
|
|
22
22
|
waits until the worker has it.
|
|
23
|
-
`,u="x-apple.systempreferences:com.apple.preference.security",az="curl -fsSL https://reasonmachines.com/install.sh | bash",oz=180000,rz=2000,h=["screen","accessibility","disk"],d={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${u}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${u}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${u}?Privacy_AllFiles`}};function Bz(z){return z.executable}function tz(z,J){if(z==="computer_use_identity_missing")return`Reason's background identity is not installed (${z}); reinstall Reason: ${az}`;if(z==="computer_use_identity_outdated")return`Reason's background identity is outdated (${I(J)??"unknown"}; this CLI is ${A}) (${z}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${z}); run the installed \`reason\``}function ez(z=N()){let J=b(z);if(J.length>0)return{state:"ready",path:g(g(g(J[0]))),prefix:J};let Z=Kz(J,z)??"computer_use_identity_unavailable";return{state:Z,path:v(z),detail:tz(Z,z)}}function Pz(){return{identity:()=>ez(),grants:(z)=>wz(z),request:(z,J)=>Nz(z,J),worker:async()=>(await import("./status-
|
|
23
|
+
`,u="x-apple.systempreferences:com.apple.preference.security",az="curl -fsSL https://reasonmachines.com/install.sh | bash",oz=180000,rz=2000,h=["screen","accessibility","disk"],d={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${u}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${u}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${u}?Privacy_AllFiles`}};function Bz(z){return z.executable}function tz(z,J){if(z==="computer_use_identity_missing")return`Reason's background identity is not installed (${z}); reinstall Reason: ${az}`;if(z==="computer_use_identity_outdated")return`Reason's background identity is outdated (${I(J)??"unknown"}; this CLI is ${A}) (${z}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${z}); run the installed \`reason\``}function ez(z=N()){let J=b(z);if(J.length>0)return{state:"ready",path:g(g(g(J[0]))),prefix:J};let Z=Kz(J,z)??"computer_use_identity_unavailable";return{state:Z,path:v(z),detail:tz(Z,z)}}function Pz(){return{identity:()=>ez(),grants:(z)=>wz(z),request:(z,J)=>Nz(z,J),worker:async()=>(await import("./status-8m39p3xw.js")).connectionMacState(),open:(z)=>{iz("/usr/bin/open",z,{stdio:"ignore",timeout:1e4})},tile:Xz,restartConnection:async()=>(await import("./connect-cli-25a18p4x.js")).restartConnection(),sleep:(z)=>new Promise((J)=>setTimeout(J,z)),now:()=>Date.now()}}function Yz(z,J,Z){if(z.state!=="ready"||!J)return"unknown";return J[Z]?"granted":"missing"}async function vz(z){let J=z.identity(),Z=J.state==="ready"?await z.grants(J.prefix):null,$=await z.worker(),j=$?Bz($):null,q=!j||$?.full_disk_access==="unknown"?"unknown":$?.full_disk_access==="granted"?"granted":"missing",Q=(V,X,W)=>{let{label:Y,purpose:B,level:F}=d[V];return{id:V,label:Y,purpose:B,level:F,state:X,holder:W}};return{identity:{state:J.state,path:J.path,detail:J.state==="ready"?null:J.detail},worker_detail:j?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[Q("screen",Yz(J,Z,"screen"),J.path),Q("accessibility",Yz(J,Z,"accessibility"),J.path),Q("disk",q,j)]}}function MJ(z){let J=z.identity.state==="ready"?null:z.identity.state,Z=z.permissions.filter((q)=>q.state==="granted").length,$=[...J?[J]:[],...z.permissions.filter((q)=>q.state!=="granted"&&!(J&&q.id!=="disk")).map((q)=>`${q.label} ${q.state}`)],j=!J&&z.permissions.some((q)=>q.state==="missing");return`Permissions: ${Z} of ${z.permissions.length}${$.length>0?` (${$.join(", ")})`:""}`+(j?" \u2014 reason permissions allow":$.length>0?" \u2014 reason permissions":"")}function zJ(z){let J=[];if(z.identity.detail)J.push(z.identity.detail);J.push(`Reason: ${z.identity.path}`);let Z=z.permissions.find(($)=>$.id==="disk");J.push(Z?.holder?`Worker: ${Z.holder}`:`Worker: ${z.worker_detail}`),J.push("");for(let $ of z.permissions){let j=`${$.label}${$.level==="recommended"?" (recommended)":""}`;J.push(` ${$.id.padEnd(13)} ${$.state.padEnd(7)} ${j}: ${$.purpose}`)}if(z.permissions.some(($)=>$.state==="missing"))J.push("","Allow the missing ones: reason permissions allow");return`${J.join(`
|
|
24
24
|
`)}
|
|
25
25
|
`}async function Gz(z,J){let Z=J.now()+oz;for(;;){if(await z())return!0;if(J.now()>=Z)return!1;await J.sleep(rz)}}async function JJ(z,J){let Z=J.host??Pz(),{io:$}=J,j=await vz(Z),q=j.permissions.filter((W)=>z.includes(W.id)&&W.state!=="granted");if(q.length===0)return $.stdout.write(`Reason permissions: ${z.map((W)=>d[W].label).join(", ")} already allowed.
|
|
26
26
|
`),0;let Q=!1,V=!1,X=Z.identity();for(let W of q){let{label:Y,pane:B}=d[W.id];if(W.id!=="disk"){if(X.state!=="ready"){if(!Q)$.stderr.write(`Reason permissions: ${X.detail}
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
var r={name:"github-native-engineer-device-worker-production",version:"0.2.
|
|
2
|
+
var r={name:"github-native-engineer-device-worker-production",version:"0.2.328",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@anthropic-ai/sandbox-runtime":"^0.0.73","@earendil-works/pi-tui":"1.0.0","@modelcontextprotocol/sdk":"^1.29.0","@reason/runtime-distribution":"workspace:*","playwright-core":"1.60.0",zod:"^4.4.3"},overrides:{"@hono/node-server":"1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"1.20.0","basic-ftp":"6.2.1","@grpc/grpc-js":"1.14.5",browserslist:"4.28.8","engine.io":"6.6.7","fast-uri":"3.1.8",hono:"^4.13.7","ip-address":"10.7.1",nanoid:"3.3.18",dompurify:"3.4.13",postcss:"8.5.23",qs:"6.16.0","shell-quote":"1.11.0","socket.io-parser":"4.2.7",tmp:"0.2.7",toml:"4.2.0",undici:"8.10.2",ws:"^8.21.0","js-yaml":"4.3.2","@modelcontextprotocol/sdk":"1.31.0","proxy-addr":"2.0.8","source-map-js":"1.2.2"}};
|
|
3
3
|
export{r as Gh};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{$a as J7,Ea as i6,Ga as _4,Ha as R4,Ma as t6,Na as e6,Xa as z4,ab as Z7,bb as h4,cb as m4,eb as Q7,ga as C4,gb as Y8,hb as y0,ia as Y2,ib as m0,ja as H4,jb as r1,ka as D4,la as M4,ma as v6,mb as K7,na as u6,oa as A4,pa as d6,pb as F8,qa as T3,qb as E4,ra as l6,sa as s6,sb as B7,ta as c6,ua as n6,va as T4,wa as r6,xa as a6}from"./vm-hands-entry-lite-mgx65dde.js";import{Ab as r0,Bb as a0,Ib as P0,tb as Z4,ub as y6,vb as h6}from"./vm-hands-entry-lite-fq0zr7an.js";import{Jb as V7,Mb as G7,Ob as U7,Pb as X7}from"./vm-hands-entry-lite-93ejmwqn.js";import{Ub as o6}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Vb as k6,Wb as f6,Xb as b6,Yb as x6,Zb as L0}from"./vm-hands-entry-lite-n07kxrd1.js";import{$b as e1,ac as $2,bc as b3,dc as x3,fc as y3,gc as h3,kc as m3,mc as S6}from"./vm-hands-entry-lite-b2wdaq7x.js";import{Fc as i1,Ic as A7,Rc as T7}from"./vm-hands-entry-lite-7t05ea2h.js";import{$d as f8,Ad as I6,Bd as A6,Cd as T6,Dd as _6,Ed as R6,Gd as P6,Hd as z6,Id as E6,Jd as q6,Kd as g6,Pd as A8,Qd as T8,Rd as _8,Sc as w1,Sd as R8,Tc as K2,Td as P8,Uc as V6,Ud as z8,Vc as A3,Wc as $4,Wd as E8,Xc as J4,Xd as q8,Yc as M0,Yd as g8,Zd as S8,_d as k8,ad as N0,ae as b8,be as x8,ce as y8,dd as d,de as h8,ed as g1,hd as I8,jd as S1,ld as G6,md as U6,nd as X6,od as W6,pd as Y6,qd as F6,rd as N6,sd as C6,td as H6,ud as D6,vd as M6,wd as L6,xd as w6,yd as O6,zd as j6}from"./vm-hands-entry-lite-t497ewn2.js";import{ee as V}from"./vm-hands-entry-lite-psybjyay.js";import{Ae as _7,De as Y5,Ee as c1,fe as L7,ge as w7,he as O7,ie as j7,je as I7,pe as r5,te as W5,ue as g5}from"./vm-hands-entry-lite-28ta42wn.js";import{bf as P4,if as $7}from"./vm-hands-entry-lite-wh0qp1gf.js";import{Af as m6,nf as L3}from"./vm-hands-entry-lite-yhz6sv35.js";import{Fg as W7,Gg as Y7,Hg as F7,Ig as N7,Kg as C7,Lg as H7,Ng as D7,Og as M7}from"./vm-hands-entry-lite-22jgncrd.js";import{ah as a1}from"./vm-hands-entry-lite-mzxhng4z.js";import{ch as I1,dh as p6,eh as j4,fh as I4}from"./vm-hands-entry-lite-cp1wqjs5.js";import{hh as M3,jh as J1,ph as W8,qh as G4}from"./vm-hands-entry-lite-ne8kkvk4.js";import{Oh as H}from"./vm-hands-entry-lite-v6tkjqb1.js";import{Uh as J8}from"./vm-hands-entry-lite-cxs89wzv.js";import{request as n7}from"http";import{request as r7}from"https";import{lookup as a7}from"dns/promises";import{isIP as i7}from"net";async function o7($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?r7:n7)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:x3},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),K.end($.body)})}var v3=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),t7=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function p3($,J=0){if(!$||typeof $!=="object"||J>3)return null;let Z=$.code;if(typeof Z==="string"){if(v3.has(Z))return"custom_endpoint_host_not_found";if(t7.has(Z))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(Z))return"custom_endpoint_tls_failed"}for(let Q of[...$ instanceof AggregateError?$.errors:[],$.cause]){let K=p3(Q,J+1);if(K)return K}return null}async function e7($,J){let Z=p3($),Q=new URL(J).hostname.replace(/^\[|\]$/g,"");if(Z!==null&&Z!=="custom_endpoint_connection_failed"||i7(Q)!==0)return Z;let K;return await Promise.race([a7(Q).then(()=>!0,(G)=>!v3.has(String(G?.code))),new Promise((G)=>{K=setTimeout(()=>G(!0),5000)})]).finally(()=>clearTimeout(K))?Z:"custom_endpoint_host_not_found"}function $9($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function J9($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let W=Buffer.allocUnsafe(G.length*Q.length+B),Y=0;for(let X of G){while(B&&Z[B]!==X){let N=K[B-1];Y+=Z.copy(W,Y,0,B-N),B=N}if(Z[B]===X){if(B++,B===Z.length)Y+=Q.copy(W,Y),B=0}else W[Y++]=X}if(U)Y+=Z.copy(W,Y,0,B),B=0;return W.subarray(0,Y)}}async function u3($){$.signal.throwIfAborted();let J=h3.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=m3.parse(await $.credential($.signal));if(!y3(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,W=0,Y=$9(Q.apiKey),X=J9(Q.apiKey,Y),N=async(F,D)=>{$.signal.throwIfAborted(),await new Promise((w,M)=>{let j=()=>{$.signal.removeEventListener("abort",j),M($.signal.reason)};if($.signal.addEventListener("abort",j,{once:!0}),$.signal.aborted){j();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(F,D)}).then(()=>{$.signal.removeEventListener("abort",j),w()},(O)=>{$.signal.removeEventListener("abort",j),M(O)})})},C=async(F)=>{if(G+=F.length,G>$2)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let D=0;D<F.length;D+=e1){if(W>=b3)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await N(`custom_endpoint.chunk.${W++}`,{eof:!1,data:F.subarray(D,D+e1).toString("base64")})}};try{let F=await o7({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=F.response,B=F.close;let D=K.statusCode??500;if(D>=300&&D<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let w={};for(let M of["content-type","retry-after","x-request-id","request-id"]){let j=K.headers[M];if(typeof j==="string")w[M]=j.replaceAll(Q.apiKey,Y).slice(0,4096)}await N("custom_endpoint.headers",{status:D,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,Y).slice(0,256),headers:w});for await(let M of K){$.signal.throwIfAborted();let j=Buffer.isBuffer(M)?M:Buffer.from(M);if(U+=j.length,U>$2)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(X(j))}return await C(X(Buffer.alloc(0),!0)),await N(`custom_endpoint.chunk.${W}`,{eof:!0}),{bytes:G,chunks:W}}catch(F){if($.signal.throwIfAborted(),F instanceof H)throw F;throw new H((K?null:await e7(F,Z.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as d3}from"path";function Z9($,J){return $===d3(J,".ara","workspace")||$===d3(J,".reason","workspace")}function l3($,J){let Z=$.filter((Q)=>Z9(Q.path,J));return Z.length===1?Z[0].path:null}var Q9=/^[a-f0-9]{64}$/;var J2=32,K9=/^\/[^\x00-\x1f\x7f\\]*$/;function D1($){if(typeof $!=="string"||$.length>4096||!K9.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function M1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!D1(J.home)||!Array.isArray(J.roots)||J.roots.length>J2)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!Q9.test(K)||!D1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}import{spawn as V9}from"child_process";import*as q from"fs";import*as r from"path";import{homedir as G9}from"os";function s3($,J,Z,Q="gh"){if(!["gh","git"].includes(Q))throw Error("local_device_gh_unavailable");let K=$.realpathSync(Z),B=Q==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+Q;for(let G of["/opt/homebrew/bin/"+Q,"/usr/local/bin/"+Q,B])try{let U=$.realpathSync(G);if(U===K||U.startsWith(K+J.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...Q==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((Y)=>U.startsWith(Y)))continue;let W=$.statSync(U);if(!W.isFile()||(W.mode&18)!==0||![0,process.getuid()].includes(W.uid))continue;return $.accessSync(U,$.constants.X_OK),U}catch{continue}throw Error("local_device_gh_unavailable")}function c3($,J){let Z=1;for(let Q=0;Q<J;Q+=1)if($.charCodeAt(Q)===10)Z+=1;return Z}var n3=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function Z2($){let J=$.trim().replaceAll("\\","/");if(!J)return{valid:!1,reason:"empty_path"};if(J.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(J.split("/").includes("..")||J.includes("../")||J.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(J===".git"||J.startsWith(".git/")||J.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function r3($){return[...new Set($.map((J)=>J.trim()).filter((J)=>J.length>=8))]}function a3($,J){return[...J.matchAll(new RegExp($.regex.source,`${$.regex.flags}g`))]}function L1($,J=[],Z={}){let Q=[],K=Z.published??new Set,B=r3(J).filter((G)=>!K.has(G));for(let G of $){let U=Z2(G.path);if(!U.valid){Q.push({path:G.path,reason:U.reason??"invalid_path"});continue}let W=G.content??"",Y=B.map((X)=>({secret:X,offset:W.indexOf(X)})).filter((X)=>X.offset>=0).sort((X,N)=>X.offset-N.offset);if(Y.length>0){let X=[...new Set(Y.flatMap((N)=>Z.secretNames?.(N.secret)??[]))];Q.push({path:G.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:c3(W,Y[0].offset),...X.length>0?{secretNames:X}:{}})}for(let X of n3){let N=a3(X,W).find((C)=>!K.has(C[0]));if(N){Q.push({path:G.path,reason:`credential_pattern_detected: ${X.name}`,pattern:X.name,ruleId:X.name,line:c3(W,N.index)});break}}}return{clean:Q.length===0,violations:Q,scannedObjectCount:$.length}}function i3($,J=[]){let Z=r3(J),Q=new Set;for(let{content:K}of $){for(let B of Z)if(K.includes(B))Q.add(B);for(let B of n3)for(let G of a3(B,K))Q.add(G[0])}return[...Q]}function B9($,J){let Z=0;for(let Q=$.indexOf(J);Q>=0;Q=$.indexOf(J,Q+J.length))Z+=1;return Z}function o3($,J,Z){let Q=(K,B)=>K.reduce((G,U)=>G+B9(U,B),0);return new Set($.filter((K)=>Q(J,K)<=Q(Z,K)))}var T0=4194304,t3=536870912,Q2=/^[a-f0-9]{40}$/,U9=($,J,Z)=>new Promise((Q)=>{if(Z.signal?.aborted){Q({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let K;try{K=V9($,J,{cwd:Z.cwd,env:Z.env,detached:!0,stdio:["pipe","pipe","pipe"]})}catch{Q({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let B=Buffer.alloc(0),G=Buffer.alloc(0),U,W=!1,Y=(F)=>{if(U??=Error(F),K.pid)try{process.kill(-K.pid,"SIGKILL")}catch{}},X=()=>Y("cancelled"),N=setTimeout(()=>Y("timeout"),Z.timeout);Z.signal?.addEventListener("abort",X,{once:!0});let C=(F)=>{if(W)return;W=!0,clearTimeout(N),Z.signal?.removeEventListener("abort",X),Q({status:F,stdout:B,stderr:G,...U?{error:U}:{}})};if(K.stdout.on("data",(F)=>{if(B.length+G.length+F.length>Z.maxBuffer)Y("output_limit");else B=Buffer.concat([B,F])}),K.stderr.on("data",(F)=>{if(B.length+G.length+F.length>Z.maxBuffer)Y("output_limit");else G=Buffer.concat([G,F])}),K.on("error",()=>{if(Y("spawn_failed"),!K.pid)C(null)}),K.on("close",(F)=>C(F)),K.stdin.on("error",()=>Y("input_failed")),K.stdin.end(Z.input),Z.signal?.aborted)X()}),X9={command:U9,gh:($,J)=>s3(q,r,$,J),home:G9};function A($){throw Error($)}function W9($,J){let Z=(K)=>K.trim().replace(/^co-authored-by:\s*/i,"Co-authored-by: "),Q=new Set($.split(/\r?\n/).map(Z));return[...new Set(J)].filter((K)=>!Q.has(Z(K)))}var Y9=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),F9=($)=>JSON.stringify($,(J,Z)=>Y9.has(J)?void 0:Z);function e3($,J,Z){let Q=[...new Set($.map((B)=>`${J(B.path)}${B.line?`:${B.line}`:""} (${B.reason==="literal_secret_detected"?`value of ${B.secretNames?.length?B.secretNames.slice(0,3).join(", "):"a session variable"}`:`${B.ruleId??"credential"} credential`})`))].slice(0,10),K=$.some((B)=>B.reason==="literal_secret_detected");A(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${Q.join("; ")}. Nothing was sent. ${Z}${K?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function Q4($,J,Z=X9){let Q=w1.parse($);if(!["darwin","linux"].includes(process.platform))A("local_device_gh_platform_unavailable");J.assertCurrent();let K=q.realpathSync(J.root);if(K==="/")A("local_device_gh_root_unavailable");if(!M0(Q)&&!J.forbiddenSecretValues)A("local_device_gh_secret_scope_unavailable");if(!M0(Q)&&J.readOnly)A("local_device_gh_read_only");if(!M0(Q)){let L=L1([{path:"github-operation",content:F9(Q)}],J.forbiddenSecretValues,J.secretNames?{secretNames:J.secretNames}:{});if(!L.clean)e3(L.violations,()=>`the ${Q.kind} request text`,"Remove it from the pull request text and try again.")}let B=Z.gh(K),G=Z.home(),U=Z.gh(K,"git"),W=J.privateDirectory?q.realpathSync(J.privateDirectory):q.realpathSync(G);if(!M0(Q)&&(!J.privateDirectory||W===K||W.startsWith(K+r.sep)))A("local_device_gh_private_scope_unavailable");let Y={PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:G,GH_CONFIG_DIR:r.join(G,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((L)=>process.env[L]?[[L,process.env[L]]]:[])):{}},X=async(L,T,P=W,k,x=T0)=>{J.assertCurrent();let y=await Z.command(L,T,{cwd:P,env:Y,input:k,maxBuffer:x,timeout:Math.max(1,Math.min(60000,(J.deadlineMs??Date.now()+60000)-Date.now())),signal:J.signal});if(J.assertCurrent(),y.error||y.status!==0)A("local_device_gh_command_failed");return y.stdout},N=async(L)=>(await X(B,L)).toString("utf8").trim(),C=async(L,T="application/vnd.github+json")=>{$4(Q.repoFullName,L,{headers:{accept:T}}),J.assertCurrent();let P=await Z.command(B,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${T}`,L],{cwd:W,env:Y,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal});if(J.assertCurrent(),P.error&&P.status===null)A("local_device_gh_response_unavailable");let k=P.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!k)A("local_device_gh_response_invalid");let x=Number(k[1]);if(x>=200&&x<300&&P.status!==0)A("local_device_gh_response_unavailable");if(Buffer.byteLength(k[3])>K2)A("local_device_gh_response_too_large");let y={};for(let i of k[2].split(/\r?\n/)){let e=i.indexOf(":"),D0=i.slice(0,e).toLowerCase();if(["link","content-type"].includes(D0))y[D0]=i.slice(e+1).trim().slice(0,8192)}return{kind:"read",status:x,headers:y,body:x>=200&&x<300?k[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(Q.kind==="read")return C(Q.path,Q.accept);if(Q.kind==="pr_review_context"){let[L,T]=Q.repoFullName.split("/"),P=await N(["api","graphql","--hostname","github.com","-f",`query=${J4}`,"-f",`owner=${L}`,"-f",`repo=${T}`,"-F",`number=${Q.number}`,...Q.after?["-f",`after=${Q.after}`]:[]]);if(Buffer.byteLength(P)>K2)A("local_device_gh_response_too_large");let k=JSON.parse(P);if(k.errors||k.data?.repository?.nameWithOwner?.toLowerCase()!==Q.repoFullName.toLowerCase()||k.data.repository.pullRequest?.number!==Q.number)A("local_device_gh_response_invalid");return{kind:"pr_review_context",body:P}}if(Q.kind==="pr_merge"){let L=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),T=JSON.parse(L.body),P=(y)=>y.number===Q.number&&y.html_url===`https://github.com/${Q.repoFullName}/pull/${Q.number}`&&y.base?.repo?.full_name?.toLowerCase()===Q.repoFullName.toLowerCase()&&y.base?.ref===Q.expectedBaseRef&&y.head?.sha===Q.expectedHeadSha;if(L.status!==200||!P(T)||T.state!=="open"||T.draft!==!1||T.head?.sha!==Q.expectedHeadSha||T.base?.repo?.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase())A("local_device_gh_merge_target_changed");await N(["pr","merge",String(Q.number),`--repo=${Q.repoFullName}`,`--${Q.method}`,"--match-head-commit",Q.expectedHeadSha,...Q.commitBody!==void 0&&Q.method!=="rebase"?[`--body=${Q.commitBody}`]:[]]);let k=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),x=JSON.parse(k.body);if(k.status!==200||!P(x)||x.merged!==!0)A("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:Q.number,merged:!0}}if(Q.kind==="pr_create"){if(Q.head===Q.base)A("local_device_gh_default_branch");let L=await N(["pr","create","--repo",Q.repoFullName,"--head",Q.head,"--base",Q.base,`--title=${Q.title}`,`--body=${Q.body}`,...Q.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+Q.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(L))A("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:L}}if(Q.kind==="pr_mutation"){let L=Q.mutation,T=L.action==="edit"?["edit",...L.title!==void 0?[`--title=${L.title}`]:[],...L.body!==void 0?[`--body=${L.body}`]:[],...L.base?[`--base=${L.base}`]:[]]:L.action==="metadata"?["edit",`--${L.change}-${L.field}=${L.value}`]:L.action==="ready"?["ready"]:L.action==="draft"?["ready","--undo"]:["close"];return await N(["pr",...T,String(Q.number),"--repo",Q.repoFullName]),{kind:"pr_mutation",number:Q.number,applied:!0}}if(!J.repoPath)A("local_device_gh_workspace_unavailable");let F=q.realpathSync(J.repoPath);if(F!==K&&!F.startsWith(K+r.sep))A("local_device_gh_workspace_unavailable");let D=`https://github.com/${Q.repoFullName}.git`,w="!'"+B.replace(/'/g,"'\\''")+"' auth git-credential",M=Function("return ("+Z4+")")(),j=(L,T,P)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",L,T,...P]]:[T,P],O=async(L,T,P,k=T0)=>{let x=L===W||L.startsWith(W+r.sep),y=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...x?["-c",`credential.https://github.com.helper=${w}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",...T];if(x)return X(U,y,L,P,k);let i=r.join(F,".ara-local-gh-tmp");if(q.mkdirSync(i,{recursive:!0,mode:448}),q.lstatSync(i).isSymbolicLink()||q.realpathSync(i)!==i)A("local_device_gh_workspace_unavailable");J.assertCurrent();let e=await Z.command(...j(M(F,i),U,y),{cwd:L,input:P,maxBuffer:k,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:F,TMPDIR:i,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),e.error||e.status!==0)A("local_device_gh_collection_failed");return e.stdout},R=async(L,T)=>(await O(L,T)).toString("utf8").trim(),g=async(L,T)=>{let P=r.join(L,".ara-local-gh-tmp");if(q.mkdirSync(P,{recursive:!0,mode:448}),q.lstatSync(P).isSymbolicLink()||q.realpathSync(P)!==P)A("local_device_gh_workspace_unavailable");J.assertCurrent();let k=await Z.command(...j(M(L,P),"/bin/sh",["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",T]),{cwd:L,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:L,TMPDIR:P}});if(J.assertCurrent(),k.error||k.status!==0)A("local_device_gh_materialization_failed")},v=async(L)=>{let T=new Map;if(L.length===0)return T;let P=await O(E,["cat-file","--batch"],[...new Set(L)].join(`
|
|
2
|
+
import{$a as J7,Ea as i6,Ga as _4,Ha as R4,Ma as t6,Na as e6,Xa as z4,ab as Z7,bb as h4,cb as m4,eb as Q7,ga as C4,gb as Y8,hb as y0,ia as Y2,ib as m0,ja as H4,jb as r1,ka as D4,la as M4,ma as v6,mb as K7,na as u6,oa as A4,pa as d6,pb as F8,qa as T3,qb as E4,ra as l6,sa as s6,sb as B7,ta as c6,ua as n6,va as T4,wa as r6,xa as a6}from"./vm-hands-entry-lite-pwzz9ntw.js";import{Ab as r0,Bb as a0,Ib as P0,tb as Z4,ub as y6,vb as h6}from"./vm-hands-entry-lite-fq0zr7an.js";import{Jb as V7,Mb as G7,Ob as U7,Pb as X7}from"./vm-hands-entry-lite-93ejmwqn.js";import{Ub as o6}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Vb as k6,Wb as f6,Xb as b6,Yb as x6,Zb as L0}from"./vm-hands-entry-lite-n07kxrd1.js";import{$b as e1,ac as $2,bc as b3,dc as x3,fc as y3,gc as h3,kc as m3,mc as S6}from"./vm-hands-entry-lite-b2wdaq7x.js";import{Fc as i1,Ic as A7,Rc as T7}from"./vm-hands-entry-lite-qwba7w42.js";import{$d as f8,Ad as I6,Bd as A6,Cd as T6,Dd as _6,Ed as R6,Gd as P6,Hd as z6,Id as E6,Jd as q6,Kd as g6,Pd as A8,Qd as T8,Rd as _8,Sc as w1,Sd as R8,Tc as K2,Td as P8,Uc as V6,Ud as z8,Vc as A3,Wc as $4,Wd as E8,Xc as J4,Xd as q8,Yc as M0,Yd as g8,Zd as S8,_d as k8,ad as N0,ae as b8,be as x8,ce as y8,dd as d,de as h8,ed as g1,hd as I8,jd as S1,ld as G6,md as U6,nd as X6,od as W6,pd as Y6,qd as F6,rd as N6,sd as C6,td as H6,ud as D6,vd as M6,wd as L6,xd as w6,yd as O6,zd as j6}from"./vm-hands-entry-lite-t497ewn2.js";import{ee as V}from"./vm-hands-entry-lite-psybjyay.js";import{Ae as _7,De as Y5,Ee as c1,fe as L7,ge as w7,he as O7,ie as j7,je as I7,pe as r5,te as W5,ue as g5}from"./vm-hands-entry-lite-yjzz85pt.js";import{bf as P4,if as $7}from"./vm-hands-entry-lite-wh0qp1gf.js";import{Af as m6,nf as L3}from"./vm-hands-entry-lite-yhz6sv35.js";import{Fg as W7,Gg as Y7,Hg as F7,Ig as N7,Kg as C7,Lg as H7,Ng as D7,Og as M7}from"./vm-hands-entry-lite-22jgncrd.js";import{ah as a1}from"./vm-hands-entry-lite-mzxhng4z.js";import{ch as I1,dh as p6,eh as j4,fh as I4}from"./vm-hands-entry-lite-cp1wqjs5.js";import{hh as M3,jh as J1,ph as W8,qh as G4}from"./vm-hands-entry-lite-ne8kkvk4.js";import{Oh as H}from"./vm-hands-entry-lite-v6tkjqb1.js";import{Uh as J8}from"./vm-hands-entry-lite-cxs89wzv.js";import{request as n7}from"http";import{request as r7}from"https";import{lookup as a7}from"dns/promises";import{isIP as i7}from"net";async function o7($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?r7:n7)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:x3},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),K.end($.body)})}var v3=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),t7=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function p3($,J=0){if(!$||typeof $!=="object"||J>3)return null;let Z=$.code;if(typeof Z==="string"){if(v3.has(Z))return"custom_endpoint_host_not_found";if(t7.has(Z))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(Z))return"custom_endpoint_tls_failed"}for(let Q of[...$ instanceof AggregateError?$.errors:[],$.cause]){let K=p3(Q,J+1);if(K)return K}return null}async function e7($,J){let Z=p3($),Q=new URL(J).hostname.replace(/^\[|\]$/g,"");if(Z!==null&&Z!=="custom_endpoint_connection_failed"||i7(Q)!==0)return Z;let K;return await Promise.race([a7(Q).then(()=>!0,(G)=>!v3.has(String(G?.code))),new Promise((G)=>{K=setTimeout(()=>G(!0),5000)})]).finally(()=>clearTimeout(K))?Z:"custom_endpoint_host_not_found"}function $9($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function J9($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let W=Buffer.allocUnsafe(G.length*Q.length+B),Y=0;for(let X of G){while(B&&Z[B]!==X){let N=K[B-1];Y+=Z.copy(W,Y,0,B-N),B=N}if(Z[B]===X){if(B++,B===Z.length)Y+=Q.copy(W,Y),B=0}else W[Y++]=X}if(U)Y+=Z.copy(W,Y,0,B),B=0;return W.subarray(0,Y)}}async function u3($){$.signal.throwIfAborted();let J=h3.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=m3.parse(await $.credential($.signal));if(!y3(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,W=0,Y=$9(Q.apiKey),X=J9(Q.apiKey,Y),N=async(F,D)=>{$.signal.throwIfAborted(),await new Promise((w,M)=>{let j=()=>{$.signal.removeEventListener("abort",j),M($.signal.reason)};if($.signal.addEventListener("abort",j,{once:!0}),$.signal.aborted){j();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(F,D)}).then(()=>{$.signal.removeEventListener("abort",j),w()},(O)=>{$.signal.removeEventListener("abort",j),M(O)})})},C=async(F)=>{if(G+=F.length,G>$2)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let D=0;D<F.length;D+=e1){if(W>=b3)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await N(`custom_endpoint.chunk.${W++}`,{eof:!1,data:F.subarray(D,D+e1).toString("base64")})}};try{let F=await o7({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=F.response,B=F.close;let D=K.statusCode??500;if(D>=300&&D<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let w={};for(let M of["content-type","retry-after","x-request-id","request-id"]){let j=K.headers[M];if(typeof j==="string")w[M]=j.replaceAll(Q.apiKey,Y).slice(0,4096)}await N("custom_endpoint.headers",{status:D,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,Y).slice(0,256),headers:w});for await(let M of K){$.signal.throwIfAborted();let j=Buffer.isBuffer(M)?M:Buffer.from(M);if(U+=j.length,U>$2)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(X(j))}return await C(X(Buffer.alloc(0),!0)),await N(`custom_endpoint.chunk.${W}`,{eof:!0}),{bytes:G,chunks:W}}catch(F){if($.signal.throwIfAborted(),F instanceof H)throw F;throw new H((K?null:await e7(F,Z.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as d3}from"path";function Z9($,J){return $===d3(J,".ara","workspace")||$===d3(J,".reason","workspace")}function l3($,J){let Z=$.filter((Q)=>Z9(Q.path,J));return Z.length===1?Z[0].path:null}var Q9=/^[a-f0-9]{64}$/;var J2=32,K9=/^\/[^\x00-\x1f\x7f\\]*$/;function D1($){if(typeof $!=="string"||$.length>4096||!K9.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function M1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!D1(J.home)||!Array.isArray(J.roots)||J.roots.length>J2)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!Q9.test(K)||!D1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}import{spawn as V9}from"child_process";import*as q from"fs";import*as r from"path";import{homedir as G9}from"os";function s3($,J,Z,Q="gh"){if(!["gh","git"].includes(Q))throw Error("local_device_gh_unavailable");let K=$.realpathSync(Z),B=Q==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+Q;for(let G of["/opt/homebrew/bin/"+Q,"/usr/local/bin/"+Q,B])try{let U=$.realpathSync(G);if(U===K||U.startsWith(K+J.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...Q==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((Y)=>U.startsWith(Y)))continue;let W=$.statSync(U);if(!W.isFile()||(W.mode&18)!==0||![0,process.getuid()].includes(W.uid))continue;return $.accessSync(U,$.constants.X_OK),U}catch{continue}throw Error("local_device_gh_unavailable")}function c3($,J){let Z=1;for(let Q=0;Q<J;Q+=1)if($.charCodeAt(Q)===10)Z+=1;return Z}var n3=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function Z2($){let J=$.trim().replaceAll("\\","/");if(!J)return{valid:!1,reason:"empty_path"};if(J.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(J.split("/").includes("..")||J.includes("../")||J.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(J===".git"||J.startsWith(".git/")||J.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function r3($){return[...new Set($.map((J)=>J.trim()).filter((J)=>J.length>=8))]}function a3($,J){return[...J.matchAll(new RegExp($.regex.source,`${$.regex.flags}g`))]}function L1($,J=[],Z={}){let Q=[],K=Z.published??new Set,B=r3(J).filter((G)=>!K.has(G));for(let G of $){let U=Z2(G.path);if(!U.valid){Q.push({path:G.path,reason:U.reason??"invalid_path"});continue}let W=G.content??"",Y=B.map((X)=>({secret:X,offset:W.indexOf(X)})).filter((X)=>X.offset>=0).sort((X,N)=>X.offset-N.offset);if(Y.length>0){let X=[...new Set(Y.flatMap((N)=>Z.secretNames?.(N.secret)??[]))];Q.push({path:G.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:c3(W,Y[0].offset),...X.length>0?{secretNames:X}:{}})}for(let X of n3){let N=a3(X,W).find((C)=>!K.has(C[0]));if(N){Q.push({path:G.path,reason:`credential_pattern_detected: ${X.name}`,pattern:X.name,ruleId:X.name,line:c3(W,N.index)});break}}}return{clean:Q.length===0,violations:Q,scannedObjectCount:$.length}}function i3($,J=[]){let Z=r3(J),Q=new Set;for(let{content:K}of $){for(let B of Z)if(K.includes(B))Q.add(B);for(let B of n3)for(let G of a3(B,K))Q.add(G[0])}return[...Q]}function B9($,J){let Z=0;for(let Q=$.indexOf(J);Q>=0;Q=$.indexOf(J,Q+J.length))Z+=1;return Z}function o3($,J,Z){let Q=(K,B)=>K.reduce((G,U)=>G+B9(U,B),0);return new Set($.filter((K)=>Q(J,K)<=Q(Z,K)))}var T0=4194304,t3=536870912,Q2=/^[a-f0-9]{40}$/,U9=($,J,Z)=>new Promise((Q)=>{if(Z.signal?.aborted){Q({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let K;try{K=V9($,J,{cwd:Z.cwd,env:Z.env,detached:!0,stdio:["pipe","pipe","pipe"]})}catch{Q({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let B=Buffer.alloc(0),G=Buffer.alloc(0),U,W=!1,Y=(F)=>{if(U??=Error(F),K.pid)try{process.kill(-K.pid,"SIGKILL")}catch{}},X=()=>Y("cancelled"),N=setTimeout(()=>Y("timeout"),Z.timeout);Z.signal?.addEventListener("abort",X,{once:!0});let C=(F)=>{if(W)return;W=!0,clearTimeout(N),Z.signal?.removeEventListener("abort",X),Q({status:F,stdout:B,stderr:G,...U?{error:U}:{}})};if(K.stdout.on("data",(F)=>{if(B.length+G.length+F.length>Z.maxBuffer)Y("output_limit");else B=Buffer.concat([B,F])}),K.stderr.on("data",(F)=>{if(B.length+G.length+F.length>Z.maxBuffer)Y("output_limit");else G=Buffer.concat([G,F])}),K.on("error",()=>{if(Y("spawn_failed"),!K.pid)C(null)}),K.on("close",(F)=>C(F)),K.stdin.on("error",()=>Y("input_failed")),K.stdin.end(Z.input),Z.signal?.aborted)X()}),X9={command:U9,gh:($,J)=>s3(q,r,$,J),home:G9};function A($){throw Error($)}function W9($,J){let Z=(K)=>K.trim().replace(/^co-authored-by:\s*/i,"Co-authored-by: "),Q=new Set($.split(/\r?\n/).map(Z));return[...new Set(J)].filter((K)=>!Q.has(Z(K)))}var Y9=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),F9=($)=>JSON.stringify($,(J,Z)=>Y9.has(J)?void 0:Z);function e3($,J,Z){let Q=[...new Set($.map((B)=>`${J(B.path)}${B.line?`:${B.line}`:""} (${B.reason==="literal_secret_detected"?`value of ${B.secretNames?.length?B.secretNames.slice(0,3).join(", "):"a session variable"}`:`${B.ruleId??"credential"} credential`})`))].slice(0,10),K=$.some((B)=>B.reason==="literal_secret_detected");A(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${Q.join("; ")}. Nothing was sent. ${Z}${K?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function Q4($,J,Z=X9){let Q=w1.parse($);if(!["darwin","linux"].includes(process.platform))A("local_device_gh_platform_unavailable");J.assertCurrent();let K=q.realpathSync(J.root);if(K==="/")A("local_device_gh_root_unavailable");if(!M0(Q)&&!J.forbiddenSecretValues)A("local_device_gh_secret_scope_unavailable");if(!M0(Q)&&J.readOnly)A("local_device_gh_read_only");if(!M0(Q)){let L=L1([{path:"github-operation",content:F9(Q)}],J.forbiddenSecretValues,J.secretNames?{secretNames:J.secretNames}:{});if(!L.clean)e3(L.violations,()=>`the ${Q.kind} request text`,"Remove it from the pull request text and try again.")}let B=Z.gh(K),G=Z.home(),U=Z.gh(K,"git"),W=J.privateDirectory?q.realpathSync(J.privateDirectory):q.realpathSync(G);if(!M0(Q)&&(!J.privateDirectory||W===K||W.startsWith(K+r.sep)))A("local_device_gh_private_scope_unavailable");let Y={PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:G,GH_CONFIG_DIR:r.join(G,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((L)=>process.env[L]?[[L,process.env[L]]]:[])):{}},X=async(L,T,P=W,k,x=T0)=>{J.assertCurrent();let y=await Z.command(L,T,{cwd:P,env:Y,input:k,maxBuffer:x,timeout:Math.max(1,Math.min(60000,(J.deadlineMs??Date.now()+60000)-Date.now())),signal:J.signal});if(J.assertCurrent(),y.error||y.status!==0)A("local_device_gh_command_failed");return y.stdout},N=async(L)=>(await X(B,L)).toString("utf8").trim(),C=async(L,T="application/vnd.github+json")=>{$4(Q.repoFullName,L,{headers:{accept:T}}),J.assertCurrent();let P=await Z.command(B,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${T}`,L],{cwd:W,env:Y,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal});if(J.assertCurrent(),P.error&&P.status===null)A("local_device_gh_response_unavailable");let k=P.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!k)A("local_device_gh_response_invalid");let x=Number(k[1]);if(x>=200&&x<300&&P.status!==0)A("local_device_gh_response_unavailable");if(Buffer.byteLength(k[3])>K2)A("local_device_gh_response_too_large");let y={};for(let i of k[2].split(/\r?\n/)){let e=i.indexOf(":"),D0=i.slice(0,e).toLowerCase();if(["link","content-type"].includes(D0))y[D0]=i.slice(e+1).trim().slice(0,8192)}return{kind:"read",status:x,headers:y,body:x>=200&&x<300?k[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(Q.kind==="read")return C(Q.path,Q.accept);if(Q.kind==="pr_review_context"){let[L,T]=Q.repoFullName.split("/"),P=await N(["api","graphql","--hostname","github.com","-f",`query=${J4}`,"-f",`owner=${L}`,"-f",`repo=${T}`,"-F",`number=${Q.number}`,...Q.after?["-f",`after=${Q.after}`]:[]]);if(Buffer.byteLength(P)>K2)A("local_device_gh_response_too_large");let k=JSON.parse(P);if(k.errors||k.data?.repository?.nameWithOwner?.toLowerCase()!==Q.repoFullName.toLowerCase()||k.data.repository.pullRequest?.number!==Q.number)A("local_device_gh_response_invalid");return{kind:"pr_review_context",body:P}}if(Q.kind==="pr_merge"){let L=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),T=JSON.parse(L.body),P=(y)=>y.number===Q.number&&y.html_url===`https://github.com/${Q.repoFullName}/pull/${Q.number}`&&y.base?.repo?.full_name?.toLowerCase()===Q.repoFullName.toLowerCase()&&y.base?.ref===Q.expectedBaseRef&&y.head?.sha===Q.expectedHeadSha;if(L.status!==200||!P(T)||T.state!=="open"||T.draft!==!1||T.head?.sha!==Q.expectedHeadSha||T.base?.repo?.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase())A("local_device_gh_merge_target_changed");await N(["pr","merge",String(Q.number),`--repo=${Q.repoFullName}`,`--${Q.method}`,"--match-head-commit",Q.expectedHeadSha,...Q.commitBody!==void 0&&Q.method!=="rebase"?[`--body=${Q.commitBody}`]:[]]);let k=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),x=JSON.parse(k.body);if(k.status!==200||!P(x)||x.merged!==!0)A("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:Q.number,merged:!0}}if(Q.kind==="pr_create"){if(Q.head===Q.base)A("local_device_gh_default_branch");let L=await N(["pr","create","--repo",Q.repoFullName,"--head",Q.head,"--base",Q.base,`--title=${Q.title}`,`--body=${Q.body}`,...Q.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+Q.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(L))A("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:L}}if(Q.kind==="pr_mutation"){let L=Q.mutation,T=L.action==="edit"?["edit",...L.title!==void 0?[`--title=${L.title}`]:[],...L.body!==void 0?[`--body=${L.body}`]:[],...L.base?[`--base=${L.base}`]:[]]:L.action==="metadata"?["edit",`--${L.change}-${L.field}=${L.value}`]:L.action==="ready"?["ready"]:L.action==="draft"?["ready","--undo"]:["close"];return await N(["pr",...T,String(Q.number),"--repo",Q.repoFullName]),{kind:"pr_mutation",number:Q.number,applied:!0}}if(!J.repoPath)A("local_device_gh_workspace_unavailable");let F=q.realpathSync(J.repoPath);if(F!==K&&!F.startsWith(K+r.sep))A("local_device_gh_workspace_unavailable");let D=`https://github.com/${Q.repoFullName}.git`,w="!'"+B.replace(/'/g,"'\\''")+"' auth git-credential",M=Function("return ("+Z4+")")(),j=(L,T,P)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",L,T,...P]]:[T,P],O=async(L,T,P,k=T0)=>{let x=L===W||L.startsWith(W+r.sep),y=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...x?["-c",`credential.https://github.com.helper=${w}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",...T];if(x)return X(U,y,L,P,k);let i=r.join(F,".ara-local-gh-tmp");if(q.mkdirSync(i,{recursive:!0,mode:448}),q.lstatSync(i).isSymbolicLink()||q.realpathSync(i)!==i)A("local_device_gh_workspace_unavailable");J.assertCurrent();let e=await Z.command(...j(M(F,i),U,y),{cwd:L,input:P,maxBuffer:k,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:F,TMPDIR:i,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),e.error||e.status!==0)A("local_device_gh_collection_failed");return e.stdout},R=async(L,T)=>(await O(L,T)).toString("utf8").trim(),g=async(L,T)=>{let P=r.join(L,".ara-local-gh-tmp");if(q.mkdirSync(P,{recursive:!0,mode:448}),q.lstatSync(P).isSymbolicLink()||q.realpathSync(P)!==P)A("local_device_gh_workspace_unavailable");J.assertCurrent();let k=await Z.command(...j(M(L,P),"/bin/sh",["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",T]),{cwd:L,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:L,TMPDIR:P}});if(J.assertCurrent(),k.error||k.status!==0)A("local_device_gh_materialization_failed")},v=async(L)=>{let T=new Map;if(L.length===0)return T;let P=await O(E,["cat-file","--batch"],[...new Set(L)].join(`
|
|
3
3
|
`)+`
|
|
4
4
|
`,T0*8);for(let k=0;k<P.length;){let x=P.indexOf(10,k),[y,i,e]=P.subarray(k,x).toString("utf8").split(" ");if(x<0||!y||i!=="blob"||!/^[0-9]+$/.test(e??""))A("local_device_gh_object_invalid");T.set(y,P.subarray(x+1,x+1+Number(e)).toString("utf8")),k=x+1+Number(e)+1}return T},I=async(L,T,P)=>{let k=r.join(F,".ara-local-gh-tmp"),x=M(F,k)+`
|
|
5
5
|
(allow file-read* file-write* (subpath ${JSON.stringify(F)}))
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{t as d0}from"./vm-hands-entry-lite-xf6schkk.js";import{A as G5,B as B5,C as R7,D as C7,E as v3,F as i5,G as H5,H as _0,I as l$,J as p$,K as S0,L as J2,M as n5,N as n0,O as M6,P as Z3,Q as Z6,U as Q6,ba as x7,ca as E7,da as S7,ea as w7,fa as u3,y as l6,z as p6}from"./vm-hands-entry-lite-
|
|
2
|
+
import{t as d0}from"./vm-hands-entry-lite-xf6schkk.js";import{A as G5,B as B5,C as R7,D as C7,E as v3,F as i5,G as H5,H as _0,I as l$,J as p$,K as S0,L as J2,M as n5,N as n0,O as M6,P as Z3,Q as Z6,U as Q6,ba as x7,ca as E7,da as S7,ea as w7,fa as u3,y as l6,z as p6}from"./vm-hands-entry-lite-f8f057tx.js";import{Aa as K5,Ba as V5,Ca as L7,Da as D7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as W5,Ka as z7,La as W$,Oa as V4,Pa as H4,Qa as CJ,Ra as PJ,Sa as IJ,Ta as y0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as O7,db as U6,fb as h8,ha as r7,ib as u2,ka as z5,kb as a5,la as O5,lb as T3,nb as h5,oa as F5,qa as E5,rb as A7,sb as N3,ta as S5,ya as y5,za as f5}from"./vm-hands-entry-lite-pwzz9ntw.js";import{Ab as w5,Bb as b5,Ib as k5}from"./vm-hands-entry-lite-fq0zr7an.js";import{Nb as N5}from"./vm-hands-entry-lite-93ejmwqn.js";import{Ub as s5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{mc as Y5}from"./vm-hands-entry-lite-b2wdaq7x.js";import{Ac as bJ,Bc as Y4,Cc as F1,Dc as E8,Ec as G4,Ic as t5,Lc as P7,Oc as c6,Pc as s6,qc as i1,rc as G1,sc as I1,tc as L$,uc as HJ,vc as EJ,wc as SJ,xc as D$,yc as wJ,zc as e3}from"./vm-hands-entry-lite-qwba7w42.js";import{Fd as X5,Ld as $$,Vd as F2,Zc as b2,bd as F7,cd as W7}from"./vm-hands-entry-lite-t497ewn2.js";import{ee as G}from"./vm-hands-entry-lite-psybjyay.js";import{Be as J6,me as xJ,ne as o2,qe as I7,te as n$,ve as tJ,we as oJ}from"./vm-hands-entry-lite-yjzz85pt.js";import{$e as e1,Fe as k0,Ge as k$,Ie as x0,Je as j4,Le as e0,Me as z0,Ne as y9,Oe as AJ,Pe as RJ,Qe as E2,Re as q2,Se as f3,Te as I8,Ue as x8,Ve as Y$,We as v$,Xe as G0,Ye as T2,Ze as y7,_e as f7,af as R4,cf as Q3,df as h1,ef as v0,ff as y$,gf as X3,jf as m1}from"./vm-hands-entry-lite-wh0qp1gf.js";import{nf as x5}from"./vm-hands-entry-lite-yhz6sv35.js";import{mg as LJ,pg as r5,qg as h3,sg as U5}from"./vm-hands-entry-lite-7q2gywdm.js";import{$g as Z2,ah as c5}from"./vm-hands-entry-lite-mzxhng4z.js";import{ch as V0,eh as V7}from"./vm-hands-entry-lite-cp1wqjs5.js";import{Ch as r}from"./vm-hands-entry-lite-qgse6zav.js";import{Jh as j7}from"./vm-hands-entry-lite-14t846kp.js";import{Oh as g0}from"./vm-hands-entry-lite-v6tkjqb1.js";import{spawn as kJ,spawnSync as $V}from"child_process";import{closeSync as yJ,mkdirSync as JV,openSync as fJ,readdirSync as ZV,realpathSync as B1,rmSync as z$}from"fs";import{hostname as QV}from"os";import{dirname as $9,join as F0,resolve as XV}from"path";var $Z=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function U9($){let J=typeof $==="string"?$Z.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as KZ,randomBytes as z9}from"crypto";import{createInterface as VZ}from"readline";import{randomBytes as JZ}from"crypto";import{chmodSync as M9,existsSync as T9,lstatSync as ZZ,mkdirSync as QZ,readFileSync as _9,renameSync as XZ,unlinkSync as F9,writeFileSync as W9}from"fs";import{homedir as YZ}from"os";import{dirname as GZ,join as q9}from"path";function $1($=process.env,J=YZ()){let Z=$.XDG_CONFIG_HOME?.trim()||q9(J,".config"),X=x0({env:$})==="staging"?["staging"]:[];return q9(q2(Z,...X),"credentials.json")}function L9($,J=$1()){return QZ(GZ(J),{recursive:!0,mode:448}),W9(J,`${JSON.stringify($,null,2)}
|
|
3
3
|
`,{mode:384}),M9(J,384),J}function I$($=$1()){if(!T9($))return null;try{let J=_9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=e0(Q);if(X!==Q)BZ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function BZ($,J,Z){let Q=`${$}.${process.pid}.${JZ(6).toString("hex")}.tmp`;try{let X=ZZ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(W9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
|
|
4
4
|
`,{mode:384,flag:"wx"}),M9(Q,384),_9($,"utf8")!==J)throw Error("credentials_changed");XZ(Q,$)}catch{try{F9(Q)}catch{}}}function D9($=$1()){if(!T9($))return!1;return F9($),!0}var j9=["run","mcp:read","mcp:write","secrets:read","secrets:write","sessions:read","sessions:debug","devices:read","devices:write","devices:use","ssh:write","knowledge:read","memory:read","memory:write","skills:read","skills:write","repos:read","repos:write","reviews:read","reviews:write","deployment:read","analytics:read","org:read","org:write","attachments:read","attachments:write","guardrails:read","guardrails:write","network:read","network:write","automations:read","automations:write","agent_auth:read"];var pV=j9.filter(($)=>$!=="network:read"&&$!=="network:write");class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function A9(){let $=z9(48).toString("base64url"),J=KZ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:z9(32).toString("base64url")}}function HZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function NZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw HZ(Y,`OAuth token request failed (${X.status})`);return Y}var UZ=1e4;async function qZ($,J={}){let Z=J.fetchImpl??fetch,Q=await NZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(UZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return L9(X,J.path??$1()),X}var M2=new Map;function O9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function k1($={}){let J=$.path??$1(),Z=I$(J);if(!Z)return null;let Q=$.apiOrigin??k0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),B=M2.get(Y);if(B)return O9(B,$.signal);let V;return V=qZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=I$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return k1({fetchImpl:$.fetchImpl,path:J});return D9(J),null}).finally(()=>{if(M2.get(Y)===V)M2.delete(Y)}),M2.set(Y,V),O9(V,$.signal)}function R9($,J){return new Promise((Z)=>{let Q=VZ({input:$}),X=!1,Y=(V)=>{if(X)return;X=!0,J.removeEventListener("abort",B),Q.close(),$.pause(),Z(V)},B=()=>Y(null);J.addEventListener("abort",B,{once:!0}),Q.once("line",(V)=>Y(V)),Q.once("close",()=>Y(null))})}var MZ=G.object({label:G.string(),used_percent:G.number().min(0).max(100).nullable(),resets_at:G.string().nullable(),exhausted:G.boolean().nullable()}),TZ=G.object({groups:G.array(G.object({selectable:G.boolean().optional(),accounts:G.array(G.object({source_id:G.string().min(1),model_ids:G.array(G.string().min(1)).optional()}))}))});function _Z($){let J=TZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class Y0 extends Error{status;code;suggestedModel;retryAfterMs;resolutionReason;constructor($,J,Z,Q,X,Y){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.resolutionReason=Y;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof Y0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var FZ=["minimal","low","medium","high","xhigh","max"],WZ=G.object({id:G.string().min(1),kind:G.string(),name:G.string(),custom_name:G.string().nullish(),status:G.string(),online:G.boolean(),compatible:G.boolean().optional(),compatibility_reason:G.string().nullish(),folder_lane_of:G.string().nullish(),roots:G.array(G.object({id:G.string().min(1),label:G.string()}))}),LZ=G.object({devices:G.array(WZ),end_cursor:G.string().nullish(),has_next_page:G.boolean().optional()}),DZ=G.object({id:G.string().min(1),name:G.string()}),jZ=G.object({items:G.array(DZ)}),zZ=G.object({id:G.string().min(1),name:G.string(),main:G.boolean(),mine:G.boolean(),session_id:G.string().nullish(),appearance:G.object({color:G.string().nullish()}).nullish().catch(null)}),OZ=G.object({items:G.array(zZ)}),AZ=G.object({skill_id:G.string().min(1),name:G.string(),description:G.string().nullish(),activation_keywords:G.array(G.string()).default([]),is_enabled:G.boolean().default(!0)}),RZ=G.object({items:G.array(AZ).default([])}),CZ=G.object({id:G.string().min(1),kind:G.string(),enabled:G.boolean(),schedule:G.object({expression:G.string().nullish(),every_seconds:G.number().nullish(),next_run_at:G.string().nullish()}).nullish(),github:G.object({event:G.string().nullish(),action:G.string().nullish(),repo:G.string().nullish()}).nullish(),last_fired_at:G.string().nullish()}),P9=G.object({id:G.string().min(1),name:G.string().nullish(),instructions:G.string().nullish(),enabled:G.boolean(),triggers:G.array(CZ).default([])}),PZ=G.object({items:G.array(P9).default([]),end_cursor:G.string().nullish(),has_next_page:G.boolean().optional()}),IZ=G.object({id:G.string().min(1),slug:G.string().nullish(),name:G.string(),description:G.string().nullish(),transport:G.string().nullish(),url:G.string().nullish(),enabled:G.boolean()}),xZ=G.object({items:G.array(IZ).default([])}),EZ=G.object({status:G.string(),summary:G.string().nullish(),category:G.string().nullish(),outcome:G.string().nullish(),message_count:G.number().nullish(),pr_url:G.string().nullish(),cost_usd:G.number().nullish(),generated_at:G.string().nullish()}),C9=G.object({tags:G.array(G.string()).default([])}),SZ=G.enum(["linux","macos"]),I9=G.object({id:G.string().min(1),name:G.string().min(1),platform:SZ.nullable(),workers:G.object({total:G.number().int(),online:G.number().int(),busy:G.number().int(),idle:G.number().int()}),sessions:G.object({queued:G.number().int(),running:G.number().int()})}),wZ=G.object({machines:G.array(I9)}),bZ=G.object({machine:I9}),kZ=G.object({deleted:G.literal(!0),revoked_workers:G.number().int(),revoked_tokens:G.number().int()}),yZ=G.object({token:G.object({id:G.string().min(1),machine_id:G.string().min(1),token_prefix:G.string()}),secret:G.string().startsWith("rmt_")}),x9=G.looseObject({machine_id:G.string().min(1),machine_name:G.string().min(1)}),fZ=x9.extend({organization_id:G.string().min(1)}),nV=G.object({id:G.string().min(1),name:G.string().min(1),state:G.enum(["waiting","placed"]),queue_position:G.number().int().nullable()});var rV=G.union([G.object({kind:G.literal("cloud")}),G.object({kind:G.enum(["mac","headless"]),device_id:G.string().min(1),root_id:G.string().min(1)})]);function P0($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new Y0(502,Z,"Reason returned an unexpected response.");return Q.data}var hZ=G.object({error:G.object({type:G.string(),message:G.string()})});function E9($,J,Z){let Q=hZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,B=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",V=Z===null||Z.trim()===""?NaN:Number(Z);return new Y0($,X,`${Y}${B}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(V)&&V>=0?V*1000:void 0,typeof J.resolution_reason==="string"?J.resolution_reason:void 0)}async function S9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw E9(J.status,Z,J.headers.get("retry-after"));return P0(fZ,Z,"invalid_machine_ticket")}class U1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.raw?{"content-type":J.raw.contentType}:J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.raw?J.raw.bytes:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let B=await k1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(B)return this.credentials=B,this.request($,J,!0)}if(!X.ok)throw E9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof Y0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return P0(wZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return P0(bZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return P0(kZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return P0(yZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return P0(x9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}agentNetwork(){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{signal:AbortSignal.timeout(30000)})}startAgentNetwork($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{method:"POST",body:$,signal:AbortSignal.timeout(30000)})}rotateAgentNetwork($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{method:"PUT",body:$,signal:AbortSignal.timeout(30000)})}async workspaceMembers(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/members/users`,{signal:AbortSignal.timeout(30000)})).items??[]).flatMap((J)=>typeof J.email==="string"?[{email:J.email,role:typeof J.role==="string"?J.role:"member"}]:[])}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=jZ.safeParse($);if(!J.success)throw new Y0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listReasons(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons`);return P0(OZ,$,"invalid_reason_list").items}async openReasonConversation($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons/${encodeURIComponent($)}/conversation`,{method:"POST"});return P0(G.object({session_id:G.string().min(1)}),J,"invalid_reason_conversation").session_id}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return P0(RZ,$,"invalid_skill_list").items}catch($){if($ instanceof Y0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=LZ.safeParse(Q);if(!X.success)throw new Y0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((X)=>X.hidden!==!0),Z=J.filter((X)=>X.available!==!1).map(({reasoning_efforts:X,hidden:Y,available:B,...V})=>({...V,...Array.isArray(X)?{reasoning_efforts:FZ.filter((K)=>X.includes(K))}:{}})),Q=new Set(Z.map((X)=>X.detail));return{models:Z.length>1&&Q.size===1?Z.map(({detail:X,...Y})=>Y):Z,runnable:Z.length>0||J.length===0}}catch($){if($ instanceof Y0&&($.status===403||$.status===404))return{models:[],runnable:!0};throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return U9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=MZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=_Z(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof Y0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($,J){let Z=J?.fields.length?`?fields=${encodeURIComponent(J.fields.join(","))}`:"";return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${Z}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.branch?{branch:$.branch}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},...$.longRunning?{long_running:{enabled:!0}}:{},...$.spendLimitRcu?{spend_limit_rcu:$.spendLimitRcu}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((B)=>X.components[B]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof Y0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($,J){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments${J?`?view=${J}`:""}`)).items??[]}catch(Z){if(Z instanceof Y0&&(Z.status===403||Z.status===404))return[];throw Z}}async requireSessionAttachments(){let $=await this.request("/deployment",{headers:{"cache-control":"no-cache"}});if($.session_attachments!==!0){let J=typeof $.reason_version==="string"&&/^\d+\.\d+(?:\.\d+)?$/.test($.reason_version)?`Agent ${$.reason_version}`:null,Z=typeof $.commit_sha==="string"&&/^[a-f0-9]{40,64}$/i.test($.commit_sha)?`server ${$.commit_sha.slice(0,12)}`:null,Q=[J,Z].filter(Boolean).join(", ");throw Error(`This server does not support Session image attachments: ${new URL(this.credentials.apiOrigin).host}${Q?` (${Q})`:""}. The API server needs an attachment-capable deployment; updating the Agent version alone is not enough. Your image was not sent; retry after the server update.`)}}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{},...Z.delivery?{delivery:Z.delivery}:{}}})}async steerQueuedMessage($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages/${encodeURIComponent(J)}/steer`,{method:"POST",body:{}})}async withdrawQueuedMessage($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages/${encodeURIComponent(J)}/queued`,{method:"DELETE"})}async getConversation($){let J=[],Z=null;for(let Q=0;Q<50;Q+=1){let X=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/conversation${Z?`?after=${encodeURIComponent(Z)}`:""}`);if(J.push(...X.items??[]),!X.has_next_page||!X.end_cursor)break;Z=X.end_cursor}return J}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}sessionAction($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/${J}`,{method:"POST",body:Z})}renameSession($,J){return this.sessionAction($,"rename",{title:J||null})}moveSessionToProject($,J){return this.sessionAction($,"project",{project_id:J})}compactSession($){return this.sessionAction($,"compact")}retrySession($){return this.sessionAction($,"retry")}rewindSession($,J){return this.sessionAction($,"rewind",{message_id:J.messageId,content:J.content,request_id:J.requestId})}forkSession($,J){return this.sessionAction($,"fork",{...J.message?{message:J.message}:{},client_session_id:J.clientSessionId})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}sessionPath($,J=""){return`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${J}`}async archiveSession($){await this.request(this.sessionPath($,"/archive"),{method:"POST",body:{}})}async unarchiveSession($){await this.request(this.sessionPath($,"/unarchive"),{method:"POST",body:{}})}async deleteSession($){await this.request(this.sessionPath($),{method:"DELETE"})}async listSessionTags($){return P0(C9,await this.request(this.sessionPath($,"/tags")),"invalid_session_tags").tags}async appendSessionTags($,J){let Z=await this.request(this.sessionPath($,"/tags"),{method:"POST",body:{tags:J}});return P0(C9,Z,"invalid_session_tags").tags}async sessionInsight($,J=!1){let Z=await this.request(this.sessionPath($,J?"/insights/generate":"/insights"),J?{method:"POST",body:{}}:{});return P0(EZ,Z,"invalid_session_insight")}async listAutomations(){let $=[],J=null;for(let Z=0;Z<20;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations?first=100${J?`&after=${encodeURIComponent(J)}`:""}`),X=P0(PZ,Q,"invalid_automation_list");if($.push(...X.items),J=X.has_next_page?X.end_cursor??null:null,!J)break}return $}async createScheduledAutomation($,J){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations`,Q=P0(P9,await this.request(Z,{method:"POST",body:{name:$.name,instructions:$.instructions,...$.repo?{repo:$.repo.full_name,provider:$.repo.provider}:{}}}),"invalid_automation");try{await this.request(`${Z}/${encodeURIComponent(Q.id)}/triggers`,{method:"POST",body:J})}catch(X){throw await this.deleteAutomation(Q.id).catch(()=>{return}),X}return Q}async setAutomationEnabled($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent($)}`,{method:"PATCH",body:{enabled:J}})}async deleteAutomation($){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent($)}`,{method:"DELETE"})}async transcribe($,J){let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/transcribe`,{method:"POST",raw:{bytes:$,contentType:J}});return P0(G.object({transcript:G.string()}),Z,"invalid_transcript").transcript}async listMcpServers(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/mcp-servers`);return P0(xZ,$,"invalid_mcp_server_list").items}async setSkillEnabled($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills/${encodeURIComponent($)}`,{method:"PUT",body:{is_enabled:J}})}}function y1($,J){let Z=k0($,"REASON_API_URL")?.trim();if(!Z)return j4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function mZ($){return k0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function z4($){return k0($,"REASON_API_KEY")?.trim()||void 0}async function w9($,J){let Z=$.env??process.env,Q=z4(Z);if(!Q)return($.getCredentials??k1)({apiOrigin:mZ(Z),signal:J});let X=y1(Z,$.channel??x0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),B=await Y.json().catch(()=>({})),V=n0(B)?B:{};if(!Y.ok){let N=typeof V.detail==="string"?V.detail:typeof V.message==="string"?V.message:"API key authentication failed ("+Y.status+")";throw new Y0(Y.status,typeof V.error==="string"?V.error:"api_key_auth_failed",N)}if(typeof V.org_id!=="string"||!V.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(V.scopes)?V.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:V.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as vZ}from"crypto";import{unlinkSync as gZ}from"fs";import{platform as uZ}from"os";import{join as dZ}from"path";var b9=G.discriminatedUnion("store",[G.strictObject({version:G.literal(1),store:G.literal("keychain")}),G.strictObject({version:G.literal(1),store:G.literal("file"),api_key:G.string().min(1).max(4096)})]),f1=($)=>dZ($,"api-key.json");function z1($){let J=vZ("sha256").update(`reason-connect-api-key
|
|
5
5
|
${$}`).digest("hex");return new e1(T2(),uZ(),J)}function O4($,J,Z=z1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof G0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=z1($)){if(!u(f1($)))return null;let Z=b9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof G0))throw Q;throw Error("worker_api_key_unreadable")}}function k9($,J=z1($)){if(!u(f1($)))return;if(b9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof G0))throw Z}gZ(f1($))}async function A4($,J){let Z;try{Z=await w9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:y0($.proxy)})}catch(Q){if(Q instanceof Y0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as BQ,renameSync as KQ,rmSync as v1}from"fs";import{join as M0}from"path";import{createHash as lZ}from"crypto";import{realpathSync as pZ,statSync as cZ,unlinkSync as _2}from"fs";import{platform as sZ}from"os";import{join as f0}from"path";function d($){return{state:f0(g($),"device.json"),control:f0(g($),"control.json"),lock:f0(g($),"lifecycle.lock"),socket:f0(g($),"control.sock"),daemon:f0(g($),"daemon.json"),releaseCheck:f0(g($),"release-check.json"),updateDeferral:f0(g($),"update-deferral.json"),firstHeartbeat:f0(g($),"first-heartbeat.json")}}var aZ=G.object({version:G.literal(1),device_id:G.string().min(1).max(160),offer:G.unknown().optional(),enrollment_ms:G.number().int().nonnegative().max($$).optional()});function f9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function C4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=aZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=f0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?P4($):new R4(g($))}function W2($,J){T0($,!0),rZ($);let Z=J??P4($),Q=new R4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof G0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function P4($){return new e1(T2(),sZ(),iZ($))}function iZ($){let J=I4($);return lZ("sha256").update(`reason-worker
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ab as L9,Bb as n0,Ib as K0,wb as NQ,xb as Y8,yb as s9,zb as _0}from"./vm-hands-entry-lite-fq0zr7an.js";import{Qb as bQ,Rb as kQ,Sb as G4,Tb as z4,Ub as V8}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b0}from"./vm-hands-entry-lite-n07kxrd1.js";import{Ad as W8,Bd as g0,Fd as C0,Sc as e$,Vc as $Q,yd as w9,zd as o0}from"./vm-hands-entry-lite-t497ewn2.js";import{ee as x}from"./vm-hands-entry-lite-psybjyay.js";import{Oe as vQ,Pe as y8,bf as yQ,hf as i9,if as f8}from"./vm-hands-entry-lite-wh0qp1gf.js";import{$f as JQ,Bf as d9,Cf as s$,Df as n$,Ef as R8,Hf as p9,Qf as I8,Rf as S0,Sf as O0,Tf as l9,_f as w8,ag as i$,kf as TZ,nf as B9,wf as QQ,xf as ZQ,zf as XQ}from"./vm-hands-entry-lite-yhz6sv35.js";import{ah as J4}from"./vm-hands-entry-lite-mzxhng4z.js";import{ch as N8,dh as u9,gh as X4}from"./vm-hands-entry-lite-cp1wqjs5.js";import{Bh as W$,hh as B8,ih as i0,jh as L8,kh as a0,lh as H9,mh as J8,nh as e8,oh as s0,ph as p0,qh as u$}from"./vm-hands-entry-lite-ne8kkvk4.js";import{Gh as HZ}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ab as L9,Bb as n0,Ib as K0,wb as NQ,xb as Y8,yb as s9,zb as _0}from"./vm-hands-entry-lite-fq0zr7an.js";import{Qb as bQ,Rb as kQ,Sb as G4,Tb as z4,Ub as V8}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b0}from"./vm-hands-entry-lite-n07kxrd1.js";import{Ad as W8,Bd as g0,Fd as C0,Sc as e$,Vc as $Q,yd as w9,zd as o0}from"./vm-hands-entry-lite-t497ewn2.js";import{ee as x}from"./vm-hands-entry-lite-psybjyay.js";import{Oe as vQ,Pe as y8,bf as yQ,hf as i9,if as f8}from"./vm-hands-entry-lite-wh0qp1gf.js";import{$f as JQ,Bf as d9,Cf as s$,Df as n$,Ef as R8,Hf as p9,Qf as I8,Rf as S0,Sf as O0,Tf as l9,_f as w8,ag as i$,kf as TZ,nf as B9,wf as QQ,xf as ZQ,zf as XQ}from"./vm-hands-entry-lite-yhz6sv35.js";import{ah as J4}from"./vm-hands-entry-lite-mzxhng4z.js";import{ch as N8,dh as u9,gh as X4}from"./vm-hands-entry-lite-cp1wqjs5.js";import{Bh as W$,hh as B8,ih as i0,jh as L8,kh as a0,lh as H9,mh as J8,nh as e8,oh as s0,ph as p0,qh as u$}from"./vm-hands-entry-lite-ne8kkvk4.js";import{Gh as HZ}from"./vm-hands-entry-lite-e0cj5ma7.js";import{Mh as Y4}from"./vm-hands-entry-lite-14t846kp.js";import{Oh as C}from"./vm-hands-entry-lite-v6tkjqb1.js";import{Ph as P1,Uh as KZ}from"./vm-hands-entry-lite-cxs89wzv.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000,window:8};function h9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function P0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function E$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function S$($,Q){let Z=Buffer.from($,"latin1");return Buffer.concat([Buffer.from([Z.length]),Z,Q])}function I0($){if(!h9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(E$)||!P0($.attachmentRevision,0)||!P0($.grantRevision,1)||!P0($.generation,1)||!P0($.port,1024,65535)||!P0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function c0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function q9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function R$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function C9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function w$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function b$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!h9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello")return{type:"hello",binding:I0(Q.binding),...P0(Q.messages,v.chunk,v.upload)?{messages:Q.messages}:{},...P0(Q.window,1,v.window)?{window:Q.window}:{},...Q.bytes===!0?{bytes:!0}:{}};if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:I0(Q.binding),reason:Q.reason};if(!E$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return C9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&P0(Q.status,200,599)&&R$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&R$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return C9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:q9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function D8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((Y)=>Y.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function _8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function T9($){return await _8($)===!0}function v9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function k$($){if(!h9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:I0($.binding),deviceRelayUrl:v9($.deviceRelayUrl,"device")}}function f$($){if(!h9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:I0($.binding)}}import{request as D4}from"http";import{pipeline as _4}from"stream";import{constants as A8,createBrotliCompress as A4,createGzip as x4}from"zlib";import{WebSocket as O9}from"ws";import{randomBytes as q4,timingSafeEqual as T4}from"crypto";import{createServer as O4}from"net";var g$="x-preview-connection";async function m$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=q4(32).toString("base64url"),X=new Set,J=!1,Y=O4((G)=>{if(J||Q.aborted||X.size>=v.streams*2)return G.destroy();X.add(G);let F=new AbortController;G.once("close",()=>{X.delete(G),F.abort()}),G.on("error",()=>G.destroy()),G.setTimeout(2000,()=>G.destroy());let B=Buffer.alloc(0),H=(L)=>{B=Buffer.concat([B,L]);let W=B.indexOf(`\r
|
|
3
3
|
\r
|
|
4
4
|
`);if(W<0){if(B.length>16384)G.destroy();return}if(G.pause(),G.off("data",H),W>16384||B.length>v.upload+16384)return G.destroy();z(B,W).catch(()=>G.destroy())};G.on("data",H);async function z(L,W){let U=L.subarray(0,W).toString("latin1").split(`\r
|
|
5
5
|
`),j=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(U.shift()??"");if(!j)throw Error("preview_request_invalid");q9(j[2]);let O=!1,q=0,A=[];for(let T of U){let S=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(T);if(!S)throw Error("preview_header_invalid");if(S[1].toLowerCase()===g$){q++;let g=Buffer.from(S[2].trim());O=g.length===Z.length&&T4(g,Buffer.from(Z))}else if(S[1].toLowerCase()!=="host")A.push(T)}if(!O||q!==1||J||F.signal.aborted)throw Error("preview_connection_denied");let R=await $.connect(F.signal);if(J||F.signal.aborted)throw R.destroy(),Error("preview_closed");X.add(R),R.on("error",()=>G.destroy()),R.once("close",()=>{X.delete(R),G.destroy()}),G.once("close",()=>R.destroy()),G.setTimeout(0);let P=[`${j[1]} ${j[2]} HTTP/1.1`,`Host: 127.0.0.1:${R.remotePort}`,...A,"",""].join(`\r
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Gh as $}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Gh as $}from"./vm-hands-entry-lite-e0cj5ma7.js";var O=$.version,Z=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function S(B,D){if(!Z.test(B)||!Z.test(D))throw Error("cannot compare invalid CLI versions");let J=(q)=>{let y=q.indexOf("-");return y===-1?[q,void 0]:[q.slice(0,y),q.slice(y+1)]},[j,F]=J(B),[w,G]=J(D),K=j.split(".").map(BigInt),M=w.split(".").map(BigInt);for(let q=0;q<3;q+=1){if(K[q]===M[q])continue;return K[q]<M[q]?-1:1}if(F===void 0||G===void 0){if(F===G)return 0;return F===void 0?1:-1}let Q=F.split("."),U=G.split("."),A=Math.max(Q.length,U.length);for(let q=0;q<A;q+=1){let y=Q[q],z=U[q];if(y===void 0||z===void 0){if(y===z)return 0;return y===void 0?-1:1}if(y===z)continue;let H=/^\d+$/.test(y),W=/^\d+$/.test(z);if(H&&W){let X=BigInt(y),Y=BigInt(z);if(X===Y)continue;return X<Y?-1:1}if(H!==W)return H?-1:1;return y<z?-1:1}return 0}function k(B,D){return D?`cli ${B} \xB7 agent ${D}`:`cli ${B}`}
|
|
3
3
|
export{O as Ch,Z as Dh,S as Eh,k as Fh};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Jd as xe}from"./vm-hands-entry-lite-t497ewn2.js";import{Ce as z,De as Je,ke as W,le as oe,ne as _t,oe as Ne,re as St,se as wt,te as $}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Jd as xe}from"./vm-hands-entry-lite-t497ewn2.js";import{Ce as z,De as Je,ke as W,le as oe,ne as _t,oe as Ne,re as St,se as wt,te as $}from"./vm-hands-entry-lite-yjzz85pt.js";import{Fe as v,He as tt,Ie as D,Qe as Ot}from"./vm-hands-entry-lite-wh0qp1gf.js";import{lg as Jt,og as xt,rg as Z,tg as zt,ug as ae}from"./vm-hands-entry-lite-7q2gywdm.js";import{Tg as Ae,Ug as se}from"./vm-hands-entry-lite-22jgncrd.js";import{ah as Se}from"./vm-hands-entry-lite-mzxhng4z.js";import{ch as q}from"./vm-hands-entry-lite-cp1wqjs5.js";import{Hh as pe,Nh as ye}from"./vm-hands-entry-lite-14t846kp.js";import{Oh as _}from"./vm-hands-entry-lite-v6tkjqb1.js";import{spawn as I}from"child_process";import{randomUUID as Oe}from"crypto";import{closeSync as Vr,copyFileSync as de,existsSync as ut,fstatSync as Er,mkdirSync as fe,openSync as vr,readdirSync as V,readFileSync as ge,readlinkSync as to,renameSync as eo,rmSync as ro,statSync as oo}from"fs";import{connect as so}from"net";import{userInfo as Te}from"os";import{basename as le,dirname as mt,join as b}from"path";var At=`import { spawn, execFileSync } from "node:child_process";
|
|
3
3
|
import { createHash, randomUUID } from "node:crypto";
|
|
4
4
|
import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
|
|
5
5
|
import { tmpdir } from "node:os";
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Pd as UJ,ed as jJ,md as OJ}from"./vm-hands-entry-lite-t497ewn2.js";import{createHash as V,randomBytes as $J}from"crypto";import{closeSync as CJ,fsyncSync as LJ,mkdirSync as yJ,openSync as qJ,renameSync as IJ,rmSync as RJ,statSync as NJ,writeSync as DJ,constants as H}from"fs";import{join as d}from"path";var fJ=1;var r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function GJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function BJ(J,Z){let{payload:z,authority:K}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!K||typeof K!=="object"||Array.isArray(K)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||K.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function AJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&r.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:GJ(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var S=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),v=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function y(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(y).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${y(J[Z])}`).join(",")}}`}async function KZ(J){let Z=await crypto.subtle.importKey("pkcs8",v(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=v(J.device_key.spki),K=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),U=new Uint8Array(await crypto.subtle.exportKey("spki",K.publicKey)),L=V("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:K,signingSpki:z,agreementSpki:U,fingerprint:L}}var mJ=4;class bJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;verifiedSinceRun=!1;unverified=new Set;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,K){this.init=J;this.keys=Z;this.hooks=z;this.options=K;if(!r.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let K=Date.now()+Z;;){let U=this.bound.get(J);if(!U)return!1;if(U.envInstalled)return!0;if(Date.now()>=K||z?.aborted)return!1;await new Promise((L)=>setTimeout(L,25))}}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:fJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:S(this.keys.signingSpki),env_public_key:S(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:S($J(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(y(Z)));return{...Z,device_signature:S(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),K=S($J(32)),U=UJ({method:"GET",pathAndQuery:jJ,timestamp:z,nonce:K,challenge:J,bodySha256:V("sha256").update("").digest("hex")}),L=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(U)));return{t:"hello",timestamp:z,nonce:K,signature:S(cJ(L)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new W("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!r.test(z))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(V("sha256").update(y({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new W("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=mJ)throw new W("vm_hands_busy","every bind slot is held");return this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,K=!1;try{if(Z.length===0){if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload(),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.verifiedSinceRun=!1,this.servedRun=!0,K=!0;let{launchId:U,applied:L,readyData:P}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),E=this.hooks.restatLayout(),D=null;if(J.env){let O=J.claim?.owner??{},g=BJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof O.device_id==="string"?O.device_id:"",rootId:J.claim?.root_id??""});D=this.hooks.installEnvironment(J.bind_id,g),z=this.writeJobEnvRootOnly(J.bind_id,g)}if(this.unbinding.has(J.bind_id))throw new W("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:D!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:D,layout:E,...P?{ready_data:P}:{},policy_digest:V("sha256").update(y({hands_confinement:L.hands_confinement??null,browser_egress:L.browser_egress??null})).digest("hex")}}catch(U){if(z)zJ(z);if(K){let P=[...this.bound.keys()];await this.hooks.killAndVerifyPayload(P.length?{bindId:J.bind_id,keep:P}:void 0).then(()=>{if(!P.length)this.verifiedSinceRun=!0,this.unverified.clear()},()=>{this.unverified.add(J.bind_id),this.verifiedSinceRun=!1})}this.binding.delete(J.bind_id);let L=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof W?U:new W(L,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new W("vm_hands_not_bound","environment delivered while not bound");if(!r.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let K=BJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),U=this.hooks.installEnvironment(Z.bindId,K);if(Z.envInstalled=!0,Z.envDirectory)zJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${U}`,K),{snapshot_id:J.snapshotId,installed_revision:U,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new W("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killAndVerifyPayload(),this.verifiedSinceRun=!0}catch{this.servedRun=!0,this.verifiedSinceRun=!1}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:V("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((K)=>K!==J);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:void 0)}catch(K){throw this.unverified.add(J),this.verifiedSinceRun=!1,K}if(!z.length)this.verifiedSinceRun=!0,this.unverified.clear();if(Z?.envDirectory)zJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},K=await crypto.subtle.importKey("spki",v(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),U=await crypto.subtle.deriveKey({name:"ECDH",public:K},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),L=await crypto.subtle.decrypt({name:"AES-GCM",iv:v(J.iv),additionalData:new TextEncoder().encode(Z)},U,v(J.ct)).catch(z),P=JSON.parse(new TextDecoder().decode(L));if(!P||typeof P!=="object"||Array.isArray(P))throw new W("vm_hands_env_invalid","env not an object");return P}writeJobEnvRootOnly(J,Z){let z=d(this.options.envRoot,`bind-${J}`);yJ(z,{mode:448});let K=NJ(z);if(!K.isDirectory()||(K.mode&63)!==0||K.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let U=Z.variables&&typeof Z.variables==="object"?Z.variables:{},L=Object.entries(U).filter(([D,O])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(D)&&typeof O==="string").map(([D,O])=>`export ${D}='${String(O).replaceAll("'","'\\''")}'`).join(`
|
|
2
|
+
import{Pd as UJ,ed as jJ,md as OJ}from"./vm-hands-entry-lite-t497ewn2.js";import{createHash as V,randomBytes as $J}from"crypto";import{closeSync as CJ,fsyncSync as LJ,mkdirSync as yJ,openSync as qJ,renameSync as IJ,rmSync as RJ,statSync as NJ,writeSync as DJ,constants as H}from"fs";import{join as d}from"path";var fJ=1;var r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function GJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function BJ(J,Z){let{payload:z,authority:K}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!K||typeof K!=="object"||Array.isArray(K)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||K.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function AJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&r.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:GJ(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var S=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),v=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function y(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(y).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${y(J[Z])}`).join(",")}}`}async function KZ(J){let Z=await crypto.subtle.importKey("pkcs8",v(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=v(J.device_key.spki),K=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),U=new Uint8Array(await crypto.subtle.exportKey("spki",K.publicKey)),L=V("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:K,signingSpki:z,agreementSpki:U,fingerprint:L}}var mJ=4;class bJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;verifiedSinceRun=!1;unverified=new Set;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,K){this.init=J;this.keys=Z;this.hooks=z;this.options=K;if(!r.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let K=Date.now()+Z;;){let U=this.bound.get(J);if(!U)return!1;if(U.envInstalled)return!0;if(Date.now()>=K||z?.aborted)return!1;await new Promise((L)=>setTimeout(L,25))}}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:fJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:S(this.keys.signingSpki),env_public_key:S(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:S($J(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(y(Z)));return{...Z,device_signature:S(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),K=S($J(32)),U=UJ({method:"GET",pathAndQuery:jJ,timestamp:z,nonce:K,challenge:J,bodySha256:V("sha256").update("").digest("hex")}),L=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(U)));return{t:"hello",timestamp:z,nonce:K,signature:S(cJ(L)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new W("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!r.test(z))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(V("sha256").update(y({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new W("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=mJ)throw new W("vm_hands_busy","every bind slot is held");return this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,K=!1;try{if(Z.length===0){if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload(),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.verifiedSinceRun=!1,this.servedRun=!0,K=!0;let{launchId:U,applied:L,readyData:P}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),E=this.hooks.restatLayout(),D=null;if(J.env){let O=J.claim?.owner??{},g=BJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof O.device_id==="string"?O.device_id:"",rootId:J.claim?.root_id??""});D=this.hooks.installEnvironment(J.bind_id,g),z=this.writeJobEnvRootOnly(J.bind_id,g)}if(this.unbinding.has(J.bind_id))throw new W("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:D!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:D,layout:E,...P?{ready_data:P}:{},policy_digest:V("sha256").update(y({hands_confinement:L.hands_confinement??null,browser_egress:L.browser_egress??null})).digest("hex")}}catch(U){if(z)zJ(z);if(K){let P=[...this.bound.keys()];await this.hooks.killAndVerifyPayload(P.length?{bindId:J.bind_id,keep:P}:void 0).then(()=>{if(!P.length)this.verifiedSinceRun=!0,this.unverified.clear()},()=>{this.unverified.add(J.bind_id),this.verifiedSinceRun=!1})}this.binding.delete(J.bind_id);let L=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof W?U:new W(L,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new W("vm_hands_not_bound","environment delivered while not bound");if(!r.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let K=BJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),U=this.hooks.installEnvironment(Z.bindId,K);if(Z.envInstalled=!0,Z.envDirectory)zJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${U}`,K),{snapshot_id:J.snapshotId,installed_revision:U,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new W("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killProbe()}catch{this.servedRun=!0,this.verifiedSinceRun=!1}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:V("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((K)=>K!==J);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:void 0)}catch(K){throw this.unverified.add(J),this.verifiedSinceRun=!1,K}if(!z.length)this.verifiedSinceRun=!0,this.unverified.clear();if(Z?.envDirectory)zJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},K=await crypto.subtle.importKey("spki",v(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),U=await crypto.subtle.deriveKey({name:"ECDH",public:K},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),L=await crypto.subtle.decrypt({name:"AES-GCM",iv:v(J.iv),additionalData:new TextEncoder().encode(Z)},U,v(J.ct)).catch(z),P=JSON.parse(new TextDecoder().decode(L));if(!P||typeof P!=="object"||Array.isArray(P))throw new W("vm_hands_env_invalid","env not an object");return P}writeJobEnvRootOnly(J,Z){let z=d(this.options.envRoot,`bind-${J}`);yJ(z,{mode:448});let K=NJ(z);if(!K.isDirectory()||(K.mode&63)!==0||K.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let U=Z.variables&&typeof Z.variables==="object"?Z.variables:{},L=Object.entries(U).filter(([D,O])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(D)&&typeof O==="string").map(([D,O])=>`export ${D}='${String(O).replaceAll("'","'\\''")}'`).join(`
|
|
3
3
|
`)+`
|
|
4
4
|
`,P=d(z,`.job.env.${$J(8).toString("hex")}`),E=qJ(P,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{DJ(E,L),LJ(E)}finally{CJ(E)}return IJ(P,d(z,"job.env")),z}}function zJ(J){try{let Z=d(J,"job.env"),z=NJ(Z).size,K=qJ(Z,H.O_WRONLY|H.O_NOFOLLOW);try{DJ(K,Buffer.alloc(z)),LJ(K)}finally{CJ(K)}}catch{}RJ(J,{recursive:!0,force:!0})}function cJ(J){if(J.length!==64)throw new W("vm_hands_signature_invalid","unexpected ECDSA signature length");let Z=(U)=>{let L=0;while(L<U.length-1&&U[L]===0)L++;let P=U.subarray(L),E=P[0]&128?Uint8Array.of(0,...P):P;return Uint8Array.of(2,E.length,...E)},z=Z(J.subarray(0,32)),K=Z(J.subarray(32));return Uint8Array.of(48,z.length+K.length,...z,...K)}import{randomUUID as pJ}from"crypto";var lJ="/app/local-runtime/session?register=vm_hands_v1",uJ="/app/local-runtime",xJ=25000,oJ=20000,dJ=1e4,rJ=5000,iJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),KJ=75000,sJ=2000,aJ=1e4,i=20000;function MJ(J,Z){return typeof J==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(J)?J:Z}class h extends Error{}var nJ=64;async function _J(J,Z){let z=[...J.modelOps.get(Z)??[]];for(let K of z)K.abort.abort();await Promise.race([Promise.all(z.map((K)=>K.settled)),new Promise((K)=>setTimeout(K,rJ))])}async function I(J,Z,z){return await _J(J,z),Z.unbind(z)}function s(J){for(let Z of J.outbox?.splice(0)??[])Z.reject(Error("vm_hands_attempt_ended"))}var EJ=15000,tJ=1e4,eJ=1000;async function PZ(J){let Z=Date.now(),z={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map},K=J.log??(()=>{}),U=async(L)=>{for(let[P,E]of[...z.turns]){z.turns.delete(P),J.onTurn?.(P,null),s(E);let D=await I(z,J.agent,P).catch(()=>null);if(D)z.receipts.push({turn:E,failure:"vm_hands_bind_lost",unbound:D});K("vm_hands.bound_dropped",{reason:L})}};try{for(let L=0;!J.signal.aborted;L++){let P=await JZ(J,z).catch((D)=>{if(D instanceof W&&z.deviceId===null&&D.code==="vm_hands_no_session"&&Date.now()-Z<aJ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(D instanceof W&&z.deviceId===null)throw D;return{closeCode:0,closeReason:D instanceof Error?D.message:String(D)}});if(K("vm_hands.session_closed",{close_code:P.closeCode,reason:P.closeReason.slice(0,120),registered:z.deviceId!==null}),P.closeCode===4401||z.attest==="refused")return;if(J.signal.aborted)return;if(z.turns.size&&Date.now()-z.lostAt>=KJ)await U("reconnect_deadline");if(z.served)z.served=!1,L=0;let E=P.closeReason==="drain_reconnect"?0:P.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(L,5),2000):z.turns.size?Math.min(250*2**Math.min(L,5),5000,Math.max(0,z.lostAt+KJ-Date.now())):Math.min(500*2**L,30000);if(await new Promise((D)=>setTimeout(D,E)),z.turns.size&&Date.now()-z.lostAt>=KJ)await U("reconnect_deadline")}}finally{await U("session_ended")}}async function JZ(J,Z){let z=Z.deviceId,K=J.log??(()=>{}),U=z?`/app/local-runtime/session?device_id=${encodeURIComponent(z)}`:lJ,L=`${J.apiOrigin.replace(/^http/,"ws")}${U}`,P=new WebSocket(L),E=0,D="",O=new Map,g=[],R=null,TJ=new Promise(($)=>{P.onclose=(Y)=>{E=Y.code,D=Y.reason;for(let G of O.values())G.reject(new h(`session closed ${Y.code}`));for(let G of Z.attestWaiters.splice(0))G(!1);O.clear(),$()}});P.onmessage=($)=>{let Y;try{Y=JSON.parse(String($.data))}catch{P.close(4400);return}if(Y.t==="res"){let G=Y;O.get(G.id)?.resolve({status:G.status,body:G.body}),O.delete(G.id);return}if(Y.t==="reconnect"){let G=Math.max(0,Math.min(Number(Y.after_ms)||0,eJ));K("vm_hands.drain_reconnect",{after_ms:G}),setTimeout(()=>{try{P.close(4001,"drain_reconnect")}catch{}},G).unref?.();return}if(!R?.(Y))g.push(Y)};let f=($,Y)=>new Promise((G,X)=>{let j=g.findIndex((C)=>$.includes(C.t));if(j>=0){G(g.splice(j,1)[0]);return}let q=setTimeout(()=>{R=null,X(new W("vm_hands_no_register",`no ${$.join("/")} in ${Y} ms`))},Y);R=(C)=>{if(!$.includes(C.t))return!1;return clearTimeout(q),R=null,G(C),!0}}),m=($)=>P.send(JSON.stringify($)),w=($,Y)=>new Promise((G,X)=>{if(P.readyState!==WebSocket.OPEN){X(new h("session closed"));return}let j=pJ(),q=typeof Y.wait_ms==="number"?Y.wait_ms:0,C=setTimeout(()=>{if(!O.delete(j))return;X(new h(`no answer to ${$.split("/").pop()} in ${q+EJ} ms`)),P.close(4000,"request_timeout")},q+EJ);O.set(j,{reject:(Q)=>{clearTimeout(C),X(Q)},resolve:({status:Q,body:F})=>{clearTimeout(C);let B=null;try{B=F?JSON.parse(F):null}catch{}G({status:Q,json:B})}}),m({t:"req",id:j,path:`${uJ}${$}`,body:JSON.stringify(Y)})}),YJ=()=>P.close(1001,"stopping");J.signal.addEventListener("abort",YJ,{once:!0});let a,b=new Map,c=new Map,n=!1,t=new Set,e=new Set,JJ=Promise.resolve(),p=!1;try{await new Promise((Q,F)=>{let B=setTimeout(()=>F(Error("session open timeout")),tJ);P.onopen=()=>{clearTimeout(B),K("vm_hands.ws_open",{}),Q()},P.onerror=()=>{clearTimeout(B),F(Error("session socket error"))}});let $=await f(["challenge"],5000);K("vm_hands.challenge",{});let Y=[],G=null,X;if(z){m(await J.agent.helloFrame($.challenge,Z.connection));let Q=await f(["ready"],1e4);if(typeof Q.vm_hands_connection==="string")Z.connection=Q.vm_hands_connection;if(X={device_id:z,...Q.cadence?{cadence:Q.cadence}:{}},typeof Q.vm_hands_probe_script==="string"){if(G=Q.vm_hands_probe_script,p=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,K("vm_hands.reconnected",{device_id:z});let F=Array.isArray(Q.vm_hands_binds)?Q.vm_hands_binds:Q.vm_hands_bind?[Q.vm_hands_bind]:[];for(let[B,N]of[...Z.turns]){if(F.some((A)=>A&&A.operation_id===N.claim.operation_id&&A.attempt_id===N.claim.attempt_id)){Y.push(N),K("vm_hands.bound_resumed",{operation_id:N.claim.operation_id});continue}Z.turns.delete(B),J.onTurn?.(B,null),s(N);let M=await I(Z,J.agent,B).catch(()=>null);if(M)Z.receipts.push({turn:N,failure:"vm_hands_bind_lost",unbound:M});K("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{m(await J.agent.registerFrame($.challenge)),K("vm_hands.register_sent",{});let Q=await f(["registered","register_refused"],1e4);if(Q.t==="register_refused")throw new W(Q.code,"register refused");J.agent.registered();let F=Q;if(X=F,Z.deviceId=F.device_id,typeof F.vm_hands_connection==="string")Z.connection=F.vm_hands_connection;if(typeof F.vm_hands_probe_script==="string"){if(G=F.vm_hands_probe_script,p=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,K("vm_hands.registered",{device_id:X.device_id})}let j=async()=>{let Q=await w("/heartbeat",await J.heartbeat());if(Q.status>=300)throw Error(`heartbeat ${Q.status}`)};await j();let q=X.cadence?.presence_interval_ms??30000;if(a=setInterval(()=>{j().catch(()=>P.close())},q),G&&Z.attest!=="accepted"&&J.agent.phase==="registered"&&!Z.turns.size)wJ(G,$.challenge);let C=(Q,F)=>{c.set(Q,F().catch(async(B)=>{if(await QJ(B,Q),B instanceof h)P.close();else await ZJ().catch(()=>{return})}).finally(()=>{c.delete(Q)}))};try{await ZJ();for(let Q of Y)Q.flush=()=>XJ(Q),Q.flush(),C(Q.claim.attempt_id,()=>FJ(Q));while(!J.signal.aborted&&P.readyState===WebSocket.OPEN){let Q=await w("/operations/claim",{wait_ms:Math.min(X.cadence?.claim_wait_ms??xJ,xJ)});if(Q.status===204||!Q.json)continue;if(Q.status>=300)throw Error(`claim ${Q.status}`);let F=Q.json;if(F.capability==="hands.connect"){if(c.has(F.attempt_id)){_({claim:F,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}C(F.attempt_id,()=>kJ(F))}else gJ(F).catch(()=>{return})}}catch(Q){await QJ(Q,null)}}finally{if(a)clearInterval(a);J.signal.removeEventListener("abort",YJ);for(let $ of Z.turns.values())$.flush=null;P.close(),await TJ,await Promise.all([...c.values()]);for(let $ of J.agent.liveBindIds){if(Z.turns.has($))continue;let Y=await I(Z,J.agent,$).catch(()=>null),G=b.get($);if(Y&&G)Z.receipts.push({turn:{...G,eventSeq:G.eventSeq+1},failure:"vm_hands_bind_lost",unbound:Y});K("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let $ of t)$.abort()}return{closeCode:E,closeReason:D};async function QJ($,Y){if($ instanceof h){if(!n&&Z.turns.size)Z.lostAt=Date.now();n=!0}else{let G=Y!==null?[Y]:[...new Set([...Z.turns.keys(),...J.agent.liveBindIds])];if(Y===null)n=!0;for(let X of G){let j=Z.turns.get(X);if(Z.turns.delete(X),j)s(j),J.onTurn?.(X,null);if(J.agent.liveBindIds.includes(X)){let q=await I(Z,J.agent,X).catch(()=>null),C=b.get(X)??j;if(q&&C)Z.receipts.push({turn:{...C,eventSeq:C.eventSeq+1},failure:"vm_hands_bind_lost",unbound:q})}}}K("vm_hands.session_lost",{error:$ instanceof Error?$.message:String($),bound_kept:Z.turns.size})}function _($){let Y=$.claim,G={attempt_id:Y.attempt_id,attempt_token:Y.attempt_token},X=encodeURIComponent(Y.operation_id);return{fence:G,op:X,complete:(q,C={})=>w(`/operations/${X}/complete`,{...G,status:q,...C}),emit:(q,C)=>{let Q=($.chain??Promise.resolve()).catch(()=>{return}).then(()=>j(q,C));return $.chain=Q,Q}};async function j(q,C){let Q=$.eventSeq,F=(A)=>w(`/operations/${X}/events`,{...G,event_seq_start:A,events:[{kind:q,payload:{sequence:A,capability:String(Y.capability??"hands.connect"),data:C}}]}),B=Q,N=await F(B),M=N.status===409?N.json?.expected_event_seq:void 0;if(typeof M==="number"&&M===Q+1)N={status:200,json:{duplicate:!0}};else if(typeof M==="number"&&M>=0&&M!==Q)B=M,N=await F(B);if(N.status<300)$.eventSeq=B+1;return N}}function hJ($){return(Y,G)=>new Promise((X,j)=>{if(Z.turns.get($.claim.attempt_id)!==$){j(Error("vm_hands_attempt_ended"));return}if($.outbox??=[],$.outbox.length>=nJ){j(Error("vm_hands_outbox_full"));return}$.outbox.push({kind:Y,data:G,resolve:X,reject:j}),$.flush?.()})}function XJ($){if(e.has($))return;e.add($),(async()=>{try{while($.outbox?.length&&Z.turns.get($.claim.attempt_id)===$&&P.readyState===WebSocket.OPEN){let Y=$.outbox[0],G;try{G=await _($).emit(Y.kind,Y.data)}catch(X){if(X instanceof h)return;G={status:500}}if($.outbox.shift(),G.status<300)Y.resolve();else Y.reject(Error(`${Y.kind} refused ${G.status}`))}}finally{e.delete($)}})()}async function wJ($,Y){try{let G=await J.agent.attestFrame($,Y);if(P.readyState!==WebSocket.OPEN)return;m(G);let X=await f(["attested","attest_refused"],15000);Z.attest=X.t==="attested"?"accepted":"refused";for(let j of Z.attestWaiters.splice(0))j(Z.attest==="accepted");if(K("vm_hands.attest",{result:Z.attest,exit_code:G.exit_code,...X.t==="attest_refused"?{code:String(X.code??"")}:{}}),Z.attest==="refused")P.close(4401,"attest_refused")}catch(G){K("vm_hands.attest_failed",{code:G instanceof W?G.code:"probe_error"});for(let X of Z.attestWaiters.splice(0))X(!1);if(Z.attest!=="accepted")P.close(4000,"attest_unanswered")}}async function kJ($){let Y=p&&Z.attest==="pending",G=$.vm_hands_attest,X=G;if(Z.attest==="refused"){K("vm_hands.claim_attest_refused",{said:typeof G==="string"?G.slice(0,16):typeof G,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(X==="accepted"){if(!Y&&Z.attest!=="accepted"){Z.attest="accepted";for(let A of Z.attestWaiters.splice(0))A(!0)}}else if(X!=="pending"||!Y&&Z.attest!=="accepted"){K("vm_hands.claim_attest_refused",{said:typeof G==="string"?G.slice(0,16):typeof G,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Z.attest!=="accepted"){let A=Date.parse($.lease_until)-Date.now()-5000,l=Math.max(0,Math.min(i,Number.isFinite(A)?A:i));if(!await new Promise((o)=>{let x=setTimeout(()=>o(!1),l);Z.attestWaiters.push((T)=>{clearTimeout(x),o(T)})})){await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let j={claim:$,eventSeq:0},{complete:q,emit:C}=_(j),Q;try{if($.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not hands.connect");Q=!GJ($)}catch(A){K("vm_hands.bind_refused",{code:A instanceof W?A.code:"unexpected"}),await q("failed",{error_code:A instanceof W?A.code:"vm_hands_bind_invalid"});return}let F;try{F=await J.agent.bind(AJ($))}catch(A){K("vm_hands.bind_refused",{code:A instanceof W?A.code:"unexpected"}),await q("failed",{error_code:A instanceof W?A.code:"vm_hands_bind_failed"});return}let B={...F.ready_data??J.readyData({launchId:F.launch_id,claim:$})};if(Q)delete B.environment_installed;b.set($.attempt_id,{claim:$,launchId:F.launch_id,readyData:B,eventSeq:j.eventSeq,ackSeq:-1});let N=await C("hands.ready",{...B,vm_hands:{layout:F.layout,policy_digest:F.policy_digest,launch_id:F.launch_id}});if(b.delete($.attempt_id),N.status>=300){await _J(Z,$.attempt_id),await J.agent.boundRefused($.attempt_id),await q("failed",{error_code:MJ(N.json?.error,"vm_hands_probe_failed")});return}let M={claim:$,launchId:F.launch_id,readyData:B,eventSeq:j.eventSeq,ackSeq:-1};Z.turns.set($.attempt_id,M),M.flush=()=>XJ(M),J.onTurn?.($.attempt_id,hJ(M)),await FJ(M)}async function FJ($){let{fence:Y,op:G}=_($),X=null,j=null,q=J.agent.executorExited($.claim.attempt_id).then((C)=>{return j=C,null});J:for(;;){let C=await Promise.race([q,w(`/operations/${G}/heartbeat`,{...Y,control_ack_seq:$.ackSeq,wait_ms:oJ})]);if(!C){X="vm_hands_executor_exited",K("vm_hands.executor_exited",{reason:j});break}if(C.status>=300)break;let Q=(C.json?.controls??[]).slice().sort((F,B)=>F.seq-B.seq);for(let F of Q){if(F.seq<=$.ackSeq)continue;if(F.kind==="operation.cancel"||F.kind==="cancel"){$.ackSeq=F.seq;break J}if(F.kind===OJ)try{await HJ($,F.payload??{})}catch(B){if(B instanceof h)throw B;X=B instanceof W?B.code:"environment_unavailable";let N=B&&typeof B==="object"&&"code"in B&&typeof B.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(B.code)?B.code:null;K("vm_hands.environment_refused",{code:X,cause:N});break J}$.ackSeq=F.seq}}await SJ($,X)}async function gJ($){let Y=$,G={claim:Y,eventSeq:0},{complete:X,emit:j,fence:q,op:C}={..._(G)},Q=$.vm_hands_origin==="person"?"person":"model",F=String($.capability??"");if(!J.executeOp){await X("failed",{error_code:"vm_hands_op_unsupported"});return}if($.vm_hands_attest==="accepted"&&Z.attest==="pending"&&!(p&&Z.attest==="pending")){Z.attest="accepted";for(let x of Z.attestWaiters.splice(0))x(!0)}if(Z.attest!=="accepted"){let x=Date.parse(String($.lease_until??""))-Date.now()-5000,T=Z.attest==="refused"?0:Math.max(0,Math.min(i,Number.isFinite(x)?x:i));if(!(T>0&&await new Promise((PJ)=>{let VJ=setTimeout(()=>PJ(!1),T);Z.attestWaiters.push((vJ)=>{clearTimeout(VJ),PJ(vJ)})}))){await X("failed",{error_code:"vm_hands_unattested"});return}}let B=J.agent.bindIdForRun(Y.run_id);if(Q==="model"&&B===null){await X("failed",{error_code:"vm_hands_not_bound"});return}if(iJ.has(F)&&J.agent.liveBindIds.length===0){await X("failed",{error_code:"vm_hands_not_bound"});return}let N=new AbortController;t.add(N);let M,A=new Promise((x)=>{M=x}),l={abort:N,settled:A};if(Q==="model"&&B){let x=Z.modelOps.get(B)??new Set;x.add(l),Z.modelOps.set(B,x),await J.agent.environmentInstalled(B,sJ,N.signal)}let u=-1,o=setInterval(()=>{w(`/operations/${C}/heartbeat`,{...q,control_ack_seq:u,wait_ms:0}).then((x)=>{if(x.status>=300){N.abort();return}let T=x.json?.controls??[];for(let k of T)if(u=Math.max(u,k.seq),k.kind==="operation.cancel"||k.kind==="cancel")N.abort()},()=>N.abort())},dJ);try{let x=await J.executeOp({kind:Q,claim:$,...Q==="model"&&B?{bindId:B}:{},signal:N.signal,emit:async(k)=>{await j(k.kind,k.data??{})}}),T=await X(x.status,{...x.result?{result:x.result}:{},...x.error_code?{error_code:MJ(x.error_code,"vm_hands_op_failed")}:{}});K("vm_hands.op",{capability:F,kind:Q,status:x.status,code:x.error_code??null,...T.status>=300?{complete_status:T.status,complete_error:String(T.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval(o),t.delete(N),B)Z.modelOps.get(B)?.delete(l);M()}}async function SJ($,Y){let G=$.claim.attempt_id;if(Z.turns.get(G)===$)Z.turns.delete(G);J.onTurn?.(G,null),s($);let X=await I(Z,J.agent,G);Z.receipts.push({turn:$,failure:Y,unbound:X}),await ZJ()}function ZJ(){return JJ=JJ.then(WJ,WJ),JJ}async function WJ(){while(Z.receipts.length){let{turn:$,failure:Y,unbound:G}=Z.receipts[0],{complete:X,emit:j}=_($);try{if(await j("hands.stopped",{...$.readyData,reason_code:Y?"failed":"cancelled",killed_verified:G.killed_verified,shredded:G.shredded,...G.srt_fallbacks?{vm_hands_srt_fallbacks:G.srt_fallbacks}:{}}),Y)await X("failed",{error_code:Y});else await X("cancelled",{error_code:"driver_stopped"})}catch(q){if(q instanceof h)return}Z.receipts.shift()}}async function HJ($,Y){let{fence:G,op:X}=_($),j=Y.snapshot_id;if(Y.version!==1||typeof j!=="string"||Object.keys(Y).length!==2)throw new W("vm_hands_env_invalid","invalid environment delivery");let q=await w(`/operations/${X}/environment`,{...G,snapshot_id:j}),C=q.json?.environment_sealed;if(q.status!==200||!C||q.json?.payload!==void 0)throw new W("vm_hands_env_invalid","environment not delivered sealed");let Q=await J.agent.deliverEnvironment({attemptId:$.claim.attempt_id,snapshotId:j,deviceId:Z.deviceId??"",sealed:C});if((await w(`/operations/${X}/environment-ack`,{...G,...Q})).status>=300)throw new W("vm_hands_env_ack_refused","environment ack refused")}}
|
|
5
5
|
export{KZ as u,bJ as v,PZ as w};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{if as Z8}from"./vm-hands-entry-lite-wh0qp1gf.js";import{rf as R0}from"./vm-hands-entry-lite-yhz6sv35.js";import{ng as Kq}from"./vm-hands-entry-lite-
|
|
2
|
+
import{if as Z8}from"./vm-hands-entry-lite-wh0qp1gf.js";import{rf as R0}from"./vm-hands-entry-lite-yhz6sv35.js";import{ng as Kq}from"./vm-hands-entry-lite-7q2gywdm.js";import{Jg as p,Mg as V0,Pg as F0,Qg as C8,Rg as eq,Tg as g8,Wg as q0,Yg as x0}from"./vm-hands-entry-lite-22jgncrd.js";import{bh as wq}from"./vm-hands-entry-lite-mzxhng4z.js";import{ch as o,dh as C0}from"./vm-hands-entry-lite-cp1wqjs5.js";import{qh as B0}from"./vm-hands-entry-lite-ne8kkvk4.js";import{Hh as A0}from"./vm-hands-entry-lite-14t846kp.js";import{Oh as Z}from"./vm-hands-entry-lite-v6tkjqb1.js";import{execFile as V1,spawn as w0}from"child_process";import{randomBytes as F1}from"crypto";import{chmodSync as w1,existsSync as K0,lstatSync as K1,mkdirSync as M1,readFileSync as z1,rmSync as Y1,writeFileSync as Xq}from"fs";import{connect as _1}from"net";import{join as H}from"path";var Bq="./desktop-wallpaper-0pjhgyfk.jpg";var Rq="./dock-browser-afp005mt.png";var Cq="./dock-files-rywdm96b.png";var yq="./dock-terminal-s41cj1jp.png";var Sq=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
|
|
3
3
|
# The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
|
|
4
4
|
# python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
|
|
5
5
|
# Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import"./vm-hands-entry-lite-
|
|
2
|
+
import"./vm-hands-entry-lite-rv6k8wy8.js";import"./vm-hands-entry-lite-t497ewn2.js";import"./vm-hands-entry-lite-psybjyay.js";import{Uh as A}from"./vm-hands-entry-lite-cxs89wzv.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-yex7kse5.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-ck24pzen.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
// @bun
|
|
2
|
+
import{Ka as Uq,ob as Lq,qa as Bq,sb as Fq}from"./vm-hands-entry-lite-pwzz9ntw.js";import"./vm-hands-entry-lite-fq0zr7an.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-t497ewn2.js";import"./vm-hands-entry-lite-psybjyay.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-e0cj5ma7.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";import{spawn as Pq}from"child_process";import{chmodSync as Cq,chownSync as vq,existsSync as a,lstatSync as i,mkdirSync as o,mkdtempSync as Iq,readdirSync as s,readFileSync as P,realpathSync as Oq,rmdirSync as e,rmSync as bq,writeFileSync as m}from"fs";import{join as F}from"path";var Tq="/sys/fs/cgroup/reason-payload",H="vm-hands",hq="/run/ara-srt/fallbacks.jsonl",E="/reason-person",r=5000,xq=1e4,Qq="__VM_HANDS_PROOF_DIR__",Vq="__VM_HANDS_PROBE_NONCE__";class M extends Error{code;constructor(q,Q){super(Q);this.code=q}}function _q(q,Q){if(!/^[0-9a-f-]{36}$/i.test(Q))throw new M("vm_hands_bind_invalid","bad bind id");return F(q,H,`b-${Q.toLowerCase()}`)}var Hq=5000,Mq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function tq(q){let Q=q.cgroup??Tq,J=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,z=new Map,K=0,C=()=>{try{let Z=P("/run/ara-srt/starts.jsonl","utf8"),$=Z.slice(K>Z.length?0:K).split(`
|
|
3
|
+
`).filter(Boolean);K=Z.length;let W=$.map((T)=>{try{return Number(JSON.parse(T).elapsed_ms)||0}catch{return 0}});if(W.length)X("vm_hands.srt_server_starts",{count:W.length,elapsed_ms:W.slice(0,8)})}catch{}},f=null,g=!1,h=q.srtCgroup??"/sys/fs/cgroup/reason-srt",v=()=>{f??=Wq()},x=0,V=()=>{try{let Z=P(hq,"utf8"),$=Z.slice(x>Z.length?0:x);x=Z.length;let W=$.split(`
|
|
4
|
+
`).filter(Boolean).slice(0,1000);if(!W.length)return null;let T={},U=0;for(let R of W)try{let w=JSON.parse(R),B=typeof w.code==="string"&&/^[a-z_]{1,40}$/.test(w.code)?w.code:"other";if(T[B]=(T[B]??0)+1,typeof w.elapsed_ms==="number")U=Math.max(U,w.elapsed_ms)}catch{T.unparsed=(T.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:W.length,codes:T,max_elapsed_ms:U}),{count:W.length,codes:T,max_elapsed_ms:U}}catch{return null}},N=!1,u=(Z,$,W)=>{if(N)throw Error("vm_hands_pool_held");return Dq(Z,$,W)},d=(Z)=>($,W,T)=>Pq("/bin/sh",["-c",`echo $$ > ${Mq(F(Z,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",$,...W],T),Dq=d(F(Q,H)),l=F(Q,H,"probe"),S=(Z)=>_q(Q,Z),fq=(Z)=>{let $=S(Z);try{o($,{mode:493})}catch(W){if(!(W&&typeof W==="object"&&("code"in W)&&W.code==="EEXIST"))throw new M("vm_hands_bind_failed","bind cgroup")}return $},jq=(Z)=>{try{e(S(Z))}catch{}},_=q.prespawn?Uq({spawnProcess:u,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(Z,$)=>X(Z,$??{})}):null;_?.arm();let n=_?setInterval(()=>{_.arm()},Hq):null;n?.unref?.();async function c(Z){let $=G.get(Z);if(G.delete(Z),!$)return;$.abort.abort(),await $.done}return{bindCgroup:S,async startExecutor(Z){if(v(),z.set(Z.bindId,Wq()),g=!0,!Z.claim)throw new M("vm_hands_bind_invalid","an executor needs the claim it serves");await c(Z.bindId);let{claim:$,bindId:W}=Z,T=fq(W),U=$.owner;if(!U||typeof U.device_id!=="string"||typeof $.root_id!=="string")throw new M("vm_hands_bind_invalid","claim without its owner Device or root");let R=new AbortController,w,B,j=new Promise((Y,A)=>{w=Y,B=A}),I,D=new Promise((Y)=>{I=Y}),O=Fq({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:U.device_id,rootId:$.root_id,apiOrigin:q.apiOrigin},claimOwner:$.owner,root:q.root,runId:$.run_id,operationId:$.operation_id,attemptId:$.attempt_id,payload:Object.fromEntries(Object.entries($.payload).filter(([Y])=>!Y.startsWith("vm_hands_"))),signal:R.signal,emitEvent:async(Y,A)=>{if(Y==="hands.ready"){w(A);return}if(Y==="hands.started"||Y==="hands.stopped"||Y==="hands.failed")return;await q.forward(W,Y,A)}},{...q.relayDependencies,spawnWorker:(Y)=>d(T)(Y.command,Y.args,Y.options),..._?{takePrespawnedWorker:(Y)=>{let A=_.take(Y);if(!A?.pid)return A;try{return m(F(T,"cgroup.procs"),String(A.pid)),A}catch{try{A.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:_.adopt}:{}}).then(()=>{I("executor_stopped")},(Y)=>{let A=Y&&typeof Y==="object"&&"code"in Y?String(Y.code):"executor_failed";B(new M(A,Y instanceof Error?Y.message:String(Y))),I(A)}).finally(()=>B(new M("vm_hands_executor_exited","executor ended before it was ready")));G.set(W,{abort:R,done:O,exited:D,operationId:$.operation_id,runId:$.run_id,expiresAtMs:Date.parse(String($.payload.expires_at??""))||0});let y=await j,L=y.executor_launch_id;if(typeof L!=="string")throw new M("vm_hands_bind_failed","executor ready without a launch id");return{launchId:L,readyData:y,applied:{hands_confinement:typeof $.payload.hands_confinement==="string"?$.payload.hands_confinement:null,browser_egress:$.payload.browser_egress??null}}},takeSrtFallbacks:V,executorExited(Z){return G.get(Z)?.exited??new Promise(()=>{})},freezeBind(Z){let $=S(Z);if(a(F($,"cgroup.freeze")))m(F($,"cgroup.freeze"),"1")},async killAndVerifyPayload(Z){let $=new Set(Z?.keep??[]);if($.size)return Aq(Z?.bindId??null,$);N=!0;let W=Jq();try{await Kq();let T=Promise.all([...G.keys()].map((B)=>c(B).catch(()=>{return})));C();let U=Date.now()+r;await p(Q,U,"payload"),await T;let R=(g||q.srtWarmLate?.()===!0)&&a(F(h,"cgroup.events"));if(R)await p(h,U,"srt");let w=Xq(J).filter((B)=>!b(B,E));if(f!==null){let B=qq(f).filter((j)=>j!==process.pid&&!b(j,E));if(B.length)throw X("vm_hands.kill_strays",{strays:B.slice(0,16).map((j)=>{let I="?",D="?";try{I=P(`/proc/${j}/comm`,"utf8").trim().slice(0,32)}catch{}try{D=(P(`/proc/${j}/cgroup`,"utf8").split(`
|
|
5
|
+
`).find((O)=>O.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:j,comm:I,cgroup:D}})}),new M("vm_hands_kill_unverified",`${B.length} process(es) the run started survived it`);f=null}if(g=!1,R)q.onSrtReset?.();if(w.length)throw X("vm_hands.kill_survivors",{pids:w.slice(0,16)}),new M("vm_hands_kill_unverified",`${w.length} payload-uid process(es) outside the payload cgroup`);z.clear();for(let B of $q())try{e(F(Q,H,B))}catch{}}finally{N=!1,W()}if(_)setTimeout(()=>{if(!G.size)_.arm()},100).unref?.()},async killProbe(){let Z=Date.now()+r;if(a(F(l,"cgroup.events"))){await p(l,Z,"probe");try{e(l)}catch{}}let $=Zq(process.pid);if($===null)throw new M("vm_hands_kill_unverified","agent start time unreadable");await kq(Q,$,Z);let W=(U)=>{let R=Zq(U);return R!==null&&R<=$},T=Xq(J).filter((U)=>W(U)&&!b(U,E));if(T.length)throw X("vm_hands.kill_survivors",{pids:T.slice(0,16),at:"attest"}),new M("vm_hands_kill_unverified",`${T.length} payload-uid process(es) from before this agent`);if(f!==null){let U=[Q,F(Q,H)].map((B)=>B.replace(/^\/sys\/fs\/cgroup/,"")),R=h.replace(/^\/sys\/fs\/cgroup/,""),w=qq(f).filter((B)=>B!==process.pid&&!b(B,E)&&!b(B,"/reason-vm-hands")&&!b(B,R)&&!U.some((j)=>zq(B,j)));if(w.length)throw X("vm_hands.kill_strays",{strays:w.slice(0,16).map((B)=>({pid:B})),at:"attest"}),new M("vm_hands_kill_unverified",`${w.length} process(es) the probe started survived it`);f=null}},async runProbe({nonce:Z,script:$}){if(v(),!$.includes(Qq))throw new M("vm_hands_probe_failed","probe names no proof directory");let W=q.proofParent??"/tmp/reason-vm-hands-proof";o(W,{mode:457,recursive:!0});let T=i(W);if(T.isSymbolicLink()||!T.isDirectory()||T.uid!==(process.getuid?.()??-1)||(T.mode&4095)!==457)throw new M("vm_hands_probe_failed","proof parent is not root's 0711 directory");let U=Iq(F(W,"p-")),R=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(U)||!/^[A-Za-z0-9_-]{1,128}$/.test(Z))throw new M("vm_hands_probe_failed","proof directory path or nonce");vq(U,J,J),Cq(U,448);let w=i(U).ino;try{o(l,{mode:493})}catch(D){if(!(D&&typeof D==="object"&&("code"in D)&&D.code==="EEXIST"))throw new M("vm_hands_probe_failed","probe cgroup")}let B=d(l)("/bin/bash",["-c",$.replaceAll(Qq,U).replaceAll(Vq,Z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),j="";B.stdout?.on("data",(D)=>{if(j.length<16384)j+=D.toString("utf8").slice(0,16384-j.length)});let I=await new Promise((D)=>{let O=setTimeout(()=>{R=!0,B.kill("SIGKILL"),D(124)},xq);B.once("error",()=>{clearTimeout(O),D(127)}),B.once("close",(y)=>{clearTimeout(O),D(y??1)})});return X("vm_hands.probe",{nonce_len:Z.length,exit_code:I}),{exitCode:I,markers:j,proofDirInode:w}}finally{if(!R)bq(U,{recursive:!0,force:!0})}},restatLayout(){let{session_root:Z,alias:$}=q.init.layout,W="invalid";try{Lq(Z),W="0:0:755"}catch{}let T=!1,U=-1;try{let R=i($);U=R.uid,T=W==="0:0:755"&&$===F(Z,"repo")&&!R.isSymbolicLink()&&R.isDirectory()&&Oq($)===$&&R.uid===J}catch{}return{root_mode:W,alias_ok:T,owner_uid:U}},installEnvironment(Z,$){let W=G.get(Z);if(!W)throw new M("environment_unavailable","no executor owns an environment");return Bq({root:q.root,operationId:W.operationId,payload:$}).installed_revision},async stop(){if(n)clearInterval(n);_?.close(),await Promise.all([...G.keys()].map((Z)=>c(Z)))}};function $q(){try{return s(F(Q,H),{withFileTypes:!0}).filter((Z)=>Z.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(Z.name)).map((Z)=>Z.name)}catch{return[]}}async function Aq(Z,$){let W=new Set([...$].map((U)=>U.toLowerCase())),T=Jq();try{await Kq();let U=Date.now()+r,R=new Set($q().filter((L)=>!W.has(L.slice(2))).map((L)=>L.slice(2)));if(Z)R.add(Z.toLowerCase());let w=null;for(let L of R){let Y=c(L).catch(()=>{return}),A=z.get(L);if(A!==void 0)w=w===null?A:Math.min(w,A);if(a(F(S(L),"cgroup.events")))await p(S(L),U,"bind");await Y}let B=[...W].map((L)=>S(L).replace(/^\/sys\/fs\/cgroup/,"")),j=[Q,F(Q,H)].map((L)=>L.replace(/^\/sys\/fs\/cgroup/,"")),I=h.replace(/^\/sys\/fs\/cgroup/,""),D=(L)=>b(L,E)||B.some((Y)=>b(L,Y)),O=Xq(J).filter((L)=>!D(L));if(O.length)throw X("vm_hands.kill_survivors",{pids:O.slice(0,16),beside:W.size}),new M("vm_hands_kill_unverified",`${O.length} payload-uid process(es) outside a live bind`);let y=(L)=>!D(L)&&!b(L,"/reason-vm-hands")&&!b(L,I)&&!j.some((Y)=>zq(L,Y));if(w!==null){let L=qq(w).filter((Y)=>Y!==process.pid&&y(Y));if(L.length)throw X("vm_hands.kill_strays",{strays:L.slice(0,16).map((Y)=>({pid:Y})),beside:W.size}),new M("vm_hands_kill_unverified",`${L.length} process(es) the run started survived it`)}for(let L of R)z.delete(L),jq(L)}finally{T()}}}function Zq(q,Q="/proc"){try{let J=P(F(Q,String(q),"stat"),"utf8"),X=Number(J.slice(J.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(X)?X:null}catch{return null}}function gq(q,Q="/proc"){try{let J=P(F(Q,String(q),"stat"),"utf8"),X=Number(J.slice(J.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(X)?X:null}catch{return null}}async function kq(q,Q,J){try{m(F(q,"cgroup.freeze"),"1")}catch(X){throw new M("vm_hands_kill_unverified",`payload cgroup.freeze: ${X instanceof Error?X.message:String(X)}`)}try{for(;;){let X=wq(q).filter((z)=>Rq(z,q)),G=new Set(X.filter((z)=>{let K=Zq(z);return K!==null&&K<=Q}));for(let z=!0;z;){z=!1;for(let K of X){if(G.has(K))continue;let C=gq(K);if(C!==null&&G.has(C))G.add(K),z=!0}}if(G.size===0)return;if(Date.now()>J)throw new M("vm_hands_kill_unverified",`${G.size} previous-boot process(es) survived`);for(let z of G)try{process.kill(z,"SIGKILL")}catch{}await new Promise((z)=>setTimeout(z,10))}}finally{try{m(F(q,"cgroup.freeze"),"0")}catch{}}}function zq(q,Q,J="/proc"){try{return P(F(J,String(q),"cgroup"),"utf8").split(`
|
|
6
|
+
`).find((G)=>G.startsWith("0::"))?.slice(3)===Q}catch{return!1}}function b(q,Q,J="/proc"){try{let G=P(F(J,String(q),"cgroup"),"utf8").split(`
|
|
7
|
+
`).find((z)=>z.startsWith("0::"))?.slice(3)??"";return G===Q||G.startsWith(`${Q}/`)}catch{return!1}}var Sq=100;function Wq(){try{return Math.floor(Number(P("/proc/uptime","utf8").split(" ")[0])*Sq)}catch{return 0}}async function p(q,Q,J){try{m(F(q,"cgroup.freeze"),"1")}catch(X){throw new M("vm_hands_kill_unverified",`${J} cgroup.freeze: ${X instanceof Error?X.message:String(X)}`)}while(!/^populated 0$/m.test(P(F(q,"cgroup.events"),"utf8"))){if(Date.now()>Q)throw new M("vm_hands_kill_unverified",`${J} cgroup still populated (left frozen)`);for(let X of wq(q)){if(!Rq(X,q))continue;try{process.kill(X,"SIGKILL")}catch{}}await new Promise((X)=>setTimeout(X,10))}try{m(F(q,"cgroup.freeze"),"0")}catch(X){throw new M("vm_hands_kill_unverified",`${J} cgroup thaw: ${X instanceof Error?X.message:String(X)}`)}}function Rq(q,Q){let J=Q.replace(/^\/sys\/fs\/cgroup/,"")||"/",X="";try{X=P(`/proc/${q}/cgroup`,"utf8").split(`
|
|
8
|
+
`).find((z)=>z.startsWith("0::"))??""}catch{return!1}let G=X.slice(3);return G===J||G.startsWith(`${J}/`)}function wq(q){let Q=[],J=(X)=>{try{for(let z of P(F(X,"cgroup.procs"),"utf8").split(`
|
|
9
|
+
`))if(/^\d+$/.test(z))Q.push(Number(z))}catch{}let G=[];try{G=s(X,{withFileTypes:!0}).filter((z)=>z.isDirectory()).map((z)=>z.name)}catch{}for(let z of G)J(F(X,z))};return J(q),Q}function qq(q,Q="/proc"){let J=[];for(let X of s(Q)){if(!/^\d+$/.test(X))continue;let G;try{G=P(F(Q,X,"stat"),"utf8")}catch{continue}let z=G.slice(G.lastIndexOf(")")+2).split(" "),K=Number(z[1]),C=Number(z[6]),f=Number(z[19]);if(!((C&2097152)!==0||K===2||X==="2")&&z[0]!=="Z"&&f>=q)J.push(Number(X))}return J}function Xq(q,Q="/proc"){let J=[];for(let X of s(Q)){if(!/^\d+$/.test(X))continue;let G;try{G=P(F(Q,X,"status"),"utf8")}catch{continue}let z=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(G);if(z&&z.slice(1).some((K)=>Number(K)===q))J.push(Number(X))}return J}function Gq(q="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(P(q,"utf8").trim())>=1}catch{return!1}}var k=0,Nq=[],t=new Set;function Jq(){k++;let q=!1;return()=>{if(q)return;if(q=!0,--k===0)for(let Q of Nq.splice(0))Q()}}function yq(){return k===0?Promise.resolve():new Promise((q)=>{Nq.push(q)})}async function Yq(){while(k>0)await yq()}async function Kq(){let q=Date.now()+1000;while(t.size&&Date.now()<q)await new Promise((Q)=>setTimeout(Q,2))}function Eq(q,Q){let J=Q.replace(/^\/sys\/fs\/cgroup/,"");t.add(q);let X=()=>{let G="";try{G=P(`/proc/${q}/cgroup`,"utf8").split(`
|
|
10
|
+
`).find((z)=>z.startsWith("0::"))??""}catch{t.delete(q);return}if(G.slice(3)===J){t.delete(q);return}setTimeout(X,1)};X()}function sq(q){let Q={person:q.personCgroup??F("/sys/fs/cgroup",E,H),model:q.payloadCgroup??F(Tq,H)},J=q.entry??process.argv[1]??"",X={},G=(K)=>K.startsWith("model:")&&q.bindCgroup?q.bindCgroup(K.slice(6)):Q[K.startsWith("model")?"model":"person"],z=(K)=>{let C=K.startsWith("model")?"model":"person",f=new Map,g=String(q.payloadUid),h=String(q.payloadGid),v=Bun.spawn(["/bin/sh","-c",`echo $$ > ${Mq(F(G(K),"cgroup.procs"))} || exit 125; exec /usr/bin/setpriv --no-new-privs --reuid=${g} --regid=${h} --clear-groups -- "$@"`,"vm-hands-op-join",process.execPath,"--no-install",J,"--vm-hands-op-runner"],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:"/home/runner"},stdio:["ignore","ignore","ignore"],ipc(V){let N=V,u=f.get(N.id);if(!u)return;if(N.t==="event"&&N.event)u.onEvent(N.event);if(N.t==="done")f.delete(N.id),u.done(N.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});v.exited.then((V)=>{if(X[K]?.child===v)delete X[K];for(let[,N]of f)N.done({status:"failed",error_code:"vm_hands_op_runner_exited"});f.clear(),q.log?.("vm_hands.op_runner_exited",{kind:C,code:V})}),Eq(v.pid,G(K));let x={child:v,pending:f};return X[K]=x,x};return{run(K,C,f,g,h){if(!Gq())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let v=K==="model"&&h&&q.bindCgroup?`model:${h.toLowerCase()}`:K,x=async()=>{while(!X[v]&&k>0)await Yq()};return x().then(async()=>{if(!X[v]&&k>0)await x()}).then(()=>new Promise((V)=>{if(!X[v]&&k>0){V({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let N=X[v]??z(v);N.pending.set(C.id,{onEvent:f,done:V}),g.addEventListener("abort",()=>{try{N.child.send({t:"cancel",id:C.id})}catch{}},{once:!0});try{N.child.send({t:"op",...C})}catch{N.pending.delete(C.id),V({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(K){if(!X[K]&&Gq())Yq().then(()=>{if(!X[K]&&k===0)z(K)})},stop(){for(let K of Object.keys(X))X[K]?.child.kill()}}}export{_q as vmHandsBindCgroup,wq as subtreePids,Gq as ptraceProtected,qq as processesStartedSince,Xq as payloadUidProcesses,b as inCgroup,sq as createVmHandsOpRunners,tq as createVmHandsExecutor,M as VmHandsExecutorError,Qq as VM_HANDS_PROOF_DIR_TOKEN,Vq as VM_HANDS_PROBE_NONCE_TOKEN,E as VM_HANDS_PERSON_CGROUP,H as VM_HANDS_PAYLOAD_JOIN,Tq as VM_HANDS_PAYLOAD_CGROUP};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Uh as E}from"./vm-hands-entry-lite-cxs89wzv.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-
|
|
2
|
+
import{Uh as E}from"./vm-hands-entry-lite-cxs89wzv.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-bkfwqn2s.js"),import("./desktop-account-emwzhj61.js"),import("./worker-sandbox-yt11b09s.js")]);J();let K=(process.geteuid?.()??0)!==0,z=new Map,y=(B)=>{try{process.send?.(B)}catch{}};process.on("message",(B)=>{let j=B;if(j?.t==="cancel"){z.get(j.id)?.abort();return}if(j?.t!=="op")return;if(!K){y({t:"done",id:j.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let F=new AbortController;z.set(j.id,F),G(j.state,j.claim,{worker:j.worker,signal:F.signal,emit:(q)=>{let{deliverySignal:N,...M}=q;y({t:"event",id:j.id,event:M})}}).then((q)=>y({t:"done",id:j.id,completion:q}),(q)=>y({t:"done",id:j.id,completion:{status:"failed",error_code:q&&typeof q==="object"&&"code"in q&&typeof q.code==="string"?q.code:"vm_hands_op_failed"}})).finally(()=>z.delete(j.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}export{Q as runVmHandsOpRunner};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{u as k,v as m,w as l}from"./vm-hands-entry-lite-
|
|
3
|
-
`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>jj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=T(p);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[S,!1],["/usr/local/bin",!0]]){let Y=T(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let
|
|
4
|
-
`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function
|
|
2
|
+
import{u as k,v as m,w as l}from"./vm-hands-entry-lite-rv6k8wy8.js";import{_c as v}from"./vm-hands-entry-lite-t497ewn2.js";import"./vm-hands-entry-lite-psybjyay.js";import{Uh as G}from"./vm-hands-entry-lite-cxs89wzv.js";import{spawn as a}from"child_process";import{createHash as r}from"crypto";import{lstatSync as T,mkdirSync as s,readFileSync as i,statSync as t,writeFileSync as d}from"fs";var P="/run/reason-vm-hands",O="/run/reason-vm-hands/env",w="/home/runner/.reason/workspace",e=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,p="/sys/fs/cgroup/reason-srt",S="/usr/local/bin/ara-srt-exec",jj=65536,qj=21600000;function Jj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=T(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
|
|
3
|
+
`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>jj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=T(p);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[S,!1],["/usr/local/bin",!0]]){let Y=T(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=r("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${p}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",S,"--settings",W,"--idle-ms",String(qj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Hj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&e.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=t(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Qj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-8qzmmn7c.js"),import("./hands-worker-source-ea5ywzxx.js"),import("./network-contract-bv7mj5he.js"),import("./device-workspace-xnyb7zp2.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-5zt3ys5t.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],Zj=new Set(["pty.start","jobs.control"]);function $j(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:w,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function Xj(Q){for(let j of i("/etc/passwd","utf8").split(`
|
|
4
|
+
`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function zj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:w,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Lj(Q,j){y(P),y(O),Jj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-emwzhj61.js"),import("./worker-sandbox-yt11b09s.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-r34x5748.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:w,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let M={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{M.restatLayout=()=>q.restatLayout(),M.installEnvironment=($,B)=>q.installEnvironment($,B),M.freezeBind=($)=>q.freezeBind($),M.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,M,{envRoot:O}),h=Qj(Q),b=null,n=Promise.all([h,import("./local-capabilities-bkfwqn2s.js")]).then(([q,$])=>{b=$j(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-r34x5748.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:Xj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:L.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let x=zj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};if(Zj.has(String($.capability))){let{executeLocalOperation:U}=await import("./local-capabilities-bkfwqn2s.js");return U(x,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:x,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Lj as runVmHands,Hj as parseVmHandsInit,Qj as heartbeatBody,Jj as enableBaseKeyedSrt};
|
package/package.json
CHANGED
|
@@ -1,10 +0,0 @@
|
|
|
1
|
-
// @bun
|
|
2
|
-
import{Ka as Kq,ob as Bq,qa as Yq,sb as Tq}from"./vm-hands-entry-lite-mgx65dde.js";import"./vm-hands-entry-lite-fq0zr7an.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-t497ewn2.js";import"./vm-hands-entry-lite-psybjyay.js";import"./vm-hands-entry-lite-wh0qp1gf.js";import"./vm-hands-entry-lite-yhz6sv35.js";import"./vm-hands-entry-lite-mzxhng4z.js";import"./vm-hands-entry-lite-cp1wqjs5.js";import"./vm-hands-entry-lite-ne8kkvk4.js";import"./vm-hands-entry-lite-cx4z34jh.js";import"./vm-hands-entry-lite-14t846kp.js";import"./vm-hands-entry-lite-v6tkjqb1.js";import"./vm-hands-entry-lite-cxs89wzv.js";import{spawn as wq}from"child_process";import{chmodSync as Pq,chownSync as Dq,existsSync as t,lstatSync as s,mkdirSync as e,mkdtempSync as jq,readdirSync as p,readFileSync as A,realpathSync as Aq,rmdirSync as r,rmSync as fq,writeFileSync as c}from"fs";import{join as L}from"path";var Uq="/sys/fs/cgroup/reason-payload",S="vm-hands",Cq="/run/ara-srt/fallbacks.jsonl",u="/reason-person",qq=5000,vq=1e4,Xq="__VM_HANDS_PROOF_DIR__",Oq="__VM_HANDS_PROBE_NONCE__";class R extends Error{code;constructor(q,z){super(z);this.code=q}}function Vq(q,z){if(!/^[0-9a-f-]{36}$/i.test(z))throw new R("vm_hands_bind_invalid","bad bind id");return L(q,S,`b-${z.toLowerCase()}`)}var bq=5000,Lq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function lq(q){let z=q.cgroup??Uq,K=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,Y=new Map,B=0,O=()=>{try{let Z=A("/run/ara-srt/starts.jsonl","utf8"),$=Z.slice(B>Z.length?0:B).split(`
|
|
3
|
-
`).filter(Boolean);B=Z.length;let Q=$.map((T)=>{try{return Number(JSON.parse(T).elapsed_ms)||0}catch{return 0}});if(Q.length)X("vm_hands.srt_server_starts",{count:Q.length,elapsed_ms:Q.slice(0,8)})}catch{}},j=null,_=!1,h=q.srtCgroup??"/sys/fs/cgroup/reason-srt",f=()=>{j??=Zq()},b=0,x=()=>{try{let Z=A(Cq,"utf8"),$=Z.slice(b>Z.length?0:b);b=Z.length;let Q=$.split(`
|
|
4
|
-
`).filter(Boolean).slice(0,1000);if(!Q.length)return null;let T={},U=0;for(let N of Q)try{let M=JSON.parse(N),F=typeof M.code==="string"&&/^[a-z_]{1,40}$/.test(M.code)?M.code:"other";if(T[F]=(T[F]??0)+1,typeof M.elapsed_ms==="number")U=Math.max(U,M.elapsed_ms)}catch{T.unparsed=(T.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:Q.length,codes:T,max_elapsed_ms:U}),{count:Q.length,codes:T,max_elapsed_ms:U}}catch{return null}},w=!1,y=(Z,$,Q)=>{if(w)throw Error("vm_hands_pool_held");return n(Z,$,Q)},i=(Z)=>($,Q,T)=>wq("/bin/sh",["-c",`echo $$ > ${Lq(L(Z,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",$,...Q],T),n=i(L(z,S)),g=(Z)=>Vq(z,Z),Mq=(Z)=>{let $=g(Z);try{e($,{mode:493})}catch(Q){if(!(Q&&typeof Q==="object"&&("code"in Q)&&Q.code==="EEXIST"))throw new R("vm_hands_bind_failed","bind cgroup")}return $},Nq=(Z)=>{try{r(g(Z))}catch{}},I=q.prespawn?Kq({spawnProcess:y,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(Z,$)=>X(Z,$??{})}):null;I?.arm();let a=I?setInterval(()=>{I.arm()},bq):null;a?.unref?.();async function m(Z){let $=G.get(Z);if(G.delete(Z),!$)return;$.abort.abort(),await $.done}return{bindCgroup:g,async startExecutor(Z){if(f(),Y.set(Z.bindId,Zq()),_=!0,!Z.claim)throw new R("vm_hands_bind_invalid","an executor needs the claim it serves");await m(Z.bindId);let{claim:$,bindId:Q}=Z,T=Mq(Q),U=$.owner;if(!U||typeof U.device_id!=="string"||typeof $.root_id!=="string")throw new R("vm_hands_bind_invalid","claim without its owner Device or root");let N=new AbortController,M,F,D=new Promise((W,P)=>{M=W,F=P}),v,C=new Promise((W)=>{v=W}),V=Tq({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:U.device_id,rootId:$.root_id,apiOrigin:q.apiOrigin},claimOwner:$.owner,root:q.root,runId:$.run_id,operationId:$.operation_id,attemptId:$.attempt_id,payload:Object.fromEntries(Object.entries($.payload).filter(([W])=>!W.startsWith("vm_hands_"))),signal:N.signal,emitEvent:async(W,P)=>{if(W==="hands.ready"){M(P);return}if(W==="hands.started"||W==="hands.stopped"||W==="hands.failed")return;await q.forward(Q,W,P)}},{...q.relayDependencies,spawnWorker:(W)=>i(T)(W.command,W.args,W.options),...I?{takePrespawnedWorker:(W)=>{let P=I.take(W);if(!P?.pid)return P;try{return c(L(T,"cgroup.procs"),String(P.pid)),P}catch{try{P.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:I.adopt}:{}}).then(()=>{v("executor_stopped")},(W)=>{let P=W&&typeof W==="object"&&"code"in W?String(W.code):"executor_failed";F(new R(P,W instanceof Error?W.message:String(W))),v(P)}).finally(()=>F(new R("vm_hands_executor_exited","executor ended before it was ready")));G.set(Q,{abort:N,done:V,exited:C,operationId:$.operation_id,runId:$.run_id,expiresAtMs:Date.parse(String($.payload.expires_at??""))||0});let E=await D,J=E.executor_launch_id;if(typeof J!=="string")throw new R("vm_hands_bind_failed","executor ready without a launch id");return{launchId:J,readyData:E,applied:{hands_confinement:typeof $.payload.hands_confinement==="string"?$.payload.hands_confinement:null,browser_egress:$.payload.browser_egress??null}}},takeSrtFallbacks:x,executorExited(Z){return G.get(Z)?.exited??new Promise(()=>{})},freezeBind(Z){let $=g(Z);if(t(L($,"cgroup.freeze")))c(L($,"cgroup.freeze"),"1")},async killAndVerifyPayload(Z){let $=new Set(Z?.keep??[]);if($.size)return Rq(Z?.bindId??null,$);w=!0;let Q=Wq();try{await Jq();let T=Promise.all([...G.keys()].map((F)=>m(F).catch(()=>{return})));O();let U=Date.now()+qq;await d(z,U,"payload"),await T;let N=(_||q.srtWarmLate?.()===!0)&&t(L(h,"cgroup.events"));if(N)await d(h,U,"srt");let M=Qq(K).filter((F)=>!k(F,u));if(j!==null){let F=$q(j).filter((D)=>D!==process.pid&&!k(D,u));if(F.length)throw X("vm_hands.kill_strays",{strays:F.slice(0,16).map((D)=>{let v="?",C="?";try{v=A(`/proc/${D}/comm`,"utf8").trim().slice(0,32)}catch{}try{C=(A(`/proc/${D}/cgroup`,"utf8").split(`
|
|
5
|
-
`).find((V)=>V.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:D,comm:v,cgroup:C}})}),new R("vm_hands_kill_unverified",`${F.length} process(es) the run started survived it`);j=null}if(_=!1,N)q.onSrtReset?.();if(M.length)throw X("vm_hands.kill_survivors",{pids:M.slice(0,16)}),new R("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside the payload cgroup`);Y.clear();for(let F of o())try{r(L(z,S,F))}catch{}}finally{w=!1,Q()}if(I)setTimeout(()=>{if(!G.size)I.arm()},100).unref?.()},async runProbe({nonce:Z,script:$}){if(f(),!$.includes(Xq))throw new R("vm_hands_probe_failed","probe names no proof directory");let Q=q.proofParent??"/tmp/reason-vm-hands-proof";e(Q,{mode:457,recursive:!0});let T=s(Q);if(T.isSymbolicLink()||!T.isDirectory()||T.uid!==(process.getuid?.()??-1)||(T.mode&4095)!==457)throw new R("vm_hands_probe_failed","proof parent is not root's 0711 directory");let U=jq(L(Q,"p-")),N=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(U)||!/^[A-Za-z0-9_-]{1,128}$/.test(Z))throw new R("vm_hands_probe_failed","proof directory path or nonce");Dq(U,K,K),Pq(U,448);let M=s(U).ino,F=n("/bin/bash",["-c",$.replaceAll(Xq,U).replaceAll(Oq,Z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),D="";F.stdout?.on("data",(C)=>{if(D.length<16384)D+=C.toString("utf8").slice(0,16384-D.length)});let v=await new Promise((C)=>{let V=setTimeout(()=>{N=!0,F.kill("SIGKILL"),C(124)},vq);F.once("error",()=>{clearTimeout(V),C(127)}),F.once("close",(E)=>{clearTimeout(V),C(E??1)})});return X("vm_hands.probe",{nonce_len:Z.length,exit_code:v}),{exitCode:v,markers:D,proofDirInode:M}}finally{if(!N)fq(U,{recursive:!0,force:!0})}},restatLayout(){let{session_root:Z,alias:$}=q.init.layout,Q="invalid";try{Bq(Z),Q="0:0:755"}catch{}let T=!1,U=-1;try{let N=s($);U=N.uid,T=Q==="0:0:755"&&$===L(Z,"repo")&&!N.isSymbolicLink()&&N.isDirectory()&&Aq($)===$&&N.uid===K}catch{}return{root_mode:Q,alias_ok:T,owner_uid:U}},installEnvironment(Z,$){let Q=G.get(Z);if(!Q)throw new R("environment_unavailable","no executor owns an environment");return Yq({root:q.root,operationId:Q.operationId,payload:$}).installed_revision},async stop(){if(a)clearInterval(a);I?.close(),await Promise.all([...G.keys()].map((Z)=>m(Z)))}};function o(){try{return p(L(z,S),{withFileTypes:!0}).filter((Z)=>Z.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(Z.name)).map((Z)=>Z.name)}catch{return[]}}async function Rq(Z,$){let Q=new Set([...$].map((U)=>U.toLowerCase())),T=Wq();try{await Jq();let U=Date.now()+qq,N=new Set(o().filter((J)=>!Q.has(J.slice(2))).map((J)=>J.slice(2)));if(Z)N.add(Z.toLowerCase());let M=null;for(let J of N){let W=m(J).catch(()=>{return}),P=Y.get(J);if(P!==void 0)M=M===null?P:Math.min(M,P);if(t(L(g(J),"cgroup.events")))await d(g(J),U,"bind");await W}let F=[...Q].map((J)=>g(J).replace(/^\/sys\/fs\/cgroup/,"")),D=[z,L(z,S)].map((J)=>J.replace(/^\/sys\/fs\/cgroup/,"")),v=h.replace(/^\/sys\/fs\/cgroup/,""),C=(J)=>k(J,u)||F.some((W)=>k(J,W)),V=Qq(K).filter((J)=>!C(J));if(V.length)throw X("vm_hands.kill_survivors",{pids:V.slice(0,16),beside:Q.size}),new R("vm_hands_kill_unverified",`${V.length} payload-uid process(es) outside a live bind`);let E=(J)=>!C(J)&&!k(J,"/reason-vm-hands")&&!k(J,v)&&!D.some((W)=>xq(J,W));if(M!==null){let J=$q(M).filter((W)=>W!==process.pid&&E(W));if(J.length)throw X("vm_hands.kill_strays",{strays:J.slice(0,16).map((W)=>({pid:W})),beside:Q.size}),new R("vm_hands_kill_unverified",`${J.length} process(es) the run started survived it`)}for(let J of N)Y.delete(J),Nq(J)}finally{T()}}}function xq(q,z,K="/proc"){try{return A(L(K,String(q),"cgroup"),"utf8").split(`
|
|
6
|
-
`).find((G)=>G.startsWith("0::"))?.slice(3)===z}catch{return!1}}function k(q,z,K="/proc"){try{let G=A(L(K,String(q),"cgroup"),"utf8").split(`
|
|
7
|
-
`).find((Y)=>Y.startsWith("0::"))?.slice(3)??"";return G===z||G.startsWith(`${z}/`)}catch{return!1}}var Iq=100;function Zq(){try{return Math.floor(Number(A("/proc/uptime","utf8").split(" ")[0])*Iq)}catch{return 0}}async function d(q,z,K){try{c(L(q,"cgroup.freeze"),"1")}catch(X){throw new R("vm_hands_kill_unverified",`${K} cgroup.freeze: ${X instanceof Error?X.message:String(X)}`)}while(!/^populated 0$/m.test(A(L(q,"cgroup.events"),"utf8"))){if(Date.now()>z)throw new R("vm_hands_kill_unverified",`${K} cgroup still populated (left frozen)`);for(let X of hq(q)){if(!_q(X,q))continue;try{process.kill(X,"SIGKILL")}catch{}}await new Promise((X)=>setTimeout(X,10))}try{c(L(q,"cgroup.freeze"),"0")}catch(X){throw new R("vm_hands_kill_unverified",`${K} cgroup thaw: ${X instanceof Error?X.message:String(X)}`)}}function _q(q,z){let K=z.replace(/^\/sys\/fs\/cgroup/,"")||"/",X="";try{X=A(`/proc/${q}/cgroup`,"utf8").split(`
|
|
8
|
-
`).find((Y)=>Y.startsWith("0::"))??""}catch{return!1}let G=X.slice(3);return G===K||G.startsWith(`${K}/`)}function hq(q){let z=[],K=(X)=>{try{for(let Y of A(L(X,"cgroup.procs"),"utf8").split(`
|
|
9
|
-
`))if(/^\d+$/.test(Y))z.push(Number(Y))}catch{}let G=[];try{G=p(X,{withFileTypes:!0}).filter((Y)=>Y.isDirectory()).map((Y)=>Y.name)}catch{}for(let Y of G)K(L(X,Y))};return K(q),z}function $q(q,z="/proc"){let K=[];for(let X of p(z)){if(!/^\d+$/.test(X))continue;let G;try{G=A(L(z,X,"stat"),"utf8")}catch{continue}let Y=G.slice(G.lastIndexOf(")")+2).split(" "),B=Number(Y[1]),O=Number(Y[6]),j=Number(Y[19]);if(!((O&2097152)!==0||B===2||X==="2")&&Y[0]!=="Z"&&j>=q)K.push(Number(X))}return K}function Qq(q,z="/proc"){let K=[];for(let X of p(z)){if(!/^\d+$/.test(X))continue;let G;try{G=A(L(z,X,"status"),"utf8")}catch{continue}let Y=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(G);if(Y&&Y.slice(1).some((B)=>Number(B)===q))K.push(Number(X))}return K}function zq(q="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(A(q,"utf8").trim())>=1}catch{return!1}}var H=0,Fq=[],l=new Set;function Wq(){H++;let q=!1;return()=>{if(q)return;if(q=!0,--H===0)for(let z of Fq.splice(0))z()}}function Hq(){return H===0?Promise.resolve():new Promise((q)=>{Fq.push(q)})}async function Gq(){while(H>0)await Hq()}async function Jq(){let q=Date.now()+1000;while(l.size&&Date.now()<q)await new Promise((z)=>setTimeout(z,2))}function gq(q,z){let K=z.replace(/^\/sys\/fs\/cgroup/,"");l.add(q);let X=()=>{let G="";try{G=A(`/proc/${q}/cgroup`,"utf8").split(`
|
|
10
|
-
`).find((Y)=>Y.startsWith("0::"))??""}catch{l.delete(q);return}if(G.slice(3)===K){l.delete(q);return}setTimeout(X,1)};X()}function cq(q){let z={person:q.personCgroup??L("/sys/fs/cgroup",u,S),model:q.payloadCgroup??L(Uq,S)},K=q.entry??process.argv[1]??"",X={},G=(B)=>B.startsWith("model:")&&q.bindCgroup?q.bindCgroup(B.slice(6)):z[B.startsWith("model")?"model":"person"],Y=(B)=>{let O=B.startsWith("model")?"model":"person",j=new Map,_=String(q.payloadUid),h=String(q.payloadGid),f=Bun.spawn(["/bin/sh","-c",`echo $$ > ${Lq(L(G(B),"cgroup.procs"))} || exit 125; exec /usr/bin/setpriv --no-new-privs --reuid=${_} --regid=${h} --clear-groups -- "$@"`,"vm-hands-op-join",process.execPath,"--no-install",K,"--vm-hands-op-runner"],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:"/home/runner"},stdio:["ignore","ignore","ignore"],ipc(x){let w=x,y=j.get(w.id);if(!y)return;if(w.t==="event"&&w.event)y.onEvent(w.event);if(w.t==="done")j.delete(w.id),y.done(w.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});f.exited.then((x)=>{if(X[B]?.child===f)delete X[B];for(let[,w]of j)w.done({status:"failed",error_code:"vm_hands_op_runner_exited"});j.clear(),q.log?.("vm_hands.op_runner_exited",{kind:O,code:x})}),gq(f.pid,G(B));let b={child:f,pending:j};return X[B]=b,b};return{run(B,O,j,_,h){if(!zq())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let f=B==="model"&&h&&q.bindCgroup?`model:${h.toLowerCase()}`:B,b=async()=>{while(!X[f]&&H>0)await Gq()};return b().then(async()=>{if(!X[f]&&H>0)await b()}).then(()=>new Promise((x)=>{if(!X[f]&&H>0){x({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let w=X[f]??Y(f);w.pending.set(O.id,{onEvent:j,done:x}),_.addEventListener("abort",()=>{try{w.child.send({t:"cancel",id:O.id})}catch{}},{once:!0});try{w.child.send({t:"op",...O})}catch{w.pending.delete(O.id),x({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(B){if(!X[B]&&zq())Gq().then(()=>{if(!X[B]&&H===0)Y(B)})},stop(){for(let B of Object.keys(X))X[B]?.child.kill()}}}export{Vq as vmHandsBindCgroup,hq as subtreePids,zq as ptraceProtected,$q as processesStartedSince,Qq as payloadUidProcesses,k as inCgroup,cq as createVmHandsOpRunners,lq as createVmHandsExecutor,R as VmHandsExecutorError,Xq as VM_HANDS_PROOF_DIR_TOKEN,Oq as VM_HANDS_PROBE_NONCE_TOKEN,u as VM_HANDS_PERSON_CGROUP,S as VM_HANDS_PAYLOAD_JOIN,Uq as VM_HANDS_PAYLOAD_CGROUP};
|