@reason-machines/cli-linux-arm64-musl 0.2.329 → 0.2.331

package/bin/vm-hands/{vm-hands-runtime-jnz4rqxa.js → vm-hands-runtime-rh673d51.js}

@@ -1,4 +1,4 @@
 // @bun
-import{x as k,y as m,z as l}from"./vm-hands-entry-lite-6g65w75z.js";import{bd as v}from"./vm-hands-entry-lite-rnwjp0tk.js";import"./vm-hands-entry-lite-669hk342.js";import{ai as G}from"./vm-hands-entry-lite-5a0kyaxa.js";import{spawn as a}from"child_process";import{createHash as t}from"crypto";import{lstatSync as w,mkdirSync as s,readFileSync as i,statSync as e,writeFileSync as d}from"fs";var P="/run/reason-vm-hands",O="/run/reason-vm-hands/env",T="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",p="/usr/local/bin/ara-srt-exec",qj=65536,Jj=21600000;function Qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=w(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
-`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=w(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=w(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=t("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-tsq05aw1.js"),import("./hands-worker-source-fprvxtp8.js"),import("./network-contract-gb6gk8fg.js"),import("./device-workspace-pacdp5tv.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-469gmb0h.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],$j=new Set(["pty.start","jobs.control"]);function Xj(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
-`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){y(P),y(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-s4629ksd.js"),import("./worker-sandbox-bqwkytj2.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-n2w3v0fs.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:T,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let M={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{M.restatLayout=()=>q.restatLayout(),M.installEnvironment=($,B)=>q.installEnvironment($,B),M.freezeBind=($)=>q.freezeBind($),M.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,M,{envRoot:O}),h=Zj(Q),b=null,n=Promise.all([h,import("./local-capabilities-qyw7cmjt.js")]).then(([q,$])=>{b=Xj(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-n2w3v0fs.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:L.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&q==="person"&&!$.authority;if($j.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-qyw7cmjt.js");return U(x,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:x,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Mj as runVmHands,Lj as parseVmHandsInit,Zj as heartbeatBody,Qj as enableBaseKeyedSrt};
+import{M as k,N as m,O as l}from"./vm-hands-entry-lite-3dx1yqhd.js";import{qd as v}from"./vm-hands-entry-lite-9k57wmkv.js";import"./vm-hands-entry-lite-mtp2h66e.js";import{qi as G}from"./vm-hands-entry-lite-px64jhhn.js";import{spawn as a}from"child_process";import{createHash as t}from"crypto";import{lstatSync as w,mkdirSync as s,readFileSync as i,statSync as e,writeFileSync as d}from"fs";var P="/run/reason-vm-hands",O="/run/reason-vm-hands/env",T="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",p="/usr/local/bin/ara-srt-exec",qj=65536,Jj=21600000;function Qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=w(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
+`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=w(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=w(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=t("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-fx884bha.js"),import("./hands-worker-source-tc1snvve.js"),import("./network-contract-qxn4pg15.js"),import("./device-workspace-nqxczwd3.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-n14gyf7k.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],$j=new Set(["pty.start","jobs.control"]);function Xj(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
+`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){y(P),y(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-a16gh9sj.js"),import("./worker-sandbox-1m0s1vnq.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-05w9bb7k.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:T,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let M={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{M.restatLayout=()=>q.restatLayout(),M.installEnvironment=($,B)=>q.installEnvironment($,B),M.freezeBind=($)=>q.freezeBind($),M.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,M,{envRoot:O}),h=Zj(Q),b=null,n=Promise.all([h,import("./local-capabilities-yhstjsc7.js")]).then(([q,$])=>{b=Xj(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-05w9bb7k.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:L.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&q==="person"&&!$.authority;if($j.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-yhstjsc7.js");return U(x,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:x,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Mj as runVmHands,Lj as parseVmHandsInit,Zj as heartbeatBody,Qj as enableBaseKeyedSrt};

package/bin/vm-hands/worker-sandbox-1m0s1vnq.js

@@ -0,0 +1,2 @@
+// @bun
+import{t as a}from"./vm-hands-entry-lite-hj6jjk24.js";import"./vm-hands-entry-lite-7kzy7rxj.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-070nd0vy.js";import"./vm-hands-entry-lite-px64jhhn.js";export{a as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-arm64-musl",
-  "version": "0.2.329",
+  "version": "0.2.331",
   "description": "Reason CLI native binary for linux-arm64-musl",
   "os": [
     "linux"

package/bin/vm-hands/connect-cli-tvqpqf33.js

@@ -1,2 +0,0 @@
-// @bun
-import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-wtk1v493.js";import"./vm-hands-entry-lite-pbnx8z9g.js";import"./vm-hands-entry-lite-nwcza0v8.js";import"./vm-hands-entry-lite-xjyd9xvx.js";import"./vm-hands-entry-lite-nj8bmc9y.js";import"./vm-hands-entry-lite-rd9vsaew.js";import"./vm-hands-entry-lite-n8gsyjq7.js";import"./vm-hands-entry-lite-9y8v419y.js";import"./vm-hands-entry-lite-abrbc7gf.js";import"./vm-hands-entry-lite-0p3hac9d.js";import"./vm-hands-entry-lite-rnwjp0tk.js";import"./vm-hands-entry-lite-669hk342.js";import"./vm-hands-entry-lite-xbe3dat0.js";import"./vm-hands-entry-lite-henbtxfe.js";import"./vm-hands-entry-lite-18kr0x4w.js";import"./vm-hands-entry-lite-asr8j2d4.js";import"./vm-hands-entry-lite-jz24p4jj.js";import"./vm-hands-entry-lite-tav4dt92.js";import"./vm-hands-entry-lite-sggk0bqc.js";import"./vm-hands-entry-lite-8afzattm.js";import"./vm-hands-entry-lite-djy0ww6h.js";import"./vm-hands-entry-lite-kbz9zfha.js";import"./vm-hands-entry-lite-n5ec0fjy.js";import"./vm-hands-entry-lite-dyqeaqzb.js";import"./vm-hands-entry-lite-40t7d4p5.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};

package/bin/vm-hands/desktop-account-s4629ksd.js

@@ -1,2 +0,0 @@
-// @bun
-import{kh as a,lh as b,mh as c,nh as d,oh as e}from"./vm-hands-entry-lite-djy0ww6h.js";import"./vm-hands-entry-lite-kbz9zfha.js";import"./vm-hands-entry-lite-n5ec0fjy.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{b as passwdAccount,e as desktopHome,d as desktopAccount,c as configureDesktopAccount,a as DESKTOP_USER_ENV};

package/bin/vm-hands/hands-worker-source-fprvxtp8.js

@@ -1,2 +0,0 @@
-// @bun
-import{Db as a,Eb as b,Fb as c,Gb as d,Hb as e,Ib as f,Jb as g,Kb as h,Lb as i}from"./vm-hands-entry-lite-nj8bmc9y.js";import"./vm-hands-entry-lite-9y8v419y.js";import"./vm-hands-entry-lite-8afzattm.js";import"./vm-hands-entry-lite-n5ec0fjy.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{e as selectCloudChildPath,a as REASON_HANDS_WORKER_VERSION,h as REASON_HANDS_WORKER_SOURCE,b as REASON_HANDS_WORKER_ENTRYPOINT,i as REASON_HANDS_WORKER_ARTIFACT_SHA256,f as REASON_HANDS_MAC_PTY_MEMBER_SOURCE,g as REASON_HANDS_LINUX_PTY_PROBE_SOURCE,d as REASON_HANDS_CLOUD_CHILD_PATH_MACOS,c as REASON_HANDS_CLOUD_CHILD_PATH_LINUX};

package/bin/vm-hands/local-automation-p0ty82xb.js

@@ -1,2 +0,0 @@
-// @bun
-import{Jc as a,Kc as b,Lc as c,Mc as d,Nc as e,Oc as f,Pc as g,Qc as h,Rc as i,Sc as j,Tc as k,Uc as l}from"./vm-hands-entry-lite-0p3hac9d.js";import"./vm-hands-entry-lite-rnwjp0tk.js";import"./vm-hands-entry-lite-669hk342.js";import"./vm-hands-entry-lite-xbe3dat0.js";import"./vm-hands-entry-lite-henbtxfe.js";import"./vm-hands-entry-lite-18kr0x4w.js";import"./vm-hands-entry-lite-asr8j2d4.js";import"./vm-hands-entry-lite-jz24p4jj.js";import"./vm-hands-entry-lite-tav4dt92.js";import"./vm-hands-entry-lite-sggk0bqc.js";import"./vm-hands-entry-lite-8afzattm.js";import"./vm-hands-entry-lite-djy0ww6h.js";import"./vm-hands-entry-lite-kbz9zfha.js";import"./vm-hands-entry-lite-n5ec0fjy.js";import"./vm-hands-entry-lite-dyqeaqzb.js";import"./vm-hands-entry-lite-40t7d4p5.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};

package/bin/vm-hands/local-capabilities-qyw7cmjt.js

@@ -1,2 +0,0 @@
-// @bun
-import{$ as l,S as c,T as d,U as e,V as f,W as g,X as h,Y as i,Z as j,_ as k,aa as m,ba as n,ca as o,da as p,ea as q,fa as r,ga as s,ha as t,ia as u}from"./vm-hands-entry-lite-nwcza0v8.js";import"./vm-hands-entry-lite-xjyd9xvx.js";import"./vm-hands-entry-lite-nj8bmc9y.js";import"./vm-hands-entry-lite-rd9vsaew.js";import"./vm-hands-entry-lite-n8gsyjq7.js";import{ac as b}from"./vm-hands-entry-lite-9y8v419y.js";import"./vm-hands-entry-lite-abrbc7gf.js";import"./vm-hands-entry-lite-0p3hac9d.js";import"./vm-hands-entry-lite-rnwjp0tk.js";import"./vm-hands-entry-lite-669hk342.js";import"./vm-hands-entry-lite-xbe3dat0.js";import"./vm-hands-entry-lite-henbtxfe.js";import"./vm-hands-entry-lite-18kr0x4w.js";import"./vm-hands-entry-lite-asr8j2d4.js";import"./vm-hands-entry-lite-jz24p4jj.js";import"./vm-hands-entry-lite-tav4dt92.js";import"./vm-hands-entry-lite-sggk0bqc.js";import"./vm-hands-entry-lite-8afzattm.js";import"./vm-hands-entry-lite-djy0ww6h.js";import"./vm-hands-entry-lite-kbz9zfha.js";import"./vm-hands-entry-lite-n5ec0fjy.js";import"./vm-hands-entry-lite-dyqeaqzb.js";import{Wh as a}from"./vm-hands-entry-lite-40t7d4p5.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};

package/bin/vm-hands/local-desktop-users-ktbva6me.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ph as a,Qh as b,Rh as c,Sh as d,Th as e,Uh as f,Vh as g}from"./vm-hands-entry-lite-dyqeaqzb.js";import"./vm-hands-entry-lite-40t7d4p5.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{f as trackDesktopRun,c as releaseLocalDesktop,a as noteLocalDesktopUse,g as holdLocalDesktop,b as forgetLocalDesktopUse,e as DESKTOP_WAIT_MS,d as DESKTOP_IDLE_MS};

package/bin/vm-hands/local-display-mac-kbbrwa0y.js

@@ -1,2 +0,0 @@
-// @bun
-import{nf as a,of as b,pf as c,qf as d,rf as e,sf as f,tf as g}from"./vm-hands-entry-lite-jz24p4jj.js";import"./vm-hands-entry-lite-40t7d4p5.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{c as requestMacScreenAccess,d as parseMacWindowBounds,a as parseMacScreenStatus,e as openMacWindowBounds,g as openMacInput,b as macScreenStatus,f as MacInputTranslator};

package/bin/vm-hands/local-display-session-dmdw0q7k.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ae as f,Be as g,Ce as h,ve as a,we as b,xe as c,ye as d,ze as e}from"./vm-hands-entry-lite-xbe3dat0.js";import"./vm-hands-entry-lite-henbtxfe.js";import"./vm-hands-entry-lite-18kr0x4w.js";import"./vm-hands-entry-lite-asr8j2d4.js";import"./vm-hands-entry-lite-jz24p4jj.js";import"./vm-hands-entry-lite-tav4dt92.js";import"./vm-hands-entry-lite-sggk0bqc.js";import"./vm-hands-entry-lite-8afzattm.js";import"./vm-hands-entry-lite-djy0ww6h.js";import"./vm-hands-entry-lite-kbz9zfha.js";import"./vm-hands-entry-lite-n5ec0fjy.js";import"./vm-hands-entry-lite-dyqeaqzb.js";import"./vm-hands-entry-lite-40t7d4p5.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};

package/bin/vm-hands/local-pty-session-bnhx083p.js

@@ -1,2 +0,0 @@
-// @bun
-import{Af as g,Bf as h,Cf as i,Df as j,uf as a,vf as b,wf as c,xf as d,yf as e,zf as f}from"./vm-hands-entry-lite-tav4dt92.js";import"./vm-hands-entry-lite-sggk0bqc.js";import"./vm-hands-entry-lite-8afzattm.js";import"./vm-hands-entry-lite-kbz9zfha.js";import"./vm-hands-entry-lite-n5ec0fjy.js";import"./vm-hands-entry-lite-40t7d4p5.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{j as runLocalPtySession,e as resolvePtyWorkingDirectory,g as ptyRuntimeSupported,d as parsePtyStartPayload,h as defaultSpawnPty,f as defaultLoginShell,i as defaultConnect,a as LOCAL_PTY_MAX_SESSION_MS,c as LOCAL_PTY_MAX_SESSIONS,b as LOCAL_PTY_MAX_BUFFERED_OUTPUT_BYTES};

package/bin/vm-hands/package-bzy9agdv.js

@@ -1,2 +0,0 @@
-// @bun
-import{A as a}from"./vm-hands-entry-lite-0yghpjef.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export default a();

package/bin/vm-hands/permissions-14dvc1rh.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ne as a,Oe as b,Pe as c,Qe as d,Re as e,Se as f,Te as g,Ue as h,Ve as i,We as j}from"./vm-hands-entry-lite-henbtxfe.js";import"./vm-hands-entry-lite-18kr0x4w.js";import"./vm-hands-entry-lite-asr8j2d4.js";import"./vm-hands-entry-lite-jz24p4jj.js";import"./vm-hands-entry-lite-kbz9zfha.js";import"./vm-hands-entry-lite-n5ec0fjy.js";import"./vm-hands-entry-lite-40t7d4p5.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};

package/bin/vm-hands/version-tsq05aw1.js

@@ -1,2 +0,0 @@
-// @bun
-import{Xe as a,Ye as b,Ze as c,_e as d}from"./vm-hands-entry-lite-18kr0x4w.js";import"./vm-hands-entry-lite-asr8j2d4.js";import"./vm-hands-entry-lite-5a0kyaxa.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};

package/bin/vm-hands/vm-hands-entry-lite-sggk0bqc.js

@@ -1,5 +0,0 @@
-// @bun
-import{ph as c}from"./vm-hands-entry-lite-kbz9zfha.js";var g={REASON_API_KEY:"ARA_API_KEY",REASON_API_URL:"ARA_API_URL",REASON_CLI_CHANNEL:"ARA_CLI_CHANNEL",REASON_CLI_LAUNCHER_PATH:"ARA_CLI_LAUNCHER_PATH",REASON_MANAGED_RUNTIME_ROOT:"ARA_MANAGED_RUNTIME_ROOT",REASON_INSTALL_ALIAS_PATH:"ARA_INSTALL_ALIAS_PATH",REASON_INSTALL_DIR:"ARA_INSTALL_DIR",REASON_INSTALL_METHOD:"ARA_INSTALL_METHOD",REASON_INSTALL_PINNED_VERSION:"ARA_INSTALL_PINNED_VERSION",REASON_INSTALL_UPGRADE:"ARA_INSTALL_UPGRADE"},g0=Object.values(g),jZ=new Set;function MQ(Q,Z){let $=Q[Z];if($?.trim())return $;let X=Q[g[Z]];if(X?.trim())jZ.add(g[Z]);return X}function KZ(Q,Z){return{[Q]:Z,[g[Q]]:Z}}import{basename as BZ}from"path";var i=["production","staging"],OZ="https://api.reasonmachines.com",kZ="https://staging-api.reasonmachines.com";var l={production:{api:"https://api.reasonmachines.ai",app:"https://reasonmachines.ai"},staging:{api:"https://staging-api.reasonmachines.ai",app:"https://staging.reasonmachines.ai"}},AZ=new Set(["ara-staging","reason-staging"]);function KQ(Q={}){let Z=MQ(Q.env??process.env,"REASON_CLI_CHANNEL")?.trim().toLowerCase();if(Z){if(i.includes(Z))return Z;throw Error(`Unknown Reason CLI channel: ${Z}`)}let $=BZ(Q.executablePath??process.execPath).toLowerCase();return AZ.has($)?"staging":"production"}function h(Q){return Q==="staging"?kZ:OZ}function y0(Q){return`${h(Q)}/mcp/ara`}var BQ={production:["https://api.ara.so",l.production.api],staging:["https://api-staging.ara.so",l.staging.api]};function jQ(Q){let Z;try{Z=new URL(Q).origin}catch{return Q}let $=i.find((X)=>BQ[X].includes(Z));return $?h($):Z}function p0(Q,Z){return Q===Z||jQ(Q)===jQ(Z)}function OQ(Q,Z){return i.some(($)=>BQ[$].includes(Q)&&Z===h($))}function u0(Q,Z){try{let $=new URL(Z);return!$.username&&!$.password&&($.origin===h(Q)||$.origin===l[Q].api)}catch{return!1}}function d0(Q){try{let Z=new URL(Q).hostname.replace(/^\[|\]$/g,"").toLowerCase();return Z==="localhost"||Z==="127.0.0.1"||Z==="::1"}catch{return!1}}import{randomBytes as xQ}from"crypto";import{chmodSync as LQ,closeSync as FQ,constants as _Z,linkSync as bQ,lstatSync as x,mkdirSync as fQ,openSync as NZ,readdirSync as P,readFileSync as TQ,readlinkSync as D,renameSync as N,rmdirSync as CQ,symlinkSync as _,unlinkSync as B}from"fs";import{createRequire as xZ}from"module";import{constants as LZ}from"os";import{basename as f,join as U,sep as bZ}from"path";import{existsSync as m,lstatSync as AQ,readdirSync as PZ,readFileSync as FZ,readlinkSync as TZ,realpathSync as DZ}from"fs";import{join as K,sep as RZ}from"path";function o(Q,...Z){let $=K(Q,"ara"),X=K(Q,"reason");if(!v($))return K(X,...Z);if(!m(X))return K($,...Z);return m(K($,...Z))&&!m(K(X,...Z))?K($,...Z):K(X,...Z)}function v(Q){try{let Z=AQ(Q);if(!Z.isSymbolicLink())return Z.isDirectory();return TZ(Q)!=="reason"&&m(Q)}catch{return!1}}function PQ(Q,Z=[]){if(!v(Q))return!1;let $;try{$=[Q,...PZ(Q,{withFileTypes:!0}).filter((X)=>X.isDirectory()).map((X)=>K(Q,X.name))]}catch{return!1}return $.some((X)=>["connect","connect-once"].filter((z)=>!Z.includes(K(X,z))).some((z)=>{let W=K(X,z,"worker.json");try{AQ(W)}catch{return!1}try{let q=JSON.parse(FZ(W,"utf8"))?.stateDirectory;if(typeof q!=="string")return!0;let V=(J,w)=>J===w||J.startsWith(w+RZ);return V(q,Q)||V(kQ(q),kQ(Q))}catch{return!0}}))}function kQ(Q){try{return DZ(Q)}catch{return Q}}var u=new Set(["credentials.json","local-device.json","local-device.revoked.json","local-device.auth-migration.json","local-device.json.registration-pending.json","local-daemon.json","local-daemon.json.workspaces.json","local-root-fingerprint-key.json","instances","workspaces"]),n=new Set(["local-device.proxy.json"]),fZ=new Set(["local-device.key","local-device.binding"]),DQ=new Map;function r(Q,Z,$){let X=U(Q,"ara");if(/[/\\]\.reason-ssh[/\\][^/\\]+[/\\]installer-home[/\\]\.config$/.test(Q))return{state:G(X)?.isDirectory()?"kept":"absent"};return EQ(X,U(Q,"reason"),{linkAlways:!0,kept:(z)=>PQ(z,$??[]),native:Z===void 0?pQ:()=>Z},$!==void 0)}function SQ(Q,...Z){return r(Q),o(Q,...Z)}function z1(Q,Z=process.platform){let $=U(Q,"Library","Logs");if(Z==="darwin")for(let X of[""," Staging"," Development"])EQ(U($,`Ara${X}`),U($,`Reason${X}`),{linkAlways:!1,kept:()=>!1,native:pQ});return U($,"Reason")}var IQ="config_rename_unavailable:busy";function EQ(Q,Z,$,X=!1){let z=X?void 0:DQ.get(Q);if(z)return z;let W;try{W=CZ(Q,Z,$)}catch(q){let V=`config_rename_unavailable:${A(q)??"failed"}`;try{return{state:G(Q)?.isDirectory()?"kept":"absent",problem:V}}catch{return{state:"kept",problem:V}}}if(!(W.state==="absent"&&$.linkAlways)&&W.problem!==IQ&&!(W.state==="kept"&&!W.problem))DQ.set(Q,W);return W}function CZ(Q,Z,$){IZ(Z,$.native);let X=!1;for(let z=0;z<8;z+=1){let W=G(Q);if(W?.isSymbolicLink())return D(Q)===f(Z)?{state:X?"renamed":"linked"}:{state:"kept"};if(!W){if(p(Z))M(()=>B(Z),"ENOENT");if(!(X||$.linkAlways)||!R(Z))return{state:"absent"};let J=b(Z,"link");_(f(Z),J);try{M(()=>N(J,Q),"EISDIR","ENOTEMPTY","EEXIST","ENOTDIR")}finally{M(()=>B(J),"ENOENT")}continue}if(!W.isDirectory())return{state:"absent"};if($.kept(Q))return RQ(Z),{state:"kept"};let q=$.native();if(!q)return RQ(Z),{state:"kept",problem:"config_rename_unavailable:no_native"};let V=EZ(q,Q);if(!V)return{state:"kept",problem:IQ};try{if(x(Q).isSymbolicLink())continue;let J=SZ(q,Q,Z);if(J)return{state:"kept",problem:J};X=!0}finally{V()}}throw Object.assign(Error("legacy directory rename did not settle"),{code:"unsettled"})}function SZ(Q,Z,$){let X=G($);if(!X||p($)){if(!X)_(f($),$);try{Q.exchange(Z,$)}catch(J){if(p($))M(()=>B($),"ENOENT");return`config_rename_unavailable:${A(J)??"exchange_failed"}`}return null}if(!X.isDirectory())return"config_rename_unavailable:ENOTDIR";if(X.dev!==x(Z).dev)return"config_rename_unavailable:EXDEV";let z=[b($,"probe"),b($,"probe")];try{_("a",z[0]),_("b",z[1]),Q.exchange(z[0],z[1])}catch(J){return`config_rename_unavailable:${A(J)??"exchange_failed"}`}finally{for(let J of z)M(()=>B(J),"ENOENT")}let W=yQ($);for(let J of fZ){let w=G(U($,J)),j=G(U(Z,J));if(w&&j&&w.ino!==j.ino)fQ(`${W}-replaced`,{mode:448,recursive:!0}),N(U($,J),U(`${W}-replaced`,J))}let q={linked:new Map,unitsKept:new Set};gQ(Z,$,"",q);let V=b($,"rename");_(f($),V);try{Q.exchange(Z,V)}catch(J){return M(()=>B(V),"ENOENT"),`config_rename_unavailable:${A(J)??"exchange_failed"}`}return hQ(V,$,q,W),null}function t(Q){return Q===""||!Q.includes(bZ)}function gQ(Q,Z,$,X){let z=t($)&&y(U(Z,$),U(Q,$));if(z)X.unitsKept.add($);for(let W of P(U(Q,$))){if(z&&(u.has(W)||n.has(W)))continue;let q=U($,W),V=U(Q,q),J=U(Z,q),w=G(V);if(!w)continue;let j=G(J);if(w.isDirectory()){if(!j)M(()=>fQ(J,{mode:w.mode&4095}),"EEXIST"),LQ(J,w.mode&4095);if(R(J))gQ(Q,Z,q,X)}else if(!j){if(w.isSymbolicLink())M(()=>_(D(V),J),"EEXIST");else if(M(()=>bQ(V,J),"EEXIST","ENOENT"))X.linked.set(q,w.ino)}}}function IZ(Q,Z){let $;try{if(!R(Q))return;$=P(Q)}catch{return}for(let X of $){let z=/^\.(rename|link|probe|claim)-(\d+)-[0-9a-f]+$/.exec(X);if(!z)continue;let W=U(Q,X),q=G(W);if(!q)continue;if(!q.isDirectory()){if(!_Q(Number(z[2])))M(()=>B(W),"ENOENT");continue}let V=Z(),J=null;if(V){try{J=V.lock(W)}catch{continue}if(!J)continue}else if(_Q(Number(z[2])))continue;try{let w=b(Q,"claim");if(M(()=>N(W,w),"ENOENT"))hQ(w,Q,null,yQ(Q))}finally{J?.()}}}function hQ(Q,Z,$,X){for(let[z,W]of $?.linked??[])if(!G(U(Q,z))&&G(U(Z,z))?.ino===W)M(()=>B(U(Z,z)),"ENOENT");if(mQ(Q,Z,"",$),M(()=>CQ(Q),"ENOTEMPTY","EEXIST"))return;N(Q,X),LQ(X,448)}function mQ(Q,Z,$,X){let z=t($)&&(X?X.unitsKept.has($):y(U(Z,$),U(Q,$)));for(let W of P(U(Q,$))){let q=U($,W),V=U(Q,q),J=U(Z,q),w=x(V),j=G(J);if(j&&w.ino===j.ino&&w.dev===j.dev){B(V);continue}if(w.isFile()&&j?.isFile()&&X?.linked.get(q)===j.ino){N(V,J);continue}if(z&&(u.has(W)||n.has(W)))continue;if(!j){if(w.isFile()){if(M(()=>bQ(V,J),"EEXIST"))B(V)}else M(()=>N(V,J),"EEXIST","ENOTEMPTY");continue}if(w.isDirectory()&&j.isDirectory())mQ(Q,Z,q,X),M(()=>CQ(V),"ENOTEMPTY","EEXIST")}}function W1(Q){let Z=U(Q,"ara"),$=U(Q,"reason");if(!R(Z)||!R($))return null;let X=["",...P(Z,{withFileTypes:!0}).filter((z)=>z.isDirectory()&&!z.name.startsWith(".")).map((z)=>z.name)];for(let z of X){let W=U(Z,z),q=U($,z);if(!y(W,q)||!y(q,W))continue;if([...u,...n].some((J)=>a(U(W,J),U(q,J))===!1))return z}return null}function q1(Q){let Z=U(Q,"ara"),$=U(Q,"reason");if(!R(Z)||!R($))return null;let X=(z)=>{for(let W of P(U(Z,z))){let q=U(z,W);if(t(z)&&(W==="connect"||W==="connect-once"))continue;let V=x(U(Z,q)),J=G(U($,q));if(!J||V.ino===J.ino&&V.dev===J.dev)continue;if(V.isDirectory()&&J.isDirectory()&&!J.isSymbolicLink()){let w=X(q);if(w!==null)return w}else if(V.isSymbolicLink()||J.isSymbolicLink()){if(!(V.isSymbolicLink()&&J.isSymbolicLink()&&D(U(Z,q))===D(U($,q))))return q}else if(a(U(Z,q),U($,q))!==!0)return q}return null};return X("")}function a(Q,Z){let $=G(Q),X=G(Z);if(!$&&!X)return null;if(!$||!X||$.isDirectory()!==X.isDirectory())return!1;if($.ino===X.ino&&$.dev===X.dev)return!0;if($.isDirectory())return[...new Set([...P(Q),...P(Z)])].every((W)=>a(U(Q,W),U(Z,W))===!0);try{return TQ(Q).equals(TQ(Z))}catch{return!1}}function y(Q,Z){for(let $ of u)if(vQ(U(Q,$),U(Z,$)))return!0;return!1}function vQ(Q,Z){let $=G(Q);if(!$)return!1;let X=G(Z);if(!X)return!0;if($.isDirectory()){if(!X.isDirectory())return!0;return P(Q).some((z)=>vQ(U(Q,z),U(Z,z)))}if($.isSymbolicLink())return!X.isSymbolicLink()||D(Q)!==D(Z);return $.ino!==X.ino||$.dev!==X.dev}function RQ(Q){if(p(Q))M(()=>B(Q),"ENOENT")}function yQ(Q){return U(Q,`.pre-rename-${new Date().toISOString().replace(/[:.]/g,"-")}-${xQ(3).toString("hex")}`)}function p(Q){try{return x(Q).isSymbolicLink()&&D(Q)===f(Q)}catch{return!1}}function R(Q){let Z=G(Q);return Z!==null&&Z.isDirectory()}function EZ(Q,Z){for(let $=0;$<40;$+=1){let X=Q.lock(Z);if(X)return X;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}return null}function b(Q,Z){return U(Q,`.${Z}-${process.pid}-${xQ(6).toString("hex")}`)}function _Q(Q){if(Q===process.pid)return!1;try{return process.kill(Q,0),!0}catch(Z){return A(Z)==="EPERM"}}function G(Q){try{return x(Q)}catch(Z){if(A(Z)==="ENOENT"||A(Z)==="ENOTDIR")return null;throw Z}}function M(Q,...Z){try{return Q(),!0}catch($){if(Z.includes(A($)??""))return!1;throw $}}function A(Q){return Q instanceof Error&&"code"in Q&&typeof Q.code==="string"?Q.code:void 0}var L,gZ=2,hZ=4,mZ=2,vZ=2,NQ=-100;function pQ(){if(L!==void 0)return L;if(L=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let Q;try{Q=xZ(import.meta.url)("bun:ffi")}catch{return null}let Z=process.platform==="darwin",$=Z?"__error":"__errno_location",X=Z?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`],{FFIType:z}=Q;for(let W of X)try{let q=Z?"renamex_np":"renameat2",J=Q.dlopen(W,{flock:{args:[z.i32,z.i32],returns:z.i32},[$]:{args:[],returns:z.ptr},[q]:Z?{args:[z.ptr,z.ptr,z.u32],returns:z.i32}:{args:[z.i32,z.ptr,z.i32,z.ptr,z.u32],returns:z.i32}}).symbols,w=J[$]();if(w===null)continue;let j=(T)=>{let k=Q.read.i32(w),O=Object.entries(LZ.errno).find(([,E])=>E===k)?.[0]??`errno_${k}`;return Object.assign(Error(`${T} failed: ${O}`),{code:O})},HQ=(T)=>Buffer.from(`${T}\x00`,"utf8");return L={exchange(T,k){let O=HQ(T),E=HQ(k);if((Z?J[q](Q.ptr(O),Q.ptr(E),mZ):J[q](NQ,Q.ptr(O),NQ,Q.ptr(E),vZ))!==0)throw j("exchange")},lock(T){let k=NZ(T,_Z.O_RDONLY);if(J.flock(k,gZ|hZ)===0)return()=>FQ(k);let O=j("lock");if(FQ(k),O.code==="EWOULDBLOCK"||O.code==="EAGAIN")return null;throw O}},L}catch{}return null}import{createHmac as V0,createPublicKey as w0,randomBytes as G0,randomUUID as zZ,verify as H0}from"crypto";import{chmodSync as qQ,existsSync as WZ,mkdirSync as M0,readFileSync as j0,realpathSync as K0,renameSync as B0,statSync as O0,unlinkSync as k0,writeFileSync as A0}from"fs";import{basename as P0,dirname as YQ,isAbsolute as qZ,join as s,resolve as F0}from"path";var Y1=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var yZ="REASON_DESKTOP_RUNTIME",pZ="REASON_DESKTOP_RUNTIME_CHANNEL",uZ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",dZ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",M1={[yZ]:"ARA_DESKTOP_RUNTIME",[pZ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[uZ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[dZ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function uQ(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as QQ,existsSync as F,mkdirSync as ZQ,readFileSync as lQ,realpathSync as lZ,renameSync as iZ,unlinkSync as $Q,writeFileSync as XQ}from"fs";import{createPrivateKey as oZ,createPublicKey as nZ,generateKeyPairSync as rZ,randomUUID as tZ,sign as aZ}from"crypto";import{createRequire as eZ}from"module";import{homedir as Q0,platform as rQ}from"os";import{dirname as Z0,join as C}from"path";import{existsSync as sZ}from"fs";import{join as cQ}from"path";var e="libara_device_keychain.dylib",dQ="libreason_device_keychain.dylib";class cZ extends Error{code;constructor(Q,Z){super(Z);this.code=Q;this.name="ManagedRuntimeError"}}function sQ(Q){let Z=cQ(Q,dQ);return sZ(Z)?Z:cQ(Q,e)}var iQ=1,$0=16384,S=65536,X0=128,z0=128,tQ=65536;class Y extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function aQ(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var zQ=null;function eQ(){if(!zQ)try{zQ=eZ(import.meta.url)("bun:ffi")}catch{throw new Y("native_boundary_unavailable")}return zQ}function W0(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function q0(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new Y("invalid_credential_record");let Z=Q,$=W0(Z.apiOrigin);if(Z.version!==iQ||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new Y("invalid_credential_record");return{version:iQ,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function J0(Q=process.execPath){let Z=Q;try{Z=lZ(Q)}catch{}return sQ(Z0(Z))}function H(Q){return eQ().ptr(Q)}function Y0(Q){if(!F(Q))throw new Y("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=eQ();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(X){if(X instanceof Y)throw X;throw new Y("native_boundary_unavailable")}}function oQ(Q){return Buffer.from(Q).toString("base64url")}function I(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function QZ(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class ZZ{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=J0(),Z=rQ(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;uQ($)}symbols(){if(this.runtimePlatform!=="darwin")throw new Y("unsupported_platform");this.library??=Y0(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(H(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new Y("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(X0),$=new BigUint64Array(1),X=Q==="load"?this.symbols().ara_device_key_load_public(H(Z),BigInt(Z.byteLength),H($)):this.symbols().ara_device_key_create_fresh_public(H(Z),BigInt(Z.byteLength),H($));if(X!==0)throw new Y(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",X);let z=Number($[0]);if(!Number.isSafeInteger(z)||z!==65)throw new Y("invalid_public_key");let W=oQ(Z.subarray(0,z));if(!I(W))throw new Y("invalid_public_key");return W}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>tQ)throw new Y("proof_sign_failed");let Z=new Uint8Array(z0),$=new BigUint64Array(1),X=this.symbols().ara_device_key_sign(H(Q),BigInt(Q.byteLength),H(Z),BigInt(Z.byteLength),H($));if(X!==0)throw new Y("proof_sign_failed",X);let z=Number($[0]);if(!Number.isSafeInteger(z)||z<1||z>Z.byteLength)throw new Y("invalid_signature");let W=Z.subarray(0,z);if(!QZ(W))throw new Y("invalid_signature");return oQ(W)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(H(Q));if(Z!==0||Q[0]!==1)throw new Y("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(H(Q));if(Z!==0)throw new Y("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(S),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(H(Q),BigInt(Q.byteLength),H(Z));if($===1)return null;if($!==0)throw new Y("binding_read_failed",$);let X=Number(Z[0]);if(!Number.isSafeInteger(X)||X<1||X>Q.byteLength)throw new Y("invalid_binding");return Q.slice(0,X)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");let Z=this.symbols().ara_device_binding_create(H(Q),BigInt(Q.byteLength));if(Z!==0)throw new Y("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");let Z=this.symbols().ara_device_binding_update(H(Q),BigInt(Q.byteLength));if(Z!==0)throw new Y("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(H(Q));if(Z!==0)throw new Y("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array($0),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(H(Q),BigInt(Q.byteLength),H(Z));if($===1)return null;if($!==0)throw new Y("legacy_credential_read_failed",$);let X=Number(Z[0]);if(!Number.isSafeInteger(X)||X<1||X>Q.byteLength)throw new Y("invalid_credential_record");try{let z=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,X));return q0(JSON.parse(z))}catch(z){if(z instanceof Y)throw z;throw new Y("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(H(Q));if(Z!==0)throw new Y("legacy_credential_delete_failed",Z);return Q[0]===1}}function nQ(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new Y("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),X=Buffer.from(Z.y,"base64url");if($.byteLength!==32||X.byteLength!==32)throw new Y("invalid_public_key");let z=Buffer.concat([Buffer.of(4),$,X]).toString("base64url");if(!I(z))throw new Y("invalid_public_key");return z}function U0(){let Q=process.env.XDG_CONFIG_HOME?.trim()||C(Q0(),".config");r(Q);let Z=C(Q,"ara");return v(Z)?Z:C(Q,"reason")}class $Z{directory;constructor(Q=U0()){this.directory=Q}keyPath(){return C(this.directory,"local-device.key")}bindingPath(){return C(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!F(Q))throw new Y("proof_key_read_failed");try{let Z=lQ(Q,"utf8");return oZ({key:Z,format:"pem"})}catch{throw new Y("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=nZ(Q);return nQ(Z)}createFreshPublicKey(){ZQ(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=rZ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),X=this.keyPath();return XQ(X,$,{mode:384}),QQ(X,384),nQ(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>tQ)throw new Y("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=aZ("sha256",Q,Z)}catch{throw new Y("proof_sign_failed")}if(!QZ($))throw new Y("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!F(Q))return!1;return $Q(Q),!0}loadBinding(){let Q=this.bindingPath();if(!F(Q))return null;try{return new Uint8Array(lQ(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");ZQ(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(F(Z))throw new Y("binding_create_failed");XQ(Z,Q,{mode:384}),QQ(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>S)throw new Y("invalid_binding");ZQ(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!F(Z))throw new Y("binding_update_failed");let $=`${Z}.${tZ()}`;try{XQ($,Q,{mode:384,flag:"wx"}),QQ($,384),iZ($,Z)}finally{if(F($))$Q($)}}deleteBinding(){let Q=this.bindingPath();if(!F(Q))return!1;return $Q(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function WQ(){return rQ()==="darwin"?new ZZ:new $Z}var UQ=4;var d="macos-keychain-p256-v1",JZ=1,T0=`ARA-DEVICE-BINDING-V1
-`;function D0(Q){return Q===void 0||typeof Q==="number"&&Number.isInteger(Q)&&Q>=1&&Q<=4}function YZ(Q={},Z=c()){let $=KQ({env:{...process.env,...Q}}),X=Q.XDG_CONFIG_HOME?.trim()||s(Z,".config");return SQ(X,...$==="staging"?["staging"]:[])}function VQ(Q={},Z=c()){return s(YZ(Q,Z),"local-device.json")}function UZ(Q={},Z=c()){return s(YZ(Q,Z),"local-daemon.json")}function wQ(Q,Z){M0(YQ(Q),{recursive:!0,mode:448}),qQ(YQ(Q),448);let $=`${Q}.${process.pid}.${zZ()}.tmp`;try{A0($,`${JSON.stringify(Z,null,2)}
-`,{mode:384,flag:"wx"}),qQ($,384),B0($,Q),qQ(Q,384)}finally{if(WZ($))k0($)}return Q}function GQ(Q){if(!WZ(Q))return null;try{return JSON.parse(j0(Q,"utf8"))}catch{return null}}function JQ(Q,Z,$){try{Q.onCredentialLifecycle?.({event:Z,...$?{reasonCode:$}:{}})}catch{}}function R0(Q){if(!Array.isArray(Q))return null;let Z=[];for(let $ of Q){if(!$||typeof $!=="object")return null;let X=$;if(typeof X.id!=="string"||typeof X.label!=="string"||typeof X.path!=="string"||typeof X.pathFingerprint!=="string"||!X.permissions||typeof X.permissions.read!=="boolean"||typeof X.permissions.write!=="boolean"||typeof X.permissions.execute!=="boolean"||typeof X.permissions.discover_environment!=="boolean"||typeof X.permissions.expose_mcp!=="boolean")return null;Z.push({id:X.id,label:X.label,path:X.path,pathFingerprint:X.pathFingerprint,permissions:X.permissions})}return Z}function VZ(Q,Z,$=[]){let X=Object.keys(Q);return Z.every((z)=>Object.hasOwn(Q,z))&&X.every((z)=>Z.includes(z)||$.includes(z))}function _0(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost")return null;return Z.origin}catch{return null}}function wZ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q,$=R0(Z.roots),X=_0(Z.apiOrigin);if(!X||typeof Z.orgId!=="string"||typeof Z.deviceId!=="string"||typeof Z.displayName!=="string"||typeof Z.registeredAt!=="string"||!D0(Z.handsSlots)||Z.worker!==void 0&&(!Z.worker||!/^[a-f0-9]{64}$/.test(Z.worker.configDigest)||!["persistent","ephemeral"].includes(Z.worker.lifetime)||!Number.isFinite(Date.parse(Z.worker.expiresAt)))||!$)return null;return{apiOrigin:X,orgId:Z.orgId,deviceId:Z.deviceId,displayName:Z.displayName,registeredAt:Z.registeredAt,...Z.handsSlots!==void 0?{handsSlots:Z.handsSlots}:{},...Z.worker!==void 0?{worker:Z.worker}:{},roots:$}}function N0(Q){return{...Q,credentialStorage:d}}function x0(Q){return{version:UQ,apiOrigin:Q.apiOrigin,orgId:Q.orgId,deviceId:Q.deviceId,devicePublicKey:Q.devicePublicKey,displayName:Q.displayName,registeredAt:Q.registeredAt,...Q.handsSlots!==void 0?{handsSlots:Q.handsSlots}:{},...Q.worker!==void 0?{worker:Q.worker}:{},roots:Q.roots.map((Z)=>({id:Z.id,label:Z.label,path:Z.path,pathFingerprint:Z.pathFingerprint,permissions:{read:Z.permissions.read,write:Z.permissions.write,execute:Z.permissions.execute,discover_environment:Z.permissions.discover_environment,expose_mcp:Z.permissions.expose_mcp}})),credentialStorage:d}}function GZ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q;if(!VZ(Z,["version","apiOrigin","orgId","deviceId","devicePublicKey","displayName","registeredAt","roots","credentialStorage"],["handsSlots","worker"]))return null;let $=wZ(Z);if(!$||Z.version!==UQ||Z.credentialStorage!==d||!I(Z.devicePublicKey))return null;return{version:UQ,...$,devicePublicKey:Z.devicePublicKey,credentialStorage:d}}function HZ(Q){return new TextEncoder().encode(`${T0}${JSON.stringify(x0(Q))}`)}function L0(Q){let Z=Buffer.from(Q,"base64url");return w0({format:"jwk",key:{kty:"EC",crv:"P-256",x:Z.subarray(1,33).toString("base64url"),y:Z.subarray(33,65).toString("base64url")}})}function b0(Q,Z){let $={version:JZ,state:Q,signature:Z.sign(HZ(Q))};return new TextEncoder().encode(JSON.stringify($))}function MZ(Q){let Z;try{Z=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(Q))}catch{throw new Y("invalid_binding")}if(!Z||typeof Z!=="object"||Array.isArray(Z))throw new Y("invalid_binding");let $=Z;if(!VZ($,["version","state","signature"])||$.version!==JZ||typeof $.signature!=="string"||!/^[A-Za-z0-9_-]{10,128}$/.test($.signature))throw new Y("invalid_binding");let X=GZ($.state);if(!X)throw new Y("invalid_binding");let z=!1;try{z=H0("sha256",HZ(X),L0(X.devicePublicKey),Buffer.from($.signature,"base64url"))}catch{z=!1}if(!z)throw new Y("invalid_binding");return X}function f0(Q){let{credentialStorage:Z,...$}=Q;return $}function C0(Q){return Q instanceof Y?aQ(Q):"credential_boundary_failed"}function v1(Q=VQ(),Z={}){let $=GQ(Q),X=Z.proofStore??Z.credentialStore??WQ(),z=X.loadBinding();if(!z){if($&&typeof $==="object"&&!Array.isArray($)&&S0($))return null;if($!==null)throw new Y("invalid_binding");return null}let W=MZ(z),q=X.loadPublicKey();if(X.privateKeyIsNonExtractable(),q!==W.devicePublicKey)throw new Y("invalid_public_key");let V=GZ($);if(Z.repair!==!1&&(!V||JSON.stringify(V)!==JSON.stringify(W)))wQ(Q,W);return f0(W)}function S0(Q){let Z=Q,$=wZ(Q);if(!$)return null;if(Z.version===2){if(typeof Z.deviceCredential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.deviceCredential)||Z.deviceCredential.length>4096)return null;return{state:$,credentialSource:"plaintext-v2"}}if(Z.version!==3||Z.credentialStorage!=="macos-keychain-v1"||"deviceCredential"in Z)return null;return{state:$,credentialSource:"keychain-v3"}}function y1(Q,Z=VQ(),$={}){let X=$.proofStore??$.credentialStore??WQ();JQ($,"credential.store_started");try{if(!I(Q.devicePublicKey)||X.loadPublicKey()!==Q.devicePublicKey)throw new Y("invalid_public_key");X.privateKeyIsNonExtractable();let z=N0(Q),W=X.loadBinding();if(W){let V=MZ(W);if(V.devicePublicKey!==Q.devicePublicKey||V.orgId!==Q.orgId||V.deviceId!==Q.deviceId||V.apiOrigin!==Q.apiOrigin&&!OQ(V.apiOrigin,Q.apiOrigin))throw new Y("invalid_binding")}let q=b0(z,X);if(W)X.updateBinding(q);else X.createBinding(q);return wQ(Z,z),JQ($,"credential.store_completed"),Z}catch(z){throw JQ($,"credential.store_failed",C0(z)),z}}function p1(Q=UZ()){let Z=GQ(Q);if(!Z||typeof Z!=="object")return null;let $=Z;if($.version!==1||typeof $.pid!=="number"||!Number.isInteger($.pid)||!["starting","connected","stopped","error"].includes($.state??"")||typeof $.startedAt!=="string"||$.lastHeartbeatAt!==void 0&&typeof $.lastHeartbeatAt!=="string"||$.lastUsedAt!==void 0&&typeof $.lastUsedAt!=="string"||$.organizationId!==void 0&&typeof $.organizationId!=="string"||$.organizationName!==void 0&&typeof $.organizationName!=="string"||$.organizationSlug!==void 0&&typeof $.organizationSlug!=="string"||$.error!==void 0&&typeof $.error!=="string"||$.reconnectingSince!==void 0&&typeof $.reconnectingSince!=="string"||$.workspace!==void 0&&typeof $.workspace!=="string")return null;return $}function u1(Q,Z=UZ()){return wQ(Z,Q)}var XZ=1;function I0(Q=VQ()){return s(YQ(Q),"local-device.proxy.json")}function d1(Q=I0()){let Z=GQ(Q);if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let $=Z;if($.version!==XZ||typeof $.url!=="string"||$.url.length===0||$.caFile!==void 0&&(typeof $.caFile!=="string"||!qZ($.caFile)))return null;return{version:XZ,url:$.url,...$.caFile?{caFile:$.caFile}:{}}}function c1(Q,Z={read:!0,write:!1,execute:!1,discover_environment:!1,expose_mcp:!1},$=G0(32)){let X=new Set,z=[];for(let W of Q){let q=K0(qZ(W)?W:F0(W));if(!O0(q).isDirectory())throw Error(`Local execution root is not a directory: ${W}`);if(X.has(q))continue;X.add(q),z.push({id:zZ(),label:P0(q)||q,path:q,pathFingerprint:V0("sha256",$).update(q).digest("hex"),permissions:{...Z}})}if(z.length===0)throw Error("At least one explicit local execution root is required.");return z}
-export{MQ as Ef,KZ as Ff,i as Gf,KQ as Hf,h as If,y0 as Jf,jQ as Kf,p0 as Lf,OQ as Mf,u0 as Nf,d0 as Of,r as Pf,SQ as Qf,z1 as Rf,W1 as Sf,q1 as Tf,pQ as Uf,cZ as Vf,Y as Wf,J0 as Xf,I as Yf,QZ as Zf,ZZ as _f,$Z as $f,VQ as ag,UZ as bg,v1 as cg,y1 as dg,p1 as eg,u1 as fg,XZ as gg,d1 as hg,c1 as ig};