@reason-machines/cli-linux-arm64-musl 0.2.337 → 0.2.339

package/bin/vm-hands/{vm-hands-entry-lite-8ga7m5ph.js → vm-hands-entry-lite-d5n40yn3.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ed as _J,ge as CJ,wd as UJ}from"./vm-hands-entry-lite-jgjvs1tq.js";import{createHash as y,randomBytes as zJ}from"crypto";import{closeSync as LJ,fsyncSync as qJ,mkdirSync as RJ,openSync as NJ,renameSync as fJ,rmSync as mJ,statSync as DJ,writeSync as AJ,constants as V}from"fs";import{join as o}from"path";var bJ=1;var d=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function KJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function jJ(J,Z){let{payload:z,authority:K}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!K||typeof K!=="object"||Array.isArray(K)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||K.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function xJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&d.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:KJ(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var H=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),I=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function R(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(R).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${R(J[Z])}`).join(",")}}`}async function QZ(J){let Z=await crypto.subtle.importKey("pkcs8",I(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=I(J.device_key.spki),K=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),U=new Uint8Array(await crypto.subtle.exportKey("spki",K.publicKey)),L=y("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:K,signingSpki:z,agreementSpki:U,fingerprint:L}}var cJ=4;class pJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;verifiedSinceRun=!1;unverified=new Set;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,K){this.init=J;this.keys=Z;this.hooks=z;this.options=K;if(!d.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let K=Date.now()+Z;;){let U=this.bound.get(J);if(!U)return!1;if(U.envInstalled)return!0;if(Date.now()>=K||z?.aborted)return!1;await new Promise((L)=>setTimeout(L,25))}}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:bJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:H(this.keys.signingSpki),env_public_key:H(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:H(zJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(R(Z)));return{...Z,device_signature:H(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),K=H(zJ(32)),U=CJ({method:"GET",pathAndQuery:UJ,timestamp:z,nonce:K,challenge:J,bodySha256:y("sha256").update("").digest("hex")}),L=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(U)));return{t:"hello",timestamp:z,nonce:K,signature:H(lJ(L)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new W("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!d.test(z))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(y("sha256").update(R({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new W("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=cJ)throw new W("vm_hands_busy","every bind slot is held");return this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,K=!1;try{if(Z.length===0){if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload(),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.verifiedSinceRun=!1,this.servedRun=!0,K=!0;let{launchId:U,applied:L,readyData:P}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),E=this.hooks.restatLayout(),A=null;if(J.env){let O=J.claim?.owner??{},g=jJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof O.device_id==="string"?O.device_id:"",rootId:J.claim?.root_id??""});A=this.hooks.installEnvironment(J.bind_id,g),z=this.writeJobEnvRootOnly(J.bind_id,g)}if(this.unbinding.has(J.bind_id))throw new W("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:A!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:A,layout:E,...P?{ready_data:P}:{},policy_digest:y("sha256").update(R({hands_confinement:L.hands_confinement??null,browser_egress:L.browser_egress??null})).digest("hex")}}catch(U){if(z)GJ(z);if(K){let P=[...this.bound.keys()];await this.hooks.killAndVerifyPayload(P.length?{bindId:J.bind_id,keep:P}:void 0).then(()=>{if(!P.length)this.verifiedSinceRun=!0,this.unverified.clear()},()=>{this.unverified.add(J.bind_id),this.verifiedSinceRun=!1})}this.binding.delete(J.bind_id);let L=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof W?U:new W(L,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new W("vm_hands_not_bound","environment delivered while not bound");if(!d.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let K=jJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),U=this.hooks.installEnvironment(Z.bindId,K);if(Z.envInstalled=!0,Z.envDirectory)GJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${U}`,K),{snapshot_id:J.snapshotId,installed_revision:U,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new W("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killProbe()}catch{this.servedRun=!0,this.verifiedSinceRun=!1}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:y("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((K)=>K!==J);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:void 0)}catch(K){throw this.unverified.add(J),this.verifiedSinceRun=!1,K}if(!z.length)this.verifiedSinceRun=!0,this.unverified.clear();if(Z?.envDirectory)GJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},K=await crypto.subtle.importKey("spki",I(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),U=await crypto.subtle.deriveKey({name:"ECDH",public:K},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),L=await crypto.subtle.decrypt({name:"AES-GCM",iv:I(J.iv),additionalData:new TextEncoder().encode(Z)},U,I(J.ct)).catch(z),P=JSON.parse(new TextDecoder().decode(L));if(!P||typeof P!=="object"||Array.isArray(P))throw new W("vm_hands_env_invalid","env not an object");return P}writeJobEnvRootOnly(J,Z){let z=o(this.options.envRoot,`bind-${J}`);RJ(z,{mode:448});let K=DJ(z);if(!K.isDirectory()||(K.mode&63)!==0||K.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let U=Z.variables&&typeof Z.variables==="object"?Z.variables:{},L=Object.entries(U).filter(([A,O])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(A)&&typeof O==="string").map(([A,O])=>`export ${A}='${String(O).replaceAll("'","'\\''")}'`).join(`
+import{Gd as _J,ie as CJ,yd as UJ}from"./vm-hands-entry-lite-723q0mmr.js";import{createHash as y,randomBytes as zJ}from"crypto";import{closeSync as LJ,fsyncSync as qJ,mkdirSync as RJ,openSync as NJ,renameSync as fJ,rmSync as mJ,statSync as DJ,writeSync as AJ,constants as V}from"fs";import{join as o}from"path";var bJ=1;var d=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function KJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function jJ(J,Z){let{payload:z,authority:K}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!K||typeof K!=="object"||Array.isArray(K)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||K.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function xJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&d.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:KJ(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var H=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),I=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function R(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(R).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${R(J[Z])}`).join(",")}}`}async function QZ(J){let Z=await crypto.subtle.importKey("pkcs8",I(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=I(J.device_key.spki),K=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),U=new Uint8Array(await crypto.subtle.exportKey("spki",K.publicKey)),L=y("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:K,signingSpki:z,agreementSpki:U,fingerprint:L}}var cJ=4;class pJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;verifiedSinceRun=!1;unverified=new Set;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,K){this.init=J;this.keys=Z;this.hooks=z;this.options=K;if(!d.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let K=Date.now()+Z;;){let U=this.bound.get(J);if(!U)return!1;if(U.envInstalled)return!0;if(Date.now()>=K||z?.aborted)return!1;await new Promise((L)=>setTimeout(L,25))}}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:bJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:H(this.keys.signingSpki),env_public_key:H(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:H(zJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(R(Z)));return{...Z,device_signature:H(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),K=H(zJ(32)),U=CJ({method:"GET",pathAndQuery:UJ,timestamp:z,nonce:K,challenge:J,bodySha256:y("sha256").update("").digest("hex")}),L=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(U)));return{t:"hello",timestamp:z,nonce:K,signature:H(lJ(L)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new W("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!d.test(z))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(y("sha256").update(R({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new W("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=cJ)throw new W("vm_hands_busy","every bind slot is held");return this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,K=!1;try{if(Z.length===0){if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload(),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.verifiedSinceRun=!1,this.servedRun=!0,K=!0;let{launchId:U,applied:L,readyData:P}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),E=this.hooks.restatLayout(),A=null;if(J.env){let O=J.claim?.owner??{},g=jJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof O.device_id==="string"?O.device_id:"",rootId:J.claim?.root_id??""});A=this.hooks.installEnvironment(J.bind_id,g),z=this.writeJobEnvRootOnly(J.bind_id,g)}if(this.unbinding.has(J.bind_id))throw new W("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:A!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:A,layout:E,...P?{ready_data:P}:{},policy_digest:y("sha256").update(R({hands_confinement:L.hands_confinement??null,browser_egress:L.browser_egress??null})).digest("hex")}}catch(U){if(z)GJ(z);if(K){let P=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:P,own:!0}).catch(()=>{this.unverified.add(J.bind_id)}),this.verifiedSinceRun=!1}this.binding.delete(J.bind_id);let L=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof W?U:new W(L,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new W("vm_hands_not_bound","environment delivered while not bound");if(!d.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let K=jJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),U=this.hooks.installEnvironment(Z.bindId,K);if(Z.envInstalled=!0,Z.envDirectory)GJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${U}`,K),{snapshot_id:J.snapshotId,installed_revision:U,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new W("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killProbe()}catch{this.servedRun=!0,this.verifiedSinceRun=!1}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:y("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((K)=>K!==J);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:void 0)}catch(K){throw this.unverified.add(J),this.verifiedSinceRun=!1,K}if(!z.length)this.verifiedSinceRun=!0,this.unverified.clear();if(Z?.envDirectory)GJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},K=await crypto.subtle.importKey("spki",I(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),U=await crypto.subtle.deriveKey({name:"ECDH",public:K},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),L=await crypto.subtle.decrypt({name:"AES-GCM",iv:I(J.iv),additionalData:new TextEncoder().encode(Z)},U,I(J.ct)).catch(z),P=JSON.parse(new TextDecoder().decode(L));if(!P||typeof P!=="object"||Array.isArray(P))throw new W("vm_hands_env_invalid","env not an object");return P}writeJobEnvRootOnly(J,Z){let z=o(this.options.envRoot,`bind-${J}`);RJ(z,{mode:448});let K=DJ(z);if(!K.isDirectory()||(K.mode&63)!==0||K.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let U=Z.variables&&typeof Z.variables==="object"?Z.variables:{},L=Object.entries(U).filter(([A,O])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(A)&&typeof O==="string").map(([A,O])=>`export ${A}='${String(O).replaceAll("'","'\\''")}'`).join(`
 `)+`
 `,P=o(z,`.job.env.${zJ(8).toString("hex")}`),E=NJ(P,V.O_WRONLY|V.O_CREAT|V.O_EXCL|V.O_NOFOLLOW,384);try{AJ(E,L),qJ(E)}finally{LJ(E)}return fJ(P,o(z,"job.env")),z}}function GJ(J){try{let Z=o(J,"job.env"),z=DJ(Z).size,K=NJ(Z,V.O_WRONLY|V.O_NOFOLLOW);try{AJ(K,Buffer.alloc(z)),qJ(K)}finally{LJ(K)}}catch{}mJ(J,{recursive:!0,force:!0})}function lJ(J){if(J.length!==64)throw new W("vm_hands_signature_invalid","unexpected ECDSA signature length");let Z=(U)=>{let L=0;while(L<U.length-1&&U[L]===0)L++;let P=U.subarray(L),E=P[0]&128?Uint8Array.of(0,...P):P;return Uint8Array.of(2,E.length,...E)},z=Z(J.subarray(0,32)),K=Z(J.subarray(32));return Uint8Array.of(48,z.length+K.length,...z,...K)}import{randomUUID as uJ}from"crypto";var oJ="/app/local-runtime/session?register=vm_hands_v1",dJ="/app/local-runtime",MJ=25000,rJ=20000,iJ=1e4,TJ=5000,sJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),YJ=75000,aJ=2000,nJ=1e4,r=20000;function EJ(J,Z){return typeof J==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(J)?J:Z}class T extends Error{}var tJ=64;async function hJ(J,Z){let z=[...J.modelOps.get(Z)??[]];for(let K of z)K.abort.abort();await Promise.race([Promise.all(z.map((K)=>K.settled)),new Promise((K)=>setTimeout(K,TJ))])}async function eJ(J){let Z=[...J.personTerminals];for(let z of Z)z.abort.abort();if(Z.length)await Promise.race([Promise.all(Z.map((z)=>z.settled)),new Promise((z)=>setTimeout(z,TJ))]);return Z.length}async function f(J,Z,z){return await hJ(J,z),Z.unbind(z)}function i(J){for(let Z of J.outbox?.splice(0)??[])Z.reject(Error("vm_hands_attempt_ended"))}var OJ=15000,JZ=1e4,ZZ=1000;async function jZ(J){let Z=Date.now(),z={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:0},K=J.log??(()=>{}),U=async(L)=>{for(let[P,E]of[...z.turns]){z.turns.delete(P),J.onTurn?.(P,null),i(E);let A=await f(z,J.agent,P).catch(()=>null);if(A)z.receipts.push({turn:E,failure:"vm_hands_bind_lost",unbound:A});K("vm_hands.bound_dropped",{reason:L})}};try{for(let L=0;!J.signal.aborted;L++){let P=await $Z(J,z).catch((A)=>{if(A instanceof W&&z.deviceId===null&&A.code==="vm_hands_no_session"&&Date.now()-Z<nJ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(A instanceof W&&z.deviceId===null)throw A;return{closeCode:0,closeReason:A instanceof Error?A.message:String(A)}});if(K("vm_hands.session_closed",{close_code:P.closeCode,reason:P.closeReason.slice(0,120),registered:z.deviceId!==null}),P.closeCode===4401||z.attest==="refused")return;if(J.signal.aborted)return;if(z.turns.size&&Date.now()-z.lostAt>=YJ)await U("reconnect_deadline");if(z.served)z.served=!1,L=0;let E=P.closeReason==="drain_reconnect"?0:P.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(L,5),2000):z.turns.size?Math.min(250*2**Math.min(L,5),5000,Math.max(0,z.lostAt+YJ-Date.now())):Math.min(500*2**L,30000);if(await new Promise((A)=>setTimeout(A,E)),z.turns.size&&Date.now()-z.lostAt>=YJ)await U("reconnect_deadline")}}finally{await U("session_ended")}}async function $Z(J,Z){let z=Z.deviceId,K=J.log??(()=>{}),U=z?`/app/local-runtime/session?device_id=${encodeURIComponent(z)}`:oJ,L=`${J.apiOrigin.replace(/^http/,"ws")}${U}`,P=new WebSocket(L),E=0,A="",O=new Map,g=[],m=null,wJ=new Promise(($)=>{P.onclose=(Q)=>{E=Q.code,A=Q.reason;for(let G of O.values())G.reject(new T(`session closed ${Q.code}`));for(let G of Z.attestWaiters.splice(0))G(!1);O.clear(),$()}});P.onmessage=($)=>{let Q;try{Q=JSON.parse(String($.data))}catch{P.close(4400);return}if(Q.t==="res"){let G=Q;O.get(G.id)?.resolve({status:G.status,body:G.body}),O.delete(G.id);return}if(Q.t==="reconnect"){let G=Math.max(0,Math.min(Number(Q.after_ms)||0,ZZ));K("vm_hands.drain_reconnect",{after_ms:G}),setTimeout(()=>{try{P.close(4001,"drain_reconnect")}catch{}},G).unref?.();return}if(!m?.(Q))g.push(Q)};let b=($,Q)=>new Promise((G,X)=>{let j=g.findIndex((C)=>$.includes(C.t));if(j>=0){G(g.splice(j,1)[0]);return}let q=setTimeout(()=>{m=null,X(new W("vm_hands_no_register",`no ${$.join("/")} in ${Q} ms`))},Q);m=(C)=>{if(!$.includes(C.t))return!1;return clearTimeout(q),m=null,G(C),!0}}),c=($)=>P.send(JSON.stringify($)),h=($,Q)=>new Promise((G,X)=>{if(P.readyState!==WebSocket.OPEN){X(new T("session closed"));return}let j=uJ(),q=typeof Q.wait_ms==="number"?Q.wait_ms:0,C=setTimeout(()=>{if(!O.delete(j))return;X(new T(`no answer to ${$.split("/").pop()} in ${q+OJ} ms`)),P.close(4000,"request_timeout")},q+OJ);O.set(j,{reject:(Y)=>{clearTimeout(C),X(Y)},resolve:({status:Y,body:F})=>{clearTimeout(C);let B=null;try{B=F?JSON.parse(F):null}catch{}G({status:Y,json:B})}}),c({t:"req",id:j,path:`${dJ}${$}`,body:JSON.stringify(Q)})}),QJ=()=>P.close(1001,"stopping");J.signal.addEventListener("abort",QJ,{once:!0});let s,p=new Map,l=new Map,a=!1,n=new Set,t=new Set,e=Promise.resolve(),u=!1;try{await new Promise((Y,F)=>{let B=setTimeout(()=>F(Error("session open timeout")),JZ);P.onopen=()=>{clearTimeout(B),K("vm_hands.ws_open",{}),Y()},P.onerror=()=>{clearTimeout(B),F(Error("session socket error"))}});let $=await b(["challenge"],5000);K("vm_hands.challenge",{});let Q=[],G=null,X;if(z){c(await J.agent.helloFrame($.challenge,Z.connection));let Y=await b(["ready"],1e4);if(typeof Y.vm_hands_connection==="string")Z.connection=Y.vm_hands_connection;if(X={device_id:z,...Y.cadence?{cadence:Y.cadence}:{}},typeof Y.vm_hands_probe_script==="string"){if(G=Y.vm_hands_probe_script,u=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,K("vm_hands.reconnected",{device_id:z});let F=Array.isArray(Y.vm_hands_binds)?Y.vm_hands_binds:Y.vm_hands_bind?[Y.vm_hands_bind]:[];for(let[B,x]of[...Z.turns]){if(F.some((N)=>N&&N.operation_id===x.claim.operation_id&&N.attempt_id===x.claim.attempt_id)){Q.push(x),K("vm_hands.bound_resumed",{operation_id:x.claim.operation_id});continue}Z.turns.delete(B),J.onTurn?.(B,null),i(x);let D=await f(Z,J.agent,B).catch(()=>null);if(D)Z.receipts.push({turn:x,failure:"vm_hands_bind_lost",unbound:D});K("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{c(await J.agent.registerFrame($.challenge)),K("vm_hands.register_sent",{});let Y=await b(["registered","register_refused"],1e4);if(Y.t==="register_refused")throw new W(Y.code,"register refused");J.agent.registered();let F=Y;if(X=F,Z.deviceId=F.device_id,typeof F.vm_hands_connection==="string")Z.connection=F.vm_hands_connection;if(typeof F.vm_hands_probe_script==="string"){if(G=F.vm_hands_probe_script,u=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,K("vm_hands.registered",{device_id:X.device_id})}let j=async()=>{let Y=await h("/heartbeat",await J.heartbeat());if(Y.status>=300)throw Error(`heartbeat ${Y.status}`)};await j();let q=X.cadence?.presence_interval_ms??30000;if(s=setInterval(()=>{j().catch(()=>P.close())},q),G&&Z.attest!=="accepted"&&J.agent.phase==="registered"&&!Z.turns.size)gJ(G,$.challenge);let C=(Y,F)=>{l.set(Y,F().catch(async(B)=>{if(await XJ(B,Y),B instanceof T)P.close();else await JJ().catch(()=>{return})}).finally(()=>{l.delete(Y)}))};try{await JJ();for(let Y of Q)Y.flush=()=>FJ(Y),Y.flush(),C(Y.claim.attempt_id,()=>WJ(Y));while(!J.signal.aborted&&P.readyState===WebSocket.OPEN){let Y=await h("/operations/claim",{wait_ms:Math.min(X.cadence?.claim_wait_ms??MJ,MJ)});if(Y.status===204||!Y.json)continue;if(Y.status>=300)throw Error(`claim ${Y.status}`);let F=Y.json;if(F.capability==="hands.connect"){if(l.has(F.attempt_id)){_({claim:F,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}C(F.attempt_id,()=>SJ(F))}else HJ(F).catch(()=>{return})}}catch(Y){await XJ(Y,null)}}finally{if(s)clearInterval(s);J.signal.removeEventListener("abort",QJ);for(let $ of Z.turns.values())$.flush=null;P.close(),await wJ,await Promise.all([...l.values()]);for(let $ of J.agent.liveBindIds){if(Z.turns.has($))continue;let Q=await f(Z,J.agent,$).catch(()=>null),G=p.get($);if(Q&&G)Z.receipts.push({turn:{...G,eventSeq:G.eventSeq+1},failure:"vm_hands_bind_lost",unbound:Q});K("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let $ of n)$.abort()}return{closeCode:E,closeReason:A};async function XJ($,Q){if($ instanceof T){if(!a&&Z.turns.size)Z.lostAt=Date.now();a=!0}else{let G=Q!==null?[Q]:[...new Set([...Z.turns.keys(),...J.agent.liveBindIds])];if(Q===null)a=!0;for(let X of G){let j=Z.turns.get(X);if(Z.turns.delete(X),j)i(j),J.onTurn?.(X,null);if(J.agent.liveBindIds.includes(X)){let q=await f(Z,J.agent,X).catch(()=>null),C=p.get(X)??j;if(q&&C)Z.receipts.push({turn:{...C,eventSeq:C.eventSeq+1},failure:"vm_hands_bind_lost",unbound:q})}}}K("vm_hands.session_lost",{error:$ instanceof Error?$.message:String($),bound_kept:Z.turns.size})}function _($){let Q=$.claim,G={attempt_id:Q.attempt_id,attempt_token:Q.attempt_token},X=encodeURIComponent(Q.operation_id);return{fence:G,op:X,complete:(q,C={})=>h(`/operations/${X}/complete`,{...G,status:q,...C}),emit:(q,C)=>{let Y=($.chain??Promise.resolve()).catch(()=>{return}).then(()=>j(q,C));return $.chain=Y,Y}};async function j(q,C){let Y=$.eventSeq,F=(N)=>h(`/operations/${X}/events`,{...G,event_seq_start:N,events:[{kind:q,payload:{sequence:N,capability:String(Q.capability??"hands.connect"),data:C}}]}),B=Y,x=await F(B),D=x.status===409?x.json?.expected_event_seq:void 0;if(typeof D==="number"&&D===Y+1)x={status:200,json:{duplicate:!0}};else if(typeof D==="number"&&D>=0&&D!==Y)B=D,x=await F(B);if(x.status<300)$.eventSeq=B+1;return x}}function kJ($){return(Q,G)=>new Promise((X,j)=>{if(Z.turns.get($.claim.attempt_id)!==$){j(Error("vm_hands_attempt_ended"));return}if($.outbox??=[],$.outbox.length>=tJ){j(Error("vm_hands_outbox_full"));return}$.outbox.push({kind:Q,data:G,resolve:X,reject:j}),$.flush?.()})}function FJ($){if(t.has($))return;t.add($),(async()=>{try{while($.outbox?.length&&Z.turns.get($.claim.attempt_id)===$&&P.readyState===WebSocket.OPEN){let Q=$.outbox[0],G;try{G=await _($).emit(Q.kind,Q.data)}catch(X){if(X instanceof T)return;G={status:500}}if($.outbox.shift(),G.status<300)Q.resolve();else Q.reject(Error(`${Q.kind} refused ${G.status}`))}}finally{t.delete($)}})()}async function gJ($,Q){try{let G=await J.agent.attestFrame($,Q);if(P.readyState!==WebSocket.OPEN)return;c(G);let X=await b(["attested","attest_refused"],15000);Z.attest=X.t==="attested"?"accepted":"refused";for(let j of Z.attestWaiters.splice(0))j(Z.attest==="accepted");if(K("vm_hands.attest",{result:Z.attest,exit_code:G.exit_code,...X.t==="attest_refused"?{code:String(X.code??"")}:{}}),Z.attest==="refused")P.close(4401,"attest_refused")}catch(G){K("vm_hands.attest_failed",{code:G instanceof W?G.code:"probe_error"});for(let X of Z.attestWaiters.splice(0))X(!1);if(Z.attest!=="accepted")P.close(4000,"attest_unanswered")}}async function SJ($){let Q=u&&Z.attest==="pending",G=$.vm_hands_attest,X=G;if(Z.attest==="refused"){K("vm_hands.claim_attest_refused",{said:typeof G==="string"?G.slice(0,16):typeof G,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(X==="accepted"){if(!Q&&Z.attest!=="accepted"){Z.attest="accepted";for(let N of Z.attestWaiters.splice(0))N(!0)}}else if(X!=="pending"||!Q&&Z.attest!=="accepted"){K("vm_hands.claim_attest_refused",{said:typeof G==="string"?G.slice(0,16):typeof G,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Z.attest!=="accepted"){let N=Date.parse($.lease_until)-Date.now()-5000,ZJ=Math.max(0,Math.min(r,Number.isFinite(N)?N:r));if(!await new Promise((S)=>{let $J=setTimeout(()=>S(!1),ZJ);Z.attestWaiters.push((M)=>{clearTimeout($J),S(M)})})){await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let j={claim:$,eventSeq:0},{complete:q,emit:C}=_(j),Y;try{if($.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not hands.connect");Y=!KJ($)}catch(N){K("vm_hands.bind_refused",{code:N instanceof W?N.code:"unexpected"}),await q("failed",{error_code:N instanceof W?N.code:"vm_hands_bind_invalid"});return}let F;Z.bindsStarting++;try{let N=await eJ(Z);if(N)K("vm_hands.person_terminals_closed",{count:N});F=await J.agent.bind(xJ($))}catch(N){K("vm_hands.bind_refused",{code:N instanceof W?N.code:"unexpected"}),await q("failed",{error_code:N instanceof W?N.code:"vm_hands_bind_failed"});return}finally{Z.bindsStarting--}let B={...F.ready_data??J.readyData({launchId:F.launch_id,claim:$})};if(Y)delete B.environment_installed;p.set($.attempt_id,{claim:$,launchId:F.launch_id,readyData:B,eventSeq:j.eventSeq,ackSeq:-1});let x=await C("hands.ready",{...B,vm_hands:{layout:F.layout,policy_digest:F.policy_digest,launch_id:F.launch_id}});if(p.delete($.attempt_id),x.status>=300){await hJ(Z,$.attempt_id),await J.agent.boundRefused($.attempt_id),await q("failed",{error_code:EJ(x.json?.error,"vm_hands_probe_failed")});return}let D={claim:$,launchId:F.launch_id,readyData:B,eventSeq:j.eventSeq,ackSeq:-1};Z.turns.set($.attempt_id,D),D.flush=()=>FJ(D),J.onTurn?.($.attempt_id,kJ(D)),await WJ(D)}async function WJ($){let{fence:Q,op:G}=_($),X=null,j=null,q=J.agent.executorExited($.claim.attempt_id).then((C)=>{return j=C,null});J:for(;;){let C=await Promise.race([q,h(`/operations/${G}/heartbeat`,{...Q,control_ack_seq:$.ackSeq,wait_ms:rJ})]);if(!C){X="vm_hands_executor_exited",K("vm_hands.executor_exited",{reason:j});break}if(C.status>=300)break;let Y=(C.json?.controls??[]).slice().sort((F,B)=>F.seq-B.seq);for(let F of Y){if(F.seq<=$.ackSeq)continue;if(F.kind==="operation.cancel"||F.kind==="cancel"){$.ackSeq=F.seq;break J}if(F.kind===_J)try{await vJ($,F.payload??{})}catch(B){if(B instanceof T)throw B;X=B instanceof W?B.code:"environment_unavailable";let x=B&&typeof B==="object"&&"code"in B&&typeof B.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(B.code)?B.code:null;K("vm_hands.environment_refused",{code:X,cause:x});break J}$.ackSeq=F.seq}}await VJ($,X)}async function HJ($){let Q=$,G={claim:Q,eventSeq:0},{complete:X,emit:j,fence:q,op:C}={..._(G)},Y=$.vm_hands_origin==="person"?"person":"model",F=String($.capability??"");if(!J.executeOp){await X("failed",{error_code:"vm_hands_op_unsupported"});return}if($.vm_hands_attest==="accepted"&&Z.attest==="pending"&&!(u&&Z.attest==="pending")){Z.attest="accepted";for(let M of Z.attestWaiters.splice(0))M(!0)}if(Z.attest!=="accepted"){let M=Date.parse(String($.lease_until??""))-Date.now()-5000,w=Z.attest==="refused"?0:Math.max(0,Math.min(r,Number.isFinite(M)?M:r));if(!(w>0&&await new Promise((BJ)=>{let yJ=setTimeout(()=>BJ(!1),w);Z.attestWaiters.push((IJ)=>{clearTimeout(yJ),BJ(IJ)})}))){await X("failed",{error_code:"vm_hands_unattested"});return}}let B=J.agent.bindIdForRun(Q.run_id);if(Y==="model"&&B===null){await X("failed",{error_code:"vm_hands_not_bound"});return}let x=F==="pty.start"&&Y==="person"&&!$.authority;if(x&&(J.agent.liveBindIds.length>0||Z.bindsStarting>0)){await X("failed",{error_code:"vm_hands_bound"});return}if(sJ.has(F)&&!x&&J.agent.liveBindIds.length===0){await X("failed",{error_code:"vm_hands_not_bound"});return}let D=new AbortController;n.add(D);let N,ZJ=new Promise((M)=>{N=M}),v={abort:D,settled:ZJ};if(x)Z.personTerminals.add(v);if(Y==="model"&&B){let M=Z.modelOps.get(B)??new Set;M.add(v),Z.modelOps.set(B,M),await J.agent.environmentInstalled(B,aJ,D.signal)}let S=-1,$J=setInterval(()=>{h(`/operations/${C}/heartbeat`,{...q,control_ack_seq:S,wait_ms:0}).then((M)=>{if(M.status>=300){D.abort();return}let w=M.json?.controls??[];for(let k of w)if(S=Math.max(S,k.seq),k.kind==="operation.cancel"||k.kind==="cancel")D.abort()},()=>D.abort())},iJ);try{let M=await J.executeOp({kind:Y,claim:$,...Y==="model"&&B?{bindId:B}:{},signal:D.signal,emit:async(k)=>{await j(k.kind,k.data??{})}}),w=await X(M.status,{...M.result?{result:M.result}:{},...M.error_code?{error_code:EJ(M.error_code,"vm_hands_op_failed")}:{}});K("vm_hands.op",{capability:F,kind:Y,status:M.status,code:M.error_code??null,...w.status>=300?{complete_status:w.status,complete_error:String(w.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval($J),n.delete(D),B)Z.modelOps.get(B)?.delete(v);Z.personTerminals.delete(v),N()}}async function VJ($,Q){let G=$.claim.attempt_id;if(Z.turns.get(G)===$)Z.turns.delete(G);J.onTurn?.(G,null),i($);let X=await f(Z,J.agent,G);Z.receipts.push({turn:$,failure:Q,unbound:X}),await JJ()}function JJ(){return e=e.then(PJ,PJ),e}async function PJ(){while(Z.receipts.length){let{turn:$,failure:Q,unbound:G}=Z.receipts[0],{complete:X,emit:j}=_($);try{if(await j("hands.stopped",{...$.readyData,reason_code:Q?"failed":"cancelled",killed_verified:G.killed_verified,shredded:G.shredded,...G.srt_fallbacks?{vm_hands_srt_fallbacks:G.srt_fallbacks}:{}}),Q)await X("failed",{error_code:Q});else await X("cancelled",{error_code:"driver_stopped"})}catch(q){if(q instanceof T)return}Z.receipts.shift()}}async function vJ($,Q){let{fence:G,op:X}=_($),j=Q.snapshot_id;if(Q.version!==1||typeof j!=="string"||Object.keys(Q).length!==2)throw new W("vm_hands_env_invalid","invalid environment delivery");let q=await h(`/operations/${X}/environment`,{...G,snapshot_id:j}),C=q.json?.environment_sealed;if(q.status!==200||!C||q.json?.payload!==void 0)throw new W("vm_hands_env_invalid","environment not delivered sealed");let Y=await J.agent.deliverEnvironment({attemptId:$.claim.attempt_id,snapshotId:j,deviceId:Z.deviceId??"",sealed:C});if((await h(`/operations/${X}/environment-ack`,{...G,...Y})).status>=300)throw new W("vm_hands_env_ack_refused","environment ack refused")}}
 export{QZ as M,pJ as N,jZ as O};

package/bin/vm-hands/{vm-hands-entry-lite-tmc063vj.js → vm-hands-entry-lite-dnx92ytp.js}

@@ -1,5 +1,5 @@
 // @bun
-import{li as l}from"./vm-hands-entry-lite-sjfdhffh.js";import{execFile as zj,spawn as I}from"child_process";var Cj="h264_ws_v1",kj="video",h=["smooth","sharp","data_saver","balanced"];var Yj="video_presets";var V=8388608,Y=65536,Lj="control",Aj="v1",d=200;function s(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q,J=(Q)=>typeof Q==="string"&&Q.length>0&&Q.length<=d;if(Object.keys(j).length!==2||!J(j.user_id)||!J(j.name))return null;return{user_id:j.user_id,name:j.name}}var xj="windows",Mj="v1",A=200,o=(q)=>typeof q==="string"&&h.includes(q);function fj(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q;if(Object.keys(j).length!==2||j.format!=="h264_ws_v1"||!o(j.preset))return null;return{format:"h264_ws_v1",preset:j.preset}}var $={hello:1,frame:2,stats:3,pong:4,serverClipboard:5,error:6,audioHello:7,audio:8,control:9,windows:10,pointer:16,key:17,config:18,ping:19,clientClipboard:20,keyframeRequest:21,ack:22,audioEnable:23};class U extends Error{constructor(q){super(q);this.name="DisplayVideoProtocolError"}}var e=new TextEncoder,jj=new TextDecoder("utf-8",{fatal:!0});function H(q,j){if(j.byteLength+1>V)throw new U("message_too_large");let J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,j.byteLength+1),Q.setUint8(4,q),J.set(j,5),J}function R(q){let j=e.encode(q);if(j.byteLength>Y)throw new U("text_too_large");return j}function f(q,j){if(!Number.isInteger(q)||q<0||q>65535)throw new U(`invalid_${j}`);return q}function qj(q){if(!Number.isFinite(q))throw new U("invalid_window");return Math.max(-2147483648,Math.min(2147483647,Math.round(q)))}function hj(q){switch(q.type){case"hello":{let j=R(q.codec),J=new Uint8Array(6+j.byteLength),Q=new DataView(J.buffer);return Q.setUint16(0,f(q.width,"width")),Q.setUint16(2,f(q.height,"height")),Q.setUint8(4,Math.max(1,Math.min(240,Math.round(q.fps)))),Q.setUint8(5,h.indexOf(q.preset)),J.set(j,6),H($.hello,J)}case"frame":{let j=new Uint8Array(13+q.data.byteLength),J=new DataView(j.buffer);return J.setUint8(0,q.key?1:0),J.setUint32(1,q.seq>>>0),J.setBigUint64(5,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,13),H($.frame,j)}case"stats":return H($.stats,R(JSON.stringify(q.stats)));case"pong":case"ping":{let j=new Uint8Array(8);return new DataView(j.buffer).setFloat64(0,q.token),H(q.type==="ping"?$.ping:$.pong,j)}case"serverClipboard":return H($.serverClipboard,R(q.text));case"clientClipboard":return H($.clientClipboard,R(q.text));case"error":return H($.error,R(q.code));case"pointer":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint16(0,f(q.x,"x")),J.setUint16(2,f(q.y,"y")),J.setUint8(4,q.buttons&255),H($.pointer,j)}case"key":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint8(0,q.down?1:0),J.setUint32(1,q.keysym>>>0),H($.key,j)}case"config":return H($.config,Uint8Array.of(h.indexOf(q.preset)));case"keyframeRequest":return H($.keyframeRequest,new Uint8Array(0));case"audioHello":{let j=R(q.codec),J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,q.sampleRate>>>0),Q.setUint8(4,q.channels&255),J.set(j,5),H($.audioHello,J)}case"audio":{let j=new Uint8Array(8+q.data.byteLength);return new DataView(j.buffer).setBigUint64(0,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,8),H($.audio,j)}case"control":return H($.control,R(JSON.stringify(q.control)));case"windows":{let j=q.bounds.slice(0,A),J=new Uint8Array(j.length*16),Q=new DataView(J.buffer);return j.forEach((Z,z)=>{[Z.x,Z.y,Z.width,Z.height].forEach((G,F)=>Q.setInt32(z*16+F*4,qj(G)))}),H($.windows,J)}case"audioEnable":return H($.audioEnable,Uint8Array.of(q.on?1:0));case"ack":{let j=new Uint8Array(4);return new DataView(j.buffer).setUint32(0,q.seq>>>0),H($.ack,j)}}}function T(q){let j=h[q];if(!j)throw new U("invalid_preset");return j}function C(q,j){if(q.byteLength!==j)throw new U("invalid_length")}function k(q){if(q.byteLength>Y)throw new U("text_too_large");try{return jj.decode(q)}catch{throw new U("invalid_text")}}function Jj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_stats")}let J=j;if(!J||typeof J!=="object"||["fps","kbps","dropped","restarts","queued_bytes"].some((Z)=>typeof J[Z]!=="number"||!Number.isFinite(J[Z])))throw new U("invalid_stats");return{fps:J.fps,kbps:J.kbps,dropped:J.dropped,restarts:J.restarts,queued_bytes:J.queued_bytes}}function Qj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_control")}let J=j;if(!J||typeof J!=="object"||typeof J.you!=="boolean"||typeof J.same_user!=="boolean")throw new U("invalid_control");let Q=J.holder===null?null:s(J.holder);if(Q===null&&J.holder!==null)throw new U("invalid_control");return{holder:Q,you:J.you,same_user:J.same_user}}function Zj(q,j){let J=new DataView(j.buffer,j.byteOffset,j.byteLength);switch(q){case $.hello:if(j.byteLength<6)throw new U("invalid_length");return{type:"hello",width:J.getUint16(0),height:J.getUint16(2),fps:J.getUint8(4),preset:T(J.getUint8(5)),codec:k(j.subarray(6))};case $.frame:if(j.byteLength<14)throw new U("invalid_length");if(J.getUint8(0)>1)throw new U("invalid_frame_flags");return{type:"frame",key:J.getUint8(0)===1,seq:J.getUint32(1),captureMicros:Number(J.getBigUint64(5)),data:j.subarray(13)};case $.stats:return{type:"stats",stats:Jj(j)};case $.ping:case $.pong:return C(j,8),{type:q===$.ping?"ping":"pong",token:J.getFloat64(0)};case $.serverClipboard:return{type:"serverClipboard",text:k(j)};case $.clientClipboard:return{type:"clientClipboard",text:k(j)};case $.error:return{type:"error",code:k(j)};case $.pointer:return C(j,5),{type:"pointer",x:J.getUint16(0),y:J.getUint16(2),buttons:J.getUint8(4)};case $.key:if(C(j,5),J.getUint8(0)>1)throw new U("invalid_key_flags");return{type:"key",down:J.getUint8(0)===1,keysym:J.getUint32(1)};case $.config:return C(j,1),{type:"config",preset:T(J.getUint8(0))};case $.keyframeRequest:return C(j,0),{type:"keyframeRequest"};case $.audioHello:if(j.byteLength<5)throw new U("invalid_length");return{type:"audioHello",sampleRate:J.getUint32(0),channels:J.getUint8(4),codec:k(j.subarray(5))};case $.audio:if(j.byteLength<9)throw new U("invalid_length");return{type:"audio",captureMicros:Number(J.getBigUint64(0)),data:j.subarray(8)};case $.audioEnable:if(C(j,1),J.getUint8(0)>1)throw new U("invalid_audio_flags");return{type:"audioEnable",on:J.getUint8(0)===1};case $.control:return{type:"control",control:Qj(j)};case $.windows:{if(j.byteLength%16!==0||j.byteLength>A*16)throw new U("invalid_length");let Q=[];for(let Z=0;Z<j.byteLength;Z+=16)Q.push({x:J.getInt32(Z),y:J.getInt32(Z+4),width:J.getInt32(Z+8),height:J.getInt32(Z+12)});return{type:"windows",bounds:Q}}case $.ack:return C(j,4),{type:"ack",seq:J.getUint32(0)};default:return null}}class $j{buffer=new Uint8Array(0);push(q){let j=new Uint8Array(this.buffer.byteLength+q.byteLength);j.set(this.buffer),j.set(q,this.buffer.byteLength);let J=[],Q=0;while(j.byteLength-Q>=4){let Z=new DataView(j.buffer,j.byteOffset+Q,4).getUint32(0);if(Z<1||Z>V)throw new U("invalid_message_length");if(j.byteLength-Q-4<Z)break;let z=j[Q+4],G=j.slice(Q+5,Q+4+Z),F=Zj(z,G);if(F)J.push(F);Q+=4+Z}return this.buffer=j.slice(Q),J}}var t="/usr/bin/osascript",Gj=5000,Kj=1048576,Uj=String.raw`
+import{ni as l}from"./vm-hands-entry-lite-y4nntb2w.js";import{execFile as zj,spawn as I}from"child_process";var Cj="h264_ws_v1",kj="video",h=["smooth","sharp","data_saver","balanced"];var Yj="video_presets";var V=8388608,Y=65536,Lj="control",Aj="v1",d=200;function s(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q,J=(Q)=>typeof Q==="string"&&Q.length>0&&Q.length<=d;if(Object.keys(j).length!==2||!J(j.user_id)||!J(j.name))return null;return{user_id:j.user_id,name:j.name}}var xj="windows",Mj="v1",A=200,o=(q)=>typeof q==="string"&&h.includes(q);function fj(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q;if(Object.keys(j).length!==2||j.format!=="h264_ws_v1"||!o(j.preset))return null;return{format:"h264_ws_v1",preset:j.preset}}var $={hello:1,frame:2,stats:3,pong:4,serverClipboard:5,error:6,audioHello:7,audio:8,control:9,windows:10,pointer:16,key:17,config:18,ping:19,clientClipboard:20,keyframeRequest:21,ack:22,audioEnable:23};class U extends Error{constructor(q){super(q);this.name="DisplayVideoProtocolError"}}var e=new TextEncoder,jj=new TextDecoder("utf-8",{fatal:!0});function H(q,j){if(j.byteLength+1>V)throw new U("message_too_large");let J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,j.byteLength+1),Q.setUint8(4,q),J.set(j,5),J}function R(q){let j=e.encode(q);if(j.byteLength>Y)throw new U("text_too_large");return j}function f(q,j){if(!Number.isInteger(q)||q<0||q>65535)throw new U(`invalid_${j}`);return q}function qj(q){if(!Number.isFinite(q))throw new U("invalid_window");return Math.max(-2147483648,Math.min(2147483647,Math.round(q)))}function hj(q){switch(q.type){case"hello":{let j=R(q.codec),J=new Uint8Array(6+j.byteLength),Q=new DataView(J.buffer);return Q.setUint16(0,f(q.width,"width")),Q.setUint16(2,f(q.height,"height")),Q.setUint8(4,Math.max(1,Math.min(240,Math.round(q.fps)))),Q.setUint8(5,h.indexOf(q.preset)),J.set(j,6),H($.hello,J)}case"frame":{let j=new Uint8Array(13+q.data.byteLength),J=new DataView(j.buffer);return J.setUint8(0,q.key?1:0),J.setUint32(1,q.seq>>>0),J.setBigUint64(5,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,13),H($.frame,j)}case"stats":return H($.stats,R(JSON.stringify(q.stats)));case"pong":case"ping":{let j=new Uint8Array(8);return new DataView(j.buffer).setFloat64(0,q.token),H(q.type==="ping"?$.ping:$.pong,j)}case"serverClipboard":return H($.serverClipboard,R(q.text));case"clientClipboard":return H($.clientClipboard,R(q.text));case"error":return H($.error,R(q.code));case"pointer":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint16(0,f(q.x,"x")),J.setUint16(2,f(q.y,"y")),J.setUint8(4,q.buttons&255),H($.pointer,j)}case"key":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint8(0,q.down?1:0),J.setUint32(1,q.keysym>>>0),H($.key,j)}case"config":return H($.config,Uint8Array.of(h.indexOf(q.preset)));case"keyframeRequest":return H($.keyframeRequest,new Uint8Array(0));case"audioHello":{let j=R(q.codec),J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,q.sampleRate>>>0),Q.setUint8(4,q.channels&255),J.set(j,5),H($.audioHello,J)}case"audio":{let j=new Uint8Array(8+q.data.byteLength);return new DataView(j.buffer).setBigUint64(0,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,8),H($.audio,j)}case"control":return H($.control,R(JSON.stringify(q.control)));case"windows":{let j=q.bounds.slice(0,A),J=new Uint8Array(j.length*16),Q=new DataView(J.buffer);return j.forEach((Z,z)=>{[Z.x,Z.y,Z.width,Z.height].forEach((G,F)=>Q.setInt32(z*16+F*4,qj(G)))}),H($.windows,J)}case"audioEnable":return H($.audioEnable,Uint8Array.of(q.on?1:0));case"ack":{let j=new Uint8Array(4);return new DataView(j.buffer).setUint32(0,q.seq>>>0),H($.ack,j)}}}function T(q){let j=h[q];if(!j)throw new U("invalid_preset");return j}function C(q,j){if(q.byteLength!==j)throw new U("invalid_length")}function k(q){if(q.byteLength>Y)throw new U("text_too_large");try{return jj.decode(q)}catch{throw new U("invalid_text")}}function Jj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_stats")}let J=j;if(!J||typeof J!=="object"||["fps","kbps","dropped","restarts","queued_bytes"].some((Z)=>typeof J[Z]!=="number"||!Number.isFinite(J[Z])))throw new U("invalid_stats");return{fps:J.fps,kbps:J.kbps,dropped:J.dropped,restarts:J.restarts,queued_bytes:J.queued_bytes}}function Qj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_control")}let J=j;if(!J||typeof J!=="object"||typeof J.you!=="boolean"||typeof J.same_user!=="boolean")throw new U("invalid_control");let Q=J.holder===null?null:s(J.holder);if(Q===null&&J.holder!==null)throw new U("invalid_control");return{holder:Q,you:J.you,same_user:J.same_user}}function Zj(q,j){let J=new DataView(j.buffer,j.byteOffset,j.byteLength);switch(q){case $.hello:if(j.byteLength<6)throw new U("invalid_length");return{type:"hello",width:J.getUint16(0),height:J.getUint16(2),fps:J.getUint8(4),preset:T(J.getUint8(5)),codec:k(j.subarray(6))};case $.frame:if(j.byteLength<14)throw new U("invalid_length");if(J.getUint8(0)>1)throw new U("invalid_frame_flags");return{type:"frame",key:J.getUint8(0)===1,seq:J.getUint32(1),captureMicros:Number(J.getBigUint64(5)),data:j.subarray(13)};case $.stats:return{type:"stats",stats:Jj(j)};case $.ping:case $.pong:return C(j,8),{type:q===$.ping?"ping":"pong",token:J.getFloat64(0)};case $.serverClipboard:return{type:"serverClipboard",text:k(j)};case $.clientClipboard:return{type:"clientClipboard",text:k(j)};case $.error:return{type:"error",code:k(j)};case $.pointer:return C(j,5),{type:"pointer",x:J.getUint16(0),y:J.getUint16(2),buttons:J.getUint8(4)};case $.key:if(C(j,5),J.getUint8(0)>1)throw new U("invalid_key_flags");return{type:"key",down:J.getUint8(0)===1,keysym:J.getUint32(1)};case $.config:return C(j,1),{type:"config",preset:T(J.getUint8(0))};case $.keyframeRequest:return C(j,0),{type:"keyframeRequest"};case $.audioHello:if(j.byteLength<5)throw new U("invalid_length");return{type:"audioHello",sampleRate:J.getUint32(0),channels:J.getUint8(4),codec:k(j.subarray(5))};case $.audio:if(j.byteLength<9)throw new U("invalid_length");return{type:"audio",captureMicros:Number(J.getBigUint64(0)),data:j.subarray(8)};case $.audioEnable:if(C(j,1),J.getUint8(0)>1)throw new U("invalid_audio_flags");return{type:"audioEnable",on:J.getUint8(0)===1};case $.control:return{type:"control",control:Qj(j)};case $.windows:{if(j.byteLength%16!==0||j.byteLength>A*16)throw new U("invalid_length");let Q=[];for(let Z=0;Z<j.byteLength;Z+=16)Q.push({x:J.getInt32(Z),y:J.getInt32(Z+4),width:J.getInt32(Z+8),height:J.getInt32(Z+12)});return{type:"windows",bounds:Q}}case $.ack:return C(j,4),{type:"ack",seq:J.getUint32(0)};default:return null}}class $j{buffer=new Uint8Array(0);push(q){let j=new Uint8Array(this.buffer.byteLength+q.byteLength);j.set(this.buffer),j.set(q,this.buffer.byteLength);let J=[],Q=0;while(j.byteLength-Q>=4){let Z=new DataView(j.buffer,j.byteOffset+Q,4).getUint32(0);if(Z<1||Z>V)throw new U("invalid_message_length");if(j.byteLength-Q-4<Z)break;let z=j[Q+4],G=j.slice(Q+5,Q+4+Z),F=Zj(z,G);if(F)J.push(F);Q+=4+Z}return this.buffer=j.slice(Q),J}}var t="/usr/bin/osascript",Gj=5000,Kj=1048576,Uj=String.raw`
 ObjC.import("CoreGraphics");
 ObjC.import("ApplicationServices");
 ObjC.import("AppKit");
@@ -109,4 +109,4 @@ function run() {
 `);X>=0;X=B.indexOf(`
 `)){let S=B.slice(0,X);if(B=B.slice(X+1),!S.startsWith("c "))continue;let O=S.slice(2);if(O.length>Math.ceil(Y/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(O)){K({reason:"display_protocol"});return}let _=Buffer.from(O,"base64");if(_.byteLength<=Y)q.clipboard(_.toString("utf8"));if(z)return}if(B.length>Math.ceil(Y/3)*4+2)K({reason:"display_protocol"})}),G.once("error",()=>W("Reason could not watch this Mac's desktop clipboard.")),G.once("exit",()=>{if(!z)W("Reason could not watch this Mac's desktop clipboard.")})};return J.stdout.on("data",(B)=>{if(z||Z===null)return;Z+=B.toString("utf8");let N=Z.indexOf(`
 `);if(N<0){if(Z.length>4096)K({reason:"display_protocol"});return}let X=y(Z.slice(0,N));if(Z=null,!X)K({reason:"display_protocol"});else if(!X.screen||!X.accessibility)W(j.length>0?"Reason's background worker needs Screen Recording and Accessibility on this Mac (its own Reason entry in System Settings > Privacy & Security, not the Reason app's): run `reason permissions allow` on this Mac.":"Allow Screen Recording and Accessibility for this Mac's Reason worker, then restart it.");else i(),q.ready({width:X.width,height:X.height})}),J.stdin.on("error",()=>{return}),J.once("error",()=>W("Reason could not start this Mac's desktop input.")),J.once("exit",()=>{if(Z!==null)W("Reason could not start this Mac's desktop input.");else K({reason:"display_closed"})}),{pointer:(B,N,X)=>L(Q.pointer(B,N,X)),key:(B,N)=>L(Q.key(B,N)),clipboard:(B)=>L([`c ${Buffer.from(B,"utf8").toString("base64")}`]),close(){z=!0,F()}}}
-export{Cj as vf,kj as wf,h as xf,Yj as yf,Y as zf,Lj as Af,Aj as Bf,s as Cf,xj as Df,Mj as Ef,fj as Ff,hj as Gf,$j as Hf,y as If,Sj as Jf,_j as Kf,Hj as Lf,Tj as Mf,a as Nf,Vj as Of};
+export{Cj as xf,kj as yf,h as zf,Yj as Af,Y as Bf,Lj as Cf,Aj as Df,s as Ef,xj as Ff,Mj as Gf,fj as Hf,hj as If,$j as Jf,y as Kf,Sj as Lf,_j as Mf,Hj as Nf,Tj as Of,a as Pf,Vj as Qf};

package/bin/vm-hands/{vm-hands-entry-lite-547nmvs3.js → vm-hands-entry-lite-f6pj0czp.js}

@@ -1,3 +1,3 @@
 // @bun
-import{uf as $}from"./vm-hands-entry-lite-cavgmkjf.js";var O=$.version,Z=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function S(B,D){if(!Z.test(B)||!Z.test(D))throw Error("cannot compare invalid CLI versions");let J=(q)=>{let y=q.indexOf("-");return y===-1?[q,void 0]:[q.slice(0,y),q.slice(y+1)]},[j,F]=J(B),[w,G]=J(D),K=j.split(".").map(BigInt),M=w.split(".").map(BigInt);for(let q=0;q<3;q+=1){if(K[q]===M[q])continue;return K[q]<M[q]?-1:1}if(F===void 0||G===void 0){if(F===G)return 0;return F===void 0?1:-1}let Q=F.split("."),U=G.split("."),A=Math.max(Q.length,U.length);for(let q=0;q<A;q+=1){let y=Q[q],z=U[q];if(y===void 0||z===void 0){if(y===z)return 0;return y===void 0?-1:1}if(y===z)continue;let H=/^\d+$/.test(y),W=/^\d+$/.test(z);if(H&&W){let X=BigInt(y),Y=BigInt(z);if(X===Y)continue;return X<Y?-1:1}if(H!==W)return H?-1:1;return y<z?-1:1}return 0}function k(B,D){return D?`cli ${B} \xB7 agent ${D}`:`cli ${B}`}
-export{O as qf,Z as rf,S as sf,k as tf};
+import{wf as $}from"./vm-hands-entry-lite-z4wyczhc.js";var O=$.version,Z=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function S(B,D){if(!Z.test(B)||!Z.test(D))throw Error("cannot compare invalid CLI versions");let J=(q)=>{let y=q.indexOf("-");return y===-1?[q,void 0]:[q.slice(0,y),q.slice(y+1)]},[j,F]=J(B),[w,G]=J(D),K=j.split(".").map(BigInt),M=w.split(".").map(BigInt);for(let q=0;q<3;q+=1){if(K[q]===M[q])continue;return K[q]<M[q]?-1:1}if(F===void 0||G===void 0){if(F===G)return 0;return F===void 0?1:-1}let Q=F.split("."),U=G.split("."),A=Math.max(Q.length,U.length);for(let q=0;q<A;q+=1){let y=Q[q],z=U[q];if(y===void 0||z===void 0){if(y===z)return 0;return y===void 0?-1:1}if(y===z)continue;let H=/^\d+$/.test(y),W=/^\d+$/.test(z);if(H&&W){let X=BigInt(y),Y=BigInt(z);if(X===Y)continue;return X<Y?-1:1}if(H!==W)return H?-1:1;return y<z?-1:1}return 0}function k(B,D){return D?`cli ${B} \xB7 agent ${D}`:`cli ${B}`}
+export{O as sf,Z as tf,S as uf,k as vf};

package/bin/vm-hands/{vm-hands-entry-lite-02t1tfe7.js → vm-hands-entry-lite-hh0002ye.js}

@@ -1,3 +1,3 @@
 // @bun
-import{xe as j}from"./vm-hands-entry-lite-y06rgq4n.js";var q=25,K=j.object({machine:j.string().min(1).max(200),person:j.string().min(1).max(200),team:j.string().min(1).max(200),version:j.string().max(64).optional(),wait_seconds:j.number().int().min(0).max(q).optional()}),v=j.discriminatedUnion("kind",[j.object({id:j.string(),kind:j.literal("who")}),j.object({id:j.string(),kind:j.literal("send"),to:j.string(),body:j.string(),from_name:j.string(),from_agent:j.string(),wake:j.boolean()})]),P=j.object({job:v.nullable(),retry_after_seconds:j.number().optional()}),x=j.object({address:j.string(),person:j.string(),machine:j.string(),agent:j.string(),repo:j.string().nullable(),branch:j.string().nullable(),status:j.string(),since:j.number().nullable(),doing:j.string().nullable(),worker:j.boolean()}),B=j.object({person:j.string(),machine:j.string(),online:j.boolean()}),F=j.object({team:j.string().nullable(),sessions:j.array(x).max(2000),machines:j.array(B).max(500)}),Q=j.union([j.object({who:F}),j.object({sent:j.object({ids:j.array(j.string().max(100)).max(500),recipients:j.array(j.string().max(300)).max(500),from:j.string().max(300)})}),j.object({error:j.string().min(1).max(2000)})]),G=j.object({id:j.string().max(100),from:j.string().max(300),from_agent:j.string().max(100).nullable(),to:j.string().max(300),reply_to:j.string().max(100).nullable(),body:j.string().max(64000),sent_at:j.number()}),U=j.object({messages:j.array(G).max(100)});
+import{ze as j}from"./vm-hands-entry-lite-samn6qm5.js";var q=25,K=j.object({machine:j.string().min(1).max(200),person:j.string().min(1).max(200),team:j.string().min(1).max(200),version:j.string().max(64).optional(),wait_seconds:j.number().int().min(0).max(q).optional()}),v=j.discriminatedUnion("kind",[j.object({id:j.string(),kind:j.literal("who")}),j.object({id:j.string(),kind:j.literal("send"),to:j.string(),body:j.string(),from_name:j.string(),from_agent:j.string(),wake:j.boolean()})]),P=j.object({job:v.nullable(),retry_after_seconds:j.number().optional()}),x=j.object({address:j.string(),person:j.string(),machine:j.string(),agent:j.string(),repo:j.string().nullable(),branch:j.string().nullable(),status:j.string(),since:j.number().nullable(),doing:j.string().nullable(),worker:j.boolean()}),B=j.object({person:j.string(),machine:j.string(),online:j.boolean()}),F=j.object({team:j.string().nullable(),sessions:j.array(x).max(2000),machines:j.array(B).max(500)}),Q=j.union([j.object({who:F}),j.object({sent:j.object({ids:j.array(j.string().max(100)).max(500),recipients:j.array(j.string().max(300)).max(500),from:j.string().max(300)})}),j.object({error:j.string().min(1).max(2000)})]),G=j.object({id:j.string().max(100),from:j.string().max(300),from_agent:j.string().max(100).nullable(),to:j.string().max(300),reply_to:j.string().max(100).nullable(),body:j.string().max(64000),sent_at:j.number()}),U=j.object({messages:j.array(G).max(100)});
 export{q as K,P as L};

package/bin/vm-hands/{vm-hands-entry-lite-2wa0aq74.js → vm-hands-entry-lite-k9sm5kaf.js}

@@ -1,5 +1,5 @@
 // @bun
-import{L as f}from"./vm-hands-entry-lite-02t1tfe7.js";import{xe as $}from"./vm-hands-entry-lite-y06rgq4n.js";import{Bh as T,oh as v,rh as K,uh as U,vh as y}from"./vm-hands-entry-lite-vx5y8jc7.js";var c=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function _(x){let w=typeof x==="string"?c.exec(x):null;return w?{major:Number(w[1]),minor:Number(w[2])}:null}import{createHash as s,randomBytes as j}from"crypto";import{createInterface as o}from"readline";import{randomBytes as d}from"crypto";import{chmodSync as q,existsSync as C,lstatSync as l,mkdirSync as a,readFileSync as b,renameSync as p,unlinkSync as O,writeFileSync as L}from"fs";import{homedir as t}from"os";import{dirname as i,join as F}from"path";function B(x=process.env,w=t()){let H=x.XDG_CONFIG_HOME?.trim()||F(w,".config"),J=K({env:x})==="staging"?["staging"]:[];return F(T(H,...J),"credentials.json")}function A(x,w=B()){return a(i(w),{recursive:!0,mode:448}),L(w,`${JSON.stringify(x,null,2)}
+import{L as f}from"./vm-hands-entry-lite-hh0002ye.js";import{ze as $}from"./vm-hands-entry-lite-samn6qm5.js";import{Dh as T,qh as v,th as K,wh as U,xh as y}from"./vm-hands-entry-lite-png3h0cm.js";var c=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function _(x){let w=typeof x==="string"?c.exec(x):null;return w?{major:Number(w[1]),minor:Number(w[2])}:null}import{createHash as s,randomBytes as j}from"crypto";import{createInterface as o}from"readline";import{randomBytes as d}from"crypto";import{chmodSync as q,existsSync as C,lstatSync as l,mkdirSync as a,readFileSync as b,renameSync as p,unlinkSync as O,writeFileSync as L}from"fs";import{homedir as t}from"os";import{dirname as i,join as F}from"path";function B(x=process.env,w=t()){let H=x.XDG_CONFIG_HOME?.trim()||F(w,".config"),J=K({env:x})==="staging"?["staging"]:[];return F(T(H,...J),"credentials.json")}function A(x,w=B()){return a(i(w),{recursive:!0,mode:448}),L(w,`${JSON.stringify(x,null,2)}
 `,{mode:384}),q(w,384),w}function M(x=B()){if(!C(x))return null;try{let w=b(x,"utf8"),H=JSON.parse(w);if(typeof H.apiOrigin!=="string"||typeof H.clientId!=="string"||typeof H.accessToken!=="string"||typeof H.refreshToken!=="string"||typeof H.expiresAt!=="string"||typeof H.orgId!=="string"||!Array.isArray(H.scopes))return null;let G=new URL(H.apiOrigin).origin,J=U(G);if(J!==G)n(x,w,J);return{apiOrigin:J,clientId:H.clientId,accessToken:H.accessToken,refreshToken:H.refreshToken,expiresAt:H.expiresAt,scopes:H.scopes.filter((Q)=>typeof Q==="string"),orgId:H.orgId}}catch{return null}}function n(x,w,H){let G=`${x}.${process.pid}.${d(6).toString("hex")}.tmp`;try{let J=l(x);if(!J.isFile()||J.uid!==process.geteuid?.())return;let Q=JSON.parse(w);if(L(G,`${JSON.stringify({...Q,apiOrigin:H},null,2)}
 `,{mode:384,flag:"wx"}),q(G,384),b(x,"utf8")!==w)throw Error("credentials_changed");p(G,x)}catch{try{O(G)}catch{}}}function R(x=B()){if(!C(x))return!1;return O(x),!0}var S=["run","mcp:read","mcp:write","secrets:read","secrets:write","sessions:read","sessions:debug","devices:read","devices:write","devices:use","ssh:write","knowledge:read","memory:read","memory:write","skills:read","skills:write","repos:read","repos:write","reviews:read","reviews:write","deployment:read","analytics:read","org:read","org:write","attachments:read","attachments:write","guardrails:read","guardrails:write","network:read","network:write","automations:read","automations:write","agent_auth:read"];var n0=S.filter((x)=>x!=="network:read"&&x!=="network:write");class D extends Error{oauthCode;constructor(x,w=null){super(x);this.oauthCode=w;this.name="LoginError"}}function s0(){let x=j(48).toString("base64url"),w=s("sha256").update(x).digest("base64url");return{verifier:x,challenge:w,state:j(32).toString("base64url")}}function r(x,w){let H=typeof x.error==="string"?x.error:null,G=typeof x.error_description==="string"?x.error_description:H?H:w;return new D(G,H)}async function e(x,w,H,G){let J=await H(`${x}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:w,signal:G}),Q=await J.json().catch(()=>({}));if(!J.ok)throw r(Q,`OAuth token request failed (${J.status})`);return Q}var x0=1e4;async function w0(x,w={}){let H=w.fetchImpl??fetch,G=await e(x.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:x.clientId,refresh_token:x.refreshToken}),H,AbortSignal.timeout(x0)).catch((Q)=>{if(Q instanceof Error&&Q.name==="TimeoutError")throw new D("Reason did not answer the login refresh in time. Check the network and retry.");throw Q});if(typeof G.access_token!=="string"||typeof G.refresh_token!=="string"||typeof G.expires_in!=="number")throw new D("Reason returned an incomplete refreshed login.");let J={...x,accessToken:G.access_token,refreshToken:G.refresh_token,expiresAt:new Date(Date.now()+G.expires_in*1000).toISOString(),scopes:typeof G.scope==="string"?G.scope.split(/\s+/).filter(Boolean):x.scopes};return A(J,w.path??B()),J}var z=new Map;function k(x,w){if(!w)return x;if(w.aborted)return Promise.reject(w.reason);return new Promise((H,G)=>{let J=()=>G(w.reason);w.addEventListener("abort",J,{once:!0}),x.then(H,G).finally(()=>w.removeEventListener("abort",J))})}async function P(x={}){let w=x.path??B(),H=M(w);if(!H)return null;let G=x.apiOrigin??v(process.env,"REASON_API_URL")?.trim();if(G&&!y(H.apiOrigin,new URL(G).origin))return null;let J=Date.parse(H.expiresAt)<=Date.now()+60000;if(!x.forceRefresh&&!J)return H;let Q=[w,H.apiOrigin,H.clientId,H.refreshToken].join("\x00"),V=z.get(Q);if(V)return k(V,x.signal);let Z;return Z=w0(H,{fetchImpl:x.fetchImpl,path:w}).catch(async(Y)=>{if(!(Y instanceof D)||Y.oauthCode!=="invalid_grant"&&Y.oauthCode!=="invalid_client")throw Y;let N=M(w),u=Y.oauthCode==="invalid_client"?N?.clientId!==H.clientId:N?.refreshToken!==H.refreshToken;if(N&&u)return P({fetchImpl:x.fetchImpl,path:w});return R(w),null}).finally(()=>{if(z.get(Q)===Z)z.delete(Q)}),z.set(Q,Z),k(Z,x.signal)}function o0(x,w){return new Promise((H)=>{let G=o({input:x}),J=!1,Q=(Z)=>{if(J)return;J=!0,w.removeEventListener("abort",V),G.close(),x.pause(),H(Z)},V=()=>Q(null);w.addEventListener("abort",V,{once:!0}),G.once("line",(Z)=>Q(Z)),G.once("close",()=>Q(null))})}var $0=$.object({label:$.string(),used_percent:$.number().min(0).max(100).nullable(),resets_at:$.string().nullable(),exhausted:$.boolean().nullable()}),H0=$.object({groups:$.array($.object({selectable:$.boolean().optional(),accounts:$.array($.object({source_id:$.string().min(1),model_ids:$.array($.string().min(1)).optional()}))}))});function G0(x){let w=H0.safeParse(x);if(!w.success)return;return w.data.groups.some((H)=>H.selectable!==!1&&H.accounts.some((G)=>G.model_ids===void 0||G.model_ids.length>0))}class X extends Error{status;code;suggestedModel;retryAfterMs;resolutionReason;constructor(x,w,H,G,J,Q){super(H);this.status=x;this.code=w;this.suggestedModel=G;this.retryAfterMs=J;this.resolutionReason=Q;this.name="ApiError"}static rateLimitDelayMs(x,w){if(!(x instanceof X)||x.status!==429)return null;return Math.min(60000,Math.max(w,x.retryAfterMs??0))}}var J0=["minimal","low","medium","high","xhigh","max"],Q0=$.object({id:$.string().min(1),kind:$.string(),name:$.string(),custom_name:$.string().nullish(),status:$.string(),online:$.boolean(),compatible:$.boolean().optional(),compatibility_reason:$.string().nullish(),folder_lane_of:$.string().nullish(),roots:$.array($.object({id:$.string().min(1),label:$.string()}))}),W0=$.object({devices:$.array(Q0),end_cursor:$.string().nullish(),has_next_page:$.boolean().optional()}),Z0=$.object({id:$.string().min(1),name:$.string()}),V0=$.object({items:$.array(Z0)}),X0=$.object({id:$.string().min(1),name:$.string(),main:$.boolean(),mine:$.boolean(),session_id:$.string().nullish(),appearance:$.object({color:$.string().nullish()}).nullish().catch(null)}),Y0=$.object({items:$.array(X0)}),B0=$.object({skill_id:$.string().min(1),name:$.string(),description:$.string().nullish(),activation_keywords:$.array($.string()).default([]),is_enabled:$.boolean().default(!0)}),D0=$.object({items:$.array(B0).default([])}),z0=$.object({id:$.string().min(1),kind:$.string(),enabled:$.boolean(),schedule:$.object({expression:$.string().nullish(),every_seconds:$.number().nullish(),next_run_at:$.string().nullish()}).nullish(),github:$.object({event:$.string().nullish(),action:$.string().nullish(),repo:$.string().nullish()}).nullish(),last_fired_at:$.string().nullish()}),I=$.object({id:$.string().min(1),name:$.string().nullish(),instructions:$.string().nullish(),enabled:$.boolean(),triggers:$.array(z0).default([])}),N0=$.object({items:$.array(I).default([]),end_cursor:$.string().nullish(),has_next_page:$.boolean().optional()}),K0=$.object({id:$.string().min(1),slug:$.string().nullish(),name:$.string(),description:$.string().nullish(),transport:$.string().nullish(),url:$.string().nullish(),enabled:$.boolean()}),M0=$.object({items:$.array(K0).default([])}),P0=$.object({status:$.string(),summary:$.string().nullish(),category:$.string().nullish(),outcome:$.string().nullish(),message_count:$.number().nullish(),pr_url:$.string().nullish(),cost_usd:$.number().nullish(),generated_at:$.string().nullish()}),E=$.object({tags:$.array($.string()).default([])}),_0=$.enum(["linux","macos"]),h=$.object({id:$.string().min(1),name:$.string().min(1),platform:_0.nullable(),workers:$.object({total:$.number().int(),online:$.number().int(),busy:$.number().int(),idle:$.number().int()}),sessions:$.object({queued:$.number().int(),running:$.number().int()})}),F0=$.object({machines:$.array(h)}),U0=$.object({machine:h}),T0=$.object({deleted:$.literal(!0),revoked_workers:$.number().int(),revoked_tokens:$.number().int()}),q0=$.object({token:$.object({id:$.string().min(1),machine_id:$.string().min(1),token_prefix:$.string()}),secret:$.string().startsWith("rmt_")}),g=$.looseObject({machine_id:$.string().min(1),machine_name:$.string().min(1)}),C0=g.extend({organization_id:$.string().min(1)}),b0=$.object({id:$.string().min(1),name:$.string().min(1),state:$.enum(["waiting","placed"]),queue_position:$.number().int().nullable()});function H1(x){let w=b0.safeParse(x.machine);return w.success?w.data:null}var O0=$.union([$.object({kind:$.literal("cloud")}),$.object({kind:$.enum(["mac","headless"]),device_id:$.string().min(1),root_id:$.string().min(1)})]);function G1(x){let w=O0.safeParse(x.runs_on);return w.success?w.data:null}function W(x,w,H){let G=x.safeParse(w);if(!G.success)throw new X(502,H,"Reason returned an unexpected response.");return G.data}var L0=$.object({error:$.object({type:$.string(),message:$.string()})});function m(x,w,H){let G=L0.safeParse(w),J=typeof w.error==="string"?w.error:G.success?G.data.error.type:`http_${x}`,Q=typeof w.detail==="string"?w.detail:typeof w.message==="string"?w.message:G.success?G.data.error.message:`Reason request failed (${x}${typeof w.error==="string"?` ${w.error}`:""})`,V=J==="github_connection_required"&&typeof w.connect_url==="string"&&/^https?:\/\//.test(w.connect_url)?` Connect it at ${w.connect_url}`:"",Z=H===null||H.trim()===""?NaN:Number(H);return new X(x,J,`${Q}${V}`,typeof w.suggested_model==="string"?w.suggested_model:void 0,Number.isFinite(Z)&&Z>=0?Z*1000:void 0,typeof w.resolution_reason==="string"?w.resolution_reason:void 0)}async function J1(x){let w=await(x.fetchImpl??fetch)(`${x.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${x.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify(x.body),signal:AbortSignal.timeout(30000),redirect:"error"}),H=await w.json().catch(()=>({}));if(!w.ok)throw m(w.status,H,w.headers.get("retry-after"));return W(C0,H,"invalid_machine_ticket")}class A0{options;credentials;constructor(x,w={}){this.options=w;this.credentials=x}trackEvent(x,w={}){}async request(x,w={},H=!1){let G=this.options.fetchImpl??fetch,J=await G(`${this.credentials.apiOrigin}/v3${x}`,{method:w.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...w.raw?{"content-type":w.raw.contentType}:w.body===void 0?{}:{"content-type":"application/json"},...w.headers},body:w.raw?w.raw.bytes:w.body===void 0?void 0:JSON.stringify(w.body),signal:w.signal,redirect:"error"}),Q=await J.json().catch(()=>({}));if(J.status===401&&!H&&w.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let V=await P({fetchImpl:G,path:this.options.credentialsPath,forceRefresh:!0,signal:w.signal});if(V)return this.credentials=V,this.request(x,w,!0)}if(!J.ok)throw m(J.status,Q,J.headers.get("retry-after"));return Q}createHeadlessDeviceEnrollmentTicket(x){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:x,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice(x){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:x,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(w){if(w instanceof X&&(w.status===404||w.status===405||w.status===403&&w.code==="endpoint_not_available"))return null;throw w}}addDeviceRoot(x,w){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent(x)}/roots`,{method:"POST",body:w,signal:AbortSignal.timeout(30000)})}removeDeviceRoot(x,w){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent(x)}/roots/${encodeURIComponent(w)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath(x,w=""){let H=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return x===void 0?H:`${H}/${encodeURIComponent(x)}${w}`}async listMachines(){return W(F0,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine(x){let w=await this.request(this.machinePath(),{method:"POST",body:{name:x.name,...x.platform?{platform:x.platform}:{}}});return W(U0,w,"invalid_machine").machine}async deleteMachine(x){let w=await this.request(this.machinePath(x),{method:"DELETE"});return W(T0,w,"invalid_machine_deletion")}async createMachineToken(x){let w=await this.request(this.machinePath(x,"/tokens"),{method:"POST",body:{}});return W(q0,w,"invalid_machine_token")}async createMachineEnrollmentTicket(x,w){let H=await this.request(this.machinePath(x,"/enrollment-tickets"),{method:"POST",body:w,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return W(g,H,"invalid_machine_ticket")}self(x){return this.request("/self",{signal:x})}agentNetwork(){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{signal:AbortSignal.timeout(30000)})}startAgentNetwork(x){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{method:"POST",body:x,signal:AbortSignal.timeout(30000)})}rotateAgentNetwork(x){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{method:"PUT",body:x,signal:AbortSignal.timeout(30000)})}async claimAgentNetworkRelayJob(x,w){let H=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/claim`,{method:"POST",body:x,signal:w});return W(f,H,"invalid_agent_network_job")}async completeAgentNetworkRelayJob(x,w){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/jobs/${encodeURIComponent(x)}`,{method:"POST",body:w,signal:AbortSignal.timeout(30000)})}async recordAgentNetworkRelayReplies(x){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/replies`,{method:"POST",body:{messages:x},signal:AbortSignal.timeout(30000)})}async workspaceMembers(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/members/users`,{signal:AbortSignal.timeout(30000)})).items??[]).flatMap((w)=>typeof w.email==="string"?[{email:w.email,role:typeof w.role==="string"?w.role:"member"}]:[])}claimExistingCliPairing(x){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:x}})}connectAnthropicProvider(x,w,H={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:H.retryUnauthorized,signal:H.signal,body:{access_token:x.access,refresh_token:x.refresh,expires_at:new Date(x.expires).toISOString(),...w?{account_key:w}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((w)=>{let H=typeof w.full_name==="string"?w.full_name:typeof w.repo_full_name==="string"?w.repo_full_name:null;if(!H)return[];return[{repo_id:typeof w.repo_id==="string"?w.repo_id:void 0,full_name:H,provider:w.provider==="gitlab"?"gitlab":"github",default_branch:typeof w.default_branch==="string"?w.default_branch:null,private:typeof w.private==="boolean"?w.private:void 0}]})}async listProjects(){let x=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),w=V0.safeParse(x);if(!w.success)throw new X(502,"invalid_project_list","Reason returned an unexpected project list.");return w.data.items}async listReasons(){let x=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons`);return W(Y0,x,"invalid_reason_list").items}async openReasonConversation(x){let w=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons/${encodeURIComponent(x)}/conversation`,{method:"POST"});return W($.object({session_id:$.string().min(1)}),w,"invalid_reason_conversation").session_id}async listSkills(){try{let x=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return W(D0,x,"invalid_skill_list").items}catch(x){if(x instanceof X&&(x.status===403||x.status===404))return[];throw x}}async listDevices(){let x=[],w=null;for(let H=0;H<50;H+=1){let G=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${w?`?after=${encodeURIComponent(w)}`:""}`),J=W0.safeParse(G);if(!J.success)throw new X(502,"invalid_device_list","Reason returned an unexpected machine list.");if(x.push(...J.data.devices),w=J.data.has_next_page?J.data.end_cursor??null:null,!w)break}return x}async listModels(){try{let w=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((J)=>J.hidden!==!0),H=w.filter((J)=>J.available!==!1).map(({reasoning_efforts:J,hidden:Q,available:V,...Z})=>({...Z,...Array.isArray(J)?{reasoning_efforts:J0.filter((Y)=>J.includes(Y))}:{}})),G=new Set(H.map((J)=>J.detail));return{models:H.length>1&&G.size===1?H.map(({detail:J,...Q})=>Q):H,runnable:H.length>0||w.length===0}}catch(x){if(x instanceof X&&(x.status===403||x.status===404))return{models:[],runnable:!0};throw x}}async getAgentVersion(x){try{let w=await this.request("/deployment",{signal:x,retryUnauthorized:!1});return _(w.reason_version)?w.reason_version:null}catch{return null}}async getUsageQuota(){try{let x=$0.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!x.success)return null;let w;try{w=G0(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...x.data,own_inference:w}}catch(x){if(x instanceof X&&(x.status===403||x.status===404))return null;throw x}}async listSessions(x=50,w,H={}){let G=new URLSearchParams({first:String(Math.min(Math.max(x,1),200)),status:H.status??"active"});if(w)G.set("project_id",w);if(H.origin)G.set("origin",H.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${G.toString()}`)).items??[]}getSession(x,w){let H=w?.fields.length?`?fields=${encodeURIComponent(w.fields.join(","))}`:"";return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}${H}`)}async prestartSession(x){let w=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:x}});return w?.status==="starting"||w?.status==="ready"}async createSession(x){let w=x.mode==="ephemeral"||x.workspaceOwnership==="externally-managed";if(x.attachments?.length)await this.requireSessionAttachments();if(w||x.runtimeProfile){let J=await this.request("/deployment");if(w&&(!Array.isArray(J.session_modes)||!J.session_modes.includes(x.mode??"standard")||!Array.isArray(J.workspace_ownerships)||!J.workspace_ownerships.includes(x.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if(x.runtimeProfile&&(!Array.isArray(J.experimental_runtime_profiles)||!J.experimental_runtime_profiles.includes(x.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let H=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:x.prompt,...x.attachments?.length?{attachments:x.attachments}:{},...x.mode?{mode:x.mode}:{},...x.workspaceOwnership?{workspace_ownership:x.workspaceOwnership}:{},...x.target?{target:x.target}:{},...x.repo?{repo:x.repo}:{},...x.provider?{provider:x.provider}:{},...x.model?{model:x.model}:{},...x.reasoningEffort?{reasoning_effort:x.reasoningEffort}:{},...x.runtimeProfile?{experimental_runtime_profile:x.runtimeProfile}:{},...x.ref?{ref:x.ref}:{},...x.branch?{branch:x.branch}:{},...x.completionMode?{completion_mode:x.completionMode}:{},...x.env&&Object.keys(x.env).length>0?{env:x.env}:{},...x.clientSessionId?{client_session_id:x.clientSessionId}:{},...x.longRunning?{long_running:{enabled:!0}}:{},...x.spendLimitRcu?{spend_limit_rcu:x.spendLimitRcu}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),G=await this.getSession(H.session_id);if(w){let J=G.session_policy,Q=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!J||J.version!==1||J.mode!==(x.mode??"standard")||J.workspaceOwnership!==(x.workspaceOwnership??"managed")||!J.components||Q.some((V)=>J.components[V]!==!0))throw await this.cancelSession(H.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if(x.runtimeProfile&&G.experimental_runtime_profile!==x.runtimeProfile)throw await this.cancelSession(H.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return G}async getEvents(x,w=-1,H={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/events?after_seq=${w}&limit=500${H.waitMs?`&wait_ms=${H.waitMs}`:""}`,H.signal?{signal:H.signal}:{})}catch(G){if(!(G instanceof X)||G.status!==403&&G.status!==404)throw G;return{session:await this.getSession(x),items:[],next_seq:w}}}async getMessages(x,w){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/messages?first=500${w===void 0?"":`&after_seq=${w}`}`)}async getAttachments(x,w){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/attachments${w?`?view=${w}`:""}`)).items??[]}catch(H){if(H instanceof X&&(H.status===403||H.status===404))return[];throw H}}async requireSessionAttachments(){let x=await this.request("/deployment",{headers:{"cache-control":"no-cache"}});if(x.session_attachments!==!0){let w=typeof x.reason_version==="string"&&/^\d+\.\d+(?:\.\d+)?$/.test(x.reason_version)?`Agent ${x.reason_version}`:null,H=typeof x.commit_sha==="string"&&/^[a-f0-9]{40,64}$/i.test(x.commit_sha)?`server ${x.commit_sha.slice(0,12)}`:null,G=[w,H].filter(Boolean).join(", ");throw Error(`This server does not support Session image attachments: ${new URL(this.credentials.apiOrigin).host}${G?` (${G})`:""}. The API server needs an attachment-capable deployment; updating the Agent version alone is not enough. Your image was not sent; retry after the server update.`)}}async sendMessage(x,w,H={}){if(H.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/messages`,{method:"POST",body:{message:w,...H.attachments?.length?{attachments:H.attachments}:{},...H.model?{model:H.model}:{},...H.reasoningEffort?{reasoning_effort:H.reasoningEffort}:{},...H.target?{target:H.target}:{},...H.delivery?{delivery:H.delivery}:{}}})}async steerQueuedMessage(x,w){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/messages/${encodeURIComponent(w)}/steer`,{method:"POST",body:{}})}async withdrawQueuedMessage(x,w){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/messages/${encodeURIComponent(w)}/queued`,{method:"DELETE"})}async getConversation(x){let w=[],H=null;for(let G=0;G<50;G+=1){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/conversation${H?`?after=${encodeURIComponent(H)}`:""}`);if(w.push(...J.items??[]),!J.has_next_page||!J.end_cursor)break;H=J.end_cursor}return w}createSharedLink(x,w){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/shared-links`,{method:"POST",body:{url:w.url,...w.label?{label:w.label}:{},...w.expiresInSeconds!==void 0?{expires_in_seconds:w.expiresInSeconds}:{}}})}sessionAction(x,w,H={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/${w}`,{method:"POST",body:H})}renameSession(x,w){return this.sessionAction(x,"rename",{title:w||null})}moveSessionToProject(x,w){return this.sessionAction(x,"project",{project_id:w})}compactSession(x){return this.sessionAction(x,"compact")}retrySession(x){return this.sessionAction(x,"retry")}rewindSession(x,w){return this.sessionAction(x,"rewind",{message_id:w.messageId,content:w.content,request_id:w.requestId})}forkSession(x,w){return this.sessionAction(x,"fork",{...w.message?{message:w.message}:{},client_session_id:w.clientSessionId})}cancelSession(x,w={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/cancel`,{method:"POST",body:w.mode==="hard"?{mode:"hard"}:{}})}sessionPath(x,w=""){return`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}${w}`}async archiveSession(x){await this.request(this.sessionPath(x,"/archive"),{method:"POST",body:{}})}async unarchiveSession(x){await this.request(this.sessionPath(x,"/unarchive"),{method:"POST",body:{}})}async deleteSession(x){await this.request(this.sessionPath(x),{method:"DELETE"})}async listSessionTags(x){return W(E,await this.request(this.sessionPath(x,"/tags")),"invalid_session_tags").tags}async appendSessionTags(x,w){let H=await this.request(this.sessionPath(x,"/tags"),{method:"POST",body:{tags:w}});return W(E,H,"invalid_session_tags").tags}async sessionInsight(x,w=!1){let H=await this.request(this.sessionPath(x,w?"/insights/generate":"/insights"),w?{method:"POST",body:{}}:{});return W(P0,H,"invalid_session_insight")}async listAutomations(){let x=[],w=null;for(let H=0;H<20;H+=1){let G=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations?first=100${w?`&after=${encodeURIComponent(w)}`:""}`),J=W(N0,G,"invalid_automation_list");if(x.push(...J.items),w=J.has_next_page?J.end_cursor??null:null,!w)break}return x}async createScheduledAutomation(x,w){let H=`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations`,G=W(I,await this.request(H,{method:"POST",body:{name:x.name,instructions:x.instructions,...x.repo?{repo:x.repo.full_name,provider:x.repo.provider}:{}}}),"invalid_automation");try{await this.request(`${H}/${encodeURIComponent(G.id)}/triggers`,{method:"POST",body:w})}catch(J){throw await this.deleteAutomation(G.id).catch(()=>{return}),J}return G}async setAutomationEnabled(x,w){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent(x)}`,{method:"PATCH",body:{enabled:w}})}async deleteAutomation(x){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent(x)}`,{method:"DELETE"})}async transcribe(x,w){let H=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/transcribe`,{method:"POST",raw:{bytes:x,contentType:w}});return W($.object({transcript:$.string()}),H,"invalid_transcript").transcript}async listMcpServers(){let x=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/mcp-servers`);return W(M0,x,"invalid_mcp_server_list").items}async setSkillEnabled(x,w){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills/${encodeURIComponent(x)}`,{method:"PUT",body:{is_enabled:w}})}}
 export{B as z,M as A,s0 as B,P as C,o0 as D,X as E,J0 as F,H1 as G,G1 as H,J1 as I,A0 as J};

package/bin/vm-hands/{vm-hands-entry-lite-xd9vwd5k.js → vm-hands-entry-lite-kf5eeggb.js}

@@ -1,3 +1,3 @@
 // @bun
-import{lg as m}from"./vm-hands-entry-lite-kh7w4cpj.js";import{ug as w}from"./vm-hands-entry-lite-h12jx2e8.js";import{Hh as h}from"./vm-hands-entry-lite-tcewjhvf.js";import{Uh as x}from"./vm-hands-entry-lite-6j29vkh5.js";import{li as Q}from"./vm-hands-entry-lite-sjfdhffh.js";import{existsSync as B,realpathSync as k,statSync as s}from"fs";import{platform as p}from"os";import{isAbsolute as y,sep as d}from"path";var r=43200000,A=w,l=4,u=/^[A-Za-z0-9._:-]{1,160}$/,a=1000;function v(z){return Boolean(z)&&typeof z==="object"&&!Array.isArray(z)}function q(z,H){if(typeof z!=="number"||!Number.isFinite(z)||z<=0)return H;return Math.min(a,Math.max(1,Math.floor(z)))}function n(z,H=Date.now()){let V=["relay_url","session_id","expires_at"],J=new Set([...V,"cols","rows","cwd","workspace"]);if(!v(z)||V.some((L)=>!(L in z))||Object.keys(z).some((L)=>!J.has(L)))throw new Q("invalid_pty_request","Reason terminal request is malformed.");let{relay_url:j,session_id:Y,expires_at:C}=z;if(typeof j!=="string")throw new Q("invalid_pty_request","Reason terminal relay URL is missing.");let D;try{D=new URL(j)}catch{throw new Q("invalid_pty_request","Reason terminal relay URL is invalid.")}if(D.protocol!=="wss:"&&D.protocol!=="ws:"||D.username||D.password)throw new Q("invalid_pty_request","Reason terminal relay URL is invalid.");if(typeof Y!=="string"||!u.test(Y))throw new Q("invalid_pty_request","Reason terminal session identity is invalid.");let R=typeof C==="string"?Date.parse(C):Number.NaN;if(!Number.isFinite(R)||R<=H)throw new Q("invalid_pty_request","Reason terminal session has already expired.");if(z.cwd!==void 0&&typeof z.cwd!=="string")throw new Q("invalid_pty_request","Reason terminal working directory is invalid.");let Z=z.workspace===void 0?void 0:x(z.workspace);if(Z===null||Z&&z.cwd!==void 0)throw new Q("invalid_pty_request","Reason terminal workspace is invalid.");return{relay_url:j,session_id:Y,expires_at:new Date(Math.min(R,H+r)).toISOString(),cols:q(z.cols,80),rows:q(z.rows,24),...z.cwd===void 0?{}:{cwd:z.cwd},...Z?{workspace:Z}:{}}}function o(z,H){return H===z||H.startsWith(z+d)}function U(z,H){if(H===void 0)return z;if(!y(H))throw new Q("pty_cwd_invalid","Reason terminal working directory must be absolute.");let V;try{V=k(H)}catch{throw new Q("pty_cwd_invalid","Reason terminal working directory does not exist.")}if(!o(z,V))throw new Q("pty_cwd_outside_root","Reason terminal working directory escapes the granted root.");if(!s(V).isDirectory())throw new Q("pty_cwd_invalid","Reason terminal working directory is not a directory.");return V}function t(z=process.env){let H=z.SHELL;if(H&&y(H)&&B(H))return H;for(let V of p()==="darwin"?["/bin/zsh","/bin/bash","/bin/sh"]:["/bin/bash","/bin/sh"])if(B(V))return V;return"/bin/sh"}function e(){let z=globalThis.Bun;if(!z)throw new Q("pty_unavailable","Reason terminals require the Bun runtime.");return z.spawn}function Dz(){return typeof globalThis.Bun<"u"}var zz=(z)=>{let H=e()({cmd:[z.shell,"-i","-l"],cwd:z.cwd,env:{...z.environment,TERM:"xterm-256color"},terminal:{cols:z.cols,rows:z.rows,data:(J,j)=>{z.onData(j)}}}),V=H.terminal;if(!V){try{H.kill()}catch{}throw new Q("pty_unavailable","Reason could not allocate a pseudo-terminal.")}return{write:(J)=>V.write(J),resize:(J,j)=>V.resize(J,j),kill:()=>{try{H.kill()}catch{}},exited:H.exited.then((J)=>typeof J==="number"?J:null,()=>null)}},Hz=(z,H)=>{return H===void 0?new WebSocket(z):new WebSocket(z,{proxy:H})},S=new Set;function Jz(z){if(S.size>=l||S.has(z))return null;S.add(z);let H=!1;return()=>{if(H)return;H=!0,S.delete(z)}}async function Kz(z,H={}){let V=H.now??Date.now,J=n(z.payload,V()),j=Jz(z.operationId);if(!j)throw new Q("pty_slot_busy","This Reason Device already runs the maximum number of terminals.");let Y=V(),C,D,R;try{let Z=J.workspace?h(z.root,J.workspace):void 0;C=Z?U(B(Z.boundary)?k(Z.boundary):Z.boundary,Z.path):U(z.root,J.cwd),D=H.environment??process.env,R=H.shellPath??t(D)}catch(Z){throw j(),Z}return await new Promise((Z,L)=>{let X=null,W=null,M=!1,f=!1,K=!1,T=null,_=0,b=0,O=[],P=0,g=null,$=(N)=>{if(K)return;if(K=!0,g)clearTimeout(g);z.signal.removeEventListener("abort",I);try{X?.kill()}catch{}try{W?.close(1000,"pty_session_over")}catch{}if(j(),N.kind==="rejected"){L(N.error);return}let G={reason:N.reason,exit_code:T,output_bytes:_,input_bytes:b,duration_ms:Math.max(0,V()-Y)};z.emitEvent("pty.stopped",{...G}).catch(()=>{return}),Z({...G})},I=()=>{let N=z.signal.reason;$({kind:"rejected",error:N instanceof Q?N:new Q("cancelled","Reason closed the terminal session.")})};if(z.signal.aborted){I();return}z.signal.addEventListener("abort",I,{once:!0}),g=setTimeout(()=>$({kind:"resolved",reason:"session_expired"}),Math.max(1,Date.parse(J.expires_at)-V()));let i=(N)=>{if(_+=N.byteLength,!M||!W){if(O.push(N),P+=N.byteLength,P>A)$({kind:"resolved",reason:"output_backpressure"});return}try{W.send(N)}catch{$({kind:"resolved",reason:"relay_closed"});return}if(W.bufferedAmount>A)$({kind:"resolved",reason:"output_backpressure"})};try{X=(H.spawnPty??zz)({shell:R,args:["-i","-l"],cwd:C,cols:J.cols,rows:J.rows,environment:D,onData:(N)=>{if(!K)i(N)}})}catch(N){$({kind:"rejected",error:N instanceof Q?N:new Q("pty_spawn_failed","Reason could not start the terminal shell.")});return}X.exited.then((N)=>{if(K)return;if(T=N,M&&W)try{W.send(JSON.stringify({t:"exit",code:N}))}catch{}$({kind:"resolved",reason:"shell_exited"})});let c=(H.loadProxy??m)()?.url;try{W=(H.connect??Hz)(J.relay_url,c)}catch{$({kind:"rejected",error:new Q("pty_relay_unavailable","Reason could not reach the terminal relay.")});return}W.binaryType="arraybuffer",W.onopen=()=>{if(K||!W)return;M=!0;try{W.send(JSON.stringify({t:"open",cols:J.cols,rows:J.rows}));for(let N of O.splice(0))W.send(N);P=0}catch{$({kind:"resolved",reason:"relay_closed"});return}f=!0,z.emitEvent("pty.ready",{session_id:J.session_id,cols:J.cols,rows:J.rows}).catch(()=>{return})},W.onmessage=(N)=>{if(K||!X)return;let G=N.data;if(typeof G==="string"){let F;try{F=JSON.parse(G)}catch{return}if(!v(F))return;if(F.t==="resize"){try{X.resize(q(F.cols,J.cols),q(F.rows,J.rows))}catch{}return}if(F.t==="close")$({kind:"resolved",reason:"client_closed"});return}let E=G instanceof ArrayBuffer?new Uint8Array(G):ArrayBuffer.isView(G)?new Uint8Array(G.buffer,G.byteOffset,G.byteLength):null;if(!E||E.byteLength===0)return;b+=E.byteLength;try{X.write(E)}catch{}},W.onclose=()=>{if(K)return;if(!f){$({kind:"rejected",error:new Q("pty_relay_unavailable","Reason could not reach the terminal relay.")});return}$({kind:"resolved",reason:"relay_closed"})},W.onerror=()=>{if(K||f)return;$({kind:"rejected",error:new Q("pty_relay_unavailable","Reason could not reach the terminal relay.")})}})}
-export{r as Pf,A as Qf,l as Rf,n as Sf,U as Tf,t as Uf,Dz as Vf,zz as Wf,Hz as Xf,Kz as Yf};
+import{ng as m}from"./vm-hands-entry-lite-d17bx1yc.js";import{wg as w}from"./vm-hands-entry-lite-bbezym6j.js";import{Jh as h}from"./vm-hands-entry-lite-0nb9zkz1.js";import{Wh as x}from"./vm-hands-entry-lite-ytmcecfr.js";import{ni as Q}from"./vm-hands-entry-lite-y4nntb2w.js";import{existsSync as B,realpathSync as k,statSync as s}from"fs";import{platform as p}from"os";import{isAbsolute as y,sep as d}from"path";var r=43200000,A=w,l=4,u=/^[A-Za-z0-9._:-]{1,160}$/,a=1000;function v(z){return Boolean(z)&&typeof z==="object"&&!Array.isArray(z)}function q(z,H){if(typeof z!=="number"||!Number.isFinite(z)||z<=0)return H;return Math.min(a,Math.max(1,Math.floor(z)))}function n(z,H=Date.now()){let V=["relay_url","session_id","expires_at"],J=new Set([...V,"cols","rows","cwd","workspace"]);if(!v(z)||V.some((L)=>!(L in z))||Object.keys(z).some((L)=>!J.has(L)))throw new Q("invalid_pty_request","Reason terminal request is malformed.");let{relay_url:j,session_id:Y,expires_at:C}=z;if(typeof j!=="string")throw new Q("invalid_pty_request","Reason terminal relay URL is missing.");let D;try{D=new URL(j)}catch{throw new Q("invalid_pty_request","Reason terminal relay URL is invalid.")}if(D.protocol!=="wss:"&&D.protocol!=="ws:"||D.username||D.password)throw new Q("invalid_pty_request","Reason terminal relay URL is invalid.");if(typeof Y!=="string"||!u.test(Y))throw new Q("invalid_pty_request","Reason terminal session identity is invalid.");let R=typeof C==="string"?Date.parse(C):Number.NaN;if(!Number.isFinite(R)||R<=H)throw new Q("invalid_pty_request","Reason terminal session has already expired.");if(z.cwd!==void 0&&typeof z.cwd!=="string")throw new Q("invalid_pty_request","Reason terminal working directory is invalid.");let Z=z.workspace===void 0?void 0:x(z.workspace);if(Z===null||Z&&z.cwd!==void 0)throw new Q("invalid_pty_request","Reason terminal workspace is invalid.");return{relay_url:j,session_id:Y,expires_at:new Date(Math.min(R,H+r)).toISOString(),cols:q(z.cols,80),rows:q(z.rows,24),...z.cwd===void 0?{}:{cwd:z.cwd},...Z?{workspace:Z}:{}}}function o(z,H){return H===z||H.startsWith(z+d)}function U(z,H){if(H===void 0)return z;if(!y(H))throw new Q("pty_cwd_invalid","Reason terminal working directory must be absolute.");let V;try{V=k(H)}catch{throw new Q("pty_cwd_invalid","Reason terminal working directory does not exist.")}if(!o(z,V))throw new Q("pty_cwd_outside_root","Reason terminal working directory escapes the granted root.");if(!s(V).isDirectory())throw new Q("pty_cwd_invalid","Reason terminal working directory is not a directory.");return V}function t(z=process.env){let H=z.SHELL;if(H&&y(H)&&B(H))return H;for(let V of p()==="darwin"?["/bin/zsh","/bin/bash","/bin/sh"]:["/bin/bash","/bin/sh"])if(B(V))return V;return"/bin/sh"}function e(){let z=globalThis.Bun;if(!z)throw new Q("pty_unavailable","Reason terminals require the Bun runtime.");return z.spawn}function Dz(){return typeof globalThis.Bun<"u"}var zz=(z)=>{let H=e()({cmd:[z.shell,"-i","-l"],cwd:z.cwd,env:{...z.environment,TERM:"xterm-256color"},terminal:{cols:z.cols,rows:z.rows,data:(J,j)=>{z.onData(j)}}}),V=H.terminal;if(!V){try{H.kill()}catch{}throw new Q("pty_unavailable","Reason could not allocate a pseudo-terminal.")}return{write:(J)=>V.write(J),resize:(J,j)=>V.resize(J,j),kill:()=>{try{H.kill()}catch{}},exited:H.exited.then((J)=>typeof J==="number"?J:null,()=>null)}},Hz=(z,H)=>{return H===void 0?new WebSocket(z):new WebSocket(z,{proxy:H})},S=new Set;function Jz(z){if(S.size>=l||S.has(z))return null;S.add(z);let H=!1;return()=>{if(H)return;H=!0,S.delete(z)}}async function Kz(z,H={}){let V=H.now??Date.now,J=n(z.payload,V()),j=Jz(z.operationId);if(!j)throw new Q("pty_slot_busy","This Reason Device already runs the maximum number of terminals.");let Y=V(),C,D,R;try{let Z=J.workspace?h(z.root,J.workspace):void 0;C=Z?U(B(Z.boundary)?k(Z.boundary):Z.boundary,Z.path):U(z.root,J.cwd),D=H.environment??process.env,R=H.shellPath??t(D)}catch(Z){throw j(),Z}return await new Promise((Z,L)=>{let X=null,W=null,M=!1,f=!1,K=!1,T=null,_=0,b=0,O=[],P=0,g=null,$=(N)=>{if(K)return;if(K=!0,g)clearTimeout(g);z.signal.removeEventListener("abort",I);try{X?.kill()}catch{}try{W?.close(1000,"pty_session_over")}catch{}if(j(),N.kind==="rejected"){L(N.error);return}let G={reason:N.reason,exit_code:T,output_bytes:_,input_bytes:b,duration_ms:Math.max(0,V()-Y)};z.emitEvent("pty.stopped",{...G}).catch(()=>{return}),Z({...G})},I=()=>{let N=z.signal.reason;$({kind:"rejected",error:N instanceof Q?N:new Q("cancelled","Reason closed the terminal session.")})};if(z.signal.aborted){I();return}z.signal.addEventListener("abort",I,{once:!0}),g=setTimeout(()=>$({kind:"resolved",reason:"session_expired"}),Math.max(1,Date.parse(J.expires_at)-V()));let i=(N)=>{if(_+=N.byteLength,!M||!W){if(O.push(N),P+=N.byteLength,P>A)$({kind:"resolved",reason:"output_backpressure"});return}try{W.send(N)}catch{$({kind:"resolved",reason:"relay_closed"});return}if(W.bufferedAmount>A)$({kind:"resolved",reason:"output_backpressure"})};try{X=(H.spawnPty??zz)({shell:R,args:["-i","-l"],cwd:C,cols:J.cols,rows:J.rows,environment:D,onData:(N)=>{if(!K)i(N)}})}catch(N){$({kind:"rejected",error:N instanceof Q?N:new Q("pty_spawn_failed","Reason could not start the terminal shell.")});return}X.exited.then((N)=>{if(K)return;if(T=N,M&&W)try{W.send(JSON.stringify({t:"exit",code:N}))}catch{}$({kind:"resolved",reason:"shell_exited"})});let c=(H.loadProxy??m)()?.url;try{W=(H.connect??Hz)(J.relay_url,c)}catch{$({kind:"rejected",error:new Q("pty_relay_unavailable","Reason could not reach the terminal relay.")});return}W.binaryType="arraybuffer",W.onopen=()=>{if(K||!W)return;M=!0;try{W.send(JSON.stringify({t:"open",cols:J.cols,rows:J.rows}));for(let N of O.splice(0))W.send(N);P=0}catch{$({kind:"resolved",reason:"relay_closed"});return}f=!0,z.emitEvent("pty.ready",{session_id:J.session_id,cols:J.cols,rows:J.rows}).catch(()=>{return})},W.onmessage=(N)=>{if(K||!X)return;let G=N.data;if(typeof G==="string"){let F;try{F=JSON.parse(G)}catch{return}if(!v(F))return;if(F.t==="resize"){try{X.resize(q(F.cols,J.cols),q(F.rows,J.rows))}catch{}return}if(F.t==="close")$({kind:"resolved",reason:"client_closed"});return}let E=G instanceof ArrayBuffer?new Uint8Array(G):ArrayBuffer.isView(G)?new Uint8Array(G.buffer,G.byteOffset,G.byteLength):null;if(!E||E.byteLength===0)return;b+=E.byteLength;try{X.write(E)}catch{}},W.onclose=()=>{if(K)return;if(!f){$({kind:"rejected",error:new Q("pty_relay_unavailable","Reason could not reach the terminal relay.")});return}$({kind:"resolved",reason:"relay_closed"})},W.onerror=()=>{if(K||f)return;$({kind:"rejected",error:new Q("pty_relay_unavailable","Reason could not reach the terminal relay.")})}})}
+export{r as Rf,A as Sf,l as Tf,n as Uf,U as Vf,t as Wf,Dz as Xf,zz as Yf,Hz as Zf,Kz as _f};

package/bin/vm-hands/{vm-hands-entry-lite-ewpfck9v.js → vm-hands-entry-lite-nfd1a1vt.js}

@@ -1,5 +1,5 @@
 // @bun
-import{$d as xe}from"./vm-hands-entry-lite-jgjvs1tq.js";import{Be as _t,Ce as Ne,Fe as St,Ge as wt,He as $,Qe as z,Re as Je,ye as W,ze as oe}from"./vm-hands-entry-lite-4kwqp4rz.js";import{We as Se}from"./vm-hands-entry-lite-d8myh0nx.js";import{$e as xt,Ye as Jt,cf as Z,ef as zt,ff as ae}from"./vm-hands-entry-lite-hkw64faw.js";import{Jf as Ae,Kf as se}from"./vm-hands-entry-lite-tmc063vj.js";import{Ah as Ot,oh as v,qh as tt,rh as D}from"./vm-hands-entry-lite-vx5y8jc7.js";import{Gh as q}from"./vm-hands-entry-lite-tcewjhvf.js";import{ei as pe,ki as ye}from"./vm-hands-entry-lite-rwp6km63.js";import{li as _}from"./vm-hands-entry-lite-sjfdhffh.js";import{spawn as I}from"child_process";import{randomUUID as Oe}from"crypto";import{closeSync as Vr,copyFileSync as de,existsSync as ut,fstatSync as Er,mkdirSync as fe,openSync as vr,readdirSync as V,readFileSync as ge,readlinkSync as to,renameSync as eo,rmSync as ro,statSync as oo}from"fs";import{connect as so}from"net";import{userInfo as Te}from"os";import{basename as le,dirname as mt,join as b}from"path";var At=`import { spawn, execFileSync } from "node:child_process";
+import{be as xe}from"./vm-hands-entry-lite-723q0mmr.js";import{Ae as W,Be as oe,De as _t,Ee as Ne,He as St,Ie as wt,Je as $,Se as z,Te as Je}from"./vm-hands-entry-lite-y0ffxpcf.js";import{Ye as Se}from"./vm-hands-entry-lite-z59ar4qz.js";import{_e as Jt,bf as xt,ef as Z,gf as zt,hf as ae}from"./vm-hands-entry-lite-679wh2qd.js";import{Lf as Ae,Mf as se}from"./vm-hands-entry-lite-dnx92ytp.js";import{Ch as Ot,qh as v,sh as tt,th as D}from"./vm-hands-entry-lite-png3h0cm.js";import{Ih as q}from"./vm-hands-entry-lite-0nb9zkz1.js";import{gi as pe,mi as ye}from"./vm-hands-entry-lite-cag8nazq.js";import{ni as _}from"./vm-hands-entry-lite-y4nntb2w.js";import{spawn as I}from"child_process";import{randomUUID as Oe}from"crypto";import{closeSync as Vr,copyFileSync as de,existsSync as ut,fstatSync as Er,mkdirSync as fe,openSync as vr,readdirSync as V,readFileSync as ge,readlinkSync as to,renameSync as eo,rmSync as ro,statSync as oo}from"fs";import{connect as so}from"net";import{userInfo as Te}from"os";import{basename as le,dirname as mt,join as b}from"path";var At=`import { spawn, execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -757,4 +757,4 @@ WantedBy=default.target
 `),1;if(t.length===1&&t[0]==="doctor"){let i=await(e.grants??Ae)(o);if(!i)return r.write(`Reason computer use: Reason's permissions could not be read (computer_use_permission_status_unavailable)
 `),1;return(e.stdout??process.stdout).write(wo(i)),0}if(t.length!==1||t[0]!=="mcp")return r.write(`Usage: reason __computer-use mcp|doctor
 `),2;let[a,...c]=o;return(e.run??xo)(a,[...c,s.ocu,"mcp"],{...process.env,OPEN_COMPUTER_USE_DISABLE_APP_AGENT_PROXY:"1"})}function Ks(t=$){return t()?.userChrome??{code:"user_chrome_browser_use_missing"}}function Ce(t,e,r,o){return new Promise((s)=>{let a=I(t,e,{env:r,stdio:"ignore"}),c=setTimeout(()=>{a.kill("SIGKILL"),s(-1)},o);a.once("error",()=>{clearTimeout(c),s(-1)}),a.once("exit",(i)=>{clearTimeout(c),s(i??-1)})})}function So(t,e,r,o){return new Promise((s)=>{let a=I(t,e,{env:r,stdio:["ignore","pipe","ignore"]}),c="";a.stdout.setEncoding("utf8").on("data",(d)=>{c+=d});let i=setTimeout(()=>{a.kill("SIGKILL"),s(null)},o);a.once("error",()=>{clearTimeout(i),s(null)}),a.once("close",(d)=>{clearTimeout(i),s(d===0?c:null)})})}var po="/tmp/open-browser-use",yo=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,Ao=33554432;function No(t,e){let r;try{r=t===null?null:JSON.parse(t)}catch{return null}let o=H(r)&&H(r.result)?r.result.metadata:null;if(!H(o)||o.extensionId!==e)return null;return typeof o.extensionInstanceId==="string"&&yo.test(o.extensionInstanceId)?o.extensionInstanceId:null}async function Be(t,e,r){let o=r.storages.map((i)=>{try{return V(i).filter((d)=>d.endsWith(".log")||d.endsWith(".ldb")).map((d)=>b(i,d))}catch{return[]}}),s;try{s=o.some((i)=>i.length>0)?V(r.socketDir).filter((i)=>i.endsWith(".sock")):[]}catch{return[]}let a=[];for(let i of s){let d=b(r.socketDir,i),f=No(await So(t,["info","--socket",d,"--timeout","2s"],e,5000),r.extensionId);if(f)a.push({instance:f,socket:d})}let c=[];for(let[i,d]of(a.length>0?o:[]).entries())for(let f of d)try{if(oo(f).size>Ao)continue;let n=ge(f),l=a.find((u)=>n.includes(u.instance));if(l){c.push({storage:r.storages[i],...l});break}}catch{}return c}async function Oo(t,e,r){return(await Be(t,e,r))[0]?.instance??null}function Ie(t,e,r){return Oo(t,e,{socketDir:po,extensionId:_t,storages:[b(r,"browser-profile","Default","Local Extension Settings",_t)]})}var ue=/^(Default|Profile ([0-9]+))$/;async function go(t,e,r=q(),o=St){let s=b(r,"Library","Application Support","Google","Chrome"),a=[];try{a=V(s)}catch(n){if(n.code==="EPERM")throw new _("browser_use_chrome_access_denied","macOS blocked Reason from reading Chrome's profiles. Allow Full Disk Access for Reason on this Mac and try again.")}let c=(n)=>Number(ue.exec(n)?.[2]??-1),i=a.filter((n)=>ue.test(n)&&ut(b(s,n,"Extensions",W))).sort((n,l)=>c(n)-c(l)),d=(n)=>b(s,n,"Local Extension Settings",W);return(await Be(t,e,{socketDir:o,extensionId:W,storages:i.map(d)})).map(({storage:n,instance:l,socket:u})=>({profile:i.find((m)=>d(m)===n),instance:l,socket:u}))}async function To(t,e,r=q(),o=St){let s=(await go(t,e,r,o))[0]?.instance;if(!s)throw new _("automation_user_chrome_not_connected","No Chrome profile on this Mac is connected to Reason. Open Chrome with the Reason extension, then try again.");return s}function me(t){return new Promise((e)=>{let r=so({path:t}),o=(s)=>{r.destroy(),e(s)};r.setTimeout(1000,()=>o(!1)),r.once("error",()=>o(!1)),r.once("connect",()=>o(!0))})}async function $e(t,e){let r=Date.now()+e;while(Date.now()<r){if(await t())return!0;await new Promise((o)=>setTimeout(o,200))}return!1}var ft=new Map;function lt(t,e){let r=ft.get(t);if(!r)r=e().finally(()=>ft.delete(t)),ft.set(t,r);return r}async function qo(t,e){if(await me(t))return;if(ro(t,{force:!0}),await Ce("dbus-daemon",["--session",`--address=unix:path=${t}`,"--fork"],e,1e4)!==0||!await $e(()=>me(t),5000))throw new _("automation_unavailable","Reason could not start the desktop session bus.")}async function be(t,e,r){let o=t.platform==="darwin-arm64"?async()=>await Ie(t.nativeHost,e,r)!==null:async()=>await Ce(t.nativeHost,["info"],e,5000)===0;if(await o())return;let s=["--profile-directory=Default",`--load-extension=${t.extensionDir}`,"--no-first-run","--no-default-browser-check","--window-size=1280,800","about:blank"],a,c=null,i=0;if(t.platform==="darwin-arm64"){let n=b(r,"browser-profile");z(n);let l=b(n,"NativeMessagingHosts");fe(l,{recursive:!0,mode:448});let u=wt(t.platform).nativeHostManifests[0];de(u,b(l,le(u)));let m=t.browser.slice(0,t.browser.indexOf(".app/")+4),S=s.filter((B)=>B!=="about:blank").concat("--no-startup-window","--use-mock-keychain");a=I("/usr/bin/open",["-g","-n","-a",m,"--args",`--user-data-dir=${n}`,...S],{env:e,stdio:"ignore"})}else{let n=b(e.HOME,".config","google-chrome"),l=b(n,"NativeMessagingHosts");fe(l,{recursive:!0,mode:448});let u=wt(t.platform).nativeHostManifests[0];de(u,b(l,le(u)));let m=process.geteuid?.()===0?["--no-sandbox"]:[];c=b(r,"browser.log");let S=vr(c,"a",384);i=Er(S).size,a=I(t.browser,[`--user-data-dir=${n}`,...s,...m,"--force-renderer-accessibility"],{detached:!0,stdio:["ignore",S,S],env:{...e,ACCESSIBILITY_ENABLED:"1"}}),Vr(S)}let d=!1;a.once("error",()=>{d=!0}),a.once("exit",(n)=>{d||=n!==0}),a.unref();let f=!1;if(await $e(async()=>d||(f=await o()),_o),!f){if(c&&ge(c).subarray(i).toString("utf8").includes("No usable sandbox"))throw new _("automation_browser_sandbox_unavailable","Chromium found no usable sandbox on this machine. Run the worker as a non-root user with unprivileged user namespaces enabled, or in a container with seccomp unconfined.");throw new _("automation_browser_unavailable","Reason could not connect the desktop browser.")}}async function Vs(t){await Ge(t,!0)}function Es(t){return Fe(t,Re(t))}function Fe(t,e){return t.platform==="darwin-arm64"?b(e,"browser-profile"):b(e,"home",".config","google-chrome")}function Re(t){let e=b(t.root,"automation");if(!ut(e)||!Co(t.automation))return t.automation;if(!Bo(Fe(t,e)))try{eo(e,t.automation)}catch{}return ut(e)?e:t.automation}function Co(t){try{return V(t).length===0}catch(e){return e.code==="ENOENT"}}function Bo(t){let e;try{e=to(b(t,"SingletonLock"))}catch{return!1}let r=Number(e.slice(e.lastIndexOf("-")+1));if(!Number.isSafeInteger(r)||r<=0)return!0;try{return process.kill(r,0),!0}catch(o){return o.code==="EPERM"}}async function Ge(t,e){pe({root:t.root,automation:t.automation,extensionDir:t.extensionDir});let r=Re(t);z(r);let o=Te().username,s={USER:o,LOGNAME:o,REASON_AUTOMATION_OCU:t.ocu,REASON_AUTOMATION_OBU:t.nativeHost};if(t.platform==="darwin-arm64"){let n={...s,HOME:q(),PATH:`${mt(t.node)}:/usr/bin:/bin:/usr/sbin:/sbin`,REASON_AUTOMATION_OCU:process.execPath,REASON_AUTOMATION_OCU_SUBCOMMAND:bo};if(!e)return n;await lt("browser",()=>be(t,n,r));let l=await Ie(t.nativeHost,n,r);if(!l)throw new _("automation_browser_unavailable","Reason could not connect the desktop browser.");return{...n,REASON_AUTOMATION_OBU_INSTANCE:l,REASON_AUTOMATION_BACKGROUND_TABS:"1"}}let a=await Je(),c=b(r,"home"),i=b(r,"runtime");z(c),z(i);let d=b(r,"bus"),f={...s,HOME:c,PATH:`${mt(t.node)}:/usr/bin:/bin`,DISPLAY:a.display,XAUTHORITY:a.xauthority,XDG_RUNTIME_DIR:i,DBUS_SESSION_BUS_ADDRESS:`unix:path=${d}`,...a.sound?{PULSE_SERVER:Ne(a.sound)}:{}};if(await lt("bus",()=>qo(d,f)),e)await lt("browser",()=>be(t,f,r));return f}async function Io(t,e,r){let o=Te().username,s={USER:o,LOGNAME:o,HOME:q(),PATH:`${mt(t.node)}:/usr/bin:/bin:/usr/sbin:/sbin`,REASON_AUTOMATION_OBU:e,REASON_AUTOMATION_BACKGROUND_TABS:"1"},a=await To(e,s);return r.throwIfAborted(),{...s,REASON_AUTOMATION_OBU_INSTANCE:a}}function Ue(t,e,r,o){if(typeof _e!=="string")return Promise.reject(new _("automation_unavailable","This Reason build has no automation runtime."));let s=_e;return new Promise((a,c)=>{let i=I(t,["--input-type=module","--eval",s],{env:{...e,REASON_CLOUD_GATEWAY_EXEC:"1",REASON_AUTOMATION_INLINE_RESULT:"1"},stdio:["pipe","pipe","pipe"],detached:!0}),d=[],f=0,n="",l=null,u=!1,m=(w)=>{l??=w;try{process.kill(-i.pid,"SIGKILL")}catch{i.kill("SIGKILL")}},S=(w)=>{if(u)return;u=!0,clearTimeout(B),o.removeEventListener("abort",g),w()},B=setTimeout(()=>m(new _("automation_timed_out","Reason automation did not finish in time.")),no),g=()=>m(new _("cancelled","Reason cancelled the automation call."));if(o.addEventListener("abort",g,{once:!0}),i.stdout.on("data",(w)=>{if(f+=w.byteLength,f>ao)m(new _("automation_output_too_large","Reason automation output is too large."));else d.push(w)}),i.stderr.setEncoding("utf8").on("data",(w)=>{n=(n+w).slice(-io)}),i.stdin.on("error",()=>{}),i.once("error",()=>S(()=>c(l??new _("automation_unavailable","Reason could not start the automation runtime.")))),i.once("close",(w)=>S(()=>{if(l)c(l);else a({code:w??1,stdout:Buffer.concat(d),stderr:n})})),o.aborted)g();i.stdin.end(r)})}var C=new Map;function $o(t,e,r){for(let[s,a]of C)if(a.expiresAt<=r)C.delete(s);while(C.size>=lo)C.delete(C.keys().next().value);let o=Oe();return C.set(o,{runId:t,bytes:e,expiresAt:r+fo}),o}async function Le(t,e,r,o={}){let s=await(o.environment??Ge)(t,e.kind==="browser");return r.throwIfAborted(),await(o.runtime??Ue)(t.node,s,JSON.stringify(e),r)}async function vs(t,e){let r=qe({call:t});if(!("call"in r))K();let o=$();if(!o?.features.computer||r.call.kind==="browser"&&!o.features.browser)throw new _("automation_unavailable","Run `reason desktop install` on this machine to enable computer and browser use.");return await Le(o,r.call,e)}function we(t,e,r){let o=t.stdout.byteLength>bt?$o(e,t.stdout,r):void 0;return{code:t.code,stderr:t.stderr,instance_id:mo,output_bytes:t.stdout.byteLength,chunk:t.stdout.subarray(0,bt).toString("base64"),...o?{output_id:o}:{}}}async function ta(t,e={}){let r=qe(t.payload),o=(e.now??Date.now)();if("output_id"in r){let m=C.get(r.output_id);if(!m||m.runId!==t.runId||m.expiresAt<=o||r.offset>m.bytes.byteLength)throw new _("automation_output_unavailable","Reason automation output expired.");return{chunk:m.bytes.subarray(r.offset,r.offset+bt).toString("base64")}}let s=(e.components??$)(),a=(e.platform??process.platform)==="darwin",c=a?(e.macIdentity??xt)():[],i=e.macSetup??X,d=!s?.features.computer||r.call.kind==="browser"&&!r.userChrome&&!s.features.browser;if(a&&(d||c.length===0||r.call.kind==="browser"&&r.userChrome&&!t.userChrome))return we(await ce({runId:t.runId,call:r.call,identity:c,desktopMissing:d,signal:t.signal},i),t.runId,o);if(!s?.features.computer)throw new _("automation_unavailable","Run `reason desktop install` on this machine to enable computer and browser use.");let f=r.userChrome?t.userChrome:void 0;if(r.userChrome&&!f)throw new _("automation_user_chrome_unavailable","Your own Chrome is not enabled on this computer: run `reason desktop install` on this Mac (and `reason connect --user-chrome on` if you turned it off).");if(r.call.kind==="browser"&&!f&&!s.features.browser)throw new _("automation_browser_not_installed",s.platform==="darwin-arm64"?"Browser use is unavailable on this machine: re-run `reason desktop install`.":"Browser use is unavailable on this machine: install a non-snap Chromium at /usr/bin/chromium, then re-run `reason desktop install`.");t.signal.throwIfAborted();let n=await ye(t.runId,t.signal,e.now),l="account"in e?e.account??null:Se(),u;try{if(f){let m=await(e.userChromeEnvironment??Io)(s,f,t.signal);t.signal.throwIfAborted(),u=await(e.runtime??Ue)(s.node,m,JSON.stringify(r.call),t.signal)}else if(l)u=await(e.delegate??Nt)(l,r.call,t.signal);else u=await Le(s,r.call,t.signal,e)}finally{n()}if(a)u=await ne({runId:t.runId,call:r.call,identity:c,output:u,signal:t.signal},i);return we(u,t.runId,o)}
-export{Ut as Hc,at as Ic,Dt as Jc,A as Kc,Mt as Lc,cs as Mc,kt as Nc,ns as Oc,dt as Pc,Ur as Qc,ds as Rc,fs as Sc,ls as Tc,_s as Uc,us as Vc,ms as Wc,We as Xc,bt as Yc,qe as Zc,Ws as _c,xo as $c,Hs as ad,Ks as bd,go as cd,To as dd,Vs as ed,Es as fd,vs as gd,ta as hd};
+export{Ut as Jc,at as Kc,Dt as Lc,A as Mc,Mt as Nc,cs as Oc,kt as Pc,ns as Qc,dt as Rc,Ur as Sc,ds as Tc,fs as Uc,ls as Vc,_s as Wc,us as Xc,ms as Yc,We as Zc,bt as _c,qe as $c,Ws as ad,xo as bd,Hs as cd,Ks as dd,go as ed,To as fd,Vs as gd,Es as hd,vs as id,ta as jd};

package/bin/vm-hands/{vm-hands-entry-lite-vx5y8jc7.js → vm-hands-entry-lite-png3h0cm.js}

@@ -1,3 +1,3 @@
 // @bun
 var j={REASON_API_KEY:"ARA_API_KEY",REASON_API_URL:"ARA_API_URL",REASON_CLI_CHANNEL:"ARA_CLI_CHANNEL",REASON_CLI_LAUNCHER_PATH:"ARA_CLI_LAUNCHER_PATH",REASON_MANAGED_RUNTIME_ROOT:"ARA_MANAGED_RUNTIME_ROOT",REASON_INSTALL_ALIAS_PATH:"ARA_INSTALL_ALIAS_PATH",REASON_INSTALL_DIR:"ARA_INSTALL_DIR",REASON_INSTALL_METHOD:"ARA_INSTALL_METHOD",REASON_INSTALL_PINNED_VERSION:"ARA_INSTALL_PINNED_VERSION",REASON_INSTALL_UPGRADE:"ARA_INSTALL_UPGRADE"},mJ=Object.values(j),UJ=new Set;function m(J,Q){let V=J[Q];if(V?.trim())return V;let Z=J[j[Q]];if(Z?.trim())UJ.add(j[Q]);return Z}function DJ(J,Q){return{[J]:Q,[j[J]]:Q}}import{basename as PJ}from"path";var x=["production","staging"],GJ="https://api.reasonmachines.com",HJ="https://staging-api.reasonmachines.com";var f={production:{api:"https://api.reasonmachines.ai",app:"https://reasonmachines.ai"},staging:{api:"https://staging-api.reasonmachines.ai",app:"https://staging.reasonmachines.ai"}},RJ=new Set(["ara-staging","reason-staging"]);function lJ(J={}){let Q=m(J.env??process.env,"REASON_CLI_CHANNEL")?.trim().toLowerCase();if(Q){if(x.includes(Q))return Q;throw Error(`Unknown Reason CLI channel: ${Q}`)}let V=PJ(J.executablePath??process.execPath).toLowerCase();return RJ.has(V)?"staging":"production"}function I(J){return J==="staging"?HJ:GJ}function iJ(J){return`${I(J)}/mcp/ara`}var s={production:["https://api.ara.so",f.production.api],staging:["https://api-staging.ara.so",f.staging.api]};function y(J){let Q;try{Q=new URL(J).origin}catch{return J}let V=x.find((Z)=>s[Z].includes(Q));return V?I(V):Q}function rJ(J,Q){return J===Q||y(J)===y(Q)}function oJ(J,Q){return x.some((V)=>s[V].includes(J)&&Q===I(V))}function aJ(J,Q){try{let V=new URL(Q);return!V.username&&!V.password&&(V.origin===I(J)||V.origin===f[J].api)}catch{return!1}}function tJ(J){try{let Q=new URL(J).hostname.replace(/^\[|\]$/g,"").toLowerCase();return Q==="localhost"||Q==="127.0.0.1"||Q==="::1"}catch{return!1}}import{randomBytes as VJ}from"crypto";import{chmodSync as ZJ,closeSync as a,constants as FJ,linkSync as $J,lstatSync as A,mkdirSync as XJ,openSync as CJ,readdirSync as H,readFileSync as t,readlinkSync as E,renameSync as _,rmdirSync as KJ,symlinkSync as k,unlinkSync as U}from"fs";import{createRequire as OJ}from"module";import{constants as bJ}from"os";import{basename as O,join as K,sep as jJ}from"path";import{existsSync as N,lstatSync as l,readdirSync as EJ,readFileSync as TJ,readlinkSync as kJ,realpathSync as _J}from"fs";import{join as L,sep as AJ}from"path";function i(J,...Q){let V=L(J,"ara"),Z=L(J,"reason");if(!r(V))return L(Z,...Q);if(!N(Z))return L(V,...Q);return N(L(V,...Q))&&!N(L(Z,...Q))?L(V,...Q):L(Z,...Q)}function r(J){try{let Q=l(J);if(!Q.isSymbolicLink())return Q.isDirectory();return kJ(J)!=="reason"&&N(J)}catch{return!1}}function o(J,Q=[]){if(!r(J))return!1;let V;try{V=[J,...EJ(J,{withFileTypes:!0}).filter((Z)=>Z.isDirectory()).map((Z)=>L(J,Z.name))]}catch{return!1}return V.some((Z)=>["connect","connect-once"].filter(($)=>!Q.includes(L(Z,$))).some(($)=>{let z=L(Z,$,"worker.json");try{l(z)}catch{return!1}try{let q=JSON.parse(TJ(z,"utf8"))?.stateDirectory;if(typeof q!=="string")return!0;let M=(X,B)=>X===B||X.startsWith(B+AJ);return M(q,J)||M(c(q),c(J))}catch{return!0}}))}function c(J){try{return _J(J)}catch{return J}}var v=new Set(["credentials.json","local-device.json","local-device.revoked.json","local-device.auth-migration.json","local-device.json.registration-pending.json","local-daemon.json","local-daemon.json.workspaces.json","local-root-fingerprint-key.json","instances","workspaces"]),g=new Set(["local-device.proxy.json"]),IJ=new Set(["local-device.key","local-device.binding"]),n=new Map;function NJ(J,Q,V){let Z=K(J,"ara");if(/[/\\]\.reason-ssh[/\\][^/\\]+[/\\]installer-home[/\\]\.config$/.test(J))return{state:W(Z)?.isDirectory()?"kept":"absent"};return qJ(Z,K(J,"reason"),{linkAlways:!0,kept:($)=>o($,V??[]),native:Q===void 0?LJ:()=>Q},V!==void 0)}function YQ(J,...Q){return NJ(J),i(J,...Q)}function wQ(J,Q=process.platform){let V=K(J,"Library","Logs");if(Q==="darwin")for(let Z of[""," Staging"," Development"])qJ(K(V,`Ara${Z}`),K(V,`Reason${Z}`),{linkAlways:!1,kept:()=>!1,native:LJ});return K(V,"Reason")}var zJ="config_rename_unavailable:busy";function qJ(J,Q,V,Z=!1){let $=Z?void 0:n.get(J);if($)return $;let z;try{z=SJ(J,Q,V)}catch(q){let M=`config_rename_unavailable:${G(q)??"failed"}`;try{return{state:W(J)?.isDirectory()?"kept":"absent",problem:M}}catch{return{state:"kept",problem:M}}}if(!(z.state==="absent"&&V.linkAlways)&&z.problem!==zJ&&!(z.state==="kept"&&!z.problem))n.set(J,z);return z}function SJ(J,Q,V){vJ(Q,V.native);let Z=!1;for(let $=0;$<8;$+=1){let z=W(J);if(z?.isSymbolicLink())return E(J)===O(Q)?{state:Z?"renamed":"linked"}:{state:"kept"};if(!z){if(u(Q))Y(()=>U(Q),"ENOENT");if(!(Z||V.linkAlways)||!T(Q))return{state:"absent"};let X=C(Q,"link");k(O(Q),X);try{Y(()=>_(X,J),"EISDIR","ENOTEMPTY","EEXIST","ENOTDIR")}finally{Y(()=>U(X),"ENOENT")}continue}if(!z.isDirectory())return{state:"absent"};if(V.kept(J))return e(Q),{state:"kept"};let q=V.native();if(!q)return e(Q),{state:"kept",problem:"config_rename_unavailable:no_native"};let M=fJ(q,J);if(!M)return{state:"kept",problem:zJ};try{if(A(J).isSymbolicLink())continue;let X=uJ(q,J,Q);if(X)return{state:"kept",problem:X};Z=!0}finally{M()}}throw Object.assign(Error("legacy directory rename did not settle"),{code:"unsettled"})}function uJ(J,Q,V){let Z=W(V);if(!Z||u(V)){if(!Z)k(O(V),V);try{J.exchange(Q,V)}catch(X){if(u(V))Y(()=>U(V),"ENOENT");return`config_rename_unavailable:${G(X)??"exchange_failed"}`}return null}if(!Z.isDirectory())return"config_rename_unavailable:ENOTDIR";if(Z.dev!==A(Q).dev)return"config_rename_unavailable:EXDEV";let $=[C(V,"probe"),C(V,"probe")];try{k("a",$[0]),k("b",$[1]),J.exchange($[0],$[1])}catch(X){return`config_rename_unavailable:${G(X)??"exchange_failed"}`}finally{for(let X of $)Y(()=>U(X),"ENOENT")}let z=wJ(V);for(let X of IJ){let B=W(K(V,X)),w=W(K(Q,X));if(B&&w&&B.ino!==w.ino)XJ(`${z}-replaced`,{mode:448,recursive:!0}),_(K(V,X),K(`${z}-replaced`,X))}let q={linked:new Map,unitsKept:new Set};MJ(Q,V,"",q);let M=C(V,"rename");k(O(V),M);try{J.exchange(Q,M)}catch(X){return Y(()=>U(M),"ENOENT"),`config_rename_unavailable:${G(X)??"exchange_failed"}`}return BJ(M,V,q,z),null}function h(J){return J===""||!J.includes(jJ)}function MJ(J,Q,V,Z){let $=h(V)&&S(K(Q,V),K(J,V));if($)Z.unitsKept.add(V);for(let z of H(K(J,V))){if($&&(v.has(z)||g.has(z)))continue;let q=K(V,z),M=K(J,q),X=K(Q,q),B=W(M);if(!B)continue;let w=W(X);if(B.isDirectory()){if(!w)Y(()=>XJ(X,{mode:B.mode&4095}),"EEXIST"),ZJ(X,B.mode&4095);if(T(X))MJ(J,Q,q,Z)}else if(!w){if(B.isSymbolicLink())Y(()=>k(E(M),X),"EEXIST");else if(Y(()=>$J(M,X),"EEXIST","ENOENT"))Z.linked.set(q,B.ino)}}}function vJ(J,Q){let V;try{if(!T(J))return;V=H(J)}catch{return}for(let Z of V){let $=/^\.(rename|link|probe|claim)-(\d+)-[0-9a-f]+$/.exec(Z);if(!$)continue;let z=K(J,Z),q=W(z);if(!q)continue;if(!q.isDirectory()){if(!JJ(Number($[2])))Y(()=>U(z),"ENOENT");continue}let M=Q(),X=null;if(M){try{X=M.lock(z)}catch{continue}if(!X)continue}else if(JJ(Number($[2])))continue;try{let B=C(J,"claim");if(Y(()=>_(z,B),"ENOENT"))BJ(B,J,null,wJ(J))}finally{X?.()}}}function BJ(J,Q,V,Z){for(let[$,z]of V?.linked??[])if(!W(K(J,$))&&W(K(Q,$))?.ino===z)Y(()=>U(K(Q,$)),"ENOENT");if(WJ(J,Q,"",V),Y(()=>KJ(J),"ENOTEMPTY","EEXIST"))return;_(J,Z),ZJ(Z,448)}function WJ(J,Q,V,Z){let $=h(V)&&(Z?Z.unitsKept.has(V):S(K(Q,V),K(J,V)));for(let z of H(K(J,V))){let q=K(V,z),M=K(J,q),X=K(Q,q),B=A(M),w=W(X);if(w&&B.ino===w.ino&&B.dev===w.dev){U(M);continue}if(B.isFile()&&w?.isFile()&&Z?.linked.get(q)===w.ino){_(M,X);continue}if($&&(v.has(z)||g.has(z)))continue;if(!w){if(B.isFile()){if(Y(()=>$J(M,X),"EEXIST"))U(M)}else Y(()=>_(M,X),"EEXIST","ENOTEMPTY");continue}if(B.isDirectory()&&w.isDirectory())WJ(J,Q,q,Z),Y(()=>KJ(M),"ENOTEMPTY","EEXIST")}}function LQ(J){let Q=K(J,"ara"),V=K(J,"reason");if(!T(Q)||!T(V))return null;let Z=["",...H(Q,{withFileTypes:!0}).filter(($)=>$.isDirectory()&&!$.name.startsWith(".")).map(($)=>$.name)];for(let $ of Z){let z=K(Q,$),q=K(V,$);if(!S(z,q)||!S(q,z))continue;if([...v,...g].some((X)=>d(K(z,X),K(q,X))===!1))return $}return null}function UQ(J){let Q=K(J,"ara"),V=K(J,"reason");if(!T(Q)||!T(V))return null;let Z=($)=>{for(let z of H(K(Q,$))){let q=K($,z);if(h($)&&(z==="connect"||z==="connect-once"))continue;let M=A(K(Q,q)),X=W(K(V,q));if(!X||M.ino===X.ino&&M.dev===X.dev)continue;if(M.isDirectory()&&X.isDirectory()&&!X.isSymbolicLink()){let B=Z(q);if(B!==null)return B}else if(M.isSymbolicLink()||X.isSymbolicLink()){if(!(M.isSymbolicLink()&&X.isSymbolicLink()&&E(K(Q,q))===E(K(V,q))))return q}else if(d(K(Q,q),K(V,q))!==!0)return q}return null};return Z("")}function d(J,Q){let V=W(J),Z=W(Q);if(!V&&!Z)return null;if(!V||!Z||V.isDirectory()!==Z.isDirectory())return!1;if(V.ino===Z.ino&&V.dev===Z.dev)return!0;if(V.isDirectory())return[...new Set([...H(J),...H(Q)])].every((z)=>d(K(J,z),K(Q,z))===!0);try{return t(J).equals(t(Q))}catch{return!1}}function S(J,Q){for(let V of v)if(YJ(K(J,V),K(Q,V)))return!0;return!1}function YJ(J,Q){let V=W(J);if(!V)return!1;let Z=W(Q);if(!Z)return!0;if(V.isDirectory()){if(!Z.isDirectory())return!0;return H(J).some(($)=>YJ(K(J,$),K(Q,$)))}if(V.isSymbolicLink())return!Z.isSymbolicLink()||E(J)!==E(Q);return V.ino!==Z.ino||V.dev!==Z.dev}function e(J){if(u(J))Y(()=>U(J),"ENOENT")}function wJ(J){return K(J,`.pre-rename-${new Date().toISOString().replace(/[:.]/g,"-")}-${VJ(3).toString("hex")}`)}function u(J){try{return A(J).isSymbolicLink()&&E(J)===O(J)}catch{return!1}}function T(J){let Q=W(J);return Q!==null&&Q.isDirectory()}function fJ(J,Q){for(let V=0;V<40;V+=1){let Z=J.lock(Q);if(Z)return Z;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}return null}function C(J,Q){return K(J,`.${Q}-${process.pid}-${VJ(6).toString("hex")}`)}function JJ(J){if(J===process.pid)return!1;try{return process.kill(J,0),!0}catch(Q){return G(Q)==="EPERM"}}function W(J){try{return A(J)}catch(Q){if(G(Q)==="ENOENT"||G(Q)==="ENOTDIR")return null;throw Q}}function Y(J,...Q){try{return J(),!0}catch(V){if(Q.includes(G(V)??""))return!1;throw V}}function G(J){return J instanceof Error&&"code"in J&&typeof J.code==="string"?J.code:void 0}var F,xJ=2,gJ=4,hJ=2,dJ=2,QJ=-100;function LJ(){if(F!==void 0)return F;if(F=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let J;try{J=OJ(import.meta.url)("bun:ffi")}catch{return null}let Q=process.platform==="darwin",V=Q?"__error":"__errno_location",Z=Q?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`],{FFIType:$}=J;for(let z of Z)try{let q=Q?"renamex_np":"renameat2",X=J.dlopen(z,{flock:{args:[$.i32,$.i32],returns:$.i32},[V]:{args:[],returns:$.ptr},[q]:Q?{args:[$.ptr,$.ptr,$.u32],returns:$.i32}:{args:[$.i32,$.ptr,$.i32,$.ptr,$.u32],returns:$.i32}}).symbols,B=X[V]();if(B===null)continue;let w=(R)=>{let P=J.read.i32(B),D=Object.entries(bJ.errno).find(([,b])=>b===P)?.[0]??`errno_${P}`;return Object.assign(Error(`${R} failed: ${D}`),{code:D})},p=(R)=>Buffer.from(`${R}\x00`,"utf8");return F={exchange(R,P){let D=p(R),b=p(P);if((Q?X[q](J.ptr(D),J.ptr(b),hJ):X[q](QJ,J.ptr(D),QJ,J.ptr(b),dJ))!==0)throw w("exchange")},lock(R){let P=CJ(R,FJ.O_RDONLY);if(X.flock(P,xJ|gJ)===0)return()=>a(P);let D=w("lock");if(a(P),D.code==="EWOULDBLOCK"||D.code==="EAGAIN")return null;throw D}},F}catch{}return null}
-export{m as oh,DJ as ph,x as qh,lJ as rh,I as sh,iJ as th,y as uh,rJ as vh,oJ as wh,aJ as xh,tJ as yh,r as zh,NJ as Ah,YQ as Bh,wQ as Ch,LQ as Dh,UQ as Eh,LJ as Fh};
+export{m as qh,DJ as rh,x as sh,lJ as th,I as uh,iJ as vh,y as wh,rJ as xh,oJ as yh,aJ as zh,tJ as Ah,r as Bh,NJ as Ch,YQ as Dh,wQ as Eh,LQ as Fh,UQ as Gh,LJ as Hh};

package/bin/vm-hands/{vm-hands-entry-lite-ytwa3p73.js → vm-hands-entry-lite-pqama7tv.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Lb as j,Mb as q}from"./vm-hands-entry-lite-z55phtry.js";function y(v=process.platform){if(j(),v==="linux")q("strict")}
+import{Lb as j,Mb as q}from"./vm-hands-entry-lite-t2q10vjr.js";function y(v=process.platform){if(j(),v==="linux")q("strict")}
 export{y as t};

package/bin/vm-hands/{vm-hands-entry-lite-3dh55nnz.js → vm-hands-entry-lite-rhpmp59p.js}

@@ -1,3 +1,3 @@
 // @bun
-import{oi as e}from"./vm-hands-entry-lite-ah89nzd4.js";var i=e((o,t)=>{t.exports={name:"playwright-core",version:"1.60.0",description:"A high-level API to automate web browsers",repository:{type:"git",url:"git+https://github.com/microsoft/playwright.git"},homepage:"https://playwright.dev",engines:{node:">=18"},author:{name:"Microsoft Corporation"},license:"Apache-2.0",exports:{".":{types:"./index.d.ts",import:"./index.mjs",require:"./index.js",default:"./index.js"},"./package.json":"./package.json","./lib/bootstrap":"./lib/bootstrap.js","./lib/coreBundle":"./lib/coreBundle.js","./lib/utilsBundle":"./lib/utilsBundle.js","./lib/tools/cli-client/program":"./lib/tools/cli-client/program.js"},bin:{"playwright-core":"cli.js"},types:"types/types.d.ts"}});
+import{qi as e}from"./vm-hands-entry-lite-9n6m4qgf.js";var i=e((o,t)=>{t.exports={name:"playwright-core",version:"1.60.0",description:"A high-level API to automate web browsers",repository:{type:"git",url:"git+https://github.com/microsoft/playwright.git"},homepage:"https://playwright.dev",engines:{node:">=18"},author:{name:"Microsoft Corporation"},license:"Apache-2.0",exports:{".":{types:"./index.d.ts",import:"./index.mjs",require:"./index.js",default:"./index.js"},"./package.json":"./package.json","./lib/bootstrap":"./lib/bootstrap.js","./lib/coreBundle":"./lib/coreBundle.js","./lib/utilsBundle":"./lib/utilsBundle.js","./lib/tools/cli-client/program":"./lib/tools/cli-client/program.js"},bin:{"playwright-core":"cli.js"},types:"types/types.d.ts"}});
 export{i as P};