@reason-machines/cli-linux-arm64-musl 0.2.337 → 0.2.339

package/bin/vm-hands/{vm-hands-runtime-kdtdv05m.js → vm-hands-runtime-fy69t29t.js}

@@ -1,4 +1,4 @@
 // @bun
-import{M as k,N as m,O as l}from"./vm-hands-entry-lite-8ga7m5ph.js";import{qd as v}from"./vm-hands-entry-lite-jgjvs1tq.js";import"./vm-hands-entry-lite-y06rgq4n.js";import{ri as G}from"./vm-hands-entry-lite-ah89nzd4.js";import{spawn as a}from"child_process";import{createHash as t}from"crypto";import{lstatSync as w,mkdirSync as s,readFileSync as i,statSync as e,writeFileSync as d}from"fs";var P="/run/reason-vm-hands",O="/run/reason-vm-hands/env",T="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",p="/usr/local/bin/ara-srt-exec",qj=65536,Jj=21600000;function Qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=w(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
-`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=w(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=w(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=t("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-474ad9ns.js"),import("./hands-worker-source-45asfw2g.js"),import("./network-contract-4f9xfjwz.js"),import("./device-workspace-5xp75zxs.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-t8676r1f.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],$j=new Set(["pty.start","jobs.control"]);function Xj(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
-`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){y(P),y(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-cjwaktbe.js"),import("./worker-sandbox-dhw5qf92.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-682amrtn.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:T,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let M={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{M.restatLayout=()=>q.restatLayout(),M.installEnvironment=($,B)=>q.installEnvironment($,B),M.freezeBind=($)=>q.freezeBind($),M.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,M,{envRoot:O}),h=Zj(Q),b=null,n=Promise.all([h,import("./local-capabilities-0v47dkgd.js")]).then(([q,$])=>{b=Xj(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-682amrtn.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:L.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&q==="person"&&!$.authority;if($j.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-0v47dkgd.js");return U(x,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:x,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Mj as runVmHands,Lj as parseVmHandsInit,Zj as heartbeatBody,Qj as enableBaseKeyedSrt};
+import{M as k,N as m,O as l}from"./vm-hands-entry-lite-d5n40yn3.js";import{sd as v}from"./vm-hands-entry-lite-723q0mmr.js";import"./vm-hands-entry-lite-samn6qm5.js";import{ti as G}from"./vm-hands-entry-lite-9n6m4qgf.js";import{spawn as a}from"child_process";import{createHash as t}from"crypto";import{lstatSync as w,mkdirSync as s,readFileSync as i,statSync as e,writeFileSync as d}from"fs";var P="/run/reason-vm-hands",O="/run/reason-vm-hands/env",T="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",p="/usr/local/bin/ara-srt-exec",qj=65536,Jj=21600000;function Qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=w(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
+`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=w(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=w(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=t("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-bgqecr3y.js"),import("./hands-worker-source-gffxw6cf.js"),import("./network-contract-cg7j1pz9.js"),import("./device-workspace-kmdera1y.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-08mbrn5k.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],$j=new Set(["pty.start","jobs.control"]);function Xj(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
+`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){y(P),y(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-a0tc6tgz.js"),import("./worker-sandbox-g70ryvcd.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-24hqj7yz.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:T,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let M={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{M.restatLayout=()=>q.restatLayout(),M.installEnvironment=($,B)=>q.installEnvironment($,B),M.freezeBind=($)=>q.freezeBind($),M.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,M,{envRoot:O}),h=Zj(Q),b=null,n=Promise.all([h,import("./local-capabilities-28wng5zm.js")]).then(([q,$])=>{b=Xj(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-24hqj7yz.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:L.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&q==="person"&&!$.authority;if($j.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-28wng5zm.js");return U(x,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:x,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Mj as runVmHands,Lj as parseVmHandsInit,Zj as heartbeatBody,Qj as enableBaseKeyedSrt};

package/bin/vm-hands/worker-sandbox-g70ryvcd.js

@@ -0,0 +1,2 @@
+// @bun
+import{t as a}from"./vm-hands-entry-lite-pqama7tv.js";import"./vm-hands-entry-lite-t2q10vjr.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-y4nntb2w.js";import"./vm-hands-entry-lite-9n6m4qgf.js";export{a as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-arm64-musl",
-  "version": "0.2.337",
+  "version": "0.2.339",
   "description": "Reason CLI native binary for linux-arm64-musl",
   "os": [
     "linux"

package/bin/vm-hands/api-credentials-etg0qnwq.js

@@ -1,2 +0,0 @@
-// @bun
-import{u as a,v as b,w as c,x as d,y as e}from"./vm-hands-entry-lite-hmva2yc7.js";import"./vm-hands-entry-lite-2wa0aq74.js";import"./vm-hands-entry-lite-02t1tfe7.js";import"./vm-hands-entry-lite-ffgjezmx.js";import"./vm-hands-entry-lite-y06rgq4n.js";import"./vm-hands-entry-lite-vx5y8jc7.js";import"./vm-hands-entry-lite-tcewjhvf.js";import"./vm-hands-entry-lite-6j29vkh5.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{d as resolveApiCredentials,e as requireApiCredentials,b as explicitApiOrigin,c as environmentApiKey,a as apiOriginFromEnvironment};

package/bin/vm-hands/api-j19tqbqn.js

@@ -1,2 +0,0 @@
-// @bun
-import{E as a,F as b,G as c,H as d,I as e,J as f}from"./vm-hands-entry-lite-2wa0aq74.js";import"./vm-hands-entry-lite-02t1tfe7.js";import"./vm-hands-entry-lite-y06rgq4n.js";import"./vm-hands-entry-lite-vx5y8jc7.js";import"./vm-hands-entry-lite-tcewjhvf.js";import"./vm-hands-entry-lite-6j29vkh5.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{d as sessionPlace,c as sessionMachine,e as createMachineEnrollmentTicketWithToken,f as ReasonApi,b as REASONING_EFFORTS,a as ApiError};

package/bin/vm-hands/connect-cli-d0zvjmkf.js

@@ -1,2 +0,0 @@
-// @bun
-import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-hybhzkvj.js";import"./vm-hands-entry-lite-ytwa3p73.js";import"./vm-hands-entry-lite-hmva2yc7.js";import"./vm-hands-entry-lite-2wa0aq74.js";import"./vm-hands-entry-lite-02t1tfe7.js";import"./vm-hands-entry-lite-3fddeh8v.js";import"./vm-hands-entry-lite-bpvxdk3g.js";import"./vm-hands-entry-lite-z55phtry.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-y9rzr1a3.js";import"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-ffgjezmx.js";import"./vm-hands-entry-lite-1hpmjd5x.js";import"./vm-hands-entry-lite-ewpfck9v.js";import"./vm-hands-entry-lite-jgjvs1tq.js";import"./vm-hands-entry-lite-y06rgq4n.js";import"./vm-hands-entry-lite-4kwqp4rz.js";import"./vm-hands-entry-lite-d8myh0nx.js";import"./vm-hands-entry-lite-hkw64faw.js";import"./vm-hands-entry-lite-547nmvs3.js";import"./vm-hands-entry-lite-cavgmkjf.js";import"./vm-hands-entry-lite-tmc063vj.js";import"./vm-hands-entry-lite-xd9vwd5k.js";import"./vm-hands-entry-lite-kh7w4cpj.js";import"./vm-hands-entry-lite-h12jx2e8.js";import"./vm-hands-entry-lite-vx5y8jc7.js";import"./vm-hands-entry-lite-tcewjhvf.js";import"./vm-hands-entry-lite-6j29vkh5.js";import"./vm-hands-entry-lite-rwp6km63.js";import"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};

package/bin/vm-hands/custom-endpoint-device-km6xxtg0.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ac as k,Bc as l,Cc as m,Dc as n,Ec as o,Fc as p,Gc as q,qc as a,rc as b,sc as c,tc as d,uc as e,vc as f,wc as g,xc as h,yc as i,zc as j}from"./vm-hands-entry-lite-1hpmjd5x.js";import"./vm-hands-entry-lite-y06rgq4n.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{q as isCustomEndpointDeviceFailureMessage,o as isCustomEndpointDeviceFailureCode,h as customEndpointRequestMatchesConfig,p as customEndpointDeviceFailureMessage,i as CustomEndpointDeviceRequestSchema,l as CustomEndpointDeviceReceiptSchema,j as CustomEndpointDeviceHeadersSchema,m as CustomEndpointDeviceCredentialSchema,k as CustomEndpointDeviceChunkSchema,f as CUSTOM_ENDPOINT_DEVICE_TIMEOUT_MS,g as CUSTOM_ENDPOINT_DEVICE_SAFE_HEADERS,c as CUSTOM_ENDPOINT_DEVICE_MAX_RESPONSE_BYTES,d as CUSTOM_ENDPOINT_DEVICE_MAX_CHUNKS,e as CUSTOM_ENDPOINT_DEVICE_MAX_BODY_BYTES,n as CUSTOM_ENDPOINT_DEVICE_FAILURE_CODES,b as CUSTOM_ENDPOINT_DEVICE_CHUNK_BYTES,a as CUSTOM_ENDPOINT_DEVICE_CAPABILITY};

package/bin/vm-hands/desktop-account-cjwaktbe.js

@@ -1,2 +0,0 @@
-// @bun
-import{Te as a,Ue as b,Ve as c,We as d,Xe as e}from"./vm-hands-entry-lite-d8myh0nx.js";import"./vm-hands-entry-lite-tcewjhvf.js";import"./vm-hands-entry-lite-6j29vkh5.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{b as passwdAccount,e as desktopHome,d as desktopAccount,c as configureDesktopAccount,a as DESKTOP_USER_ENV};

package/bin/vm-hands/local-automation-jkq9qqyt.js

@@ -1,2 +0,0 @@
-// @bun
-import{$c as d,Yc as a,Zc as b,_c as c,ad as e,bd as f,cd as g,dd as h,ed as i,fd as j,gd as k,hd as l}from"./vm-hands-entry-lite-ewpfck9v.js";import"./vm-hands-entry-lite-jgjvs1tq.js";import"./vm-hands-entry-lite-y06rgq4n.js";import"./vm-hands-entry-lite-4kwqp4rz.js";import"./vm-hands-entry-lite-d8myh0nx.js";import"./vm-hands-entry-lite-hkw64faw.js";import"./vm-hands-entry-lite-547nmvs3.js";import"./vm-hands-entry-lite-cavgmkjf.js";import"./vm-hands-entry-lite-tmc063vj.js";import"./vm-hands-entry-lite-xd9vwd5k.js";import"./vm-hands-entry-lite-kh7w4cpj.js";import"./vm-hands-entry-lite-h12jx2e8.js";import"./vm-hands-entry-lite-vx5y8jc7.js";import"./vm-hands-entry-lite-tcewjhvf.js";import"./vm-hands-entry-lite-6j29vkh5.js";import"./vm-hands-entry-lite-rwp6km63.js";import"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};

package/bin/vm-hands/local-capabilities-0v47dkgd.js

@@ -1,2 +0,0 @@
-// @bun
-import{ea as c,fa as d,ga as e,ha as f,ia as g,ja as h,ka as i,la as j,ma as k,na as l,oa as m,pa as n,qa as o,ra as p,sa as q,ta as r,ua as s,va as t,wa as u}from"./vm-hands-entry-lite-3fddeh8v.js";import"./vm-hands-entry-lite-bpvxdk3g.js";import"./vm-hands-entry-lite-z55phtry.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-y9rzr1a3.js";import{oc as b}from"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-ffgjezmx.js";import"./vm-hands-entry-lite-1hpmjd5x.js";import"./vm-hands-entry-lite-ewpfck9v.js";import"./vm-hands-entry-lite-jgjvs1tq.js";import"./vm-hands-entry-lite-y06rgq4n.js";import"./vm-hands-entry-lite-4kwqp4rz.js";import"./vm-hands-entry-lite-d8myh0nx.js";import"./vm-hands-entry-lite-hkw64faw.js";import"./vm-hands-entry-lite-547nmvs3.js";import"./vm-hands-entry-lite-cavgmkjf.js";import"./vm-hands-entry-lite-tmc063vj.js";import"./vm-hands-entry-lite-xd9vwd5k.js";import"./vm-hands-entry-lite-kh7w4cpj.js";import"./vm-hands-entry-lite-h12jx2e8.js";import"./vm-hands-entry-lite-vx5y8jc7.js";import"./vm-hands-entry-lite-tcewjhvf.js";import"./vm-hands-entry-lite-6j29vkh5.js";import"./vm-hands-entry-lite-rwp6km63.js";import{li as a}from"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};

package/bin/vm-hands/local-desktop-users-t01f06c6.js

@@ -1,2 +0,0 @@
-// @bun
-import{ei as a,fi as b,gi as c,hi as d,ii as e,ji as f,ki as g}from"./vm-hands-entry-lite-rwp6km63.js";import"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{f as trackDesktopRun,c as releaseLocalDesktop,a as noteLocalDesktopUse,g as holdLocalDesktop,b as forgetLocalDesktopUse,e as DESKTOP_WAIT_MS,d as DESKTOP_IDLE_MS};

package/bin/vm-hands/local-display-mac-ykh2dzvh.js

@@ -1,2 +0,0 @@
-// @bun
-import{If as a,Jf as b,Kf as c,Lf as d,Mf as e,Nf as f,Of as g}from"./vm-hands-entry-lite-tmc063vj.js";import"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{c as requestMacScreenAccess,d as parseMacWindowBounds,a as parseMacScreenStatus,e as openMacWindowBounds,g as openMacInput,b as macScreenStatus,f as MacInputTranslator};

package/bin/vm-hands/local-display-session-dczh64rd.js

@@ -1,2 +0,0 @@
-// @bun
-import{Le as a,Me as b,Ne as c,Oe as d,Pe as e,Qe as f,Re as g,Se as h}from"./vm-hands-entry-lite-4kwqp4rz.js";import"./vm-hands-entry-lite-d8myh0nx.js";import"./vm-hands-entry-lite-hkw64faw.js";import"./vm-hands-entry-lite-547nmvs3.js";import"./vm-hands-entry-lite-cavgmkjf.js";import"./vm-hands-entry-lite-tmc063vj.js";import"./vm-hands-entry-lite-xd9vwd5k.js";import"./vm-hands-entry-lite-kh7w4cpj.js";import"./vm-hands-entry-lite-h12jx2e8.js";import"./vm-hands-entry-lite-vx5y8jc7.js";import"./vm-hands-entry-lite-tcewjhvf.js";import"./vm-hands-entry-lite-6j29vkh5.js";import"./vm-hands-entry-lite-rwp6km63.js";import"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};

package/bin/vm-hands/local-pty-session-kxj5vhby.js

@@ -1,2 +0,0 @@
-// @bun
-import{Pf as a,Qf as b,Rf as c,Sf as d,Tf as e,Uf as f,Vf as g,Wf as h,Xf as i,Yf as j}from"./vm-hands-entry-lite-xd9vwd5k.js";import"./vm-hands-entry-lite-kh7w4cpj.js";import"./vm-hands-entry-lite-h12jx2e8.js";import"./vm-hands-entry-lite-vx5y8jc7.js";import"./vm-hands-entry-lite-tcewjhvf.js";import"./vm-hands-entry-lite-6j29vkh5.js";import"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{j as runLocalPtySession,e as resolvePtyWorkingDirectory,g as ptyRuntimeSupported,d as parsePtyStartPayload,h as defaultSpawnPty,f as defaultLoginShell,i as defaultConnect,a as LOCAL_PTY_MAX_SESSION_MS,c as LOCAL_PTY_MAX_SESSIONS,b as LOCAL_PTY_MAX_BUFFERED_OUTPUT_BYTES};

package/bin/vm-hands/package-9cdhcvkp.js

@@ -1,2 +0,0 @@
-// @bun
-import{P as a}from"./vm-hands-entry-lite-3dh55nnz.js";import"./vm-hands-entry-lite-ah89nzd4.js";export default a();

package/bin/vm-hands/permissions-cyjxf3as.js

@@ -1,2 +0,0 @@
-// @bun
-import{gf as a,hf as b,if as c,jf as d,kf as e,lf as f,mf as g,nf as h,of as i,pf as j}from"./vm-hands-entry-lite-hkw64faw.js";import"./vm-hands-entry-lite-547nmvs3.js";import"./vm-hands-entry-lite-cavgmkjf.js";import"./vm-hands-entry-lite-tmc063vj.js";import"./vm-hands-entry-lite-tcewjhvf.js";import"./vm-hands-entry-lite-6j29vkh5.js";import"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};

package/bin/vm-hands/version-474ad9ns.js

@@ -1,2 +0,0 @@
-// @bun
-import{qf as a,rf as b,sf as c,tf as d}from"./vm-hands-entry-lite-547nmvs3.js";import"./vm-hands-entry-lite-cavgmkjf.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};

package/bin/vm-hands/vm-hands-executor-682amrtn.js

@@ -1,10 +0,0 @@
-// @bun
-import{a as Tq}from"./vm-hands-entry-lite-wfr5mnge.js";import{$a as Lq,Fb as Uq,Ha as Bq,Jb as Fq}from"./vm-hands-entry-lite-bpvxdk3g.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-y9rzr1a3.js";import"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-jgjvs1tq.js";import"./vm-hands-entry-lite-y06rgq4n.js";import"./vm-hands-entry-lite-d8myh0nx.js";import"./vm-hands-entry-lite-cavgmkjf.js";import"./vm-hands-entry-lite-kh7w4cpj.js";import"./vm-hands-entry-lite-h12jx2e8.js";import"./vm-hands-entry-lite-vx5y8jc7.js";import"./vm-hands-entry-lite-tcewjhvf.js";import"./vm-hands-entry-lite-6j29vkh5.js";import"./vm-hands-entry-lite-rwp6km63.js";import"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";import{spawn as Cq}from"child_process";import{chmodSync as Iq,chownSync as vq,existsSync as c,lstatSync as i,mkdirSync as o,mkdtempSync as Oq,readdirSync as s,readFileSync as P,realpathSync as bq,rmdirSync as e,rmSync as hq,writeFileSync as m}from"fs";import{join as F}from"path";var Mq="/sys/fs/cgroup/reason-payload",H="vm-hands",xq="/run/ara-srt/fallbacks.jsonl",E="/reason-person",r=5000,Vq=1e4,Qq="__VM_HANDS_PROOF_DIR__",_q="__VM_HANDS_PROBE_NONCE__";class M extends Error{code;constructor(q,Q){super(Q);this.code=q}}function Hq(q,Q){if(!/^[0-9a-f-]{36}$/i.test(Q))throw new M("vm_hands_bind_invalid","bad bind id");return F(q,H,`b-${Q.toLowerCase()}`)}var gq=5000,wq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function dq(q){let Q=q.cgroup??Mq,J=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,z=new Map,K=0,C=()=>{try{let Z=P("/run/ara-srt/starts.jsonl","utf8"),$=Z.slice(K>Z.length?0:K).split(`
-`).filter(Boolean);K=Z.length;let W=$.map((T)=>{try{return Number(JSON.parse(T).elapsed_ms)||0}catch{return 0}});if(W.length)X("vm_hands.srt_server_starts",{count:W.length,elapsed_ms:W.slice(0,8)})}catch{}},j=null,g=!1,h=q.srtCgroup??"/sys/fs/cgroup/reason-srt",I=()=>{j??=Wq()},x=0,V=()=>{try{let Z=P(xq,"utf8"),$=Z.slice(x>Z.length?0:x);x=Z.length;let W=$.split(`
-`).filter(Boolean).slice(0,1000);if(!W.length)return null;let T={},L=0;for(let w of W)try{let R=JSON.parse(w),B=typeof R.code==="string"&&/^[a-z_]{1,40}$/.test(R.code)?R.code:"other";if(T[B]=(T[B]??0)+1,typeof R.elapsed_ms==="number")L=Math.max(L,R.elapsed_ms)}catch{T.unparsed=(T.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:W.length,codes:T,max_elapsed_ms:L}),{count:W.length,codes:T,max_elapsed_ms:L}}catch{return null}},f=!1,u=(Z,$,W)=>{if(f)throw Error("vm_hands_pool_held");return jq(Z,$,W)},d=(Z)=>($,W,T)=>Cq("/bin/sh",["-c",`echo $$ > ${wq(F(Z,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",$,...W],T),jq=d(F(Q,H)),l=F(Q,H,"probe"),S=(Z)=>Hq(Q,Z),Nq=(Z)=>{let $=S(Z);try{o($,{mode:493})}catch(W){if(!(W&&typeof W==="object"&&("code"in W)&&W.code==="EEXIST"))throw new M("vm_hands_bind_failed","bind cgroup")}return $},Aq=(Z)=>{try{e(S(Z))}catch{}},_=q.prespawn?Lq({spawnProcess:u,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(Z,$)=>X(Z,$??{})}):null;_?.arm();let n=_?setInterval(()=>{_.arm()},gq):null;n?.unref?.();async function a(Z){let $=G.get(Z);if(G.delete(Z),!$)return;$.abort.abort(),await $.done}return{bindCgroup:S,async startExecutor(Z){if(I(),z.set(Z.bindId,Wq()),g=!0,!Z.claim)throw new M("vm_hands_bind_invalid","an executor needs the claim it serves");await a(Z.bindId);let{claim:$,bindId:W}=Z,T=Nq(W),L=$.owner;if(!L||typeof L.device_id!=="string"||typeof $.root_id!=="string")throw new M("vm_hands_bind_invalid","claim without its owner Device or root");let w=new AbortController,R,B,N=new Promise((Y,A)=>{R=Y,B=A}),v,D=new Promise((Y)=>{v=Y}),O=Fq({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:L.device_id,rootId:$.root_id,apiOrigin:q.apiOrigin},claimOwner:$.owner,root:q.root,runId:$.run_id,operationId:$.operation_id,attemptId:$.attempt_id,payload:Object.fromEntries(Object.entries($.payload).filter(([Y])=>!Y.startsWith("vm_hands_"))),signal:w.signal,emitEvent:async(Y,A)=>{if(Y==="hands.ready"){R(A);return}if(Y==="hands.started"||Y==="hands.stopped"||Y==="hands.failed")return;await q.forward(W,Y,A)}},{...q.relayDependencies,spawnWorker:(Y)=>d(T)(Y.command,Y.args,Y.options),..._?{takePrespawnedWorker:(Y)=>{let A=_.take(Y);if(!A?.pid)return A;try{return m(F(T,"cgroup.procs"),String(A.pid)),A}catch{try{A.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:_.adopt}:{}}).then(()=>{v("executor_stopped")},(Y)=>{let A=Y&&typeof Y==="object"&&"code"in Y?String(Y.code):"executor_failed";B(new M(A,Y instanceof Error?Y.message:String(Y))),v(A)}).finally(()=>B(new M("vm_hands_executor_exited","executor ended before it was ready")));G.set(W,{abort:w,done:O,exited:D,operationId:$.operation_id,runId:$.run_id,expiresAtMs:Date.parse(String($.payload.expires_at??""))||0});let y=await N,U=y.executor_launch_id;if(typeof U!=="string")throw new M("vm_hands_bind_failed","executor ready without a launch id");return{launchId:U,readyData:y,applied:{hands_confinement:typeof $.payload.hands_confinement==="string"?$.payload.hands_confinement:null,browser_egress:$.payload.browser_egress??null}}},takeSrtFallbacks:V,executorExited(Z){return G.get(Z)?.exited??new Promise(()=>{})},freezeBind(Z){let $=S(Z);if(c(F($,"cgroup.freeze")))m(F($,"cgroup.freeze"),"1")},async killAndVerifyPayload(Z){let $=new Set(Z?.keep??[]);if($.size)return Pq(Z?.bindId??null,$);f=!0;let W=Jq();try{await Kq();let T=Promise.all([...G.keys()].map((B)=>a(B).catch(()=>{return})));C();let L=Date.now()+r;await p(Q,L,"payload"),await T;let w=(g||q.srtWarmLate?.()===!0)&&c(F(h,"cgroup.events"));if(w)await p(h,L,"srt");let R=Xq(J).filter((B)=>!b(B,E));if(j!==null){let B=qq(j).filter((N)=>N!==process.pid&&!b(N,E));if(B.length)throw X("vm_hands.kill_strays",{strays:B.slice(0,16).map((N)=>{let v="?",D="?";try{v=P(`/proc/${N}/comm`,"utf8").trim().slice(0,32)}catch{}try{D=(P(`/proc/${N}/cgroup`,"utf8").split(`
-`).find((O)=>O.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:N,comm:v,cgroup:D}})}),new M("vm_hands_kill_unverified",`${B.length} process(es) the run started survived it`);j=null}if(g=!1,w)q.onSrtReset?.();if(R.length)throw X("vm_hands.kill_survivors",{pids:R.slice(0,16)}),new M("vm_hands_kill_unverified",`${R.length} payload-uid process(es) outside the payload cgroup`);z.clear();for(let B of $q())try{e(F(Q,H,B))}catch{}}finally{f=!1,W()}if(_)setTimeout(()=>{if(!G.size)_.arm()},100).unref?.()},async killProbe(){let Z=Date.now()+r;if(c(F(l,"cgroup.events"))){await p(l,Z,"probe");try{e(l)}catch{}}let $=Zq(process.pid);if($===null)throw new M("vm_hands_kill_unverified","agent start time unreadable");await Sq(Q,$,Z);let W=(L)=>{let w=Zq(L);return w!==null&&w<=$},T=Xq(J).filter((L)=>W(L)&&!b(L,E));if(T.length)throw X("vm_hands.kill_survivors",{pids:T.slice(0,16),at:"attest"}),new M("vm_hands_kill_unverified",`${T.length} payload-uid process(es) from before this agent`);if(j!==null){let L=[Q,F(Q,H)].map((B)=>B.replace(/^\/sys\/fs\/cgroup/,"")),w=h.replace(/^\/sys\/fs\/cgroup/,""),R=qq(j).filter((B)=>B!==process.pid&&!b(B,E)&&!b(B,"/reason-vm-hands")&&!b(B,w)&&!L.some((N)=>zq(B,N)));if(R.length)throw X("vm_hands.kill_strays",{strays:R.slice(0,16).map((B)=>({pid:B})),at:"attest"}),new M("vm_hands_kill_unverified",`${R.length} process(es) the probe started survived it`);j=null}},async runProbe({nonce:Z,script:$}){if(I(),!$.includes(Qq))throw new M("vm_hands_probe_failed","probe names no proof directory");let W=q.proofParent??"/tmp/reason-vm-hands-proof";o(W,{mode:457,recursive:!0});let T=i(W);if(T.isSymbolicLink()||!T.isDirectory()||T.uid!==(process.getuid?.()??-1)||(T.mode&4095)!==457)throw new M("vm_hands_probe_failed","proof parent is not root's 0711 directory");let L=Oq(F(W,"p-")),w=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(L)||!/^[A-Za-z0-9_-]{1,128}$/.test(Z))throw new M("vm_hands_probe_failed","proof directory path or nonce");vq(L,J,J),Iq(L,448);let R=i(L).ino;try{o(l,{mode:493})}catch(D){if(!(D&&typeof D==="object"&&("code"in D)&&D.code==="EEXIST"))throw new M("vm_hands_probe_failed","probe cgroup")}let B=d(l)("/bin/bash",["-c",$.replaceAll(Qq,L).replaceAll(_q,Z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),N="";B.stdout?.on("data",(D)=>{if(N.length<16384)N+=D.toString("utf8").slice(0,16384-N.length)});let v=await new Promise((D)=>{let O=setTimeout(()=>{w=!0,B.kill("SIGKILL"),D(124)},Vq);B.once("error",()=>{clearTimeout(O),D(127)}),B.once("close",(y)=>{clearTimeout(O),D(y??1)})});return X("vm_hands.probe",{nonce_len:Z.length,exit_code:v}),{exitCode:v,markers:N,proofDirInode:R}}finally{if(!w)hq(L,{recursive:!0,force:!0})}},restatLayout(){let{session_root:Z,alias:$}=q.init.layout,W="invalid";try{Uq(Z),W="0:0:755"}catch{}let T=!1,L=-1;try{let w=i($);L=w.uid,T=W==="0:0:755"&&$===F(Z,"repo")&&!w.isSymbolicLink()&&w.isDirectory()&&bq($)===$&&w.uid===J}catch{}return{root_mode:W,alias_ok:T,owner_uid:L}},installEnvironment(Z,$){let W=G.get(Z);if(!W)throw new M("environment_unavailable","no executor owns an environment");return Bq({root:q.root,operationId:W.operationId,payload:$}).installed_revision},async stop(){if(n)clearInterval(n);_?.close(),await Promise.all([...G.keys()].map((Z)=>a(Z)))}};function $q(){try{return s(F(Q,H),{withFileTypes:!0}).filter((Z)=>Z.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(Z.name)).map((Z)=>Z.name)}catch{return[]}}async function Pq(Z,$){let W=new Set([...$].map((L)=>L.toLowerCase())),T=Jq();try{await Kq();let L=Date.now()+r,w=new Set($q().filter((U)=>!W.has(U.slice(2))).map((U)=>U.slice(2)));if(Z)w.add(Z.toLowerCase());let R=null;for(let U of w){let Y=a(U).catch(()=>{return}),A=z.get(U);if(A!==void 0)R=R===null?A:Math.min(R,A);if(c(F(S(U),"cgroup.events")))await p(S(U),L,"bind");await Y}let B=[...W].map((U)=>S(U).replace(/^\/sys\/fs\/cgroup/,"")),N=[Q,F(Q,H)].map((U)=>U.replace(/^\/sys\/fs\/cgroup/,"")),v=h.replace(/^\/sys\/fs\/cgroup/,""),D=(U)=>b(U,E)||B.some((Y)=>b(U,Y)),O=Xq(J).filter((U)=>!D(U));if(O.length)throw X("vm_hands.kill_survivors",{pids:O.slice(0,16),beside:W.size}),new M("vm_hands_kill_unverified",`${O.length} payload-uid process(es) outside a live bind`);let y=(U)=>!D(U)&&!b(U,"/reason-vm-hands")&&!b(U,v)&&!N.some((Y)=>zq(U,Y));if(R!==null){let U=qq(R).filter((Y)=>Y!==process.pid&&y(Y));if(U.length)throw X("vm_hands.kill_strays",{strays:U.slice(0,16).map((Y)=>({pid:Y})),beside:W.size}),new M("vm_hands_kill_unverified",`${U.length} process(es) the run started survived it`)}for(let U of w)z.delete(U),Aq(U)}finally{T()}}}function Zq(q,Q="/proc"){try{let J=P(F(Q,String(q),"stat"),"utf8"),X=Number(J.slice(J.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(X)?X:null}catch{return null}}function kq(q,Q="/proc"){try{let J=P(F(Q,String(q),"stat"),"utf8"),X=Number(J.slice(J.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(X)?X:null}catch{return null}}async function Sq(q,Q,J){try{m(F(q,"cgroup.freeze"),"1")}catch(X){throw new M("vm_hands_kill_unverified",`payload cgroup.freeze: ${X instanceof Error?X.message:String(X)}`)}try{for(;;){let X=fq(q).filter((z)=>Rq(z,q)),G=new Set(X.filter((z)=>{let K=Zq(z);return K!==null&&K<=Q}));for(let z=!0;z;){z=!1;for(let K of X){if(G.has(K))continue;let C=kq(K);if(C!==null&&G.has(C))G.add(K),z=!0}}if(G.size===0)return;if(Date.now()>J)throw new M("vm_hands_kill_unverified",`${G.size} previous-boot process(es) survived`);for(let z of G)try{process.kill(z,"SIGKILL")}catch{}await new Promise((z)=>setTimeout(z,10))}}finally{try{m(F(q,"cgroup.freeze"),"0")}catch{}}}function zq(q,Q,J="/proc"){try{return P(F(J,String(q),"cgroup"),"utf8").split(`
-`).find((G)=>G.startsWith("0::"))?.slice(3)===Q}catch{return!1}}function b(q,Q,J="/proc"){try{let G=P(F(J,String(q),"cgroup"),"utf8").split(`
-`).find((z)=>z.startsWith("0::"))?.slice(3)??"";return G===Q||G.startsWith(`${Q}/`)}catch{return!1}}var yq=100;function Wq(){try{return Math.floor(Number(P("/proc/uptime","utf8").split(" ")[0])*yq)}catch{return 0}}async function p(q,Q,J){try{m(F(q,"cgroup.freeze"),"1")}catch(X){throw new M("vm_hands_kill_unverified",`${J} cgroup.freeze: ${X instanceof Error?X.message:String(X)}`)}while(!/^populated 0$/m.test(P(F(q,"cgroup.events"),"utf8"))){if(Date.now()>Q)throw new M("vm_hands_kill_unverified",`${J} cgroup still populated (left frozen)`);for(let X of fq(q)){if(!Rq(X,q))continue;try{process.kill(X,"SIGKILL")}catch{}}await new Promise((X)=>setTimeout(X,10))}try{m(F(q,"cgroup.freeze"),"0")}catch(X){throw new M("vm_hands_kill_unverified",`${J} cgroup thaw: ${X instanceof Error?X.message:String(X)}`)}}function Rq(q,Q){let J=Q.replace(/^\/sys\/fs\/cgroup/,"")||"/",X="";try{X=P(`/proc/${q}/cgroup`,"utf8").split(`
-`).find((z)=>z.startsWith("0::"))??""}catch{return!1}let G=X.slice(3);return G===J||G.startsWith(`${J}/`)}function fq(q){let Q=[],J=(X)=>{try{for(let z of P(F(X,"cgroup.procs"),"utf8").split(`
-`))if(/^\d+$/.test(z))Q.push(Number(z))}catch{}let G=[];try{G=s(X,{withFileTypes:!0}).filter((z)=>z.isDirectory()).map((z)=>z.name)}catch{}for(let z of G)J(F(X,z))};return J(q),Q}function qq(q,Q="/proc"){let J=[];for(let X of s(Q)){if(!/^\d+$/.test(X))continue;let G;try{G=P(F(Q,X,"stat"),"utf8")}catch{continue}let z=G.slice(G.lastIndexOf(")")+2).split(" "),K=Number(z[1]),C=Number(z[6]),j=Number(z[19]);if(!((C&2097152)!==0||K===2||X==="2")&&z[0]!=="Z"&&j>=q)J.push(Number(X))}return J}function Xq(q,Q="/proc"){let J=[];for(let X of s(Q)){if(!/^\d+$/.test(X))continue;let G;try{G=P(F(Q,X,"status"),"utf8")}catch{continue}let z=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(G);if(z&&z.slice(1).some((K)=>Number(K)===q))J.push(Number(X))}return J}function Gq(q="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(P(q,"utf8").trim())>=1}catch{return!1}}var k=0,Dq=[],t=new Set;function Jq(){k++;let q=!1;return()=>{if(q)return;if(q=!0,--k===0)for(let Q of Dq.splice(0))Q()}}function Eq(){return k===0?Promise.resolve():new Promise((q)=>{Dq.push(q)})}async function Yq(){while(k>0)await Eq()}async function Kq(){let q=Date.now()+1000;while(t.size&&Date.now()<q)await new Promise((Q)=>setTimeout(Q,2))}function mq(q,Q){let J=Q.replace(/^\/sys\/fs\/cgroup/,"");t.add(q);let X=()=>{let G="";try{G=P(`/proc/${q}/cgroup`,"utf8").split(`
-`).find((z)=>z.startsWith("0::"))??""}catch{t.delete(q);return}if(G.slice(3)===J){t.delete(q);return}setTimeout(X,1)};X()}function nq(q){let Q={person:q.personCgroup??F("/sys/fs/cgroup",E,H),model:q.payloadCgroup??F(Mq,H)},J=q.entry??process.argv[1]??"",X={},G=(K)=>K.startsWith("model:")&&q.bindCgroup?q.bindCgroup(K.slice(6)):Q[K.startsWith("model")?"model":"person"],z=(K)=>{let C=K.startsWith("model")?"model":"person",j=new Map,g=String(q.payloadUid),h=String(q.payloadGid),I=Bun.spawn(["/bin/sh","-c",`echo $$ > ${wq(F(G(K),"cgroup.procs"))} || exit 125; exec /usr/bin/setpriv --no-new-privs --reuid=${g} --regid=${h} --clear-groups -- "$@"`,"vm-hands-op-join",process.execPath,"--no-install",J,"--vm-hands-op-runner",...C==="person"?[Tq]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:"/home/runner",...c("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(V){let f=V,u=j.get(f.id);if(!u)return;if(f.t==="event"&&f.event)u.onEvent(f.event);if(f.t==="done")j.delete(f.id),u.done(f.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});I.exited.then((V)=>{if(X[K]?.child===I)delete X[K];for(let[,f]of j)f.done({status:"failed",error_code:"vm_hands_op_runner_exited"});j.clear(),q.log?.("vm_hands.op_runner_exited",{kind:C,code:V})}),mq(I.pid,G(K));let x={child:I,pending:j};return X[K]=x,x};return{run(K,C,j,g,h){if(!Gq())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let I=K==="model"&&h&&q.bindCgroup?`model:${h.toLowerCase()}`:K,x=async()=>{while(!X[I]&&k>0)await Yq()};return x().then(async()=>{if(!X[I]&&k>0)await x()}).then(()=>new Promise((V)=>{if(!X[I]&&k>0){V({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let f=X[I]??z(I);f.pending.set(C.id,{onEvent:j,done:V}),g.addEventListener("abort",()=>{try{f.child.send({t:"cancel",id:C.id})}catch{}},{once:!0});try{f.child.send({t:"op",...C})}catch{f.pending.delete(C.id),V({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(K){if(!X[K]&&Gq())Yq().then(()=>{if(!X[K]&&k===0)z(K)})},stop(){for(let K of Object.keys(X))X[K]?.child.kill()}}}export{Hq as vmHandsBindCgroup,fq as subtreePids,Gq as ptraceProtected,qq as processesStartedSince,Xq as payloadUidProcesses,b as inCgroup,nq as createVmHandsOpRunners,dq as createVmHandsExecutor,M as VmHandsExecutorError,Qq as VM_HANDS_PROOF_DIR_TOKEN,_q as VM_HANDS_PROBE_NONCE_TOKEN,E as VM_HANDS_PERSON_CGROUP,H as VM_HANDS_PAYLOAD_JOIN,Mq as VM_HANDS_PAYLOAD_CGROUP};

package/bin/vm-hands/vm-hands-op-runner-zhndrtp2.js

@@ -1,2 +0,0 @@
-// @bun
-import{a,b,c}from"./vm-hands-entry-lite-wfr5mnge.js";import"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{b as spawnSessionPty,c as runVmHandsOpRunner,a as VM_HANDS_OP_RUNNER_PERSON_ARG};

package/bin/vm-hands/worker-sandbox-dhw5qf92.js

@@ -1,2 +0,0 @@
-// @bun
-import{t as a}from"./vm-hands-entry-lite-ytwa3p73.js";import"./vm-hands-entry-lite-z55phtry.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-sjfdhffh.js";import"./vm-hands-entry-lite-ah89nzd4.js";export{a as configureWorkerSandbox};