@reason-machines/cli-linux-arm64-musl 0.2.342 → 0.2.343

package/bin/vm-hands/{vm-hands-entry-lite-9k93fyhy.js → vm-hands-entry-lite-ypcqvygf.js}

@@ -1,3 +1,3 @@
 // @bun
 class o extends Error{code;constructor(a,r){super(r);this.code=a;this.name="LocalCapabilityError"}}
-export{o as pi};
+export{o as si};

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,2 +1,2 @@
 // @bun
-import"./vm-hands-entry-lite-g0jhbxz4.js";import"./vm-hands-entry-lite-ammwy4z8.js";import"./vm-hands-entry-lite-0r5vmp7p.js";import{vi as A}from"./vm-hands-entry-lite-hz2ww2qe.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-9yh3qjrw.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-5t6s4k63.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();
+import"./vm-hands-entry-lite-60t59y3n.js";import"./vm-hands-entry-lite-bbc5r4y1.js";import"./vm-hands-entry-lite-6z2g0td2.js";import{yi as A}from"./vm-hands-entry-lite-45cnnd8e.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-8nw0g7v3.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-bwvpt55d.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();

package/bin/vm-hands/{vm-hands-executor-4g0e4grj.js → vm-hands-executor-wqn9mnsj.js}

@@ -1,5 +1,5 @@
 // @bun
-import{a as Mq}from"./vm-hands-entry-lite-h1dtacsm.js";import{$a as Uq,Fb as Fq,Ha as Lq,Jb as Tq}from"./vm-hands-entry-lite-e26ht37z.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-f5m8cde2.js";import"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-ammwy4z8.js";import"./vm-hands-entry-lite-0r5vmp7p.js";import"./vm-hands-entry-lite-7djq90d1.js";import"./vm-hands-entry-lite-1rn52w4j.js";import"./vm-hands-entry-lite-x6tft70v.js";import"./vm-hands-entry-lite-mybm2kyz.js";import"./vm-hands-entry-lite-6qfax5p2.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-xr02bw8t.js";import"./vm-hands-entry-lite-9k93fyhy.js";import"./vm-hands-entry-lite-hz2ww2qe.js";import{spawn as Iq}from"child_process";import{chmodSync as vq,chownSync as Oq,existsSync as l,lstatSync as o,mkdirSync as e,mkdtempSync as bq,readdirSync as s,readFileSync as A,realpathSync as hq,rmdirSync as r,rmSync as xq,writeFileSync as E}from"fs";import{join as U}from"path";var wq="/sys/fs/cgroup/reason-payload",_="vm-hands",Vq="/run/ara-srt/fallbacks.jsonl",y="/reason-person",qq=5000,_q=1e4,zq="__VM_HANDS_PROOF_DIR__",Hq="__VM_HANDS_PROBE_NONCE__";class T extends Error{code;constructor(q,z){super(z);this.code=q}}function gq(q,z){if(!/^[0-9a-f-]{36}$/i.test(z))throw new T("vm_hands_bind_invalid","bad bind id");return U(q,_,`b-${z.toLowerCase()}`)}var kq=5000,Rq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function iq(q){let z=q.cgroup??wq,J=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,W=new Map,B=0,P=()=>{try{let Z=A("/run/ara-srt/starts.jsonl","utf8"),Q=Z.slice(B>Z.length?0:B).split(`
+import{a as Mq}from"./vm-hands-entry-lite-8zencenv.js";import{Gb as Fq,Ia as Lq,Kb as Tq,ab as Uq}from"./vm-hands-entry-lite-xv868vfm.js";import"./vm-hands-entry-lite-wmxksawm.js";import"./vm-hands-entry-lite-3gf1yegq.js";import"./vm-hands-entry-lite-k469tezz.js";import"./vm-hands-entry-lite-bbc5r4y1.js";import"./vm-hands-entry-lite-2c8m8m7v.js";import"./vm-hands-entry-lite-xazz63m6.js";import"./vm-hands-entry-lite-vn0r1e8c.js";import"./vm-hands-entry-lite-2mhzfg6b.js";import"./vm-hands-entry-lite-70d6f5r9.js";import"./vm-hands-entry-lite-p9eyqdq7.js";import"./vm-hands-entry-lite-3s5fdvat.js";import"./vm-hands-entry-lite-6z2g0td2.js";import"./vm-hands-entry-lite-0zr461f9.js";import"./vm-hands-entry-lite-ypcqvygf.js";import"./vm-hands-entry-lite-45cnnd8e.js";import{spawn as Iq}from"child_process";import{chmodSync as vq,chownSync as Oq,existsSync as l,lstatSync as o,mkdirSync as e,mkdtempSync as bq,readdirSync as s,readFileSync as A,realpathSync as hq,rmdirSync as r,rmSync as xq,writeFileSync as E}from"fs";import{join as U}from"path";var wq="/sys/fs/cgroup/reason-payload",_="vm-hands",Vq="/run/ara-srt/fallbacks.jsonl",y="/reason-person",qq=5000,_q=1e4,zq="__VM_HANDS_PROOF_DIR__",Hq="__VM_HANDS_PROBE_NONCE__";class T extends Error{code;constructor(q,z){super(z);this.code=q}}function gq(q,z){if(!/^[0-9a-f-]{36}$/i.test(z))throw new T("vm_hands_bind_invalid","bad bind id");return U(q,_,`b-${z.toLowerCase()}`)}var kq=5000,Rq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function iq(q){let z=q.cgroup??wq,J=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,W=new Map,B=0,P=()=>{try{let Z=A("/run/ara-srt/starts.jsonl","utf8"),Q=Z.slice(B>Z.length?0:B).split(`
 `).filter(Boolean);B=Z.length;let Y=Q.map((L)=>{try{return Number(JSON.parse(L).elapsed_ms)||0}catch{return 0}});if(Y.length)X("vm_hands.srt_server_starts",{count:Y.length,elapsed_ms:Y.slice(0,8)})}catch{}},D=null,H=!1,O=q.srtCgroup??"/sys/fs/cgroup/reason-srt",C=()=>{D??=Gq()},b=0,h=()=>{try{let Z=A(Vq,"utf8"),Q=Z.slice(b>Z.length?0:b);b=Z.length;let Y=Q.split(`
 `).filter(Boolean).slice(0,1000);if(!Y.length)return null;let L={},F=0;for(let M of Y)try{let R=JSON.parse(M),K=typeof R.code==="string"&&/^[a-z_]{1,40}$/.test(R.code)?R.code:"other";if(L[K]=(L[K]??0)+1,typeof R.elapsed_ms==="number")F=Math.max(F,R.elapsed_ms)}catch{L.unparsed=(L.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:Y.length,codes:L,max_elapsed_ms:F}),{count:Y.length,codes:L,max_elapsed_ms:F}}catch{return null}},f=!1,m=(Z,Q,Y)=>{if(f)throw Error("vm_hands_pool_held");return Nq(Z,Q,Y)},d=(Z)=>(Q,Y,L)=>Iq("/bin/sh",["-c",`echo $$ > ${Rq(U(Z,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",Q,...Y],L),Nq=d(U(z,_)),u=U(z,_,"probe"),S=(Z)=>gq(z,Z),Aq=(Z)=>{let Q=S(Z);try{e(Q,{mode:493})}catch(Y){if(!(Y&&typeof Y==="object"&&("code"in Y)&&Y.code==="EEXIST"))throw new T("vm_hands_bind_failed","bind cgroup")}return Q},Pq=(Z)=>{try{r(S(Z))}catch{}},x=q.prespawn?Uq({spawnProcess:m,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(Z,Q)=>X(Z,Q??{})}):null;x?.arm();let i=x?setInterval(()=>{x.arm()},kq):null;i?.unref?.();async function c(Z){let Q=G.get(Z);if(G.delete(Z),!Q)return;Q.abort.abort(),await Q.done}return{bindCgroup:S,async startExecutor(Z){if(C(),W.set(Z.bindId,Gq()),H=!0,!Z.claim)throw new T("vm_hands_bind_invalid","an executor needs the claim it serves");await c(Z.bindId);let{claim:Q,bindId:Y}=Z,L=Aq(Y),F=Q.owner;if(!F||typeof F.device_id!=="string"||typeof Q.root_id!=="string")throw new T("vm_hands_bind_invalid","claim without its owner Device or root");let M=new AbortController,R,K,j=new Promise(($,w)=>{R=$,K=w}),I,N=new Promise(($)=>{I=$}),V=Tq({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:F.device_id,rootId:Q.root_id,apiOrigin:q.apiOrigin},claimOwner:Q.owner,root:q.root,runId:Q.run_id,operationId:Q.operation_id,attemptId:Q.attempt_id,payload:Object.fromEntries(Object.entries(Q.payload).filter(([$])=>!$.startsWith("vm_hands_"))),signal:M.signal,emitEvent:async($,w)=>{if($==="hands.ready"){R(w);return}if($==="hands.started"||$==="hands.stopped"||$==="hands.failed")return;await q.forward(Y,$,w)}},{...q.relayDependencies,spawnWorker:($)=>d(L)($.command,$.args,$.options),...x?{takePrespawnedWorker:($)=>{let w=x.take($);if(!w?.pid)return w;try{return E(U(L,"cgroup.procs"),String(w.pid)),w}catch{try{w.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:x.adopt}:{}}).then(()=>{I("executor_stopped")},($)=>{let w=$&&typeof $==="object"&&"code"in $?String($.code):"executor_failed";K(new T(w,$ instanceof Error?$.message:String($))),I(w)}).finally(()=>K(new T("vm_hands_executor_exited","executor ended before it was ready")));G.set(Y,{abort:M,done:V,exited:N,operationId:Q.operation_id,runId:Q.run_id,expiresAtMs:Date.parse(String(Q.payload.expires_at??""))||0});let g=await j,a=g.executor_launch_id;if(typeof a!=="string")throw new T("vm_hands_bind_failed","executor ready without a launch id");return{launchId:a,readyData:g,applied:{hands_confinement:typeof Q.payload.hands_confinement==="string"?Q.payload.hands_confinement:null,browser_egress:Q.payload.browser_egress??null}}},takeSrtFallbacks:h,executorExited(Z){return G.get(Z)?.exited??new Promise(()=>{})},freezeBind(Z){let Q=S(Z);if(l(U(Q,"cgroup.freeze")))E(U(Q,"cgroup.freeze"),"1")},async killAndVerifyPayload(Z){let Q=new Set(Z?.keep??[]);if(Q.size||Z?.own)return Cq(Z?.bindId??null,Q,Z?.own===!0);f=!0;let Y=Yq();try{await Bq();let L=Promise.all([...G.keys()].map((K)=>c(K).catch(()=>{return})));P();let F=Date.now()+qq;await p(z,F,"payload"),await L;let M=(H||q.srtWarmLate?.()===!0)&&l(U(O,"cgroup.events"));if(M)await p(O,F,"srt");let R=Zq(J).filter((K)=>!v(K,y));if(D!==null){let K=Xq(D).filter((j)=>j!==process.pid&&!v(j,y));if(K.length)throw X("vm_hands.kill_strays",{strays:K.slice(0,16).map((j)=>{let I="?",N="?";try{I=A(`/proc/${j}/comm`,"utf8").trim().slice(0,32)}catch{}try{N=(A(`/proc/${j}/cgroup`,"utf8").split(`
 `).find((V)=>V.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:j,comm:I,cgroup:N}})}),new T("vm_hands_kill_unverified",`${K.length} process(es) the run started survived it`);D=null}if(H=!1,M)q.onSrtReset?.();if(R.length)throw X("vm_hands.kill_survivors",{pids:R.slice(0,16)}),new T("vm_hands_kill_unverified",`${R.length} payload-uid process(es) outside the payload cgroup`);W.clear();for(let K of Qq())try{r(U(z,_,K))}catch{}}finally{f=!1,Y()}if(x)setTimeout(()=>{if(!G.size)x.arm()},100).unref?.()},async killProbe(){let Z=Date.now()+qq;if(l(U(u,"cgroup.events"))){await p(u,Z,"probe");try{r(u)}catch{}}let Q=$q(process.pid);if(Q===null)throw new T("vm_hands_kill_unverified","agent start time unreadable");await yq(z,Q,Z);let Y=(F)=>{let M=$q(F);return M!==null&&M<=Q},L=Zq(J).filter((F)=>Y(F)&&!v(F,y));if(L.length)throw X("vm_hands.kill_survivors",{pids:L.slice(0,16),at:"attest"}),new T("vm_hands_kill_unverified",`${L.length} payload-uid process(es) from before this agent`);if(D!==null){let F=[z,U(z,_)].map((K)=>K.replace(/^\/sys\/fs\/cgroup/,"")),M=O.replace(/^\/sys\/fs\/cgroup/,""),R=Xq(D).filter((K)=>K!==process.pid&&!v(K,y)&&!v(K,"/reason-vm-hands")&&!v(K,M)&&!F.some((j)=>Wq(K,j)));if(R.length)throw X("vm_hands.kill_strays",{strays:R.slice(0,16).map((K)=>({pid:K})),at:"attest"}),new T("vm_hands_kill_unverified",`${R.length} process(es) the probe started survived it`);D=null}},async runProbe({nonce:Z,script:Q}){if(C(),!Q.includes(zq))throw new T("vm_hands_probe_failed","probe names no proof directory");let Y=q.proofParent??"/tmp/reason-vm-hands-proof";e(Y,{mode:457,recursive:!0});let L=o(Y);if(L.isSymbolicLink()||!L.isDirectory()||L.uid!==(process.getuid?.()??-1)||(L.mode&4095)!==457)throw new T("vm_hands_probe_failed","proof parent is not root's 0711 directory");let F=bq(U(Y,"p-")),M=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(F)||!/^[A-Za-z0-9_-]{1,128}$/.test(Z))throw new T("vm_hands_probe_failed","proof directory path or nonce");Oq(F,J,J),vq(F,448);let R=o(F).ino;try{e(u,{mode:493})}catch(N){if(!(N&&typeof N==="object"&&("code"in N)&&N.code==="EEXIST"))throw new T("vm_hands_probe_failed","probe cgroup")}let K=d(u)("/bin/bash",["-c",Q.replaceAll(zq,F).replaceAll(Hq,Z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),j="";K.stdout?.on("data",(N)=>{if(j.length<16384)j+=N.toString("utf8").slice(0,16384-j.length)});let I=await new Promise((N)=>{let V=setTimeout(()=>{M=!0,K.kill("SIGKILL"),N(124)},_q);K.once("error",()=>{clearTimeout(V),N(127)}),K.once("close",(g)=>{clearTimeout(V),N(g??1)})});return X("vm_hands.probe",{nonce_len:Z.length,exit_code:I}),{exitCode:I,markers:j,proofDirInode:R}}finally{if(!M)xq(F,{recursive:!0,force:!0})}},restatLayout(){let{session_root:Z,alias:Q}=q.init.layout,Y="invalid";try{Fq(Z),Y="0:0:755"}catch{}let L=!1,F=-1;try{let M=o(Q);F=M.uid,L=Y==="0:0:755"&&Q===U(Z,"repo")&&!M.isSymbolicLink()&&M.isDirectory()&&hq(Q)===Q&&M.uid===J}catch{}return{root_mode:Y,alias_ok:L,owner_uid:F}},installEnvironment(Z,Q){let Y=G.get(Z);if(!Y)throw new T("environment_unavailable","no executor owns an environment");return Lq({root:q.root,operationId:Y.operationId,payload:Q}).installed_revision},async stop(){if(i)clearInterval(i);x?.close(),await Promise.all([...G.keys()].map((Z)=>c(Z)))}};function Qq(){try{return s(U(z,_),{withFileTypes:!0}).filter((Z)=>Z.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(Z.name)).map((Z)=>Z.name)}catch{return[]}}async function Cq(Z,Q,Y=!1){let L=new Set([...Q].map((M)=>M.toLowerCase())),F=Yq();try{await Bq();let M=Date.now()+qq,R=new Set(Qq().filter(($)=>!L.has($.slice(2))).map(($)=>$.slice(2)));if(Z)R.add(Z.toLowerCase());let K=null;for(let $ of R){let w=c($).catch(()=>{return}),n=W.get($);if(n!==void 0)K=K===null?n:Math.min(K,n);if(l(U(S($),"cgroup.events")))await p(S($),M,"bind");await w}let j=[...L].map(($)=>S($).replace(/^\/sys\/fs\/cgroup/,"")),I=[z,U(z,_)].map(($)=>$.replace(/^\/sys\/fs\/cgroup/,"")),N=O.replace(/^\/sys\/fs\/cgroup/,""),V=($)=>v($,y)||j.some((w)=>v($,w)),g=Y?[]:Zq(J).filter(($)=>!V($));if(g.length)throw X("vm_hands.kill_survivors",{pids:g.slice(0,16),beside:L.size}),new T("vm_hands_kill_unverified",`${g.length} payload-uid process(es) outside a live bind`);let a=($)=>!V($)&&!v($,"/reason-vm-hands")&&!v($,N)&&!I.some((w)=>Wq($,w));if(K!==null){let $=Xq(K).filter((w)=>w!==process.pid&&a(w));if($.length)throw X("vm_hands.kill_strays",{strays:$.slice(0,16).map((w)=>({pid:w})),beside:L.size}),new T("vm_hands_kill_unverified",`${$.length} process(es) the run started survived it`)}for(let $ of R)W.delete($),Pq($)}finally{F()}}}function $q(q,z="/proc"){try{let J=A(U(z,String(q),"stat"),"utf8"),X=Number(J.slice(J.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(X)?X:null}catch{return null}}function Sq(q,z="/proc"){try{let J=A(U(z,String(q),"stat"),"utf8"),X=Number(J.slice(J.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(X)?X:null}catch{return null}}async function yq(q,z,J){try{E(U(q,"cgroup.freeze"),"1")}catch(X){throw new T("vm_hands_kill_unverified",`payload cgroup.freeze: ${X instanceof Error?X.message:String(X)}`)}try{for(;;){let X=Dq(q).filter((W)=>fq(W,q)),G=new Set(X.filter((W)=>{let B=$q(W);return B!==null&&B<=z}));for(let W=!0;W;){W=!1;for(let B of X){if(G.has(B))continue;let P=Sq(B);if(P!==null&&G.has(P))G.add(B),W=!0}}if(G.size===0)return;if(Date.now()>J)throw new T("vm_hands_kill_unverified",`${G.size} previous-boot process(es) survived`);for(let W of G)try{process.kill(W,"SIGKILL")}catch{}await new Promise((W)=>setTimeout(W,10))}}finally{try{E(U(q,"cgroup.freeze"),"0")}catch{}}}function Wq(q,z,J="/proc"){try{return A(U(J,String(q),"cgroup"),"utf8").split(`

package/bin/vm-hands/vm-hands-op-runner-8nw0g7v3.js

@@ -0,0 +1,2 @@
+// @bun
+import{a,b,c}from"./vm-hands-entry-lite-8zencenv.js";import"./vm-hands-entry-lite-ypcqvygf.js";import"./vm-hands-entry-lite-45cnnd8e.js";export{b as spawnSessionPty,c as runVmHandsOpRunner,a as VM_HANDS_OP_RUNNER_PERSON_ARG};

package/bin/vm-hands/{vm-hands-runtime-5t6s4k63.js → vm-hands-runtime-bwvpt55d.js}

@@ -1,4 +1,4 @@
 // @bun
-import{M as k,N as m,O as l}from"./vm-hands-entry-lite-g0jhbxz4.js";import{sd as v}from"./vm-hands-entry-lite-ammwy4z8.js";import"./vm-hands-entry-lite-0r5vmp7p.js";import{vi as G}from"./vm-hands-entry-lite-hz2ww2qe.js";import{spawn as a}from"child_process";import{createHash as t}from"crypto";import{lstatSync as w,mkdirSync as s,readFileSync as i,statSync as e,writeFileSync as d}from"fs";var P="/run/reason-vm-hands",O="/run/reason-vm-hands/env",T="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",p="/usr/local/bin/ara-srt-exec",qj=65536,Jj=21600000;function Qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=w(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
-`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=w(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=w(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=t("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-tny61mj7.js"),import("./hands-worker-source-tv5dj6wm.js"),import("./network-contract-6fvpv5h6.js"),import("./device-workspace-w5m2krzy.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-4qavazs4.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],$j=new Set(["pty.start","jobs.control"]);function Xj(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
-`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){y(P),y(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-ndf87vz8.js"),import("./worker-sandbox-w5jq1qzm.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-4g0e4grj.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:T,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let M={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{M.restatLayout=()=>q.restatLayout(),M.installEnvironment=($,B)=>q.installEnvironment($,B),M.freezeBind=($)=>q.freezeBind($),M.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,M,{envRoot:O}),h=Zj(Q),b=null,n=Promise.all([h,import("./local-capabilities-wnhek3h0.js")]).then(([q,$])=>{b=Xj(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-4g0e4grj.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:L.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&q==="person"&&!$.authority;if($j.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-wnhek3h0.js");return U(x,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:x,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Mj as runVmHands,Lj as parseVmHandsInit,Zj as heartbeatBody,Qj as enableBaseKeyedSrt};
+import{N as k,O as m,P as l}from"./vm-hands-entry-lite-60t59y3n.js";import{td as v}from"./vm-hands-entry-lite-bbc5r4y1.js";import"./vm-hands-entry-lite-6z2g0td2.js";import{yi as G}from"./vm-hands-entry-lite-45cnnd8e.js";import{spawn as a}from"child_process";import{createHash as t}from"crypto";import{lstatSync as w,mkdirSync as s,readFileSync as i,statSync as e,writeFileSync as d}from"fs";var P="/run/reason-vm-hands",O="/run/reason-vm-hands/env",T="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",p="/usr/local/bin/ara-srt-exec",qj=65536,Jj=21600000;function Qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=w(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
+`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=w(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=w(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=t("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-xdgmrx9d.js"),import("./hands-worker-source-9mq68whc.js"),import("./network-contract-7y9z06qs.js"),import("./device-workspace-1abchg0z.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-mm6kwqk8.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],$j=new Set(["pty.start","jobs.control"]);function Xj(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
+`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){y(P),y(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-j9pxgjn0.js"),import("./worker-sandbox-4mraqzsg.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-wqn9mnsj.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:T,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let M={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{M.restatLayout=()=>q.restatLayout(),M.installEnvironment=($,B)=>q.installEnvironment($,B),M.freezeBind=($)=>q.freezeBind($),M.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,M,{envRoot:O}),h=Zj(Q),b=null,n=Promise.all([h,import("./local-capabilities-9y6jj12c.js")]).then(([q,$])=>{b=Xj(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-wqn9mnsj.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:L.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&q==="person"&&!$.authority;if($j.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-9y6jj12c.js");return U(x,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:x,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Mj as runVmHands,Lj as parseVmHandsInit,Zj as heartbeatBody,Qj as enableBaseKeyedSrt};

package/bin/vm-hands/worker-sandbox-4mraqzsg.js

@@ -0,0 +1,2 @@
+// @bun
+import{u as a}from"./vm-hands-entry-lite-bfh3cnh2.js";import"./vm-hands-entry-lite-p7x3vnz5.js";import"./vm-hands-entry-lite-wmxksawm.js";import"./vm-hands-entry-lite-k469tezz.js";import"./vm-hands-entry-lite-ypcqvygf.js";import"./vm-hands-entry-lite-45cnnd8e.js";export{a as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-arm64-musl",
-  "version": "0.2.342",
+  "version": "0.2.343",
   "description": "Reason CLI native binary for linux-arm64-musl",
   "os": [
     "linux"

package/bin/vm-hands/api-46arm6n3.js

@@ -1,2 +0,0 @@
-// @bun
-import{E as a,F as b,G as c,H as d,I as e,J as f}from"./vm-hands-entry-lite-n76c16jk.js";import"./vm-hands-entry-lite-g3axe41b.js";import"./vm-hands-entry-lite-0r5vmp7p.js";import"./vm-hands-entry-lite-6qfax5p2.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{d as sessionPlace,c as sessionMachine,e as createMachineEnrollmentTicketWithToken,f as ReasonApi,b as REASONING_EFFORTS,a as ApiError};

package/bin/vm-hands/api-credentials-xt853vej.js

@@ -1,2 +0,0 @@
-// @bun
-import{u as a,v as b,w as c,x as d,y as e}from"./vm-hands-entry-lite-84t0sxks.js";import"./vm-hands-entry-lite-n76c16jk.js";import"./vm-hands-entry-lite-g3axe41b.js";import"./vm-hands-entry-lite-ffgjezmx.js";import"./vm-hands-entry-lite-0r5vmp7p.js";import"./vm-hands-entry-lite-6qfax5p2.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{d as resolveApiCredentials,e as requireApiCredentials,b as explicitApiOrigin,c as environmentApiKey,a as apiOriginFromEnvironment};

package/bin/vm-hands/connect-cli-w1wdrkp0.js

@@ -1,2 +0,0 @@
-// @bun
-import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-hdmwe5bp.js";import"./vm-hands-entry-lite-8tf0kw71.js";import"./vm-hands-entry-lite-84t0sxks.js";import"./vm-hands-entry-lite-n76c16jk.js";import"./vm-hands-entry-lite-g3axe41b.js";import"./vm-hands-entry-lite-ffa7xfss.js";import"./vm-hands-entry-lite-e26ht37z.js";import"./vm-hands-entry-lite-k6e9bt1m.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-f5m8cde2.js";import"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-ffgjezmx.js";import"./vm-hands-entry-lite-crh2cy1q.js";import"./vm-hands-entry-lite-tbrwer33.js";import"./vm-hands-entry-lite-ammwy4z8.js";import"./vm-hands-entry-lite-0r5vmp7p.js";import"./vm-hands-entry-lite-hbqq9f9a.js";import"./vm-hands-entry-lite-7djq90d1.js";import"./vm-hands-entry-lite-ngpcdqxk.js";import"./vm-hands-entry-lite-2r9pdqzf.js";import"./vm-hands-entry-lite-1rn52w4j.js";import"./vm-hands-entry-lite-9p8gxetg.js";import"./vm-hands-entry-lite-v674xqzd.js";import"./vm-hands-entry-lite-x6tft70v.js";import"./vm-hands-entry-lite-mybm2kyz.js";import"./vm-hands-entry-lite-6qfax5p2.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-xr02bw8t.js";import"./vm-hands-entry-lite-9k93fyhy.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};

package/bin/vm-hands/desktop-account-ndf87vz8.js

@@ -1,2 +0,0 @@
-// @bun
-import{$e as e,Xe as a,Ye as b,Ze as c,_e as d}from"./vm-hands-entry-lite-7djq90d1.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{b as passwdAccount,e as desktopHome,d as desktopAccount,c as configureDesktopAccount,a as DESKTOP_USER_ENV};

package/bin/vm-hands/hands-worker-source-tv5dj6wm.js

@@ -1,2 +0,0 @@
-// @bun
-import{bc as a,cc as b,dc as c,ec as d,fc as e,gc as f,hc as g,ic as h,jc as i}from"./vm-hands-entry-lite-f5m8cde2.js";import"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-mybm2kyz.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{e as selectCloudChildPath,a as REASON_HANDS_WORKER_VERSION,h as REASON_HANDS_WORKER_SOURCE,b as REASON_HANDS_WORKER_ENTRYPOINT,i as REASON_HANDS_WORKER_ARTIFACT_SHA256,f as REASON_HANDS_MAC_PTY_MEMBER_SOURCE,g as REASON_HANDS_LINUX_PTY_PROBE_SOURCE,d as REASON_HANDS_CLOUD_CHILD_PATH_MACOS,c as REASON_HANDS_CLOUD_CHILD_PATH_LINUX};

package/bin/vm-hands/local-automation-we5k29ph.js

@@ -1,2 +0,0 @@
-// @bun
-import{$c as b,_c as a,ad as c,bd as d,cd as e,dd as f,ed as g,fd as h,gd as i,hd as j,id as k,jd as l}from"./vm-hands-entry-lite-tbrwer33.js";import"./vm-hands-entry-lite-ammwy4z8.js";import"./vm-hands-entry-lite-0r5vmp7p.js";import"./vm-hands-entry-lite-hbqq9f9a.js";import"./vm-hands-entry-lite-7djq90d1.js";import"./vm-hands-entry-lite-ngpcdqxk.js";import"./vm-hands-entry-lite-2r9pdqzf.js";import"./vm-hands-entry-lite-1rn52w4j.js";import"./vm-hands-entry-lite-9p8gxetg.js";import"./vm-hands-entry-lite-v674xqzd.js";import"./vm-hands-entry-lite-x6tft70v.js";import"./vm-hands-entry-lite-mybm2kyz.js";import"./vm-hands-entry-lite-6qfax5p2.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-xr02bw8t.js";import"./vm-hands-entry-lite-9k93fyhy.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};

package/bin/vm-hands/local-capabilities-wnhek3h0.js

@@ -1,2 +0,0 @@
-// @bun
-import{ea as c,fa as d,ga as e,ha as f,ia as g,ja as h,ka as i,la as j,ma as k,na as l,oa as m,pa as n,qa as o,ra as p,sa as q,ta as r,ua as s,va as t,wa as u}from"./vm-hands-entry-lite-ffa7xfss.js";import"./vm-hands-entry-lite-e26ht37z.js";import"./vm-hands-entry-lite-k6e9bt1m.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-f5m8cde2.js";import{oc as b}from"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-ffgjezmx.js";import"./vm-hands-entry-lite-crh2cy1q.js";import"./vm-hands-entry-lite-tbrwer33.js";import"./vm-hands-entry-lite-ammwy4z8.js";import"./vm-hands-entry-lite-0r5vmp7p.js";import"./vm-hands-entry-lite-hbqq9f9a.js";import"./vm-hands-entry-lite-7djq90d1.js";import"./vm-hands-entry-lite-ngpcdqxk.js";import"./vm-hands-entry-lite-2r9pdqzf.js";import"./vm-hands-entry-lite-1rn52w4j.js";import"./vm-hands-entry-lite-9p8gxetg.js";import"./vm-hands-entry-lite-v674xqzd.js";import"./vm-hands-entry-lite-x6tft70v.js";import"./vm-hands-entry-lite-mybm2kyz.js";import"./vm-hands-entry-lite-6qfax5p2.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-xr02bw8t.js";import{pi as a}from"./vm-hands-entry-lite-9k93fyhy.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};

package/bin/vm-hands/local-desktop-users-qs13y705.js

@@ -1,2 +0,0 @@
-// @bun
-import{ii as a,ji as b,ki as c,li as d,mi as e,ni as f,oi as g}from"./vm-hands-entry-lite-xr02bw8t.js";import"./vm-hands-entry-lite-9k93fyhy.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{f as trackDesktopRun,c as releaseLocalDesktop,a as noteLocalDesktopUse,g as holdLocalDesktop,b as forgetLocalDesktopUse,e as DESKTOP_WAIT_MS,d as DESKTOP_IDLE_MS};

package/bin/vm-hands/local-display-session-6fev7evp.js

@@ -1,2 +0,0 @@
-// @bun
-import{Pe as a,Qe as b,Re as c,Se as d,Te as e,Ue as f,Ve as g,We as h}from"./vm-hands-entry-lite-hbqq9f9a.js";import"./vm-hands-entry-lite-7djq90d1.js";import"./vm-hands-entry-lite-ngpcdqxk.js";import"./vm-hands-entry-lite-2r9pdqzf.js";import"./vm-hands-entry-lite-1rn52w4j.js";import"./vm-hands-entry-lite-9p8gxetg.js";import"./vm-hands-entry-lite-v674xqzd.js";import"./vm-hands-entry-lite-x6tft70v.js";import"./vm-hands-entry-lite-mybm2kyz.js";import"./vm-hands-entry-lite-6qfax5p2.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-xr02bw8t.js";import"./vm-hands-entry-lite-9k93fyhy.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};

package/bin/vm-hands/local-pty-session-fakj59cv.js

@@ -1,2 +0,0 @@
-// @bun
-import{$f as i,Tf as a,Uf as b,Vf as c,Wf as d,Xf as e,Yf as f,Zf as g,_f as h,ag as j}from"./vm-hands-entry-lite-v674xqzd.js";import"./vm-hands-entry-lite-x6tft70v.js";import"./vm-hands-entry-lite-mybm2kyz.js";import"./vm-hands-entry-lite-6qfax5p2.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-9k93fyhy.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{j as runLocalPtySession,e as resolvePtyWorkingDirectory,g as ptyRuntimeSupported,d as parsePtyStartPayload,h as defaultSpawnPty,f as defaultLoginShell,i as defaultConnect,a as LOCAL_PTY_MAX_SESSION_MS,c as LOCAL_PTY_MAX_SESSIONS,b as LOCAL_PTY_MAX_BUFFERED_OUTPUT_BYTES};

package/bin/vm-hands/package-vyhgakbw.js

@@ -1,2 +0,0 @@
-// @bun
-import{P as a}from"./vm-hands-entry-lite-967c5n18.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export default a();

package/bin/vm-hands/permissions-rp0ndr13.js

@@ -1,2 +0,0 @@
-// @bun
-import{kf as a,lf as b,mf as c,nf as d,of as e,pf as f,qf as g,rf as h,sf as i,tf as j}from"./vm-hands-entry-lite-ngpcdqxk.js";import"./vm-hands-entry-lite-2r9pdqzf.js";import"./vm-hands-entry-lite-1rn52w4j.js";import"./vm-hands-entry-lite-9p8gxetg.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-9k93fyhy.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};

package/bin/vm-hands/status-k5f7hxcs.js

@@ -1,96 +0,0 @@
-// @bun
-import{d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-hdmwe5bp.js";import"./vm-hands-entry-lite-8tf0kw71.js";import{x as bq}from"./vm-hands-entry-lite-84t0sxks.js";import{J as Bq,z as Wq}from"./vm-hands-entry-lite-n76c16jk.js";import"./vm-hands-entry-lite-g3axe41b.js";import"./vm-hands-entry-lite-ffa7xfss.js";import"./vm-hands-entry-lite-e26ht37z.js";import"./vm-hands-entry-lite-k6e9bt1m.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-f5m8cde2.js";import"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-ffgjezmx.js";import"./vm-hands-entry-lite-crh2cy1q.js";import{Jc as jq}from"./vm-hands-entry-lite-tbrwer33.js";import"./vm-hands-entry-lite-ammwy4z8.js";import{Be as G}from"./vm-hands-entry-lite-0r5vmp7p.js";import"./vm-hands-entry-lite-hbqq9f9a.js";import"./vm-hands-entry-lite-7djq90d1.js";import"./vm-hands-entry-lite-ngpcdqxk.js";import{uf as R}from"./vm-hands-entry-lite-2r9pdqzf.js";import"./vm-hands-entry-lite-1rn52w4j.js";import"./vm-hands-entry-lite-9p8gxetg.js";import"./vm-hands-entry-lite-v674xqzd.js";import{mg as Qq}from"./vm-hands-entry-lite-x6tft70v.js";import"./vm-hands-entry-lite-mybm2kyz.js";import{vh as H,wh as u,xh as s}from"./vm-hands-entry-lite-6qfax5p2.js";import{Kh as l}from"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-xr02bw8t.js";import"./vm-hands-entry-lite-9k93fyhy.js";import{vi as $q}from"./vm-hands-entry-lite-hz2ww2qe.js";import{createHash as tq,randomBytes as sq}from"crypto";import{readFileSync as eq,realpathSync as zq,renameSync as aq,unlinkSync as nq,writeFileSync as q3}from"fs";import{dirname as x3,join as Aq}from"path";import{spawnSync as Mq}from"child_process";import{accessSync as _q,constants as wq,existsSync as L,mkdirSync as Lq,readFileSync as fq,renameSync as Sq,writeFileSync as hq}from"fs";import{homedir as Cq}from"os";import{delimiter as gq,dirname as mq,join as T}from"path";import{existsSync as Tq,readFileSync as Uq}from"fs";import{join as vq}from"path";var Eq=`---
-name: reason
-description: Integrate software with Reason's public REST API using a scoped API key. Use for API clients, CI, service integrations, or cloud coding-session automation.
----
-
-# Reason API
-
-Reason integrations use the public REST API. Public customer MCP is retired.
-
-Base URL: \`https://api.reasonmachines.com/v3\`
-
-- API quickstart: \`https://docs.reasonmachines.com/api-quickstart\`
-- Endpoint reference: \`https://docs.reasonmachines.com/api-reference\`
-
-## Authentication and scope
-
-1. Create a least-privilege \`ara_\` key in Reason Settings \u2192 Developers (the Code
-   / API keys picker) and keep it only in the calling service or CI secret
-   manager. Never
-   put it in source, prompts, logs, generated files, or a repository
-   environment file. A new key from that picker includes the ordinary public
-   scopes for session, skill, repo, and org reads.
-2. Send it as \`Authorization: Bearer <api-key>\`. Call \`GET /v3/self\` first
-   to resolve the key's organization before reading or mutating resources.
-3. Request only the scopes needed by the integration. Treat secret values as
-   write-only and never expose them in API responses or diagnostics.
-4. Use the endpoint reference as the source of truth for request/response
-   shapes, pagination, and error handling. Do not recreate an old MCP client,
-   route, OAuth flow, or plugin configuration. Do not connect to the retired
-   public MCP transport.
-
-## Session automation
-
-- Create and monitor sessions through the documented \`/v3/organizations/:orgId/
-  sessions\` endpoints. Return the session URL or identifier to the caller, then
-  poll or stream only as the API reference specifies.
-- Omit \`hands_mode\` for adaptive lazy Hands, or set it to \`brain_only\` when
-  physical execution must remain permanently disabled for that Conversation.
-- Keep API work idempotent where the endpoint supports it, and surface failed
-  mutations rather than retrying destructive operations blindly.
-- Scope every request to the intended organization and repository. Do not infer
-  authority from a repository name or an untrusted task payload.
-`;function m(q){return vq(q,".agents","skills","ara","SKILL.md")}function i(q){let J=m(q);return Tq(J)&&Uq(J,"utf8")===Eq}var p=["codex","claude","cursor"],r={codex:"Codex",claude:"Claude Code",cursor:"Cursor"};function pq(q,J=process.env){let x=J.PATH??"";for(let Y of x.split(gq)){if(!Y)continue;try{return _q(T(Y,q),wq.X_OK),!0}catch{}}return!1}function dq(){return{exists:pq,run(q,J,x={}){let Y=x.interactive===!0,X=Mq(q,J,{encoding:"utf8",env:process.env,stdio:Y?"inherit":"pipe"});return{status:X.status??1,stdout:Y?"":X.stdout??"",stderr:Y?X.error?.message??"":`${X.stderr??""}${X.error?`${X.error.message}
-`:""}`}}}}function O(q){return`${q.stdout}
-${q.stderr}`}function k(q){return q.status===0}function I(q,J,x,Y={}){let X=q.run(J,x,Y);if(k(X))return X;let $=O(X).trim();throw Error(`${J} ${x.join(" ")} failed${$?`: ${$}`:` with exit code ${X.status}`}`)}function uq(q=process.env){return s(H({env:q}))}function d(q,J){return q.split(/\s+/).some((x)=>e(x,J))}function w(q){return T(q,".cursor","mcp.json")}function t(q){if(!L(q))return{};try{let J=JSON.parse(fq(q,"utf8"));if(!J||typeof J!=="object"||Array.isArray(J))throw Error("top-level value must be an object");return J}catch(J){let x=J instanceof Error?J.message:String(J);throw Error(`Cursor MCP config at ${q} is invalid; refusing to overwrite it (${x})`)}}function lq(q,J){Lq(mq(q),{recursive:!0,mode:448});let x=`${q}.ara-${process.pid}.tmp`;hq(x,`${JSON.stringify(J,null,2)}
-`,{mode:384}),Sq(x,q)}function e(q,J){if(typeof q!=="string")return!1;if(q===J)return!0;try{let x=new URL(q);return["https://api.ara.so","https://api-staging.ara.so","https://api.reasonmachines.ai","https://staging-api.reasonmachines.ai","https://api.reasonmachines.com","https://staging-api.reasonmachines.com"].includes(x.origin)&&!x.username&&!x.password&&x.pathname==="/mcp/ara"&&!x.search&&!x.hash}catch{return!1}}function oq(q,J){let x=q.mcpServers?.ara;return Boolean(x&&typeof x==="object"&&!Array.isArray(x)&&e(x.url,J))}class f{runner;home;mcpUrl;constructor(q=dq(),J=Cq(),x=uq()){this.runner=q;this.home=J;this.mcpUrl=x}isAvailable(q){if(q==="codex")return this.runner.exists("codex");if(q==="claude")return this.runner.exists("claude");return this.runner.exists("cursor")||L("/Applications/Cursor.app")||L(T(this.home,"Applications","Cursor.app"))||L(w(this.home))}availableClients(){return p.filter((q)=>this.isAvailable(q))}installationPath(q){if(q==="cursor")return w(this.home);if(q==="codex")return T(this.home,".codex","plugins","cache","ara");return T(this.home,".claude","plugins","cache","ara")}sharedSkillStatus(){return{installed:i(this.home),path:m(this.home)}}status(q){let J=r[q];if(!this.isAvailable(q))return{id:q,label:J,available:!1,installed:!1,connection:null,detail:"Client not detected",legacyInstallations:[]};if(q==="cursor"){let B=w(this.home),D=oq(t(B),this.mcpUrl);return{id:q,label:J,available:!0,installed:D,connection:D?"configured":null,detail:D?`Retired Reason MCP configuration in ${B}`:`No retired Reason MCP configuration in ${B}`,legacyInstallations:[]}}if(q==="codex"){let B=this.runner.run("codex",["plugin","list"]);if(!(k(B)&&O(B).includes("ara@ara")))return{id:q,label:J,available:!0,installed:!1,connection:null,detail:"No retired Reason plugin installed",legacyInstallations:[]};let P=this.runner.run("codex",["mcp","list"]),Q=O(P).split(/\r?\n/).find((E)=>E.trimStart().startsWith("ara ")&&d(E,this.mcpUrl)),h=k(P)&&Boolean(Q),v=!k(P)?"error":Q?.includes("Not logged in")?"not_logged_in":Q?.includes("OAuth")?"oauth":Q?"configured":"unknown";return{id:q,label:J,available:!0,installed:h,connection:v,detail:Q?.trim()||"The retired Reason plugin is installed but has no verified retired MCP registration",legacyInstallations:[]}}let x=this.runner.run("claude",["plugin","list"]),Y=O(x),X=k(x)&&Y.includes("ara@ara"),$=k(x)&&Y.includes("ara-handoff@ara");if(!X&&!$)return{id:q,label:J,available:!0,installed:!1,connection:null,detail:"No retired Reason plugin installed",legacyInstallations:[]};let W=this.runner.run("claude",["mcp","list"]),K=O(W),j=K.split(/\r?\n/).find((B)=>B.includes("plugin:ara:ara")&&d(B,this.mcpUrl)),A=K.split(/\r?\n/).find((B)=>B.includes("plugin:ara-handoff:ara")&&d(B,this.mcpUrl)),U=k(W)&&Boolean(j),F=k(W)&&A?["ara-handoff@ara"]:[],S=!k(W)?"error":j?.includes("Connected")?"connected":j?.includes("Failed")?"error":j?"configured":"unknown";return{id:q,label:J,available:!0,installed:U,connection:S,detail:j?.trim()||"The retired Reason plugin is installed but has no verified retired MCP registration",legacyInstallations:F}}statuses(){return p.map((q)=>this.status(q))}logout(q){let J=this.status(q);if(!J.available||!J.installed)return`${J.label}: not connected`;if(q==="cursor")return this.uninstall("cursor").replace("removed retired Reason","signed out and removed retired Reason");if(q==="codex")return I(this.runner,"codex",["mcp","logout","ara"]),"Codex: signed out of Reason";return I(this.runner,"claude",["mcp","logout","plugin:ara:ara"]),"Claude Code: signed out of Reason"}uninstall(q){let J=this.status(q);if(!J.available||!J.installed)return`${J.label}: Reason is not installed`;if(q==="cursor"){let x=w(this.home),Y=t(x),X={...Y.mcpServers??{}};return delete X.ara,Y.mcpServers=X,lq(x,Y),`Cursor: removed retired Reason MCP from ${x}`}if(q==="codex")return I(this.runner,"codex",["plugin","remove","ara@ara"]),"Codex: removed retired ara@ara";return I(this.runner,"claude",["plugin","uninstall","ara@ara","--scope","user"]),"Claude Code: removed retired ara@ara"}removeLegacyClaudePlugin(){if(!this.runner.exists("claude"))return"Claude Code: not installed";if(!this.status("claude").legacyInstallations.includes("ara-handoff@ara"))return"Claude Code: no legacy Reason plugin found";return I(this.runner,"claude",["plugin","uninstall","ara-handoff@ara","--scope","user"]),"Claude Code: removed obsolete ara-handoff@ara"}removeRetiredInstallations(){let q=[],J=[];for(let x of p){let Y;try{Y=this.status(x)}catch(X){J.push(`${r[x]}: ${X instanceof Error?X.message:String(X)}`);continue}if(Y.installed){if(x!=="cursor")try{q.push(this.logout(x))}catch(X){J.push(`${Y.label}: ${X instanceof Error?X.message:String(X)}`)}try{q.push(this.uninstall(x))}catch(X){J.push(`${Y.label}: ${X instanceof Error?X.message:String(X)}`)}}if(x==="claude"&&Y.legacyInstallations.includes("ara-handoff@ara"))try{q.push(this.removeLegacyClaudePlugin())}catch(X){J.push(`${Y.label}: ${X instanceof Error?X.message:String(X)}`)}}if(q.length===0&&J.length===0)q.push("No retired Reason MCP configuration found.");return{messages:q,failures:J}}}function a(q){return`claude mcp add --transport http reason ${q}`}function n(q){return`codex mcp add reason --url ${q}
-codex mcp login reason`}var P3=a("https://mcp.reasonmachines.com/mcp"),y3=n("https://mcp.reasonmachines.com/mcp"),R3=`https://claude.ai/settings/connectors?add=custom&url=${encodeURIComponent("https://mcp.reasonmachines.com/mcp")}`,N3=`https://cursor.com/install-mcp?name=reason&config=${encodeURIComponent(btoa(JSON.stringify({url:"https://mcp.reasonmachines.com/mcp"})))}`;var cq="https://github.com/reason-machines/reason-plugins",E3=`Connect a coding agent to Reason over MCP
-
-Usage:
-  reason mcp             Show how to connect Claude Code, Codex, or another MCP client
-  reason mcp uninstall   Remove only this machine's registrations of the earlier, retired server
-
-Plugins for Claude Code and Codex: ${cq}
-`;function qq(q){if(!q.available)return"not detected";if(q.installed||q.legacyInstallations.length>0)return"retired configuration";return"not installed"}function iq(q,J){let x=J.toLowerCase();if(q==="codex")return x.includes("codex");if(q==="claude")return x.includes("claude");return x.includes("cursor")}function xq(q,J){return(J.mcp_connections??[]).filter((Y)=>iq(q.id,Y.client_name)).flatMap((Y)=>Y.last_used_at?[Y.last_used_at]:[]).sort().at(-1)??null}function Jq(q,J=new Date){if(!q)return"never";let x=Date.parse(q);if(!Number.isFinite(x))return"never";let Y=Math.max(0,Math.floor((J.getTime()-x)/1000));if(Y<45)return"just now";let X=Math.floor(Y/60);if(X<60)return`${X} ${X===1?"minute":"minutes"} ago`;let $=Math.floor(X/60);if($<24)return`${$} ${$===1?"hour":"hours"} ago`;let W=Math.floor($/24);return`${W} ${W===1?"day":"days"} ago`}function Xq(q){let J=q.name?.trim(),x=q.email?.trim();if(J&&x)return`${J} (${x})`;return J||x||q.id||"Reason user"}function Yq(q){let J=q.name?.trim(),x=q.slug?.trim();if(J&&x)return`${J} (${x})`;return J||x||q.id}var rq=G.enum(["granted","not_granted","unknown"]),Zq=G.object({status:rq,checkedAt:G.number().finite(),executablePath:G.string().min(1)});var J3=`Reason status
-
-Usage:
-  reason status [--json]
-
-Show the installed version, signed-in account and organization, this
-computer's connection (\`reason connect\`) and the workspaces it serves, any
-retired MCP configuration that can be cleaned up, and automatic updates.
-`,X3=5000,Y3=300000,Z3=G.object({version:G.literal(1),key:G.string(),at:G.number(),self:G.object({principal_type:G.string(),user_id:G.string().optional(),user_name:G.string().nullish(),email:G.string().nullish(),org_id:G.string(),organization_name:G.string().nullish(),organization_slug:G.string().nullish(),mcp_connections:G.array(G.object({client_id:G.string(),client_name:G.string(),last_used_at:G.string().nullable()})).optional()})}),Pq=(q)=>`${q.apiOrigin}
-${tq("sha256").update(q.accessToken).digest("hex")}`;function $3(q,J,x){try{let Y=Z3.safeParse(JSON.parse(eq(q,"utf8")));if(!Y.success||Y.data.key!==Pq(J))return null;let X=x-Y.data.at;return X>=0&&X<Y3?Y.data.self:null}catch{return null}}function G3(q,J,x,Y){let X=`${q}.${process.pid}.${sq(6).toString("hex")}.tmp`;try{let $={version:1,key:Pq(J),at:Y,self:x};q3(X,`${JSON.stringify($)}
-`,{mode:384,flag:"wx"}),aq(X,q)}catch{try{nq(X)}catch{}}}var Q3=30000;function W3(q,J=Date.now()){let x=Qq(q),Y=(()=>{if(x?.state!=="connected"&&x?.state!=="starting")return!1;try{return process.kill(x.pid,0),!0}catch{return!1}})(),X=Y&&x?.state==="connected",$=(K)=>X&&J-K>=0&&J-K<Q3,W=Zq.safeParse(x?.fullDiskAccess);return{full_disk_access:W.success&&$(W.data.checkedAt)?W.data.status:"unknown",keep_awake:{enabled:Dq(q)==="battery_and_ac",holding:x?.idleSleepHold===!0&&$(Date.parse(x.lastHeartbeatAt??""))},executable:Y&&W.success?W.data.executablePath:null}}function B3(q=H()){if(process.platform!=="darwin")return null;let J=kq(Aq(Kq(zq(l()),q),"worker.json"));return J?W3(Fq(J).daemon):null}var Gq={connected:"connected",starting:"starting",reconnecting:"reconnecting",stopping:"stopping",not_running:"not running",removed:"removed from Reason (run `reason connect` to connect it again)"};async function x1(q,J={}){let x=J.io??{stdout:process.stdout,stderr:process.stderr};if(q.includes("--help")||q.includes("-h"))return x.stdout.write(J3),0;if(q.some(($)=>$!=="--json"))return x.stderr.write(`Usage: reason status [--json]
-`),1;let Y=new AbortController,X=setTimeout(()=>Y.abort(Error("timed out reading the account")),X3);try{let $=J.now?.()??new Date,W=performance.now(),K=W,j=()=>{let Z=performance.now(),V=Math.round(Z-K);return K=Z,V},A=null,U=(Z)=>{return A=Z instanceof Error?Z.message:String(Z),null},F=await bq(J,Y.signal).catch(U),S=j(),B=F?.credentialKind==="api_key",D=F&&!B?Aq(x3(Wq(J.env??process.env)),"status-account.json"):null,P=F&&D&&q.includes("--json")?$3(D,F,$.getTime()):null,Q=P??(F?await(J.getSelf??((Z,V)=>new Bq(Z).self(V)))(F,Y.signal).catch(U):null);if(F&&Q&&!P&&D)G3(D,F,Q,$.getTime());let h=j(),v=J.manager??new f,E=q.includes("--json")?[]:v.statuses(),M=(J.loadReceipt??jq)(),_=await(J.readConnection??(()=>Hq({channel:J.channel})))().catch(()=>null),z=null;try{if(_)z=(J.readConnectionMacState??(()=>B3(J.channel??H())))()}catch{}let b=_&&z?{..._,...z}:_,C=(()=>{try{return(J.readDisconnected??(()=>Vq(zq(l()),J.channel??H())))()}catch{return!1}})(),yq=j(),o=Q?{id:Q.org_id,name:Q.organization_name??null,slug:Q.organization_slug??null}:null,N=Q?{id:Q.user_id??null,name:(B?Q.service_user_name:Q.user_name)??null,email:Q.email??null,credential:B?"api_key":"login"}:null,g=J.channel??H(),y={version:R,channel:g,api_origin:F?.apiOrigin??u(g),account:N,account_error:A,organization:o,mcp:E.map((Z)=>({client:Z.id,label:Z.label,status:qq(Z),installed_at:Z.installed?v.installationPath(Z.id):null,last_used_at:Q?xq(Z,Q):null})),connection:b,disconnected:C,installation:M?{background_mode:M.background_mode,automatic_updates:M.background_mode!=="cli_only",future_device_consent:M.device_consent?.decision??"disabled"}:null,timings_ms:{process:Math.round(W),credentials:S,account:h,local:yq,total:Math.round(performance.now()-W)}};if(q.includes("--json"))return x.stdout.write(`${JSON.stringify(y,null,2)}
-`),0;if(g==="staging")x.stdout.write(`Reason ${R}  \xB7  channel: STAGING
-`),x.stdout.write(`API: ${y.api_origin}
-`);else x.stdout.write(`Reason ${R}
-`);if(N)x.stdout.write(B?`Account: API key (REASON_API_KEY)${N.name?`: ${N.name}`:""}
-`:`Account: ${Xq(N)}
-`),x.stdout.write(`Organization: ${Yq(o)}
-`);else if(A)x.stdout.write(`Account: unavailable (${A})
-`);else x.stdout.write(`Account: signed out
-`),x.stdout.write(`Organization: none
-`);if(x.stdout.write(`
-This computer
-`),!b)x.stdout.write(C?"Disconnected. Run `reason connect` to connect it again.\n":"Not connected. Run `reason connect` to run your Sessions here.\n");else{if(x.stdout.write(`Connection: ${Gq[b.state]} (${b.name})${C?", disconnected (run `reason connect` to connect it again)":""}
-`),b.version)x.stdout.write(`Version: ${b.version}${b.version===R?"":` (${R} is installed; \`reason connect\` restarts it on that)`}
-`);if(x.stdout.write(`Folder: ${b.folder}
-`),x.stdout.write(`Sessions: ${b.sessions_running===null?"":`${b.sessions_running} running, `}${b.sessions_max===null?"every Session you start":b.sessions_max===1?"one at a time":`up to ${b.sessions_max} at once`}
-`),z){let Z=z,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-rp0ndr13.js"),{macScreenStatus:Oq}=await import("./local-display-mac-nm4a2m36.js");return Rq(await Nq({identity:()=>Iq(),grants:Oq,worker:async()=>Z}))}))().catch(()=>null);if(V)x.stdout.write(`${V}
-`);x.stdout.write(`Keep awake: ${z.keep_awake.enabled?"on":"off"}${z.keep_awake.holding?" (holding)":""}
-`)}if(b.service)x.stdout.write(`Logs: ${b.service.logs}
-`);for(let Z of b.workspaces??[]){let V=Z.state==="removed"?"removed from that workspace":Z.blocked?"offline (this computer is outside that workspace's allowed networks)":Z.device_id?Gq[Z.state]:"connecting";x.stdout.write(`Also in workspace ${Z.name??Z.organization_id}${Z.account?" (another Reason account's)":""}: ${V}
-`)}if(b.workspaces_off==="sign_in")x.stdout.write("Other workspaces: off. This computer's sign-in is not one the Reason app or the setup command\n  Reason shows you made for it (or that sign-in ended, or it is in use on another computer), so it is\n  connected in one workspace only. Run the setup command from Reason here (it ends in --pair CODE);\n  if this computer was connected before that, run `reason disconnect` and `reason connect` once.\n")}let c=y.mcp.filter((Z)=>Z.installed_at||Z.status!=="not installed");if(c.length>0)x.stdout.write(`
-Retired MCP configuration
-`);for(let Z of c)if(x.stdout.write(`${Z.label}: ${Z.status}
-`),Z.installed_at)x.stdout.write(`  Installed: ${Z.installed_at}
-`),x.stdout.write(`  Last used: ${Jq(Z.last_used_at,$)}
-`);if(y.mcp.some((Z)=>Z.status==="retired configuration"))x.stdout.write("Run `reason mcp uninstall` to remove only the retired Reason MCP registrations.\n");if(x.stdout.write(`
-Background access
-`),!y.installation)x.stdout.write(`Not managed by the Reason installer
-`);else x.stdout.write(`Automatic updates: ${y.installation.automatic_updates?"enabled":"disabled"}
-`);return 0}catch($){return x.stderr.write(`Reason status: ${$ instanceof Error?$.message:String($)}
-`),1}finally{clearTimeout(X)}}export{W3 as workerMacState,x1 as runStatusCli,B3 as connectionMacState,J3 as STATUS_HELP};

package/bin/vm-hands/vm-hands-entry-lite-8tf0kw71.js

@@ -1,3 +0,0 @@
-// @bun
-import{Lb as j,Mb as q}from"./vm-hands-entry-lite-k6e9bt1m.js";function y(v=process.platform){if(j(),v==="linux")q("strict")}
-export{y as t};

package/bin/vm-hands/vm-hands-entry-lite-x6tft70v.js

@@ -1,5 +0,0 @@
-// @bun
-import{Ah as r,Dh as y,Eh as v,Fh as t,vh as o}from"./vm-hands-entry-lite-6qfax5p2.js";import{Kh as V}from"./vm-hands-entry-lite-5b29hq7h.js";import{createHmac as CQ,createPublicKey as IQ,randomBytes as mQ,randomUUID as a,verify as gQ}from"crypto";import{chmodSync as F,existsSync as e,mkdirSync as EQ,readFileSync as hQ,realpathSync as yQ,renameSync as vQ,statSync as pQ,unlinkSync as cQ,writeFileSync as uQ}from"fs";import{basename as dQ,dirname as P,isAbsolute as QQ,join as M,resolve as lQ}from"path";var XZ=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var JQ="REASON_DESKTOP_RUNTIME",UQ="REASON_DESKTOP_RUNTIME_CHANNEL",YQ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",HQ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",YZ={[JQ]:"ARA_DESKTOP_RUNTIME",[UQ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[YQ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[HQ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function S(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as N,existsSync as U,mkdirSync as K,readFileSync as m,realpathSync as VQ,renameSync as MQ,unlinkSync as f,writeFileSync as B}from"fs";import{createPrivateKey as OQ,createPublicKey as NQ,generateKeyPairSync as KQ,randomUUID as fQ,sign as BQ}from"crypto";import{createRequire as kQ}from"module";import{homedir as AQ,platform as p}from"os";import{dirname as FQ,join as Y}from"path";import{existsSync as xQ}from"fs";import{join as C}from"path";var O="libara_device_keychain.dylib",L="libreason_device_keychain.dylib";class wQ extends Error{code;constructor(Q,Z){super(Z);this.code=Q;this.name="ManagedRuntimeError"}}function I(Q){let Z=C(Q,L);return xQ(Z)?Z:C(Q,O)}var g=1,TQ=16384,H=65536,PQ=128,_Q=128,c=65536;class X extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function u(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var k=null;function d(){if(!k)try{k=kQ(import.meta.url)("bun:ffi")}catch{throw new X("native_boundary_unavailable")}return k}function RQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function DQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new X("invalid_credential_record");let Z=Q,$=RQ(Z.apiOrigin);if(Z.version!==g||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new X("invalid_credential_record");return{version:g,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function bQ(Q=process.execPath){let Z=Q;try{Z=VQ(Q)}catch{}return I(FQ(Z))}function q(Q){return d().ptr(Q)}function SQ(Q){if(!U(Q))throw new X("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=d();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(W){if(W instanceof X)throw W;throw new X("native_boundary_unavailable")}}function E(Q){return Buffer.from(Q).toString("base64url")}function w(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function l(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class i{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=bQ(),Z=p(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;S($)}symbols(){if(this.runtimePlatform!=="darwin")throw new X("unsupported_platform");this.library??=SQ(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(q(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new X("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(PQ),$=new BigUint64Array(1),W=Q==="load"?this.symbols().ara_device_key_load_public(q(Z),BigInt(Z.byteLength),q($)):this.symbols().ara_device_key_create_fresh_public(q(Z),BigInt(Z.byteLength),q($));if(W!==0)throw new X(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",W);let z=Number($[0]);if(!Number.isSafeInteger(z)||z!==65)throw new X("invalid_public_key");let j=E(Z.subarray(0,z));if(!w(j))throw new X("invalid_public_key");return j}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>c)throw new X("proof_sign_failed");let Z=new Uint8Array(_Q),$=new BigUint64Array(1),W=this.symbols().ara_device_key_sign(q(Q),BigInt(Q.byteLength),q(Z),BigInt(Z.byteLength),q($));if(W!==0)throw new X("proof_sign_failed",W);let z=Number($[0]);if(!Number.isSafeInteger(z)||z<1||z>Z.byteLength)throw new X("invalid_signature");let j=Z.subarray(0,z);if(!l(j))throw new X("invalid_signature");return E(j)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(q(Q));if(Z!==0||Q[0]!==1)throw new X("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(q(Q));if(Z!==0)throw new X("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(H),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(q(Q),BigInt(Q.byteLength),q(Z));if($===1)return null;if($!==0)throw new X("binding_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new X("invalid_binding");return Q.slice(0,W)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>H)throw new X("invalid_binding");let Z=this.symbols().ara_device_binding_create(q(Q),BigInt(Q.byteLength));if(Z!==0)throw new X("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>H)throw new X("invalid_binding");let Z=this.symbols().ara_device_binding_update(q(Q),BigInt(Q.byteLength));if(Z!==0)throw new X("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(q(Q));if(Z!==0)throw new X("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array(TQ),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(q(Q),BigInt(Q.byteLength),q(Z));if($===1)return null;if($!==0)throw new X("legacy_credential_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new X("invalid_credential_record");try{let z=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,W));return DQ(JSON.parse(z))}catch(z){if(z instanceof X)throw z;throw new X("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(q(Q));if(Z!==0)throw new X("legacy_credential_delete_failed",Z);return Q[0]===1}}function h(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new X("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),W=Buffer.from(Z.y,"base64url");if($.byteLength!==32||W.byteLength!==32)throw new X("invalid_public_key");let z=Buffer.concat([Buffer.of(4),$,W]).toString("base64url");if(!w(z))throw new X("invalid_public_key");return z}function LQ(){let Q=process.env.XDG_CONFIG_HOME?.trim()||Y(AQ(),".config");v(Q);let Z=Y(Q,"ara");return y(Z)?Z:Y(Q,"reason")}class s{directory;constructor(Q=LQ()){this.directory=Q}keyPath(){return Y(this.directory,"local-device.key")}bindingPath(){return Y(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!U(Q))throw new X("proof_key_read_failed");try{let Z=m(Q,"utf8");return OQ({key:Z,format:"pem"})}catch{throw new X("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=NQ(Q);return h(Z)}createFreshPublicKey(){K(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=KQ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),W=this.keyPath();return B(W,$,{mode:384}),N(W,384),h(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>c)throw new X("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=BQ("sha256",Q,Z)}catch{throw new X("proof_sign_failed")}if(!l($))throw new X("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!U(Q))return!1;return f(Q),!0}loadBinding(){let Q=this.bindingPath();if(!U(Q))return null;try{return new Uint8Array(m(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>H)throw new X("invalid_binding");K(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(U(Z))throw new X("binding_create_failed");B(Z,Q,{mode:384}),N(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>H)throw new X("invalid_binding");K(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!U(Z))throw new X("binding_update_failed");let $=`${Z}.${fQ()}`;try{B($,Q,{mode:384,flag:"wx"}),N($,384),MQ($,Z)}finally{if(U($))f($)}}deleteBinding(){let Q=this.bindingPath();if(!U(Q))return!1;return f(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function A(){return p()==="darwin"?new i:new s}var _=4;var x="macos-keychain-p256-v1",ZQ=1,iQ=`ARA-DEVICE-BINDING-V1
-`;function sQ(Q){return Q===void 0||typeof Q==="number"&&Number.isInteger(Q)&&Q>=1&&Q<=4}function $Q(Q={},Z=V()){let $=o({env:{...process.env,...Q}}),W=Q.XDG_CONFIG_HOME?.trim()||M(Z,".config");return t(W,...$==="staging"?["staging"]:[])}function R(Q={},Z=V()){return M($Q(Q,Z),"local-device.json")}function WQ(Q={},Z=V()){return M($Q(Q,Z),"local-daemon.json")}function D(Q,Z){EQ(P(Q),{recursive:!0,mode:448}),F(P(Q),448);let $=`${Q}.${process.pid}.${a()}.tmp`;try{uQ($,`${JSON.stringify(Z,null,2)}
-`,{mode:384,flag:"wx"}),F($,384),vQ($,Q),F(Q,384)}finally{if(e($))cQ($)}return Q}function b(Q){if(!e(Q))return null;try{return JSON.parse(hQ(Q,"utf8"))}catch{return null}}function T(Q,Z,$){try{Q.onCredentialLifecycle?.({event:Z,...$?{reasonCode:$}:{}})}catch{}}function nQ(Q){if(!Array.isArray(Q))return null;let Z=[];for(let $ of Q){if(!$||typeof $!=="object")return null;let W=$;if(typeof W.id!=="string"||typeof W.label!=="string"||typeof W.path!=="string"||typeof W.pathFingerprint!=="string"||!W.permissions||typeof W.permissions.read!=="boolean"||typeof W.permissions.write!=="boolean"||typeof W.permissions.execute!=="boolean"||typeof W.permissions.discover_environment!=="boolean"||typeof W.permissions.expose_mcp!=="boolean")return null;Z.push({id:W.id,label:W.label,path:W.path,pathFingerprint:W.pathFingerprint,permissions:W.permissions})}return Z}function XQ(Q,Z,$=[]){let W=Object.keys(Q);return Z.every((z)=>Object.hasOwn(Q,z))&&W.every((z)=>Z.includes(z)||$.includes(z))}function oQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost")return null;return Z.origin}catch{return null}}function zQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q,$=nQ(Z.roots),W=oQ(Z.apiOrigin);if(!W||typeof Z.orgId!=="string"||typeof Z.deviceId!=="string"||typeof Z.displayName!=="string"||typeof Z.registeredAt!=="string"||!sQ(Z.handsSlots)||Z.worker!==void 0&&(!Z.worker||!/^[a-f0-9]{64}$/.test(Z.worker.configDigest)||!["persistent","ephemeral"].includes(Z.worker.lifetime)||!Number.isFinite(Date.parse(Z.worker.expiresAt)))||!$)return null;return{apiOrigin:W,orgId:Z.orgId,deviceId:Z.deviceId,displayName:Z.displayName,registeredAt:Z.registeredAt,...Z.handsSlots!==void 0?{handsSlots:Z.handsSlots}:{},...Z.worker!==void 0?{worker:Z.worker}:{},roots:$}}function rQ(Q){return{...Q,credentialStorage:x}}function tQ(Q){return{version:_,apiOrigin:Q.apiOrigin,orgId:Q.orgId,deviceId:Q.deviceId,devicePublicKey:Q.devicePublicKey,displayName:Q.displayName,registeredAt:Q.registeredAt,...Q.handsSlots!==void 0?{handsSlots:Q.handsSlots}:{},...Q.worker!==void 0?{worker:Q.worker}:{},roots:Q.roots.map((Z)=>({id:Z.id,label:Z.label,path:Z.path,pathFingerprint:Z.pathFingerprint,permissions:{read:Z.permissions.read,write:Z.permissions.write,execute:Z.permissions.execute,discover_environment:Z.permissions.discover_environment,expose_mcp:Z.permissions.expose_mcp}})),credentialStorage:x}}function jQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q;if(!XQ(Z,["version","apiOrigin","orgId","deviceId","devicePublicKey","displayName","registeredAt","roots","credentialStorage"],["handsSlots","worker"]))return null;let $=zQ(Z);if(!$||Z.version!==_||Z.credentialStorage!==x||!w(Z.devicePublicKey))return null;return{version:_,...$,devicePublicKey:Z.devicePublicKey,credentialStorage:x}}function qQ(Q){return new TextEncoder().encode(`${iQ}${JSON.stringify(tQ(Q))}`)}function aQ(Q){let Z=Buffer.from(Q,"base64url");return IQ({format:"jwk",key:{kty:"EC",crv:"P-256",x:Z.subarray(1,33).toString("base64url"),y:Z.subarray(33,65).toString("base64url")}})}function eQ(Q,Z){let $={version:ZQ,state:Q,signature:Z.sign(qQ(Q))};return new TextEncoder().encode(JSON.stringify($))}function GQ(Q){let Z;try{Z=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(Q))}catch{throw new X("invalid_binding")}if(!Z||typeof Z!=="object"||Array.isArray(Z))throw new X("invalid_binding");let $=Z;if(!XQ($,["version","state","signature"])||$.version!==ZQ||typeof $.signature!=="string"||!/^[A-Za-z0-9_-]{10,128}$/.test($.signature))throw new X("invalid_binding");let W=jQ($.state);if(!W)throw new X("invalid_binding");let z=!1;try{z=gQ("sha256",qQ(W),aQ(W.devicePublicKey),Buffer.from($.signature,"base64url"))}catch{z=!1}if(!z)throw new X("invalid_binding");return W}function QZ(Q){let{credentialStorage:Z,...$}=Q;return $}function ZZ(Q){return Q instanceof X?u(Q):"credential_boundary_failed"}function gZ(Q=R(),Z={}){let $=b(Q),W=Z.proofStore??Z.credentialStore??A(),z=W.loadBinding();if(!z){if($&&typeof $==="object"&&!Array.isArray($)&&$Z($))return null;if($!==null)throw new X("invalid_binding");return null}let j=GQ(z),G=W.loadPublicKey();if(W.privateKeyIsNonExtractable(),G!==j.devicePublicKey)throw new X("invalid_public_key");let J=jQ($);if(Z.repair!==!1&&(!J||JSON.stringify(J)!==JSON.stringify(j)))D(Q,j);return QZ(j)}function $Z(Q){let Z=Q,$=zQ(Q);if(!$)return null;if(Z.version===2){if(typeof Z.deviceCredential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.deviceCredential)||Z.deviceCredential.length>4096)return null;return{state:$,credentialSource:"plaintext-v2"}}if(Z.version!==3||Z.credentialStorage!=="macos-keychain-v1"||"deviceCredential"in Z)return null;return{state:$,credentialSource:"keychain-v3"}}function EZ(Q,Z=R(),$={}){let W=$.proofStore??$.credentialStore??A();T($,"credential.store_started");try{if(!w(Q.devicePublicKey)||W.loadPublicKey()!==Q.devicePublicKey)throw new X("invalid_public_key");W.privateKeyIsNonExtractable();let z=rQ(Q),j=W.loadBinding();if(j){let J=GQ(j);if(J.devicePublicKey!==Q.devicePublicKey||J.orgId!==Q.orgId||J.deviceId!==Q.deviceId||J.apiOrigin!==Q.apiOrigin&&!r(J.apiOrigin,Q.apiOrigin))throw new X("invalid_binding")}let G=eQ(z,W);if(j)W.updateBinding(G);else W.createBinding(G);return D(Z,z),T($,"credential.store_completed"),Z}catch(z){throw T($,"credential.store_failed",ZZ(z)),z}}function hZ(Q=WQ()){let Z=b(Q);if(!Z||typeof Z!=="object")return null;let $=Z;if($.version!==1||typeof $.pid!=="number"||!Number.isInteger($.pid)||!["starting","connected","stopped","error"].includes($.state??"")||typeof $.startedAt!=="string"||$.lastHeartbeatAt!==void 0&&typeof $.lastHeartbeatAt!=="string"||$.lastUsedAt!==void 0&&typeof $.lastUsedAt!=="string"||$.organizationId!==void 0&&typeof $.organizationId!=="string"||$.organizationName!==void 0&&typeof $.organizationName!=="string"||$.organizationSlug!==void 0&&typeof $.organizationSlug!=="string"||$.error!==void 0&&typeof $.error!=="string"||$.reconnectingSince!==void 0&&typeof $.reconnectingSince!=="string"||$.workspace!==void 0&&typeof $.workspace!=="string")return null;return $}function yZ(Q,Z=WQ()){return D(Z,Q)}var n=1;function WZ(Q=R()){return M(P(Q),"local-device.proxy.json")}function vZ(Q=WZ()){let Z=b(Q);if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let $=Z;if($.version!==n||typeof $.url!=="string"||$.url.length===0||$.caFile!==void 0&&(typeof $.caFile!=="string"||!QQ($.caFile)))return null;return{version:n,url:$.url,...$.caFile?{caFile:$.caFile}:{}}}function pZ(Q,Z={read:!0,write:!1,execute:!1,discover_environment:!1,expose_mcp:!1},$=mQ(32)){let W=new Set,z=[];for(let j of Q){let G=yQ(QQ(j)?j:lQ(j));if(!pQ(G).isDirectory())throw Error(`Local execution root is not a directory: ${j}`);if(W.has(G))continue;W.add(G),z.push({id:a(),label:dQ(G)||G,path:G,pathFingerprint:CQ("sha256",$).update(G).digest("hex"),permissions:{...Z}})}if(z.length===0)throw Error("At least one explicit local execution root is required.");return z}
-export{wQ as bg,X as cg,bQ as dg,w as eg,l as fg,i as gg,s as hg,R as ig,WQ as jg,gZ as kg,EZ as lg,hZ as mg,yZ as ng,n as og,vZ as pg,pZ as qg};

package/bin/vm-hands/vm-hands-op-runner-9yh3qjrw.js

@@ -1,2 +0,0 @@
-// @bun
-import{a,b,c}from"./vm-hands-entry-lite-h1dtacsm.js";import"./vm-hands-entry-lite-9k93fyhy.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{b as spawnSessionPty,c as runVmHandsOpRunner,a as VM_HANDS_OP_RUNNER_PERSON_ARG};

package/bin/vm-hands/worker-sandbox-w5jq1qzm.js

@@ -1,2 +0,0 @@
-// @bun
-import{t as a}from"./vm-hands-entry-lite-8tf0kw71.js";import"./vm-hands-entry-lite-k6e9bt1m.js";import"./vm-hands-entry-lite-h01d2fbm.js";import"./vm-hands-entry-lite-t5h3g60g.js";import"./vm-hands-entry-lite-9k93fyhy.js";import"./vm-hands-entry-lite-hz2ww2qe.js";export{a as configureWorkerSandbox};