@reason-machines/cli-linux-arm64-musl 0.2.343 → 0.2.344

package/bin/vm-hands/{vm-hands-entry-lite-dqqjy7kj.js → vm-hands-entry-lite-k1qw05mt.js}

@@ -1,5 +1,5 @@
 // @bun
-import{u as g0}from"./vm-hands-entry-lite-bfh3cnh2.js";import{v as Q2,x as N7,y as Y4}from"./vm-hands-entry-lite-tt4zgt64.js";import{A as q2,B as V7,C as M4,D as T4,E as u6,F as v0,J as d6,K as I$}from"./vm-hands-entry-lite-5qe562gn.js";import{$ as h1,R as jJ,S as WJ,T as y8,U as f8,V as J6,W as Z6,X as b9,Y as A5,Z as v8,_ as _0,aa as m1,ba as P0,ca as n1,da as R5,ea as p5,fa as t3,ga as b5,ka as w5,ta as Y6,ua as G6,va as K6,wa as B6,xa as k9}from"./vm-hands-entry-lite-1sq7jgg0.js";import{$a as i8,Ab as m2,Ca as o8,Cb as z5,Da as e8,Db as B9,Fb as H5,Ga as a8,Ia as G5,Jb as $6,Kb as X9,La as K5,Qa as N5,Ra as q5,Sa as h8,Ta as m8,Ua as nJ,Va as rJ,Xa as u,Ya as e,Za as s,_a as c,ab as oJ,bb as _1,eb as G3,fb as K3,gb as G7,hb as K7,ib as B7,jb as b0,kb as J0,lb as g,mb as w9,nb as R1,ob as Z2,pb as N0,qb as eJ,vb as d5,xb as H8,za as I6}from"./vm-hands-entry-lite-xv868vfm.js";import{Pb as g8}from"./vm-hands-entry-lite-p7x3vnz5.js";import{Wb as O5}from"./vm-hands-entry-lite-wmxksawm.js";import{cc as B5,dc as U5,kc as V5}from"./vm-hands-entry-lite-3gf1yegq.js";import{qc as H$}from"./vm-hands-entry-lite-8ynztq9j.js";import{Fc as k8}from"./vm-hands-entry-lite-pn6vyghh.js";import{Lc as c$,Mc as X$,Nc as C$,Oc as F1,Pc as l6,Qc as q7,Rc as H7,Sc as L1,Tc as M7,Uc as s9,Vc as T7,Wc as Z3,Xc as T$,Yc as G8,Zc as Q3,bd as C5,ed as Q6,hd as DJ,id as OJ}from"./vm-hands-entry-lite-3c4qwk4d.js";import{_d as w8,ge as f6,he as t$,re as V2,sd as C2,wd as aJ,xd as iJ}from"./vm-hands-entry-lite-bbc5r4y1.js";import{Ee as U7,Fe as n2,Ie as X6,Le as l1,Ne as w7,Oe as k7,Te as S5}from"./vm-hands-entry-lite-q1ekx7k0.js";import{Ze as r1,_e as D5}from"./vm-hands-entry-lite-2c8m8m7v.js";import{bf as o6,ef as I5,ff as x9,hf as u8}from"./vm-hands-entry-lite-ckehp0dy.js";import{uf as t}from"./vm-hands-entry-lite-jjq3xq9z.js";import{bg as w1,cg as G0,dg as B2,eg as N6,fg as q6,gg as r$,hg as W3,ig as k2,jg as z4,lg as y2,mg as k$,ng as f0,og as o$,pg as f2,sg as y$}from"./vm-hands-entry-lite-vn0r1e8c.js";import{wg as Y5}from"./vm-hands-entry-lite-2mhzfg6b.js";import{Ah as z$,Bh as C0,Ch as B4,Dh as Q7,Eh as X7,Gh as A2,Hh as Y7,Ih as E9,Jh as X8,Kh as Y8,Lh as Q1,uh as O$,vh as E1,xh as Q$}from"./vm-hands-entry-lite-70d6f5r9.js";import{Mh as U0,Oh as vJ}from"./vm-hands-entry-lite-p9eyqdq7.js";import{ki as U}from"./vm-hands-entry-lite-6z2g0td2.js";import{ni as tJ}from"./vm-hands-entry-lite-0zr461f9.js";import{si as h0}from"./vm-hands-entry-lite-ypcqvygf.js";import{yi as JB}from"./vm-hands-entry-lite-45cnnd8e.js";import{spawn as _7,spawnSync as ZB}from"child_process";import{closeSync as F7,mkdirSync as QB,openSync as L7,readdirSync as XB,realpathSync as Y$,rmSync as W1}from"fs";import{hostname as YB}from"os";import{dirname as a9,join as F0,resolve as GB}from"path";import{createHash as f7}from"crypto";import{unlinkSync as h7}from"fs";import{platform as m7}from"os";import{join as v7}from"path";var G4=U.discriminatedUnion("store",[U.strictObject({version:U.literal(1),store:U.literal("keychain")}),U.strictObject({version:U.literal(1),store:U.literal("file"),api_key:U.string().min(1).max(4096)})]),w$=($)=>v7($,"api-key.json");function L$($){let J=f7("sha256").update(`reason-connect-api-key
+import{u as g0}from"./vm-hands-entry-lite-k2e3q5qj.js";import{v as Q2,x as N7,y as Y4}from"./vm-hands-entry-lite-m16qf0yy.js";import{A as q2,B as V7,C as M4,D as T4,E as u6,F as v0,J as d6,K as I$}from"./vm-hands-entry-lite-pnkfgnqz.js";import{$ as h1,R as jJ,S as WJ,T as y8,U as f8,V as J6,W as Z6,X as b9,Y as A5,Z as v8,_ as _0,aa as m1,ba as P0,ca as n1,da as R5,ea as p5,fa as t3,ga as b5,ka as w5,ta as Y6,ua as G6,va as K6,wa as B6,xa as k9}from"./vm-hands-entry-lite-rkmkv423.js";import{$a as i8,Ab as m2,Ca as o8,Cb as z5,Da as e8,Db as B9,Fb as H5,Ga as a8,Ia as G5,Jb as $6,Kb as X9,La as K5,Qa as N5,Ra as q5,Sa as h8,Ta as m8,Ua as nJ,Va as rJ,Xa as u,Ya as e,Za as s,_a as c,ab as oJ,bb as _1,eb as G3,fb as K3,gb as G7,hb as K7,ib as B7,jb as b0,kb as J0,lb as g,mb as w9,nb as R1,ob as Z2,pb as N0,qb as eJ,vb as d5,xb as H8,za as I6}from"./vm-hands-entry-lite-f7g390b5.js";import{Pb as g8}from"./vm-hands-entry-lite-7ba3nhgv.js";import{Wb as O5}from"./vm-hands-entry-lite-wmxksawm.js";import{cc as B5,dc as U5,kc as V5}from"./vm-hands-entry-lite-k2cvr710.js";import{qc as H$}from"./vm-hands-entry-lite-8ynztq9j.js";import{Fc as k8}from"./vm-hands-entry-lite-0wyjnvjz.js";import{Lc as c$,Mc as X$,Nc as C$,Oc as F1,Pc as l6,Qc as q7,Rc as H7,Sc as L1,Tc as M7,Uc as s9,Vc as T7,Wc as Z3,Xc as T$,Yc as G8,Zc as Q3,bd as C5,ed as Q6,hd as DJ,id as OJ}from"./vm-hands-entry-lite-fnefqcw4.js";import{ae as w8,ie as f6,je as t$,te as V2,ud as C2,yd as aJ,zd as iJ}from"./vm-hands-entry-lite-bjc5fdv3.js";import{Ge as U7,He as n2,Ke as X6,Ne as l1,Pe as w7,Qe as k7,Ve as S5}from"./vm-hands-entry-lite-x5az8qvp.js";import{$e as r1,af as D5}from"./vm-hands-entry-lite-pa111vpq.js";import{df as o6,gf as I5,hf as x9,jf as u8}from"./vm-hands-entry-lite-c1p0mz65.js";import{wf as t}from"./vm-hands-entry-lite-f8ss5hkt.js";import{dg as w1,eg as G0,fg as B2,gg as N6,hg as q6,ig as r$,jg as W3,kg as k2,lg as z4,ng as y2,og as k$,pg as f0,qg as o$,rg as f2,ug as y$}from"./vm-hands-entry-lite-kt418g2w.js";import{yg as Y5}from"./vm-hands-entry-lite-knfh7w3j.js";import{Ch as z$,Dh as C0,Eh as B4,Fh as Q7,Gh as X7,Ih as A2,Jh as Y7,Kh as E9,Lh as X8,Mh as Y8,Nh as Q1,wh as O$,xh as E1,zh as Q$}from"./vm-hands-entry-lite-1xjtcxpn.js";import{Oh as U0,Qh as vJ}from"./vm-hands-entry-lite-9dx3at21.js";import{mi as U}from"./vm-hands-entry-lite-2xh7sjs0.js";import{pi as tJ}from"./vm-hands-entry-lite-0jar357h.js";import{ui as h0}from"./vm-hands-entry-lite-gt5pkv4h.js";import{Ai as JB}from"./vm-hands-entry-lite-mhsv58hw.js";import{spawn as _7,spawnSync as ZB}from"child_process";import{closeSync as F7,mkdirSync as QB,openSync as L7,readdirSync as XB,realpathSync as Y$,rmSync as W1}from"fs";import{hostname as YB}from"os";import{dirname as a9,join as F0,resolve as GB}from"path";import{createHash as f7}from"crypto";import{unlinkSync as h7}from"fs";import{platform as m7}from"os";import{join as v7}from"path";var G4=U.discriminatedUnion("store",[U.strictObject({version:U.literal(1),store:U.literal("keychain")}),U.strictObject({version:U.literal(1),store:U.literal("file"),api_key:U.string().min(1).max(4096)})]),w$=($)=>v7($,"api-key.json");function L$($){let J=f7("sha256").update(`reason-connect-api-key
 ${$}`).digest("hex");return new r$(B2(),m7(),J)}function L3($,J,Z=L$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(w$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof G0))throw Q}c(w$($),{version:1,store:"file",api_key:J})}function l0($,J=L$($)){if(!u(w$($)))return null;let Z=G4.parse(JSON.parse(s(w$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof G0))throw Q;throw Error("worker_api_key_unreadable")}}function K4($,J=L$($)){if(!u(w$($)))return;if(G4.parse(JSON.parse(s(w$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof G0))throw Z}h7(w$($))}async function j3($,J){let Z;try{Z=await Y4({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:b0($.proxy)})}catch(Q){if(Q instanceof v0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as XZ,renameSync as YZ,rmSync as f$}from"fs";import{join as H0}from"path";import{createHash as g7}from"crypto";import{realpathSync as u7,statSync as d7,unlinkSync as U2}from"fs";import{platform as l7}from"os";import{join as w0}from"path";function d($){return{state:w0(g($),"device.json"),control:w0(g($),"control.json"),lock:w0(g($),"lifecycle.lock"),socket:w0(g($),"control.sock"),daemon:w0(g($),"daemon.json"),releaseCheck:w0(g($),"release-check.json"),updateDeferral:w0(g($),"update-deferral.json"),firstHeartbeat:w0(g($),"first-heartbeat.json")}}var p7=U.object({version:U.literal(1),device_id:U.string().min(1).max(160),offer:U.unknown().optional(),enrollment_ms:U.number().int().nonnegative().max(t$).optional()});function U4($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function D3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=p7.safeParse(JSON.parse(s(Z)));if(U2(Z),!Q.success||Q.data.device_id!==J)return null;let X=V2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=w0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?O3($):new W3(g($))}function N2($,J){T0($,!0),a7($);let Z=J??O3($),Q=new W3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof G0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function O3($){return new r$(B2(),l7(),c7($))}function c7($){let J=z3($);return g7("sha256").update(`reason-worker
 ${J?.directory??g($)}`).digest("hex")}function I1($,J){c(w0(g($),C1),{version:1,directory:z3($)?.directory??g($),devicePublicKey:J})}var C1="keychain-scope.json";function V4($){return u(w0(g($),C1))}var s7=U.strictObject({version:U.literal(1),directory:U.string().min(1),devicePublicKey:U.string().min(1)});function z3($){let J=w0(g($),C1);if(!u(J))return null;let Z=s7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function a7($){let J=w0(g($),C1);if(!u(J))return;if(z3($))try{let Z=O3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof G0))throw Z}U2(J)}function V$($){let J=u7($.workspaceRoot);if(J!==$.workspaceRoot||!d7(J).isDirectory()||!R1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function o($){if(!u(g($)))return null;let J=k$(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&B4($.apiOrigin,J.apiOrigin),Q=Z?[N0($),N0({...$,apiOrigin:J.apiOrigin})]:[N0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var N4=U.strictObject({version:U.literal(1),drained:U.boolean(),revoked:U.boolean()});function $0($){let J=d($).control;return u(J)?N4.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function I0($,J){c(d($).control,N4.parse(J))}function k0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=w0(g($),C1);if(u(Z))U2(Z);let Q=d($).state;if(u(Q))U2(Q)}var i7=U.strictObject({read:U.boolean(),write:U.boolean(),execute:U.boolean(),discover_environment:U.boolean(),expose_mcp:U.literal(!1)}),A3=U.strictObject({version:U.literal(1),organization_id:U.string().min(1).max(160),enrollment_ticket:U.string().min(1).max(4096),code_verifier:U.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/),root:U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/),permissions:i7,execution_mode:U.enum(["confined","host"]).default("confined")}),folders:U.array(U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),n7=U.object({device_id:U.string().min(1).max(160),organization_id:U.string().min(1).max(160),auth_scheme:U.literal("p256"),protocol_version:U.literal(2),roots:U.array(U.object({id:U.string().min(1),label:U.string(),path_fingerprint:U.string()})).min(1).max(32),headless:U.object({lifecycle:U.enum(["persistent","ephemeral"]),expires_at:U.iso.datetime({offset:!0})}),first_heartbeat:U.unknown().optional()}),R3=30000;class o0 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function r7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(R3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new o0(X?.error==="device_revoked")}return Q.json()}async function I3($,J,Z,Q){g0();let X=A3.parse(JSON.parse(s(J)));return e0($,X,Z,Q)}async function e0($,J,Z,Q=(Y,G)=>r7(Y,G,b0($.proxy)),X=performance.now()){let Y=H4($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function q4($,J,Z,Q,X=performance.now()){let Y=H4($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function H4($,J,Z){if(g0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=y$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let H=y$([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(H.path!==K||H.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return H});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:t,bridge_version:t,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let H=n7.parse(K);if(H.organization_id!==J.organization_id||H.roots.length!==Y.length||H.roots.some((q,M)=>q.path_fingerprint!==Y[M].pathFingerprint)||H.headless.lifecycle!==$.lifetime||Date.parse(H.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let B=V2(H.first_heartbeat);try{U4($,H.device_id,{...B?{offer:B}:{},enrollmentMs:Math.min(t$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:H.organization_id,deviceId:H.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:N0($),lifetime:$.lifetime,expiresAt:H.headless.expires_at},roots:H.roots.map((q,M)=>({id:q.id,label:q.label,path:Y[M].path,pathFingerprint:q.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as t7,randomUUID as o7}from"crypto";import{unlinkSync as e7}from"fs";import{join as $Z}from"path";var _4=U.strictObject({version:U.literal(1),install_id:U.uuid(),fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/)}),JZ=U.object({enrollment_ticket:U.string().min(1).max(4096),expires_at:U.iso.datetime({offset:!0}),device_kind:U.literal("headless"),lifecycle:U.enum(["persistent","ephemeral"]),device_expires_at:U.iso.datetime({offset:!0})});function C3($){return JZ.parse($)}var ZZ=U.object({credentialKind:U.enum(["oauth","api_key"]).optional(),apiOrigin:U.url(),clientId:U.string(),accessToken:U.string().min(1).max(32768),refreshToken:U.string().max(32768),expiresAt:U.iso.datetime({offset:!0}),scopes:U.array(U.string().max(128)).max(128),orgId:U.string().min(1).max(160)});function j$($){return q2(E1("REASON_CLI_CHANNEL",$.channel),U0())}async function W$($,J=j$($)){if(!u(J))return null;let Z=ZZ.parse(JSON.parse(s(J)));if(!C0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=b0($.proxy),X=Object.assign((G,V)=>Q(G,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await T4({path:J,fetchImpl:X});if(Y&&!C0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function F4($,J,Z){if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=D$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function L4($,J,Z,Q,X){let Y=performance.now();if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=D$($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await q4($,G.direct(J.orgId),Q,(N,H)=>V({approval:G.request,code_verifier:H,registration:N}).catch((B)=>{throw QZ(B)}),Y);if(K)return K}return e0($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function QZ($){if(!($ instanceof v0))return $;if($.status===409)return new o0($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new o0(!1);return $}var P1=($)=>$Z(g($),"enrollment-install.json");function j4($){if(u(P1($)))e7(P1($))}function D$($,{stored:J=!0}={}){g0();let Z=P1($),Q=J&&u(Z)?_4.parse(JSON.parse(s(Z))):{version:1,install_id:o7(),fingerprint_key:t7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=y$([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((B)=>{let q=y$([B],X,Y)[0];if(q.path!==B)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:q.pathFingerprint}}),K=M4(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...V.map((B)=>B.path_fingerprint)].map((B)=>({path_fingerprint:B,permissions:X,execution_mode:$.executionMode}))},H=(B)=>({version:1,organization_id:B,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(B){e(g(B),!0),c(P1(B),Q)},complete(B,q){let M=C3(q);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...H(B),enrollment_ticket:M.enrollment_ticket}},direct:H}}function W4($,J,Z){let Q=P1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=_4.parse(JSON.parse(s(Q)));return y$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var H2=8,A4=600000,R4=15000,D4=new Set(["device_revoked","invalid_device_credential"]),M2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,N$=($)=>H0(g($),"workspaces"),I4="account.json",P3=($)=>u(H0($,I4));function y0($){let J;try{J=XZ(N$($))}catch{return[]}return J.filter((Z)=>M2.test(Z)).sort().map((Z)=>{let Q=H0(N$($),Z),X=H0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:P3(Q)}})}function T2($,J){let Z=J.toLowerCase();if(!M2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:H0(N$($),Z)});return e(Q.stateDirectory,!0),c(H0(Q.stateDirectory,I4),{version:1}),{config:Q,configPath:H0(Q.stateDirectory,"worker.json")}}function _2($,J){try{let{config:Z,configPath:Q}=T2($,J);e(g(Z),!0),I0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function x1($,J){let Z=J.toLowerCase(),Q=null;try{Q=o($)?.orgId.toLowerCase()??null}catch{}return Q===Z||y0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var E3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function O4($,J){let Z=o($);if(!Z?.worker)throw Error("worker_identity_missing");I1($,Z.devicePublicKey),e(g(J),!0);for(let Y of E3)f$(H0(g(J),Y),{force:!0});for(let Y of E3){let G=H0(g($),Y);if(u(G))YZ(G,H0(g(J),Y))}let Q=T0(J),X=k$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");f0({...X,worker:{...X.worker,configDigest:N0(J)}},d(J).state,{proofStore:Q})}function x3($){for(let J of y0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))k0(J.config)}catch{}f$(J.directory,{recursive:!0,force:!0})}f$(b3($),{force:!0})}function F2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(B)=>Number(Date.parse(B.worker?.expiresAt??"")>X+60000),V=y0($).flatMap((B)=>{if(!B.account||!B.config)return[];try{if($0(B.config).revoked)return[];let q=o(B.config);return q&&q.orgId.toLowerCase()===B.organizationId&&(!Q||Y(q))?[{...B,config:B.config,state:q}]:[]}catch{return[]}}).sort((B,q)=>Number(q.organizationId===J)-Number(B.organizationId===J)||Y(q.state)-Y(B.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:o($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&M2.test(N)&&N!==V.organizationId){let B=T2($,N);O4($,B.config),c(B.configPath,B.config)}else if(u(g($))){try{if(u(d($).state))k0($)}catch{}for(let B of E3)f$(H0(g($),B),{force:!0})}x3($);let H=J0.parse({...V.config,stateDirectory:$.stateDirectory});return O4(V.config,H),c(H0($.stateDirectory,"worker.json"),H),f$(V.directory,{recursive:!0,force:!0}),H}var S3={before($){for(let{config:J}of y0($))try{let Z=J?o(J):null;if(J&&Z)I1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of y0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==H0(N$($),Z))continue;let V=J0.parse({...G,stateDirectory:Q}),K=T0(V),N=k$(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===N0(G))f0({...N,worker:{...N.worker,configDigest:N0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},b3=($)=>H0(N$($),"listed.json");function C4($){try{let J=JSON.parse(s(b3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function P4($,J){let Z=y0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=C4($),G=Y&&!Y.listed?Y.reason:null,V=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:H})=>{let B=!1,q=null,M=!1,T=null;try{B=N?$0(N).revoked:!1,q=N&&!B?o(N):null;let _=N?o$(d(N).daemon):null;M=J&&!!q&&_?.state==="connected",T=M?z4(_,q):null}catch{}return{...T?{permission_recovery:T}:{},organization_id:K,device_id:q?.deviceId??null,name:Y?.names?.[K]??null,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,state:B?"removed":M?"connected":"not_running",blocked:!H&&!B&&!M&&(Y?.blocked.includes(K)??!1),...H?{account:!0}:{}}})}}function E4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,V=null,K=!1,N=C4(J)??{listed:!1,reason:null,blocked:[]},H=(L)=>{let{folders:W,...R}=J,E=Z.roots.slice(1).map((I)=>I.path);return J0.parse({...R,...E.length?{folders:E}:{},stateDirectory:H0(N$(J),L)})},B=async(L)=>{let W=G.get(L);if(!W)return;W.controller.abort(),await W.done},q=(L,W=!1)=>{let R=new AbortController,E=()=>R.abort();if(X.addEventListener("abort",E,{once:!0}),X.aborted)R.abort();let I={...L,controller:R,claims:0,done:Promise.resolve(),account:W};I.done=$.serve(L,R.signal,(C)=>{I.claims=C}).then(()=>{return},(C)=>{if(W&&C instanceof _0&&C.status===401&&D4.has(C.code)){try{I0(L.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${L.organizationId} (another account's) no longer accepts this computer (${C.code}); run \`reason connect\` signed in as that account to connect it again
 `)}else if(C instanceof _0&&C.status===401&&D4.has(C.code)){try{k0(L.config)}catch{}Y(`Reason worker: workspace ${L.organizationId} no longer accepts this computer
@@ -312,7 +312,7 @@ Usage:
 `),host:Z.host}),V=$8({...G,log:(M)=>Q.stderr.write(`${M}
 `)}),{configPath:K}=V,N=V.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let H=(M,T)=>{let _=q3(Z.home,Z.channel),j;try{let O=null;try{O=T.keep?null:o(N)?.orgId.toLowerCase()??null}catch{}if(j=F2(N,{prefer:X2(Z.home,Z.channel,N),...T}),j&&O)_2(j,O)}finally{_()}if(!j)return!1;N=j;let D="";try{D=` (workspace ${o(j)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${M}; this computer goes on running Sessions for its other Reason account${D}.
 `),!0};if($0(N).revoked&&!H("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j1(N)){let M=l0(N.stateDirectory)??void 0,T=M?null:X2(Z.home,Z.channel,N);if(!M&&!(T&&x1(N,T)))H("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let B=N.executionMode==="confined";if(B||!j1(N)){let M=l0(N.stateDirectory)??void 0;if(Q.stderr.write(B?O7:`Reason: this computer's connection expired; renewing it with ${M?"its API key":"your login"}\u2026
-`),await i9(J0.parse({...N,executionMode:"host"}),K,Q,X,M)!==0)return Q.stderr.write(M?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let q=new AbortController;if(!X.runWorker)import("./ask-relay-d96qx4ez.js").then(({runBackgroundAskRelay:M})=>M(q.signal,(T)=>Q.stderr.write(`${T}
+`),await i9(J0.parse({...N,executionMode:"host"}),K,Q,X,M)!==0)return Q.stderr.write(M?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let q=new AbortController;if(!X.runWorker)import("./ask-relay-mxa9m9t7.js").then(({runBackgroundAskRelay:M})=>M(q.signal,(T)=>Q.stderr.write(`${T}
 `))).catch(()=>{});try{for(;;){let M=l0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},T=X.runWorker?null:$3({stateDirectory:N.stateDirectory}),_=!1,j;try{j=await(X.runWorker??M$)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...M,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{_=!0}})}finally{T?.stop()}if(!_)return j;if(!H("this computer's connection was removed from Reason",{keep:!1}))break}return U3(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{q.abort()}}async function MB($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:V}=Z;if(J&&await(X.controlWorker??V0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=u0(Y,G,!0),N=A7({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:V}),H=R7(N,Z.apiKey??(J?l0(J.stateDirectory)??void 0:void 0)),B=F0(K,"worker.json");return e(K,!0),c(B,H),Q.stdout.write(p9(`Reason: connecting "${H.name}" while this command runs`,H,Z.host.platform,["Connecting\u2026"])),(X.runWorker??M$)(["start","--config",B],{...n9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:Y3(Q.stderr)},onStartup:(q)=>{if(q==="ready")Q.stdout.write(`Connected. Start Sessions on "${H.name}" from Reason. Press Ctrl-C to stop.
 `);X.worker?.onStartup?.(q)}})}function TB($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),q8(d(J).daemon,$);let X=R2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
 `),0}var _B=U.object({root:U.object({id:U.string().min(1).max(160),label:U.string().max(160),path_fingerprint:U.string()})});async function I7($,J,Z,Q){let X=await(n9(Q.worker,Z).enrollmentCredentials??W$)($,j$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new I$(X,{credentialsPath:j$($),fetchImpl:b0($.proxy)}),G=(V)=>V instanceof v0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=W4($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((B)=>{if(G(B))throw Error("worker_folders_unavailable");if(B instanceof v0&&B.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw B}),H=_B.parse(N).root;if(H.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:H.id,label:H.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof v0&&K.code==="root_not_found"))throw K})}}}function C7($,J,Z){f0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:N0($)}},d($).state,{proofStore:T0($)})}async function P7($,J,Z,Q){let{io:X,options:Y,host:G}=Q,V=J&&!Q.apiKey&&l0(J.stateDirectory)===null?X2(Q.home,Q.channel,J):null,K=J&&V&&P$(J)&&!x1(J,V)?y0(J).find((I)=>I.account&&I.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,H=K?K.configPath:Z,B=N&&P$(N)&&!$0(N).revoked?o(N):null;if(!J||!N||!B||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let q=$.addFolder!==void 0,M=q?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=X3(T,M)}catch(I){if(q)throw new p(I instanceof Error?I.message:String(I));_=GB(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let j=N.folders??[],D=B.roots.slice(1).find((I)=>I.path===_);if(!q&&!D&&!j.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(q&&!R1(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(q&&!D&&j.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??l0(N.stateDirectory)??void 0,F=await I7(N,B,O,Y),z=B.roots.filter((I)=>I.path!==_);if(q)z=[...z,await F.add(_)];else if(D)await F.remove(D.id);C7(N,B,z);let L=q?[...j.filter((I)=>I!==_),_]:j.filter((I)=>I!==_),{folders:W,...R}=N;if(c(H,J0.parse({...R,...L.length?{folders:L}:{}})),!await(Y.controlWorker??V0)(J,"reload_roots").then(()=>!0,()=>!1))T$(J,G,"connect");return X.stdout.write(q?`Added ${_}. Sessions on "${N.name}" may run in it.

package/bin/vm-hands/{vm-hands-entry-lite-3gf1yegq.js → vm-hands-entry-lite-k2cvr710.js}

@@ -1,5 +1,5 @@
 // @bun
-import{lc as i,mc as l,nc as g,oc as y}from"./vm-hands-entry-lite-k469tezz.js";import{Ag as k,Cg as G,Eg as X,Fg as M,Gg as Y,Hg as H,Ig as V,Kg as S,Lg as _,Ng as P,Og as C,Pg as I,Rg as O,Ug as A,ug as Q,vg as J,wg as z,xg as Z,yg as K,zg as $}from"./vm-hands-entry-lite-2mhzfg6b.js";import{bi as L,ci as W,di as F,ei as j}from"./vm-hands-entry-lite-3s5fdvat.js";var d=["cgroup_membership_read_failed","cgroup_v2_membership_absent","cgroup_scope_invalid","cgroup_root_unavailable","cgroup_directory_unavailable","cgroup_limit_read_failed","cgroup_events_read_failed","cgroup_current_read_failed","cgroup_stat_read_failed","boot_id_read_failed","boot_id_invalid","guest_meminfo_read_failed","guest_vmstat_read_failed","memory_counter_invalid","memory_field_missing","memory_capacity_invalid"];var a=String.raw`(function(fs, path) {
+import{lc as i,mc as l,nc as g,oc as y}from"./vm-hands-entry-lite-k469tezz.js";import{Ag as K,Bg as $,Cg as k,Eg as G,Gg as X,Hg as M,Ig as Y,Jg as H,Kg as V,Mg as S,Ng as _,Pg as P,Qg as C,Rg as I,Tg as O,Wg as A,wg as Q,xg as J,yg as z,zg as Z}from"./vm-hands-entry-lite-knfh7w3j.js";import{di as L,ei as W,fi as F,gi as j}from"./vm-hands-entry-lite-289bc9v7.js";var d=["cgroup_membership_read_failed","cgroup_v2_membership_absent","cgroup_scope_invalid","cgroup_root_unavailable","cgroup_directory_unavailable","cgroup_limit_read_failed","cgroup_events_read_failed","cgroup_current_read_failed","cgroup_stat_read_failed","boot_id_read_failed","boot_id_invalid","guest_meminfo_read_failed","guest_vmstat_read_failed","memory_counter_invalid","memory_field_missing","memory_capacity_invalid"];var a=String.raw`(function(fs, path) {
   const fail = (message, reasonCode) => { throw Object.assign(Error(message), {reasonCode}); };
   const read = (p, reasonCode, trim=true) => { try { const text=fs.readFileSync(p, "utf8"); return trim?text.trim():text; }
     catch { fail("memory_read", reasonCode); } };

package/bin/vm-hands/{vm-hands-entry-lite-bfh3cnh2.js → vm-hands-entry-lite-k2e3q5qj.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Mb as j,Nb as q}from"./vm-hands-entry-lite-p7x3vnz5.js";function y(v=process.platform){if(j(),v==="linux")q("strict")}
+import{Mb as j,Nb as q}from"./vm-hands-entry-lite-7ba3nhgv.js";function y(v=process.platform){if(j(),v==="linux")q("strict")}
 export{y as u};

package/bin/vm-hands/{vm-hands-entry-lite-2mhzfg6b.js → vm-hands-entry-lite-knfh7w3j.js}

@@ -1,4 +1,4 @@
 // @bun
-import{_h as f}from"./vm-hands-entry-lite-3s5fdvat.js";var j=["Click browser element","Double click browser element","Type text","Clear browser field","Press key","Scroll browser element into view","Drag on computer","Select browser option","Check browser control","Uncheck browser control","Hover browser element","Focus browser element","Open browser page","Reload browser page","Go back in browser","Go forward in browser","Take browser screenshot"],$A=32;function R(x){if(!Array.isArray(x)||x.length>32||!x.every((A)=>typeof A==="string"&&j.includes(A)))return;return x.slice()}var KA="__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__",QA=262144;function Y(x){if(!x||typeof x!=="object"||Array.isArray(x))return!1;let A=x,W=Object.keys(A);return W.length===2&&W.includes("template")&&W.includes("quoteDepth")&&typeof A.template==="string"&&A.template.length<=262144&&!A.template.includes("\x00")&&A.template.split("__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__").length===2&&(A.quoteDepth===1||A.quoteDepth===2||A.quoteDepth===3)}var I=2,b=33554432,K=200000,D=4000000,_=240000,YA=`
+import{ai as f}from"./vm-hands-entry-lite-289bc9v7.js";var j=["Click browser element","Double click browser element","Type text","Clear browser field","Press key","Scroll browser element into view","Drag on computer","Select browser option","Check browser control","Uncheck browser control","Hover browser element","Focus browser element","Open browser page","Reload browser page","Go back in browser","Go forward in browser","Take browser screenshot"],$A=32;function R(x){if(!Array.isArray(x)||x.length>32||!x.every((A)=>typeof A==="string"&&j.includes(A)))return;return x.slice()}var KA="__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__",QA=262144;function Y(x){if(!x||typeof x!=="object"||Array.isArray(x))return!1;let A=x,W=Object.keys(A);return W.length===2&&W.includes("template")&&W.includes("quoteDepth")&&typeof A.template==="string"&&A.template.length<=262144&&!A.template.includes("\x00")&&A.template.split("__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__").length===2&&(A.quoteDepth===1||A.quoteDepth===2||A.quoteDepth===3)}var I=2,b=33554432,K=200000,D=4000000,_=240000,YA=`
 ...[executor output truncated]`,p=2000,k=1,i=16384,d=32768,y=128,LA=64,s=2097152,H=1,m=16384,c=32768,OA=8388608,n=1000,t=2500,r=2000,zA=t+r,o=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/,v=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,l={text_only:4430,invalid_json:4431,invalid_cancel_request:4432,invalid_sdk_response:4433,claim_required:4434,invalid_claim:4435,executor_mismatch:4436,stale_generation:4437,fence_conflict:4438,frame_too_large:4439,result_too_large:4440,progress_too_large:4441,terminal_cleanup_started:4442,job_journal_unavailable:4443},u=new Map(Object.entries(l).map(([x,A])=>[A,x]));function SA(x,A){return A||(u.get(x)??"")}var a=["cancelled","command_failed","duplicate_request_id","duplicate_result_evicted","invalid_repl_response","invalid_request","process_group_cleanup_unconfirmed","repl_failed","result_too_large","repl_response_too_large","repl_transport_failed","request_ledger_full","request_journal_unavailable","request_outcome_uncertain","maintenance_held","request_not_found","resume_digest_mismatch","spawn_failed","stale_generation","timeout"],e=new Set(a),w=16384,AA=200,xA=2000,WA=["maintenance_held","invalid_job_request","jobs_disabled","job_not_found","job_conflict","job_capacity","job_journal_unavailable","job_not_running","job_lease_expired","job_input_sequence","job_input_backpressure","stale_generation","pty_unsupported","job_mode_mismatch"];class G extends Error{code;constructor(x){super(x);this.name="HandsProtocolError",this.code=x}}function g(x){return new TextEncoder().encode(x).byteLength}function U(x){return typeof x==="object"&&x!==null&&!Array.isArray(x)}function B(x,A){let W=new Set(A);return Object.keys(x).every((N)=>W.has(N))}function M(x){return typeof x==="string"&&o.test(x)}function Z(x){return Number.isSafeInteger(x)&&Number(x)>=1}function J(x){return typeof x==="string"&&v.test(x)}function C(x){return typeof x==="string"&&x.startsWith("pty-")&&J(x.slice(4))}function z(x){return[x.cols,x.rows].every((A)=>Number.isSafeInteger(A)&&Number(A)>=1&&Number(A)<=n)}function E(x){if(typeof x!=="string"||x.length>Math.ceil(m/3)*4||x.length%4!==0||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(x))return-1;let A=x.endsWith("==")?2:x.endsWith("=")?1:0;if(A&&"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(x[x.length-A-1])&(A===2?15:3))return-1;let N=x.length/4*3-A;return N<=m?N:-1}function S(x){return typeof x==="string"&&/^[0-9a-f]{64}$/.test(x)}function $(x){if(g(x)>b)throw new G("frame_too_large");try{return JSON.parse(x)}catch{throw new G("invalid_json")}}function BA(x){let A=$(x);if(!U(A)||!B(A,["version","generation","id","tool","input","semanticDigest","lifecycleLeaseId","workspaceBefore"])||A.version!==I||!Z(A.generation)||!M(A.id)||!["bash","repl","resume","read","edit","write","pi_tool"].includes(String(A.tool))||!U(A.input)||A.lifecycleLeaseId!==void 0&&(A.tool!=="bash"||!J(A.lifecycleLeaseId))||A.workspaceBefore!==void 0&&(!(A.tool==="bash"||A.tool==="repl"||A.tool==="pi_tool"&&A.input.tool==="bash")||!U(A.workspaceBefore)||!B(A.workspaceBefore,["script"])||typeof A.workspaceBefore.script!=="string"||A.workspaceBefore.script.length>K))throw new G("invalid_request");let W=U(A.workspaceBefore)&&typeof A.workspaceBefore.script==="string"?{workspaceBefore:{script:A.workspaceBefore.script}}:{};if(A.tool==="bash"){if(!B(A.input,["script","retainBackground","machineSdk"])||typeof A.input.script!=="string"||A.input.script.length>K||A.input.retainBackground!==void 0&&A.input.retainBackground!==!0||A.input.machineSdk!==void 0&&A.input.machineSdk!==!0||A.semanticDigest!==void 0&&!S(A.semanticDigest))throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"bash",input:{script:A.input.script,...A.input.retainBackground===!0?{retainBackground:!0}:{},...A.input.machineSdk===!0?{machineSdk:!0}:{}},...A.semanticDigest===void 0?{}:{semanticDigest:A.semanticDigest},...A.lifecycleLeaseId===void 0?{}:{lifecycleLeaseId:A.lifecycleLeaseId},...W}}if(A.tool==="resume"){if(A.semanticDigest!==void 0||!B(A.input,["semanticDigest"])||!S(A.input.semanticDigest))throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"resume",input:{semanticDigest:A.input.semanticDigest}}}if(A.tool==="repl"){if(!B(A.input,["code"])||typeof A.input.code!=="string"||A.input.code.length>K||A.semanticDigest!==void 0)throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"repl",input:{code:A.input.code},...W}}if(A.tool==="pi_tool"){let N=A.semanticDigest===void 0?GA(A.input):null;if(!N)throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"pi_tool",input:N,...W}}if(A.tool==="read"){if(!B(A.input,["path","offset","limit"])||typeof A.input.path!=="string"||A.input.path.length<1||A.input.path.length>K||A.semanticDigest!==void 0||A.input.offset!==void 0&&(!Number.isSafeInteger(A.input.offset)||Number(A.input.offset)<1)||A.input.limit!==void 0&&(!Number.isSafeInteger(A.input.limit)||Number(A.input.limit)<1||Number(A.input.limit)>2000))throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"read",input:{path:A.input.path,...A.input.offset===void 0?{}:{offset:Number(A.input.offset)},...A.input.limit===void 0?{}:{limit:Number(A.input.limit)}}}}if(A.tool==="edit"){if(!B(A.input,["path","edits"])||typeof A.input.path!=="string"||A.input.path.length<1||!Array.isArray(A.input.edits)||A.input.edits.length<1||A.input.edits.length>128||A.semanticDigest!==void 0)throw new G("invalid_request");let N=A.input.path.length,X=[];for(let V of A.input.edits){if(!U(V)||!B(V,["oldText","newText"])||typeof V.oldText!=="string"||V.oldText.length<1||typeof V.newText!=="string")throw new G("invalid_request");if(N+=V.oldText.length+V.newText.length,N>D)throw new G("invalid_request");X.push({oldText:V.oldText,newText:V.newText})}return{version:I,generation:A.generation,id:A.id,tool:"edit",input:{path:A.input.path,edits:X}}}if(A.tool!=="write"||!B(A.input,["path","content"])||typeof A.input.path!=="string"||A.input.path.length<1||typeof A.input.content!=="string"||A.input.path.length+A.input.content.length>D||A.semanticDigest!==void 0)throw new G("invalid_request");return{version:I,generation:A.generation,id:A.id,tool:"write",input:{path:A.input.path,content:A.input.content}}}function L(x){return x===void 0||typeof x==="number"&&Number.isFinite(x)}function GA(x){let A=x.args;if(!B(x,["tool","args"])||!U(A))return null;if(x.tool==="bash")return B(A,["command","timeout"])&&typeof A.command==="string"&&A.command.length<=K&&L(A.timeout)?{tool:"bash",args:{command:A.command,...A.timeout===void 0?{}:{timeout:Number(A.timeout)}}}:null;if(typeof A.path!=="string"||A.path.length>K)return null;if(x.tool==="read")return B(A,["path","offset","limit"])&&L(A.offset)&&L(A.limit)?{tool:"read",args:{path:A.path,...A.offset===void 0?{}:{offset:Number(A.offset)},...A.limit===void 0?{}:{limit:Number(A.limit)}}}:null;if(x.tool==="write")return B(A,["path","content"])&&typeof A.content==="string"&&A.path.length+A.content.length<=D?{tool:"write",args:{path:A.path,content:A.content}}:null;if(x.tool!=="edit"||!B(A,["path","edits"])||!Array.isArray(A.edits))return null;let W=A.path.length,N=[];for(let X of A.edits){if(!U(X)||!B(X,["oldText","newText"])||typeof X.oldText!=="string"||typeof X.newText!=="string")return null;if(W+=X.oldText.length+X.newText.length,W>D)return null;N.push({oldText:X.oldText,newText:X.newText})}return{tool:"edit",args:{path:A.path,edits:N}}}function NA(x){if(!U(x))return null;if("thrown"in x)return B(x,["thrown"])&&typeof x.thrown==="string"?{thrown:x.thrown}:null;let A=x.structuredContent;if(!B(x,["content","details","structuredContent","isError"])||!Array.isArray(x.content)||x.isError!==void 0&&x.isError!==!0||A!==void 0&&(!U(A)||!B(A,["output","truncated","full_output_path","exit_code","wall_time_seconds"])||typeof A.output!=="string"||typeof A.truncated!=="boolean"||A.full_output_path!==void 0&&typeof A.full_output_path!=="string"||typeof A.exit_code!=="number"||typeof A.wall_time_seconds!=="number"))return null;let W=[];for(let N of x.content)if(U(N)&&N.type==="text"&&B(N,["type","text"])&&typeof N.text==="string")W.push({type:"text",text:N.text});else if(U(N)&&N.type==="image"&&B(N,["type","data","mimeType"])&&typeof N.data==="string"&&typeof N.mimeType==="string")W.push({type:"image",data:N.data,mimeType:N.mimeType});else return null;return{content:W,...x.details===void 0?{}:{details:x.details},...U(A)?{structuredContent:{output:String(A.output),truncated:A.truncated===!0,...typeof A.full_output_path==="string"?{full_output_path:A.full_output_path}:{},exit_code:Number(A.exit_code),wall_time_seconds:Number(A.wall_time_seconds)}}:{},...x.isError===!0?{isError:!0}:{}}}function UA(x){let A=$(x);if(!U(A)||!B(A,["version","generation","id","ok","exitCode","stdout","stderr","cwd","error","resumed","browserActions","automaticProgressImage","piToolOutcome","workerElapsedMs","environmentWaitMs","workspaceBefore"])||A.version!==I||!Z(A.generation)||!M(A.id)||typeof A.ok!=="boolean"||!Number.isSafeInteger(A.exitCode)||Number(A.exitCode)<0||Number(A.exitCode)>255||typeof A.stdout!=="string"||A.stdout.length>_||typeof A.stderr!=="string"||A.stderr.length>_||A.cwd!==void 0&&(typeof A.cwd!=="string"||A.cwd.length<1||A.cwd.length>4096||!A.cwd.startsWith("/")||A.cwd.includes("\x00"))||A.error!==void 0&&(typeof A.error!=="string"||A.error.length<1||A.error.length>p||!e.has(A.error))||A.browserActions!==void 0&&!R(A.browserActions)||A.automaticProgressImage!==void 0&&(A.automaticProgressImage!==!0||!A.ok)||A.resumed!==void 0&&A.resumed!==!0||A.workerElapsedMs!==void 0&&(!Number.isSafeInteger(A.workerElapsedMs)||Number(A.workerElapsedMs)<0)||A.environmentWaitMs!==void 0&&(!Number.isSafeInteger(A.environmentWaitMs)||Number(A.environmentWaitMs)<0)||A.workspaceBefore!==void 0&&!h(A.workspaceBefore)||A.ok&&(A.exitCode!==0||A.error!==void 0)||!A.ok&&A.exitCode===0)throw new G("invalid_result");let W=A.piToolOutcome===void 0?void 0:NA(A.piToolOutcome);if(W===null||W&&!A.ok)throw new G("invalid_result");return{version:I,generation:A.generation,id:A.id,ok:A.ok,exitCode:Number(A.exitCode),stdout:A.stdout,stderr:A.stderr,...typeof A.cwd==="string"?{cwd:A.cwd}:{},...A.browserActions!==void 0?{browserActions:R(A.browserActions)}:{},...typeof A.error==="string"?{error:A.error}:{},...A.automaticProgressImage===!0?{automaticProgressImage:!0}:{},...A.resumed===!0?{resumed:!0}:{},...W?{piToolOutcome:W}:{},...A.workerElapsedMs!==void 0?{workerElapsedMs:Number(A.workerElapsedMs)}:{},...A.environmentWaitMs!==void 0?{environmentWaitMs:Number(A.environmentWaitMs)}:{},...h(A.workspaceBefore)?{workspaceBefore:{exitCode:A.workspaceBefore.exitCode,stdout:A.workspaceBefore.stdout,stderr:A.workspaceBefore.stderr}}:{}}}function h(x){return U(x)&&B(x,["exitCode","stdout","stderr"])&&Number.isSafeInteger(x.exitCode)&&Number(x.exitCode)>=0&&Number(x.exitCode)<=255&&typeof x.stdout==="string"&&x.stdout.length<=w&&typeof x.stderr==="string"&&x.stderr.length<=w}function FA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","id","sequence","stdout","stderr"])||A.type!=="progress"||A.version!==I||!Z(A.generation)||!M(A.id)||!Number.isSafeInteger(A.sequence)||Number(A.sequence)<1||typeof A.stdout!=="string"||A.stdout.length>_||typeof A.stderr!=="string"||A.stderr.length>_)throw new G("invalid_progress");return{type:"progress",version:I,generation:Number(A.generation),id:A.id,sequence:Number(A.sequence),stdout:A.stdout,stderr:A.stderr}}function IA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","fenceId","executorLaunchId","requestCancelVersion","managedJobsVersion","browserRunEnvelopeVersion","terminalCleanupVersion","guestMemoryVersion","guestMemoryDiagnosticsVersion","piToolsVersion","piToolsConfinement","backgroundBashVersion","machineSdkVersion","executionTimingVersion","environmentWaitVersion","workspaceBeforeVersion"])||A.type!=="claim"||A.version!==I||!Z(A.generation)||!J(A.fenceId)||!J(A.executorLaunchId)||A.requestCancelVersion!==void 0&&A.requestCancelVersion!==1||A.managedJobsVersion!==void 0&&A.managedJobsVersion!==k||A.guestMemoryVersion!==void 0&&A.guestMemoryVersion!==1||A.guestMemoryDiagnosticsVersion!==void 0&&(A.guestMemoryDiagnosticsVersion!==1||A.guestMemoryVersion!==1)||A.terminalCleanupVersion!==void 0&&A.terminalCleanupVersion!==1||A.browserRunEnvelopeVersion!==void 0&&A.browserRunEnvelopeVersion!==1||A.piToolsVersion!==void 0&&A.piToolsVersion!==1||A.piToolsConfinement!==void 0&&(!Y(A.piToolsConfinement)||A.piToolsVersion!==1)||A.backgroundBashVersion!==void 0&&A.backgroundBashVersion!==1||A.machineSdkVersion!==void 0&&A.machineSdkVersion!==1||A.executionTimingVersion!==void 0&&A.executionTimingVersion!==1||A.environmentWaitVersion!==void 0&&(A.environmentWaitVersion!==1||A.executionTimingVersion!==1)||A.workspaceBeforeVersion!==void 0&&A.workspaceBeforeVersion!==1)throw new G("invalid_claim");return{type:"claim",version:I,generation:A.generation,fenceId:A.fenceId,executorLaunchId:A.executorLaunchId,...A.requestCancelVersion===1?{requestCancelVersion:1}:{},...A.managedJobsVersion===1?{managedJobsVersion:1}:{},...A.guestMemoryVersion===1?{guestMemoryVersion:1}:{},...A.guestMemoryDiagnosticsVersion===1?{guestMemoryDiagnosticsVersion:1}:{},...A.terminalCleanupVersion===1?{terminalCleanupVersion:1}:{},...A.browserRunEnvelopeVersion===1?{browserRunEnvelopeVersion:1}:{},...A.piToolsVersion===1?{piToolsVersion:1}:{},...Y(A.piToolsConfinement)?{piToolsConfinement:{template:A.piToolsConfinement.template,quoteDepth:A.piToolsConfinement.quoteDepth}}:{},...A.backgroundBashVersion===1?{backgroundBashVersion:1}:{},...A.machineSdkVersion===1?{machineSdkVersion:1}:{},...A.executionTimingVersion===1?{executionTimingVersion:1}:{},...A.environmentWaitVersion===1?{environmentWaitVersion:1}:{},...A.workspaceBeforeVersion===1?{workspaceBeforeVersion:1}:{}}}function XA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","fenceId","executorLaunchId","workerVersion","workerArtifactSha256","requestCancelVersion","managedJobsVersion","lifecycleVersion","browserRunEnvelopeVersion","terminalCleanupVersion","guestMemoryVersion","guestMemoryDiagnosticsVersion","piToolsVersion","piToolsConfinementVersion","backgroundBashVersion","machineSdkVersion","executionTimingVersion","environmentWaitVersion","workspaceBeforeVersion"])||A.lifecycleVersion!==void 0&&A.lifecycleVersion!==1||A.workspaceBeforeVersion!==void 0&&A.workspaceBeforeVersion!==1||A.piToolsVersion!==void 0&&A.piToolsVersion!==1||A.piToolsConfinementVersion!==void 0&&(A.piToolsConfinementVersion!==1||A.piToolsVersion!==1)||A.backgroundBashVersion!==void 0&&A.backgroundBashVersion!==1||A.machineSdkVersion!==void 0&&A.machineSdkVersion!==1||A.executionTimingVersion!==void 0&&A.executionTimingVersion!==1||A.environmentWaitVersion!==void 0&&(A.environmentWaitVersion!==1||A.executionTimingVersion!==1)||A.guestMemoryVersion!==void 0&&A.guestMemoryVersion!==1||A.guestMemoryDiagnosticsVersion!==void 0&&(A.guestMemoryDiagnosticsVersion!==1||A.guestMemoryVersion!==1)||A.terminalCleanupVersion!==void 0&&A.terminalCleanupVersion!==1||A.browserRunEnvelopeVersion!==void 0&&A.browserRunEnvelopeVersion!==1||A.type!=="claim_ack"||A.version!==I||!Z(A.generation)||!J(A.fenceId)||!J(A.executorLaunchId)||!Number.isSafeInteger(A.workerVersion)||Number(A.workerVersion)<1||!S(A.workerArtifactSha256)||A.requestCancelVersion!==void 0&&A.requestCancelVersion!==1||A.managedJobsVersion!==void 0&&A.managedJobsVersion!==k)throw new G("invalid_claim_ack");return{type:"claim_ack",...A.guestMemoryVersion===1?{guestMemoryVersion:1}:{},...A.guestMemoryDiagnosticsVersion===1?{guestMemoryDiagnosticsVersion:1}:{},...A.terminalCleanupVersion===1?{terminalCleanupVersion:1}:{},...A.browserRunEnvelopeVersion===1?{browserRunEnvelopeVersion:1}:{},...A.lifecycleVersion===1?{lifecycleVersion:1}:{},...A.piToolsVersion===1?{piToolsVersion:1}:{},...A.piToolsConfinementVersion===1?{piToolsConfinementVersion:1}:{},...A.backgroundBashVersion===1?{backgroundBashVersion:1}:{},...A.machineSdkVersion===1?{machineSdkVersion:1}:{},...A.executionTimingVersion===1?{executionTimingVersion:1}:{},...A.environmentWaitVersion===1?{environmentWaitVersion:1}:{},...A.workspaceBeforeVersion===1?{workspaceBeforeVersion:1}:{},version:I,generation:A.generation,fenceId:A.fenceId,executorLaunchId:A.executorLaunchId,workerVersion:Number(A.workerVersion),workerArtifactSha256:A.workerArtifactSha256,...A.requestCancelVersion===1?{requestCancelVersion:1}:{},...A.managedJobsVersion===1?{managedJobsVersion:1}:{}}}function TA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","id","jobId","action","input"])||A.type!=="job"||A.version!==I||!Z(A.generation)||!M(A.id)||!M(A.jobId)||!U(A.input))throw new G("invalid_job_request");let W=A.input,N=Number.isSafeInteger(W.leaseExpiresAtMs)&&Number(W.leaseExpiresAtMs)>0,X=Number.isSafeInteger(W.sequence)&&Number(W.sequence)>=1;if(!(A.action==="start"?W.mode==="pty"?B(W,["mode","cols","rows","leaseExpiresAtMs"])&&C(A.jobId)&&z(W)&&N:B(W,["script","leaseExpiresAtMs"])&&typeof W.script==="string"&&W.script.length<=K&&N:A.action==="inspect"?B(W,["after"])&&Number.isSafeInteger(W.after)&&Number(W.after)>=0:A.action==="input"?"dataBase64"in W?B(W,["sequence","dataBase64"])&&C(A.jobId)&&X&&E(W.dataBase64)>0:B(W,["sequence","data","eof"])&&X&&typeof W.data==="string"&&W.data.length<=i&&typeof W.eof==="boolean":A.action==="resize"?B(W,["sequence","cols","rows"])&&C(A.jobId)&&X&&z(W):A.action==="renew"?B(W,["leaseExpiresAtMs"])&&N:A.action==="cancel"&&B(W,[])))throw new G("invalid_job_request");return A}function MA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","id","ok","job","error"])||A.type!=="job_result"||A.version!==I||!Z(A.generation)||!M(A.id))throw new G("invalid_job_result");if(A.ok===!1&&A.job===void 0&&typeof A.error==="string"&&WA.some((F)=>F===A.error))return A;let W=A.job;if(A.ok!==!0||A.error!==void 0||!U(W)||!B(W,["jobId","state","startedAtMs","finishedAtMs","leaseExpiresAtMs","exitCode","inputSequence","output","firstCursor","nextCursor","truncated","process","environmentRevision","environmentSnapshotId","pty"])||!M(W.jobId)||!["starting","running","exited","cancelled","expired","uncertain"].includes(String(W.state))||!Number.isSafeInteger(W.startedAtMs)||Number(W.startedAtMs)<1||!Number.isSafeInteger(W.leaseExpiresAtMs)||Number(W.leaseExpiresAtMs)<1||W.finishedAtMs!==null&&(!Number.isSafeInteger(W.finishedAtMs)||Number(W.finishedAtMs)<Number(W.startedAtMs))||W.exitCode!==null&&(!Number.isSafeInteger(W.exitCode)||Number(W.exitCode)<0||Number(W.exitCode)>255)||!Number.isSafeInteger(W.inputSequence)||Number(W.inputSequence)<0||!Number.isSafeInteger(W.firstCursor)||Number(W.firstCursor)<1||!Number.isSafeInteger(W.nextCursor)||Number(W.nextCursor)<Number(W.firstCursor)-1||typeof W.truncated!=="boolean"||!Array.isArray(W.output)||W.output.length>y)throw new G("invalid_job_result");if(W.environmentRevision===void 0!==(W.environmentSnapshotId===void 0)||W.environmentRevision!==void 0&&(!Number.isSafeInteger(W.environmentRevision)||Number(W.environmentRevision)<1||!J(W.environmentSnapshotId)))throw new G("invalid_job_result");let N=Number(W.firstCursor)-1,X=0;for(let F of W.output){if(!U(F)||!B(F,["cursor","stream","text"])||!Number.isSafeInteger(F.cursor)||Number(F.cursor)<=N||Number(F.cursor)>Number(W.nextCursor)||!["stdout","stderr"].includes(String(F.stream))||typeof F.text!=="string")throw new G("invalid_job_result");X+=F.text.length,N=Number(F.cursor)}if(X>d)throw new G("invalid_job_result");let V=W.state==="starting"||W.state==="running";if(V&&(W.finishedAtMs!==null||W.exitCode!==null)||!V&&W.finishedAtMs===null||W.state==="uncertain"&&W.exitCode!==null||W.state==="exited"&&W.exitCode===null||W.state==="cancelled"&&W.exitCode!==130||W.state==="expired"&&W.exitCode!==124)throw new G("invalid_job_result");if(W.process!==void 0){let F=W.process;if(!U(F)||!B(F,["pid","processGroupId","executorLaunchId"])||!Number.isSafeInteger(F.pid)||Number(F.pid)<1||F.processGroupId!==F.pid||!J(F.executorLaunchId)||!["starting","running"].includes(String(W.state)))throw new G("invalid_job_result")}if(W.pty!==void 0){let F=W.pty;if(!U(F)||!B(F,["version","cols","rows","output","cleanup"])||F.version!==H||!C(W.jobId)||!z(F)||W.output.length!==0||!Array.isArray(F.output)||F.output.length>y||(V?F.cleanup!=="pending":W.state==="uncertain"?F.cleanup!=="unconfirmed":F.cleanup!=="confirmed")||W.state==="running"&&(W.process===void 0||W.environmentRevision===void 0))throw new G("invalid_job_result");let T=Number(W.firstCursor)-1,P=0;for(let Q of F.output){if(!U(Q)||!B(Q,["cursor","dataBase64"])||!Number.isSafeInteger(Q.cursor)||Number(Q.cursor)<=T||Number(Q.cursor)>Number(W.nextCursor))throw new G("invalid_job_result");let q=E(Q.dataBase64);if(q<=0||(P+=q)>c)throw new G("invalid_job_result");T=Number(Q.cursor)}}return A}function qA(x){if(g(x)>s)throw new G("frame_too_large");let A=$(x);if(!U(A)||!B(A,["version","sessionId","operationId","runId","deviceId","rootId","workspace","binding","targetRevision","rootGrantRevision","generation","fenceId","executorLaunchId","job"])||A.version!==H||![A.sessionId,A.operationId,A.runId].every(M)||![A.deviceId,A.rootId,A.fenceId,A.executorLaunchId].every(J)||!Z(A.generation)||!Number.isSafeInteger(A.rootGrantRevision)||Number(A.rootGrantRevision)<1||!["workspace_source","mcp_control"].includes(String(A.binding))||!Number.isSafeInteger(A.targetRevision)||Number(A.targetRevision)<0||A.binding==="workspace_source"&&A.targetRevision!==0||!U(A.workspace))throw new G("invalid_pty_receipt");if(!f(A.workspace))throw new G("invalid_pty_receipt");let W=MA(JSON.stringify({type:"job_result",version:I,generation:A.generation,id:A.operationId,ok:!0,job:A.job}));if(!W.ok||!W.job.pty||W.job.pty.output.length!==0||W.job.process&&W.job.process.executorLaunchId!==A.executorLaunchId)throw new G("invalid_pty_receipt");return A}function yA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","id","targetId"])||A.type!=="cancel_request"||A.version!==I||!Z(A.generation)||!M(A.id)||!M(A.targetId))throw new G("invalid_cancel_request");return A}function mA(x){let A=$(x);if(!U(A)||!B(A,["type","version","generation","id","targetId","status"])||A.type!=="cancel_ack"||A.version!==I||!Z(A.generation)||!M(A.id)||!M(A.targetId)||!["cancelled","settled","not_found","unsupported","unconfirmed"].includes(String(A.status)))throw new G("invalid_cancel_ack");return A}function wA(x){let A=JSON.stringify(x);return BA(A),A}function hA(x){let A=JSON.stringify(x);return UA(A),A}function fA(x){let A=JSON.stringify(x);return FA(A),A}function kA(x){let A=JSON.stringify(x);return IA(A),A}function HA(x){let A=JSON.stringify(x);return XA(A),A}function O(x){return typeof x==="string"&&x.length>=1&&x.length<=AA&&!x.includes("\x00")}function VA(x){let A=["type","version","generation","id","jobRequestId","verb"];if(x.verb==="help")return B(x,A)?{verb:"help"}:null;if(x.verb==="describe"||x.verb==="namespace")return B(x,[...A,"name"])&&O(x.name)?{verb:x.verb,name:x.name}:null;if(x.verb==="search"){let W=x.args;if(!B(x,[...A,"query","args"])||typeof x.query!=="string"||x.query.trim().length<1||x.query.length>xA)return null;if(W===void 0)return{verb:"search",query:x.query};if(!U(W)||!B(W,["namespace","limit"])||W.namespace!==void 0&&!O(W.namespace)||W.limit!==void 0&&(!Number.isSafeInteger(W.limit)||Number(W.limit)<1||Number(W.limit)>50))return null;return{verb:"search",query:x.query,args:{...typeof W.namespace==="string"?{namespace:W.namespace}:{},...W.limit===void 0?{}:{limit:Number(W.limit)}}}}if(x.verb!=="call"||!B(x,[...A,"name","args"])||!O(x.name)||!U(x.args)||JSON.stringify(x.args).length>K)return null;return{verb:"call",name:x.name,args:x.args}}function gA(x){let A=$(x);if(!U(A)||A.type!=="sdk_request"||A.version!==I||!Z(A.generation)||!M(A.id)||!M(A.jobRequestId))throw new G("invalid_sdk_request");let W=VA(A);if(!W)throw new G("invalid_sdk_request");return{type:"sdk_request",version:I,generation:Number(A.generation),id:A.id,jobRequestId:A.jobRequestId,...W}}function ZA(x){let A=$(x);if(!U(A)||A.type!=="sdk_response"||A.version!==I||!Z(A.generation)||!M(A.id))throw new G("invalid_sdk_response");let W={type:"sdk_response",version:I,generation:Number(A.generation),id:A.id},N=["type","version","generation","id","ok"];if(A.ok===!0&&B(A,[...N,"result"])&&typeof A.result==="string"&&A.result.length<=_)return{...W,ok:!0,result:A.result};if(A.ok===!1&&B(A,[...N,"error"])&&typeof A.error==="string"&&A.error.length>=1&&A.error.length<=_)return{...W,ok:!1,error:A.error};throw new G("invalid_sdk_response")}function EA(x){let A=JSON.stringify(x);return ZA(A),A}
-export{$A as tg,KA as ug,QA as vg,I as wg,b as xg,K as yg,D as zg,_ as Ag,YA as Bg,p as Cg,k as Dg,i as Eg,d as Fg,y as Gg,LA as Hg,s as Ig,H as Jg,m as Kg,c as Lg,OA as Mg,n as Ng,t as Og,r as Pg,zA as Qg,l as Rg,SA as Sg,a as Tg,w as Ug,AA as Vg,xA as Wg,WA as Xg,G as Yg,M as Zg,Z as _g,J as $g,C as ah,S as bh,BA as ch,UA as dh,FA as eh,IA as fh,XA as gh,TA as hh,MA as ih,qA as jh,yA as kh,mA as lh,wA as mh,hA as nh,fA as oh,kA as ph,HA as qh,gA as rh,ZA as sh,EA as th};
+export{$A as vg,KA as wg,QA as xg,I as yg,b as zg,K as Ag,D as Bg,_ as Cg,YA as Dg,p as Eg,k as Fg,i as Gg,d as Hg,y as Ig,LA as Jg,s as Kg,H as Lg,m as Mg,c as Ng,OA as Og,n as Pg,t as Qg,r as Rg,zA as Sg,l as Tg,SA as Ug,a as Vg,w as Wg,AA as Xg,xA as Yg,WA as Zg,G as _g,M as $g,Z as ah,J as bh,C as ch,S as dh,BA as eh,UA as fh,FA as gh,IA as hh,XA as ih,TA as jh,MA as kh,qA as lh,yA as mh,mA as nh,wA as oh,hA as ph,fA as qh,kA as rh,HA as sh,gA as th,ZA as uh,EA as vh};

package/bin/vm-hands/{vm-hands-entry-lite-vn0r1e8c.js → vm-hands-entry-lite-kt418g2w.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ch as e,Fh as p,Gh as c,Hh as QQ,xh as a}from"./vm-hands-entry-lite-70d6f5r9.js";import{Mh as O}from"./vm-hands-entry-lite-p9eyqdq7.js";import{ki as Y}from"./vm-hands-entry-lite-6z2g0td2.js";import{createHmac as EQ,createPublicKey as hQ,randomBytes as yQ,randomUUID as ZQ,verify as vQ}from"crypto";import{chmodSync as _,existsSync as $Q,mkdirSync as pQ,readFileSync as cQ,realpathSync as uQ,renameSync as dQ,statSync as lQ,unlinkSync as iQ,writeFileSync as sQ}from"fs";import{basename as nQ,dirname as R,isAbsolute as WQ,join as N,resolve as oQ}from"path";var GZ=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var wQ="REASON_DESKTOP_RUNTIME",xQ="REASON_DESKTOP_RUNTIME_CHANNEL",VQ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",MQ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",VZ={[wQ]:"ARA_DESKTOP_RUNTIME",[xQ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[VQ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[MQ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function C(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as f,existsSync as U,mkdirSync as B,readFileSync as E,realpathSync as KQ,renameSync as fQ,unlinkSync as k,writeFileSync as A}from"fs";import{createPrivateKey as BQ,createPublicKey as kQ,generateKeyPairSync as AQ,randomUUID as FQ,sign as TQ}from"crypto";import{createRequire as _Q}from"module";import{homedir as PQ,platform as u}from"os";import{dirname as RQ,join as H}from"path";import{existsSync as NQ}from"fs";import{join as m}from"path";var K="libara_device_keychain.dylib",I="libreason_device_keychain.dylib";class OQ extends Error{code;constructor(Q,Z){super(Z);this.code=Q;this.name="ManagedRuntimeError"}}function g(Q){let Z=m(Q,I);return NQ(Z)?Z:m(Q,K)}var h=1,DQ=16384,w=65536,bQ=128,SQ=128,d=65536;class X extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function l(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var F=null;function i(){if(!F)try{F=_Q(import.meta.url)("bun:ffi")}catch{throw new X("native_boundary_unavailable")}return F}function LQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function CQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new X("invalid_credential_record");let Z=Q,$=LQ(Z.apiOrigin);if(Z.version!==h||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new X("invalid_credential_record");return{version:h,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function IQ(Q=process.execPath){let Z=Q;try{Z=KQ(Q)}catch{}return g(RQ(Z))}function z(Q){return i().ptr(Q)}function mQ(Q){if(!U(Q))throw new X("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=i();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(W){if(W instanceof X)throw W;throw new X("native_boundary_unavailable")}}function y(Q){return Buffer.from(Q).toString("base64url")}function x(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function s(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class n{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=IQ(),Z=u(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;C($)}symbols(){if(this.runtimePlatform!=="darwin")throw new X("unsupported_platform");this.library??=mQ(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(z(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new X("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(bQ),$=new BigUint64Array(1),W=Q==="load"?this.symbols().ara_device_key_load_public(z(Z),BigInt(Z.byteLength),z($)):this.symbols().ara_device_key_create_fresh_public(z(Z),BigInt(Z.byteLength),z($));if(W!==0)throw new X(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",W);let j=Number($[0]);if(!Number.isSafeInteger(j)||j!==65)throw new X("invalid_public_key");let q=y(Z.subarray(0,j));if(!x(q))throw new X("invalid_public_key");return q}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>d)throw new X("proof_sign_failed");let Z=new Uint8Array(SQ),$=new BigUint64Array(1),W=this.symbols().ara_device_key_sign(z(Q),BigInt(Q.byteLength),z(Z),BigInt(Z.byteLength),z($));if(W!==0)throw new X("proof_sign_failed",W);let j=Number($[0]);if(!Number.isSafeInteger(j)||j<1||j>Z.byteLength)throw new X("invalid_signature");let q=Z.subarray(0,j);if(!s(q))throw new X("invalid_signature");return y(q)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(z(Q));if(Z!==0||Q[0]!==1)throw new X("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(z(Q));if(Z!==0)throw new X("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(w),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(z(Q),BigInt(Q.byteLength),z(Z));if($===1)return null;if($!==0)throw new X("binding_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new X("invalid_binding");return Q.slice(0,W)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>w)throw new X("invalid_binding");let Z=this.symbols().ara_device_binding_create(z(Q),BigInt(Q.byteLength));if(Z!==0)throw new X("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>w)throw new X("invalid_binding");let Z=this.symbols().ara_device_binding_update(z(Q),BigInt(Q.byteLength));if(Z!==0)throw new X("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(z(Q));if(Z!==0)throw new X("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array(DQ),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(z(Q),BigInt(Q.byteLength),z(Z));if($===1)return null;if($!==0)throw new X("legacy_credential_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new X("invalid_credential_record");try{let j=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,W));return CQ(JSON.parse(j))}catch(j){if(j instanceof X)throw j;throw new X("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(z(Q));if(Z!==0)throw new X("legacy_credential_delete_failed",Z);return Q[0]===1}}function v(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new X("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),W=Buffer.from(Z.y,"base64url");if($.byteLength!==32||W.byteLength!==32)throw new X("invalid_public_key");let j=Buffer.concat([Buffer.of(4),$,W]).toString("base64url");if(!x(j))throw new X("invalid_public_key");return j}function gQ(){let Q=process.env.XDG_CONFIG_HOME?.trim()||H(PQ(),".config");c(Q);let Z=H(Q,"ara");return p(Z)?Z:H(Q,"reason")}class o{directory;constructor(Q=gQ()){this.directory=Q}keyPath(){return H(this.directory,"local-device.key")}bindingPath(){return H(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!U(Q))throw new X("proof_key_read_failed");try{let Z=E(Q,"utf8");return BQ({key:Z,format:"pem"})}catch{throw new X("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=kQ(Q);return v(Z)}createFreshPublicKey(){B(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=AQ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),W=this.keyPath();return A(W,$,{mode:384}),f(W,384),v(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>d)throw new X("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=TQ("sha256",Q,Z)}catch{throw new X("proof_sign_failed")}if(!s($))throw new X("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!U(Q))return!1;return k(Q),!0}loadBinding(){let Q=this.bindingPath();if(!U(Q))return null;try{return new Uint8Array(E(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>w)throw new X("invalid_binding");B(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(U(Z))throw new X("binding_create_failed");A(Z,Q,{mode:384}),f(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>w)throw new X("invalid_binding");B(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!U(Z))throw new X("binding_update_failed");let $=`${Z}.${FQ()}`;try{A($,Q,{mode:384,flag:"wx"}),f($,384),fQ($,Z)}finally{if(U($))k($)}}deleteBinding(){let Q=this.bindingPath();if(!U(Q))return!1;return k(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function T(){return u()==="darwin"?new n:new o}var V=Y.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/),r=Y.object({id:V,kind:Y.literal("permission_denied"),operation:Y.enum(["bash","read","write","edit"]),provenance:Y.enum(["sandbox_policy","os_permission_unknown"]),occurredAt:Y.string().datetime(),expiresAt:Y.string().datetime(),sessionId:V,deviceId:V,organizationId:V}).strict();var D=4;var M="macos-keychain-p256-v1",XQ=1,rQ=`ARA-DEVICE-BINDING-V1
+import{Eh as e,Hh as p,Ih as c,Jh as QQ,zh as a}from"./vm-hands-entry-lite-1xjtcxpn.js";import{Oh as O}from"./vm-hands-entry-lite-9dx3at21.js";import{mi as Y}from"./vm-hands-entry-lite-2xh7sjs0.js";import{createHmac as EQ,createPublicKey as hQ,randomBytes as yQ,randomUUID as ZQ,verify as vQ}from"crypto";import{chmodSync as _,existsSync as $Q,mkdirSync as pQ,readFileSync as cQ,realpathSync as uQ,renameSync as dQ,statSync as lQ,unlinkSync as iQ,writeFileSync as sQ}from"fs";import{basename as nQ,dirname as R,isAbsolute as WQ,join as N,resolve as oQ}from"path";var GZ=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var wQ="REASON_DESKTOP_RUNTIME",xQ="REASON_DESKTOP_RUNTIME_CHANNEL",VQ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",MQ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",VZ={[wQ]:"ARA_DESKTOP_RUNTIME",[xQ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[VQ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[MQ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function C(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as f,existsSync as U,mkdirSync as B,readFileSync as E,realpathSync as KQ,renameSync as fQ,unlinkSync as k,writeFileSync as A}from"fs";import{createPrivateKey as BQ,createPublicKey as kQ,generateKeyPairSync as AQ,randomUUID as FQ,sign as TQ}from"crypto";import{createRequire as _Q}from"module";import{homedir as PQ,platform as u}from"os";import{dirname as RQ,join as H}from"path";import{existsSync as NQ}from"fs";import{join as m}from"path";var K="libara_device_keychain.dylib",I="libreason_device_keychain.dylib";class OQ extends Error{code;constructor(Q,Z){super(Z);this.code=Q;this.name="ManagedRuntimeError"}}function g(Q){let Z=m(Q,I);return NQ(Z)?Z:m(Q,K)}var h=1,DQ=16384,w=65536,bQ=128,SQ=128,d=65536;class X extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function l(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var F=null;function i(){if(!F)try{F=_Q(import.meta.url)("bun:ffi")}catch{throw new X("native_boundary_unavailable")}return F}function LQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function CQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new X("invalid_credential_record");let Z=Q,$=LQ(Z.apiOrigin);if(Z.version!==h||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new X("invalid_credential_record");return{version:h,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function IQ(Q=process.execPath){let Z=Q;try{Z=KQ(Q)}catch{}return g(RQ(Z))}function z(Q){return i().ptr(Q)}function mQ(Q){if(!U(Q))throw new X("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=i();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(W){if(W instanceof X)throw W;throw new X("native_boundary_unavailable")}}function y(Q){return Buffer.from(Q).toString("base64url")}function x(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function s(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class n{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=IQ(),Z=u(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;C($)}symbols(){if(this.runtimePlatform!=="darwin")throw new X("unsupported_platform");this.library??=mQ(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(z(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new X("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(bQ),$=new BigUint64Array(1),W=Q==="load"?this.symbols().ara_device_key_load_public(z(Z),BigInt(Z.byteLength),z($)):this.symbols().ara_device_key_create_fresh_public(z(Z),BigInt(Z.byteLength),z($));if(W!==0)throw new X(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",W);let j=Number($[0]);if(!Number.isSafeInteger(j)||j!==65)throw new X("invalid_public_key");let q=y(Z.subarray(0,j));if(!x(q))throw new X("invalid_public_key");return q}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>d)throw new X("proof_sign_failed");let Z=new Uint8Array(SQ),$=new BigUint64Array(1),W=this.symbols().ara_device_key_sign(z(Q),BigInt(Q.byteLength),z(Z),BigInt(Z.byteLength),z($));if(W!==0)throw new X("proof_sign_failed",W);let j=Number($[0]);if(!Number.isSafeInteger(j)||j<1||j>Z.byteLength)throw new X("invalid_signature");let q=Z.subarray(0,j);if(!s(q))throw new X("invalid_signature");return y(q)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(z(Q));if(Z!==0||Q[0]!==1)throw new X("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(z(Q));if(Z!==0)throw new X("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(w),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(z(Q),BigInt(Q.byteLength),z(Z));if($===1)return null;if($!==0)throw new X("binding_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new X("invalid_binding");return Q.slice(0,W)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>w)throw new X("invalid_binding");let Z=this.symbols().ara_device_binding_create(z(Q),BigInt(Q.byteLength));if(Z!==0)throw new X("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>w)throw new X("invalid_binding");let Z=this.symbols().ara_device_binding_update(z(Q),BigInt(Q.byteLength));if(Z!==0)throw new X("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(z(Q));if(Z!==0)throw new X("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array(DQ),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(z(Q),BigInt(Q.byteLength),z(Z));if($===1)return null;if($!==0)throw new X("legacy_credential_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new X("invalid_credential_record");try{let j=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,W));return CQ(JSON.parse(j))}catch(j){if(j instanceof X)throw j;throw new X("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(z(Q));if(Z!==0)throw new X("legacy_credential_delete_failed",Z);return Q[0]===1}}function v(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new X("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),W=Buffer.from(Z.y,"base64url");if($.byteLength!==32||W.byteLength!==32)throw new X("invalid_public_key");let j=Buffer.concat([Buffer.of(4),$,W]).toString("base64url");if(!x(j))throw new X("invalid_public_key");return j}function gQ(){let Q=process.env.XDG_CONFIG_HOME?.trim()||H(PQ(),".config");c(Q);let Z=H(Q,"ara");return p(Z)?Z:H(Q,"reason")}class o{directory;constructor(Q=gQ()){this.directory=Q}keyPath(){return H(this.directory,"local-device.key")}bindingPath(){return H(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!U(Q))throw new X("proof_key_read_failed");try{let Z=E(Q,"utf8");return BQ({key:Z,format:"pem"})}catch{throw new X("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=kQ(Q);return v(Z)}createFreshPublicKey(){B(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=AQ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),W=this.keyPath();return A(W,$,{mode:384}),f(W,384),v(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>d)throw new X("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=TQ("sha256",Q,Z)}catch{throw new X("proof_sign_failed")}if(!s($))throw new X("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!U(Q))return!1;return k(Q),!0}loadBinding(){let Q=this.bindingPath();if(!U(Q))return null;try{return new Uint8Array(E(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>w)throw new X("invalid_binding");B(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(U(Z))throw new X("binding_create_failed");A(Z,Q,{mode:384}),f(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>w)throw new X("invalid_binding");B(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!U(Z))throw new X("binding_update_failed");let $=`${Z}.${FQ()}`;try{A($,Q,{mode:384,flag:"wx"}),f($,384),fQ($,Z)}finally{if(U($))k($)}}deleteBinding(){let Q=this.bindingPath();if(!U(Q))return!1;return k(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function T(){return u()==="darwin"?new n:new o}var V=Y.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/),r=Y.object({id:V,kind:Y.literal("permission_denied"),operation:Y.enum(["bash","read","write","edit"]),provenance:Y.enum(["sandbox_policy","os_permission_unknown"]),occurredAt:Y.string().datetime(),expiresAt:Y.string().datetime(),sessionId:V,deviceId:V,organizationId:V}).strict();var D=4;var M="macos-keychain-p256-v1",XQ=1,rQ=`ARA-DEVICE-BINDING-V1
 `;function tQ(Q){return Q===void 0||typeof Q==="number"&&Number.isInteger(Q)&&Q>=1&&Q<=4}function jQ(Q,Z=Date.now()){let $=r.safeParse(Q);if(!$.success)return!1;let W=$.data,j=typeof W.occurredAt==="string"?Date.parse(W.occurredAt):NaN,q=typeof W.expiresAt==="string"?Date.parse(W.expiresAt):NaN;return W.kind==="permission_denied"&&["bash","read","write","edit"].includes(W.operation)&&["sandbox_policy","os_permission_unknown"].includes(W.provenance)&&Number.isFinite(j)&&j<=Z&&q>Z&&q>j&&q-j<=600000}function uZ(Q,Z,$=Date.now()){if(!Q||!Z||Q.state!=="connected"||Q.deviceId!==Z.deviceId)return null;let W=Date.parse(Q.lastHeartbeatAt??""),j=Q.permissionRecovery;if(!($-W>=0&&$-W<30000)||!jQ(j,$)||j.deviceId!==Z.deviceId||j.organizationId!==Z.orgId)return null;try{process.kill(Q.pid,0)}catch{return null}return j}function qQ(Q={},Z=O()){let $=a({env:{...process.env,...Q}}),W=Q.XDG_CONFIG_HOME?.trim()||N(Z,".config");return QQ(W,...$==="staging"?["staging"]:[])}function b(Q={},Z=O()){return N(qQ(Q,Z),"local-device.json")}function zQ(Q={},Z=O()){return N(qQ(Q,Z),"local-daemon.json")}function S(Q,Z){pQ(R(Q),{recursive:!0,mode:448}),_(R(Q),448);let $=`${Q}.${process.pid}.${ZQ()}.tmp`;try{sQ($,`${JSON.stringify(Z,null,2)}
 `,{mode:384,flag:"wx"}),_($,384),dQ($,Q),_(Q,384)}finally{if($Q($))iQ($)}return Q}function L(Q){if(!$Q(Q))return null;try{return JSON.parse(cQ(Q,"utf8"))}catch{return null}}function P(Q,Z,$){try{Q.onCredentialLifecycle?.({event:Z,...$?{reasonCode:$}:{}})}catch{}}function aQ(Q){if(!Array.isArray(Q))return null;let Z=[];for(let $ of Q){if(!$||typeof $!=="object")return null;let W=$;if(typeof W.id!=="string"||typeof W.label!=="string"||typeof W.path!=="string"||typeof W.pathFingerprint!=="string"||!W.permissions||typeof W.permissions.read!=="boolean"||typeof W.permissions.write!=="boolean"||typeof W.permissions.execute!=="boolean"||typeof W.permissions.discover_environment!=="boolean"||typeof W.permissions.expose_mcp!=="boolean")return null;Z.push({id:W.id,label:W.label,path:W.path,pathFingerprint:W.pathFingerprint,permissions:W.permissions})}return Z}function GQ(Q,Z,$=[]){let W=Object.keys(Q);return Z.every((j)=>Object.hasOwn(Q,j))&&W.every((j)=>Z.includes(j)||$.includes(j))}function eQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost")return null;return Z.origin}catch{return null}}function JQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q,$=aQ(Z.roots),W=eQ(Z.apiOrigin);if(!W||typeof Z.orgId!=="string"||typeof Z.deviceId!=="string"||typeof Z.displayName!=="string"||typeof Z.registeredAt!=="string"||!tQ(Z.handsSlots)||Z.worker!==void 0&&(!Z.worker||!/^[a-f0-9]{64}$/.test(Z.worker.configDigest)||!["persistent","ephemeral"].includes(Z.worker.lifetime)||!Number.isFinite(Date.parse(Z.worker.expiresAt)))||!$)return null;return{apiOrigin:W,orgId:Z.orgId,deviceId:Z.deviceId,displayName:Z.displayName,registeredAt:Z.registeredAt,...Z.handsSlots!==void 0?{handsSlots:Z.handsSlots}:{},...Z.worker!==void 0?{worker:Z.worker}:{},roots:$}}function QZ(Q){return{...Q,credentialStorage:M}}function ZZ(Q){return{version:D,apiOrigin:Q.apiOrigin,orgId:Q.orgId,deviceId:Q.deviceId,devicePublicKey:Q.devicePublicKey,displayName:Q.displayName,registeredAt:Q.registeredAt,...Q.handsSlots!==void 0?{handsSlots:Q.handsSlots}:{},...Q.worker!==void 0?{worker:Q.worker}:{},roots:Q.roots.map((Z)=>({id:Z.id,label:Z.label,path:Z.path,pathFingerprint:Z.pathFingerprint,permissions:{read:Z.permissions.read,write:Z.permissions.write,execute:Z.permissions.execute,discover_environment:Z.permissions.discover_environment,expose_mcp:Z.permissions.expose_mcp}})),credentialStorage:M}}function UQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q;if(!GQ(Z,["version","apiOrigin","orgId","deviceId","devicePublicKey","displayName","registeredAt","roots","credentialStorage"],["handsSlots","worker"]))return null;let $=JQ(Z);if(!$||Z.version!==D||Z.credentialStorage!==M||!x(Z.devicePublicKey))return null;return{version:D,...$,devicePublicKey:Z.devicePublicKey,credentialStorage:M}}function YQ(Q){return new TextEncoder().encode(`${rQ}${JSON.stringify(ZZ(Q))}`)}function $Z(Q){let Z=Buffer.from(Q,"base64url");return hQ({format:"jwk",key:{kty:"EC",crv:"P-256",x:Z.subarray(1,33).toString("base64url"),y:Z.subarray(33,65).toString("base64url")}})}function WZ(Q,Z){let $={version:XQ,state:Q,signature:Z.sign(YQ(Q))};return new TextEncoder().encode(JSON.stringify($))}function HQ(Q){let Z;try{Z=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(Q))}catch{throw new X("invalid_binding")}if(!Z||typeof Z!=="object"||Array.isArray(Z))throw new X("invalid_binding");let $=Z;if(!GQ($,["version","state","signature"])||$.version!==XQ||typeof $.signature!=="string"||!/^[A-Za-z0-9_-]{10,128}$/.test($.signature))throw new X("invalid_binding");let W=UQ($.state);if(!W)throw new X("invalid_binding");let j=!1;try{j=vQ("sha256",YQ(W),$Z(W.devicePublicKey),Buffer.from($.signature,"base64url"))}catch{j=!1}if(!j)throw new X("invalid_binding");return W}function XZ(Q){let{credentialStorage:Z,...$}=Q;return $}function jZ(Q){return Q instanceof X?l(Q):"credential_boundary_failed"}function dZ(Q=b(),Z={}){let $=L(Q),W=Z.proofStore??Z.credentialStore??T(),j=W.loadBinding();if(!j){if($&&typeof $==="object"&&!Array.isArray($)&&qZ($))return null;if($!==null)throw new X("invalid_binding");return null}let q=HQ(j),G=W.loadPublicKey();if(W.privateKeyIsNonExtractable(),G!==q.devicePublicKey)throw new X("invalid_public_key");let J=UQ($);if(Z.repair!==!1&&(!J||JSON.stringify(J)!==JSON.stringify(q)))S(Q,q);return XZ(q)}function qZ(Q){let Z=Q,$=JQ(Q);if(!$)return null;if(Z.version===2){if(typeof Z.deviceCredential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.deviceCredential)||Z.deviceCredential.length>4096)return null;return{state:$,credentialSource:"plaintext-v2"}}if(Z.version!==3||Z.credentialStorage!=="macos-keychain-v1"||"deviceCredential"in Z)return null;return{state:$,credentialSource:"keychain-v3"}}function lZ(Q,Z=b(),$={}){let W=$.proofStore??$.credentialStore??T();P($,"credential.store_started");try{if(!x(Q.devicePublicKey)||W.loadPublicKey()!==Q.devicePublicKey)throw new X("invalid_public_key");W.privateKeyIsNonExtractable();let j=QZ(Q),q=W.loadBinding();if(q){let J=HQ(q);if(J.devicePublicKey!==Q.devicePublicKey||J.orgId!==Q.orgId||J.deviceId!==Q.deviceId||J.apiOrigin!==Q.apiOrigin&&!e(J.apiOrigin,Q.apiOrigin))throw new X("invalid_binding")}let G=WZ(j,W);if(q)W.updateBinding(G);else W.createBinding(G);return S(Z,j),P($,"credential.store_completed"),Z}catch(j){throw P($,"credential.store_failed",jZ(j)),j}}function iZ(Q=zQ()){let Z=L(Q);if(!Z||typeof Z!=="object")return null;let $=Z;if($.version!==1||typeof $.pid!=="number"||!Number.isInteger($.pid)||!["starting","connected","stopped","error"].includes($.state??"")||typeof $.startedAt!=="string"||$.lastHeartbeatAt!==void 0&&typeof $.lastHeartbeatAt!=="string"||$.lastUsedAt!==void 0&&typeof $.lastUsedAt!=="string"||$.organizationId!==void 0&&typeof $.organizationId!=="string"||$.organizationName!==void 0&&typeof $.organizationName!=="string"||$.organizationSlug!==void 0&&typeof $.organizationSlug!=="string"||$.error!==void 0&&typeof $.error!=="string"||$.reconnectingSince!==void 0&&typeof $.reconnectingSince!=="string"||$.workspace!==void 0&&typeof $.workspace!=="string")return null;if($.permissionRecovery!==void 0&&!jQ($.permissionRecovery))delete $.permissionRecovery;return $}function sZ(Q,Z=zQ()){return S(Z,Q)}var t=1;function zZ(Q=b()){return N(R(Q),"local-device.proxy.json")}function nZ(Q=zZ()){let Z=L(Q);if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let $=Z;if($.version!==t||typeof $.url!=="string"||$.url.length===0||$.caFile!==void 0&&(typeof $.caFile!=="string"||!WQ($.caFile)))return null;return{version:t,url:$.url,...$.caFile?{caFile:$.caFile}:{}}}function oZ(Q,Z={read:!0,write:!1,execute:!1,discover_environment:!1,expose_mcp:!1},$=yQ(32)){let W=new Set,j=[];for(let q of Q){let G=uQ(WQ(q)?q:oQ(q));if(!lQ(G).isDirectory())throw Error(`Local execution root is not a directory: ${q}`);if(W.has(G))continue;W.add(G),j.push({id:ZQ(),label:nQ(G)||G,path:G,pathFingerprint:EQ("sha256",$).update(G).digest("hex"),permissions:{...Z}})}if(j.length===0)throw Error("At least one explicit local execution root is required.");return j}
-export{OQ as bg,X as cg,IQ as dg,x as eg,s as fg,n as gg,o as hg,jQ as ig,uZ as jg,b as kg,zQ as lg,dZ as mg,lZ as ng,iZ as og,sZ as pg,t as qg,nZ as rg,oZ as sg};
+export{OQ as dg,X as eg,IQ as fg,x as gg,s as hg,n as ig,o as jg,jQ as kg,uZ as lg,b as mg,zQ as ng,dZ as og,lZ as pg,iZ as qg,sZ as rg,t as sg,nZ as tg,oZ as ug};

package/bin/vm-hands/{vm-hands-entry-lite-tt4zgt64.js → vm-hands-entry-lite-m16qf0yy.js}

@@ -1,3 +1,3 @@
 // @bun
-import{D as T,F as U}from"./vm-hands-entry-lite-5qe562gn.js";import{qc as V}from"./vm-hands-entry-lite-8ynztq9j.js";import{uh as G,xh as M,yh as Q}from"./vm-hands-entry-lite-70d6f5r9.js";function W(j,B){let k=G(j,"REASON_API_URL")?.trim();if(!k)return Q(B);let z=new URL(k);if(z.protocol!=="https:"&&!(z.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(z.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return z.origin}function X(j){return G(j,"REASON_API_URL")?.trim()?W(j,"production"):void 0}function $(j){return G(j,"REASON_API_KEY")?.trim()||void 0}async function N(j,B){let k=j.env??process.env,z=$(k);if(!z)return(j.getCredentials??T)({apiOrigin:X(k),signal:B});let J=W(k,j.channel??M({env:k})),D=await(j.fetchImpl??fetch)(J+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+z,accept:"application/json"},signal:B}),L=await D.json().catch(()=>({})),w=V(L)?L:{};if(!D.ok){let H=typeof w.detail==="string"?w.detail:typeof w.message==="string"?w.message:"API key authentication failed ("+D.status+")";throw new U(D.status,typeof w.error==="string"?w.error:"api_key_auth_failed",H)}if(typeof w.org_id!=="string"||!w.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let Z=Array.isArray(w.scopes)?w.scopes.filter((H)=>typeof H==="string"):[];return{credentialKind:"api_key",apiOrigin:J,accessToken:z,orgId:w.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:Z}}async function P(j){let B=await N(j),k=X(j.env??process.env);if(!B)throw Error(k?`Not signed in to ${k}. Set REASON_API_KEY, or run \`reason login --api-url ${k}\`.`:"Not signed in. Run `reason login`, or set REASON_API_KEY.");return B}
+import{D as T,F as U}from"./vm-hands-entry-lite-pnkfgnqz.js";import{qc as V}from"./vm-hands-entry-lite-8ynztq9j.js";import{Ah as Q,wh as G,zh as M}from"./vm-hands-entry-lite-1xjtcxpn.js";function W(j,B){let k=G(j,"REASON_API_URL")?.trim();if(!k)return Q(B);let z=new URL(k);if(z.protocol!=="https:"&&!(z.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(z.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return z.origin}function X(j){return G(j,"REASON_API_URL")?.trim()?W(j,"production"):void 0}function $(j){return G(j,"REASON_API_KEY")?.trim()||void 0}async function N(j,B){let k=j.env??process.env,z=$(k);if(!z)return(j.getCredentials??T)({apiOrigin:X(k),signal:B});let J=W(k,j.channel??M({env:k})),D=await(j.fetchImpl??fetch)(J+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+z,accept:"application/json"},signal:B}),L=await D.json().catch(()=>({})),w=V(L)?L:{};if(!D.ok){let H=typeof w.detail==="string"?w.detail:typeof w.message==="string"?w.message:"API key authentication failed ("+D.status+")";throw new U(D.status,typeof w.error==="string"?w.error:"api_key_auth_failed",H)}if(typeof w.org_id!=="string"||!w.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let Z=Array.isArray(w.scopes)?w.scopes.filter((H)=>typeof H==="string"):[];return{credentialKind:"api_key",apiOrigin:J,accessToken:z,orgId:w.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:Z}}async function P(j){let B=await N(j),k=X(j.env??process.env);if(!B)throw Error(k?`Not signed in to ${k}. Set REASON_API_KEY, or run \`reason login --api-url ${k}\`.`:"Not signed in. Run `reason login`, or set REASON_API_KEY.");return B}
 export{W as v,X as w,$ as x,N as y,P as z};

package/bin/vm-hands/{vm-hands-entry-lite-45cnnd8e.js → vm-hands-entry-lite-mhsv58hw.js}

@@ -1,3 +1,3 @@
 // @bun
 var n=Object.create;var{getPrototypeOf:o,defineProperty:e,getOwnPropertyNames:k,getOwnPropertyDescriptor:p}=Object,l=Object.prototype.hasOwnProperty;function m(a){return this[a]}var q,r,u=(a,b,c)=>{var d=a!=null&&typeof a==="object";if(d){var h=b?q??=new WeakMap:r??=new WeakMap,i=h.get(a);if(i)return i}c=a!=null?n(o(a)):{};let f=b||!a||!a.__esModule?e(c,"default",{value:a,enumerable:!0}):c;for(let g of k(a))if(!l.call(f,g))e(f,g,{get:m.bind(a,g),enumerable:!0});if(d)h.set(a,f);return f},v=(a)=>{var b=(j??=new WeakMap).get(a),c;if(b)return b;if(b=e({},"__esModule",{value:!0}),a&&typeof a==="object"||typeof a==="function"){for(var d of k(a))if(!l.call(b,d))e(b,d,{get:m.bind(a,d),enumerable:!(c=p(a,d))||c.enumerable})}return j.set(a,b),b},j,w=(a,b)=>()=>(b||a((b={exports:{}}).exports,b),b.exports);var s=(a)=>a;function t(a,b){this[a]=s.bind(null,b)}var x=(a,b)=>{for(var c in b)e(a,c,{get:b[c],enumerable:!0,configurable:!0,set:t.bind(b,c)})};var y=(a,b)=>()=>(a&&(b=a(a=0)),b);var z=import.meta.require;
-export{u as ti,v as ui,w as vi,x as wi,y as xi,z as yi};
+export{u as vi,v as wi,w as xi,x as yi,y as zi,z as Ai};

package/bin/vm-hands/{vm-hands-entry-lite-60t59y3n.js → vm-hands-entry-lite-mw2vtxm3.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Hd as _J,le as CJ,zd as UJ}from"./vm-hands-entry-lite-bbc5r4y1.js";import{createHash as y,randomBytes as zJ}from"crypto";import{closeSync as LJ,fsyncSync as qJ,mkdirSync as RJ,openSync as NJ,renameSync as fJ,rmSync as mJ,statSync as DJ,writeSync as AJ,constants as V}from"fs";import{join as o}from"path";var bJ=1;var d=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function KJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function jJ(J,Z){let{payload:z,authority:K}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!K||typeof K!=="object"||Array.isArray(K)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||K.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function xJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&d.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:KJ(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var H=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),I=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function R(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(R).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${R(J[Z])}`).join(",")}}`}async function QZ(J){let Z=await crypto.subtle.importKey("pkcs8",I(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=I(J.device_key.spki),K=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),U=new Uint8Array(await crypto.subtle.exportKey("spki",K.publicKey)),L=y("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:K,signingSpki:z,agreementSpki:U,fingerprint:L}}var cJ=4;class pJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;verifiedSinceRun=!1;bootKillPending=!1;unverified=new Set;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,K){this.init=J;this.keys=Z;this.hooks=z;this.options=K;if(!d.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let K=Date.now()+Z;;){let U=this.bound.get(J);if(!U)return!1;if(U.envInstalled)return!0;if(Date.now()>=K||z?.aborted)return!1;await new Promise((L)=>setTimeout(L,25))}}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:bJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:H(this.keys.signingSpki),env_public_key:H(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:H(zJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(R(Z)));return{...Z,device_signature:H(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),K=H(zJ(32)),U=CJ({method:"GET",pathAndQuery:UJ,timestamp:z,nonce:K,challenge:J,bodySha256:y("sha256").update("").digest("hex")}),L=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(U)));return{t:"hello",timestamp:z,nonce:K,signature:H(lJ(L)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new W("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!d.test(z))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(y("sha256").update(R({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new W("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=cJ)throw new W("vm_hands_busy","every bind slot is held");return this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,K=!1;try{if(Z.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new W("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload(),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.verifiedSinceRun=!1,this.servedRun=!0,K=!0;let{launchId:U,applied:L,readyData:P}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),E=this.hooks.restatLayout(),A=null;if(J.env){let O=J.claim?.owner??{},g=jJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof O.device_id==="string"?O.device_id:"",rootId:J.claim?.root_id??""});A=this.hooks.installEnvironment(J.bind_id,g),z=this.writeJobEnvRootOnly(J.bind_id,g)}if(this.unbinding.has(J.bind_id))throw new W("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:A!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:A,layout:E,...P?{ready_data:P}:{},policy_digest:y("sha256").update(R({hands_confinement:L.hands_confinement??null,browser_egress:L.browser_egress??null})).digest("hex")}}catch(U){if(z)GJ(z);if(K){let P=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:P,own:!0}).catch(()=>{this.unverified.add(J.bind_id)}),this.verifiedSinceRun=!1}this.binding.delete(J.bind_id);let L=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof W?U:new W(L,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new W("vm_hands_not_bound","environment delivered while not bound");if(!d.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let K=jJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),U=this.hooks.installEnvironment(Z.bindId,K);if(Z.envInstalled=!0,Z.envDirectory)GJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${U}`,K),{snapshot_id:J.snapshotId,installed_revision:U,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new W("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:y("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((K)=>K!==J);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:void 0)}catch(K){throw this.unverified.add(J),this.verifiedSinceRun=!1,K}if(!z.length)this.verifiedSinceRun=!0,this.unverified.clear();if(Z?.envDirectory)GJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},K=await crypto.subtle.importKey("spki",I(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),U=await crypto.subtle.deriveKey({name:"ECDH",public:K},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),L=await crypto.subtle.decrypt({name:"AES-GCM",iv:I(J.iv),additionalData:new TextEncoder().encode(Z)},U,I(J.ct)).catch(z),P=JSON.parse(new TextDecoder().decode(L));if(!P||typeof P!=="object"||Array.isArray(P))throw new W("vm_hands_env_invalid","env not an object");return P}writeJobEnvRootOnly(J,Z){let z=o(this.options.envRoot,`bind-${J}`);RJ(z,{mode:448});let K=DJ(z);if(!K.isDirectory()||(K.mode&63)!==0||K.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let U=Z.variables&&typeof Z.variables==="object"?Z.variables:{},L=Object.entries(U).filter(([A,O])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(A)&&typeof O==="string").map(([A,O])=>`export ${A}='${String(O).replaceAll("'","'\\''")}'`).join(`
+import{Bd as UJ,Jd as _J,ne as CJ}from"./vm-hands-entry-lite-bjc5fdv3.js";import{createHash as y,randomBytes as zJ}from"crypto";import{closeSync as LJ,fsyncSync as qJ,mkdirSync as RJ,openSync as NJ,renameSync as fJ,rmSync as mJ,statSync as DJ,writeSync as AJ,constants as V}from"fs";import{join as o}from"path";var bJ=1;var d=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function KJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function jJ(J,Z){let{payload:z,authority:K}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!K||typeof K!=="object"||Array.isArray(K)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||K.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function xJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&d.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:KJ(J)?J.environment_sealed:null}}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var H=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),I=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function R(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(R).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${R(J[Z])}`).join(",")}}`}async function QZ(J){let Z=await crypto.subtle.importKey("pkcs8",I(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=I(J.device_key.spki),K=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),U=new Uint8Array(await crypto.subtle.exportKey("spki",K.publicKey)),L=y("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:K,signingSpki:z,agreementSpki:U,fingerprint:L}}var cJ=4;class pJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;verifiedSinceRun=!1;bootKillPending=!1;unverified=new Set;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,K){this.init=J;this.keys=Z;this.hooks=z;this.options=K;if(!d.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let K=Date.now()+Z;;){let U=this.bound.get(J);if(!U)return!1;if(U.envInstalled)return!0;if(Date.now()>=K||z?.aborted)return!1;await new Promise((L)=>setTimeout(L,25))}}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:bJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:H(this.keys.signingSpki),env_public_key:H(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:H(zJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(R(Z)));return{...Z,device_signature:H(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),K=H(zJ(32)),U=CJ({method:"GET",pathAndQuery:UJ,timestamp:z,nonce:K,challenge:J,bodySha256:y("sha256").update("").digest("hex")}),L=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(U)));return{t:"hello",timestamp:z,nonce:K,signature:H(lJ(L)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new W("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!d.test(z))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(y("sha256").update(R({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new W("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=cJ)throw new W("vm_hands_busy","every bind slot is held");return this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,K=!1;try{if(Z.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new W("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.servedRun&&!this.verifiedSinceRun)await this.hooks.killAndVerifyPayload(),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.verifiedSinceRun=!1,this.servedRun=!0,K=!0;let{launchId:U,applied:L,readyData:P}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim}),E=this.hooks.restatLayout(),A=null;if(J.env){let O=J.claim?.owner??{},g=jJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof O.device_id==="string"?O.device_id:"",rootId:J.claim?.root_id??""});A=this.hooks.installEnvironment(J.bind_id,g),z=this.writeJobEnvRootOnly(J.bind_id,g)}if(this.unbinding.has(J.bind_id))throw new W("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:A!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:A,layout:E,...P?{ready_data:P}:{},policy_digest:y("sha256").update(R({hands_confinement:L.hands_confinement??null,browser_egress:L.browser_egress??null})).digest("hex")}}catch(U){if(z)GJ(z);if(K){let P=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:P,own:!0}).catch(()=>{this.unverified.add(J.bind_id)}),this.verifiedSinceRun=!1}this.binding.delete(J.bind_id);let L=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof W?U:new W(L,"executor refused the bind")}}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new W("vm_hands_not_bound","environment delivered while not bound");if(!d.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let K=jJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId}),U=this.hooks.installEnvironment(Z.bindId,K);if(Z.envInstalled=!0,Z.envDirectory)GJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${U}`,K),{snapshot_id:J.snapshotId,installed_revision:U,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new W("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:y("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((K)=>K!==J);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:void 0)}catch(K){throw this.unverified.add(J),this.verifiedSinceRun=!1,K}if(!z.length)this.verifiedSinceRun=!0,this.unverified.clear();if(Z?.envDirectory)GJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},K=await crypto.subtle.importKey("spki",I(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),U=await crypto.subtle.deriveKey({name:"ECDH",public:K},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),L=await crypto.subtle.decrypt({name:"AES-GCM",iv:I(J.iv),additionalData:new TextEncoder().encode(Z)},U,I(J.ct)).catch(z),P=JSON.parse(new TextDecoder().decode(L));if(!P||typeof P!=="object"||Array.isArray(P))throw new W("vm_hands_env_invalid","env not an object");return P}writeJobEnvRootOnly(J,Z){let z=o(this.options.envRoot,`bind-${J}`);RJ(z,{mode:448});let K=DJ(z);if(!K.isDirectory()||(K.mode&63)!==0||K.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let U=Z.variables&&typeof Z.variables==="object"?Z.variables:{},L=Object.entries(U).filter(([A,O])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(A)&&typeof O==="string").map(([A,O])=>`export ${A}='${String(O).replaceAll("'","'\\''")}'`).join(`
 `)+`
 `,P=o(z,`.job.env.${zJ(8).toString("hex")}`),E=NJ(P,V.O_WRONLY|V.O_CREAT|V.O_EXCL|V.O_NOFOLLOW,384);try{AJ(E,L),qJ(E)}finally{LJ(E)}return fJ(P,o(z,"job.env")),z}}function GJ(J){try{let Z=o(J,"job.env"),z=DJ(Z).size,K=NJ(Z,V.O_WRONLY|V.O_NOFOLLOW);try{AJ(K,Buffer.alloc(z)),qJ(K)}finally{LJ(K)}}catch{}mJ(J,{recursive:!0,force:!0})}function lJ(J){if(J.length!==64)throw new W("vm_hands_signature_invalid","unexpected ECDSA signature length");let Z=(U)=>{let L=0;while(L<U.length-1&&U[L]===0)L++;let P=U.subarray(L),E=P[0]&128?Uint8Array.of(0,...P):P;return Uint8Array.of(2,E.length,...E)},z=Z(J.subarray(0,32)),K=Z(J.subarray(32));return Uint8Array.of(48,z.length+K.length,...z,...K)}import{randomUUID as uJ}from"crypto";var oJ="/app/local-runtime/session?register=vm_hands_v1",dJ="/app/local-runtime",MJ=25000,rJ=20000,iJ=1e4,TJ=5000,sJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),YJ=75000,aJ=2000,nJ=1e4,r=20000;function EJ(J,Z){return typeof J==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(J)?J:Z}class T extends Error{}var tJ=64;async function hJ(J,Z){let z=[...J.modelOps.get(Z)??[]];for(let K of z)K.abort.abort();await Promise.race([Promise.all(z.map((K)=>K.settled)),new Promise((K)=>setTimeout(K,TJ))])}async function eJ(J){let Z=[...J.personTerminals];for(let z of Z)z.abort.abort();if(Z.length)await Promise.race([Promise.all(Z.map((z)=>z.settled)),new Promise((z)=>setTimeout(z,TJ))]);return Z.length}async function f(J,Z,z){return await hJ(J,z),Z.unbind(z)}function i(J){for(let Z of J.outbox?.splice(0)??[])Z.reject(Error("vm_hands_attempt_ended"))}var OJ=15000,JZ=1e4,ZZ=1000;async function jZ(J){let Z=Date.now(),z={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:0},K=J.log??(()=>{}),U=async(L)=>{for(let[P,E]of[...z.turns]){z.turns.delete(P),J.onTurn?.(P,null),i(E);let A=await f(z,J.agent,P).catch(()=>null);if(A)z.receipts.push({turn:E,failure:"vm_hands_bind_lost",unbound:A});K("vm_hands.bound_dropped",{reason:L})}};try{for(let L=0;!J.signal.aborted;L++){let P=await $Z(J,z).catch((A)=>{if(A instanceof W&&z.deviceId===null&&A.code==="vm_hands_no_session"&&Date.now()-Z<nJ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(A instanceof W&&z.deviceId===null)throw A;return{closeCode:0,closeReason:A instanceof Error?A.message:String(A)}});if(K("vm_hands.session_closed",{close_code:P.closeCode,reason:P.closeReason.slice(0,120),registered:z.deviceId!==null}),P.closeCode===4401||z.attest==="refused")return;if(J.signal.aborted)return;if(z.turns.size&&Date.now()-z.lostAt>=YJ)await U("reconnect_deadline");if(z.served)z.served=!1,L=0;let E=P.closeReason==="drain_reconnect"?0:P.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(L,5),2000):z.turns.size?Math.min(250*2**Math.min(L,5),5000,Math.max(0,z.lostAt+YJ-Date.now())):Math.min(500*2**L,30000);if(await new Promise((A)=>setTimeout(A,E)),z.turns.size&&Date.now()-z.lostAt>=YJ)await U("reconnect_deadline")}}finally{await U("session_ended")}}async function $Z(J,Z){let z=Z.deviceId,K=J.log??(()=>{}),U=z?`/app/local-runtime/session?device_id=${encodeURIComponent(z)}`:oJ,L=`${J.apiOrigin.replace(/^http/,"ws")}${U}`,P=new WebSocket(L),E=0,A="",O=new Map,g=[],m=null,wJ=new Promise(($)=>{P.onclose=(Q)=>{E=Q.code,A=Q.reason;for(let G of O.values())G.reject(new T(`session closed ${Q.code}`));for(let G of Z.attestWaiters.splice(0))G(!1);O.clear(),$()}});P.onmessage=($)=>{let Q;try{Q=JSON.parse(String($.data))}catch{P.close(4400);return}if(Q.t==="res"){let G=Q;O.get(G.id)?.resolve({status:G.status,body:G.body}),O.delete(G.id);return}if(Q.t==="reconnect"){let G=Math.max(0,Math.min(Number(Q.after_ms)||0,ZZ));K("vm_hands.drain_reconnect",{after_ms:G}),setTimeout(()=>{try{P.close(4001,"drain_reconnect")}catch{}},G).unref?.();return}if(!m?.(Q))g.push(Q)};let b=($,Q)=>new Promise((G,X)=>{let j=g.findIndex((C)=>$.includes(C.t));if(j>=0){G(g.splice(j,1)[0]);return}let q=setTimeout(()=>{m=null,X(new W("vm_hands_no_register",`no ${$.join("/")} in ${Q} ms`))},Q);m=(C)=>{if(!$.includes(C.t))return!1;return clearTimeout(q),m=null,G(C),!0}}),c=($)=>P.send(JSON.stringify($)),h=($,Q)=>new Promise((G,X)=>{if(P.readyState!==WebSocket.OPEN){X(new T("session closed"));return}let j=uJ(),q=typeof Q.wait_ms==="number"?Q.wait_ms:0,C=setTimeout(()=>{if(!O.delete(j))return;X(new T(`no answer to ${$.split("/").pop()} in ${q+OJ} ms`)),P.close(4000,"request_timeout")},q+OJ);O.set(j,{reject:(Y)=>{clearTimeout(C),X(Y)},resolve:({status:Y,body:F})=>{clearTimeout(C);let B=null;try{B=F?JSON.parse(F):null}catch{}G({status:Y,json:B})}}),c({t:"req",id:j,path:`${dJ}${$}`,body:JSON.stringify(Q)})}),QJ=()=>P.close(1001,"stopping");J.signal.addEventListener("abort",QJ,{once:!0});let s,p=new Map,l=new Map,a=!1,n=new Set,t=new Set,e=Promise.resolve(),u=!1;try{await new Promise((Y,F)=>{let B=setTimeout(()=>F(Error("session open timeout")),JZ);P.onopen=()=>{clearTimeout(B),K("vm_hands.ws_open",{}),Y()},P.onerror=()=>{clearTimeout(B),F(Error("session socket error"))}});let $=await b(["challenge"],5000);K("vm_hands.challenge",{});let Q=[],G=null,X;if(z){c(await J.agent.helloFrame($.challenge,Z.connection));let Y=await b(["ready"],1e4);if(typeof Y.vm_hands_connection==="string")Z.connection=Y.vm_hands_connection;if(X={device_id:z,...Y.cadence?{cadence:Y.cadence}:{}},typeof Y.vm_hands_probe_script==="string"){if(G=Y.vm_hands_probe_script,u=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,K("vm_hands.reconnected",{device_id:z});let F=Array.isArray(Y.vm_hands_binds)?Y.vm_hands_binds:Y.vm_hands_bind?[Y.vm_hands_bind]:[];for(let[B,x]of[...Z.turns]){if(F.some((N)=>N&&N.operation_id===x.claim.operation_id&&N.attempt_id===x.claim.attempt_id)){Q.push(x),K("vm_hands.bound_resumed",{operation_id:x.claim.operation_id});continue}Z.turns.delete(B),J.onTurn?.(B,null),i(x);let D=await f(Z,J.agent,B).catch(()=>null);if(D)Z.receipts.push({turn:x,failure:"vm_hands_bind_lost",unbound:D});K("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{c(await J.agent.registerFrame($.challenge)),K("vm_hands.register_sent",{});let Y=await b(["registered","register_refused"],1e4);if(Y.t==="register_refused")throw new W(Y.code,"register refused");J.agent.registered();let F=Y;if(X=F,Z.deviceId=F.device_id,typeof F.vm_hands_connection==="string")Z.connection=F.vm_hands_connection;if(typeof F.vm_hands_probe_script==="string"){if(G=F.vm_hands_probe_script,u=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,K("vm_hands.registered",{device_id:X.device_id})}let j=async()=>{let Y=await h("/heartbeat",await J.heartbeat());if(Y.status>=300)throw Error(`heartbeat ${Y.status}`)};await j();let q=X.cadence?.presence_interval_ms??30000;if(s=setInterval(()=>{j().catch(()=>P.close())},q),G&&Z.attest!=="accepted"&&J.agent.phase==="registered"&&!Z.turns.size)gJ(G,$.challenge);let C=(Y,F)=>{l.set(Y,F().catch(async(B)=>{if(await XJ(B,Y),B instanceof T)P.close();else await JJ().catch(()=>{return})}).finally(()=>{l.delete(Y)}))};try{await JJ();for(let Y of Q)Y.flush=()=>FJ(Y),Y.flush(),C(Y.claim.attempt_id,()=>WJ(Y));while(!J.signal.aborted&&P.readyState===WebSocket.OPEN){let Y=await h("/operations/claim",{wait_ms:Math.min(X.cadence?.claim_wait_ms??MJ,MJ)});if(Y.status===204||!Y.json)continue;if(Y.status>=300)throw Error(`claim ${Y.status}`);let F=Y.json;if(F.capability==="hands.connect"){if(l.has(F.attempt_id)){_({claim:F,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}C(F.attempt_id,()=>SJ(F))}else HJ(F).catch(()=>{return})}}catch(Y){await XJ(Y,null)}}finally{if(s)clearInterval(s);J.signal.removeEventListener("abort",QJ);for(let $ of Z.turns.values())$.flush=null;P.close(),await wJ,await Promise.all([...l.values()]);for(let $ of J.agent.liveBindIds){if(Z.turns.has($))continue;let Q=await f(Z,J.agent,$).catch(()=>null),G=p.get($);if(Q&&G)Z.receipts.push({turn:{...G,eventSeq:G.eventSeq+1},failure:"vm_hands_bind_lost",unbound:Q});K("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let $ of n)$.abort()}return{closeCode:E,closeReason:A};async function XJ($,Q){if($ instanceof T){if(!a&&Z.turns.size)Z.lostAt=Date.now();a=!0}else{let G=Q!==null?[Q]:[...new Set([...Z.turns.keys(),...J.agent.liveBindIds])];if(Q===null)a=!0;for(let X of G){let j=Z.turns.get(X);if(Z.turns.delete(X),j)i(j),J.onTurn?.(X,null);if(J.agent.liveBindIds.includes(X)){let q=await f(Z,J.agent,X).catch(()=>null),C=p.get(X)??j;if(q&&C)Z.receipts.push({turn:{...C,eventSeq:C.eventSeq+1},failure:"vm_hands_bind_lost",unbound:q})}}}K("vm_hands.session_lost",{error:$ instanceof Error?$.message:String($),bound_kept:Z.turns.size})}function _($){let Q=$.claim,G={attempt_id:Q.attempt_id,attempt_token:Q.attempt_token},X=encodeURIComponent(Q.operation_id);return{fence:G,op:X,complete:(q,C={})=>h(`/operations/${X}/complete`,{...G,status:q,...C}),emit:(q,C)=>{let Y=($.chain??Promise.resolve()).catch(()=>{return}).then(()=>j(q,C));return $.chain=Y,Y}};async function j(q,C){let Y=$.eventSeq,F=(N)=>h(`/operations/${X}/events`,{...G,event_seq_start:N,events:[{kind:q,payload:{sequence:N,capability:String(Q.capability??"hands.connect"),data:C}}]}),B=Y,x=await F(B),D=x.status===409?x.json?.expected_event_seq:void 0;if(typeof D==="number"&&D===Y+1)x={status:200,json:{duplicate:!0}};else if(typeof D==="number"&&D>=0&&D!==Y)B=D,x=await F(B);if(x.status<300)$.eventSeq=B+1;return x}}function kJ($){return(Q,G)=>new Promise((X,j)=>{if(Z.turns.get($.claim.attempt_id)!==$){j(Error("vm_hands_attempt_ended"));return}if($.outbox??=[],$.outbox.length>=tJ){j(Error("vm_hands_outbox_full"));return}$.outbox.push({kind:Q,data:G,resolve:X,reject:j}),$.flush?.()})}function FJ($){if(t.has($))return;t.add($),(async()=>{try{while($.outbox?.length&&Z.turns.get($.claim.attempt_id)===$&&P.readyState===WebSocket.OPEN){let Q=$.outbox[0],G;try{G=await _($).emit(Q.kind,Q.data)}catch(X){if(X instanceof T)return;G={status:500}}if($.outbox.shift(),G.status<300)Q.resolve();else Q.reject(Error(`${Q.kind} refused ${G.status}`))}}finally{t.delete($)}})()}async function gJ($,Q){try{let G=await J.agent.attestFrame($,Q);if(P.readyState!==WebSocket.OPEN)return;c(G);let X=await b(["attested","attest_refused"],15000);Z.attest=X.t==="attested"?"accepted":"refused";for(let j of Z.attestWaiters.splice(0))j(Z.attest==="accepted");if(K("vm_hands.attest",{result:Z.attest,exit_code:G.exit_code,...X.t==="attest_refused"?{code:String(X.code??"")}:{}}),Z.attest==="refused")P.close(4401,"attest_refused")}catch(G){K("vm_hands.attest_failed",{code:G instanceof W?G.code:"probe_error"});for(let X of Z.attestWaiters.splice(0))X(!1);if(Z.attest!=="accepted")P.close(4000,"attest_unanswered")}}async function SJ($){let Q=u&&Z.attest==="pending",G=$.vm_hands_attest,X=G;if(Z.attest==="refused"){K("vm_hands.claim_attest_refused",{said:typeof G==="string"?G.slice(0,16):typeof G,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(X==="accepted"){if(!Q&&Z.attest!=="accepted"){Z.attest="accepted";for(let N of Z.attestWaiters.splice(0))N(!0)}}else if(X!=="pending"||!Q&&Z.attest!=="accepted"){K("vm_hands.claim_attest_refused",{said:typeof G==="string"?G.slice(0,16):typeof G,local:Z.attest}),await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Z.attest!=="accepted"){let N=Date.parse($.lease_until)-Date.now()-5000,ZJ=Math.max(0,Math.min(r,Number.isFinite(N)?N:r));if(!await new Promise((S)=>{let $J=setTimeout(()=>S(!1),ZJ);Z.attestWaiters.push((M)=>{clearTimeout($J),S(M)})})){await _({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let j={claim:$,eventSeq:0},{complete:q,emit:C}=_(j),Y;try{if($.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not hands.connect");Y=!KJ($)}catch(N){K("vm_hands.bind_refused",{code:N instanceof W?N.code:"unexpected"}),await q("failed",{error_code:N instanceof W?N.code:"vm_hands_bind_invalid"});return}let F;Z.bindsStarting++;try{let N=await eJ(Z);if(N)K("vm_hands.person_terminals_closed",{count:N});F=await J.agent.bind(xJ($))}catch(N){K("vm_hands.bind_refused",{code:N instanceof W?N.code:"unexpected"}),await q("failed",{error_code:N instanceof W?N.code:"vm_hands_bind_failed"});return}finally{Z.bindsStarting--}let B={...F.ready_data??J.readyData({launchId:F.launch_id,claim:$})};if(Y)delete B.environment_installed;p.set($.attempt_id,{claim:$,launchId:F.launch_id,readyData:B,eventSeq:j.eventSeq,ackSeq:-1});let x=await C("hands.ready",{...B,vm_hands:{layout:F.layout,policy_digest:F.policy_digest,launch_id:F.launch_id}});if(p.delete($.attempt_id),x.status>=300){await hJ(Z,$.attempt_id),await J.agent.boundRefused($.attempt_id),await q("failed",{error_code:EJ(x.json?.error,"vm_hands_probe_failed")});return}let D={claim:$,launchId:F.launch_id,readyData:B,eventSeq:j.eventSeq,ackSeq:-1};Z.turns.set($.attempt_id,D),D.flush=()=>FJ(D),J.onTurn?.($.attempt_id,kJ(D)),await WJ(D)}async function WJ($){let{fence:Q,op:G}=_($),X=null,j=null,q=J.agent.executorExited($.claim.attempt_id).then((C)=>{return j=C,null});J:for(;;){let C=await Promise.race([q,h(`/operations/${G}/heartbeat`,{...Q,control_ack_seq:$.ackSeq,wait_ms:rJ})]);if(!C){X="vm_hands_executor_exited",K("vm_hands.executor_exited",{reason:j});break}if(C.status>=300)break;let Y=(C.json?.controls??[]).slice().sort((F,B)=>F.seq-B.seq);for(let F of Y){if(F.seq<=$.ackSeq)continue;if(F.kind==="operation.cancel"||F.kind==="cancel"){$.ackSeq=F.seq;break J}if(F.kind===_J)try{await vJ($,F.payload??{})}catch(B){if(B instanceof T)throw B;X=B instanceof W?B.code:"environment_unavailable";let x=B&&typeof B==="object"&&"code"in B&&typeof B.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(B.code)?B.code:null;K("vm_hands.environment_refused",{code:X,cause:x});break J}$.ackSeq=F.seq}}await VJ($,X)}async function HJ($){let Q=$,G={claim:Q,eventSeq:0},{complete:X,emit:j,fence:q,op:C}={..._(G)},Y=$.vm_hands_origin==="person"?"person":"model",F=String($.capability??"");if(!J.executeOp){await X("failed",{error_code:"vm_hands_op_unsupported"});return}if($.vm_hands_attest==="accepted"&&Z.attest==="pending"&&!(u&&Z.attest==="pending")){Z.attest="accepted";for(let M of Z.attestWaiters.splice(0))M(!0)}if(Z.attest!=="accepted"){let M=Date.parse(String($.lease_until??""))-Date.now()-5000,w=Z.attest==="refused"?0:Math.max(0,Math.min(r,Number.isFinite(M)?M:r));if(!(w>0&&await new Promise((BJ)=>{let yJ=setTimeout(()=>BJ(!1),w);Z.attestWaiters.push((IJ)=>{clearTimeout(yJ),BJ(IJ)})}))){await X("failed",{error_code:"vm_hands_unattested"});return}}let B=J.agent.bindIdForRun(Q.run_id);if(Y==="model"&&B===null){await X("failed",{error_code:"vm_hands_not_bound"});return}let x=F==="pty.start"&&Y==="person"&&!$.authority;if(x&&(J.agent.liveBindIds.length>0||Z.bindsStarting>0)){await X("failed",{error_code:"vm_hands_bound"});return}if(sJ.has(F)&&!x&&J.agent.liveBindIds.length===0){await X("failed",{error_code:"vm_hands_not_bound"});return}let D=new AbortController;n.add(D);let N,ZJ=new Promise((M)=>{N=M}),v={abort:D,settled:ZJ};if(x)Z.personTerminals.add(v);if(Y==="model"&&B){let M=Z.modelOps.get(B)??new Set;M.add(v),Z.modelOps.set(B,M),await J.agent.environmentInstalled(B,aJ,D.signal)}let S=-1,$J=setInterval(()=>{h(`/operations/${C}/heartbeat`,{...q,control_ack_seq:S,wait_ms:0}).then((M)=>{if(M.status>=300){D.abort();return}let w=M.json?.controls??[];for(let k of w)if(S=Math.max(S,k.seq),k.kind==="operation.cancel"||k.kind==="cancel")D.abort()},()=>D.abort())},iJ);try{let M=await J.executeOp({kind:Y,claim:$,...Y==="model"&&B?{bindId:B}:{},signal:D.signal,emit:async(k)=>{await j(k.kind,k.data??{})}}),w=await X(M.status,{...M.result?{result:M.result}:{},...M.error_code?{error_code:EJ(M.error_code,"vm_hands_op_failed")}:{}});K("vm_hands.op",{capability:F,kind:Y,status:M.status,code:M.error_code??null,...w.status>=300?{complete_status:w.status,complete_error:String(w.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval($J),n.delete(D),B)Z.modelOps.get(B)?.delete(v);Z.personTerminals.delete(v),N()}}async function VJ($,Q){let G=$.claim.attempt_id;if(Z.turns.get(G)===$)Z.turns.delete(G);J.onTurn?.(G,null),i($);let X=await f(Z,J.agent,G);Z.receipts.push({turn:$,failure:Q,unbound:X}),await JJ()}function JJ(){return e=e.then(PJ,PJ),e}async function PJ(){while(Z.receipts.length){let{turn:$,failure:Q,unbound:G}=Z.receipts[0],{complete:X,emit:j}=_($);try{if(await j("hands.stopped",{...$.readyData,reason_code:Q?"failed":"cancelled",killed_verified:G.killed_verified,shredded:G.shredded,...G.srt_fallbacks?{vm_hands_srt_fallbacks:G.srt_fallbacks}:{}}),Q)await X("failed",{error_code:Q});else await X("cancelled",{error_code:"driver_stopped"})}catch(q){if(q instanceof T)return}Z.receipts.shift()}}async function vJ($,Q){let{fence:G,op:X}=_($),j=Q.snapshot_id;if(Q.version!==1||typeof j!=="string"||Object.keys(Q).length!==2)throw new W("vm_hands_env_invalid","invalid environment delivery");let q=await h(`/operations/${X}/environment`,{...G,snapshot_id:j}),C=q.json?.environment_sealed;if(q.status!==200||!C||q.json?.payload!==void 0)throw new W("vm_hands_env_invalid","environment not delivered sealed");let Y=await J.agent.deliverEnvironment({attemptId:$.claim.attempt_id,snapshotId:j,deviceId:Z.deviceId??"",sealed:C});if((await h(`/operations/${X}/environment-ack`,{...G,...Y})).status>=300)throw new W("vm_hands_env_ack_refused","environment ack refused")}}
 export{QZ as N,pJ as O,jZ as P};

package/bin/vm-hands/{vm-hands-entry-lite-2c8m8m7v.js → vm-hands-entry-lite-pa111vpq.js}

@@ -1,4 +1,4 @@
 // @bun
-import{Mh as J}from"./vm-hands-entry-lite-p9eyqdq7.js";import{readFileSync as L}from"fs";import{isAbsolute as M,normalize as Q}from"path";var W="REASON_WORKER_DESKTOP_USER",G=null;function X(q,B){for(let I of B.split(`
+import{Oh as J}from"./vm-hands-entry-lite-9dx3at21.js";import{readFileSync as L}from"fs";import{isAbsolute as M,normalize as Q}from"path";var W="REASON_WORKER_DESKTOP_USER",G=null;function X(q,B){for(let I of B.split(`
 `)){let j=I.split(":");if(j.length<7||Number(j[2])!==q||!/^\d+$/.test(j[2])||!/^\d+$/.test(j[3]))continue;let x=j[5];if(!/^[a-z_][a-z0-9_-]*$/i.test(j[0])||!M(x)||Q(x)!==x||x==="/")return null;return{username:j[0],uid:q,gid:Number(j[3]),home:x}}return null}function b(q={}){let B="value"in q?q.value:process.env[W];if(G=null,B===void 0||B==="")return null;let I=q.platform??process.platform,j="euid"in q?q.euid:process.geteuid?.(),x=/^[1-9]\d{0,9}$/.test(B)?Number(B):NaN,C=I==="linux"&&j===0&&Number.isSafeInteger(x)?X(x,(q.passwd??(()=>L("/etc/passwd","utf8")))()):null;if(!C||C.gid===0)throw Error("worker_desktop_user_invalid");return G=C,C}function k(){return G}function y(){return G?.home??J()}
-export{W as Xe,X as Ye,b as Ze,k as _e,y as $e};
+export{W as Ze,X as _e,b as $e,k as af,y as bf};

package/bin/vm-hands/{vm-hands-entry-lite-5qe562gn.js → vm-hands-entry-lite-pnkfgnqz.js}

@@ -1,5 +1,5 @@
 // @bun
-import{M as f}from"./vm-hands-entry-lite-21sg3fyz.js";import{Ah as U,Bh as y,Hh as T,uh as v,xh as K}from"./vm-hands-entry-lite-70d6f5r9.js";import{ki as $}from"./vm-hands-entry-lite-6z2g0td2.js";var c=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function _(x){let w=typeof x==="string"?c.exec(x):null;return w?{major:Number(w[1]),minor:Number(w[2])}:null}import{createHash as s,randomBytes as j}from"crypto";import{createInterface as o}from"readline";import{randomBytes as d}from"crypto";import{chmodSync as q,existsSync as C,lstatSync as l,mkdirSync as a,readFileSync as b,renameSync as p,unlinkSync as O,writeFileSync as L}from"fs";import{homedir as t}from"os";import{dirname as i,join as F}from"path";function B(x=process.env,w=t()){let H=x.XDG_CONFIG_HOME?.trim()||F(w,".config"),J=K({env:x})==="staging"?["staging"]:[];return F(T(H,...J),"credentials.json")}function A(x,w=B()){return a(i(w),{recursive:!0,mode:448}),L(w,`${JSON.stringify(x,null,2)}
+import{M as f}from"./vm-hands-entry-lite-tfpebnar.js";import{Ch as U,Dh as y,Jh as T,wh as v,zh as K}from"./vm-hands-entry-lite-1xjtcxpn.js";import{mi as $}from"./vm-hands-entry-lite-2xh7sjs0.js";var c=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function _(x){let w=typeof x==="string"?c.exec(x):null;return w?{major:Number(w[1]),minor:Number(w[2])}:null}import{createHash as s,randomBytes as j}from"crypto";import{createInterface as o}from"readline";import{randomBytes as d}from"crypto";import{chmodSync as q,existsSync as C,lstatSync as l,mkdirSync as a,readFileSync as b,renameSync as p,unlinkSync as O,writeFileSync as L}from"fs";import{homedir as t}from"os";import{dirname as i,join as F}from"path";function B(x=process.env,w=t()){let H=x.XDG_CONFIG_HOME?.trim()||F(w,".config"),J=K({env:x})==="staging"?["staging"]:[];return F(T(H,...J),"credentials.json")}function A(x,w=B()){return a(i(w),{recursive:!0,mode:448}),L(w,`${JSON.stringify(x,null,2)}
 `,{mode:384}),q(w,384),w}function M(x=B()){if(!C(x))return null;try{let w=b(x,"utf8"),H=JSON.parse(w);if(typeof H.apiOrigin!=="string"||typeof H.clientId!=="string"||typeof H.accessToken!=="string"||typeof H.refreshToken!=="string"||typeof H.expiresAt!=="string"||typeof H.orgId!=="string"||!Array.isArray(H.scopes))return null;let G=new URL(H.apiOrigin).origin,J=U(G);if(J!==G)n(x,w,J);return{apiOrigin:J,clientId:H.clientId,accessToken:H.accessToken,refreshToken:H.refreshToken,expiresAt:H.expiresAt,scopes:H.scopes.filter((Q)=>typeof Q==="string"),orgId:H.orgId}}catch{return null}}function n(x,w,H){let G=`${x}.${process.pid}.${d(6).toString("hex")}.tmp`;try{let J=l(x);if(!J.isFile()||J.uid!==process.geteuid?.())return;let Q=JSON.parse(w);if(L(G,`${JSON.stringify({...Q,apiOrigin:H},null,2)}
 `,{mode:384,flag:"wx"}),q(G,384),b(x,"utf8")!==w)throw Error("credentials_changed");p(G,x)}catch{try{O(G)}catch{}}}function R(x=B()){if(!C(x))return!1;return O(x),!0}var S=["run","mcp:read","mcp:write","secrets:read","secrets:write","sessions:read","sessions:debug","devices:read","devices:write","devices:use","ssh:write","knowledge:read","memory:read","memory:write","skills:read","skills:write","repos:read","repos:write","reviews:read","reviews:write","deployment:read","analytics:read","org:read","org:write","attachments:read","attachments:write","guardrails:read","guardrails:write","network:read","network:write","automations:read","automations:write","agent_auth:read"];var n0=S.filter((x)=>x!=="network:read"&&x!=="network:write");class D extends Error{oauthCode;constructor(x,w=null){super(x);this.oauthCode=w;this.name="LoginError"}}function s0(){let x=j(48).toString("base64url"),w=s("sha256").update(x).digest("base64url");return{verifier:x,challenge:w,state:j(32).toString("base64url")}}function r(x,w){let H=typeof x.error==="string"?x.error:null,G=typeof x.error_description==="string"?x.error_description:H?H:w;return new D(G,H)}async function e(x,w,H,G){let J=await H(`${x}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:w,signal:G}),Q=await J.json().catch(()=>({}));if(!J.ok)throw r(Q,`OAuth token request failed (${J.status})`);return Q}var x0=1e4;async function w0(x,w={}){let H=w.fetchImpl??fetch,G=await e(x.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:x.clientId,refresh_token:x.refreshToken}),H,AbortSignal.timeout(x0)).catch((Q)=>{if(Q instanceof Error&&Q.name==="TimeoutError")throw new D("Reason did not answer the login refresh in time. Check the network and retry.");throw Q});if(typeof G.access_token!=="string"||typeof G.refresh_token!=="string"||typeof G.expires_in!=="number")throw new D("Reason returned an incomplete refreshed login.");let J={...x,accessToken:G.access_token,refreshToken:G.refresh_token,expiresAt:new Date(Date.now()+G.expires_in*1000).toISOString(),scopes:typeof G.scope==="string"?G.scope.split(/\s+/).filter(Boolean):x.scopes};return A(J,w.path??B()),J}var z=new Map;function k(x,w){if(!w)return x;if(w.aborted)return Promise.reject(w.reason);return new Promise((H,G)=>{let J=()=>G(w.reason);w.addEventListener("abort",J,{once:!0}),x.then(H,G).finally(()=>w.removeEventListener("abort",J))})}async function P(x={}){let w=x.path??B(),H=M(w);if(!H)return null;let G=x.apiOrigin??v(process.env,"REASON_API_URL")?.trim();if(G&&!y(H.apiOrigin,new URL(G).origin))return null;let J=Date.parse(H.expiresAt)<=Date.now()+60000;if(!x.forceRefresh&&!J)return H;let Q=[w,H.apiOrigin,H.clientId,H.refreshToken].join("\x00"),V=z.get(Q);if(V)return k(V,x.signal);let Z;return Z=w0(H,{fetchImpl:x.fetchImpl,path:w}).catch(async(Y)=>{if(!(Y instanceof D)||Y.oauthCode!=="invalid_grant"&&Y.oauthCode!=="invalid_client")throw Y;let N=M(w),u=Y.oauthCode==="invalid_client"?N?.clientId!==H.clientId:N?.refreshToken!==H.refreshToken;if(N&&u)return P({fetchImpl:x.fetchImpl,path:w});return R(w),null}).finally(()=>{if(z.get(Q)===Z)z.delete(Q)}),z.set(Q,Z),k(Z,x.signal)}function o0(x,w){return new Promise((H)=>{let G=o({input:x}),J=!1,Q=(Z)=>{if(J)return;J=!0,w.removeEventListener("abort",V),G.close(),x.pause(),H(Z)},V=()=>Q(null);w.addEventListener("abort",V,{once:!0}),G.once("line",(Z)=>Q(Z)),G.once("close",()=>Q(null))})}var $0=$.object({label:$.string(),used_percent:$.number().min(0).max(100).nullable(),resets_at:$.string().nullable(),exhausted:$.boolean().nullable()}),H0=$.object({groups:$.array($.object({selectable:$.boolean().optional(),accounts:$.array($.object({source_id:$.string().min(1),model_ids:$.array($.string().min(1)).optional()}))}))});function G0(x){let w=H0.safeParse(x);if(!w.success)return;return w.data.groups.some((H)=>H.selectable!==!1&&H.accounts.some((G)=>G.model_ids===void 0||G.model_ids.length>0))}class X extends Error{status;code;suggestedModel;retryAfterMs;resolutionReason;constructor(x,w,H,G,J,Q){super(H);this.status=x;this.code=w;this.suggestedModel=G;this.retryAfterMs=J;this.resolutionReason=Q;this.name="ApiError"}static rateLimitDelayMs(x,w){if(!(x instanceof X)||x.status!==429)return null;return Math.min(60000,Math.max(w,x.retryAfterMs??0))}}var J0=["minimal","low","medium","high","xhigh","max"],Q0=$.object({id:$.string().min(1),kind:$.string(),name:$.string(),custom_name:$.string().nullish(),status:$.string(),online:$.boolean(),compatible:$.boolean().optional(),compatibility_reason:$.string().nullish(),folder_lane_of:$.string().nullish(),roots:$.array($.object({id:$.string().min(1),label:$.string()}))}),W0=$.object({devices:$.array(Q0),end_cursor:$.string().nullish(),has_next_page:$.boolean().optional()}),Z0=$.object({id:$.string().min(1),name:$.string()}),V0=$.object({items:$.array(Z0)}),X0=$.object({id:$.string().min(1),name:$.string(),main:$.boolean(),mine:$.boolean(),session_id:$.string().nullish(),appearance:$.object({color:$.string().nullish()}).nullish().catch(null)}),Y0=$.object({items:$.array(X0)}),B0=$.object({skill_id:$.string().min(1),name:$.string(),description:$.string().nullish(),activation_keywords:$.array($.string()).default([]),is_enabled:$.boolean().default(!0)}),D0=$.object({items:$.array(B0).default([])}),z0=$.object({id:$.string().min(1),kind:$.string(),enabled:$.boolean(),schedule:$.object({expression:$.string().nullish(),every_seconds:$.number().nullish(),next_run_at:$.string().nullish()}).nullish(),github:$.object({event:$.string().nullish(),action:$.string().nullish(),repo:$.string().nullish()}).nullish(),last_fired_at:$.string().nullish()}),I=$.object({id:$.string().min(1),name:$.string().nullish(),instructions:$.string().nullish(),enabled:$.boolean(),triggers:$.array(z0).default([])}),N0=$.object({items:$.array(I).default([]),end_cursor:$.string().nullish(),has_next_page:$.boolean().optional()}),K0=$.object({id:$.string().min(1),slug:$.string().nullish(),name:$.string(),description:$.string().nullish(),transport:$.string().nullish(),url:$.string().nullish(),enabled:$.boolean()}),M0=$.object({items:$.array(K0).default([])}),P0=$.object({status:$.string(),summary:$.string().nullish(),category:$.string().nullish(),outcome:$.string().nullish(),message_count:$.number().nullish(),pr_url:$.string().nullish(),cost_usd:$.number().nullish(),generated_at:$.string().nullish()}),E=$.object({tags:$.array($.string()).default([])}),_0=$.enum(["linux","macos"]),h=$.object({id:$.string().min(1),name:$.string().min(1),platform:_0.nullable(),workers:$.object({total:$.number().int(),online:$.number().int(),busy:$.number().int(),idle:$.number().int()}),sessions:$.object({queued:$.number().int(),running:$.number().int()})}),F0=$.object({machines:$.array(h)}),U0=$.object({machine:h}),T0=$.object({deleted:$.literal(!0),revoked_workers:$.number().int(),revoked_tokens:$.number().int()}),q0=$.object({token:$.object({id:$.string().min(1),machine_id:$.string().min(1),token_prefix:$.string()}),secret:$.string().startsWith("rmt_")}),g=$.looseObject({machine_id:$.string().min(1),machine_name:$.string().min(1)}),C0=g.extend({organization_id:$.string().min(1)}),b0=$.object({id:$.string().min(1),name:$.string().min(1),state:$.enum(["waiting","placed"]),queue_position:$.number().int().nullable()});function H1(x){let w=b0.safeParse(x.machine);return w.success?w.data:null}var O0=$.union([$.object({kind:$.literal("cloud")}),$.object({kind:$.enum(["mac","headless"]),device_id:$.string().min(1),root_id:$.string().min(1)})]);function G1(x){let w=O0.safeParse(x.runs_on);return w.success?w.data:null}function W(x,w,H){let G=x.safeParse(w);if(!G.success)throw new X(502,H,"Reason returned an unexpected response.");return G.data}var L0=$.object({error:$.object({type:$.string(),message:$.string()})});function m(x,w,H){let G=L0.safeParse(w),J=typeof w.error==="string"?w.error:G.success?G.data.error.type:`http_${x}`,Q=typeof w.detail==="string"?w.detail:typeof w.message==="string"?w.message:G.success?G.data.error.message:`Reason request failed (${x}${typeof w.error==="string"?` ${w.error}`:""})`,V=J==="github_connection_required"&&typeof w.connect_url==="string"&&/^https?:\/\//.test(w.connect_url)?` Connect it at ${w.connect_url}`:"",Z=H===null||H.trim()===""?NaN:Number(H);return new X(x,J,`${Q}${V}`,typeof w.suggested_model==="string"?w.suggested_model:void 0,Number.isFinite(Z)&&Z>=0?Z*1000:void 0,typeof w.resolution_reason==="string"?w.resolution_reason:void 0)}async function J1(x){let w=await(x.fetchImpl??fetch)(`${x.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${x.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify(x.body),signal:AbortSignal.timeout(30000),redirect:"error"}),H=await w.json().catch(()=>({}));if(!w.ok)throw m(w.status,H,w.headers.get("retry-after"));return W(C0,H,"invalid_machine_ticket")}class A0{options;credentials;constructor(x,w={}){this.options=w;this.credentials=x}trackEvent(x,w={}){}async request(x,w={},H=!1){let G=this.options.fetchImpl??fetch,J=await G(`${this.credentials.apiOrigin}/v3${x}`,{method:w.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...w.raw?{"content-type":w.raw.contentType}:w.body===void 0?{}:{"content-type":"application/json"},...w.headers},body:w.raw?w.raw.bytes:w.body===void 0?void 0:JSON.stringify(w.body),signal:w.signal,redirect:"error"}),Q=await J.json().catch(()=>({}));if(J.status===401&&!H&&w.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let V=await P({fetchImpl:G,path:this.options.credentialsPath,forceRefresh:!0,signal:w.signal});if(V)return this.credentials=V,this.request(x,w,!0)}if(!J.ok)throw m(J.status,Q,J.headers.get("retry-after"));return Q}createHeadlessDeviceEnrollmentTicket(x){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:x,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice(x){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:x,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(w){if(w instanceof X&&(w.status===404||w.status===405||w.status===403&&w.code==="endpoint_not_available"))return null;throw w}}addDeviceRoot(x,w){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent(x)}/roots`,{method:"POST",body:w,signal:AbortSignal.timeout(30000)})}removeDeviceRoot(x,w){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent(x)}/roots/${encodeURIComponent(w)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath(x,w=""){let H=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return x===void 0?H:`${H}/${encodeURIComponent(x)}${w}`}async listMachines(){return W(F0,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine(x){let w=await this.request(this.machinePath(),{method:"POST",body:{name:x.name,...x.platform?{platform:x.platform}:{}}});return W(U0,w,"invalid_machine").machine}async deleteMachine(x){let w=await this.request(this.machinePath(x),{method:"DELETE"});return W(T0,w,"invalid_machine_deletion")}async createMachineToken(x){let w=await this.request(this.machinePath(x,"/tokens"),{method:"POST",body:{}});return W(q0,w,"invalid_machine_token")}async createMachineEnrollmentTicket(x,w){let H=await this.request(this.machinePath(x,"/enrollment-tickets"),{method:"POST",body:w,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return W(g,H,"invalid_machine_ticket")}self(x){return this.request("/self",{signal:x})}agentNetwork(){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{signal:AbortSignal.timeout(30000)})}startAgentNetwork(x){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{method:"POST",body:x,signal:AbortSignal.timeout(30000)})}rotateAgentNetwork(x){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{method:"PUT",body:x,signal:AbortSignal.timeout(30000)})}async claimAgentNetworkRelayJob(x,w){let H=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/claim`,{method:"POST",body:x,signal:w});return W(f,H,"invalid_agent_network_job")}async completeAgentNetworkRelayJob(x,w){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/jobs/${encodeURIComponent(x)}`,{method:"POST",body:w,signal:AbortSignal.timeout(30000)})}async recordAgentNetworkRelayReplies(x){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/replies`,{method:"POST",body:{messages:x},signal:AbortSignal.timeout(30000)})}async workspaceMembers(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/members/users`,{signal:AbortSignal.timeout(30000)})).items??[]).flatMap((w)=>typeof w.email==="string"?[{email:w.email,role:typeof w.role==="string"?w.role:"member"}]:[])}claimExistingCliPairing(x){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:x}})}connectAnthropicProvider(x,w,H={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:H.retryUnauthorized,signal:H.signal,body:{access_token:x.access,refresh_token:x.refresh,expires_at:new Date(x.expires).toISOString(),...w?{account_key:w}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((w)=>{let H=typeof w.full_name==="string"?w.full_name:typeof w.repo_full_name==="string"?w.repo_full_name:null;if(!H)return[];return[{repo_id:typeof w.repo_id==="string"?w.repo_id:void 0,full_name:H,provider:w.provider==="gitlab"?"gitlab":"github",default_branch:typeof w.default_branch==="string"?w.default_branch:null,private:typeof w.private==="boolean"?w.private:void 0}]})}async listProjects(){let x=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),w=V0.safeParse(x);if(!w.success)throw new X(502,"invalid_project_list","Reason returned an unexpected project list.");return w.data.items}async listReasons(){let x=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons`);return W(Y0,x,"invalid_reason_list").items}async openReasonConversation(x){let w=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons/${encodeURIComponent(x)}/conversation`,{method:"POST"});return W($.object({session_id:$.string().min(1)}),w,"invalid_reason_conversation").session_id}async listSkills(){try{let x=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return W(D0,x,"invalid_skill_list").items}catch(x){if(x instanceof X&&(x.status===403||x.status===404))return[];throw x}}async listDevices(){let x=[],w=null;for(let H=0;H<50;H+=1){let G=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${w?`?after=${encodeURIComponent(w)}`:""}`),J=W0.safeParse(G);if(!J.success)throw new X(502,"invalid_device_list","Reason returned an unexpected machine list.");if(x.push(...J.data.devices),w=J.data.has_next_page?J.data.end_cursor??null:null,!w)break}return x}async listModels(){try{let w=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((J)=>J.hidden!==!0),H=w.filter((J)=>J.available!==!1).map(({reasoning_efforts:J,hidden:Q,available:V,...Z})=>({...Z,...Array.isArray(J)?{reasoning_efforts:J0.filter((Y)=>J.includes(Y))}:{}})),G=new Set(H.map((J)=>J.detail));return{models:H.length>1&&G.size===1?H.map(({detail:J,...Q})=>Q):H,runnable:H.length>0||w.length===0}}catch(x){if(x instanceof X&&(x.status===403||x.status===404))return{models:[],runnable:!0};throw x}}async getAgentVersion(x){try{let w=await this.request("/deployment",{signal:x,retryUnauthorized:!1});return _(w.reason_version)?w.reason_version:null}catch{return null}}async getUsageQuota(){try{let x=$0.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!x.success)return null;let w;try{w=G0(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...x.data,own_inference:w}}catch(x){if(x instanceof X&&(x.status===403||x.status===404))return null;throw x}}async listSessions(x=50,w,H={}){let G=new URLSearchParams({first:String(Math.min(Math.max(x,1),200)),status:H.status??"active"});if(w)G.set("project_id",w);if(H.origin)G.set("origin",H.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${G.toString()}`)).items??[]}getSession(x,w){let H=w?.fields.length?`?fields=${encodeURIComponent(w.fields.join(","))}`:"";return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}${H}`)}async prestartSession(x){let w=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:x}});return w?.status==="starting"||w?.status==="ready"}async createSession(x){let w=x.mode==="ephemeral"||x.workspaceOwnership==="externally-managed";if(x.attachments?.length)await this.requireSessionAttachments();if(w||x.runtimeProfile){let J=await this.request("/deployment");if(w&&(!Array.isArray(J.session_modes)||!J.session_modes.includes(x.mode??"standard")||!Array.isArray(J.workspace_ownerships)||!J.workspace_ownerships.includes(x.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if(x.runtimeProfile&&(!Array.isArray(J.experimental_runtime_profiles)||!J.experimental_runtime_profiles.includes(x.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let H=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:x.prompt,...x.attachments?.length?{attachments:x.attachments}:{},...x.mode?{mode:x.mode}:{},...x.workspaceOwnership?{workspace_ownership:x.workspaceOwnership}:{},...x.target?{target:x.target}:{},...x.repo?{repo:x.repo}:{},...x.provider?{provider:x.provider}:{},...x.model?{model:x.model}:{},...x.reasoningEffort?{reasoning_effort:x.reasoningEffort}:{},...x.runtimeProfile?{experimental_runtime_profile:x.runtimeProfile}:{},...x.ref?{ref:x.ref}:{},...x.branch?{branch:x.branch}:{},...x.completionMode?{completion_mode:x.completionMode}:{},...x.env&&Object.keys(x.env).length>0?{env:x.env}:{},...x.clientSessionId?{client_session_id:x.clientSessionId}:{},...x.longRunning?{long_running:{enabled:!0}}:{},...x.spendLimitRcu?{spend_limit_rcu:x.spendLimitRcu}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),G=await this.getSession(H.session_id);if(w){let J=G.session_policy,Q=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!J||J.version!==1||J.mode!==(x.mode??"standard")||J.workspaceOwnership!==(x.workspaceOwnership??"managed")||!J.components||Q.some((V)=>J.components[V]!==!0))throw await this.cancelSession(H.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if(x.runtimeProfile&&G.experimental_runtime_profile!==x.runtimeProfile)throw await this.cancelSession(H.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return G}async getEvents(x,w=-1,H={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/events?after_seq=${w}&limit=500${H.waitMs?`&wait_ms=${H.waitMs}`:""}`,H.signal?{signal:H.signal}:{})}catch(G){if(!(G instanceof X)||G.status!==403&&G.status!==404)throw G;return{session:await this.getSession(x),items:[],next_seq:w}}}async getMessages(x,w){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/messages?first=500${w===void 0?"":`&after_seq=${w}`}`)}async getAttachments(x,w){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/attachments${w?`?view=${w}`:""}`)).items??[]}catch(H){if(H instanceof X&&(H.status===403||H.status===404))return[];throw H}}async requireSessionAttachments(){let x=await this.request("/deployment",{headers:{"cache-control":"no-cache"}});if(x.session_attachments!==!0){let w=typeof x.reason_version==="string"&&/^\d+\.\d+(?:\.\d+)?$/.test(x.reason_version)?`Agent ${x.reason_version}`:null,H=typeof x.commit_sha==="string"&&/^[a-f0-9]{40,64}$/i.test(x.commit_sha)?`server ${x.commit_sha.slice(0,12)}`:null,G=[w,H].filter(Boolean).join(", ");throw Error(`This server does not support Session image attachments: ${new URL(this.credentials.apiOrigin).host}${G?` (${G})`:""}. The API server needs an attachment-capable deployment; updating the Agent version alone is not enough. Your image was not sent; retry after the server update.`)}}async sendMessage(x,w,H={}){if(H.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/messages`,{method:"POST",body:{message:w,...H.attachments?.length?{attachments:H.attachments}:{},...H.model?{model:H.model}:{},...H.reasoningEffort?{reasoning_effort:H.reasoningEffort}:{},...H.target?{target:H.target}:{},...H.delivery?{delivery:H.delivery}:{}}})}async steerQueuedMessage(x,w){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/messages/${encodeURIComponent(w)}/steer`,{method:"POST",body:{}})}async withdrawQueuedMessage(x,w){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/messages/${encodeURIComponent(w)}/queued`,{method:"DELETE"})}async getConversation(x){let w=[],H=null;for(let G=0;G<50;G+=1){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/conversation${H?`?after=${encodeURIComponent(H)}`:""}`);if(w.push(...J.items??[]),!J.has_next_page||!J.end_cursor)break;H=J.end_cursor}return w}createSharedLink(x,w){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/shared-links`,{method:"POST",body:{url:w.url,...w.label?{label:w.label}:{},...w.expiresInSeconds!==void 0?{expires_in_seconds:w.expiresInSeconds}:{}}})}sessionAction(x,w,H={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/${w}`,{method:"POST",body:H})}renameSession(x,w){return this.sessionAction(x,"rename",{title:w||null})}moveSessionToProject(x,w){return this.sessionAction(x,"project",{project_id:w})}compactSession(x){return this.sessionAction(x,"compact")}retrySession(x){return this.sessionAction(x,"retry")}rewindSession(x,w){return this.sessionAction(x,"rewind",{message_id:w.messageId,content:w.content,request_id:w.requestId})}forkSession(x,w){return this.sessionAction(x,"fork",{...w.message?{message:w.message}:{},client_session_id:w.clientSessionId})}cancelSession(x,w={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}/cancel`,{method:"POST",body:w.mode==="hard"?{mode:"hard"}:{}})}sessionPath(x,w=""){return`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(x)}${w}`}async archiveSession(x){await this.request(this.sessionPath(x,"/archive"),{method:"POST",body:{}})}async unarchiveSession(x){await this.request(this.sessionPath(x,"/unarchive"),{method:"POST",body:{}})}async deleteSession(x){await this.request(this.sessionPath(x),{method:"DELETE"})}async listSessionTags(x){return W(E,await this.request(this.sessionPath(x,"/tags")),"invalid_session_tags").tags}async appendSessionTags(x,w){let H=await this.request(this.sessionPath(x,"/tags"),{method:"POST",body:{tags:w}});return W(E,H,"invalid_session_tags").tags}async sessionInsight(x,w=!1){let H=await this.request(this.sessionPath(x,w?"/insights/generate":"/insights"),w?{method:"POST",body:{}}:{});return W(P0,H,"invalid_session_insight")}async listAutomations(){let x=[],w=null;for(let H=0;H<20;H+=1){let G=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations?first=100${w?`&after=${encodeURIComponent(w)}`:""}`),J=W(N0,G,"invalid_automation_list");if(x.push(...J.items),w=J.has_next_page?J.end_cursor??null:null,!w)break}return x}async createScheduledAutomation(x,w){let H=`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations`,G=W(I,await this.request(H,{method:"POST",body:{name:x.name,instructions:x.instructions,...x.repo?{repo:x.repo.full_name,provider:x.repo.provider}:{}}}),"invalid_automation");try{await this.request(`${H}/${encodeURIComponent(G.id)}/triggers`,{method:"POST",body:w})}catch(J){throw await this.deleteAutomation(G.id).catch(()=>{return}),J}return G}async setAutomationEnabled(x,w){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent(x)}`,{method:"PATCH",body:{enabled:w}})}async deleteAutomation(x){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent(x)}`,{method:"DELETE"})}async transcribe(x,w){let H=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/transcribe`,{method:"POST",raw:{bytes:x,contentType:w}});return W($.object({transcript:$.string()}),H,"invalid_transcript").transcript}async listMcpServers(){let x=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/mcp-servers`);return W(M0,x,"invalid_mcp_server_list").items}async setSkillEnabled(x,w){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills/${encodeURIComponent(x)}`,{method:"PUT",body:{is_enabled:w}})}}
 export{B as A,M as B,s0 as C,P as D,o0 as E,X as F,J0 as G,H1 as H,G1 as I,J1 as J,A0 as K};