@reason-machines/cli-linux-arm64-musl 0.2.353 → 0.2.354

package/bin/vm-hands/{vm-hands-entry-lite-s097ym0m.js → vm-hands-entry-lite-s069zk82.js}

@@ -1,5 +1,5 @@
 // @bun
-import{u as g0}from"./vm-hands-entry-lite-tdgbgcer.js";import{v as Q2,x as N7,y as Y4}from"./vm-hands-entry-lite-w7gxe8ta.js";import{A as q2,B as V7,C as M4,D as T4,E as u6,F as v0,J as d6,K as I$}from"./vm-hands-entry-lite-y7jx1x8p.js";import{$ as h1,R as jJ,S as WJ,T as y8,U as f8,V as J6,W as Z6,X as b9,Y as A5,Z as v8,_ as _0,aa as m1,ba as P0,ca as n1,da as R5,ea as p5,fa as t3,ga as b5,ka as w5,sa as Y6,ta as G6,ua as K6,va as B6,wa as k9}from"./vm-hands-entry-lite-fvkswqc3.js";import{$a as oJ,Ba as o8,Bb as z5,Ca as e8,Cb as B9,Eb as H5,Fa as a8,Ha as G5,Ib as $6,Jb as X9,Ka as K5,Pa as N5,Qa as q5,Ra as h8,Sa as m8,Ta as nJ,Ua as rJ,Wa as u,Xa as e,Ya as s,Za as c,_a as i8,ab as _1,db as G3,eb as K3,fb as G7,gb as K7,hb as B7,ib as b0,jb as J0,kb as g,lb as w9,mb as R1,nb as Z2,ob as N0,pb as eJ,ub as d5,wb as H8,ya as I6,zb as m2}from"./vm-hands-entry-lite-g4xy7th1.js";import{Ob as g8}from"./vm-hands-entry-lite-dyy62gt3.js";import{Vb as O5}from"./vm-hands-entry-lite-wpx6sg6d.js";import{$b as U5,_b as B5,gc as V5}from"./vm-hands-entry-lite-nbtpm59m.js";import{mc as H$}from"./vm-hands-entry-lite-gcn3rmz6.js";import{Bc as k8}from"./vm-hands-entry-lite-beannz0s.js";import{Hc as c$,Ic as X$,Jc as C$,Kc as F1,Lc as l6,Mc as q7,Nc as H7,Oc as L1,Pc as M7,Qc as s9,Rc as T7,Sc as Z3,Tc as T$,Uc as G8,Vc as Q3,Zc as C5,ad as Q6,dd as DJ,ed as OJ}from"./vm-hands-entry-lite-erbwr8ms.js";import{Yd as w8,ee as f6,fe as t$,pe as V2,qd as C2,ud as aJ,vd as iJ}from"./vm-hands-entry-lite-qf01e5f1.js";import{Ce as U7,De as n2,Ge as X6,Je as l1,Le as w7,Me as k7,Re as S5}from"./vm-hands-entry-lite-60s8m5m7.js";import{Xe as r1,Ye as D5}from"./vm-hands-entry-lite-xhjbc3e4.js";import{$e as o6,cf as I5,df as x9,ff as u8}from"./vm-hands-entry-lite-akaxyv3r.js";import{sf as t}from"./vm-hands-entry-lite-g47chb57.js";import{$f as w1,ag as G0,bg as B2,cg as N6,dg as q6,eg as r$,fg as W3,gg as k2,hg as z4,jg as y2,kg as k$,lg as f0,mg as o$,ng as f2,qg as y$}from"./vm-hands-entry-lite-33ttamma.js";import{ug as Y5}from"./vm-hands-entry-lite-mybm2kyz.js";import{Ah as B4,Bh as Q7,Ch as X7,Eh as A2,Fh as Y7,Gh as E9,Hh as X8,Ih as Y8,Jh as Q1,sh as O$,th as E1,vh as Q$,yh as z$,zh as C0}from"./vm-hands-entry-lite-6qfax5p2.js";import{Kh as U0,Mh as vJ}from"./vm-hands-entry-lite-5b29hq7h.js";import{ii as U}from"./vm-hands-entry-lite-k17ntg9v.js";import{li as tJ}from"./vm-hands-entry-lite-6f5eypjm.js";import{qi as h0}from"./vm-hands-entry-lite-tj1y61bg.js";import{wi as JB}from"./vm-hands-entry-lite-nd1k2jz9.js";import{spawn as _7,spawnSync as ZB}from"child_process";import{closeSync as F7,mkdirSync as QB,openSync as L7,readdirSync as XB,realpathSync as Y$,rmSync as W1}from"fs";import{hostname as YB}from"os";import{dirname as a9,join as F0,resolve as GB}from"path";import{createHash as f7}from"crypto";import{unlinkSync as h7}from"fs";import{platform as m7}from"os";import{join as v7}from"path";var G4=U.discriminatedUnion("store",[U.strictObject({version:U.literal(1),store:U.literal("keychain")}),U.strictObject({version:U.literal(1),store:U.literal("file"),api_key:U.string().min(1).max(4096)})]),w$=($)=>v7($,"api-key.json");function L$($){let J=f7("sha256").update(`reason-connect-api-key
+import{u as g0}from"./vm-hands-entry-lite-tdgbgcer.js";import{v as Q2,x as N7,y as Y4}from"./vm-hands-entry-lite-w7gxe8ta.js";import{A as q2,B as V7,C as M4,D as T4,E as u6,F as v0,J as d6,K as I$}from"./vm-hands-entry-lite-y7jx1x8p.js";import{$ as h1,R as jJ,S as WJ,T as y8,U as f8,V as J6,W as Z6,X as b9,Y as A5,Z as v8,_ as _0,aa as m1,ba as P0,ca as n1,da as R5,ea as p5,fa as t3,ga as b5,ka as w5,sa as Y6,ta as G6,ua as K6,va as B6,wa as k9}from"./vm-hands-entry-lite-8q8mxthp.js";import{$a as oJ,Ba as o8,Bb as z5,Ca as e8,Cb as B9,Eb as H5,Fa as a8,Ha as G5,Ib as $6,Jb as X9,Ka as K5,Pa as N5,Qa as q5,Ra as h8,Sa as m8,Ta as nJ,Ua as rJ,Wa as u,Xa as e,Ya as s,Za as c,_a as i8,ab as _1,db as G3,eb as K3,fb as G7,gb as K7,hb as B7,ib as b0,jb as J0,kb as g,lb as w9,mb as R1,nb as Z2,ob as N0,pb as eJ,ub as d5,wb as H8,ya as I6,zb as m2}from"./vm-hands-entry-lite-rw994s8q.js";import{Ob as g8}from"./vm-hands-entry-lite-dyy62gt3.js";import{Vb as O5}from"./vm-hands-entry-lite-wpx6sg6d.js";import{$b as U5,_b as B5,gc as V5}from"./vm-hands-entry-lite-nbtpm59m.js";import{mc as H$}from"./vm-hands-entry-lite-gcn3rmz6.js";import{Bc as k8}from"./vm-hands-entry-lite-beannz0s.js";import{Hc as c$,Ic as X$,Jc as C$,Kc as F1,Lc as l6,Mc as q7,Nc as H7,Oc as L1,Pc as M7,Qc as s9,Rc as T7,Sc as Z3,Tc as T$,Uc as G8,Vc as Q3,Zc as C5,ad as Q6,dd as DJ,ed as OJ}from"./vm-hands-entry-lite-zg2xz3b1.js";import{Yd as w8,ee as f6,fe as t$,pe as V2,qd as C2,ud as aJ,vd as iJ}from"./vm-hands-entry-lite-qf01e5f1.js";import{Ce as U7,De as n2,Ge as X6,Je as l1,Le as w7,Me as k7,Re as S5}from"./vm-hands-entry-lite-7z169ekf.js";import{Xe as r1,Ye as D5}from"./vm-hands-entry-lite-xhjbc3e4.js";import{$e as o6,cf as I5,df as x9,ff as u8}from"./vm-hands-entry-lite-s97jy69e.js";import{sf as t}from"./vm-hands-entry-lite-d7s2d8bp.js";import{$f as w1,ag as G0,bg as B2,cg as N6,dg as q6,eg as r$,fg as W3,gg as k2,hg as z4,jg as y2,kg as k$,lg as f0,mg as o$,ng as f2,qg as y$}from"./vm-hands-entry-lite-33ttamma.js";import{ug as Y5}from"./vm-hands-entry-lite-mybm2kyz.js";import{Ah as B4,Bh as Q7,Ch as X7,Eh as A2,Fh as Y7,Gh as E9,Hh as X8,Ih as Y8,Jh as Q1,sh as O$,th as E1,vh as Q$,yh as z$,zh as C0}from"./vm-hands-entry-lite-6qfax5p2.js";import{Kh as U0,Mh as vJ}from"./vm-hands-entry-lite-5b29hq7h.js";import{ii as U}from"./vm-hands-entry-lite-k17ntg9v.js";import{li as tJ}from"./vm-hands-entry-lite-6f5eypjm.js";import{qi as h0}from"./vm-hands-entry-lite-tj1y61bg.js";import{wi as JB}from"./vm-hands-entry-lite-nd1k2jz9.js";import{spawn as _7,spawnSync as ZB}from"child_process";import{closeSync as F7,mkdirSync as QB,openSync as L7,readdirSync as XB,realpathSync as Y$,rmSync as W1}from"fs";import{hostname as YB}from"os";import{dirname as a9,join as F0,resolve as GB}from"path";import{createHash as f7}from"crypto";import{unlinkSync as h7}from"fs";import{platform as m7}from"os";import{join as v7}from"path";var G4=U.discriminatedUnion("store",[U.strictObject({version:U.literal(1),store:U.literal("keychain")}),U.strictObject({version:U.literal(1),store:U.literal("file"),api_key:U.string().min(1).max(4096)})]),w$=($)=>v7($,"api-key.json");function L$($){let J=f7("sha256").update(`reason-connect-api-key
 ${$}`).digest("hex");return new r$(B2(),m7(),J)}function L3($,J,Z=L$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(w$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof G0))throw Q}c(w$($),{version:1,store:"file",api_key:J})}function l0($,J=L$($)){if(!u(w$($)))return null;let Z=G4.parse(JSON.parse(s(w$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof G0))throw Q;throw Error("worker_api_key_unreadable")}}function K4($,J=L$($)){if(!u(w$($)))return;if(G4.parse(JSON.parse(s(w$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof G0))throw Z}h7(w$($))}async function j3($,J){let Z;try{Z=await Y4({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:b0($.proxy)})}catch(Q){if(Q instanceof v0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as XZ,renameSync as YZ,rmSync as f$}from"fs";import{join as H0}from"path";import{createHash as g7}from"crypto";import{realpathSync as u7,statSync as d7,unlinkSync as U2}from"fs";import{platform as l7}from"os";import{join as w0}from"path";function d($){return{state:w0(g($),"device.json"),control:w0(g($),"control.json"),lock:w0(g($),"lifecycle.lock"),socket:w0(g($),"control.sock"),daemon:w0(g($),"daemon.json"),releaseCheck:w0(g($),"release-check.json"),updateDeferral:w0(g($),"update-deferral.json"),firstHeartbeat:w0(g($),"first-heartbeat.json")}}var p7=U.object({version:U.literal(1),device_id:U.string().min(1).max(160),offer:U.unknown().optional(),enrollment_ms:U.number().int().nonnegative().max(t$).optional()});function U4($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function D3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=p7.safeParse(JSON.parse(s(Z)));if(U2(Z),!Q.success||Q.data.device_id!==J)return null;let X=V2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=w0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?O3($):new W3(g($))}function N2($,J){T0($,!0),a7($);let Z=J??O3($),Q=new W3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof G0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function O3($){return new r$(B2(),l7(),c7($))}function c7($){let J=z3($);return g7("sha256").update(`reason-worker
 ${J?.directory??g($)}`).digest("hex")}function I1($,J){c(w0(g($),C1),{version:1,directory:z3($)?.directory??g($),devicePublicKey:J})}var C1="keychain-scope.json";function V4($){return u(w0(g($),C1))}var s7=U.strictObject({version:U.literal(1),directory:U.string().min(1),devicePublicKey:U.string().min(1)});function z3($){let J=w0(g($),C1);if(!u(J))return null;let Z=s7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function a7($){let J=w0(g($),C1);if(!u(J))return;if(z3($))try{let Z=O3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof G0))throw Z}U2(J)}function V$($){let J=u7($.workspaceRoot);if(J!==$.workspaceRoot||!d7(J).isDirectory()||!R1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function o($){if(!u(g($)))return null;let J=k$(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&B4($.apiOrigin,J.apiOrigin),Q=Z?[N0($),N0({...$,apiOrigin:J.apiOrigin})]:[N0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var N4=U.strictObject({version:U.literal(1),drained:U.boolean(),revoked:U.boolean()});function $0($){let J=d($).control;return u(J)?N4.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function I0($,J){c(d($).control,N4.parse(J))}function k0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=w0(g($),C1);if(u(Z))U2(Z);let Q=d($).state;if(u(Q))U2(Q)}var i7=U.strictObject({read:U.boolean(),write:U.boolean(),execute:U.boolean(),discover_environment:U.boolean(),expose_mcp:U.literal(!1)}),A3=U.strictObject({version:U.literal(1),organization_id:U.string().min(1).max(160),enrollment_ticket:U.string().min(1).max(4096),code_verifier:U.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/),root:U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/),permissions:i7,execution_mode:U.enum(["confined","host"]).default("confined")}),folders:U.array(U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),n7=U.object({device_id:U.string().min(1).max(160),organization_id:U.string().min(1).max(160),auth_scheme:U.literal("p256"),protocol_version:U.literal(2),roots:U.array(U.object({id:U.string().min(1),label:U.string(),path_fingerprint:U.string()})).min(1).max(32),headless:U.object({lifecycle:U.enum(["persistent","ephemeral"]),expires_at:U.iso.datetime({offset:!0})}),first_heartbeat:U.unknown().optional()}),R3=30000;class o0 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function r7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(R3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new o0(X?.error==="device_revoked")}return Q.json()}async function I3($,J,Z,Q){g0();let X=A3.parse(JSON.parse(s(J)));return e0($,X,Z,Q)}async function e0($,J,Z,Q=(Y,G)=>r7(Y,G,b0($.proxy)),X=performance.now()){let Y=H4($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function q4($,J,Z,Q,X=performance.now()){let Y=H4($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function H4($,J,Z){if(g0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=y$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let H=y$([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(H.path!==K||H.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return H});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:t,bridge_version:t,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let H=n7.parse(K);if(H.organization_id!==J.organization_id||H.roots.length!==Y.length||H.roots.some((q,M)=>q.path_fingerprint!==Y[M].pathFingerprint)||H.headless.lifecycle!==$.lifetime||Date.parse(H.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let B=V2(H.first_heartbeat);try{U4($,H.device_id,{...B?{offer:B}:{},enrollmentMs:Math.min(t$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:H.organization_id,deviceId:H.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:N0($),lifetime:$.lifetime,expiresAt:H.headless.expires_at},roots:H.roots.map((q,M)=>({id:q.id,label:q.label,path:Y[M].path,pathFingerprint:q.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as t7,randomUUID as o7}from"crypto";import{unlinkSync as e7}from"fs";import{join as $Z}from"path";var _4=U.strictObject({version:U.literal(1),install_id:U.uuid(),fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/)}),JZ=U.object({enrollment_ticket:U.string().min(1).max(4096),expires_at:U.iso.datetime({offset:!0}),device_kind:U.literal("headless"),lifecycle:U.enum(["persistent","ephemeral"]),device_expires_at:U.iso.datetime({offset:!0})});function C3($){return JZ.parse($)}var ZZ=U.object({credentialKind:U.enum(["oauth","api_key"]).optional(),apiOrigin:U.url(),clientId:U.string(),accessToken:U.string().min(1).max(32768),refreshToken:U.string().max(32768),expiresAt:U.iso.datetime({offset:!0}),scopes:U.array(U.string().max(128)).max(128),orgId:U.string().min(1).max(160)});function j$($){return q2(E1("REASON_CLI_CHANNEL",$.channel),U0())}async function W$($,J=j$($)){if(!u(J))return null;let Z=ZZ.parse(JSON.parse(s(J)));if(!C0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=b0($.proxy),X=Object.assign((G,V)=>Q(G,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await T4({path:J,fetchImpl:X});if(Y&&!C0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function F4($,J,Z){if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=D$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function L4($,J,Z,Q,X){let Y=performance.now();if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=D$($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await q4($,G.direct(J.orgId),Q,(N,H)=>V({approval:G.request,code_verifier:H,registration:N}).catch((B)=>{throw QZ(B)}),Y);if(K)return K}return e0($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function QZ($){if(!($ instanceof v0))return $;if($.status===409)return new o0($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new o0(!1);return $}var P1=($)=>$Z(g($),"enrollment-install.json");function j4($){if(u(P1($)))e7(P1($))}function D$($,{stored:J=!0}={}){g0();let Z=P1($),Q=J&&u(Z)?_4.parse(JSON.parse(s(Z))):{version:1,install_id:o7(),fingerprint_key:t7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=y$([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((B)=>{let q=y$([B],X,Y)[0];if(q.path!==B)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:q.pathFingerprint}}),K=M4(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...V.map((B)=>B.path_fingerprint)].map((B)=>({path_fingerprint:B,permissions:X,execution_mode:$.executionMode}))},H=(B)=>({version:1,organization_id:B,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(B){e(g(B),!0),c(P1(B),Q)},complete(B,q){let M=C3(q);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...H(B),enrollment_ticket:M.enrollment_ticket}},direct:H}}function W4($,J,Z){let Q=P1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=_4.parse(JSON.parse(s(Q)));return y$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var H2=8,A4=600000,R4=15000,D4=new Set(["device_revoked","invalid_device_credential"]),M2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,N$=($)=>H0(g($),"workspaces"),I4="account.json",P3=($)=>u(H0($,I4));function y0($){let J;try{J=XZ(N$($))}catch{return[]}return J.filter((Z)=>M2.test(Z)).sort().map((Z)=>{let Q=H0(N$($),Z),X=H0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:P3(Q)}})}function T2($,J){let Z=J.toLowerCase();if(!M2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:H0(N$($),Z)});return e(Q.stateDirectory,!0),c(H0(Q.stateDirectory,I4),{version:1}),{config:Q,configPath:H0(Q.stateDirectory,"worker.json")}}function _2($,J){try{let{config:Z,configPath:Q}=T2($,J);e(g(Z),!0),I0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function x1($,J){let Z=J.toLowerCase(),Q=null;try{Q=o($)?.orgId.toLowerCase()??null}catch{}return Q===Z||y0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var E3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function O4($,J){let Z=o($);if(!Z?.worker)throw Error("worker_identity_missing");I1($,Z.devicePublicKey),e(g(J),!0);for(let Y of E3)f$(H0(g(J),Y),{force:!0});for(let Y of E3){let G=H0(g($),Y);if(u(G))YZ(G,H0(g(J),Y))}let Q=T0(J),X=k$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");f0({...X,worker:{...X.worker,configDigest:N0(J)}},d(J).state,{proofStore:Q})}function x3($){for(let J of y0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))k0(J.config)}catch{}f$(J.directory,{recursive:!0,force:!0})}f$(b3($),{force:!0})}function F2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(B)=>Number(Date.parse(B.worker?.expiresAt??"")>X+60000),V=y0($).flatMap((B)=>{if(!B.account||!B.config)return[];try{if($0(B.config).revoked)return[];let q=o(B.config);return q&&q.orgId.toLowerCase()===B.organizationId&&(!Q||Y(q))?[{...B,config:B.config,state:q}]:[]}catch{return[]}}).sort((B,q)=>Number(q.organizationId===J)-Number(B.organizationId===J)||Y(q.state)-Y(B.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:o($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&M2.test(N)&&N!==V.organizationId){let B=T2($,N);O4($,B.config),c(B.configPath,B.config)}else if(u(g($))){try{if(u(d($).state))k0($)}catch{}for(let B of E3)f$(H0(g($),B),{force:!0})}x3($);let H=J0.parse({...V.config,stateDirectory:$.stateDirectory});return O4(V.config,H),c(H0($.stateDirectory,"worker.json"),H),f$(V.directory,{recursive:!0,force:!0}),H}var S3={before($){for(let{config:J}of y0($))try{let Z=J?o(J):null;if(J&&Z)I1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of y0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==H0(N$($),Z))continue;let V=J0.parse({...G,stateDirectory:Q}),K=T0(V),N=k$(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===N0(G))f0({...N,worker:{...N.worker,configDigest:N0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},b3=($)=>H0(N$($),"listed.json");function C4($){try{let J=JSON.parse(s(b3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function P4($,J){let Z=y0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=C4($),G=Y&&!Y.listed?Y.reason:null,V=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:H})=>{let B=!1,q=null,M=!1,T=null;try{B=N?$0(N).revoked:!1,q=N&&!B?o(N):null;let _=N?o$(d(N).daemon):null;M=J&&!!q&&_?.state==="connected",T=M?z4(_,q):null}catch{}return{...T?{permission_recovery:T}:{},organization_id:K,device_id:q?.deviceId??null,name:Y?.names?.[K]??null,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,state:B?"removed":M?"connected":"not_running",blocked:!H&&!B&&!M&&(Y?.blocked.includes(K)??!1),...H?{account:!0}:{}}})}}function E4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,V=null,K=!1,N=C4(J)??{listed:!1,reason:null,blocked:[]},H=(L)=>{let{folders:W,...R}=J,E=Z.roots.slice(1).map((I)=>I.path);return J0.parse({...R,...E.length?{folders:E}:{},stateDirectory:H0(N$(J),L)})},B=async(L)=>{let W=G.get(L);if(!W)return;W.controller.abort(),await W.done},q=(L,W=!1)=>{let R=new AbortController,E=()=>R.abort();if(X.addEventListener("abort",E,{once:!0}),X.aborted)R.abort();let I={...L,controller:R,claims:0,done:Promise.resolve(),account:W};I.done=$.serve(L,R.signal,(C)=>{I.claims=C}).then(()=>{return},(C)=>{if(W&&C instanceof _0&&C.status===401&&D4.has(C.code)){try{I0(L.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${L.organizationId} (another account's) no longer accepts this computer (${C.code}); run \`reason connect\` signed in as that account to connect it again
 `)}else if(C instanceof _0&&C.status===401&&D4.has(C.code)){try{k0(L.config)}catch{}Y(`Reason worker: workspace ${L.organizationId} no longer accepts this computer
@@ -312,7 +312,7 @@ Usage:
 `),host:Z.host}),V=$8({...G,log:(M)=>Q.stderr.write(`${M}
 `)}),{configPath:K}=V,N=V.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let H=(M,T)=>{let _=q3(Z.home,Z.channel),j;try{let O=null;try{O=T.keep?null:o(N)?.orgId.toLowerCase()??null}catch{}if(j=F2(N,{prefer:X2(Z.home,Z.channel,N),...T}),j&&O)_2(j,O)}finally{_()}if(!j)return!1;N=j;let D="";try{D=` (workspace ${o(j)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${M}; this computer goes on running Sessions for its other Reason account${D}.
 `),!0};if($0(N).revoked&&!H("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j1(N)){let M=l0(N.stateDirectory)??void 0,T=M?null:X2(Z.home,Z.channel,N);if(!M&&!(T&&x1(N,T)))H("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let B=N.executionMode==="confined";if(B||!j1(N)){let M=l0(N.stateDirectory)??void 0;if(Q.stderr.write(B?O7:`Reason: this computer's connection expired; renewing it with ${M?"its API key":"your login"}\u2026
-`),await i9(J0.parse({...N,executionMode:"host"}),K,Q,X,M)!==0)return Q.stderr.write(M?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let q=new AbortController;if(!X.runWorker)import("./ask-relay-6tvp84kt.js").then(({runBackgroundAskRelay:M})=>M(q.signal,(T)=>Q.stderr.write(`${T}
+`),await i9(J0.parse({...N,executionMode:"host"}),K,Q,X,M)!==0)return Q.stderr.write(M?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let q=new AbortController;if(!X.runWorker)import("./ask-relay-d8gbx7rd.js").then(({runBackgroundAskRelay:M})=>M(q.signal,(T)=>Q.stderr.write(`${T}
 `))).catch(()=>{});try{for(;;){let M=l0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},T=X.runWorker?null:$3({stateDirectory:N.stateDirectory}),_=!1,j;try{j=await(X.runWorker??M$)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...M,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{_=!0}})}finally{T?.stop()}if(!_)return j;if(!H("this computer's connection was removed from Reason",{keep:!1}))break}return U3(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{q.abort()}}async function MB($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:V}=Z;if(J&&await(X.controlWorker??V0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=u0(Y,G,!0),N=A7({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:V}),H=R7(N,Z.apiKey??(J?l0(J.stateDirectory)??void 0:void 0)),B=F0(K,"worker.json");return e(K,!0),c(B,H),Q.stdout.write(p9(`Reason: connecting "${H.name}" while this command runs`,H,Z.host.platform,["Connecting\u2026"])),(X.runWorker??M$)(["start","--config",B],{...n9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:Y3(Q.stderr)},onStartup:(q)=>{if(q==="ready")Q.stdout.write(`Connected. Start Sessions on "${H.name}" from Reason. Press Ctrl-C to stop.
 `);X.worker?.onStartup?.(q)}})}function TB($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),q8(d(J).daemon,$);let X=R2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
 `),0}var _B=U.object({root:U.object({id:U.string().min(1).max(160),label:U.string().max(160),path_fingerprint:U.string()})});async function I7($,J,Z,Q){let X=await(n9(Q.worker,Z).enrollmentCredentials??W$)($,j$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new I$(X,{credentialsPath:j$($),fetchImpl:b0($.proxy)}),G=(V)=>V instanceof v0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=W4($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((B)=>{if(G(B))throw Error("worker_folders_unavailable");if(B instanceof v0&&B.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw B}),H=_B.parse(N).root;if(H.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:H.id,label:H.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof v0&&K.code==="root_not_found"))throw K})}}}function C7($,J,Z){f0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:N0($)}},d($).state,{proofStore:T0($)})}async function P7($,J,Z,Q){let{io:X,options:Y,host:G}=Q,V=J&&!Q.apiKey&&l0(J.stateDirectory)===null?X2(Q.home,Q.channel,J):null,K=J&&V&&P$(J)&&!x1(J,V)?y0(J).find((I)=>I.account&&I.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,H=K?K.configPath:Z,B=N&&P$(N)&&!$0(N).revoked?o(N):null;if(!J||!N||!B||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let q=$.addFolder!==void 0,M=q?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=X3(T,M)}catch(I){if(q)throw new p(I instanceof Error?I.message:String(I));_=GB(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let j=N.folders??[],D=B.roots.slice(1).find((I)=>I.path===_);if(!q&&!D&&!j.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(q&&!R1(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(q&&!D&&j.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??l0(N.stateDirectory)??void 0,F=await I7(N,B,O,Y),z=B.roots.filter((I)=>I.path!==_);if(q)z=[...z,await F.add(_)];else if(D)await F.remove(D.id);C7(N,B,z);let L=q?[...j.filter((I)=>I!==_),_]:j.filter((I)=>I!==_),{folders:W,...R}=N;if(c(H,J0.parse({...R,...L.length?{folders:L}:{}})),!await(Y.controlWorker??V0)(J,"reload_roots").then(()=>!0,()=>!1))T$(J,G,"connect");return X.stdout.write(q?`Added ${_}. Sessions on "${N.name}" may run in it.

package/bin/vm-hands/{vm-hands-entry-lite-akaxyv3r.js → vm-hands-entry-lite-s97jy69e.js}

@@ -1,5 +1,5 @@
 // @bun
-import{sf as A}from"./vm-hands-entry-lite-g47chb57.js";import{Lf as wz,Mf as Nz}from"./vm-hands-entry-lite-c9wp99nr.js";import{Kh as N}from"./vm-hands-entry-lite-5b29hq7h.js";import{wi as Fz}from"./vm-hands-entry-lite-nd1k2jz9.js";import{spawnSync as iz}from"child_process";import{dirname as g}from"path";import{spawn as cz}from"child_process";import{accessSync as lz,constants as sz}from"fs";import{basename as nz,join as pz}from"path";import{randomUUID as p}from"crypto";import{spawnSync as M}from"child_process";import{chmodSync as Hz,cpSync as Rz,existsSync as U,lstatSync as O,mkdirSync as i,readdirSync as Cz,readFileSync as E,readlinkSync as Lz,realpathSync as T,renameSync as R,rmdirSync as Mz,rmSync as P,symlinkSync as c,writeFileSync as Oz}from"fs";import{dirname as C,join as D,relative as Uz,resolve as Tz}from"path";var a="so.ara.cli",_z="5LJFSBRY2F";var o="ReasonBackgroundIdentity",r="Contents/Helpers/ReasonPermissionTile";var x="AraBackgroundIdentity",Az="Reason",Iz=`anchor apple generic and identifier "${a}" and certificate leaf[subject.OU] = "${_z}"`;class L extends Error{code;constructor(z,J){super(J);this.code=z;this.name="MacOSBackgroundIdentityError"}}var k="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function v(z=N()){return D(z,"Library","Application Support","Reason","Background","Reason.app")}function _(z=N()){return D(z,"Library","Application Support","Ara","Background","Ara.app")}function kz(z){try{return O(z).isFile()}catch{return!1}}function y(z){return[o,x].map((J)=>D(z,"Contents","MacOS",J)).find(kz)??null}function w(z){try{if(!O(z).isDirectory())return!1;let J=E(D(z,"Contents","Info.plist"),"utf8");return J.includes(`<string>${a}</string>`)&&(J.includes(`<string>${Az}</string>`)||J.includes("<string>Ara</string>"))&&y(z)!==null}catch{return!1}}function I(z=N()){let J=v(z);if(!w(J))return null;try{let Z=E(D(J,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(Z)?.[1]??null}catch{return null}}function Sz(z,J=N()){let Z=I(J);return Z===null||$z(S(Z.split(".")),S(z.split(/[.-]/).slice(0,3)))}var fz=1e4;function t(z,J){return M(z,[...J],{stdio:"ignore",timeout:fz}).status??1}var e=new Set;function zz(z){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let J=(Z)=>{try{return T(Z)}catch{return Tz(Z)}};if(z!==void 0&&J(z)!==J(N()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var Jz=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.ara(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,Zz=new Set(["ara","ara.exe","reason","reason.exe"]);function S(z){return z.map((J)=>Number(J))}function $z(z,J){for(let Z=0;Z<3;Z+=1)if(z[Z]!==J[Z])return z[Z]<J[Z];return!1}var Ez=[0,2,161];function xz(z){if(z===null)return!0;let J=Ez,Z=null;try{Z=T(process.execPath)}catch{}return z.some(($)=>{let j=Jz.exec($);if(j){let Q=j[1]===void 0?j.slice(4,7):j.slice(1,4);return $z(S(Q),J)}let q=$.slice($.lastIndexOf("/")+1);return Zz.has(q)&&$!==Z&&$!==process.execPath})}function yz(){let z=M("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(z.status!==0)return null;let J=[];for(let Z of z.stdout.split(`
+import{sf as A}from"./vm-hands-entry-lite-d7s2d8bp.js";import{Lf as wz,Mf as Nz}from"./vm-hands-entry-lite-c9wp99nr.js";import{Kh as N}from"./vm-hands-entry-lite-5b29hq7h.js";import{wi as Fz}from"./vm-hands-entry-lite-nd1k2jz9.js";import{spawnSync as iz}from"child_process";import{dirname as g}from"path";import{spawn as cz}from"child_process";import{accessSync as lz,constants as sz}from"fs";import{basename as nz,join as pz}from"path";import{randomUUID as p}from"crypto";import{spawnSync as M}from"child_process";import{chmodSync as Hz,cpSync as Rz,existsSync as U,lstatSync as O,mkdirSync as i,readdirSync as Cz,readFileSync as E,readlinkSync as Lz,realpathSync as T,renameSync as R,rmdirSync as Mz,rmSync as P,symlinkSync as c,writeFileSync as Oz}from"fs";import{dirname as C,join as D,relative as Uz,resolve as Tz}from"path";var a="so.ara.cli",_z="5LJFSBRY2F";var o="ReasonBackgroundIdentity",r="Contents/Helpers/ReasonPermissionTile";var x="AraBackgroundIdentity",Az="Reason",Iz=`anchor apple generic and identifier "${a}" and certificate leaf[subject.OU] = "${_z}"`;class L extends Error{code;constructor(z,J){super(J);this.code=z;this.name="MacOSBackgroundIdentityError"}}var k="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function v(z=N()){return D(z,"Library","Application Support","Reason","Background","Reason.app")}function _(z=N()){return D(z,"Library","Application Support","Ara","Background","Ara.app")}function kz(z){try{return O(z).isFile()}catch{return!1}}function y(z){return[o,x].map((J)=>D(z,"Contents","MacOS",J)).find(kz)??null}function w(z){try{if(!O(z).isDirectory())return!1;let J=E(D(z,"Contents","Info.plist"),"utf8");return J.includes(`<string>${a}</string>`)&&(J.includes(`<string>${Az}</string>`)||J.includes("<string>Ara</string>"))&&y(z)!==null}catch{return!1}}function I(z=N()){let J=v(z);if(!w(J))return null;try{let Z=E(D(J,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(Z)?.[1]??null}catch{return null}}function Sz(z,J=N()){let Z=I(J);return Z===null||$z(S(Z.split(".")),S(z.split(/[.-]/).slice(0,3)))}var fz=1e4;function t(z,J){return M(z,[...J],{stdio:"ignore",timeout:fz}).status??1}var e=new Set;function zz(z){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let J=(Z)=>{try{return T(Z)}catch{return Tz(Z)}};if(z!==void 0&&J(z)!==J(N()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var Jz=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.ara(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,Zz=new Set(["ara","ara.exe","reason","reason.exe"]);function S(z){return z.map((J)=>Number(J))}function $z(z,J){for(let Z=0;Z<3;Z+=1)if(z[Z]!==J[Z])return z[Z]<J[Z];return!1}var Ez=[0,2,161];function xz(z){if(z===null)return!0;let J=Ez,Z=null;try{Z=T(process.execPath)}catch{}return z.some(($)=>{let j=Jz.exec($);if(j){let Q=j[1]===void 0?j.slice(4,7):j.slice(1,4);return $z(S(Q),J)}let q=$.slice($.lastIndexOf("/")+1);return Zz.has(q)&&$!==Z&&$!==process.execPath})}function yz(){let z=M("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(z.status!==0)return null;let J=[];for(let Z of z.stdout.split(`
 `)){let $=/^\s*(\d+)\s+(\S.*)$/.exec(Z);if(!$||Number($[1])===process.pid)continue;let j=$[2].trimEnd(),q=j.slice(j.lastIndexOf("/")+1);if(!Jz.test(j)&&Zz.has(q)){let V=M("/usr/sbin/lsof",["-a","-p",$[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
 `).find((X)=>X.startsWith("n/"));if(V)j=V.slice(1)}J.push(j)}return J}function bz(z){if(zz(z.home),!w(z.sourceApp))throw new L("identity_invalid","The packaged Reason background identity is missing or invalid.");let J=z.command??t,Z=v(z.home),$=C(Z);i($,{recursive:!0,mode:448}),Hz($,448);let j=T(z.sourceApp),q=null;try{q=T(Z)}catch{}if(j!==q){let Q=`${process.pid}.${p()}`,V=D($,`.Reason.app.${Q}.tmp`),X=D($,`.Reason.app.${Q}.old`),W=!1;try{if(Rz(j,V,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!w(V))throw new L("identity_invalid","The copied Reason background identity is invalid.");let Y=z.releaseSigned?["--test-requirement",`=${Iz}`]:[];if(J("/usr/bin/codesign",["--verify","--strict",...Y,V])!==0)throw new L("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let B=!1;for(let F=0;F<4;F+=1){let G=!1;try{R(Z,X),G=!0,W=!0}catch(K){if(K.code!=="ENOENT")throw K}if(F===0)z.beforePublish?.();try{R(V,Z),B=!0}catch(K){let m=K.code;if(!["EEXIST","ENOTEMPTY"].includes(m??""))throw K;if(G)P(X,{recursive:!0,force:!0}),W=!1;if(F===3)throw K;continue}if(G)P(X,{recursive:!0,force:!0}),W=!1;break}if(!B)throw Error("Could not publish Reason's background identity.")}catch(Y){if(W&&!U(Z)&&U(X))R(X,Z);throw Y}finally{P(V,{recursive:!0,force:!0}),P(X,{recursive:!0,force:!0})}}return Wz(Z,z,{verified:j!==q}),Z}function jz(z){return D(C(z),".Reason.app.registered")}function qz(z){try{let J=O(z);return J.isDirectory()?`${J.ino}:${J.birthtimeMs}`:null}catch{return null}}function f(z){let J=qz(z);try{return J!==null&&E(jz(z),"utf8")===J}catch{return!1}}function Qz(z){if(w(z))return"bundle";try{if(O(D(z,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return O(D(z,"Contents","MacOS",x)).isSymbolicLink()?"retired":null}catch{return null}}function Wz(z,J,Z={}){let $=J.command??t;if(!Z.verified&&$("/usr/bin/codesign",["--verify","--strict",z])!==0)throw new L("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if($(k,["-f",z])!==0)throw new L("identity_register_failed","Could not register Reason's macOS background identity.");let j=qz(z);try{if(j)Oz(jz(z),j,{mode:384})}catch{}try{gz(z,J.home,$,J.runningExecutables??yz)}catch(q){let Q=q.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${Q})
 `)}}function gz(z,J,Z,$){let j=y(z);if(!j)return;let q=_(J),Q=C(q),V=(K)=>D(K,"Contents","MacOS",x),X=Uz(C(V(q)),j),W=`${process.pid}.${p()}`,Y=Qz(q);if(Y===null)return;let B=Y==="bundle";if(B)Z(k,["-u",q]);let F=D(Q,`.Ara.app.${W}.old`);if(!e.has(q)&&!xz($())){if(!B)Z(k,["-u",q]);try{R(q,F)}catch(K){if(K.code==="ENOENT")return;throw K}P(F,{recursive:!0,force:!0}),uz(Q);return}if(!B){if(Lz(V(q))===X)return;let K=`${V(q)}.${W}`;c(X,K);try{R(K,V(q))}finally{P(K,{force:!0})}return}let G=D(Q,`.Ara.app.${W}.shim`);i(C(V(G)),{recursive:!0}),c(X,V(G));try{try{R(q,F)}catch(K){if(K.code==="ENOENT")return;throw K}try{R(G,q)}catch(K){if(U(q))return;throw R(F,q),K}}finally{P(G,{recursive:!0,force:!0}),P(F,{recursive:!0,force:!0})}}function uz(z){try{if(Cz(z).some((Z)=>Z!==".DS_Store"))return;P(D(z,".DS_Store"),{force:!0}),Mz(z)}catch{}}var l=new Map;function hz(z=N()){let J=l.get(z);if(J)return J;if(process.platform!=="darwin")return[];let Z=s(z);if(Z===null&&U(C(v(z))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),Z=s(z);if(Z===null)return[];return l.set(z,Z),Z}function s(z){let J=v(z),Z=_(z);if(!w(J)||!f(J))try{dz({home:z,skipWhenSettled:!0})}catch{}let $=w(J)&&(f(J)||!w(Z))?J:w(Z)?Z:null,j=$?y($):null;if(!j)return null;if($===Z)e.add(Z);let q=M(j,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return q.status===0&&q.stdout===`spawn
@@ -20,7 +20,7 @@ The macOS privacy permissions of this computer's Reason worker:
 allow asks for each missing one, or the one named. macOS cannot ask for Full
 Disk Access: allow disk opens its pane, shows the file to add in Finder and
 waits until the worker has it.
-`,u="x-apple.systempreferences:com.apple.preference.security",az="curl -fsSL https://reasonmachines.com/install.sh | bash",oz=180000,rz=2000,h=["screen","accessibility","disk"],d={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${u}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${u}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${u}?Privacy_AllFiles`}};function Bz(z){return z.executable}function tz(z,J){if(z==="computer_use_identity_missing")return`Reason's background identity is not installed (${z}); reinstall Reason: ${az}`;if(z==="computer_use_identity_outdated")return`Reason's background identity is outdated (${I(J)??"unknown"}; this CLI is ${A}) (${z}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${z}); run the installed \`reason\``}function ez(z=N()){let J=b(z);if(J.length>0)return{state:"ready",path:g(g(g(J[0]))),prefix:J};let Z=Kz(J,z)??"computer_use_identity_unavailable";return{state:Z,path:v(z),detail:tz(Z,z)}}function Pz(){return{identity:()=>ez(),grants:(z)=>wz(z),request:(z,J)=>Nz(z,J),worker:async()=>(await import("./status-1rzbc3qv.js")).connectionMacState(),open:(z)=>{iz("/usr/bin/open",z,{stdio:"ignore",timeout:1e4})},tile:Xz,restartConnection:async()=>(await import("./connect-cli-rbx2c5db.js")).restartConnection(),sleep:(z)=>new Promise((J)=>setTimeout(J,z)),now:()=>Date.now()}}function Yz(z,J,Z){if(z.state!=="ready"||!J)return"unknown";return J[Z]?"granted":"missing"}async function vz(z){let J=z.identity(),Z=J.state==="ready"?await z.grants(J.prefix):null,$=await z.worker(),j=$?Bz($):null,q=!j||$?.full_disk_access==="unknown"?"unknown":$?.full_disk_access==="granted"?"granted":"missing",Q=(V,X,W)=>{let{label:Y,purpose:B,level:F}=d[V];return{id:V,label:Y,purpose:B,level:F,state:X,holder:W}};return{identity:{state:J.state,path:J.path,detail:J.state==="ready"?null:J.detail},worker_detail:j?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[Q("screen",Yz(J,Z,"screen"),J.path),Q("accessibility",Yz(J,Z,"accessibility"),J.path),Q("disk",q,j)]}}function MJ(z){let J=z.identity.state==="ready"?null:z.identity.state,Z=z.permissions.filter((q)=>q.state==="granted").length,$=[...J?[J]:[],...z.permissions.filter((q)=>q.state!=="granted"&&!(J&&q.id!=="disk")).map((q)=>`${q.label} ${q.state}`)],j=!J&&z.permissions.some((q)=>q.state==="missing");return`Permissions: ${Z} of ${z.permissions.length}${$.length>0?` (${$.join(", ")})`:""}`+(j?" \u2014 reason permissions allow":$.length>0?" \u2014 reason permissions":"")}function zJ(z){let J=[];if(z.identity.detail)J.push(z.identity.detail);J.push(`Reason: ${z.identity.path}`);let Z=z.permissions.find(($)=>$.id==="disk");J.push(Z?.holder?`Worker: ${Z.holder}`:`Worker: ${z.worker_detail}`),J.push("");for(let $ of z.permissions){let j=`${$.label}${$.level==="recommended"?" (recommended)":""}`;J.push(`  ${$.id.padEnd(13)}  ${$.state.padEnd(7)}  ${j}: ${$.purpose}`)}if(z.permissions.some(($)=>$.state==="missing"))J.push("","Allow the missing ones: reason permissions allow");return`${J.join(`
+`,u="x-apple.systempreferences:com.apple.preference.security",az="curl -fsSL https://reasonmachines.com/install.sh | bash",oz=180000,rz=2000,h=["screen","accessibility","disk"],d={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${u}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${u}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${u}?Privacy_AllFiles`}};function Bz(z){return z.executable}function tz(z,J){if(z==="computer_use_identity_missing")return`Reason's background identity is not installed (${z}); reinstall Reason: ${az}`;if(z==="computer_use_identity_outdated")return`Reason's background identity is outdated (${I(J)??"unknown"}; this CLI is ${A}) (${z}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${z}); run the installed \`reason\``}function ez(z=N()){let J=b(z);if(J.length>0)return{state:"ready",path:g(g(g(J[0]))),prefix:J};let Z=Kz(J,z)??"computer_use_identity_unavailable";return{state:Z,path:v(z),detail:tz(Z,z)}}function Pz(){return{identity:()=>ez(),grants:(z)=>wz(z),request:(z,J)=>Nz(z,J),worker:async()=>(await import("./status-yqrfan74.js")).connectionMacState(),open:(z)=>{iz("/usr/bin/open",z,{stdio:"ignore",timeout:1e4})},tile:Xz,restartConnection:async()=>(await import("./connect-cli-vcfcb2g3.js")).restartConnection(),sleep:(z)=>new Promise((J)=>setTimeout(J,z)),now:()=>Date.now()}}function Yz(z,J,Z){if(z.state!=="ready"||!J)return"unknown";return J[Z]?"granted":"missing"}async function vz(z){let J=z.identity(),Z=J.state==="ready"?await z.grants(J.prefix):null,$=await z.worker(),j=$?Bz($):null,q=!j||$?.full_disk_access==="unknown"?"unknown":$?.full_disk_access==="granted"?"granted":"missing",Q=(V,X,W)=>{let{label:Y,purpose:B,level:F}=d[V];return{id:V,label:Y,purpose:B,level:F,state:X,holder:W}};return{identity:{state:J.state,path:J.path,detail:J.state==="ready"?null:J.detail},worker_detail:j?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[Q("screen",Yz(J,Z,"screen"),J.path),Q("accessibility",Yz(J,Z,"accessibility"),J.path),Q("disk",q,j)]}}function MJ(z){let J=z.identity.state==="ready"?null:z.identity.state,Z=z.permissions.filter((q)=>q.state==="granted").length,$=[...J?[J]:[],...z.permissions.filter((q)=>q.state!=="granted"&&!(J&&q.id!=="disk")).map((q)=>`${q.label} ${q.state}`)],j=!J&&z.permissions.some((q)=>q.state==="missing");return`Permissions: ${Z} of ${z.permissions.length}${$.length>0?` (${$.join(", ")})`:""}`+(j?" \u2014 reason permissions allow":$.length>0?" \u2014 reason permissions":"")}function zJ(z){let J=[];if(z.identity.detail)J.push(z.identity.detail);J.push(`Reason: ${z.identity.path}`);let Z=z.permissions.find(($)=>$.id==="disk");J.push(Z?.holder?`Worker: ${Z.holder}`:`Worker: ${z.worker_detail}`),J.push("");for(let $ of z.permissions){let j=`${$.label}${$.level==="recommended"?" (recommended)":""}`;J.push(`  ${$.id.padEnd(13)}  ${$.state.padEnd(7)}  ${j}: ${$.purpose}`)}if(z.permissions.some(($)=>$.state==="missing"))J.push("","Allow the missing ones: reason permissions allow");return`${J.join(`
 `)}
 `}async function Gz(z,J){let Z=J.now()+oz;for(;;){if(await z())return!0;if(J.now()>=Z)return!1;await J.sleep(rz)}}async function JJ(z,J){let Z=J.host??Pz(),{io:$}=J,j=await vz(Z),q=j.permissions.filter((W)=>z.includes(W.id)&&W.state!=="granted");if(q.length===0)return $.stdout.write(`Reason permissions: ${z.map((W)=>d[W].label).join(", ")} already allowed.
 `),0;let Q=!1,V=!1,X=Z.identity();for(let W of q){let{label:Y,pane:B}=d[W.id];if(W.id!=="disk"){if(X.state!=="ready"){if(!Q)$.stderr.write(`Reason permissions: ${X.detail}

package/bin/vm-hands/{vm-hands-entry-lite-erbwr8ms.js → vm-hands-entry-lite-zg2xz3b1.js}

@@ -1,5 +1,5 @@
 // @bun
-import{ce as xe}from"./vm-hands-entry-lite-qf01e5f1.js";import{Ae as W,Be as oe,De as _t,Ee as Ne,He as St,Ie as wt,Je as $,Se as z,Te as Je}from"./vm-hands-entry-lite-60s8m5m7.js";import{Ye as Se}from"./vm-hands-entry-lite-xhjbc3e4.js";import{_e as Jt,bf as xt,ef as Z,gf as zt,hf as ae}from"./vm-hands-entry-lite-akaxyv3r.js";import{Lf as Ae,Mf as se}from"./vm-hands-entry-lite-c9wp99nr.js";import{Eh as Ot,sh as v,uh as tt,vh as D}from"./vm-hands-entry-lite-6qfax5p2.js";import{Kh as q}from"./vm-hands-entry-lite-5b29hq7h.js";import{ji as pe,pi as ye}from"./vm-hands-entry-lite-6f5eypjm.js";import{qi as _}from"./vm-hands-entry-lite-tj1y61bg.js";import{spawn as I}from"child_process";import{randomUUID as Oe}from"crypto";import{closeSync as Vr,copyFileSync as de,existsSync as ut,fstatSync as Er,mkdirSync as fe,openSync as vr,readdirSync as V,readFileSync as ge,readlinkSync as to,renameSync as eo,rmSync as ro,statSync as oo}from"fs";import{connect as so}from"net";import{userInfo as Te}from"os";import{basename as le,dirname as mt,join as b}from"path";var At=`import { spawn, execFileSync } from "node:child_process";
+import{ce as xe}from"./vm-hands-entry-lite-qf01e5f1.js";import{Ae as W,Be as oe,De as _t,Ee as Ne,He as St,Ie as wt,Je as $,Se as z,Te as Je}from"./vm-hands-entry-lite-7z169ekf.js";import{Ye as Se}from"./vm-hands-entry-lite-xhjbc3e4.js";import{_e as Jt,bf as xt,ef as Z,gf as zt,hf as ae}from"./vm-hands-entry-lite-s97jy69e.js";import{Lf as Ae,Mf as se}from"./vm-hands-entry-lite-c9wp99nr.js";import{Eh as Ot,sh as v,uh as tt,vh as D}from"./vm-hands-entry-lite-6qfax5p2.js";import{Kh as q}from"./vm-hands-entry-lite-5b29hq7h.js";import{ji as pe,pi as ye}from"./vm-hands-entry-lite-6f5eypjm.js";import{qi as _}from"./vm-hands-entry-lite-tj1y61bg.js";import{spawn as I}from"child_process";import{randomUUID as Oe}from"crypto";import{closeSync as Vr,copyFileSync as de,existsSync as ut,fstatSync as Er,mkdirSync as fe,openSync as vr,readdirSync as V,readFileSync as ge,readlinkSync as to,renameSync as eo,rmSync as ro,statSync as oo}from"fs";import{connect as so}from"net";import{userInfo as Te}from"os";import{basename as le,dirname as mt,join as b}from"path";var At=`import { spawn, execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
 import { tmpdir } from "node:os";

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,2 +1,2 @@
 // @bun
-import"./vm-hands-entry-lite-zrvaqawr.js";import"./vm-hands-entry-lite-qf01e5f1.js";import"./vm-hands-entry-lite-k17ntg9v.js";import{wi as A}from"./vm-hands-entry-lite-nd1k2jz9.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-n0swj91r.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-pec65yhk.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();
+import"./vm-hands-entry-lite-zrvaqawr.js";import"./vm-hands-entry-lite-qf01e5f1.js";import"./vm-hands-entry-lite-k17ntg9v.js";import{wi as A}from"./vm-hands-entry-lite-nd1k2jz9.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-dj3pn7eg.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-sw74b6rq.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();

package/bin/vm-hands/{vm-hands-executor-3fj32kpg.js → vm-hands-executor-645jqht0.js}

@@ -1,5 +1,5 @@
 // @bun
-import{a as Mq}from"./vm-hands-entry-lite-4rs8zyke.js";import{$a as Uq,Fb as Fq,Ha as Lq,Jb as Tq}from"./vm-hands-entry-lite-g4xy7th1.js";import"./vm-hands-entry-lite-wpx6sg6d.js";import"./vm-hands-entry-lite-nbtpm59m.js";import"./vm-hands-entry-lite-nvhzj5b0.js";import"./vm-hands-entry-lite-qf01e5f1.js";import"./vm-hands-entry-lite-xhjbc3e4.js";import"./vm-hands-entry-lite-8a0dsr68.js";import"./vm-hands-entry-lite-33ttamma.js";import"./vm-hands-entry-lite-mybm2kyz.js";import"./vm-hands-entry-lite-6qfax5p2.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-k17ntg9v.js";import"./vm-hands-entry-lite-6f5eypjm.js";import"./vm-hands-entry-lite-tj1y61bg.js";import"./vm-hands-entry-lite-nd1k2jz9.js";import{spawn as Iq}from"child_process";import{chmodSync as vq,chownSync as Oq,existsSync as l,lstatSync as o,mkdirSync as e,mkdtempSync as bq,readdirSync as s,readFileSync as A,realpathSync as hq,rmdirSync as r,rmSync as xq,writeFileSync as E}from"fs";import{join as U}from"path";var wq="/sys/fs/cgroup/reason-payload",_="vm-hands",Vq="/run/ara-srt/fallbacks.jsonl",y="/reason-person",qq=5000,_q=1e4,zq="__VM_HANDS_PROOF_DIR__",Hq="__VM_HANDS_PROBE_NONCE__";class T extends Error{code;constructor(q,z){super(z);this.code=q}}function gq(q,z){if(!/^[0-9a-f-]{36}$/i.test(z))throw new T("vm_hands_bind_invalid","bad bind id");return U(q,_,`b-${z.toLowerCase()}`)}var kq=5000,Rq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function iq(q){let z=q.cgroup??wq,J=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,W=new Map,B=0,P=()=>{try{let Z=A("/run/ara-srt/starts.jsonl","utf8"),Q=Z.slice(B>Z.length?0:B).split(`
+import{a as Mq}from"./vm-hands-entry-lite-75v7p1ab.js";import{$a as Uq,Fb as Fq,Ha as Lq,Jb as Tq}from"./vm-hands-entry-lite-rw994s8q.js";import"./vm-hands-entry-lite-wpx6sg6d.js";import"./vm-hands-entry-lite-nbtpm59m.js";import"./vm-hands-entry-lite-nvhzj5b0.js";import"./vm-hands-entry-lite-qf01e5f1.js";import"./vm-hands-entry-lite-xhjbc3e4.js";import"./vm-hands-entry-lite-14ff4san.js";import"./vm-hands-entry-lite-33ttamma.js";import"./vm-hands-entry-lite-mybm2kyz.js";import"./vm-hands-entry-lite-6qfax5p2.js";import"./vm-hands-entry-lite-5b29hq7h.js";import"./vm-hands-entry-lite-84d59wrf.js";import"./vm-hands-entry-lite-k17ntg9v.js";import"./vm-hands-entry-lite-6f5eypjm.js";import"./vm-hands-entry-lite-tj1y61bg.js";import"./vm-hands-entry-lite-nd1k2jz9.js";import{spawn as Iq}from"child_process";import{chmodSync as vq,chownSync as Oq,existsSync as l,lstatSync as o,mkdirSync as e,mkdtempSync as bq,readdirSync as s,readFileSync as A,realpathSync as hq,rmdirSync as r,rmSync as xq,writeFileSync as E}from"fs";import{join as U}from"path";var wq="/sys/fs/cgroup/reason-payload",_="vm-hands",Vq="/run/ara-srt/fallbacks.jsonl",y="/reason-person",qq=5000,_q=1e4,zq="__VM_HANDS_PROOF_DIR__",Hq="__VM_HANDS_PROBE_NONCE__";class T extends Error{code;constructor(q,z){super(z);this.code=q}}function gq(q,z){if(!/^[0-9a-f-]{36}$/i.test(z))throw new T("vm_hands_bind_invalid","bad bind id");return U(q,_,`b-${z.toLowerCase()}`)}var kq=5000,Rq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function iq(q){let z=q.cgroup??wq,J=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,W=new Map,B=0,P=()=>{try{let Z=A("/run/ara-srt/starts.jsonl","utf8"),Q=Z.slice(B>Z.length?0:B).split(`
 `).filter(Boolean);B=Z.length;let Y=Q.map((L)=>{try{return Number(JSON.parse(L).elapsed_ms)||0}catch{return 0}});if(Y.length)X("vm_hands.srt_server_starts",{count:Y.length,elapsed_ms:Y.slice(0,8)})}catch{}},D=null,H=!1,O=q.srtCgroup??"/sys/fs/cgroup/reason-srt",C=()=>{D??=Gq()},b=0,h=()=>{try{let Z=A(Vq,"utf8"),Q=Z.slice(b>Z.length?0:b);b=Z.length;let Y=Q.split(`
 `).filter(Boolean).slice(0,1000);if(!Y.length)return null;let L={},F=0;for(let M of Y)try{let R=JSON.parse(M),K=typeof R.code==="string"&&/^[a-z_]{1,40}$/.test(R.code)?R.code:"other";if(L[K]=(L[K]??0)+1,typeof R.elapsed_ms==="number")F=Math.max(F,R.elapsed_ms)}catch{L.unparsed=(L.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:Y.length,codes:L,max_elapsed_ms:F}),{count:Y.length,codes:L,max_elapsed_ms:F}}catch{return null}},f=!1,m=(Z,Q,Y)=>{if(f)throw Error("vm_hands_pool_held");return Nq(Z,Q,Y)},d=(Z)=>(Q,Y,L)=>Iq("/bin/sh",["-c",`echo $$ > ${Rq(U(Z,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",Q,...Y],L),Nq=d(U(z,_)),u=U(z,_,"probe"),S=(Z)=>gq(z,Z),Aq=(Z)=>{let Q=S(Z);try{e(Q,{mode:493})}catch(Y){if(!(Y&&typeof Y==="object"&&("code"in Y)&&Y.code==="EEXIST"))throw new T("vm_hands_bind_failed","bind cgroup")}return Q},Pq=(Z)=>{try{r(S(Z))}catch{}},x=q.prespawn?Uq({spawnProcess:m,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(Z,Q)=>X(Z,Q??{})}):null;x?.arm();let i=x?setInterval(()=>{x.arm()},kq):null;i?.unref?.();async function c(Z){let Q=G.get(Z);if(G.delete(Z),!Q)return;Q.abort.abort(),await Q.done}return{bindCgroup:S,async startExecutor(Z){if(C(),W.set(Z.bindId,Gq()),H=!0,!Z.claim)throw new T("vm_hands_bind_invalid","an executor needs the claim it serves");await c(Z.bindId);let{claim:Q,bindId:Y}=Z,L=Aq(Y),F=Q.owner;if(!F||typeof F.device_id!=="string"||typeof Q.root_id!=="string")throw new T("vm_hands_bind_invalid","claim without its owner Device or root");let M=new AbortController,R,K,j=new Promise(($,w)=>{R=$,K=w}),I,N=new Promise(($)=>{I=$}),V=Tq({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:F.device_id,rootId:Q.root_id,apiOrigin:q.apiOrigin},claimOwner:Q.owner,root:q.root,runId:Q.run_id,operationId:Q.operation_id,attemptId:Q.attempt_id,payload:Object.fromEntries(Object.entries(Q.payload).filter(([$])=>!$.startsWith("vm_hands_"))),signal:M.signal,emitEvent:async($,w)=>{if($==="hands.ready"){R(w);return}if($==="hands.started"||$==="hands.stopped"||$==="hands.failed")return;await q.forward(Y,$,w)}},{...q.relayDependencies,spawnWorker:($)=>d(L)($.command,$.args,$.options),...x?{takePrespawnedWorker:($)=>{let w=x.take($);if(!w?.pid)return w;try{return E(U(L,"cgroup.procs"),String(w.pid)),w}catch{try{w.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:x.adopt}:{}}).then(()=>{I("executor_stopped")},($)=>{let w=$&&typeof $==="object"&&"code"in $?String($.code):"executor_failed";K(new T(w,$ instanceof Error?$.message:String($))),I(w)}).finally(()=>K(new T("vm_hands_executor_exited","executor ended before it was ready")));G.set(Y,{abort:M,done:V,exited:N,operationId:Q.operation_id,runId:Q.run_id,expiresAtMs:Date.parse(String(Q.payload.expires_at??""))||0});let g=await j,a=g.executor_launch_id;if(typeof a!=="string")throw new T("vm_hands_bind_failed","executor ready without a launch id");return{launchId:a,readyData:g,applied:{hands_confinement:typeof Q.payload.hands_confinement==="string"?Q.payload.hands_confinement:null,browser_egress:Q.payload.browser_egress??null}}},takeSrtFallbacks:h,executorExited(Z){return G.get(Z)?.exited??new Promise(()=>{})},freezeBind(Z){let Q=S(Z);if(l(U(Q,"cgroup.freeze")))E(U(Q,"cgroup.freeze"),"1")},async killAndVerifyPayload(Z){let Q=new Set(Z?.keep??[]);if(Q.size||Z?.own)return Cq(Z?.bindId??null,Q,Z?.own===!0);f=!0;let Y=Yq();try{await Bq();let L=Promise.all([...G.keys()].map((K)=>c(K).catch(()=>{return})));P();let F=Date.now()+qq;await p(z,F,"payload"),await L;let M=(H||q.srtWarmLate?.()===!0)&&l(U(O,"cgroup.events"));if(M)await p(O,F,"srt");let R=Zq(J).filter((K)=>!v(K,y));if(D!==null){let K=Xq(D).filter((j)=>j!==process.pid&&!v(j,y));if(K.length)throw X("vm_hands.kill_strays",{strays:K.slice(0,16).map((j)=>{let I="?",N="?";try{I=A(`/proc/${j}/comm`,"utf8").trim().slice(0,32)}catch{}try{N=(A(`/proc/${j}/cgroup`,"utf8").split(`
 `).find((V)=>V.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:j,comm:I,cgroup:N}})}),new T("vm_hands_kill_unverified",`${K.length} process(es) the run started survived it`);D=null}if(H=!1,M)q.onSrtReset?.();if(R.length)throw X("vm_hands.kill_survivors",{pids:R.slice(0,16)}),new T("vm_hands_kill_unverified",`${R.length} payload-uid process(es) outside the payload cgroup`);W.clear();for(let K of Qq())try{r(U(z,_,K))}catch{}}finally{f=!1,Y()}if(x)setTimeout(()=>{if(!G.size)x.arm()},100).unref?.()},async killProbe(){let Z=Date.now()+qq;if(l(U(u,"cgroup.events"))){await p(u,Z,"probe");try{r(u)}catch{}}let Q=$q(process.pid);if(Q===null)throw new T("vm_hands_kill_unverified","agent start time unreadable");await yq(z,Q,Z);let Y=(F)=>{let M=$q(F);return M!==null&&M<=Q},L=Zq(J).filter((F)=>Y(F)&&!v(F,y));if(L.length)throw X("vm_hands.kill_survivors",{pids:L.slice(0,16),at:"attest"}),new T("vm_hands_kill_unverified",`${L.length} payload-uid process(es) from before this agent`);if(D!==null){let F=[z,U(z,_)].map((K)=>K.replace(/^\/sys\/fs\/cgroup/,"")),M=O.replace(/^\/sys\/fs\/cgroup/,""),R=Xq(D).filter((K)=>K!==process.pid&&!v(K,y)&&!v(K,"/reason-vm-hands")&&!v(K,M)&&!F.some((j)=>Wq(K,j)));if(R.length)throw X("vm_hands.kill_strays",{strays:R.slice(0,16).map((K)=>({pid:K})),at:"attest"}),new T("vm_hands_kill_unverified",`${R.length} process(es) the probe started survived it`);D=null}},async runProbe({nonce:Z,script:Q}){if(C(),!Q.includes(zq))throw new T("vm_hands_probe_failed","probe names no proof directory");let Y=q.proofParent??"/tmp/reason-vm-hands-proof";e(Y,{mode:457,recursive:!0});let L=o(Y);if(L.isSymbolicLink()||!L.isDirectory()||L.uid!==(process.getuid?.()??-1)||(L.mode&4095)!==457)throw new T("vm_hands_probe_failed","proof parent is not root's 0711 directory");let F=bq(U(Y,"p-")),M=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(F)||!/^[A-Za-z0-9_-]{1,128}$/.test(Z))throw new T("vm_hands_probe_failed","proof directory path or nonce");Oq(F,J,J),vq(F,448);let R=o(F).ino;try{e(u,{mode:493})}catch(N){if(!(N&&typeof N==="object"&&("code"in N)&&N.code==="EEXIST"))throw new T("vm_hands_probe_failed","probe cgroup")}let K=d(u)("/bin/bash",["-c",Q.replaceAll(zq,F).replaceAll(Hq,Z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),j="";K.stdout?.on("data",(N)=>{if(j.length<16384)j+=N.toString("utf8").slice(0,16384-j.length)});let I=await new Promise((N)=>{let V=setTimeout(()=>{M=!0,K.kill("SIGKILL"),N(124)},_q);K.once("error",()=>{clearTimeout(V),N(127)}),K.once("close",(g)=>{clearTimeout(V),N(g??1)})});return X("vm_hands.probe",{nonce_len:Z.length,exit_code:I}),{exitCode:I,markers:j,proofDirInode:R}}finally{if(!M)xq(F,{recursive:!0,force:!0})}},restatLayout(){let{session_root:Z,alias:Q}=q.init.layout,Y="invalid";try{Fq(Z),Y="0:0:755"}catch{}let L=!1,F=-1;try{let M=o(Q);F=M.uid,L=Y==="0:0:755"&&Q===U(Z,"repo")&&!M.isSymbolicLink()&&M.isDirectory()&&hq(Q)===Q&&M.uid===J}catch{}return{root_mode:Y,alias_ok:L,owner_uid:F}},installEnvironment(Z,Q){let Y=G.get(Z);if(!Y)throw new T("environment_unavailable","no executor owns an environment");return Lq({root:q.root,operationId:Y.operationId,payload:Q}).installed_revision},async stop(){if(i)clearInterval(i);x?.close(),await Promise.all([...G.keys()].map((Z)=>c(Z)))}};function Qq(){try{return s(U(z,_),{withFileTypes:!0}).filter((Z)=>Z.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(Z.name)).map((Z)=>Z.name)}catch{return[]}}async function Cq(Z,Q,Y=!1){let L=new Set([...Q].map((M)=>M.toLowerCase())),F=Yq();try{await Bq();let M=Date.now()+qq,R=new Set(Qq().filter(($)=>!L.has($.slice(2))).map(($)=>$.slice(2)));if(Z)R.add(Z.toLowerCase());let K=null;for(let $ of R){let w=c($).catch(()=>{return}),n=W.get($);if(n!==void 0)K=K===null?n:Math.min(K,n);if(l(U(S($),"cgroup.events")))await p(S($),M,"bind");await w}let j=[...L].map(($)=>S($).replace(/^\/sys\/fs\/cgroup/,"")),I=[z,U(z,_)].map(($)=>$.replace(/^\/sys\/fs\/cgroup/,"")),N=O.replace(/^\/sys\/fs\/cgroup/,""),V=($)=>v($,y)||j.some((w)=>v($,w)),g=Y?[]:Zq(J).filter(($)=>!V($));if(g.length)throw X("vm_hands.kill_survivors",{pids:g.slice(0,16),beside:L.size}),new T("vm_hands_kill_unverified",`${g.length} payload-uid process(es) outside a live bind`);let a=($)=>!V($)&&!v($,"/reason-vm-hands")&&!v($,N)&&!I.some((w)=>Wq($,w));if(K!==null){let $=Xq(K).filter((w)=>w!==process.pid&&a(w));if($.length)throw X("vm_hands.kill_strays",{strays:$.slice(0,16).map((w)=>({pid:w})),beside:L.size}),new T("vm_hands_kill_unverified",`${$.length} process(es) the run started survived it`)}for(let $ of R)W.delete($),Pq($)}finally{F()}}}function $q(q,z="/proc"){try{let J=A(U(z,String(q),"stat"),"utf8"),X=Number(J.slice(J.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(X)?X:null}catch{return null}}function Sq(q,z="/proc"){try{let J=A(U(z,String(q),"stat"),"utf8"),X=Number(J.slice(J.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(X)?X:null}catch{return null}}async function yq(q,z,J){try{E(U(q,"cgroup.freeze"),"1")}catch(X){throw new T("vm_hands_kill_unverified",`payload cgroup.freeze: ${X instanceof Error?X.message:String(X)}`)}try{for(;;){let X=Dq(q).filter((W)=>fq(W,q)),G=new Set(X.filter((W)=>{let B=$q(W);return B!==null&&B<=z}));for(let W=!0;W;){W=!1;for(let B of X){if(G.has(B))continue;let P=Sq(B);if(P!==null&&G.has(P))G.add(B),W=!0}}if(G.size===0)return;if(Date.now()>J)throw new T("vm_hands_kill_unverified",`${G.size} previous-boot process(es) survived`);for(let W of G)try{process.kill(W,"SIGKILL")}catch{}await new Promise((W)=>setTimeout(W,10))}}finally{try{E(U(q,"cgroup.freeze"),"0")}catch{}}}function Wq(q,z,J="/proc"){try{return A(U(J,String(q),"cgroup"),"utf8").split(`

package/bin/vm-hands/{vm-hands-op-runner-n0swj91r.js → vm-hands-op-runner-dj3pn7eg.js}

@@ -1,2 +1,2 @@
 // @bun
-import{a,b,c}from"./vm-hands-entry-lite-4rs8zyke.js";import"./vm-hands-entry-lite-tj1y61bg.js";import"./vm-hands-entry-lite-nd1k2jz9.js";export{b as spawnSessionPty,c as runVmHandsOpRunner,a as VM_HANDS_OP_RUNNER_PERSON_ARG};
+import{a,b,c}from"./vm-hands-entry-lite-75v7p1ab.js";import"./vm-hands-entry-lite-tj1y61bg.js";import"./vm-hands-entry-lite-nd1k2jz9.js";export{b as spawnSessionPty,c as runVmHandsOpRunner,a as VM_HANDS_OP_RUNNER_PERSON_ARG};

package/bin/vm-hands/{vm-hands-runtime-pec65yhk.js → vm-hands-runtime-sw74b6rq.js}

@@ -1,4 +1,4 @@
 // @bun
 import{N as k,O as m,P as l}from"./vm-hands-entry-lite-zrvaqawr.js";import{rd as v}from"./vm-hands-entry-lite-qf01e5f1.js";import"./vm-hands-entry-lite-k17ntg9v.js";import{wi as G}from"./vm-hands-entry-lite-nd1k2jz9.js";import{spawn as a}from"child_process";import{createHash as t}from"crypto";import{lstatSync as w,mkdirSync as s,readFileSync as i,statSync as e,writeFileSync as d}from"fs";var P="/run/reason-vm-hands",O="/run/reason-vm-hands/env",T="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",p="/usr/local/bin/ara-srt-exec",qj=65536,Jj=21600000;function Qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=w(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
-`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=w(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=w(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=t("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-mcae7k64.js"),import("./hands-worker-source-hbp5n31r.js"),import("./network-contract-rm9x646s.js"),import("./device-workspace-7yg5x68n.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-3z7bas06.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],$j=new Set(["pty.start","jobs.control"]);function Xj(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
-`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){y(P),y(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-gcysz0m3.js"),import("./worker-sandbox-yw24sxyp.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-3fj32kpg.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:T,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let M={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{M.restatLayout=()=>q.restatLayout(),M.installEnvironment=($,B)=>q.installEnvironment($,B),M.freezeBind=($)=>q.freezeBind($),M.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,M,{envRoot:O}),h=Zj(Q),b=null,n=Promise.all([h,import("./local-capabilities-pg7ad5dp.js")]).then(([q,$])=>{b=Xj(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-3fj32kpg.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:L.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&q==="person"&&!$.authority;if($j.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-pg7ad5dp.js");return U(x,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:x,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Mj as runVmHands,Lj as parseVmHandsInit,Zj as heartbeatBody,Qj as enableBaseKeyedSrt};
+`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=w(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=w(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=t("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-hz0ddxsn.js"),import("./hands-worker-source-hbp5n31r.js"),import("./network-contract-rm9x646s.js"),import("./device-workspace-7yg5x68n.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-3z7bas06.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],$j=new Set(["pty.start","jobs.control"]);function Xj(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
+`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){y(P),y(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-gcysz0m3.js"),import("./worker-sandbox-yw24sxyp.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-645jqht0.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:T,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let M={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{M.restatLayout=()=>q.restatLayout(),M.installEnvironment=($,B)=>q.installEnvironment($,B),M.freezeBind=($)=>q.freezeBind($),M.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,M,{envRoot:O}),h=Zj(Q),b=null,n=Promise.all([h,import("./local-capabilities-3x0b9xmk.js")]).then(([q,$])=>{b=Xj(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-645jqht0.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:L.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&q==="person"&&!$.authority;if($j.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-3x0b9xmk.js");return U(x,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:x,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Mj as runVmHands,Lj as parseVmHandsInit,Zj as heartbeatBody,Qj as enableBaseKeyedSrt};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-arm64-musl",
-  "version": "0.2.353",
+  "version": "0.2.354",
   "description": "Reason CLI native binary for linux-arm64-musl",
   "os": [
     "linux"