@reason-machines/cli-linux-arm64-musl 0.2.372 → 0.2.374
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/ara +1 -1
- package/bin/vm-hands/{ask-relay-ymd2qzgp.js → ask-relay-qnc0pbfm.js} +3 -3
- package/bin/vm-hands/{connect-cli-qc3wtvs2.js → connect-cli-acmq5f14.js} +1 -1
- package/bin/vm-hands/{local-automation-a6jqeh24.js → local-automation-bpn0exj8.js} +1 -1
- package/bin/vm-hands/{local-capabilities-mhszxbtw.js → local-capabilities-60rw4wtj.js} +1 -1
- package/bin/vm-hands/{local-display-session-n39tx1qm.js → local-display-session-9dn9tjav.js} +1 -1
- package/bin/vm-hands/{managed-runtime-jqx6n9c8.js → managed-runtime-v8x8gyh7.js} +1 -1
- package/bin/vm-hands/{permissions-yg7dazpa.js → permissions-e74rdrsv.js} +1 -1
- package/bin/vm-hands/{serve-service-65kzxsrc.js → serve-service-2zpqk67b.js} +1 -1
- package/bin/vm-hands/{status-3wwz3xqm.js → status-45mxz20c.js} +2 -2
- package/bin/vm-hands/{version-bsyrze8b.js → version-443dzn59.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-mrms7y4e.js → vm-hands-entry-lite-12xrjfxt.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-vppy988d.js → vm-hands-entry-lite-1sewc078.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-3wgag7rz.js → vm-hands-entry-lite-9bap9r1t.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-y3jxbhxs.js → vm-hands-entry-lite-b2zq6301.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-nb5kxm2n.js → vm-hands-entry-lite-h4r22jaw.js} +77 -77
- package/bin/vm-hands/vm-hands-entry-lite-ja2sqpq1.js +5 -0
- package/bin/vm-hands/{vm-hands-entry-lite-576m681k.js → vm-hands-entry-lite-m3wmcx9g.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-maqkw6pg.js → vm-hands-entry-lite-mdjsd983.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-4kfy4zcs.js → vm-hands-entry-lite-nxz3p54x.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-xdm9jkgq.js → vm-hands-entry-lite-q2f5d2e9.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-rtf4sqh0.js +540 -0
- package/bin/vm-hands/{vm-hands-entry-lite-70xn5vnc.js → vm-hands-entry-lite-sf5svyrg.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-2jbj99sk.js → vm-hands-entry-lite-vn9hp96c.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
- package/bin/vm-hands/{vm-hands-executor-y16fdqnj.js → vm-hands-executor-3s16z4ma.js} +1 -1
- package/bin/vm-hands/{vm-hands-op-runner-sb4fa85z.js → vm-hands-op-runner-9kc2qjg0.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-vq9kf92k.js → vm-hands-runtime-afsge57y.js} +3 -3
- package/package.json +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-khjrcwrj.js +0 -5
- package/bin/vm-hands/vm-hands-entry-lite-z964akpr.js +0 -540
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
// @bun
|
|
2
|
+
import{Be as LJ,Je as gJ,Ke as EJ,Le as VJ,pf as OJ}from"./vm-hands-entry-lite-zfwg7ehq.js";import{createHash as m,randomBytes as KJ}from"crypto";import{closeSync as MJ,fsyncSync as DJ,mkdirSync as oJ,openSync as qJ,renameSync as dJ,rmSync as iJ,statSync as _J,writeSync as xJ,constants as R}from"fs";import{join as a}from"path";var rJ=1;var n=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function FJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function jJ(J,Z){let{payload:z,authority:Q}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!Q||typeof Q!=="object"||Array.isArray(Q)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||Q.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function AJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&n.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:FJ(J)?J.environment_sealed:null,workspace_deferred:sJ(J)}}function sJ(J){let Z=J.payload[EJ];if(Z===void 0)return!1;if(Z!==!0||J.payload.vm_hands_env_deferred!==!0||J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var y=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),b=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function c(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(c).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${c(J[Z])}`).join(",")}}`}async function DZ(J){let Z=await crypto.subtle.importKey("pkcs8",b(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=b(J.device_key.spki),Q=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),L=new Uint8Array(await crypto.subtle.exportKey("spki",Q.publicKey)),j=m("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:Q,signingSpki:z,agreementSpki:L,fingerprint:j}}var aJ=4;class nJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;grants=new Map;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,Q){this.init=J;this.keys=Z;this.hooks=z;this.options=Q;if(!n.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let Q=Date.now()+Z;;){let L=this.bound.get(J);if(!L)return!1;if(L.envInstalled)return!0;if(Date.now()>=Q||z?.aborted)return!1;await new Promise((j)=>setTimeout(j,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:rJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:y(this.keys.signingSpki),env_public_key:y(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:y(KJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(c(Z)));return{...Z,device_signature:y(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),Q=y(KJ(32)),L=OJ({method:"GET",pathAndQuery:LJ,timestamp:z,nonce:Q,challenge:J,bodySha256:m("sha256").update("").digest("hex")}),j=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(L)));return{t:"hello",timestamp:z,nonce:Q,signature:y(tJ(j)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new W("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!n.test(z))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(m("sha256").update(c({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new W("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=aJ)throw new W("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new W("vm_hands_busy","a bind waits for its workspace beside the setup");if(J.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new W("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),J.workspace_deferred){let z,Q,L=new Promise((j,U)=>{z=j,Q=U});L.catch(()=>{return}),this.grants.set(J.bind_id,{promise:L,resolve:z,reject:Q})}return this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,Q=!1,L=this.grants.get(J.bind_id);try{if(L&&(Z.length||this.commandsSinceVerified))throw new W("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(Z.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new W("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.servedRun=!0,Q=!0;let{launchId:j,applied:U,readyData:D}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim,...L?{workspaceGrant:L.promise}:{}}),_=this.hooks.restatLayout(),A=null,q=null;if(J.env){let v=J.claim?.owner??{},V=jJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof v.device_id==="string"?v.device_id:"",rootId:J.claim?.root_id??""});this.commandsSinceVerified=!0,A=this.hooks.installEnvironment(J.bind_id,V),q=typeof V.snapshot_id==="string"&&V.snapshot_id?V.snapshot_id:null,z=this.writeJobEnvRootOnly(J.bind_id,V)}if(this.unbinding.has(J.bind_id))throw new W("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:j,envInstalled:A!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),this.grants.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:j,snapshot_revision:A,snapshot_id:q,layout:_,...D?{ready_data:D}:{},policy_digest:m("sha256").update(c({hands_confinement:U.hands_confinement??null,browser_egress:U.browser_egress??null})).digest("hex")}}catch(j){if(z)GJ(z);if(Q){let D=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:D,own:!0}).catch(()=>{this.unverified.add(J.bind_id)})}this.binding.delete(J.bind_id),this.grants.delete(J.bind_id);let U=j&&typeof j==="object"&&"code"in j&&typeof j.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(j.code)?j.code:"vm_hands_bind_failed";throw j instanceof W?j:new W(U,"executor refused the bind")}}grantWorkspace(J){let Z=this.grants.get(J);if(!Z)throw new W("vm_hands_not_binding","no pre-bind waits for a workspace grant");Z.resolve()}abandonWorkspaceGrant(J){this.grants.get(J)?.reject(new W("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new W("vm_hands_not_bound","environment delivered while not bound");if(!n.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let Q=jJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId});this.commandsSinceVerified=!0;let L=this.hooks.installEnvironment(Z.bindId,Q);if(Z.envInstalled=!0,Z.envDirectory)GJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${L}`,Q),{snapshot_id:J.snapshotId,installed_revision:L,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new W("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:m("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),this.abandonWorkspaceGrant(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((L)=>L!==J),Q=!z.length&&!this.commandsSinceVerified;try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:Q?{bindId:J,own:!0}:void 0)}catch(L){throw this.unverified.add(J),L}if(!z.length)this.unverified.clear(),this.commandsSinceVerified=!1;if(Z?.envDirectory)GJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},Q=await crypto.subtle.importKey("spki",b(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),L=await crypto.subtle.deriveKey({name:"ECDH",public:Q},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),j=await crypto.subtle.decrypt({name:"AES-GCM",iv:b(J.iv),additionalData:new TextEncoder().encode(Z)},L,b(J.ct)).catch(z),U=JSON.parse(new TextDecoder().decode(j));if(!U||typeof U!=="object"||Array.isArray(U))throw new W("vm_hands_env_invalid","env not an object");return U}writeJobEnvRootOnly(J,Z){let z=a(this.options.envRoot,`bind-${J}`);oJ(z,{mode:448});let Q=_J(z);if(!Q.isDirectory()||(Q.mode&63)!==0||Q.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let L=Z.variables&&typeof Z.variables==="object"?Z.variables:{},j=Object.entries(L).filter(([_,A])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(_)&&typeof A==="string").map(([_,A])=>`export ${_}='${String(A).replaceAll("'","'\\''")}'`).join(`
|
|
3
|
+
`)+`
|
|
4
|
+
`,U=a(z,`.job.env.${KJ(8).toString("hex")}`),D=qJ(U,R.O_WRONLY|R.O_CREAT|R.O_EXCL|R.O_NOFOLLOW,384);try{xJ(D,j),DJ(D)}finally{MJ(D)}return dJ(U,a(z,"job.env")),z}}function GJ(J){try{let Z=a(J,"job.env"),z=_J(Z).size,Q=qJ(Z,R.O_WRONLY|R.O_NOFOLLOW);try{xJ(Q,Buffer.alloc(z)),DJ(Q)}finally{MJ(Q)}}catch{}iJ(J,{recursive:!0,force:!0})}function tJ(J){if(J.length!==64)throw new W("vm_hands_signature_invalid","unexpected ECDSA signature length");let Z=(L)=>{let j=0;while(j<L.length-1&&L[j]===0)j++;let U=L.subarray(j),D=U[0]&128?Uint8Array.of(0,...U):U;return Uint8Array.of(2,D.length,...D)},z=Z(J.subarray(0,32)),Q=Z(J.subarray(32));return Uint8Array.of(48,z.length+Q.length,...z,...Q)}import{randomUUID as eJ}from"crypto";var JZ="/app/local-runtime/session?register=vm_hands_v1",ZZ="/app/local-runtime",TJ=25000,wJ=20000,$Z=1e4,vJ=5000,hJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),WJ=75000,zZ=2000,QZ=1e4,XZ=new Set(["vm_hands_no_register","vm_hands_register_failed"]),YZ=3,KZ=20000,GZ=250,FZ=2000;function HJ(J){let Z=Math.min(GZ*2**(J-1),FZ);return Math.round(Z/2+Math.random()*Z/2)}var WZ=5000;function NZ(J){return J>=500||J===408||J===429}var t=20000;function SJ(J,Z){return typeof J==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(J)?J:Z}class g extends Error{}var PZ=64;async function IJ(J,Z){let z=[...J.modelOps.get(Z)??[]];for(let Q of z)Q.abort.abort();await Promise.race([Promise.all(z.map((Q)=>Q.settled)),new Promise((Q)=>setTimeout(Q,vJ))])}async function UZ(J){let Z=[...J.personTerminals];for(let z of Z)z.abort.abort();if(Z.length)await Promise.race([Promise.all(Z.map((z)=>z.settled)),new Promise((z)=>setTimeout(z,vJ))]);return Z.length}async function p(J,Z,z){return await IJ(J,z),Z.unbind(z)}function e(J){for(let Z of J.outbox?.splice(0)??[])Z.reject(Error("vm_hands_attempt_ended"))}var kJ=15000,CZ=1e4,BZ=1000;async function wZ(J){let Z=Date.now(),z={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:0},Q=J.log??(()=>{}),L=async(D)=>{for(let[_,A]of[...z.turns]){z.turns.delete(_),J.onTurn?.(_,null),e(A);let q=await p(z,J.agent,_).catch(()=>null);if(q)z.receipts.push({turn:A,failure:"vm_hands_bind_lost",unbound:q});Q("vm_hands.bound_dropped",{reason:D})}},j=0,U=0;try{for(let D=0;!J.signal.aborted;D++){let _=await jZ(J,z).catch((q)=>{if(q instanceof W&&z.deviceId===null&&q.code==="vm_hands_no_session"&&Date.now()-Z<QZ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(q instanceof W&&z.deviceId===null&&XZ.has(q.code)&&j<YZ&&Date.now()-Z<KZ)return j++,U=HJ(j),Q("vm_hands.register_retry",{attempt:j,code:q.code,delay_ms:U}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(q instanceof W&&z.deviceId===null)throw q;return{closeCode:0,closeReason:q instanceof Error?q.message:String(q)}});if(Q("vm_hands.session_closed",{close_code:_.closeCode,reason:_.closeReason.slice(0,120),registered:z.deviceId!==null}),_.closeCode===4401||z.attest==="refused")return;if(J.signal.aborted)return;if(z.turns.size&&Date.now()-z.lostAt>=WJ)await L("reconnect_deadline");if(z.served)z.served=!1,D=0;let A=_.closeReason==="drain_reconnect"?0:_.closeReason==="vm_hands_register_retry"?U:_.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(D,5),2000):z.turns.size?Math.min(250*2**Math.min(D,5),5000,Math.max(0,z.lostAt+WJ-Date.now())):Math.min(500*2**D,30000);if(await new Promise((q)=>setTimeout(q,A)),z.turns.size&&Date.now()-z.lostAt>=WJ)await L("reconnect_deadline")}}finally{await L("session_ended")}}async function jZ(J,Z){let z=Z.deviceId,Q=J.log??(()=>{}),L=z?`/app/local-runtime/session?device_id=${encodeURIComponent(z)}`:JZ,j=`${J.apiOrigin.replace(/^http/,"ws")}${L}`,U=new WebSocket(j),D=0,_="",A=new Map,q=[],v=null,V=new Promise(($)=>{U.onclose=(K)=>{D=K.code,_=K.reason;for(let X of A.values())X.reject(new g(`session closed ${K.code}`));for(let X of Z.attestWaiters.splice(0))X(!1);A.clear(),$()}});U.onmessage=($)=>{let K;try{K=JSON.parse(String($.data))}catch{U.close(4400);return}if(K.t==="res"){let X=K;A.get(X.id)?.resolve({status:X.status,body:X.body}),A.delete(X.id);return}if(K.t==="reconnect"){let X=Math.max(0,Math.min(Number(K.after_ms)||0,BZ));Q("vm_hands.drain_reconnect",{after_ms:X}),setTimeout(()=>{try{U.close(4001,"drain_reconnect")}catch{}},X).unref?.();return}if(!v?.(K))q.push(K)};let l=($,K)=>new Promise((X,F)=>{let P=q.findIndex((B)=>$.includes(B.t));if(P>=0){X(q.splice(P,1)[0]);return}let C=setTimeout(()=>{v=null,F(new W("vm_hands_no_register",`no ${$.join("/")} in ${K} ms`))},K);v=(B)=>{if(!$.includes(B.t))return!1;return clearTimeout(C),v=null,X(B),!0}}),u=($)=>U.send(JSON.stringify($)),S=($,K)=>new Promise((X,F)=>{if(U.readyState!==WebSocket.OPEN){F(new g("session closed"));return}let P=eJ(),C=typeof K.wait_ms==="number"?K.wait_ms:0,B=setTimeout(()=>{if(!A.delete(P))return;F(new g(`no answer to ${$.split("/").pop()} in ${C+kJ} ms`)),U.close(4000,"request_timeout")},C+kJ);A.set(P,{reject:(Y)=>{clearTimeout(B),F(Y)},resolve:({status:Y,body:G})=>{clearTimeout(B);let N=null;try{N=G?JSON.parse(G):null}catch{}X({status:Y,json:N})}}),u({t:"req",id:P,path:`${ZZ}${$}`,body:JSON.stringify(K)})}),NJ=()=>U.close(1001,"stopping");J.signal.addEventListener("abort",NJ,{once:!0});let JJ,o=new Map,d=new Map,ZJ=!1,$J=new Set,zJ=new Set,QJ=Promise.resolve(),i=!1;try{await new Promise((Y,G)=>{let N=setTimeout(()=>G(Error("session open timeout")),CZ);U.onopen=()=>{clearTimeout(N),Q("vm_hands.ws_open",{}),Y()},U.onerror=()=>{clearTimeout(N),G(Error("session socket error"))}});let $=await l(["challenge"],5000);Q("vm_hands.challenge",{});let K=[],X=null,F;if(z){u(await J.agent.helloFrame($.challenge,Z.connection));let Y=await l(["ready"],1e4);if(typeof Y.vm_hands_connection==="string")Z.connection=Y.vm_hands_connection;if(F={device_id:z,...Y.cadence?{cadence:Y.cadence}:{}},typeof Y.vm_hands_probe_script==="string"){if(X=Y.vm_hands_probe_script,i=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,Q("vm_hands.reconnected",{device_id:z});let G=Array.isArray(Y.vm_hands_binds)?Y.vm_hands_binds:Y.vm_hands_bind?[Y.vm_hands_bind]:[];for(let[N,M]of[...Z.turns]){if(G.some((T)=>T&&T.operation_id===M.claim.operation_id&&T.attempt_id===M.claim.attempt_id)){K.push(M),Q("vm_hands.bound_resumed",{operation_id:M.claim.operation_id});continue}Z.turns.delete(N),J.onTurn?.(N,null),e(M);let x=await p(Z,J.agent,N).catch(()=>null);if(x)Z.receipts.push({turn:M,failure:"vm_hands_bind_lost",unbound:x});Q("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{u(await J.agent.registerFrame($.challenge)),Q("vm_hands.register_sent",{});let Y=await Promise.race([l(["registered","register_refused"],1e4),V.then(()=>{throw new W(_==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(Y.t==="register_refused")throw new W(Y.code,"register refused");J.agent.registered();let G=Y;if(F=G,Z.deviceId=G.device_id,typeof G.vm_hands_connection==="string")Z.connection=G.vm_hands_connection;if(typeof G.vm_hands_probe_script==="string"){if(X=G.vm_hands_probe_script,i=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,Q("vm_hands.registered",{device_id:F.device_id})}let P=async()=>{let Y=await S("/heartbeat",await J.heartbeat());if(Y.status>=300)throw Error(`heartbeat ${Y.status}`)};await P();let C=F.cadence?.presence_interval_ms??30000;if(JJ=setInterval(()=>{P().catch(()=>U.close())},C),X&&Z.attest!=="accepted"&&J.agent.phase==="registered"&&!Z.turns.size)RJ(X,$.challenge);let B=(Y,G)=>{d.set(Y,G().catch(async(N)=>{if(await PJ(N,Y),N instanceof g)U.close();else await XJ().catch(()=>{return})}).finally(()=>{d.delete(Y)}))};try{await XJ();for(let Y of K)Y.flush=()=>UJ(Y),Y.flush(),B(Y.claim.attempt_id,()=>CJ(Y));while(!J.signal.aborted&&U.readyState===WebSocket.OPEN){let Y=await S("/operations/claim",{wait_ms:Math.min(F.cadence?.claim_wait_ms??TJ,TJ)});if(Y.status===204||!Y.json)continue;if(Y.status>=300)throw Error(`claim ${Y.status}`);let G=Y.json;if(G.capability==="hands.connect"){if(d.has(G.attempt_id)){h({claim:G,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}B(G.attempt_id,()=>fJ(G))}else bJ(G).catch(()=>{return})}}catch(Y){await PJ(Y,null)}}finally{if(JJ)clearInterval(JJ);J.signal.removeEventListener("abort",NJ);for(let $ of Z.turns.values())$.flush=null;U.close(),await V,await Promise.all([...d.values()]);for(let $ of J.agent.liveBindIds){if(Z.turns.has($))continue;let K=await p(Z,J.agent,$).catch(()=>null),X=o.get($);if(K&&X)Z.receipts.push({turn:{...X,eventSeq:X.eventSeq+1},failure:"vm_hands_bind_lost",unbound:K});Q("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let $ of $J)$.abort()}return{closeCode:D,closeReason:_};async function PJ($,K){if($ instanceof g){if(!ZJ&&Z.turns.size)Z.lostAt=Date.now();ZJ=!0}else{let X=K!==null?[K]:[...new Set([...Z.turns.keys(),...J.agent.liveBindIds])];if(K===null)ZJ=!0;for(let F of X){let P=Z.turns.get(F);if(Z.turns.delete(F),P)e(P),J.onTurn?.(F,null);if(J.agent.liveBindIds.includes(F)){let C=await p(Z,J.agent,F).catch(()=>null),B=o.get(F)??P;if(C&&B)Z.receipts.push({turn:{...B,eventSeq:B.eventSeq+1},failure:"vm_hands_bind_lost",unbound:C})}}}Q("vm_hands.session_lost",{error:$ instanceof Error?$.message:String($),bound_kept:Z.turns.size})}function h($){let K=$.claim,X={attempt_id:K.attempt_id,attempt_token:K.attempt_token},F=encodeURIComponent(K.operation_id);return{fence:X,op:F,complete:(C,B={})=>S(`/operations/${F}/complete`,{...X,status:C,...B}),emit:(C,B)=>{let Y=($.chain??Promise.resolve()).catch(()=>{return}).then(()=>P(C,B));return $.chain=Y,Y}};async function P(C,B){let Y=$.eventSeq,G=(T)=>S(`/operations/${F}/events`,{...X,event_seq_start:T,events:[{kind:C,payload:{sequence:T,capability:String(K.capability??"hands.connect"),data:B}}]}),N=Y,M=await G(N),x=M.status===409?M.json?.expected_event_seq:void 0;if(typeof x==="number"&&x===Y+1)M={status:200,json:{duplicate:!0}};else if(typeof x==="number"&&x>=0&&x!==Y)N=x,M=await G(N);if(M.status<300)$.eventSeq=N+1;return M}}function yJ($){return(K,X)=>new Promise((F,P)=>{if(Z.turns.get($.claim.attempt_id)!==$){P(Error("vm_hands_attempt_ended"));return}if($.outbox??=[],$.outbox.length>=PZ){P(Error("vm_hands_outbox_full"));return}$.outbox.push({kind:K,data:X,resolve:F,reject:P}),$.flush?.()})}function UJ($){if(zJ.has($))return;zJ.add($),(async()=>{try{while($.outbox?.length&&Z.turns.get($.claim.attempt_id)===$&&U.readyState===WebSocket.OPEN){let K=$.outbox[0],X;try{X=await h($).emit(K.kind,K.data)}catch(F){if(F instanceof g)return;X={status:500}}if($.outbox.shift(),X.status<300)K.resolve();else K.reject(Error(`${K.kind} refused ${X.status}`))}}finally{zJ.delete($)}})()}async function RJ($,K){try{let X=await J.agent.attestFrame($,K);if(U.readyState!==WebSocket.OPEN)return;u(X);let F=await l(["attested","attest_refused"],15000);Z.attest=F.t==="attested"?"accepted":"refused";for(let P of Z.attestWaiters.splice(0))P(Z.attest==="accepted");if(Q("vm_hands.attest",{result:Z.attest,exit_code:X.exit_code,...F.t==="attest_refused"?{code:String(F.code??"")}:{}}),Z.attest==="refused")U.close(4401,"attest_refused")}catch(X){Q("vm_hands.attest_failed",{code:X instanceof W?X.code:"probe_error"});for(let F of Z.attestWaiters.splice(0))F(!1);if(Z.attest!=="accepted")U.close(4000,"attest_unanswered")}}async function fJ($){let K=i&&Z.attest==="pending",X=$.vm_hands_attest,F=X;if(Z.attest==="refused"){Q("vm_hands.claim_attest_refused",{said:typeof X==="string"?X.slice(0,16):typeof X,local:Z.attest}),await h({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(F==="accepted"){if(!K&&Z.attest!=="accepted"){Z.attest="accepted";for(let E of Z.attestWaiters.splice(0))E(!0)}}else if(F!=="pending"||!K&&Z.attest!=="accepted"){Q("vm_hands.claim_attest_refused",{said:typeof X==="string"?X.slice(0,16):typeof X,local:Z.attest}),await h({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Z.attest!=="accepted"){let E=Date.parse($.lease_until)-Date.now()-5000,k=Math.max(0,Math.min(t,Number.isFinite(E)?E:t));if(!await new Promise((s)=>{let lJ=setTimeout(()=>s(!1),k);Z.attestWaiters.push((uJ)=>{clearTimeout(lJ),s(uJ)})})){await h({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let P={claim:$,eventSeq:0},{complete:C,emit:B}=h(P),Y;try{if($.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not hands.connect");Y=!FJ($)}catch(E){Q("vm_hands.bind_refused",{code:E instanceof W?E.code:"unexpected"}),await C("failed",{error_code:E instanceof W?E.code:"vm_hands_bind_invalid"});return}let G,N=null,M=!1;Z.bindsStarting++;try{let E=await UZ(Z);if(E)Q("vm_hands.person_terminals_closed",{count:E});let k=AJ($),r=J.agent.bind(k);if(k.workspace_deferred)M=!0,N=mJ(P,()=>M);G=await r}catch(E){Q("vm_hands.bind_refused",{code:E instanceof W?E.code:"unexpected"}),await C("failed",{error_code:E instanceof W?E.code:"vm_hands_bind_failed"});return}finally{M=!1,Z.bindsStarting--}let x=N?await N:-1,T={...G.ready_data??J.readyData({launchId:G.launch_id,claim:$})};if(Y)delete T.environment_installed;let YJ=!Y&&G.snapshot_revision!==null&&G.snapshot_id!==null?{environment_installed:{snapshot_id:G.snapshot_id,installed_revision:G.snapshot_revision}}:{};o.set($.attempt_id,{claim:$,launchId:G.launch_id,readyData:T,eventSeq:P.eventSeq,ackSeq:-1});let H={...T,...YJ,vm_hands:{layout:G.layout,policy_digest:G.policy_digest,launch_id:G.launch_id}},f=Date.now()+WZ,I=1,O=await B("hands.ready",H);while(NZ(O.status)&&!J.signal.aborted){let E=HJ(I);if(Date.now()+E>=f)break;await new Promise((k)=>setTimeout(k,E)),I++,O=await B("hands.ready",H)}if(I>1)Q("vm_hands.ready_retried",{attempts:I,status_class:`${Math.floor(O.status/100)}xx`});if(o.delete($.attempt_id),O.status>=300){await IJ(Z,$.attempt_id),await J.agent.boundRefused($.attempt_id),await C("failed",{error_code:SJ(O.json?.error,"vm_hands_probe_failed")});return}let w={claim:$,launchId:G.launch_id,readyData:T,eventSeq:P.eventSeq,ackSeq:x};Z.turns.set($.attempt_id,w),w.flush=()=>UJ(w),J.onTurn?.($.attempt_id,yJ(w)),await CJ(w)}async function mJ($,K){let{fence:X,op:F}=h($),P=$.claim.attempt_id,C=-1;try{for(;;){let B=await S(`/operations/${F}/heartbeat`,{...X,control_ack_seq:C,wait_ms:wJ});if(!K())return C;if(B.status>=300)return J.agent.abandonWorkspaceGrant(P),C;let Y=(B.json?.controls??[]).slice().sort((G,N)=>G.seq-N.seq);for(let G of Y){if(G.seq<=C)continue;if(C=G.seq,G.kind===VJ)return Q("vm_hands.workspace_granted",{}),J.agent.grantWorkspace(P),C;return Q("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(G.kind)?G.kind:"other"}),J.agent.abandonWorkspaceGrant(P),C}}}catch{return J.agent.abandonWorkspaceGrant(P),C}}async function CJ($){let{fence:K,op:X}=h($),F=null,P=null,C=J.agent.executorExited($.claim.attempt_id).then((B)=>{return P=B,null});J:for(;;){let B=await Promise.race([C,S(`/operations/${X}/heartbeat`,{...K,control_ack_seq:$.ackSeq,wait_ms:wJ})]);if(!B){F="vm_hands_executor_exited",Q("vm_hands.executor_exited",{reason:P});break}if(B.status>=300)break;let Y=(B.json?.controls??[]).slice().sort((G,N)=>G.seq-N.seq);for(let G of Y){if(G.seq<=$.ackSeq)continue;if(G.kind==="operation.cancel"||G.kind==="cancel"){$.ackSeq=G.seq;break J}if(G.kind===gJ)try{await pJ($,G.payload??{})}catch(N){if(N instanceof g)throw N;F=N instanceof W?N.code:"environment_unavailable";let M=N&&typeof N==="object"&&"code"in N&&typeof N.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(N.code)?N.code:null;Q("vm_hands.environment_refused",{code:F,cause:M});break J}$.ackSeq=G.seq}}await cJ($,F)}async function bJ($){let K=$,X={claim:K,eventSeq:0},{complete:F,emit:P,fence:C,op:B}={...h(X)},Y=$.vm_hands_origin==="person"?"person":"model",G=String($.capability??"");if(!J.executeOp){await F("failed",{error_code:"vm_hands_op_unsupported"});return}if($.vm_hands_attest==="accepted"&&Z.attest==="pending"&&!(i&&Z.attest==="pending")){Z.attest="accepted";for(let O of Z.attestWaiters.splice(0))O(!0)}if(Z.attest!=="accepted"){let O=Date.parse(String($.lease_until??""))-Date.now()-5000,w=Z.attest==="refused"?0:Math.max(0,Math.min(t,Number.isFinite(O)?O:t));if(!(w>0&&await new Promise((k)=>{let r=setTimeout(()=>k(!1),w);Z.attestWaiters.push((s)=>{clearTimeout(r),k(s)})}))){await F("failed",{error_code:"vm_hands_unattested"});return}}let N=J.agent.bindIdForRun(K.run_id);if(Y==="model"&&N===null){await F("failed",{error_code:"vm_hands_not_bound"});return}let M=G==="pty.start"&&Y==="person"&&!$.authority;if(M&&(J.agent.liveBindIds.length>0||Z.bindsStarting>0)){await F("failed",{error_code:"vm_hands_bound"});return}if(hJ.has(G)&&!M&&J.agent.liveBindIds.length===0){await F("failed",{error_code:"vm_hands_not_bound"});return}if(Y==="model"&&N||hJ.has(G)&&!M)J.agent.opServed();let x=new AbortController;$J.add(x);let T,YJ=new Promise((O)=>{T=O}),H={abort:x,settled:YJ};if(M)Z.personTerminals.add(H);if(Y==="model"&&N){let O=Z.modelOps.get(N)??new Set;O.add(H),Z.modelOps.set(N,O),await J.agent.environmentInstalled(N,zZ,x.signal)}let f=-1,I=setInterval(()=>{S(`/operations/${B}/heartbeat`,{...C,control_ack_seq:f,wait_ms:0}).then((O)=>{if(O.status>=300){x.abort();return}let w=O.json?.controls??[];for(let E of w)if(f=Math.max(f,E.seq),E.kind==="operation.cancel"||E.kind==="cancel")x.abort()},()=>x.abort())},$Z);try{let O=await J.executeOp({kind:Y,claim:$,...Y==="model"&&N?{bindId:N}:{},signal:x.signal,emit:async(E)=>{await P(E.kind,E.data??{})}}),w=await F(O.status,{...O.result?{result:O.result}:{},...O.error_code?{error_code:SJ(O.error_code,"vm_hands_op_failed")}:{}});Q("vm_hands.op",{capability:G,kind:Y,status:O.status,code:O.error_code??null,...w.status>=300?{complete_status:w.status,complete_error:String(w.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval(I),$J.delete(x),N)Z.modelOps.get(N)?.delete(H);Z.personTerminals.delete(H),T()}}async function cJ($,K){let X=$.claim.attempt_id;if(Z.turns.get(X)===$)Z.turns.delete(X);J.onTurn?.(X,null),e($);let F=await p(Z,J.agent,X);Z.receipts.push({turn:$,failure:K,unbound:F}),await XJ()}function XJ(){return QJ=QJ.then(BJ,BJ),QJ}async function BJ(){while(Z.receipts.length){let{turn:$,failure:K,unbound:X}=Z.receipts[0],{complete:F,emit:P}=h($);try{if(await P("hands.stopped",{...$.readyData,reason_code:K?"failed":"cancelled",killed_verified:X.killed_verified,shredded:X.shredded,...X.srt_fallbacks?{vm_hands_srt_fallbacks:X.srt_fallbacks}:{}}),K)await F("failed",{error_code:K});else await F("cancelled",{error_code:"driver_stopped"})}catch(C){if(C instanceof g)return}Z.receipts.shift()}}async function pJ($,K){let{fence:X,op:F}=h($),P=K.snapshot_id;if(K.version!==1||typeof P!=="string"||Object.keys(K).length!==2)throw new W("vm_hands_env_invalid","invalid environment delivery");let C=await S(`/operations/${F}/environment`,{...X,snapshot_id:P}),B=C.json?.environment_sealed;if(C.status!==200||!B||C.json?.payload!==void 0)throw new W("vm_hands_env_invalid","environment not delivered sealed");let Y=await J.agent.deliverEnvironment({attemptId:$.claim.attempt_id,snapshotId:P,deviceId:Z.deviceId??"",sealed:B});if((await S(`/operations/${F}/environment-ack`,{...X,...Y})).status>=300)throw new W("vm_hands_env_ack_refused","environment ack refused")}}
|
|
5
|
+
export{DZ as xa,nJ as ya,wZ as za};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Gi as F}from"./vm-hands-entry-lite-4m40gwkf.js";import{Ji as T,Mi as d,Oi as p,Si as n,Ti as a}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Gi as F}from"./vm-hands-entry-lite-4m40gwkf.js";import{Ji as T,Mi as d,Oi as p,Si as n,Ti as a}from"./vm-hands-entry-lite-b2zq6301.js";import{Yi as j,_i as v}from"./vm-hands-entry-lite-c01eyep6.js";import{wj as l}from"./vm-hands-entry-lite-q2f5d2e9.js";import{Pj as m,Qj as h}from"./vm-hands-entry-lite-7shpbsw8.js";import{hk as y}from"./vm-hands-entry-lite-g036gtem.js";import{spawnSync as Eq}from"child_process";import{dirname as I}from"path";import{spawn as r}from"child_process";import{accessSync as e,constants as qq}from"fs";import{basename as zq,join as Jq}from"path";var V=null;function O(q){if(V===q)V=null;if(q.exitCode===null&&q.signalCode===null)q.kill("SIGTERM")}var _=(q,z)=>{if(V)O(V);let Q=Jq(q,T);try{e(Q,qq.X_OK)}catch{return()=>{}}let J;try{J=r(Q,["--app",q,"--name",zq(q,".app"),"--permission",z==="screen"?"screen_recording":"accessibility"],{detached:!0,stdio:"ignore"})}catch{return()=>{}}return J.on("error",()=>{if(V===J)V=null}),J.once("exit",()=>{if(V===J)V=null}),J.unref(),V=J,()=>O(J)};import{chmodSync as Qq,existsSync as x,mkdirSync as Xq,readFileSync as Zq,realpathSync as k,renameSync as $q,statSync as G,writeFileSync as Kq}from"fs";import{dirname as P,isAbsolute as Rq,join as Vq,resolve as S,sep as W}from"path";function U(q=j()){return Vq(v(q),"reason","protected-path-grants.json")}var B=null;function Yq(q){let z=JSON.parse(q);if(!Array.isArray(z?.grants))return[];return z.grants.flatMap((Q)=>{let J=Q;return J&&typeof J.path==="string"&&Rq(J.path)&&(J.kind==="file"||J.kind==="folder")&&typeof J.grantedAt==="number"?[{path:J.path,kind:J.kind,grantedAt:J.grantedAt}]:[]})}function D(q=U()){try{let{mtimeMs:z}=G(q);if(B&&B.file===q&&B.mtimeMs===z)return B.grants;let Q=Yq(Zq(q,"utf8"));return B={file:q,mtimeMs:z,grants:Q},Q}catch{return[]}}function Bq(q,z){return q.kind==="file"?z===q.path:z===q.path||z.startsWith(`${q.path}${W}`)}function Dq(q,z){let Q=S(q);return D(z).some((J)=>Bq(J,Q))}function Sq(q,z){return F(q)&&!Dq(q,z)}function w(q,z){Xq(P(z),{recursive:!0,mode:448});let Q=`${z}.${process.pid}.tmp`;Kq(Q,`${JSON.stringify({version:1,grants:q},null,2)}
|
|
3
3
|
`,{mode:384}),Qq(Q,384),$q(Q,z),B=null}function b(q,z=U(),Q=Date.now()){if(!x(q))throw Error(`No file or folder at ${q}.`);let J=k(q),X=P(z);if(X===J||X.startsWith(`${J}${W}`)||J.startsWith(`${X}${W}`))throw Error("Reason's own configuration folder cannot be allowed.");let Z={path:J,kind:G(J).isDirectory()?"folder":"file",grantedAt:Q},$=D(z).filter((R)=>R.path!==J);return w([...$,Z],z),Z}function u(q,z=U()){let Q=x(q)?k(q):S(q),J=D(z),X=J.filter((Z)=>Z.path!==Q);if(X.length===J.length)return!1;return w(X,z),!0}function wq(q,z,Q){let J=z?"file-read* file-write*":"file-read*";return D(Q).filter((X)=>X.path===q||X.path.startsWith(`${q}${W}`)).map((X)=>`(allow ${J} (${X.kind==="file"?"literal":"subpath"} ${JSON.stringify(X.path)}))`)}var f=`Reason permissions
|
|
4
4
|
|
|
5
5
|
Usage:
|
|
@@ -20,7 +20,7 @@ this Mac may open. Only you can change this list; Sessions cannot.
|
|
|
20
20
|
allow asks for each missing one, or the one named. macOS cannot ask for Full
|
|
21
21
|
Disk Access: allow disk opens its pane, shows the file to add in Finder and
|
|
22
22
|
waits until the worker has it.
|
|
23
|
-
`,M="x-apple.systempreferences:com.apple.preference.security",Nq="curl -fsSL https://reasonmachines.com/install.sh | bash",Hq=180000,Wq=2000,A=["screen","accessibility","disk"],L={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${M}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${M}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${M}?Privacy_AllFiles`}};function s(q){return q.executable}function jq(q,z){if(q==="computer_use_identity_missing")return`Reason's background identity is not installed (${q}); reinstall Reason: ${Nq}`;if(q==="computer_use_identity_outdated")return`Reason's background identity is outdated (${p(z)??"unknown"}; this CLI is ${l}) (${q}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${q}); run the installed \`reason\``}function Cq(q=j()){let z=n(q);if(z.length>0)return{state:"ready",path:I(I(I(z[0]))),prefix:z};let Q=a(z,q)??"computer_use_identity_unavailable";return{state:Q,path:d(q),detail:jq(Q,q)}}function o(){return{identity:()=>Cq(),grants:(q)=>m(q),request:(q,z)=>h(q,z),worker:async()=>(await import("./status-
|
|
23
|
+
`,M="x-apple.systempreferences:com.apple.preference.security",Nq="curl -fsSL https://reasonmachines.com/install.sh | bash",Hq=180000,Wq=2000,A=["screen","accessibility","disk"],L={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${M}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${M}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${M}?Privacy_AllFiles`}};function s(q){return q.executable}function jq(q,z){if(q==="computer_use_identity_missing")return`Reason's background identity is not installed (${q}); reinstall Reason: ${Nq}`;if(q==="computer_use_identity_outdated")return`Reason's background identity is outdated (${p(z)??"unknown"}; this CLI is ${l}) (${q}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${q}); run the installed \`reason\``}function Cq(q=j()){let z=n(q);if(z.length>0)return{state:"ready",path:I(I(I(z[0]))),prefix:z};let Q=a(z,q)??"computer_use_identity_unavailable";return{state:Q,path:d(q),detail:jq(Q,q)}}function o(){return{identity:()=>Cq(),grants:(q)=>m(q),request:(q,z)=>h(q,z),worker:async()=>(await import("./status-45mxz20c.js")).connectionMacState(),open:(q)=>{Eq("/usr/bin/open",q,{stdio:"ignore",timeout:1e4})},tile:_,restartConnection:async()=>(await import("./connect-cli-acmq5f14.js")).restartConnection(),sleep:(q)=>new Promise((z)=>setTimeout(z,q)),now:()=>Date.now()}}function c(q,z,Q){if(q.state!=="ready"||!z)return"unknown";return z[Q]?"granted":"missing"}async function i(q){let z=q.identity(),Q=z.state==="ready"?await q.grants(z.prefix):null,J=await q.worker(),X=J?s(J):null,Z=!X||J?.full_disk_access==="unknown"?"unknown":J?.full_disk_access==="granted"?"granted":"missing",$=(R,Y,K)=>{let{label:E,purpose:H,level:N}=L[R];return{id:R,label:E,purpose:H,level:N,state:Y,holder:K}};return{identity:{state:z.state,path:z.path,detail:z.state==="ready"?null:z.detail},worker_detail:X?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[$("screen",c(z,Q,"screen"),z.path),$("accessibility",c(z,Q,"accessibility"),z.path),$("disk",Z,X)]}}function dq(q){let z=q.identity.state==="ready"?null:q.identity.state,Q=q.permissions.filter((Z)=>Z.state==="granted").length,J=[...z?[z]:[],...q.permissions.filter((Z)=>Z.state!=="granted"&&!(z&&Z.id!=="disk")).map((Z)=>`${Z.label} ${Z.state}`)],X=!z&&q.permissions.some((Z)=>Z.state==="missing");return`Permissions: ${Q} of ${q.permissions.length}${J.length>0?` (${J.join(", ")})`:""}`+(X?" \u2014 reason permissions allow":J.length>0?" \u2014 reason permissions":"")}function Uq(q){let z=[];if(q.identity.detail)z.push(q.identity.detail);z.push(`Reason: ${q.identity.path}`);let Q=q.permissions.find((J)=>J.id==="disk");z.push(Q?.holder?`Worker: ${Q.holder}`:`Worker: ${q.worker_detail}`),z.push("");for(let J of q.permissions){let X=`${J.label}${J.level==="recommended"?" (recommended)":""}`;z.push(` ${J.id.padEnd(13)} ${J.state.padEnd(7)} ${X}: ${J.purpose}`)}if(q.permissions.some((J)=>J.state==="missing"))z.push("","Allow the missing ones: reason permissions allow");return`${z.join(`
|
|
24
24
|
`)}
|
|
25
25
|
`}async function g(q,z){let Q=z.now()+Hq;for(;;){if(await q())return!0;if(z.now()>=Q)return!1;await z.sleep(Wq)}}async function Iq(q,z){let Q=z.host??o(),{io:J}=z,X=await i(Q),Z=X.permissions.filter((K)=>q.includes(K.id)&&K.state!=="granted");if(Z.length===0)return J.stdout.write(`Reason permissions: ${q.map((K)=>L[K].label).join(", ")} already allowed.
|
|
26
26
|
`),0;let $=!1,R=!1,Y=Q.identity();for(let K of Z){let{label:E,pane:H}=L[K.id];if(K.id!=="disk"){if(Y.state!=="ready"){if(!$)J.stderr.write(`Reason permissions: ${Y.detail}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Uc as dq,Vc as cq}from"./vm-hands-entry-lite-hh24bq0d.js";import{Gh as zq,Hh as fq,Lh as Rq,Mh as Uq,Nh as X,Qh as mq,Sh as Fq,Th as vq,Vh as h,Wh as P,Xh as Mq}from"./vm-hands-entry-lite-kxdw4myj.js";import{ni as _q}from"./vm-hands-entry-lite-r6pap1kh.js";import{Ii as hq,Ki as lq,Ni as oq,Oi as sq,Pi as uq,Qi as Nq}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Uc as dq,Vc as cq}from"./vm-hands-entry-lite-hh24bq0d.js";import{Gh as zq,Hh as fq,Lh as Rq,Mh as Uq,Nh as X,Qh as mq,Sh as Fq,Th as vq,Vh as h,Wh as P,Xh as Mq}from"./vm-hands-entry-lite-kxdw4myj.js";import{ni as _q}from"./vm-hands-entry-lite-r6pap1kh.js";import{Ii as hq,Ki as lq,Ni as oq,Oi as sq,Pi as uq,Qi as Nq}from"./vm-hands-entry-lite-b2zq6301.js";import{Yi as c}from"./vm-hands-entry-lite-c01eyep6.js";import{randomUUID as O}from"crypto";import{chmodSync as qq,closeSync as m,constants as v,existsSync as B,fstatSync as pq,lstatSync as T,mkdirSync as r,openSync as rq,readFileSync as g,readdirSync as Iq,readlinkSync as E,realpathSync as C,renameSync as k,rmSync as d,statSync as x,symlinkSync as Gq,unlinkSync as D,writeFileSync as l}from"fs";import{basename as p,dirname as I,isAbsolute as jG,join as K,relative as HG,resolve as A,sep as nq}from"path";import{spawnSync as Tq}from"child_process";import{createRequire as zG}from"module";var Wq=1,iq=1,aq=128,FG=65536,MG="https://reasonmachines.com/api/runtime-manifest-v2",NG=30000,IG=600000,kq=1e4,TG=60000,AG=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var xq=/^[a-z0-9_.-]{1,80}$/,BG=64,DG="so.ara.device-broker",Vq=["com.apple.security.cs.allow-jit","com.apple.security.cs.allow-unsigned-executable-memory"],OG=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function e(q){if(q?.aborted)throw new X("update_cancelled","Managed runtime update request was cancelled.")}function Aq(q){return Boolean(q)&&typeof q==="object"&&!Array.isArray(q)}function Bq(q,G,J=[]){let Q=new Set([...G,...J]);return G.every((R)=>(R in q))&&Object.keys(q).every((R)=>Q.has(R))}function N(q){return typeof q==="string"&&AG.test(q)}function eq(q){return typeof q==="string"&&!Number.isNaN(Date.parse(q))&&new Date(q).toISOString()===q}function EG(q){return Uq.includes(q)}function y(q){r(q,{recursive:!0,mode:448}),qq(q,448)}function tq(q,G){y(I(q));let J=`${q}.${process.pid}.${O()}.tmp`;try{l(J,G,{mode:384,flag:"wx"}),qq(J,384),k(J,q)}finally{if(B(J))D(J)}}function Dq(q={}){if((q.platform??process.platform)!=="darwin")throw new X("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let J=q.environment??process.env,Q=_q(J,"REASON_CLI_CHANNEL")==="staging",R=Q?_q(J,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,W=q.root!==void 0||Boolean(R&&jG(R))?null:K(q.home??c(),"Library","Application Support"),Z=q.root??(W?K(W,Q?"Reason Staging":"Reason","CLI"):R);return{executableName:"reason",root:Z,...W?{legacyRoot:K(W,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:K(Z,"versions"),current:K(Z,"current"),previous:K(Z,"previous"),brokerLock:K(Z,"broker.lock"),transitionLock:K(Z,"transition.lock"),lifecycleEvents:K(Z,"lifecycle-events")}}function CJ(q){let G=q.legacyRoot;if(!G)return null;return{root:G,versions:K(G,"versions"),current:K(G,"current"),previous:K(G,"previous"),brokerLock:K(G,"broker.lock"),transitionLock:K(G,"transition.lock"),lifecycleEvents:K(G,"lifecycle-events")}}function S(q,G){if(!N(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let J=K(q.versions,G,"ara");if(!q.executableName)return J;let Q=K(q.versions,G,q.executableName),R=(Z)=>{try{return T(Z),!0}catch(_){if(_.code==="ENOENT")return!1;throw _}},U=R(J),W=R(Q);if(U&&W)throw new X("installed_artifact_mismatch","Ambiguous managed runtime executable layout.");return U?J:Q}function n(q,G){if(!N(G))throw new X("invalid_version","Invalid managed Reason runtime version.");return Oq(S(q,G))}function Oq(q){return K(I(q),p(q)==="reason"?fq:zq)}function qG(q,G){if(!N(q)||!N(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let[J,Q]=q.split("-",2),[R,U]=G.split("-",2),W=J.split(".").map(Number),Z=R.split(".").map(Number);for(let H=0;H<3;H+=1){let j=W[H]-Z[H];if(j!==0)return j<0?-1:1}if(Q===void 0||U===void 0){if(Q===U)return 0;return Q===void 0?1:-1}let _=Q.split("."),$=U.split("."),Y=Math.max(_.length,$.length);for(let H=0;H<Y;H+=1){let j=_[H],z=$[H];if(j===void 0||z===void 0){if(j===z)return 0;return j===void 0?-1:1}if(j===z)continue;let F=/^\d+$/.test(j),w=/^\d+$/.test(z);if(F&&w)return Number(j)<Number(z)?-1:1;if(F!==w)return F?-1:1;return j<z?-1:1}return 0}function CG(q=process.arch){let G=`darwin-${q}`;if(!EG(G))throw new X("unsupported_architecture","The managed Reason runtime supports only Apple Silicon and Intel Macs.");return G}function Pq(q){return[...q.matchAll(/<key>\s*([^<]+?)\s*<\/key>/g)].map((G)=>G[1].trim())}function gq(q){let G=q.match(/^CodeDirectory .*$/gm)??[];return G.length>0&&G.every((J)=>{return(/ flags=0x[0-9a-f]+\(([^)]*)\)(?: |$)/.exec(J)?.[1]?.split(/[ ,]+/).filter(Boolean)??[]).includes("runtime")})}function SG(q){let G=`TeamIdentifier=${hq}`,J=`Identifier=${DG}`,Q=Pq(q.brokerEntitlements),R=Pq(q.credentialLibraryEntitlements);if(!q.brokerDetail.split(`
|
|
3
3
|
`).includes(G)||!q.brokerDetail.split(`
|
|
4
4
|
`).includes(J)||!gq(q.brokerDetail)||Q.length!==Vq.length||Vq.some((U)=>!new RegExp(`<key>\\s*${U.replaceAll(".","\\.")}\\s*</key>\\s*<true\\s*/>`).test(q.brokerEntitlements)))throw new X("invalid_code_signature","Managed runtime broker has an invalid Reason signature, identifier, or entitlement set.");if(!q.credentialLibraryDetail.split(`
|
|
5
5
|
`).includes(G)||!gq(q.credentialLibraryDetail)||R.length!==0)throw new X("invalid_code_signature","Managed runtime credential library has an invalid signature or entitlement.")}function b(q,G){let J=Tq("/usr/bin/codesign",q,{stdio:["ignore","pipe","pipe"]});if(J.status!==0)throw new X("invalid_code_signature",G);return[new TextDecoder().decode(J.stdout??new Uint8Array),new TextDecoder().decode(J.stderr??new Uint8Array)].join("")}var Eq=(q,G)=>{b(["--verify","--strict","--verbose=2",q],"Managed runtime broker code signature is invalid."),b(["--verify","--strict","--verbose=2",G],"Managed runtime credential library code signature is invalid."),SG({brokerDetail:b(["-d","--verbose=4",q],"Managed runtime broker signer could not be inspected."),brokerEntitlements:b(["-d","--entitlements",":-",q],"Managed runtime broker entitlements could not be inspected."),credentialLibraryDetail:b(["-d","--verbose=4",G],"Managed runtime credential library signer could not be inspected."),credentialLibraryEntitlements:b(["-d","--entitlements",":-",G],"Managed runtime credential library entitlements could not be inspected.")})};async function LG(q,G,J){let Q=q.headers.get("content-length");if(Q!==null){let Y=Number(Q);if(!Number.isSafeInteger(Y)||Y<0||Y>G)throw new X("response_too_large","Managed runtime response exceeded its size limit.")}if(!q.body){let Y=new Uint8Array(await q.arrayBuffer());if(Y.byteLength>G)throw new X("response_too_large","Managed runtime response exceeded its size limit.");return Y}let R=q.body.getReader(),U=[],W=0,Z=()=>{if(!J)return R.read();return new Promise((Y,H)=>{let j=()=>{J.removeEventListener("abort",j),R.cancel(J.reason).catch(()=>{}),H(J.reason??new DOMException("Aborted","AbortError"))};if(J.aborted){j();return}J.addEventListener("abort",j,{once:!0}),R.read().then((z)=>{J.removeEventListener("abort",j),Y(z)},(z)=>{J.removeEventListener("abort",j),H(z)})})};try{while(!0){let Y=await Z();if(Y.done)break;if(W+=Y.value.byteLength,W>G)throw await R.cancel(),new X("response_too_large","Managed runtime response exceeded its size limit.");U.push(Y.value)}}finally{try{R.releaseLock()}catch{}}let _=new Uint8Array(W),$=0;for(let Y of U)_.set(Y,$),$+=Y.byteLength;return _}async function u(q){let G;try{G=new URL(q.url)}catch{throw new X("invalid_update_url","Managed runtime update URL is invalid.")}if(G.protocol!=="https:"||G.username||G.password||G.hash)throw new X("invalid_update_url","Managed runtime update URL must use HTTPS.");let J=new AbortController,Q,R=()=>{Q??="caller",J.abort(q.signal?.reason)};if(q.signal?.aborted)R();else q.signal?.addEventListener("abort",R,{once:!0});let U=setTimeout(()=>{Q??="timeout",J.abort(Error("managed runtime fetch timed out"))},q.timeoutMs),W=(Z,_)=>{if(Z instanceof X)return Z;if(Q==="caller")return new X("update_cancelled","Managed runtime update request was cancelled.");if(Q==="timeout")return new X("update_fetch_timeout","Managed runtime update request timed out.");return new X("update_fetch_failed",_)};try{let Z;try{if(Z=await q.fetchImpl(G,{headers:{accept:q.accept},signal:J.signal}),J.signal.aborted)throw W(J.signal.reason,"Managed runtime update request was cancelled.")}catch(_){throw W(_,"Managed runtime update request failed.")}if(!Z.ok)throw new X("update_http_error","Managed runtime update request was rejected.");if(Z.url&&new URL(Z.url).protocol!=="https:")throw new X("insecure_redirect","Managed runtime update redirected to an insecure URL.");try{let _=await LG(Z,q.maximumBytes,J.signal);if(J.signal.aborted)throw W(J.signal.reason,"Managed runtime update response was cancelled.");return _}catch(_){throw W(_,"Managed runtime update response failed.")}}finally{clearTimeout(U),q.signal?.removeEventListener("abort",R)}}async function GG(q,G,J=kq,Q){let R=typeof J==="number"?J:kq,U=typeof J==="number"?Q:J;if(U?.aborted)return!1;let W=await dq([q,"--version"],{timeoutMs:R,...U?{signal:U}:{}});return W.exitCode===0&&W.stdout.trim().replace(/^v/,"")===G}async function wG(q){let G=!1,J=null,Q=null,R=(U)=>{try{M(q.paths,U,{now:q.now})}catch{}};try{let U=q.home??c();if(!uq(q.manifest.version,U))return{status:"current"};Q=sq(U);let W=await u({url:new URL(mq,q.manifest.artifacts[q.target].broker.url).toString(),maximumBytes:Rq,fetchImpl:async(j,z)=>{let F=await q.fetchImpl(j,z);return G=F.status===404,F},timeoutMs:q.timeoutMs,accept:"application/json",signal:q.signal}),{manifest:Z}=vq(new TextDecoder().decode(W),q.trustedKeys);if(Z.version!==q.manifest.version||Z.published_at!==q.manifest.published_at)throw new X("identity_manifest_mismatch","Background identity manifest names another release.");let _=Z.artifacts[q.target],$=await u({url:_.url,maximumBytes:_.size_bytes,fetchImpl:q.fetchImpl,timeoutMs:q.timeoutMs,accept:"application/octet-stream",signal:q.signal});P($,_),y(q.workDirectory),J=K(q.workDirectory,`.identity-${process.pid}-${O()}`),r(J,{mode:448});let Y=K(J,"identity.tgz");if(l(Y,$,{mode:384,flag:"wx"}),Tq("/usr/bin/tar",["-xzf",Y,"-C",J],{stdio:"ignore",timeout:60000}).status!==0)throw new X("identity_extract_failed","Background identity archive could not be extracted.");return Nq({sourceApp:K(J,"Reason.app"),home:U,releaseSigned:!0,...q.command?{command:q.command}:{}}),R({event:"identity.refresh_completed",runtime_version:q.manifest.version,...Q?{from_version:Q}:{},to_version:q.manifest.version}),{status:"installed"}}catch(U){if(G)return{status:"unpublished"};let W=U instanceof X||U instanceof lq?U.code:"identity_install_failed";return process.stderr.write(`Reason background identity: identity_update_failed (${W})
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{bk as M}from"./vm-hands-entry-lite-j2q1k9vb.js";import{hk as G}from"./vm-hands-entry-lite-g036gtem.js";import{readdirSync as D,readFileSync as I}from"fs";import{userInfo as A}from"os";var O="--vm-hands-op-runner-kind=person";function x(q){let Q=new Set([q]),K=[];try{K=D("/proc")}catch{}for(let z of K){if(!/^\d+$/.test(z))continue;try{let X=I(`/proc/${z}/stat`,"utf8");if(Number(X.slice(X.lastIndexOf(")")+2).split(" ")[3])===q)Q.add(Number(z))}catch{}}for(let z of Q)try{process.kill(z,"SIGKILL")}catch{}}var C=(q)=>{let Q=globalThis.Bun;if(!Q)throw new M("pty_unavailable","Reason terminals require the Bun runtime.");let K=Q.spawn({cmd:[q.shell,...q.args],cwd:q.cwd,env:{...q.environment,TERM:"xterm-256color"},terminal:{cols:q.cols,rows:q.rows,data:(J,Y)=>q.onData(Y)}}),z=K.terminal,X=()=>{x(K.pid);try{z?.close()}catch{}};if(!z)throw X(),new M("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(J)=>z.write(J),resize:(J,Y)=>z.resize(J,Y),kill:X,exited:K.exited.then((J)=>typeof J==="number"?J:null,()=>null)}};function L(){let q=(()=>{try{return A().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...q?{USER:q,LOGNAME:q}:{}}}async function P(){let[{executeLocalOperation:q,spawnCaptured:Q},{runLocalPtySession:K},{configureDesktopAccount:z},{configureWorkerSandbox:X}]=await Promise.all([import("./local-capabilities-
|
|
2
|
+
import{bk as M}from"./vm-hands-entry-lite-j2q1k9vb.js";import{hk as G}from"./vm-hands-entry-lite-g036gtem.js";import{readdirSync as D,readFileSync as I}from"fs";import{userInfo as A}from"os";var O="--vm-hands-op-runner-kind=person";function x(q){let Q=new Set([q]),K=[];try{K=D("/proc")}catch{}for(let z of K){if(!/^\d+$/.test(z))continue;try{let X=I(`/proc/${z}/stat`,"utf8");if(Number(X.slice(X.lastIndexOf(")")+2).split(" ")[3])===q)Q.add(Number(z))}catch{}}for(let z of Q)try{process.kill(z,"SIGKILL")}catch{}}var C=(q)=>{let Q=globalThis.Bun;if(!Q)throw new M("pty_unavailable","Reason terminals require the Bun runtime.");let K=Q.spawn({cmd:[q.shell,...q.args],cwd:q.cwd,env:{...q.environment,TERM:"xterm-256color"},terminal:{cols:q.cols,rows:q.rows,data:(J,Y)=>q.onData(Y)}}),z=K.terminal,X=()=>{x(K.pid);try{z?.close()}catch{}};if(!z)throw X(),new M("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(J)=>z.write(J),resize:(J,Y)=>z.resize(J,Y),kill:X,exited:K.exited.then((J)=>typeof J==="number"?J:null,()=>null)}};function L(){let q=(()=>{try{return A().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...q?{USER:q,LOGNAME:q}:{}}}async function P(){let[{executeLocalOperation:q,spawnCaptured:Q},{runLocalPtySession:K},{configureDesktopAccount:z},{configureWorkerSandbox:X}]=await Promise.all([import("./local-capabilities-60rw4wtj.js"),import("./local-pty-session-hs7rq03x.js"),import("./desktop-account-5zvgspyw.js"),import("./worker-sandbox-wpzkvwer.js")]);X();let T=process.argv.includes(O),J=($,j,F)=>Q($,j[0]==="-lic"?["-lc",...j.slice(1)]:j,F),Y=(process.geteuid?.()??0)!==0,H=new Map,Z=($)=>{try{process.send?.($)}catch{}};process.on("message",($)=>{let j=$;if(j?.t==="cancel"){H.get(j.id)?.abort();return}if(j?.t!=="op")return;if(!Y){Z({t:"done",id:j.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let F=j.claim.capability;if(F==="pty.start"&&!T){Z({t:"done",id:j.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}let U=new AbortController;H.set(j.id,U);let V=F==="pty.start"?{runPtySession:(B)=>K(B,{spawnPty:C,environment:L(),loadProxy:()=>null})}:{worker:j.worker,...F==="exec.full"?{spawnFullControl:J}:{}};q(j.state,j.claim,{...V,signal:U.signal,emit:(B)=>{let{deliverySignal:N,...W}=B;Z({t:"event",id:j.id,event:W})}}).then((B)=>Z({t:"done",id:j.id,completion:B}),(B)=>Z({t:"done",id:j.id,completion:{status:"failed",error_code:B&&typeof B==="object"&&"code"in B&&typeof B.code==="string"?B.code:"vm_hands_op_failed"}})).finally(()=>H.delete(j.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}
|
|
3
3
|
export{O as s,C as t,P as u};
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Aj as $}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Aj as $}from"./vm-hands-entry-lite-12xrjfxt.js";var O=$.version,Z=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function S(B,D){if(!Z.test(B)||!Z.test(D))throw Error("cannot compare invalid CLI versions");let J=(q)=>{let y=q.indexOf("-");return y===-1?[q,void 0]:[q.slice(0,y),q.slice(y+1)]},[j,F]=J(B),[w,G]=J(D),K=j.split(".").map(BigInt),M=w.split(".").map(BigInt);for(let q=0;q<3;q+=1){if(K[q]===M[q])continue;return K[q]<M[q]?-1:1}if(F===void 0||G===void 0){if(F===G)return 0;return F===void 0?1:-1}let Q=F.split("."),U=G.split("."),A=Math.max(Q.length,U.length);for(let q=0;q<A;q+=1){let y=Q[q],z=U[q];if(y===void 0||z===void 0){if(y===z)return 0;return y===void 0?-1:1}if(y===z)continue;let H=/^\d+$/.test(y),W=/^\d+$/.test(z);if(H&&W){let X=BigInt(y),Y=BigInt(z);if(X===Y)continue;return X<Y?-1:1}if(H!==W)return H?-1:1;return y<z?-1:1}return 0}function k(B,D){return D?`cli ${B} \xB7 agent ${D}`:`cli ${B}`}
|
|
3
3
|
export{O as wj,Z as xj,S as yj,k as zj};
|