@reason-machines/cli-linux-arm64-musl 0.2.372 → 0.2.374
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/ara +1 -1
- package/bin/vm-hands/{ask-relay-ymd2qzgp.js → ask-relay-qnc0pbfm.js} +3 -3
- package/bin/vm-hands/{connect-cli-qc3wtvs2.js → connect-cli-acmq5f14.js} +1 -1
- package/bin/vm-hands/{local-automation-a6jqeh24.js → local-automation-bpn0exj8.js} +1 -1
- package/bin/vm-hands/{local-capabilities-mhszxbtw.js → local-capabilities-60rw4wtj.js} +1 -1
- package/bin/vm-hands/{local-display-session-n39tx1qm.js → local-display-session-9dn9tjav.js} +1 -1
- package/bin/vm-hands/{managed-runtime-jqx6n9c8.js → managed-runtime-v8x8gyh7.js} +1 -1
- package/bin/vm-hands/{permissions-yg7dazpa.js → permissions-e74rdrsv.js} +1 -1
- package/bin/vm-hands/{serve-service-65kzxsrc.js → serve-service-2zpqk67b.js} +1 -1
- package/bin/vm-hands/{status-3wwz3xqm.js → status-45mxz20c.js} +2 -2
- package/bin/vm-hands/{version-bsyrze8b.js → version-443dzn59.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-mrms7y4e.js → vm-hands-entry-lite-12xrjfxt.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-vppy988d.js → vm-hands-entry-lite-1sewc078.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-3wgag7rz.js → vm-hands-entry-lite-9bap9r1t.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-y3jxbhxs.js → vm-hands-entry-lite-b2zq6301.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-nb5kxm2n.js → vm-hands-entry-lite-h4r22jaw.js} +77 -77
- package/bin/vm-hands/vm-hands-entry-lite-ja2sqpq1.js +5 -0
- package/bin/vm-hands/{vm-hands-entry-lite-576m681k.js → vm-hands-entry-lite-m3wmcx9g.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-maqkw6pg.js → vm-hands-entry-lite-mdjsd983.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-4kfy4zcs.js → vm-hands-entry-lite-nxz3p54x.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-xdm9jkgq.js → vm-hands-entry-lite-q2f5d2e9.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-rtf4sqh0.js +540 -0
- package/bin/vm-hands/{vm-hands-entry-lite-70xn5vnc.js → vm-hands-entry-lite-sf5svyrg.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-2jbj99sk.js → vm-hands-entry-lite-vn9hp96c.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
- package/bin/vm-hands/{vm-hands-executor-y16fdqnj.js → vm-hands-executor-3s16z4ma.js} +1 -1
- package/bin/vm-hands/{vm-hands-op-runner-sb4fa85z.js → vm-hands-op-runner-9kc2qjg0.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-vq9kf92k.js → vm-hands-runtime-afsge57y.js} +3 -3
- package/package.json +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-khjrcwrj.js +0 -5
- package/bin/vm-hands/vm-hands-entry-lite-z964akpr.js +0 -540
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ac as kQ,Bc as fQ,Cc as z4,Dc as K4,Ec as H8}from"./vm-hands-entry-lite-sb9a1jcn.js";import{Fc as MQ,Gc as z8,Hc as i9,Ic as _0,Jc as M9,Kc as i0,Rc as K0}from"./vm-hands-entry-lite-anmv8hp7.js";import{Xe as k9,Ye as r0,Ze as L8,_e as m0,cf as q0,le as $Q,qe as QQ}from"./vm-hands-entry-lite-zfwg7ehq.js";import{rg as hQ,xg as a9,yg as g8}from"./vm-hands-entry-lite-dgxxsdwb.js";import{Dg as Y4}from"./vm-hands-entry-lite-zh8p7ndn.js";import{Fg as OZ,Ig as N9,Rg as ZQ,Sg as XQ,Ug as JQ,Wg as l9,Xg as n$,Yg as i$,Zg as S8,ah as u9,jh as E8,kh as S0,lh as O0,mh as s9,th as k8,uh as YQ,vh as o$}from"./vm-hands-entry-lite-za55dtte.js";import{ei as cQ,fi as v8}from"./vm-hands-entry-lite-5kgvss4p.js";import{Gi as b0}from"./vm-hands-entry-lite-4m40gwkf.js";import{Yi as j8,Zi as n9,aj as J4}from"./vm-hands-entry-lite-c01eyep6.js";import{bj as N8,cj as o0,dj as M8,ej as a0,fj as W9,gj as G8,hj as Q$,ij as n0,jj as l0,kj as s$,vj as L$}from"./vm-hands-entry-lite-9cgm6g8t.js";import{Aj as UZ}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ac as kQ,Bc as fQ,Cc as z4,Dc as K4,Ec as H8}from"./vm-hands-entry-lite-sb9a1jcn.js";import{Fc as MQ,Gc as z8,Hc as i9,Ic as _0,Jc as M9,Kc as i0,Rc as K0}from"./vm-hands-entry-lite-anmv8hp7.js";import{Xe as k9,Ye as r0,Ze as L8,_e as m0,cf as q0,le as $Q,qe as QQ}from"./vm-hands-entry-lite-zfwg7ehq.js";import{rg as hQ,xg as a9,yg as g8}from"./vm-hands-entry-lite-dgxxsdwb.js";import{Dg as Y4}from"./vm-hands-entry-lite-zh8p7ndn.js";import{Fg as OZ,Ig as N9,Rg as ZQ,Sg as XQ,Ug as JQ,Wg as l9,Xg as n$,Yg as i$,Zg as S8,ah as u9,jh as E8,kh as S0,lh as O0,mh as s9,th as k8,uh as YQ,vh as o$}from"./vm-hands-entry-lite-za55dtte.js";import{ei as cQ,fi as v8}from"./vm-hands-entry-lite-5kgvss4p.js";import{Gi as b0}from"./vm-hands-entry-lite-4m40gwkf.js";import{Yi as j8,Zi as n9,aj as J4}from"./vm-hands-entry-lite-c01eyep6.js";import{bj as N8,cj as o0,dj as M8,ej as a0,fj as W9,gj as G8,hj as Q$,ij as n0,jj as l0,kj as s$,vj as L$}from"./vm-hands-entry-lite-9cgm6g8t.js";import{Aj as UZ}from"./vm-hands-entry-lite-12xrjfxt.js";import{Vj as x}from"./vm-hands-entry-lite-hc3p6r9p.js";import{$j as G4}from"./vm-hands-entry-lite-bvbfcp1k.js";import{bk as C}from"./vm-hands-entry-lite-j2q1k9vb.js";import{ck as P1,hk as VZ}from"./vm-hands-entry-lite-g036gtem.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000,window:8};function c9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function P0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function S$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function w$($,Q){let Z=Buffer.from($,"latin1");return Buffer.concat([Buffer.from([Z.length]),Z,Q])}function I0($){if(!c9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(S$)||!P0($.attachmentRevision,0)||!P0($.grantRevision,1)||!P0($.generation,1)||!P0($.port,1024,65535)||!P0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function d0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function O9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function E$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function T9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function b$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function k$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!c9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello")return{type:"hello",binding:I0(Q.binding),...P0(Q.messages,v.chunk,v.upload)?{messages:Q.messages}:{},...P0(Q.window,1,v.window)?{window:Q.window}:{},...Q.bytes===!0?{bytes:!0}:{}};if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:I0(Q.binding),reason:Q.reason};if(!S$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return T9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&P0(Q.status,200,599)&&E$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&E$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return T9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:O9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function A8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((Y)=>Y.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function x8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function D9($){return await x8($)===!0}function d9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function f$($){if(!c9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:I0($.binding),deviceRelayUrl:d9($.deviceRelayUrl,"device")}}function m$($){if(!c9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:I0($.binding)}}import{request as D4}from"http";import{pipeline as _4}from"stream";import{constants as P8,createBrotliCompress as A4,createGzip as x4}from"zlib";import{WebSocket as _9}from"ws";import{randomBytes as q4,timingSafeEqual as T4}from"crypto";import{createServer as O4}from"net";var g$="x-preview-connection";async function y$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=q4(32).toString("base64url"),X=new Set,J=!1,Y=O4((G)=>{if(J||Q.aborted||X.size>=v.streams*2)return G.destroy();X.add(G);let F=new AbortController;G.once("close",()=>{X.delete(G),F.abort()}),G.on("error",()=>G.destroy()),G.setTimeout(2000,()=>G.destroy());let B=Buffer.alloc(0),H=(L)=>{B=Buffer.concat([B,L]);let W=B.indexOf(`\r
|
|
3
3
|
\r
|
|
4
4
|
`);if(W<0){if(B.length>16384)G.destroy();return}if(G.pause(),G.off("data",H),W>16384||B.length>v.upload+16384)return G.destroy();z(B,W).catch(()=>G.destroy())};G.on("data",H);async function z(L,W){let U=L.subarray(0,W).toString("latin1").split(`\r
|
|
5
5
|
`),j=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(U.shift()??"");if(!j)throw Error("preview_request_invalid");O9(j[2]);let O=!1,q=0,A=[];for(let T of U){let S=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(T);if(!S)throw Error("preview_header_invalid");if(S[1].toLowerCase()===g$){q++;let m=Buffer.from(S[2].trim());O=m.length===Z.length&&T4(m,Buffer.from(Z))}else if(S[1].toLowerCase()!=="host")A.push(T)}if(!O||q!==1||J||F.signal.aborted)throw Error("preview_connection_denied");let R=await $.connect(F.signal);if(J||F.signal.aborted)throw R.destroy(),Error("preview_closed");X.add(R),R.on("error",()=>G.destroy()),R.once("close",()=>{X.delete(R),G.destroy()}),G.once("close",()=>R.destroy()),G.setTimeout(0);let P=[`${j[1]} ${j[2]} HTTP/1.1`,`Host: 127.0.0.1:${R.remotePort}`,...A,"",""].join(`\r
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Fd as ie,Hd as oe}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Fd as ie,Hd as oe}from"./vm-hands-entry-lite-9bap9r1t.js";import{if as he}from"./vm-hands-entry-lite-zfwg7ehq.js";import{Gf as q,Hf as ee,Jf as D,Kf as ye,Nf as W,Of as z,Pf as v,Yf as T,Zf as Fe}from"./vm-hands-entry-lite-1sewc078.js";import{Dg as ge}from"./vm-hands-entry-lite-zh8p7ndn.js";import{ri as re}from"./vm-hands-entry-lite-m3wmcx9g.js";import{Si as J}from"./vm-hands-entry-lite-b2zq6301.js";import{Yi as y}from"./vm-hands-entry-lite-c01eyep6.js";import{Pj as xe,Qj as te}from"./vm-hands-entry-lite-7shpbsw8.js";import{Wj as be,ak as we}from"./vm-hands-entry-lite-bvbfcp1k.js";import{bk as f}from"./vm-hands-entry-lite-j2q1k9vb.js";import{spawn as O}from"child_process";import{randomUUID as Se}from"crypto";import{closeSync as ct,copyFileSync as ce,existsSync as G,fstatSync as lt,mkdirSync as le,openSync as ut,readdirSync as F,readFileSync as Ae,readlinkSync as dt,renameSync as ft,rmSync as mt,statSync as pt}from"fs";import{connect as _t}from"net";import{userInfo as Oe}from"os";import{basename as ue,dirname as U,join as _}from"path";var V=`import { spawn, execFileSync } from "node:child_process";
|
|
3
3
|
import { createHash, randomUUID } from "node:crypto";
|
|
4
4
|
import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
|
|
5
5
|
import { tmpdir } from "node:os";
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import"./vm-hands-entry-lite-
|
|
2
|
+
import"./vm-hands-entry-lite-ja2sqpq1.js";import"./vm-hands-entry-lite-zfwg7ehq.js";import"./vm-hands-entry-lite-hc3p6r9p.js";import{hk as A}from"./vm-hands-entry-lite-g036gtem.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-9kc2qjg0.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-afsge57y.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{s as Mq}from"./vm-hands-entry-lite-
|
|
2
|
+
import{s as Mq}from"./vm-hands-entry-lite-nxz3p54x.js";import{Lb as Uq,pc as Fq,rb as Lq,tc as Tq}from"./vm-hands-entry-lite-sf5svyrg.js";import"./vm-hands-entry-lite-sb9a1jcn.js";import"./vm-hands-entry-lite-anmv8hp7.js";import"./vm-hands-entry-lite-zfwg7ehq.js";import"./vm-hands-entry-lite-dgxxsdwb.js";import"./vm-hands-entry-lite-zh8p7ndn.js";import"./vm-hands-entry-lite-za55dtte.js";import"./vm-hands-entry-lite-kxdw4myj.js";import"./vm-hands-entry-lite-5kgvss4p.js";import"./vm-hands-entry-lite-r6pap1kh.js";import"./vm-hands-entry-lite-4m40gwkf.js";import"./vm-hands-entry-lite-c01eyep6.js";import"./vm-hands-entry-lite-9cgm6g8t.js";import"./vm-hands-entry-lite-12xrjfxt.js";import"./vm-hands-entry-lite-hc3p6r9p.js";import"./vm-hands-entry-lite-bvbfcp1k.js";import"./vm-hands-entry-lite-j2q1k9vb.js";import"./vm-hands-entry-lite-g036gtem.js";import{spawn as Iq}from"child_process";import{chmodSync as vq,chownSync as Oq,existsSync as l,lstatSync as o,mkdirSync as e,mkdtempSync as bq,readdirSync as s,readFileSync as A,realpathSync as hq,rmdirSync as r,rmSync as xq,writeFileSync as E}from"fs";import{join as U}from"path";var wq="/sys/fs/cgroup/reason-payload",_="vm-hands",Vq="/run/ara-srt/fallbacks.jsonl",y="/reason-person",qq=5000,_q=1e4,zq="__VM_HANDS_PROOF_DIR__",Hq="__VM_HANDS_PROBE_NONCE__";class T extends Error{code;constructor(q,z){super(z);this.code=q}}function gq(q,z){if(!/^[0-9a-f-]{36}$/i.test(z))throw new T("vm_hands_bind_invalid","bad bind id");return U(q,_,`b-${z.toLowerCase()}`)}var kq=5000,Rq=(q)=>`'${q.replaceAll("'","'\\''")}'`;function iq(q){let z=q.cgroup??wq,J=q.init.layout.payload_uid,X=q.log??(()=>{}),G=new Map,W=new Map,B=0,P=()=>{try{let Z=A("/run/ara-srt/starts.jsonl","utf8"),Q=Z.slice(B>Z.length?0:B).split(`
|
|
3
3
|
`).filter(Boolean);B=Z.length;let Y=Q.map((L)=>{try{return Number(JSON.parse(L).elapsed_ms)||0}catch{return 0}});if(Y.length)X("vm_hands.srt_server_starts",{count:Y.length,elapsed_ms:Y.slice(0,8)})}catch{}},D=null,H=!1,O=q.srtCgroup??"/sys/fs/cgroup/reason-srt",C=()=>{D??=Gq()},b=0,h=()=>{try{let Z=A(Vq,"utf8"),Q=Z.slice(b>Z.length?0:b);b=Z.length;let Y=Q.split(`
|
|
4
4
|
`).filter(Boolean).slice(0,1000);if(!Y.length)return null;let L={},F=0;for(let M of Y)try{let R=JSON.parse(M),K=typeof R.code==="string"&&/^[a-z_]{1,40}$/.test(R.code)?R.code:"other";if(L[K]=(L[K]??0)+1,typeof R.elapsed_ms==="number")F=Math.max(F,R.elapsed_ms)}catch{L.unparsed=(L.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:Y.length,codes:L,max_elapsed_ms:F}),{count:Y.length,codes:L,max_elapsed_ms:F}}catch{return null}},f=!1,m=(Z,Q,Y)=>{if(f)throw Error("vm_hands_pool_held");return Nq(Z,Q,Y)},d=(Z)=>(Q,Y,L)=>Iq("/bin/sh",["-c",`echo $$ > ${Rq(U(Z,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",Q,...Y],L),Nq=d(U(z,_)),u=U(z,_,"probe"),S=(Z)=>gq(z,Z),Aq=(Z)=>{let Q=S(Z);try{e(Q,{mode:493})}catch(Y){if(!(Y&&typeof Y==="object"&&("code"in Y)&&Y.code==="EEXIST"))throw new T("vm_hands_bind_failed","bind cgroup")}return Q},Pq=(Z)=>{try{r(S(Z))}catch{}},x=q.prespawn?Uq({spawnProcess:m,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(Z,Q)=>X(Z,Q??{})}):null;x?.arm();let i=x?setInterval(()=>{x.arm()},kq):null;i?.unref?.();async function c(Z){let Q=G.get(Z);if(G.delete(Z),!Q)return;Q.abort.abort(),await Q.done}return{bindCgroup:S,async startExecutor(Z){if(C(),W.set(Z.bindId,Gq()),H=!0,!Z.claim)throw new T("vm_hands_bind_invalid","an executor needs the claim it serves");await c(Z.bindId);let{claim:Q,bindId:Y}=Z,L=Aq(Y),F=Q.owner;if(!F||typeof F.device_id!=="string"||typeof Q.root_id!=="string")throw new T("vm_hands_bind_invalid","claim without its owner Device or root");let M=new AbortController,R,K,j=new Promise(($,w)=>{R=$,K=w}),I,N=new Promise(($)=>{I=$}),V=Tq({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:F.device_id,rootId:Q.root_id,apiOrigin:q.apiOrigin},claimOwner:Q.owner,root:q.root,runId:Q.run_id,operationId:Q.operation_id,attemptId:Q.attempt_id,payload:Object.fromEntries(Object.entries(Q.payload).filter(([$])=>!$.startsWith("vm_hands_"))),signal:M.signal,...Z.workspaceGrant?{workspaceGrant:Z.workspaceGrant}:{},emitEvent:async($,w)=>{if($==="hands.ready"){R(w);return}if($==="hands.started"||$==="hands.stopped"||$==="hands.failed")return;await q.forward(Y,$,w)}},{...q.relayDependencies,spawnWorker:($)=>d(L)($.command,$.args,$.options),...x?{takePrespawnedWorker:($)=>{let w=x.take($);if(!w?.pid)return w;try{return E(U(L,"cgroup.procs"),String(w.pid)),w}catch{try{w.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:x.adopt}:{}}).then(()=>{I("executor_stopped")},($)=>{let w=$&&typeof $==="object"&&"code"in $?String($.code):"executor_failed";K(new T(w,$ instanceof Error?$.message:String($))),I(w)}).finally(()=>K(new T("vm_hands_executor_exited","executor ended before it was ready")));G.set(Y,{abort:M,done:V,exited:N,operationId:Q.operation_id,runId:Q.run_id,expiresAtMs:Date.parse(String(Q.payload.expires_at??""))||0});let g=await j,a=g.executor_launch_id;if(typeof a!=="string")throw new T("vm_hands_bind_failed","executor ready without a launch id");return{launchId:a,readyData:g,applied:{hands_confinement:typeof Q.payload.hands_confinement==="string"?Q.payload.hands_confinement:null,browser_egress:Q.payload.browser_egress??null}}},takeSrtFallbacks:h,executorExited(Z){return G.get(Z)?.exited??new Promise(()=>{})},freezeBind(Z){let Q=S(Z);if(l(U(Q,"cgroup.freeze")))E(U(Q,"cgroup.freeze"),"1")},async killAndVerifyPayload(Z){let Q=new Set(Z?.keep??[]);if(Q.size||Z?.own)return Cq(Z?.bindId??null,Q,Z?.own===!0);f=!0;let Y=Yq();try{await Bq();let L=Promise.all([...G.keys()].map((K)=>c(K).catch(()=>{return})));P();let F=Date.now()+qq;await p(z,F,"payload"),await L;let M=(H||q.srtWarmLate?.()===!0)&&l(U(O,"cgroup.events"));if(M)await p(O,F,"srt");let R=Zq(J).filter((K)=>!v(K,y));if(D!==null){let K=Xq(D).filter((j)=>j!==process.pid&&!v(j,y));if(K.length)throw X("vm_hands.kill_strays",{strays:K.slice(0,16).map((j)=>{let I="?",N="?";try{I=A(`/proc/${j}/comm`,"utf8").trim().slice(0,32)}catch{}try{N=(A(`/proc/${j}/cgroup`,"utf8").split(`
|
|
5
5
|
`).find((V)=>V.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:j,comm:I,cgroup:N}})}),new T("vm_hands_kill_unverified",`${K.length} process(es) the run started survived it`);D=null}if(H=!1,M)q.onSrtReset?.();if(R.length)throw X("vm_hands.kill_survivors",{pids:R.slice(0,16)}),new T("vm_hands_kill_unverified",`${R.length} payload-uid process(es) outside the payload cgroup`);W.clear();for(let K of Qq())try{r(U(z,_,K))}catch{}}finally{f=!1,Y()}if(x)setTimeout(()=>{if(!G.size)x.arm()},100).unref?.()},async killProbe(){let Z=Date.now()+qq;if(l(U(u,"cgroup.events"))){await p(u,Z,"probe");try{r(u)}catch{}}let Q=$q(process.pid);if(Q===null)throw new T("vm_hands_kill_unverified","agent start time unreadable");await yq(z,Q,Z);let Y=(F)=>{let M=$q(F);return M!==null&&M<=Q},L=Zq(J).filter((F)=>Y(F)&&!v(F,y));if(L.length)throw X("vm_hands.kill_survivors",{pids:L.slice(0,16),at:"attest"}),new T("vm_hands_kill_unverified",`${L.length} payload-uid process(es) from before this agent`);if(D!==null){let F=[z,U(z,_)].map((K)=>K.replace(/^\/sys\/fs\/cgroup/,"")),M=O.replace(/^\/sys\/fs\/cgroup/,""),R=Xq(D).filter((K)=>K!==process.pid&&!v(K,y)&&!v(K,"/reason-vm-hands")&&!v(K,M)&&!F.some((j)=>Wq(K,j)));if(R.length)throw X("vm_hands.kill_strays",{strays:R.slice(0,16).map((K)=>({pid:K})),at:"attest"}),new T("vm_hands_kill_unverified",`${R.length} process(es) the probe started survived it`);D=null}},async runProbe({nonce:Z,script:Q}){if(C(),!Q.includes(zq))throw new T("vm_hands_probe_failed","probe names no proof directory");let Y=q.proofParent??"/tmp/reason-vm-hands-proof";e(Y,{mode:457,recursive:!0});let L=o(Y);if(L.isSymbolicLink()||!L.isDirectory()||L.uid!==(process.getuid?.()??-1)||(L.mode&4095)!==457)throw new T("vm_hands_probe_failed","proof parent is not root's 0711 directory");let F=bq(U(Y,"p-")),M=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(F)||!/^[A-Za-z0-9_-]{1,128}$/.test(Z))throw new T("vm_hands_probe_failed","proof directory path or nonce");Oq(F,J,J),vq(F,448);let R=o(F).ino;try{e(u,{mode:493})}catch(N){if(!(N&&typeof N==="object"&&("code"in N)&&N.code==="EEXIST"))throw new T("vm_hands_probe_failed","probe cgroup")}let K=d(u)("/bin/bash",["-c",Q.replaceAll(zq,F).replaceAll(Hq,Z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),j="";K.stdout?.on("data",(N)=>{if(j.length<16384)j+=N.toString("utf8").slice(0,16384-j.length)});let I=await new Promise((N)=>{let V=setTimeout(()=>{M=!0,K.kill("SIGKILL"),N(124)},_q);K.once("error",()=>{clearTimeout(V),N(127)}),K.once("close",(g)=>{clearTimeout(V),N(g??1)})});return X("vm_hands.probe",{nonce_len:Z.length,exit_code:I}),{exitCode:I,markers:j,proofDirInode:R}}finally{if(!M)xq(F,{recursive:!0,force:!0})}},restatLayout(){let{session_root:Z,alias:Q}=q.init.layout,Y="invalid";try{Fq(Z),Y="0:0:755"}catch{}let L=!1,F=-1;try{let M=o(Q);F=M.uid,L=Y==="0:0:755"&&Q===U(Z,"repo")&&!M.isSymbolicLink()&&M.isDirectory()&&hq(Q)===Q&&M.uid===J}catch{}return{root_mode:Y,alias_ok:L,owner_uid:F}},installEnvironment(Z,Q){let Y=G.get(Z);if(!Y)throw new T("environment_unavailable","no executor owns an environment");return Lq({root:q.root,operationId:Y.operationId,payload:Q}).installed_revision},async stop(){if(i)clearInterval(i);x?.close(),await Promise.all([...G.keys()].map((Z)=>c(Z)))}};function Qq(){try{return s(U(z,_),{withFileTypes:!0}).filter((Z)=>Z.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(Z.name)).map((Z)=>Z.name)}catch{return[]}}async function Cq(Z,Q,Y=!1){let L=new Set([...Q].map((M)=>M.toLowerCase())),F=Yq();try{await Bq();let M=Date.now()+qq,R=new Set(Qq().filter(($)=>!L.has($.slice(2))).map(($)=>$.slice(2)));if(Z)R.add(Z.toLowerCase());let K=null;for(let $ of R){let w=c($).catch(()=>{return}),n=W.get($);if(n!==void 0)K=K===null?n:Math.min(K,n);if(l(U(S($),"cgroup.events")))await p(S($),M,"bind");await w}let j=[...L].map(($)=>S($).replace(/^\/sys\/fs\/cgroup/,"")),I=[z,U(z,_)].map(($)=>$.replace(/^\/sys\/fs\/cgroup/,"")),N=O.replace(/^\/sys\/fs\/cgroup/,""),V=($)=>v($,y)||j.some((w)=>v($,w)),g=Y?[]:Zq(J).filter(($)=>!V($));if(g.length)throw X("vm_hands.kill_survivors",{pids:g.slice(0,16),beside:L.size}),new T("vm_hands_kill_unverified",`${g.length} payload-uid process(es) outside a live bind`);let a=($)=>!V($)&&!v($,"/reason-vm-hands")&&!v($,N)&&!I.some((w)=>Wq($,w));if(K!==null){let $=Xq(K).filter((w)=>w!==process.pid&&a(w));if($.length)throw X("vm_hands.kill_strays",{strays:$.slice(0,16).map((w)=>({pid:w})),beside:L.size}),new T("vm_hands_kill_unverified",`${$.length} process(es) the run started survived it`)}for(let $ of R)W.delete($),Pq($)}finally{F()}}}function $q(q,z="/proc"){try{let J=A(U(z,String(q),"stat"),"utf8"),X=Number(J.slice(J.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(X)?X:null}catch{return null}}function Sq(q,z="/proc"){try{let J=A(U(z,String(q),"stat"),"utf8"),X=Number(J.slice(J.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(X)?X:null}catch{return null}}async function yq(q,z,J){try{E(U(q,"cgroup.freeze"),"1")}catch(X){throw new T("vm_hands_kill_unverified",`payload cgroup.freeze: ${X instanceof Error?X.message:String(X)}`)}try{for(;;){let X=Dq(q).filter((W)=>fq(W,q)),G=new Set(X.filter((W)=>{let B=$q(W);return B!==null&&B<=z}));for(let W=!0;W;){W=!1;for(let B of X){if(G.has(B))continue;let P=Sq(B);if(P!==null&&G.has(P))G.add(B),W=!0}}if(G.size===0)return;if(Date.now()>J)throw new T("vm_hands_kill_unverified",`${G.size} previous-boot process(es) survived`);for(let W of G)try{process.kill(W,"SIGKILL")}catch{}await new Promise((W)=>setTimeout(W,10))}}finally{try{E(U(q,"cgroup.freeze"),"0")}catch{}}}function Wq(q,z,J="/proc"){try{return A(U(J,String(q),"cgroup"),"utf8").split(`
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{s as a,t as b,u as c}from"./vm-hands-entry-lite-
|
|
2
|
+
import{s as a,t as b,u as c}from"./vm-hands-entry-lite-nxz3p54x.js";import"./vm-hands-entry-lite-j2q1k9vb.js";import"./vm-hands-entry-lite-g036gtem.js";export{b as spawnSessionPty,c as runVmHandsOpRunner,a as VM_HANDS_OP_RUNNER_PERSON_ARG};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{xa as k,ya as m,za as l}from"./vm-hands-entry-lite-
|
|
3
|
-
`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=w(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=w(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=t("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-
|
|
4
|
-
`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){y(P),y(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-5zvgspyw.js"),import("./worker-sandbox-wpzkvwer.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-
|
|
2
|
+
import{xa as k,ya as m,za as l}from"./vm-hands-entry-lite-ja2sqpq1.js";import{ve as v}from"./vm-hands-entry-lite-zfwg7ehq.js";import"./vm-hands-entry-lite-hc3p6r9p.js";import{hk as G}from"./vm-hands-entry-lite-g036gtem.js";import{spawn as a}from"child_process";import{createHash as t}from"crypto";import{lstatSync as w,mkdirSync as s,readFileSync as i,statSync as e,writeFileSync as d}from"fs";var P="/run/reason-vm-hands",O="/run/reason-vm-hands/env",T="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",p="/usr/local/bin/ara-srt-exec",qj=65536,Jj=21600000;function Qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=w(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
|
|
3
|
+
`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=w(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=w(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=t("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let L=a("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{L.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),L.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var u=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function y(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-443dzn59.js"),import("./hands-worker-source-h0b1j53p.js"),import("./network-contract-zqvt1v0t.js"),import("./device-workspace-vbcry9d6.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-8fxjynte.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],$j=new Set(["pty.start","jobs.control"]);function Xj(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function zj(Q){for(let j of i("/etc/passwd","utf8").split(`
|
|
4
|
+
`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:T,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){y(P),y(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-5zvgspyw.js"),import("./worker-sandbox-wpzkvwer.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let L=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>L.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-3s16z4ma.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:T,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let M={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{M.restatLayout=()=>q.restatLayout(),M.installEnvironment=($,B)=>q.installEnvironment($,B),M.freezeBind=($)=>q.freezeBind($),M.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,M,{envRoot:O}),h=Zj(Q),b=null,n=Promise.all([h,import("./local-capabilities-60rw4wtj.js")]).then(([q,$])=>{b=Xj(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-3s16z4ma.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:L.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&q==="person"&&!$.authority;if($j.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-60rw4wtj.js");return U(x,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:x,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Mj as runVmHands,Lj as parseVmHandsInit,Zj as heartbeatBody,Qj as enableBaseKeyedSrt};
|
package/package.json
CHANGED
|
@@ -1,5 +0,0 @@
|
|
|
1
|
-
// @bun
|
|
2
|
-
import{Be as jJ,Je as kJ,Ke as LJ,Le as gJ,pf as EJ}from"./vm-hands-entry-lite-zfwg7ehq.js";import{createHash as f,randomBytes as YJ}from"crypto";import{closeSync as MJ,fsyncSync as OJ,mkdirSync as pJ,openSync as DJ,renameSync as lJ,rmSync as uJ,statSync as qJ,writeSync as AJ,constants as R}from"fs";import{join as r}from"path";var oJ=1;var s=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function GJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new P("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new P("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function BJ(J,Z){let{payload:z,authority:X}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!X||typeof X!=="object"||Array.isArray(X)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||X.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new P("vm_hands_env_invalid","environment does not match this Hands");return z}function _J(J){if(J.capability!=="hands.connect")throw new P("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&s.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:GJ(J)?J.environment_sealed:null,workspace_deferred:dJ(J)}}function dJ(J){let Z=J.payload[LJ];if(Z===void 0)return!1;if(Z!==!0||J.payload.vm_hands_env_deferred!==!0||J.environment_sealed!==void 0)throw new P("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class P extends Error{code;constructor(J,Z){super(Z);this.code=J}}var I=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),m=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function b(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(b).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${b(J[Z])}`).join(",")}}`}async function jZ(J){let Z=await crypto.subtle.importKey("pkcs8",m(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=m(J.device_key.spki),X=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),L=new Uint8Array(await crypto.subtle.exportKey("spki",X.publicKey)),j=f("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:X,signingSpki:z,agreementSpki:L,fingerprint:j}}var iJ=4;class rJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;grants=new Map;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,X){this.init=J;this.keys=Z;this.hooks=z;this.options=X;if(!s.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new P("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new P("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let X=Date.now()+Z;;){let L=this.bound.get(J);if(!L)return!1;if(L.envInstalled)return!0;if(Date.now()>=X||z?.aborted)return!1;await new Promise((j)=>setTimeout(j,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new P("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new P("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:oJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:I(this.keys.signingSpki),env_public_key:I(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:I(YJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(b(Z)));return{...Z,device_signature:I(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new P("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),X=I(YJ(32)),L=EJ({method:"GET",pathAndQuery:jJ,timestamp:z,nonce:X,challenge:J,bodySha256:f("sha256").update("").digest("hex")}),j=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(L)));return{t:"hello",timestamp:z,nonce:X,signature:I(sJ(j)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new P("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new P("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new P("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!s.test(z))throw new P("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new P("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new P("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new P("vm_hands_bind_invalid","bad policy or nonce");if(f("sha256").update(b({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new P("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new P("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=iJ)throw new P("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new P("vm_hands_busy","a bind waits for its workspace beside the setup");if(J.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new P("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),J.workspace_deferred){let z,X,L=new Promise((j,U)=>{z=j,X=U});L.catch(()=>{return}),this.grants.set(J.bind_id,{promise:L,resolve:z,reject:X})}return this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,X=!1,L=this.grants.get(J.bind_id);try{if(L&&(Z.length||this.commandsSinceVerified))throw new P("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(Z.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new P("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.servedRun=!0,X=!0;let{launchId:j,applied:U,readyData:O}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim,...L?{workspaceGrant:L.promise}:{}}),q=this.hooks.restatLayout(),_=null,D=null;if(J.env){let S=J.claim?.owner??{},H=BJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof S.device_id==="string"?S.device_id:"",rootId:J.claim?.root_id??""});this.commandsSinceVerified=!0,_=this.hooks.installEnvironment(J.bind_id,H),D=typeof H.snapshot_id==="string"&&H.snapshot_id?H.snapshot_id:null,z=this.writeJobEnvRootOnly(J.bind_id,H)}if(this.unbinding.has(J.bind_id))throw new P("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:j,envInstalled:_!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),this.grants.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:j,snapshot_revision:_,snapshot_id:D,layout:q,...O?{ready_data:O}:{},policy_digest:f("sha256").update(b({hands_confinement:U.hands_confinement??null,browser_egress:U.browser_egress??null})).digest("hex")}}catch(j){if(z)KJ(z);if(X){let O=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:O,own:!0}).catch(()=>{this.unverified.add(J.bind_id)})}this.binding.delete(J.bind_id),this.grants.delete(J.bind_id);let U=j&&typeof j==="object"&&"code"in j&&typeof j.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(j.code)?j.code:"vm_hands_bind_failed";throw j instanceof P?j:new P(U,"executor refused the bind")}}grantWorkspace(J){let Z=this.grants.get(J);if(!Z)throw new P("vm_hands_not_binding","no pre-bind waits for a workspace grant");Z.resolve()}abandonWorkspaceGrant(J){this.grants.get(J)?.reject(new P("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new P("vm_hands_not_bound","environment delivered while not bound");if(!s.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new P("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new P("vm_hands_env_invalid","bad env envelope");let X=BJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId});this.commandsSinceVerified=!0;let L=this.hooks.installEnvironment(Z.bindId,X);if(Z.envInstalled=!0,Z.envDirectory)KJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${L}`,X),{snapshot_id:J.snapshotId,installed_revision:L,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new P("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new P("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new P("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:f("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),this.abandonWorkspaceGrant(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((L)=>L!==J),X=!z.length&&!this.commandsSinceVerified;try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:X?{bindId:J,own:!0}:void 0)}catch(L){throw this.unverified.add(J),L}if(!z.length)this.unverified.clear(),this.commandsSinceVerified=!1;if(Z?.envDirectory)KJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new P("vm_hands_env_invalid","env did not decrypt")},X=await crypto.subtle.importKey("spki",m(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),L=await crypto.subtle.deriveKey({name:"ECDH",public:X},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),j=await crypto.subtle.decrypt({name:"AES-GCM",iv:m(J.iv),additionalData:new TextEncoder().encode(Z)},L,m(J.ct)).catch(z),U=JSON.parse(new TextDecoder().decode(j));if(!U||typeof U!=="object"||Array.isArray(U))throw new P("vm_hands_env_invalid","env not an object");return U}writeJobEnvRootOnly(J,Z){let z=r(this.options.envRoot,`bind-${J}`);pJ(z,{mode:448});let X=qJ(z);if(!X.isDirectory()||(X.mode&63)!==0||X.uid!==(process.getuid?.()??-1))throw new P("vm_hands_env_dir_unsafe","env directory is not root's 0700");let L=Z.variables&&typeof Z.variables==="object"?Z.variables:{},j=Object.entries(L).filter(([q,_])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(q)&&typeof _==="string").map(([q,_])=>`export ${q}='${String(_).replaceAll("'","'\\''")}'`).join(`
|
|
3
|
-
`)+`
|
|
4
|
-
`,U=r(z,`.job.env.${YJ(8).toString("hex")}`),O=DJ(U,R.O_WRONLY|R.O_CREAT|R.O_EXCL|R.O_NOFOLLOW,384);try{AJ(O,j),OJ(O)}finally{MJ(O)}return lJ(U,r(z,"job.env")),z}}function KJ(J){try{let Z=r(J,"job.env"),z=qJ(Z).size,X=DJ(Z,R.O_WRONLY|R.O_NOFOLLOW);try{AJ(X,Buffer.alloc(z)),OJ(X)}finally{MJ(X)}}catch{}uJ(J,{recursive:!0,force:!0})}function sJ(J){if(J.length!==64)throw new P("vm_hands_signature_invalid","unexpected ECDSA signature length");let Z=(L)=>{let j=0;while(j<L.length-1&&L[j]===0)j++;let U=L.subarray(j),O=U[0]&128?Uint8Array.of(0,...U):U;return Uint8Array.of(2,O.length,...O)},z=Z(J.subarray(0,32)),X=Z(J.subarray(32));return Uint8Array.of(48,z.length+X.length,...z,...X)}import{randomUUID as aJ}from"crypto";var nJ="/app/local-runtime/session?register=vm_hands_v1",tJ="/app/local-runtime",xJ=25000,TJ=20000,eJ=1e4,vJ=5000,wJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),FJ=75000,JZ=2000,ZZ=1e4,$Z=new Set(["vm_hands_no_register","vm_hands_register_failed"]),zZ=3,QZ=20000,XZ=250,YZ=2000,a=20000;function hJ(J,Z){return typeof J==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(J)?J:Z}class V extends Error{}var KZ=64;async function VJ(J,Z){let z=[...J.modelOps.get(Z)??[]];for(let X of z)X.abort.abort();await Promise.race([Promise.all(z.map((X)=>X.settled)),new Promise((X)=>setTimeout(X,vJ))])}async function GZ(J){let Z=[...J.personTerminals];for(let z of Z)z.abort.abort();if(Z.length)await Promise.race([Promise.all(Z.map((z)=>z.settled)),new Promise((z)=>setTimeout(z,vJ))]);return Z.length}async function c(J,Z,z){return await VJ(J,z),Z.unbind(z)}function n(J){for(let Z of J.outbox?.splice(0)??[])Z.reject(Error("vm_hands_attempt_ended"))}var SJ=15000,FZ=1e4,PZ=1000;async function qZ(J){let Z=Date.now(),z={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:0},X=J.log??(()=>{}),L=async(O)=>{for(let[q,_]of[...z.turns]){z.turns.delete(q),J.onTurn?.(q,null),n(_);let D=await c(z,J.agent,q).catch(()=>null);if(D)z.receipts.push({turn:_,failure:"vm_hands_bind_lost",unbound:D});X("vm_hands.bound_dropped",{reason:O})}},j=0,U=0;try{for(let O=0;!J.signal.aborted;O++){let q=await WZ(J,z).catch((D)=>{if(D instanceof P&&z.deviceId===null&&D.code==="vm_hands_no_session"&&Date.now()-Z<ZZ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(D instanceof P&&z.deviceId===null&&$Z.has(D.code)&&j<zZ&&Date.now()-Z<QZ){j++;let S=Math.min(XZ*2**(j-1),YZ);return U=Math.round(S/2+Math.random()*S/2),X("vm_hands.register_retry",{attempt:j,code:D.code,delay_ms:U}),{closeCode:0,closeReason:"vm_hands_register_retry"}}if(D instanceof P&&z.deviceId===null)throw D;return{closeCode:0,closeReason:D instanceof Error?D.message:String(D)}});if(X("vm_hands.session_closed",{close_code:q.closeCode,reason:q.closeReason.slice(0,120),registered:z.deviceId!==null}),q.closeCode===4401||z.attest==="refused")return;if(J.signal.aborted)return;if(z.turns.size&&Date.now()-z.lostAt>=FJ)await L("reconnect_deadline");if(z.served)z.served=!1,O=0;let _=q.closeReason==="drain_reconnect"?0:q.closeReason==="vm_hands_register_retry"?U:q.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(O,5),2000):z.turns.size?Math.min(250*2**Math.min(O,5),5000,Math.max(0,z.lostAt+FJ-Date.now())):Math.min(500*2**O,30000);if(await new Promise((D)=>setTimeout(D,_)),z.turns.size&&Date.now()-z.lostAt>=FJ)await L("reconnect_deadline")}}finally{await L("session_ended")}}async function WZ(J,Z){let z=Z.deviceId,X=J.log??(()=>{}),L=z?`/app/local-runtime/session?device_id=${encodeURIComponent(z)}`:nJ,j=`${J.apiOrigin.replace(/^http/,"ws")}${L}`,U=new WebSocket(j),O=0,q="",_=new Map,D=[],S=null,H=new Promise(($)=>{U.onclose=(K)=>{O=K.code,q=K.reason;for(let Q of _.values())Q.reject(new V(`session closed ${K.code}`));for(let Q of Z.attestWaiters.splice(0))Q(!1);_.clear(),$()}});U.onmessage=($)=>{let K;try{K=JSON.parse(String($.data))}catch{U.close(4400);return}if(K.t==="res"){let Q=K;_.get(Q.id)?.resolve({status:Q.status,body:Q.body}),_.delete(Q.id);return}if(K.t==="reconnect"){let Q=Math.max(0,Math.min(Number(K.after_ms)||0,PZ));X("vm_hands.drain_reconnect",{after_ms:Q}),setTimeout(()=>{try{U.close(4001,"drain_reconnect")}catch{}},Q).unref?.();return}if(!S?.(K))D.push(K)};let p=($,K)=>new Promise((Q,F)=>{let N=D.findIndex((B)=>$.includes(B.t));if(N>=0){Q(D.splice(N,1)[0]);return}let C=setTimeout(()=>{S=null,F(new P("vm_hands_no_register",`no ${$.join("/")} in ${K} ms`))},K);S=(B)=>{if(!$.includes(B.t))return!1;return clearTimeout(C),S=null,Q(B),!0}}),l=($)=>U.send(JSON.stringify($)),g=($,K)=>new Promise((Q,F)=>{if(U.readyState!==WebSocket.OPEN){F(new V("session closed"));return}let N=aJ(),C=typeof K.wait_ms==="number"?K.wait_ms:0,B=setTimeout(()=>{if(!_.delete(N))return;F(new V(`no answer to ${$.split("/").pop()} in ${C+SJ} ms`)),U.close(4000,"request_timeout")},C+SJ);_.set(N,{reject:(Y)=>{clearTimeout(B),F(Y)},resolve:({status:Y,body:G})=>{clearTimeout(B);let W=null;try{W=G?JSON.parse(G):null}catch{}Q({status:Y,json:W})}}),l({t:"req",id:N,path:`${tJ}${$}`,body:JSON.stringify(K)})}),PJ=()=>U.close(1001,"stopping");J.signal.addEventListener("abort",PJ,{once:!0});let t,u=new Map,o=new Map,e=!1,JJ=new Set,ZJ=new Set,$J=Promise.resolve(),d=!1;try{await new Promise((Y,G)=>{let W=setTimeout(()=>G(Error("session open timeout")),FZ);U.onopen=()=>{clearTimeout(W),X("vm_hands.ws_open",{}),Y()},U.onerror=()=>{clearTimeout(W),G(Error("session socket error"))}});let $=await p(["challenge"],5000);X("vm_hands.challenge",{});let K=[],Q=null,F;if(z){l(await J.agent.helloFrame($.challenge,Z.connection));let Y=await p(["ready"],1e4);if(typeof Y.vm_hands_connection==="string")Z.connection=Y.vm_hands_connection;if(F={device_id:z,...Y.cadence?{cadence:Y.cadence}:{}},typeof Y.vm_hands_probe_script==="string"){if(Q=Y.vm_hands_probe_script,d=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,X("vm_hands.reconnected",{device_id:z});let G=Array.isArray(Y.vm_hands_binds)?Y.vm_hands_binds:Y.vm_hands_bind?[Y.vm_hands_bind]:[];for(let[W,M]of[...Z.turns]){if(G.some((T)=>T&&T.operation_id===M.claim.operation_id&&T.attempt_id===M.claim.attempt_id)){K.push(M),X("vm_hands.bound_resumed",{operation_id:M.claim.operation_id});continue}Z.turns.delete(W),J.onTurn?.(W,null),n(M);let A=await c(Z,J.agent,W).catch(()=>null);if(A)Z.receipts.push({turn:M,failure:"vm_hands_bind_lost",unbound:A});X("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{l(await J.agent.registerFrame($.challenge)),X("vm_hands.register_sent",{});let Y=await Promise.race([p(["registered","register_refused"],1e4),H.then(()=>{throw new P(q==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(Y.t==="register_refused")throw new P(Y.code,"register refused");J.agent.registered();let G=Y;if(F=G,Z.deviceId=G.device_id,typeof G.vm_hands_connection==="string")Z.connection=G.vm_hands_connection;if(typeof G.vm_hands_probe_script==="string"){if(Q=G.vm_hands_probe_script,d=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,X("vm_hands.registered",{device_id:F.device_id})}let N=async()=>{let Y=await g("/heartbeat",await J.heartbeat());if(Y.status>=300)throw Error(`heartbeat ${Y.status}`)};await N();let C=F.cadence?.presence_interval_ms??30000;if(t=setInterval(()=>{N().catch(()=>U.close())},C),Q&&Z.attest!=="accepted"&&J.agent.phase==="registered"&&!Z.turns.size)yJ(Q,$.challenge);let B=(Y,G)=>{o.set(Y,G().catch(async(W)=>{if(await WJ(W,Y),W instanceof V)U.close();else await zJ().catch(()=>{return})}).finally(()=>{o.delete(Y)}))};try{await zJ();for(let Y of K)Y.flush=()=>NJ(Y),Y.flush(),B(Y.claim.attempt_id,()=>UJ(Y));while(!J.signal.aborted&&U.readyState===WebSocket.OPEN){let Y=await g("/operations/claim",{wait_ms:Math.min(F.cadence?.claim_wait_ms??xJ,xJ)});if(Y.status===204||!Y.json)continue;if(Y.status>=300)throw Error(`claim ${Y.status}`);let G=Y.json;if(G.capability==="hands.connect"){if(o.has(G.attempt_id)){w({claim:G,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}B(G.attempt_id,()=>IJ(G))}else fJ(G).catch(()=>{return})}}catch(Y){await WJ(Y,null)}}finally{if(t)clearInterval(t);J.signal.removeEventListener("abort",PJ);for(let $ of Z.turns.values())$.flush=null;U.close(),await H,await Promise.all([...o.values()]);for(let $ of J.agent.liveBindIds){if(Z.turns.has($))continue;let K=await c(Z,J.agent,$).catch(()=>null),Q=u.get($);if(K&&Q)Z.receipts.push({turn:{...Q,eventSeq:Q.eventSeq+1},failure:"vm_hands_bind_lost",unbound:K});X("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let $ of JJ)$.abort()}return{closeCode:O,closeReason:q};async function WJ($,K){if($ instanceof V){if(!e&&Z.turns.size)Z.lostAt=Date.now();e=!0}else{let Q=K!==null?[K]:[...new Set([...Z.turns.keys(),...J.agent.liveBindIds])];if(K===null)e=!0;for(let F of Q){let N=Z.turns.get(F);if(Z.turns.delete(F),N)n(N),J.onTurn?.(F,null);if(J.agent.liveBindIds.includes(F)){let C=await c(Z,J.agent,F).catch(()=>null),B=u.get(F)??N;if(C&&B)Z.receipts.push({turn:{...B,eventSeq:B.eventSeq+1},failure:"vm_hands_bind_lost",unbound:C})}}}X("vm_hands.session_lost",{error:$ instanceof Error?$.message:String($),bound_kept:Z.turns.size})}function w($){let K=$.claim,Q={attempt_id:K.attempt_id,attempt_token:K.attempt_token},F=encodeURIComponent(K.operation_id);return{fence:Q,op:F,complete:(C,B={})=>g(`/operations/${F}/complete`,{...Q,status:C,...B}),emit:(C,B)=>{let Y=($.chain??Promise.resolve()).catch(()=>{return}).then(()=>N(C,B));return $.chain=Y,Y}};async function N(C,B){let Y=$.eventSeq,G=(T)=>g(`/operations/${F}/events`,{...Q,event_seq_start:T,events:[{kind:C,payload:{sequence:T,capability:String(K.capability??"hands.connect"),data:B}}]}),W=Y,M=await G(W),A=M.status===409?M.json?.expected_event_seq:void 0;if(typeof A==="number"&&A===Y+1)M={status:200,json:{duplicate:!0}};else if(typeof A==="number"&&A>=0&&A!==Y)W=A,M=await G(W);if(M.status<300)$.eventSeq=W+1;return M}}function HJ($){return(K,Q)=>new Promise((F,N)=>{if(Z.turns.get($.claim.attempt_id)!==$){N(Error("vm_hands_attempt_ended"));return}if($.outbox??=[],$.outbox.length>=KZ){N(Error("vm_hands_outbox_full"));return}$.outbox.push({kind:K,data:Q,resolve:F,reject:N}),$.flush?.()})}function NJ($){if(ZJ.has($))return;ZJ.add($),(async()=>{try{while($.outbox?.length&&Z.turns.get($.claim.attempt_id)===$&&U.readyState===WebSocket.OPEN){let K=$.outbox[0],Q;try{Q=await w($).emit(K.kind,K.data)}catch(F){if(F instanceof V)return;Q={status:500}}if($.outbox.shift(),Q.status<300)K.resolve();else K.reject(Error(`${K.kind} refused ${Q.status}`))}}finally{ZJ.delete($)}})()}async function yJ($,K){try{let Q=await J.agent.attestFrame($,K);if(U.readyState!==WebSocket.OPEN)return;l(Q);let F=await p(["attested","attest_refused"],15000);Z.attest=F.t==="attested"?"accepted":"refused";for(let N of Z.attestWaiters.splice(0))N(Z.attest==="accepted");if(X("vm_hands.attest",{result:Z.attest,exit_code:Q.exit_code,...F.t==="attest_refused"?{code:String(F.code??"")}:{}}),Z.attest==="refused")U.close(4401,"attest_refused")}catch(Q){X("vm_hands.attest_failed",{code:Q instanceof P?Q.code:"probe_error"});for(let F of Z.attestWaiters.splice(0))F(!1);if(Z.attest!=="accepted")U.close(4000,"attest_unanswered")}}async function IJ($){let K=d&&Z.attest==="pending",Q=$.vm_hands_attest,F=Q;if(Z.attest==="refused"){X("vm_hands.claim_attest_refused",{said:typeof Q==="string"?Q.slice(0,16):typeof Q,local:Z.attest}),await w({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(F==="accepted"){if(!K&&Z.attest!=="accepted"){Z.attest="accepted";for(let x of Z.attestWaiters.splice(0))x(!0)}}else if(F!=="pending"||!K&&Z.attest!=="accepted"){X("vm_hands.claim_attest_refused",{said:typeof Q==="string"?Q.slice(0,16):typeof Q,local:Z.attest}),await w({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Z.attest!=="accepted"){let x=Date.parse($.lease_until)-Date.now()-5000,E=Math.max(0,Math.min(a,Number.isFinite(x)?x:a));if(!await new Promise((k)=>{let i=setTimeout(()=>k(!1),E);Z.attestWaiters.push((XJ)=>{clearTimeout(i),k(XJ)})})){await w({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let N={claim:$,eventSeq:0},{complete:C,emit:B}=w(N),Y;try{if($.capability!=="hands.connect")throw new P("vm_hands_bind_invalid","not hands.connect");Y=!GJ($)}catch(x){X("vm_hands.bind_refused",{code:x instanceof P?x.code:"unexpected"}),await C("failed",{error_code:x instanceof P?x.code:"vm_hands_bind_invalid"});return}let G,W=null,M=!1;Z.bindsStarting++;try{let x=await GZ(Z);if(x)X("vm_hands.person_terminals_closed",{count:x});let E=_J($),h=J.agent.bind(E);if(E.workspace_deferred)M=!0,W=RJ(N,()=>M);G=await h}catch(x){X("vm_hands.bind_refused",{code:x instanceof P?x.code:"unexpected"}),await C("failed",{error_code:x instanceof P?x.code:"vm_hands_bind_failed"});return}finally{M=!1,Z.bindsStarting--}let A=W?await W:-1,T={...G.ready_data??J.readyData({launchId:G.launch_id,claim:$})};if(Y)delete T.environment_installed;let QJ=!Y&&G.snapshot_revision!==null&&G.snapshot_id!==null?{environment_installed:{snapshot_id:G.snapshot_id,installed_revision:G.snapshot_revision}}:{};u.set($.attempt_id,{claim:$,launchId:G.launch_id,readyData:T,eventSeq:N.eventSeq,ackSeq:-1});let y=await B("hands.ready",{...T,...QJ,vm_hands:{layout:G.layout,policy_digest:G.policy_digest,launch_id:G.launch_id}});if(u.delete($.attempt_id),y.status>=300){await VJ(Z,$.attempt_id),await J.agent.boundRefused($.attempt_id),await C("failed",{error_code:hJ(y.json?.error,"vm_hands_probe_failed")});return}let v={claim:$,launchId:G.launch_id,readyData:T,eventSeq:N.eventSeq,ackSeq:A};Z.turns.set($.attempt_id,v),v.flush=()=>NJ(v),J.onTurn?.($.attempt_id,HJ(v)),await UJ(v)}async function RJ($,K){let{fence:Q,op:F}=w($),N=$.claim.attempt_id,C=-1;try{for(;;){let B=await g(`/operations/${F}/heartbeat`,{...Q,control_ack_seq:C,wait_ms:TJ});if(!K())return C;if(B.status>=300)return J.agent.abandonWorkspaceGrant(N),C;let Y=(B.json?.controls??[]).slice().sort((G,W)=>G.seq-W.seq);for(let G of Y){if(G.seq<=C)continue;if(C=G.seq,G.kind===gJ)return X("vm_hands.workspace_granted",{}),J.agent.grantWorkspace(N),C;return X("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(G.kind)?G.kind:"other"}),J.agent.abandonWorkspaceGrant(N),C}}}catch{return J.agent.abandonWorkspaceGrant(N),C}}async function UJ($){let{fence:K,op:Q}=w($),F=null,N=null,C=J.agent.executorExited($.claim.attempt_id).then((B)=>{return N=B,null});J:for(;;){let B=await Promise.race([C,g(`/operations/${Q}/heartbeat`,{...K,control_ack_seq:$.ackSeq,wait_ms:TJ})]);if(!B){F="vm_hands_executor_exited",X("vm_hands.executor_exited",{reason:N});break}if(B.status>=300)break;let Y=(B.json?.controls??[]).slice().sort((G,W)=>G.seq-W.seq);for(let G of Y){if(G.seq<=$.ackSeq)continue;if(G.kind==="operation.cancel"||G.kind==="cancel"){$.ackSeq=G.seq;break J}if(G.kind===kJ)try{await bJ($,G.payload??{})}catch(W){if(W instanceof V)throw W;F=W instanceof P?W.code:"environment_unavailable";let M=W&&typeof W==="object"&&"code"in W&&typeof W.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(W.code)?W.code:null;X("vm_hands.environment_refused",{code:F,cause:M});break J}$.ackSeq=G.seq}}await mJ($,F)}async function fJ($){let K=$,Q={claim:K,eventSeq:0},{complete:F,emit:N,fence:C,op:B}={...w(Q)},Y=$.vm_hands_origin==="person"?"person":"model",G=String($.capability??"");if(!J.executeOp){await F("failed",{error_code:"vm_hands_op_unsupported"});return}if($.vm_hands_attest==="accepted"&&Z.attest==="pending"&&!(d&&Z.attest==="pending")){Z.attest="accepted";for(let E of Z.attestWaiters.splice(0))E(!0)}if(Z.attest!=="accepted"){let E=Date.parse(String($.lease_until??""))-Date.now()-5000,h=Z.attest==="refused"?0:Math.max(0,Math.min(a,Number.isFinite(E)?E:a));if(!(h>0&&await new Promise((i)=>{let XJ=setTimeout(()=>i(!1),h);Z.attestWaiters.push((cJ)=>{clearTimeout(XJ),i(cJ)})}))){await F("failed",{error_code:"vm_hands_unattested"});return}}let W=J.agent.bindIdForRun(K.run_id);if(Y==="model"&&W===null){await F("failed",{error_code:"vm_hands_not_bound"});return}let M=G==="pty.start"&&Y==="person"&&!$.authority;if(M&&(J.agent.liveBindIds.length>0||Z.bindsStarting>0)){await F("failed",{error_code:"vm_hands_bound"});return}if(wJ.has(G)&&!M&&J.agent.liveBindIds.length===0){await F("failed",{error_code:"vm_hands_not_bound"});return}if(Y==="model"&&W||wJ.has(G)&&!M)J.agent.opServed();let A=new AbortController;JJ.add(A);let T,QJ=new Promise((E)=>{T=E}),y={abort:A,settled:QJ};if(M)Z.personTerminals.add(y);if(Y==="model"&&W){let E=Z.modelOps.get(W)??new Set;E.add(y),Z.modelOps.set(W,E),await J.agent.environmentInstalled(W,JZ,A.signal)}let v=-1,x=setInterval(()=>{g(`/operations/${B}/heartbeat`,{...C,control_ack_seq:v,wait_ms:0}).then((E)=>{if(E.status>=300){A.abort();return}let h=E.json?.controls??[];for(let k of h)if(v=Math.max(v,k.seq),k.kind==="operation.cancel"||k.kind==="cancel")A.abort()},()=>A.abort())},eJ);try{let E=await J.executeOp({kind:Y,claim:$,...Y==="model"&&W?{bindId:W}:{},signal:A.signal,emit:async(k)=>{await N(k.kind,k.data??{})}}),h=await F(E.status,{...E.result?{result:E.result}:{},...E.error_code?{error_code:hJ(E.error_code,"vm_hands_op_failed")}:{}});X("vm_hands.op",{capability:G,kind:Y,status:E.status,code:E.error_code??null,...h.status>=300?{complete_status:h.status,complete_error:String(h.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval(x),JJ.delete(A),W)Z.modelOps.get(W)?.delete(y);Z.personTerminals.delete(y),T()}}async function mJ($,K){let Q=$.claim.attempt_id;if(Z.turns.get(Q)===$)Z.turns.delete(Q);J.onTurn?.(Q,null),n($);let F=await c(Z,J.agent,Q);Z.receipts.push({turn:$,failure:K,unbound:F}),await zJ()}function zJ(){return $J=$J.then(CJ,CJ),$J}async function CJ(){while(Z.receipts.length){let{turn:$,failure:K,unbound:Q}=Z.receipts[0],{complete:F,emit:N}=w($);try{if(await N("hands.stopped",{...$.readyData,reason_code:K?"failed":"cancelled",killed_verified:Q.killed_verified,shredded:Q.shredded,...Q.srt_fallbacks?{vm_hands_srt_fallbacks:Q.srt_fallbacks}:{}}),K)await F("failed",{error_code:K});else await F("cancelled",{error_code:"driver_stopped"})}catch(C){if(C instanceof V)return}Z.receipts.shift()}}async function bJ($,K){let{fence:Q,op:F}=w($),N=K.snapshot_id;if(K.version!==1||typeof N!=="string"||Object.keys(K).length!==2)throw new P("vm_hands_env_invalid","invalid environment delivery");let C=await g(`/operations/${F}/environment`,{...Q,snapshot_id:N}),B=C.json?.environment_sealed;if(C.status!==200||!B||C.json?.payload!==void 0)throw new P("vm_hands_env_invalid","environment not delivered sealed");let Y=await J.agent.deliverEnvironment({attemptId:$.claim.attempt_id,snapshotId:N,deviceId:Z.deviceId??"",sealed:B});if((await g(`/operations/${F}/environment-ack`,{...Q,...Y})).status>=300)throw new P("vm_hands_env_ack_refused","environment ack refused")}}
|
|
5
|
-
export{jZ as xa,rJ as ya,qZ as za};
|