@reason-machines/cli-linux-arm64-musl 0.2.387 → 0.2.389

package/bin/vm-hands/managed-runtime-pjemjmd9.js

@@ -1,2 +0,0 @@
-// @bun
-import{$ as D,L as n,M as o,N as p,O as q,P as r,Q as s,R as t,S as u,T as v,U as w,V as x,W as y,X as z,Y as A,Z as B,_ as C,aa as E,ba as F,ca as G,da as H,ea as I,fa as J,ga as K,ha as L,ia as M,ja as N,ka as O,la as P,ma as Q,na as R,oa as S,pa as T,qa as U,ra as V,sa as W,ta as X,ua as Y}from"./vm-hands-entry-lite-w7havvz8.js";import"./vm-hands-entry-lite-h8dbw0c7.js";import"./vm-hands-entry-lite-g7h6wjqy.js";import{$h as e,Xh as a,Yh as b,Zh as c,_h as d,ai as f,bi as g,ci as h,ei as i,fi as j,hi as k,ii as l,ji as m}from"./vm-hands-entry-lite-y2s2w174.js";import"./vm-hands-entry-lite-ma001vzh.js";import"./vm-hands-entry-lite-wc6skbhf.js";import"./vm-hands-entry-lite-fyvgav60.js";import"./vm-hands-entry-lite-pk3q774c.js";import"./vm-hands-entry-lite-2j141pnw.js";import"./vm-hands-entry-lite-ew076kpd.js";import"./vm-hands-entry-lite-r8qg3wp1.js";import"./vm-hands-entry-lite-f5230h6t.js";import"./vm-hands-entry-lite-2t0vcvd8.js";export{E as verifyManagedRuntimeCodeSignatures,m as verifyManagedRuntimeArtifact,H as updateManagedRuntime,l as sha256Hex,Q as rollbackManagedRuntime,R as recoverManagedRuntimeActivation,V as recordManagedRuntimeLifecycle,U as readManagedRuntimeLifecycleEvents,j as parseAndVerifyManagedRuntimeManifest,k as parseAndVerifyLegacyManagedRuntimeManifest,z as managedRuntimeVersionPath,C as managedRuntimeTarget,K as managedRuntimePointerVersion,x as managedRuntimePaths,O as managedRuntimeExecutableVersion,A as managedRuntimeCredentialLibraryPath,h as managedRuntimeCredentialLibraryAssetName,g as managedRuntimeAssetName,y as legacyManagedRuntimePaths,N as isManagedRuntimeVersionExecutable,M as isManagedRuntimeExecutable,J as installManagedRuntimeLauncher,I as installManagedRuntimeArtifact,X as flushManagedRuntimeLifecycleEvents,F as fetchManagedRuntimeBytes,G as defaultManagedRuntimeHealthCheck,L as currentManagedRuntimeVersion,B as compareManagedRuntimeVersions,i as canonicalJson,Y as bootstrapManagedRuntime,D as assertManagedRuntimeSignatureEvidence,P as activateManagedRuntime,T as acquireManagedRuntimeLock,S as acquireManagedRuntimeDirectoryLock,W as acknowledgeManagedRuntimeLifecycleEvents,f as ManagedRuntimeError,v as MANAGED_RUNTIME_UPDATE_HEALTH_TIMEOUT_MS,e as MANAGED_RUNTIME_TARGETS,d as MANAGED_RUNTIME_MAX_MANIFEST_BYTES,p as MANAGED_RUNTIME_MAX_LIFECYCLE_EVENTS,q as MANAGED_RUNTIME_MAX_LIFECYCLE_BYTES,c as MANAGED_RUNTIME_MAX_ARTIFACT_BYTES,b as MANAGED_RUNTIME_MANIFEST_VERSION,r as MANAGED_RUNTIME_MANIFEST_URL,o as MANAGED_RUNTIME_LIFECYCLE_VERSION,w as MANAGED_RUNTIME_LIFECYCLE_EVENTS,n as MANAGED_RUNTIME_LAYOUT_VERSION,u as MANAGED_RUNTIME_HEALTH_TIMEOUT_MS,s as MANAGED_RUNTIME_FETCH_TIMEOUT_MS,t as MANAGED_RUNTIME_ARTIFACT_FETCH_TIMEOUT_MS,a as LEGACY_MANAGED_RUNTIME_MANIFEST_VERSION};

package/bin/vm-hands/network-contract-dsw79qkc.js

@@ -1,2 +0,0 @@
-// @bun
-import{$e as t,Af as U,Bf as V,Cf as W,Df as X,Ef as Y,Ff as Z,Gf as _,Hf as $,Ie as a,If as aa,Je as b,Jf as ba,Ke as c,Kf as ca,Le as d,Lf as da,Me as e,Mf as ea,Ne as f,Nf as fa,Oe as g,Of as ga,Pe as h,Pf as ha,Qe as i,Qf as ia,Re as j,Rf as ja,Se as k,Sf as ka,Te as l,Ue as m,Ve as n,We as o,Xe as p,Ye as q,Ze as r,_e as s,af as u,bf as v,cf as w,df as x,ef as y,ff as z,gf as A,hf as B,if as C,jf as D,kf as E,lf as F,mf as G,nf as H,of as I,pf as J,qf as K,rf as L,sf as M,tf as N,uf as O,vf as P,wf as Q,xf as R,yf as S,zf as T}from"./vm-hands-entry-lite-5n4vsm6b.js";import"./vm-hands-entry-lite-zjfr0zh8.js";import"./vm-hands-entry-lite-2t0vcvd8.js";export{ba as parseLocalRuntimeRootsSyncResponse,Z as parseLocalRuntimeRegistrationResponse,Y as parseLocalRuntimeProofChallenge,ha as parseLocalRuntimeOperationHeartbeatResponse,ia as parseLocalRuntimeOperationEventsResponse,ja as parseLocalRuntimeOperationEnvironmentResponse,ka as parseLocalRuntimeOperationCompletionResponse,ga as parseLocalRuntimeOperationClaim,ea as parseLocalRuntimeLocalSubscriptionResponse,fa as parseLocalRuntimeLifecycleResponse,ca as parseLocalRuntimeIdentityResponse,$ as parseLocalRuntimeHeartbeatResponse,aa as parseLocalRuntimeFirstHeartbeat,X as parseLocalRuntimeErrorEnvelope,_ as parseLocalRuntimeEnrollmentResponse,da as parseLocalRuntimeDisconnectResponse,j as localRuntimeSessionRoutable,W as buildLocalRuntimeDeviceProofBytes,R as WORKER_STARTUP_TIMING_STAGES,M as WORKER_PREVIEW_CARRIED_JOBS,q as VM_HANDS_WORKSPACE_GRANT_CONTROL,p as VM_HANDS_WORKSPACE_DEFERRED_KEY,e as RELAY_HOST_ALIAS_VERSION,d as RELAY_HOST_ALIAS_HEADER,S as LOCAL_RUNTIME_WORKER_STARTUP_MAX_MS,k as LOCAL_RUNTIME_SESSION_VM_HANDS_REGISTER,h as LOCAL_RUNTIME_SESSION_PRE_AUTH_MAX_BYTES,g as LOCAL_RUNTIME_SESSION_PATH,m as LOCAL_RUNTIME_SESSION_CLOSE,l as LOCAL_RUNTIME_SESSION_CLAIM_WAIT_MAX_MS,i as LOCAL_RUNTIME_SESSION_AUTH_DEADLINE_MS,b as LOCAL_RUNTIME_ROUTE_PREFIX,f as LOCAL_RUNTIME_ROUTES,a as LOCAL_RUNTIME_PROTOCOL_VERSION,T as LOCAL_RUNTIME_LIFECYCLE_EVENTS,V as LOCAL_RUNTIME_LEGACY_DEVICE_PROOF_TAG,U as LOCAL_RUNTIME_DEVICE_PROOF_TAG,c as LOCAL_OPERATION_MAX_BYTES,O as JOBS_START_WAIT_KEY,N as JOBS_START_WAIT,J as HANDS_SESSION_GROUP_KEY,I as HANDS_SESSION_GROUP,L as HANDS_SESSION_CAP_NONE,K as HANDS_SESSION_CAP_KEY,u as HANDS_REBIND_KEY,v as HANDS_REBIND_CONTROL,t as HANDS_REBIND,F as HANDS_MODEL_JOBS_EGRESS_KEY,E as HANDS_MODEL_JOBS_EGRESS,B as HANDS_LARGE_ENVIRONMENT_KEY,A as HANDS_LARGE_ENVIRONMENT,H as HANDS_JOBS_USER_KEY,G as HANDS_JOBS_USER,z as HANDS_HEADLESS_BROWSER_KEY,y as HANDS_HEADLESS_BROWSER,o as HANDS_ENVIRONMENT_DELIVER_CONTROL,n as HANDS_ENVIRONMENT_DELIVERY,s as HANDS_ENVIRONMENT_AT_CLAIM_KEY,r as HANDS_ENVIRONMENT_AT_CLAIM,D as HANDS_CONFINEMENT_KEY,C as HANDS_CONFINEMENT,x as HANDS_CLOUD_ACCESS_KEY,w as HANDS_CLOUD_ACCESS,P as AUTOMATION_USER_CHROME,Q as AUTOMATION_CLOUD_SESSIONS};

package/bin/vm-hands/package-smk3nqjs.js

@@ -1,2 +0,0 @@
-// @bun
-import{Aa as a}from"./vm-hands-entry-lite-9w5vs9zv.js";import"./vm-hands-entry-lite-2t0vcvd8.js";export default a();

package/bin/vm-hands/permissions-qrfwt9ez.js

@@ -1,2 +0,0 @@
-// @bun
-import{Hi as a,Ii as b,Ji as c,Ki as d,Li as e,Mi as f,Ni as g,Oi as h,Pi as i,Qi as j}from"./vm-hands-entry-lite-7a01dgje.js";import"./vm-hands-entry-lite-sex82vb1.js";import"./vm-hands-entry-lite-wc6skbhf.js";import"./vm-hands-entry-lite-fyvgav60.js";import"./vm-hands-entry-lite-pk3q774c.js";import"./vm-hands-entry-lite-2j141pnw.js";import"./vm-hands-entry-lite-ew076kpd.js";import"./vm-hands-entry-lite-1gxktkpe.js";import"./vm-hands-entry-lite-51hmj6am.js";import"./vm-hands-entry-lite-2t0vcvd8.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};

package/bin/vm-hands/serve-service-403dqjk9.js

@@ -1,2 +0,0 @@
-// @bun
-import{$d as l,Qd as a,Rd as b,Sd as c,Td as d,Ud as e,Vd as f,Wd as g,Xd as h,Yd as i,Zd as j,_d as k,ae as m,be as n,ce as o,de as p,ee as q,fe as r}from"./vm-hands-entry-lite-6wsa0qrb.js";import"./vm-hands-entry-lite-qnnfvm5r.js";import"./vm-hands-entry-lite-e2mjbqmr.js";import"./vm-hands-entry-lite-ma001vzh.js";import"./vm-hands-entry-lite-wc6skbhf.js";import"./vm-hands-entry-lite-fyvgav60.js";import"./vm-hands-entry-lite-pk3q774c.js";import"./vm-hands-entry-lite-2j141pnw.js";import"./vm-hands-entry-lite-ew076kpd.js";import"./vm-hands-entry-lite-r8qg3wp1.js";import"./vm-hands-entry-lite-f5230h6t.js";import"./vm-hands-entry-lite-2t0vcvd8.js";export{g as workerServiceRetargetPending,f as workerServiceProgram,m as workerServiceProcessRunning,e as workerServiceLauncher,j as workerServiceDefinitions,n as workerServiceDefinitionCurrent,l as retireLegacyWorkerService,q as retargetWorkerServiceLogs,p as restartWorkerService,r as removeWorkerService,i as isConnectServiceLabel,k as installedWorkerService,o as installWorkerService,c as defaultWorkerServiceHost,h as connectServiceLabel,d as WorkerServiceError,a as WORKER_SERVICE_ENV,b as WORKER_IDENTITY_UNAVAILABLE_CODE};

package/bin/vm-hands/version-gyns0vgm.js

@@ -1,2 +0,0 @@
-// @bun
-import{Lj as a,Mj as b,Nj as c,Oj as d}from"./vm-hands-entry-lite-2j141pnw.js";import"./vm-hands-entry-lite-ew076kpd.js";import"./vm-hands-entry-lite-2t0vcvd8.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};

package/bin/vm-hands/vm-hands-entry-lite-dh5gwmyf.js

@@ -1,3 +0,0 @@
-// @bun
-import{Mg as d}from"./vm-hands-entry-lite-xrthfx3q.js";import{Tg as P}from"./vm-hands-entry-lite-2e18tm6w.js";import{$g as i}from"./vm-hands-entry-lite-ammr3xbc.js";import{mj as s}from"./vm-hands-entry-lite-fyvgav60.js";import{zj as c}from"./vm-hands-entry-lite-pk3q774c.js";import{Ek as V}from"./vm-hands-entry-lite-51hmj6am.js";import{existsSync as A,realpathSync as p,statSync as t}from"fs";import{platform as f}from"os";import{isAbsolute as l,sep as e}from"path";import{existsSync as o}from"fs";import{createRequire as n}from"module";var E=Function("return ("+P+")")()(()=>n(import.meta.url)("bun:ffi"),o);function h(){return process.platform==="win32"&&typeof globalThis.Bun<"u"&&E.available()}function m(z=process.env){return E.defaultShell(z)}function w(z){return E.shellArgs(z)}function k(z){let H=E.spawn({...z,env:z.environment});return H.exited.then(()=>H.close()),{write:(Q)=>H.write(Q),resize:(Q,J)=>H.resize(Q,J),kill:()=>H.close(),exited:H.exited}}var zz=43200000,v=i,Hz=4,Jz=/^[A-Za-z0-9._:-]{1,160}$/,Qz=1000;function r(z){return Boolean(z)&&typeof z==="object"&&!Array.isArray(z)}function g(z,H){if(typeof z!=="number"||!Number.isFinite(z)||z<=0)return H;return Math.min(Qz,Math.max(1,Math.floor(z)))}function Vz(z,H=Date.now()){let Q=["relay_url","session_id","expires_at"],J=new Set([...Q,"cols","rows","cwd","workspace"]);if(!r(z)||Q.some((C)=>!(C in z))||Object.keys(z).some((C)=>!J.has(C)))throw new V("invalid_pty_request","Reason terminal request is malformed.");let{relay_url:N,session_id:Y,expires_at:R}=z;if(typeof N!=="string")throw new V("invalid_pty_request","Reason terminal relay URL is missing.");let K;try{K=new URL(N)}catch{throw new V("invalid_pty_request","Reason terminal relay URL is invalid.")}if(K.protocol!=="wss:"&&K.protocol!=="ws:"||K.username||K.password)throw new V("invalid_pty_request","Reason terminal relay URL is invalid.");if(typeof Y!=="string"||!Jz.test(Y))throw new V("invalid_pty_request","Reason terminal session identity is invalid.");let D=typeof R==="string"?Date.parse(R):Number.NaN;if(!Number.isFinite(D)||D<=H)throw new V("invalid_pty_request","Reason terminal session has already expired.");if(z.cwd!==void 0&&typeof z.cwd!=="string")throw new V("invalid_pty_request","Reason terminal working directory is invalid.");let j=z.workspace===void 0?void 0:c(z.workspace);if(j===null||j&&z.cwd!==void 0)throw new V("invalid_pty_request","Reason terminal workspace is invalid.");return{relay_url:N,session_id:Y,expires_at:new Date(Math.min(D,H+zz)).toISOString(),cols:g(z.cols,80),rows:g(z.rows,24),...z.cwd===void 0?{}:{cwd:z.cwd},...j?{workspace:j}:{}}}function Zz(z,H){if(f()==="win32")[z,H]=[z.toLowerCase(),H.toLowerCase()];return H===z||H.startsWith(z+e)}function y(z,H){if(H===void 0)return z;if(!l(H))throw new V("pty_cwd_invalid","Reason terminal working directory must be absolute.");let Q;try{Q=p(H)}catch{throw new V("pty_cwd_invalid","Reason terminal working directory does not exist.")}if(!Zz(z,Q))throw new V("pty_cwd_outside_root","Reason terminal working directory escapes the granted root.");if(!t(Q).isDirectory())throw new V("pty_cwd_invalid","Reason terminal working directory is not a directory.");return Q}function $z(z=process.env){if(f()==="win32")return m(z);let H=z.SHELL;if(H&&l(H)&&A(H))return H;for(let Q of f()==="darwin"?["/bin/zsh","/bin/bash","/bin/sh"]:["/bin/bash","/bin/sh"])if(A(Q))return Q;return"/bin/sh"}function jz(){let z=globalThis.Bun;if(!z)throw new V("pty_unavailable","Reason terminals require the Bun runtime.");return z.spawn}function Bz(){if(f()==="win32")return h();return typeof globalThis.Bun<"u"}var Gz=(z)=>{if(f()==="win32")try{return k({...z,file:z.shell,args:w(z.shell),environment:{...z.environment,TERM:"xterm-256color"}})}catch{throw new V("pty_unavailable","Reason could not allocate a pseudo-terminal.")}let H=jz()({cmd:[z.shell,"-i","-l"],cwd:z.cwd,env:{...z.environment,TERM:"xterm-256color"},terminal:{cols:z.cols,rows:z.rows,data:(J,N)=>{z.onData(N)}}}),Q=H.terminal;if(!Q){try{H.kill()}catch{}throw new V("pty_unavailable","Reason could not allocate a pseudo-terminal.")}return{write:(J)=>Q.write(J),resize:(J,N)=>Q.resize(J,N),kill:()=>{try{H.kill()}catch{}},exited:H.exited.then((J)=>typeof J==="number"?J:null,()=>null)}},Nz=(z,H)=>{return H===void 0?new WebSocket(z):new WebSocket(z,{proxy:H})},M=new Set;function Wz(z){if(M.size>=Hz||M.has(z))return null;M.add(z);let H=!1;return()=>{if(H)return;H=!0,M.delete(z)}}async function Iz(z,H={}){let Q=H.now??Date.now,J=Vz(z.payload,Q()),N=Wz(z.operationId);if(!N)throw new V("pty_slot_busy","This Reason Device already runs the maximum number of terminals.");let Y=Q(),R,K,D;try{let j=J.workspace?s(z.root,J.workspace):void 0;R=j?y(A(j.boundary)?p(j.boundary):j.boundary,j.path):y(z.root,J.cwd),K=H.environment??process.env,D=H.shellPath??$z(K)}catch(j){throw N(),j}return await new Promise((j,C)=>{let F=null,$=null,B=!1,I=!1,X=!1,U=null,_=0,x=0,O=[],S=0,T=null,G=(Z)=>{if(X)return;if(X=!0,T)clearTimeout(T);z.signal.removeEventListener("abort",b);try{F?.kill()}catch{}try{$?.close(1000,"pty_session_over")}catch{}if(N(),Z.kind==="rejected"){C(Z.error);return}let W={reason:Z.reason,exit_code:U,output_bytes:_,input_bytes:x,duration_ms:Math.max(0,Q()-Y)};z.emitEvent("pty.stopped",{...W}).catch(()=>{return}),j({...W})},b=()=>{let Z=z.signal.reason;G({kind:"rejected",error:Z instanceof V?Z:new V("cancelled","Reason closed the terminal session.")})};if(z.signal.aborted){b();return}z.signal.addEventListener("abort",b,{once:!0}),T=setTimeout(()=>G({kind:"resolved",reason:"session_expired"}),Math.max(1,Date.parse(J.expires_at)-Q()));let u=(Z)=>{if(_+=Z.byteLength,!B||!$){if(O.push(Z),S+=Z.byteLength,S>v)G({kind:"resolved",reason:"output_backpressure"});return}try{$.send(Z)}catch{G({kind:"resolved",reason:"relay_closed"});return}if($.bufferedAmount>v)G({kind:"resolved",reason:"output_backpressure"})};try{F=(H.spawnPty??Gz)({shell:D,args:["-i","-l"],cwd:R,cols:J.cols,rows:J.rows,environment:K,onData:(Z)=>{if(!X)u(Z)}})}catch(Z){G({kind:"rejected",error:Z instanceof V?Z:new V("pty_spawn_failed","Reason could not start the terminal shell.")});return}F.exited.then((Z)=>{if(X)return;if(U=Z,B&&$)try{$.send(JSON.stringify({t:"exit",code:Z}))}catch{}G({kind:"resolved",reason:"shell_exited"})});let a=(H.loadProxy??d)()?.url;try{$=(H.connect??Nz)(J.relay_url,a)}catch{G({kind:"rejected",error:new V("pty_relay_unavailable","Reason could not reach the terminal relay.")});return}$.binaryType="arraybuffer",$.onopen=()=>{if(X||!$)return;B=!0;try{$.send(JSON.stringify({t:"open",cols:J.cols,rows:J.rows}));for(let Z of O.splice(0))$.send(Z);S=0}catch{G({kind:"resolved",reason:"relay_closed"});return}I=!0,z.emitEvent("pty.ready",{session_id:J.session_id,cols:J.cols,rows:J.rows}).catch(()=>{return})},$.onmessage=(Z)=>{if(X||!F)return;let W=Z.data;if(typeof W==="string"){let L;try{L=JSON.parse(W)}catch{return}if(!r(L))return;if(L.t==="resize"){try{F.resize(g(L.cols,J.cols),g(L.rows,J.rows))}catch{}return}if(L.t==="close")G({kind:"resolved",reason:"client_closed"});return}let q=W instanceof ArrayBuffer?new Uint8Array(W):ArrayBuffer.isView(W)?new Uint8Array(W.buffer,W.byteOffset,W.byteLength):null;if(!q||q.byteLength===0)return;x+=q.byteLength;try{F.write(q)}catch{}},$.onclose=()=>{if(X)return;if(!I){G({kind:"rejected",error:new V("pty_relay_unavailable","Reason could not reach the terminal relay.")});return}G({kind:"resolved",reason:"relay_closed"})},$.onerror=()=>{if(X||I)return;G({kind:"rejected",error:new V("pty_relay_unavailable","Reason could not reach the terminal relay.")})}})}
-export{h as mg,zz as ng,v as og,Hz as pg,Vz as qg,y as rg,$z as sg,Bz as tg,Gz as ug,Nz as vg,Iz as wg};

package/bin/vm-hands/vm-hands-entry-lite-e0gdt6r5.js

@@ -1,5 +0,0 @@
-// @bun
-import{Cf as OJ,Oe as LJ,We as gJ,Xe as EJ,Ye as VJ}from"./vm-hands-entry-lite-5n4vsm6b.js";import{createHash as m,randomBytes as KJ}from"crypto";import{closeSync as MJ,fsyncSync as DJ,mkdirSync as oJ,openSync as qJ,renameSync as dJ,rmSync as iJ,statSync as _J,writeSync as xJ,constants as R}from"fs";import{join as a}from"path";var rJ=1;var n=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function FJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new W("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function jJ(J,Z){let{payload:z,authority:Q}=J;if(!z||typeof z!=="object"||Array.isArray(z)||!Q||typeof Q!=="object"||Array.isArray(Q)||!Z.deviceId||!Z.rootId||z.run_id!==Z.runId||z.device_id!==Z.deviceId||Q.device_id!==Z.deviceId||z.root_id!==Z.rootId||Z.snapshotId!==void 0&&z.snapshot_id!==Z.snapshotId)throw new W("vm_hands_env_invalid","environment does not match this Hands");return z}function AJ(J){if(J.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not a hands.connect claim");let Z=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Z.workspace_id==="string"&&n.test(Z.workspace_id)?Z.workspace_id:J.run_id,brain_generation:Z.target_generation,fence_id:Z.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Z.hands_confinement??""),browser_egress:Z.browser_egress??null,policy_digest:Z.vm_hands_policy_digest},cwd:typeof Z.cwd==="string"?Z.cwd:"",claim:J,env:FJ(J)?J.environment_sealed:null,workspace_deferred:sJ(J)}}function sJ(J){let Z=J.payload[EJ];if(Z===void 0)return!1;if(Z!==!0||J.payload.vm_hands_env_deferred!==!0||J.environment_sealed!==void 0)throw new W("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class W extends Error{code;constructor(J,Z){super(Z);this.code=J}}var y=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),b=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function c(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(c).join(",")}]`;return`{${Object.keys(J).sort().map((Z)=>`${JSON.stringify(Z)}:${c(J[Z])}`).join(",")}}`}async function DZ(J){let Z=await crypto.subtle.importKey("pkcs8",b(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),z=b(J.device_key.spki),Q=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),L=new Uint8Array(await crypto.subtle.exportKey("spki",Q.publicKey)),j=m("sha256").update(z).digest("base64url");return{signing:{privateKey:Z},agreement:Q,signingSpki:z,agreementSpki:L,fingerprint:j}}var aJ=4;class nJ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;grants=new Map;structural=Promise.resolve();exclusive(J){let Z=this.structural.then(J,J);return this.structural=Z.catch(()=>{return}),Z}constructor(J,Z,z,Q){this.init=J;this.keys=Z;this.hooks=z;this.options=Q;if(!n.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new W("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new W("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Z of this.bound.values())if(Z.runId===J)return!0;return!1}bindIdForRun(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Z,z){for(let Q=Date.now()+Z;;){let L=this.bound.get(J);if(!L)return!1;if(L.envInstalled)return!0;if(Date.now()>=Q||z?.aborted)return!1;await new Promise((j)=>setTimeout(j,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(J){for(let Z of this.bound.values())if(Z.runId===J)return Z.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new W("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new W("vm_hands_challenge_invalid","bad register challenge");let Z={challenge:J,t:"register",v:rJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:y(this.keys.signingSpki),env_public_key:y(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:y(KJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},z=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(c(Z)));return{...Z,device_signature:y(z)}}async helloFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","hello before register");let z=String((this.options.now??Date.now)()),Q=y(KJ(32)),L=OJ({method:"GET",pathAndQuery:LJ,timestamp:z,nonce:Q,challenge:J,bodySha256:m("sha256").update("").digest("hex")}),j=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(L)));return{t:"hello",timestamp:z,nonce:Q,signature:y(tJ(j)),...Z?{vm_hands_previous_connection:Z}:{}}}registered(){if(this.identity!=="identity_free")throw new W("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new W("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new W("vm_hands_bind_invalid","bad bind");for(let z of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!n.test(z))throw new W("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new W("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new W("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new W("vm_hands_bind_invalid","bad policy or nonce");if(m("sha256").update(c({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new W("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some((z)=>z.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new W("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=aJ)throw new W("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new W("vm_hands_busy","a bind waits for its workspace beside the setup");if(J.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new W("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),J.workspace_deferred){let z,Q,L=new Promise((j,U)=>{z=j,Q=U});L.catch(()=>{return}),this.grants.set(J.bind_id,{promise:L,resolve:z,reject:Q})}return this.exclusive(()=>this.setUp(J))}async setUp(J){let Z=[...this.bound.keys()],z=null,Q=!1,L=this.grants.get(J.bind_id);try{if(L&&(Z.length||this.commandsSinceVerified))throw new W("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(Z.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new W("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Z}),this.unverified.clear();this.servedRun=!0,Q=!0;let{launchId:j,applied:U,readyData:D}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim,...L?{workspaceGrant:L.promise}:{}}),_=this.hooks.restatLayout();this.hooks.verifyMounts?.();let A=null,q=null;if(J.env){let v=J.claim?.owner??{},V=jJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof v.device_id==="string"?v.device_id:"",rootId:J.claim?.root_id??""});this.commandsSinceVerified=!0,A=this.hooks.installEnvironment(J.bind_id,V),q=typeof V.snapshot_id==="string"&&V.snapshot_id?V.snapshot_id:null,z=this.writeJobEnvRootOnly(J.bind_id,V)}if(this.unbinding.has(J.bind_id))throw new W("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:j,envInstalled:A!==null,rootId:J.claim?.root_id??"",envDirectory:z}),this.binding.delete(J.bind_id),this.grants.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:j,snapshot_revision:A,snapshot_id:q,layout:_,...D?{ready_data:D}:{},policy_digest:m("sha256").update(c({hands_confinement:U.hands_confinement??null,browser_egress:U.browser_egress??null})).digest("hex")}}catch(j){if(z)GJ(z);if(Q){let D=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:D,own:!0}).catch(()=>{this.unverified.add(J.bind_id)})}this.binding.delete(J.bind_id),this.grants.delete(J.bind_id);let U=j&&typeof j==="object"&&"code"in j&&typeof j.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(j.code)?j.code:"vm_hands_bind_failed";throw j instanceof W?j:new W(U,"executor refused the bind")}}grantWorkspace(J){let Z=this.grants.get(J);if(!Z)throw new W("vm_hands_not_binding","no pre-bind waits for a workspace grant");Z.resolve()}abandonWorkspaceGrant(J){this.grants.get(J)?.reject(new W("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(J){let Z=this.bound.get(J.attemptId);if(!Z||this.unbinding.has(J.attemptId))throw new W("vm_hands_not_bound","environment delivered while not bound");if(!n.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new W("vm_hands_env_invalid","bad snapshot id");let z=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==z)throw new W("vm_hands_env_invalid","bad env envelope");let Q=jJ(await this.openSealed(J.sealed,z),{runId:Z.runId,deviceId:J.deviceId,rootId:Z.rootId,snapshotId:J.snapshotId});this.commandsSinceVerified=!0;let L=this.hooks.installEnvironment(Z.bindId,Q);if(Z.envInstalled=!0,Z.envDirectory)GJ(Z.envDirectory);return Z.envDirectory=null,Z.envDirectory=this.writeJobEnvRootOnly(`${Z.bindId}-r${L}`,Q),{snapshot_id:J.snapshotId,installed_revision:L,installed:!0}}async attestFrame(J,Z){if(this.identity==="identity_free")throw new W("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new W("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new W("vm_hands_attest_invalid","attest beside a bind");let z=await this.hooks.runProbe({nonce:Z,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Z,exit_code:z.exitCode,markers:z.markers,proof_dir_inode:z.proofDirInode,script_sha256:m("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Z=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),this.abandonWorkspaceGrant(J),Z)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Z))}async tearDown(J,Z){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((L)=>L!==J),Q=!z.length&&!this.commandsSinceVerified;try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:Q?{bindId:J,own:!0}:void 0)}catch(L){throw this.unverified.add(J),L}if(!z.length)this.unverified.clear(),this.commandsSinceVerified=!1;if(Z?.envDirectory)GJ(Z.envDirectory);return{bind_id:Z?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Z){let z=()=>{throw new W("vm_hands_env_invalid","env did not decrypt")},Q=await crypto.subtle.importKey("spki",b(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(z),L=await crypto.subtle.deriveKey({name:"ECDH",public:Q},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),j=await crypto.subtle.decrypt({name:"AES-GCM",iv:b(J.iv),additionalData:new TextEncoder().encode(Z)},L,b(J.ct)).catch(z),U=JSON.parse(new TextDecoder().decode(j));if(!U||typeof U!=="object"||Array.isArray(U))throw new W("vm_hands_env_invalid","env not an object");return U}writeJobEnvRootOnly(J,Z){let z=a(this.options.envRoot,`bind-${J}`);oJ(z,{mode:448});let Q=_J(z);if(!Q.isDirectory()||(Q.mode&63)!==0||Q.uid!==(process.getuid?.()??-1))throw new W("vm_hands_env_dir_unsafe","env directory is not root's 0700");let L=Z.variables&&typeof Z.variables==="object"?Z.variables:{},j=Object.entries(L).filter(([_,A])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(_)&&typeof A==="string").map(([_,A])=>`export ${_}='${String(A).replaceAll("'","'\\''")}'`).join(`
-`)+`
-`,U=a(z,`.job.env.${KJ(8).toString("hex")}`),D=qJ(U,R.O_WRONLY|R.O_CREAT|R.O_EXCL|R.O_NOFOLLOW,384);try{xJ(D,j),DJ(D)}finally{MJ(D)}return dJ(U,a(z,"job.env")),z}}function GJ(J){try{let Z=a(J,"job.env"),z=_J(Z).size,Q=qJ(Z,R.O_WRONLY|R.O_NOFOLLOW);try{xJ(Q,Buffer.alloc(z)),DJ(Q)}finally{MJ(Q)}}catch{}iJ(J,{recursive:!0,force:!0})}function tJ(J){if(J.length!==64)throw new W("vm_hands_signature_invalid","unexpected ECDSA signature length");let Z=(L)=>{let j=0;while(j<L.length-1&&L[j]===0)j++;let U=L.subarray(j),D=U[0]&128?Uint8Array.of(0,...U):U;return Uint8Array.of(2,D.length,...D)},z=Z(J.subarray(0,32)),Q=Z(J.subarray(32));return Uint8Array.of(48,z.length+Q.length,...z,...Q)}import{randomUUID as eJ}from"crypto";var JZ="/app/local-runtime/session?register=vm_hands_v1",ZZ="/app/local-runtime",TJ=25000,wJ=20000,$Z=1e4,vJ=5000,hJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),WJ=75000,zZ=2000,QZ=1e4,XZ=new Set(["vm_hands_no_register","vm_hands_register_failed"]),YZ=3,KZ=20000,GZ=250,FZ=2000;function HJ(J){let Z=Math.min(GZ*2**(J-1),FZ);return Math.round(Z/2+Math.random()*Z/2)}var WZ=5000;function NZ(J){return J>=500||J===408||J===429}var t=20000;function SJ(J,Z){return typeof J==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(J)?J:Z}class g extends Error{}var PZ=64;async function IJ(J,Z){let z=[...J.modelOps.get(Z)??[]];for(let Q of z)Q.abort.abort();await Promise.race([Promise.all(z.map((Q)=>Q.settled)),new Promise((Q)=>setTimeout(Q,vJ))])}async function UZ(J){let Z=[...J.personTerminals];for(let z of Z)z.abort.abort();if(Z.length)await Promise.race([Promise.all(Z.map((z)=>z.settled)),new Promise((z)=>setTimeout(z,vJ))]);return Z.length}async function p(J,Z,z){return await IJ(J,z),Z.unbind(z)}function e(J){for(let Z of J.outbox?.splice(0)??[])Z.reject(Error("vm_hands_attempt_ended"))}var kJ=15000,CZ=1e4,BZ=1000;async function wZ(J){let Z=Date.now(),z={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:0},Q=J.log??(()=>{}),L=async(D)=>{for(let[_,A]of[...z.turns]){z.turns.delete(_),J.onTurn?.(_,null),e(A);let q=await p(z,J.agent,_).catch(()=>null);if(q)z.receipts.push({turn:A,failure:"vm_hands_bind_lost",unbound:q});Q("vm_hands.bound_dropped",{reason:D})}},j=0,U=0;try{for(let D=0;!J.signal.aborted;D++){let _=await jZ(J,z).catch((q)=>{if(q instanceof W&&z.deviceId===null&&q.code==="vm_hands_no_session"&&Date.now()-Z<QZ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(q instanceof W&&z.deviceId===null&&XZ.has(q.code)&&j<YZ&&Date.now()-Z<KZ)return j++,U=HJ(j),Q("vm_hands.register_retry",{attempt:j,code:q.code,delay_ms:U}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(q instanceof W&&z.deviceId===null)throw q;return{closeCode:0,closeReason:q instanceof Error?q.message:String(q)}});if(Q("vm_hands.session_closed",{close_code:_.closeCode,reason:_.closeReason.slice(0,120),registered:z.deviceId!==null}),_.closeCode===4401||z.attest==="refused")return;if(J.signal.aborted)return;if(z.turns.size&&Date.now()-z.lostAt>=WJ)await L("reconnect_deadline");if(z.served)z.served=!1,D=0;let A=_.closeReason==="drain_reconnect"?0:_.closeReason==="vm_hands_register_retry"?U:_.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(D,5),2000):z.turns.size?Math.min(250*2**Math.min(D,5),5000,Math.max(0,z.lostAt+WJ-Date.now())):Math.min(500*2**D,30000);if(await new Promise((q)=>setTimeout(q,A)),z.turns.size&&Date.now()-z.lostAt>=WJ)await L("reconnect_deadline")}}finally{await L("session_ended")}}async function jZ(J,Z){let z=Z.deviceId,Q=J.log??(()=>{}),L=z?`/app/local-runtime/session?device_id=${encodeURIComponent(z)}`:JZ,j=`${J.apiOrigin.replace(/^http/,"ws")}${L}`,U=new WebSocket(j),D=0,_="",A=new Map,q=[],v=null,V=new Promise(($)=>{U.onclose=(K)=>{D=K.code,_=K.reason;for(let X of A.values())X.reject(new g(`session closed ${K.code}`));for(let X of Z.attestWaiters.splice(0))X(!1);A.clear(),$()}});U.onmessage=($)=>{let K;try{K=JSON.parse(String($.data))}catch{U.close(4400);return}if(K.t==="res"){let X=K;A.get(X.id)?.resolve({status:X.status,body:X.body}),A.delete(X.id);return}if(K.t==="reconnect"){let X=Math.max(0,Math.min(Number(K.after_ms)||0,BZ));Q("vm_hands.drain_reconnect",{after_ms:X}),setTimeout(()=>{try{U.close(4001,"drain_reconnect")}catch{}},X).unref?.();return}if(!v?.(K))q.push(K)};let l=($,K)=>new Promise((X,F)=>{let P=q.findIndex((B)=>$.includes(B.t));if(P>=0){X(q.splice(P,1)[0]);return}let C=setTimeout(()=>{v=null,F(new W("vm_hands_no_register",`no ${$.join("/")} in ${K} ms`))},K);v=(B)=>{if(!$.includes(B.t))return!1;return clearTimeout(C),v=null,X(B),!0}}),u=($)=>U.send(JSON.stringify($)),S=($,K)=>new Promise((X,F)=>{if(U.readyState!==WebSocket.OPEN){F(new g("session closed"));return}let P=eJ(),C=typeof K.wait_ms==="number"?K.wait_ms:0,B=setTimeout(()=>{if(!A.delete(P))return;F(new g(`no answer to ${$.split("/").pop()} in ${C+kJ} ms`)),U.close(4000,"request_timeout")},C+kJ);A.set(P,{reject:(Y)=>{clearTimeout(B),F(Y)},resolve:({status:Y,body:G})=>{clearTimeout(B);let N=null;try{N=G?JSON.parse(G):null}catch{}X({status:Y,json:N})}}),u({t:"req",id:P,path:`${ZZ}${$}`,body:JSON.stringify(K)})}),NJ=()=>U.close(1001,"stopping");J.signal.addEventListener("abort",NJ,{once:!0});let JJ,o=new Map,d=new Map,ZJ=!1,$J=new Set,zJ=new Set,QJ=Promise.resolve(),i=!1;try{await new Promise((Y,G)=>{let N=setTimeout(()=>G(Error("session open timeout")),CZ);U.onopen=()=>{clearTimeout(N),Q("vm_hands.ws_open",{}),Y()},U.onerror=()=>{clearTimeout(N),G(Error("session socket error"))}});let $=await l(["challenge"],5000);Q("vm_hands.challenge",{});let K=[],X=null,F;if(z){u(await J.agent.helloFrame($.challenge,Z.connection));let Y=await l(["ready"],1e4);if(typeof Y.vm_hands_connection==="string")Z.connection=Y.vm_hands_connection;if(F={device_id:z,...Y.cadence?{cadence:Y.cadence}:{}},typeof Y.vm_hands_probe_script==="string"){if(X=Y.vm_hands_probe_script,i=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,Q("vm_hands.reconnected",{device_id:z});let G=Array.isArray(Y.vm_hands_binds)?Y.vm_hands_binds:Y.vm_hands_bind?[Y.vm_hands_bind]:[];for(let[N,M]of[...Z.turns]){if(G.some((T)=>T&&T.operation_id===M.claim.operation_id&&T.attempt_id===M.claim.attempt_id)){K.push(M),Q("vm_hands.bound_resumed",{operation_id:M.claim.operation_id});continue}Z.turns.delete(N),J.onTurn?.(N,null),e(M);let x=await p(Z,J.agent,N).catch(()=>null);if(x)Z.receipts.push({turn:M,failure:"vm_hands_bind_lost",unbound:x});Q("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{u(await J.agent.registerFrame($.challenge)),Q("vm_hands.register_sent",{});let Y=await Promise.race([l(["registered","register_refused"],1e4),V.then(()=>{throw new W(_==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(Y.t==="register_refused")throw new W(Y.code,"register refused");J.agent.registered();let G=Y;if(F=G,Z.deviceId=G.device_id,typeof G.vm_hands_connection==="string")Z.connection=G.vm_hands_connection;if(typeof G.vm_hands_probe_script==="string"){if(X=G.vm_hands_probe_script,i=!0,J.agent.phase==="registered"&&!Z.turns.size)Z.attest="pending"}Z.served=!0,Q("vm_hands.registered",{device_id:F.device_id})}let P=async()=>{let Y=await S("/heartbeat",await J.heartbeat());if(Y.status>=300)throw Error(`heartbeat ${Y.status}`)};await P();let C=F.cadence?.presence_interval_ms??30000;if(JJ=setInterval(()=>{P().catch(()=>U.close())},C),X&&Z.attest!=="accepted"&&J.agent.phase==="registered"&&!Z.turns.size)RJ(X,$.challenge);let B=(Y,G)=>{d.set(Y,G().catch(async(N)=>{if(await PJ(N,Y),N instanceof g)U.close();else await XJ().catch(()=>{return})}).finally(()=>{d.delete(Y)}))};try{await XJ();for(let Y of K)Y.flush=()=>UJ(Y),Y.flush(),B(Y.claim.attempt_id,()=>CJ(Y));while(!J.signal.aborted&&U.readyState===WebSocket.OPEN){let Y=await S("/operations/claim",{wait_ms:Math.min(F.cadence?.claim_wait_ms??TJ,TJ)});if(Y.status===204||!Y.json)continue;if(Y.status>=300)throw Error(`claim ${Y.status}`);let G=Y.json;if(G.capability==="hands.connect"){if(d.has(G.attempt_id)){h({claim:G,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}B(G.attempt_id,()=>fJ(G))}else bJ(G).catch(()=>{return})}}catch(Y){await PJ(Y,null)}}finally{if(JJ)clearInterval(JJ);J.signal.removeEventListener("abort",NJ);for(let $ of Z.turns.values())$.flush=null;U.close(),await V,await Promise.all([...d.values()]);for(let $ of J.agent.liveBindIds){if(Z.turns.has($))continue;let K=await p(Z,J.agent,$).catch(()=>null),X=o.get($);if(K&&X)Z.receipts.push({turn:{...X,eventSeq:X.eventSeq+1},failure:"vm_hands_bind_lost",unbound:K});Q("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let $ of $J)$.abort()}return{closeCode:D,closeReason:_};async function PJ($,K){if($ instanceof g){if(!ZJ&&Z.turns.size)Z.lostAt=Date.now();ZJ=!0}else{let X=K!==null?[K]:[...new Set([...Z.turns.keys(),...J.agent.liveBindIds])];if(K===null)ZJ=!0;for(let F of X){let P=Z.turns.get(F);if(Z.turns.delete(F),P)e(P),J.onTurn?.(F,null);if(J.agent.liveBindIds.includes(F)){let C=await p(Z,J.agent,F).catch(()=>null),B=o.get(F)??P;if(C&&B)Z.receipts.push({turn:{...B,eventSeq:B.eventSeq+1},failure:"vm_hands_bind_lost",unbound:C})}}}Q("vm_hands.session_lost",{error:$ instanceof Error?$.message:String($),bound_kept:Z.turns.size})}function h($){let K=$.claim,X={attempt_id:K.attempt_id,attempt_token:K.attempt_token},F=encodeURIComponent(K.operation_id);return{fence:X,op:F,complete:(C,B={})=>S(`/operations/${F}/complete`,{...X,status:C,...B}),emit:(C,B)=>{let Y=($.chain??Promise.resolve()).catch(()=>{return}).then(()=>P(C,B));return $.chain=Y,Y}};async function P(C,B){let Y=$.eventSeq,G=(T)=>S(`/operations/${F}/events`,{...X,event_seq_start:T,events:[{kind:C,payload:{sequence:T,capability:String(K.capability??"hands.connect"),data:B}}]}),N=Y,M=await G(N),x=M.status===409?M.json?.expected_event_seq:void 0;if(typeof x==="number"&&x===Y+1)M={status:200,json:{duplicate:!0}};else if(typeof x==="number"&&x>=0&&x!==Y)N=x,M=await G(N);if(M.status<300)$.eventSeq=N+1;return M}}function yJ($){return(K,X)=>new Promise((F,P)=>{if(Z.turns.get($.claim.attempt_id)!==$){P(Error("vm_hands_attempt_ended"));return}if($.outbox??=[],$.outbox.length>=PZ){P(Error("vm_hands_outbox_full"));return}$.outbox.push({kind:K,data:X,resolve:F,reject:P}),$.flush?.()})}function UJ($){if(zJ.has($))return;zJ.add($),(async()=>{try{while($.outbox?.length&&Z.turns.get($.claim.attempt_id)===$&&U.readyState===WebSocket.OPEN){let K=$.outbox[0],X;try{X=await h($).emit(K.kind,K.data)}catch(F){if(F instanceof g)return;X={status:500}}if($.outbox.shift(),X.status<300)K.resolve();else K.reject(Error(`${K.kind} refused ${X.status}`))}}finally{zJ.delete($)}})()}async function RJ($,K){try{let X=await J.agent.attestFrame($,K);if(U.readyState!==WebSocket.OPEN)return;u(X);let F=await l(["attested","attest_refused"],15000);Z.attest=F.t==="attested"?"accepted":"refused";for(let P of Z.attestWaiters.splice(0))P(Z.attest==="accepted");if(Q("vm_hands.attest",{result:Z.attest,exit_code:X.exit_code,...F.t==="attest_refused"?{code:String(F.code??"")}:{}}),Z.attest==="refused")U.close(4401,"attest_refused")}catch(X){Q("vm_hands.attest_failed",{code:X instanceof W?X.code:"probe_error"});for(let F of Z.attestWaiters.splice(0))F(!1);if(Z.attest!=="accepted")U.close(4000,"attest_unanswered")}}async function fJ($){let K=i&&Z.attest==="pending",X=$.vm_hands_attest,F=X;if(Z.attest==="refused"){Q("vm_hands.claim_attest_refused",{said:typeof X==="string"?X.slice(0,16):typeof X,local:Z.attest}),await h({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(F==="accepted"){if(!K&&Z.attest!=="accepted"){Z.attest="accepted";for(let E of Z.attestWaiters.splice(0))E(!0)}}else if(F!=="pending"||!K&&Z.attest!=="accepted"){Q("vm_hands.claim_attest_refused",{said:typeof X==="string"?X.slice(0,16):typeof X,local:Z.attest}),await h({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Z.attest!=="accepted"){let E=Date.parse($.lease_until)-Date.now()-5000,k=Math.max(0,Math.min(t,Number.isFinite(E)?E:t));if(!await new Promise((s)=>{let lJ=setTimeout(()=>s(!1),k);Z.attestWaiters.push((uJ)=>{clearTimeout(lJ),s(uJ)})})){await h({claim:$,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let P={claim:$,eventSeq:0},{complete:C,emit:B}=h(P),Y;try{if($.capability!=="hands.connect")throw new W("vm_hands_bind_invalid","not hands.connect");Y=!FJ($)}catch(E){Q("vm_hands.bind_refused",{code:E instanceof W?E.code:"unexpected"}),await C("failed",{error_code:E instanceof W?E.code:"vm_hands_bind_invalid"});return}let G,N=null,M=!1;Z.bindsStarting++;try{let E=await UZ(Z);if(E)Q("vm_hands.person_terminals_closed",{count:E});let k=AJ($),r=J.agent.bind(k);if(k.workspace_deferred)M=!0,N=mJ(P,()=>M);G=await r}catch(E){Q("vm_hands.bind_refused",{code:E instanceof W?E.code:"unexpected"}),await C("failed",{error_code:E instanceof W?E.code:"vm_hands_bind_failed"});return}finally{M=!1,Z.bindsStarting--}let x=N?await N:-1,T={...G.ready_data??J.readyData({launchId:G.launch_id,claim:$})};if(Y)delete T.environment_installed;let YJ=!Y&&G.snapshot_revision!==null&&G.snapshot_id!==null?{environment_installed:{snapshot_id:G.snapshot_id,installed_revision:G.snapshot_revision}}:{};o.set($.attempt_id,{claim:$,launchId:G.launch_id,readyData:T,eventSeq:P.eventSeq,ackSeq:-1});let H={...T,...YJ,vm_hands:{layout:G.layout,policy_digest:G.policy_digest,launch_id:G.launch_id}},f=Date.now()+WZ,I=1,O=await B("hands.ready",H);while(NZ(O.status)&&!J.signal.aborted){let E=HJ(I);if(Date.now()+E>=f)break;await new Promise((k)=>setTimeout(k,E)),I++,O=await B("hands.ready",H)}if(I>1)Q("vm_hands.ready_retried",{attempts:I,status_class:`${Math.floor(O.status/100)}xx`});if(o.delete($.attempt_id),O.status>=300){await IJ(Z,$.attempt_id),await J.agent.boundRefused($.attempt_id),await C("failed",{error_code:SJ(O.json?.error,"vm_hands_probe_failed")});return}let w={claim:$,launchId:G.launch_id,readyData:T,eventSeq:P.eventSeq,ackSeq:x};Z.turns.set($.attempt_id,w),w.flush=()=>UJ(w),J.onTurn?.($.attempt_id,yJ(w)),await CJ(w)}async function mJ($,K){let{fence:X,op:F}=h($),P=$.claim.attempt_id,C=-1;try{for(;;){let B=await S(`/operations/${F}/heartbeat`,{...X,control_ack_seq:C,wait_ms:wJ});if(!K())return C;if(B.status>=300)return J.agent.abandonWorkspaceGrant(P),C;let Y=(B.json?.controls??[]).slice().sort((G,N)=>G.seq-N.seq);for(let G of Y){if(G.seq<=C)continue;if(C=G.seq,G.kind===VJ)return Q("vm_hands.workspace_granted",{}),J.agent.grantWorkspace(P),C;return Q("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(G.kind)?G.kind:"other"}),J.agent.abandonWorkspaceGrant(P),C}}}catch{return J.agent.abandonWorkspaceGrant(P),C}}async function CJ($){let{fence:K,op:X}=h($),F=null,P=null,C=J.agent.executorExited($.claim.attempt_id).then((B)=>{return P=B,null});J:for(;;){let B=await Promise.race([C,S(`/operations/${X}/heartbeat`,{...K,control_ack_seq:$.ackSeq,wait_ms:wJ})]);if(!B){F="vm_hands_executor_exited",Q("vm_hands.executor_exited",{reason:P});break}if(B.status>=300)break;let Y=(B.json?.controls??[]).slice().sort((G,N)=>G.seq-N.seq);for(let G of Y){if(G.seq<=$.ackSeq)continue;if(G.kind==="operation.cancel"||G.kind==="cancel"){$.ackSeq=G.seq;break J}if(G.kind===gJ)try{await pJ($,G.payload??{})}catch(N){if(N instanceof g)throw N;F=N instanceof W?N.code:"environment_unavailable";let M=N&&typeof N==="object"&&"code"in N&&typeof N.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(N.code)?N.code:null;Q("vm_hands.environment_refused",{code:F,cause:M});break J}$.ackSeq=G.seq}}await cJ($,F)}async function bJ($){let K=$,X={claim:K,eventSeq:0},{complete:F,emit:P,fence:C,op:B}={...h(X)},Y=$.vm_hands_origin==="person"?"person":"model",G=String($.capability??"");if(!J.executeOp){await F("failed",{error_code:"vm_hands_op_unsupported"});return}if($.vm_hands_attest==="accepted"&&Z.attest==="pending"&&!(i&&Z.attest==="pending")){Z.attest="accepted";for(let O of Z.attestWaiters.splice(0))O(!0)}if(Z.attest!=="accepted"){let O=Date.parse(String($.lease_until??""))-Date.now()-5000,w=Z.attest==="refused"?0:Math.max(0,Math.min(t,Number.isFinite(O)?O:t));if(!(w>0&&await new Promise((k)=>{let r=setTimeout(()=>k(!1),w);Z.attestWaiters.push((s)=>{clearTimeout(r),k(s)})}))){await F("failed",{error_code:"vm_hands_unattested"});return}}let N=J.agent.bindIdForRun(K.run_id);if(Y==="model"&&N===null){await F("failed",{error_code:"vm_hands_not_bound"});return}let M=G==="pty.start"&&Y==="person"&&!$.authority;if(M&&(J.agent.liveBindIds.length>0||Z.bindsStarting>0)){await F("failed",{error_code:"vm_hands_bound"});return}if(hJ.has(G)&&!M&&J.agent.liveBindIds.length===0){await F("failed",{error_code:"vm_hands_not_bound"});return}if(Y==="model"&&N||hJ.has(G)&&!M)J.agent.opServed();let x=new AbortController;$J.add(x);let T,YJ=new Promise((O)=>{T=O}),H={abort:x,settled:YJ};if(M)Z.personTerminals.add(H);if(Y==="model"&&N){let O=Z.modelOps.get(N)??new Set;O.add(H),Z.modelOps.set(N,O),await J.agent.environmentInstalled(N,zZ,x.signal)}let f=-1,I=setInterval(()=>{S(`/operations/${B}/heartbeat`,{...C,control_ack_seq:f,wait_ms:0}).then((O)=>{if(O.status>=300){x.abort();return}let w=O.json?.controls??[];for(let E of w)if(f=Math.max(f,E.seq),E.kind==="operation.cancel"||E.kind==="cancel")x.abort()},()=>x.abort())},$Z);try{let O=await J.executeOp({kind:Y,claim:$,...Y==="model"&&N?{bindId:N}:{},signal:x.signal,emit:async(E)=>{await P(E.kind,E.data??{})}}),w=await F(O.status,{...O.result?{result:O.result}:{},...O.error_code?{error_code:SJ(O.error_code,"vm_hands_op_failed")}:{}});Q("vm_hands.op",{capability:G,kind:Y,status:O.status,code:O.error_code??null,...w.status>=300?{complete_status:w.status,complete_error:String(w.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval(I),$J.delete(x),N)Z.modelOps.get(N)?.delete(H);Z.personTerminals.delete(H),T()}}async function cJ($,K){let X=$.claim.attempt_id;if(Z.turns.get(X)===$)Z.turns.delete(X);J.onTurn?.(X,null),e($);let F=await p(Z,J.agent,X);Z.receipts.push({turn:$,failure:K,unbound:F}),await XJ()}function XJ(){return QJ=QJ.then(BJ,BJ),QJ}async function BJ(){while(Z.receipts.length){let{turn:$,failure:K,unbound:X}=Z.receipts[0],{complete:F,emit:P}=h($);try{if(await P("hands.stopped",{...$.readyData,reason_code:K?"failed":"cancelled",killed_verified:X.killed_verified,shredded:X.shredded,...X.srt_fallbacks?{vm_hands_srt_fallbacks:X.srt_fallbacks}:{}}),K)await F("failed",{error_code:K});else await F("cancelled",{error_code:"driver_stopped"})}catch(C){if(C instanceof g)return}Z.receipts.shift()}}async function pJ($,K){let{fence:X,op:F}=h($),P=K.snapshot_id;if(K.version!==1||typeof P!=="string"||Object.keys(K).length!==2)throw new W("vm_hands_env_invalid","invalid environment delivery");let C=await S(`/operations/${F}/environment`,{...X,snapshot_id:P}),B=C.json?.environment_sealed;if(C.status!==200||!B||C.json?.payload!==void 0)throw new W("vm_hands_env_invalid","environment not delivered sealed");let Y=await J.agent.deliverEnvironment({attemptId:$.claim.attempt_id,snapshotId:P,deviceId:Z.deviceId??"",sealed:B});if((await S(`/operations/${F}/environment-ack`,{...X,...Y})).status>=300)throw new W("vm_hands_env_ack_refused","environment ack refused")}}
-export{DZ as xa,nJ as ya,wZ as za};

package/bin/vm-hands/vm-hands-entry-lite-r8qg3wp1.js

@@ -1,3 +0,0 @@
-// @bun
-import{Dk as D}from"./vm-hands-entry-lite-f5230h6t.js";import{execFileSync as M}from"child_process";import{realpathSync as C,statSync as N}from"fs";import{tmpdir as U}from"os";import{createRequire as F}from"module";import{win32 as Z}from"path";var j=["/bin/bash","/usr/bin/bash"],I="Git Bash was not found. Install Git for Windows (https://git-scm.com/download/win), then run `reason connect`.";function k(K){try{return N(K).isFile()}catch{return!1}}var q=(K)=>[Z.join(K,"bin","bash.exe"),Z.join(K,"usr","bin","bash.exe")];function J(K,Q){let L=Z.normalize(K).toLowerCase(),Y=(Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows").toLowerCase();return L.startsWith(Z.join(Y,"system32").toLowerCase()+"\\")||L.startsWith(Z.join(Y,"sysnative").toLowerCase()+"\\")||L.includes("\\windowsapps\\")}function u(K=process.env,Q=k){let L=[];for(let Y of(K.PATH??K.Path??"").split(";"))if(Y&&Z.isAbsolute(Y))L.push(Z.join(Y,"git.exe"));for(let Y of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if(Y)L.push(Z.join(Y,"Git","cmd","git.exe"));if(K.LOCALAPPDATA)L.push(Z.join(K.LOCALAPPDATA,"Programs","Git","cmd","git.exe"));return L.find(Q)??null}var T;function S(K=process.platform){if(K!=="win32")return"git";return T??=u(),T}function O(K){let Q=process.platform==="win32"?u(K):"git";if(!Q)return null;try{return M(Q,["--exec-path"],{encoding:"utf8",timeout:5000,windowsHide:!0,stdio:["ignore","pipe","ignore"],env:K}).trim()||null}catch{return null}}function P(K=process.env,Q=O,L=k){let Y=[],H=Q(K);if(H)Y.push(...q(Z.resolve(H,"..","..","..")));for(let $ of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if($)Y.push(...q(Z.join($,"Git")));if(K.LOCALAPPDATA)Y.push(...q(Z.join(K.LOCALAPPDATA,"Programs","Git")));for(let $ of(K.PATH??K.Path??"").split(";"))if($&&Z.isAbsolute($))Y.push(Z.join($,"bash.exe"));return Y.find(($)=>!J($,K)&&L($))??null}var z;function G(K=process.platform){if(K!=="win32")return j.find(k)??null;return z??=P(),z}function y(K=process.platform){let Q=G(K);if(!Q)throw Error(K==="win32"?I:"bash_unavailable");return Q}function w(K=process.platform){return C(K==="win32"?U():"/tmp")}function X(K=process.platform,Q=process.env){if(K!=="win32")return"/usr/bin:/bin";let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return[Z.join(L,"System32"),L,Z.join(L,"System32","Wbem"),Z.join(L,"System32","WindowsPowerShell","v1.0")].join(";")}function W(K,Q=process.platform){if(Q!=="win32"||/[\\/]/.test(K))return K;let L=/\.exe$/i.test(K)?K:`${K}.exe`,Y=X(Q).split(";");return Z.join(L.toLowerCase()==="powershell.exe"?Y[3]:Y[0],L)}function f(K=process.platform,Q=process.env){if(K!=="win32")return{PATH:X(K)};let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return{PATH:X(K,Q),SystemRoot:L,WINDIR:L}}function h(K=process.platform){return K==="win32"?{windowsHide:!0}:{detached:!0}}var V;function A(){if(V===void 0)V=Function("require",`return ${D}(require)`)(F(import.meta.url));return V}function v(K,Q=process.platform){let L=K.pid;if(Q!=="win32"||L===void 0)return;let Y=A();if(Y?.track(L))K.once("close",()=>Y.release(L))}function c(K,Q="SIGTERM",L=process.platform){if(L!=="win32"){process.kill(-K,Q);return}if(Q===0){process.kill(K,0);return}if(A()?.terminate(K))return;M(W("taskkill",L),["/PID",String(K),"/T","/F"],{stdio:"ignore",timeout:1e4,windowsHide:!0})}function p(K,Q=63,L=process.platform){return L==="win32"||K.uid===process.getuid?.()&&(K.mode&Q)===0}var _=/^(?:con|prn|aux|nul|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3]|conin\$|conout\$)(?:\..*)?$|:|[. ]$/i;function l(K){return K!=="."&&K!==".."&&_.test(K)}
-export{I as qk,S as rk,G as sk,y as tk,w as uk,X as vk,W as wk,f as xk,h as yk,v as zk,c as Ak,p as Bk,l as Ck};

package/bin/vm-hands/vm-hands-op-runner-4m334z7c.js

@@ -1,2 +0,0 @@
-// @bun
-import{s as a,t as b,u as c}from"./vm-hands-entry-lite-f7f1zb7s.js";import"./vm-hands-entry-lite-51hmj6am.js";import"./vm-hands-entry-lite-2t0vcvd8.js";export{b as spawnSessionPty,c as runVmHandsOpRunner,a as VM_HANDS_OP_RUNNER_PERSON_ARG};

package/bin/vm-hands/vm-hands-runtime-6ajffhfb.js

@@ -1,4 +0,0 @@
-// @bun
-import{xa as k,ya as m,za as l}from"./vm-hands-entry-lite-e0gdt6r5.js";import{Ie as u}from"./vm-hands-entry-lite-5n4vsm6b.js";import"./vm-hands-entry-lite-zjfr0zh8.js";import{Kk as G}from"./vm-hands-entry-lite-2t0vcvd8.js";import{spawn as r}from"child_process";import{createHash as i}from"crypto";import{lstatSync as T,mkdirSync as s,readFileSync as t,statSync as e,writeFileSync as d}from"fs";var P="/run/reason-vm-hands",O="/run/reason-vm-hands/env",x="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",p="/usr/local/bin/ara-srt-exec",qj=65536,Jj=21600000;function Qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let J=T(j);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}d(`${j}/base-keyed`,`1
-`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function R(Q,j){let J=(F)=>{return j("srt_warm_skipped",{reason:F}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>qj||Z.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");try{let F=T(S);if(!F.isDirectory()||F.uid!==0||(F.mode&18)!==0)return J("cgroup_unsafe");for(let[H,g]of[[p,!1],["/usr/local/bin",!0]]){let Y=T(H);if((g?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let X=performance.now(),z=i("sha256").update(Z).digest("hex"),W=`${P}/srt-base-settings.json`;try{d(W,Z,{mode:384,flag:"w"})}catch{return J("settings_write")}let M=r("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",p,"--settings",W,"--idle-ms",String(Jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((F)=>{M.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),F()}),M.once("close",(H)=>{j(H===0?"srt_warm_done":"srt_warm_failed",{exit_code:H,warm_ms:Math.round(performance.now()-X),settings_sha256:z}),F()})})}var y=3000;function Lj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,J=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function v(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Zj(Q){let[{CLI_VERSION:j},J,Z,X]=await Promise.all([import("./version-gyns0vgm.js"),import("./hands-worker-source-azdrrhsz.js"),import("./network-contract-dsw79qkc.js"),import("./device-workspace-0xsj5ykf.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-7d7xj1h3.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:u,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var V=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],$j=new Set(["pty.start","jobs.control"]);function Xj(Q,j){let J=j([{id:"vm-hands",label:"workspace",path:x,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(V.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of V)X[z]={...J.operation_constraints?.[z]??{},ready:!0,execution_mode:J.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...V],operation_constraints:X}}}function zj(Q){for(let j of t("/etc/passwd","utf8").split(`
-`)){let J=j.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let J=j.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:x,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Mj(Q,j){v(P),v(O),Qj(j);let J=R(Q,j),Z=!1,X=async()=>{if(!await Promise.race([J.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),y).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:y})},[{configureDesktopAccount:z},{configureWorkerSandbox:W}]=await Promise.all([import("./desktop-account-3tnm4z5w.js"),import("./worker-sandbox-tgqbmy6b.js")]);W();try{z({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let M=new AbortController;for(let q of["SIGTERM","SIGINT"])process.on(q,()=>M.abort());let F=new Map,H,g=new Promise((q)=>{H=q}),Y=g.then(()=>import("./vm-hands-executor-d8wkv51n.js")).then(({createVmHandsExecutor:q})=>{let $=q({init:Q,root:x,runtimeDirectory:P,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,J=R(Q,j)},srtWarmLate:()=>Z,forward:(B,K,N)=>F.get(B)?.(K,N)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),A=(q)=>async(...$)=>(await Y)[q](...$),C=null;Y.then((q)=>{C=($)=>q.executorExited($)});let L={startExecutor:async(...q)=>{return await X(),A("startExecutor")(...q)},killAndVerifyPayload:A("killAndVerifyPayload"),killProbe:A("killProbe"),runProbe:async(...q)=>{return await X(),A("runProbe")(...q)},restatLayout:()=>{throw Error("replaced below")},verifyMounts:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(q)=>C?C(q):new Promise(()=>{}),takeSrtFallbacks:()=>null};Y.then((q)=>{L.restatLayout=()=>q.restatLayout(),L.verifyMounts=()=>q.verifyMounts(),L.installEnvironment=($,B)=>q.installEnvironment($,B),L.freezeBind=($)=>q.freezeBind($),L.takeSrtFallbacks=()=>q.takeSrtFallbacks?.()??null});let c=await k(Q),o=new m(Q,c,L,{envRoot:O}),h=Zj(Q),b=null,n=Promise.all([h,import("./local-capabilities-cktbbszh.js")]).then(([q,$])=>{b=Xj(q,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((q)=>j("device_ops_unavailable",{error:q instanceof Error?q.name:"error"})),f=g.then(()=>import("./vm-hands-executor-d8wkv51n.js")).then(({createVmHandsOpRunners:q,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>q({payloadUid:Q.layout.payload_uid,payloadGid:zj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,N)=>j(K,N)})).catch(()=>null);f.then((q)=>q?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:o,signal:M.signal,heartbeat:async()=>b??await h,executeOp:async({kind:q,claim:$,bindId:B,signal:K,emit:N})=>{let w=Fj(Q,$);if(!w)return{status:"failed",error_code:"vm_hands_bind_invalid"};let E={executionMode:"unsandboxed",runtimeDirectory:P,readiness:Object.fromEntries(V.map((U)=>[U,!0]))},_=(U)=>{let D=typeof U.kind==="string"?U.kind:"";if(D)N({kind:D,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&q!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&q!=="model")return{status:"failed",error_code:"capability_not_granted"};let a=$.capability==="pty.start"&&q==="person"&&!$.authority;if($j.has(String($.capability))&&!a){let{executeLocalOperation:U}=await import("./local-capabilities-cktbbszh.js");return U(w,$,{worker:E,signal:K,emit:(D)=>_(D)})}let I=await f;if(!I)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return I.run(q,{id:String($.attempt_id),claim:$,state:w,worker:E},_,K,B)},readyData:({launchId:q})=>({executor_launch_id:q}),log:(q,$)=>{if(q==="vm_hands.registered"||q==="vm_hands.reconnected")H();j(q,$)},onTurn:(q,$)=>{if($)F.set(q,$);else F.delete(q)}}),await(await Y).stop(),(await f)?.stop()}export{R as startBaseSrtServer,Mj as runVmHands,Lj as parseVmHandsInit,Zj as heartbeatBody,Qj as enableBaseKeyedSrt};

package/bin/vm-hands/worker-sandbox-tgqbmy6b.js

@@ -1,2 +0,0 @@
-// @bun
-import{r as a}from"./vm-hands-entry-lite-8fj07njx.js";import"./vm-hands-entry-lite-ejm5er3h.js";import"./vm-hands-entry-lite-qef2ndkd.js";import"./vm-hands-entry-lite-g7h6wjqy.js";import"./vm-hands-entry-lite-sex82vb1.js";import"./vm-hands-entry-lite-r8qg3wp1.js";import"./vm-hands-entry-lite-f5230h6t.js";import"./vm-hands-entry-lite-51hmj6am.js";import"./vm-hands-entry-lite-2t0vcvd8.js";export{a as configureWorkerSandbox};