@reason-machines/cli-linux-arm64 0.2.393 → 0.2.396

package/bin/vm-hands/{vm-hands-entry-lite-pjctaaxx.js → vm-hands-entry-lite-eztjchde.js}

@@ -1,5 +1,5 @@
 // @bun
-import{r as m0}from"./vm-hands-entry-lite-0seprnh3.js";import{v as t1,x as n6,y as t9}from"./vm-hands-entry-lite-atg4z1vg.js";import{A as V2,B as i6,C as V4,D as G4,E as R6,F as v0,J as P6,K as A$}from"./vm-hands-entry-lite-trm3dn8c.js";import{V as l2,oa as e0,ra as p1,ta as RJ}from"./vm-hands-entry-lite-z4q7mrn5.js";import{Ba as $J,Ca as JJ,Da as V8,Ea as G8,Fa as mJ,Ga as gJ,Ha as W9,Ia as Z5,Ja as U8,Ka as T0,La as I1,Ma as E1,Na as C0,Oa as d1,Pa as X5,Qa as R5,Ra as u3,Sa as N5,Wa as H5,db as pJ,eb as lJ,fb as cJ,gb as sJ,hb as z9}from"./vm-hands-entry-lite-9rnba1mg.js";import{$b as U0,Eb as g8,Fb as u8,Gb as B8,Hb as K8,Ib as wJ,Jb as yJ,Lb as j8,Mb as hJ,Nb as N1,Qb as $3,Rb as J3,Sb as p6,Tb as l6,Ub as c6,Vb as S0,Wb as J0,Xb as g,Yb as O9,Zb as D1,_b as r1,ac as fJ,fc as W5,hc as f4,jb as U6,kc as E2,mb as P8,mc as J5,nb as C8,nc as o3,pc as d8,qb as o8,rb as I8,ub as _8,vc as vJ,wb as k8,wc as i3,zb as h8}from"./vm-hands-entry-lite-y64x380n.js";import{Ac as w1,Bc as s6,Ec as N8,xc as h9,yc as f9,zc as Q5}from"./vm-hands-entry-lite-mc3pkj0q.js";import{Lc as $5}from"./vm-hands-entry-lite-h0keewxv.js";import{Rc as f8,Sc as v8,Zc as m8}from"./vm-hands-entry-lite-r166b92s.js";import{_c as q$}from"./vm-hands-entry-lite-rtt2w6c6.js";import{$c as u,ad as e,bd as s,cd as c}from"./vm-hands-entry-lite-180h5amj.js";import{ud as Y8}from"./vm-hands-entry-lite-e73s63fb.js";import{Fd as V5,Id as uJ,Ld as ZJ,Md as QJ}from"./vm-hands-entry-lite-3xtndjrw.js";import{$d as o6,Pd as OJ,Qd as p$,Sd as Q$,Td as R$,Ud as H1,Wd as C6,Xd as r6,Yd as t6,_d as q1,ae as v9,be as e6,ce as r2,de as X$,ee as x4,fe as t2}from"./vm-hands-entry-lite-vc06etcb.js";import{He as _2,Jf as X2,Le as SJ,Me as bJ,qf as X8,yf as D6,zf as n$}from"./vm-hands-entry-lite-02zaqpgh.js";import{Wf as a6,Xf as u2,_f as dJ,bg as k1,dg as F7,eg as _7,jg as U5}from"./vm-hands-entry-lite-t7g13jac.js";import{ng as p8}from"./vm-hands-entry-lite-yr1n57v6.js";import{Ag as nJ,Bg as rJ,Cg as i$,Dg as M3,Eg as R2,Fg as L4,Hg as P2,Ig as b$,Jg as k0,Kg as r$,Lg as C2,Og as w$,yg as V0,zg as Z2}from"./vm-hands-entry-lite-n3y7495e.js";import{Rg as l1,Sg as e8}from"./vm-hands-entry-lite-hfv2tsm9.js";import{Yg as y8}from"./vm-hands-entry-lite-a1yy1yp3.js";import{Ai as I4,Bi as E4,Ci as t$,ni as Z$,ri as W$,si as P0,ti as $4,ui as g6,vi as u6,xi as L2,yi as d6,zi as _9}from"./vm-hands-entry-lite-csecgmaa.js";import{Di as u1,Ei as A1}from"./vm-hands-entry-lite-ksz1k1dh.js";import{$i as k6,hj as Y5,ij as j9,kj as H8}from"./vm-hands-entry-lite-na1vayq4.js";import{mj as H0,oj as WJ}from"./vm-hands-entry-lite-5x04hakp.js";import{Mj as t}from"./vm-hands-entry-lite-1edhwzhg.js";import{jk as K}from"./vm-hands-entry-lite-8pgggvbb.js";import{mk as kJ}from"./vm-hands-entry-lite-p1s0xyc2.js";import{Ak as R8,rk as t8,tk as Z1,xk as DJ,yk as z8,zk as A8}from"./vm-hands-entry-lite-fb02h1zm.js";import{Gk as h0}from"./vm-hands-entry-lite-g87z5eb6.js";import{Mk as jG}from"./vm-hands-entry-lite-f78n4wqt.js";import{spawn as $7,spawnSync as DG}from"child_process";import{closeSync as J7,existsSync as WG,mkdirSync as OG,openSync as Z7,readdirSync as zG,realpathSync as Y$,rmSync as L1}from"fs";import{hostname as AG}from"os";import{dirname as m9,join as F0,resolve as RG}from"path";import{createHash as D7}from"crypto";import{unlinkSync as W7}from"fs";import{platform as O7}from"os";import{join as z7}from"path";var o9=K.discriminatedUnion("store",[K.strictObject({version:K.literal(1),store:K.literal("keychain")}),K.strictObject({version:K.literal(1),store:K.literal("file"),api_key:K.string().min(1).max(4096)})]),S$=($)=>z7($,"api-key.json");function F$($){let J=D7("sha256").update(`reason-connect-api-key
+import{r as m0}from"./vm-hands-entry-lite-xhbjkkk5.js";import{v as t1,x as n6,y as t9}from"./vm-hands-entry-lite-f50vcbjg.js";import{A as V2,B as i6,C as V4,D as G4,E as R6,F as v0,J as P6,K as A$}from"./vm-hands-entry-lite-cfwke54v.js";import{V as l2,oa as e0,ra as p1,ta as RJ}from"./vm-hands-entry-lite-t67cjjan.js";import{Ba as $J,Ca as JJ,Da as V8,Ea as G8,Fa as mJ,Ga as gJ,Ha as W9,Ia as Z5,Ja as U8,Ka as T0,La as I1,Ma as E1,Na as C0,Oa as d1,Pa as X5,Qa as R5,Ra as u3,Sa as N5,Wa as H5,db as pJ,eb as lJ,fb as cJ,gb as sJ,hb as z9}from"./vm-hands-entry-lite-tbn5dn91.js";import{$b as U0,Eb as g8,Fb as u8,Gb as B8,Hb as K8,Ib as wJ,Jb as yJ,Lb as j8,Mb as hJ,Nb as N1,Qb as $3,Rb as J3,Sb as p6,Tb as l6,Ub as c6,Vb as S0,Wb as J0,Xb as g,Yb as O9,Zb as D1,_b as r1,ac as fJ,fc as W5,hc as f4,jb as U6,kc as E2,mb as P8,mc as J5,nb as C8,nc as o3,pc as d8,qb as o8,rb as I8,ub as _8,vc as vJ,wb as k8,wc as i3,zb as h8}from"./vm-hands-entry-lite-ygbggn2q.js";import{Ac as w1,Bc as s6,Ec as N8,xc as h9,yc as f9,zc as Q5}from"./vm-hands-entry-lite-v0kpksbf.js";import{Lc as $5}from"./vm-hands-entry-lite-e99ftdr6.js";import{Rc as f8,Sc as v8,Zc as m8}from"./vm-hands-entry-lite-e4kdpq0t.js";import{_c as q$}from"./vm-hands-entry-lite-rtt2w6c6.js";import{$c as u,ad as e,bd as s,cd as c}from"./vm-hands-entry-lite-0nd56w02.js";import{ud as Y8}from"./vm-hands-entry-lite-smrymax6.js";import{Fd as V5,Id as uJ,Ld as ZJ,Md as QJ}from"./vm-hands-entry-lite-6zrz9pkm.js";import{$d as o6,Pd as OJ,Qd as p$,Sd as Q$,Td as R$,Ud as H1,Wd as C6,Xd as r6,Yd as t6,_d as q1,ae as v9,be as e6,ce as r2,de as X$,ee as x4,fe as t2}from"./vm-hands-entry-lite-09426bhf.js";import{Cf as D6,Df as n$,Le as _2,Nf as X2,Pe as SJ,Qe as bJ,uf as X8}from"./vm-hands-entry-lite-qvj5560v.js";import{$f as u2,_f as a6,cg as dJ,fg as k1,hg as F7,ig as _7,ng as U5}from"./vm-hands-entry-lite-gc7prfyz.js";import{rg as p8}from"./vm-hands-entry-lite-t839nkd2.js";import{Cg as V0,Dg as Z2,Eg as nJ,Fg as rJ,Gg as i$,Hg as M3,Ig as R2,Jg as L4,Lg as P2,Mg as b$,Ng as k0,Og as r$,Pg as C2,Sg as w$}from"./vm-hands-entry-lite-ps9gjbs5.js";import{Vg as l1,Wg as e8}from"./vm-hands-entry-lite-q5h859gg.js";import{ah as y8}from"./vm-hands-entry-lite-1cs1jy20.js";import{Bi as L2,Ci as d6,Di as _9,Ei as I4,Fi as E4,Gi as t$,ri as Z$,vi as W$,wi as P0,xi as $4,yi as g6,zi as u6}from"./vm-hands-entry-lite-gk3y60ap.js";import{Hi as u1,Ii as A1}from"./vm-hands-entry-lite-eatqxe5y.js";import{dj as k6,lj as Y5,mj as j9,oj as H8}from"./vm-hands-entry-lite-sg0c4khn.js";import{qj as H0,sj as WJ}from"./vm-hands-entry-lite-2sx1a43v.js";import{Qj as t}from"./vm-hands-entry-lite-j2w231k5.js";import{nk as K}from"./vm-hands-entry-lite-f9akybcm.js";import{qk as kJ}from"./vm-hands-entry-lite-sjn5yjvx.js";import{Bk as DJ,Ck as z8,Dk as A8,Ek as R8,vk as t8,xk as Z1}from"./vm-hands-entry-lite-ek5r435m.js";import{Kk as h0}from"./vm-hands-entry-lite-69n9q5f1.js";import{Qk as jG}from"./vm-hands-entry-lite-5d31qv44.js";import{spawn as $7,spawnSync as DG}from"child_process";import{closeSync as J7,existsSync as WG,mkdirSync as OG,openSync as Z7,readdirSync as zG,realpathSync as Y$,rmSync as L1}from"fs";import{hostname as AG}from"os";import{dirname as m9,join as F0,resolve as RG}from"path";import{createHash as D7}from"crypto";import{unlinkSync as W7}from"fs";import{platform as O7}from"os";import{join as z7}from"path";var o9=K.discriminatedUnion("store",[K.strictObject({version:K.literal(1),store:K.literal("keychain")}),K.strictObject({version:K.literal(1),store:K.literal("file"),api_key:K.string().min(1).max(4096)})]),S$=($)=>z7($,"api-key.json");function F$($){let J=D7("sha256").update(`reason-connect-api-key
 ${$}`).digest("hex");return new i$(Z2(),O7(),J)}function H3($,J,Z=F$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(S$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof V0))throw Q}c(S$($),{version:1,store:"file",api_key:J})}function d0($,J=F$($)){if(!u(S$($)))return null;let Z=o9.parse(JSON.parse(s(S$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof V0))throw Q;throw Error("worker_api_key_unreadable")}}function e9($,J=F$($)){if(!u(S$($)))return;if(o9.parse(JSON.parse(s(S$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof V0))throw Z}W7(S$($))}async function q3($,J){let Z;try{Z=await t9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:S0($.proxy)})}catch(Q){if(Q instanceof v0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as d7,renameSync as p7,rmSync as y$}from"fs";import{join as q0}from"path";import{createHash as A7}from"crypto";import{realpathSync as R7,statSync as P7,unlinkSync as Q2}from"fs";import{platform as C7}from"os";import{join as b0}from"path";function d($){return{state:b0(g($),"device.json"),control:b0(g($),"control.json"),lock:b0(g($),"lifecycle.lock"),socket:b0(g($),"control.sock"),daemon:b0(g($),"daemon.json"),releaseCheck:b0(g($),"release-check.json"),updateDeferral:b0(g($),"update-deferral.json"),firstHeartbeat:b0(g($),"first-heartbeat.json")}}var I7=K.object({version:K.literal(1),device_id:K.string().min(1).max(160),offer:K.unknown().optional(),enrollment_ms:K.number().int().nonnegative().max(n$).optional()});function J4($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function L3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=I7.safeParse(JSON.parse(s(Z)));if(Q2(Z),!Q.success||Q.data.device_id!==J)return null;let X=X2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function L0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=b0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?T3($):new M3(g($))}function Y2($,J){L0($,!0),S7($);let Z=J??T3($),Q=new M3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof V0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function T3($){return new i$(Z2(),C7(),E7($))}function E7($){let J=F3($);return A7("sha256").update(`reason-worker
 ${J?.directory??g($)}`).digest("hex")}function W1($,J){c(b0(g($),O1),{version:1,directory:F3($)?.directory??g($),devicePublicKey:J})}var O1="keychain-scope.json";function Z4($){return u(b0(g($),O1))}var x7=K.strictObject({version:K.literal(1),directory:K.string().min(1),devicePublicKey:K.string().min(1)});function F3($){let J=b0(g($),O1);if(!u(J))return null;let Z=x7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function S7($){let J=b0(g($),O1);if(!u(J))return;if(F3($))try{let Z=T3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof V0))throw Z}Q2(J)}function U$($){let J=R7($.workspaceRoot);if(J!==$.workspaceRoot||!P7(J).isDirectory()||!D1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function o($){if(!u(g($)))return null;let J=b$(d($).state,{proofStore:L0($),repair:!1}),Z=J!==null&&$4($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var Q4=K.strictObject({version:K.literal(1),drained:K.boolean(),revoked:K.boolean()});function $0($){let J=d($).control;return u(J)?Q4.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function R0($,J){c(d($).control,Q4.parse(J))}function w0($){let J=L0($);J.deleteBinding(),J.deleteKey();let Z=b0(g($),O1);if(u(Z))Q2(Z);let Q=d($).state;if(u(Q))Q2(Q)}var b7=K.strictObject({read:K.boolean(),write:K.boolean(),execute:K.boolean(),discover_environment:K.boolean(),expose_mcp:K.literal(!1)}),_3=K.strictObject({version:K.literal(1),organization_id:K.string().min(1).max(160),enrollment_ticket:K.string().min(1).max(4096),code_verifier:K.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/),root:K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/),permissions:b7,execution_mode:K.enum(["confined","host"]).default("confined")}),folders:K.array(K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),w7=K.object({device_id:K.string().min(1).max(160),organization_id:K.string().min(1).max(160),auth_scheme:K.literal("p256"),protocol_version:K.literal(2),roots:K.array(K.object({id:K.string().min(1),label:K.string(),path_fingerprint:K.string()})).min(1).max(32),headless:K.object({lifecycle:K.enum(["persistent","ephemeral"]),expires_at:K.iso.datetime({offset:!0})}),first_heartbeat:K.unknown().optional()}),j3=30000;class t0 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function y7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(j3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new t0(X?.error==="device_revoked")}return Q.json()}async function D3($,J,Z,Q){m0();let X=_3.parse(JSON.parse(s(J)));return o0($,X,Z,Q)}async function o0($,J,Z,Q=(Y,V)=>y7(Y,V,S0($.proxy)),X=performance.now()){let Y=Y4($,J,Z),V=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(V,X)}async function X4($,J,Z,Q,X=performance.now()){let Y=Y4($,J,Z),V=await Q(Y.request,J.code_verifier);return V===null?null:Y.receipt(V,X)}function Y4($,J,Z){if(m0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=w$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((G,H)=>{let M=w$([G],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(M.path!==G||M.pathFingerprint!==J.folders?.[H]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return M});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],V;try{V=Z.loadPublicKey()}catch{V=Z.createFreshPublicKey()}return{request:{device_public_key:V,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:t,bridge_version:t,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((G)=>({label:G.label,path_fingerprint:G.pathFingerprint,permissions:J.root.permissions}))},receipt(G,H){let M=w7.parse(G);if(M.organization_id!==J.organization_id||M.roots.length!==Y.length||M.roots.some((B,q)=>B.path_fingerprint!==Y[q].pathFingerprint)||M.headless.lifecycle!==$.lifetime||Date.parse(M.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let U=X2(M.first_heartbeat);try{J4($,M.device_id,{...U?{offer:U}:{},enrollmentMs:Math.min(n$,Math.max(0,Math.round(performance.now()-H)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:M.organization_id,deviceId:M.device_id,devicePublicKey:V,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:M.headless.expires_at},roots:M.roots.map((B,q)=>({id:B.id,label:B.label,path:Y[q].path,pathFingerprint:B.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as k7,randomUUID as h7}from"crypto";import{unlinkSync as f7}from"fs";import{join as v7}from"path";var B4=K.strictObject({version:K.literal(1),install_id:K.uuid(),fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/)}),m7=K.object({enrollment_ticket:K.string().min(1).max(4096),expires_at:K.iso.datetime({offset:!0}),device_kind:K.literal("headless"),lifecycle:K.enum(["persistent","ephemeral"]),device_expires_at:K.iso.datetime({offset:!0})});function W3($){return m7.parse($)}var g7=K.object({credentialKind:K.enum(["oauth","api_key"]).optional(),apiOrigin:K.url(),clientId:K.string(),accessToken:K.string().min(1).max(32768),refreshToken:K.string().max(32768),expiresAt:K.iso.datetime({offset:!0}),scopes:K.array(K.string().max(128)).max(128),orgId:K.string().min(1).max(160)});function _$($){return V2(A1("REASON_CLI_CHANNEL",$.channel),H0())}async function j$($,J=_$($)){if(!u(J))return null;let Z=g7.parse(JSON.parse(s(J)));if(!P0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=S0($.proxy),X=Object.assign((V,N)=>Q(V,{...N,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await G4({path:J,fetchImpl:X});if(Y&&!P0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function K4($,J,Z){if(!P0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=D$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function U4($,J,Z,Q,X){let Y=performance.now();if(!P0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=D$($),N=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(N){let G=await X4($,V.direct(J.orgId),Q,(H,M)=>N({approval:V.request,code_verifier:M,registration:H}).catch((U)=>{throw u7(U)}),Y);if(G)return G}return o0($,V.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(V.request)),Q,X,Y)}function u7($){if(!($ instanceof v0))return $;if($.status===409)return new t0($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new t0(!1);return $}var z1=($)=>v7(g($),"enrollment-install.json");function N4($){if(u(z1($)))f7(z1($))}function D$($,{stored:J=!0}={}){m0();let Z=z1($),Q=J&&u(Z)?B4.parse(JSON.parse(s(Z))):{version:1,install_id:h7(),fingerprint_key:k7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),V=w$([$.workspaceRoot],X,Y)[0];if(V.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let N=($.folders??[]).map((U)=>{let B=w$([U],X,Y)[0];if(B.path!==U)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:B.pathFingerprint}}),G=V4(),H={install_id:Q.install_id,code_challenge:G.challenge,lifecycle:$.lifetime,roots:[V.pathFingerprint,...N.map((U)=>U.path_fingerprint)].map((U)=>({path_fingerprint:U,permissions:X,execution_mode:$.executionMode}))},M=(U)=>({version:1,organization_id:U,code_verifier:G.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:V.pathFingerprint,permissions:X,execution_mode:$.executionMode},...N.length?{folders:N}:{}});return{request:H,saveInstall(U){e(g(U),!0),c(z1(U),Q)},complete(U,B){let q=W3(B);if(q.lifecycle!==$.lifetime||Date.parse(q.expires_at)<=Date.now()||Date.parse(q.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...M(U),enrollment_ticket:q.enrollment_ticket}},direct:M}}function H4($,J,Z){let Q=z1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=B4.parse(JSON.parse(s(Q)));return w$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var G2=8,T4=600000,F4=15000,q4=new Set(["device_revoked","invalid_device_credential"]),B2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,N$=($)=>q0(g($),"workspaces"),_4="account.json",O3=($)=>u(q0($,_4));function y0($){let J;try{J=d7(N$($))}catch{return[]}return J.filter((Z)=>B2.test(Z)).sort().map((Z)=>{let Q=q0(N$($),Z),X=q0(Q,"worker.json"),Y=null;try{let V=J0.safeParse(JSON.parse(s(X)));if(V.success&&V.data.stateDirectory===Q)Y=V.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:O3(Q)}})}function K2($,J){let Z=J.toLowerCase();if(!B2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(N$($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,_4),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function U2($,J){try{let{config:Z,configPath:Q}=K2($,J);e(g(Z),!0),R0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function R1($,J){let Z=J.toLowerCase(),Q=null;try{Q=o($)?.orgId.toLowerCase()??null}catch{}return Q===Z||y0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var z3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function M4($,J){let Z=o($);if(!Z?.worker)throw Error("worker_identity_missing");W1($,Z.devicePublicKey),e(g(J),!0);for(let Y of z3)y$(q0(g(J),Y),{force:!0});for(let Y of z3){let V=q0(g($),Y);if(u(V))p7(V,q0(g(J),Y))}let Q=L0(J),X=b$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");k0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function A3($){for(let J of y0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))w0(J.config)}catch{}y$(J.directory,{recursive:!0,force:!0})}y$(P3($),{force:!0})}function N2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(U)=>Number(Date.parse(U.worker?.expiresAt??"")>X+60000),N=y0($).flatMap((U)=>{if(!U.account||!U.config)return[];try{if($0(U.config).revoked)return[];let B=o(U.config);return B&&B.orgId.toLowerCase()===U.organizationId&&(!Q||Y(B))?[{...U,config:U.config,state:B}]:[]}catch{return[]}}).sort((U,B)=>Number(B.organizationId===J)-Number(U.organizationId===J)||Y(B.state)-Y(U.state))[0];if(!N)return null;let G=null;try{G=$0($).revoked?null:o($)}catch{}let H=G?.orgId.toLowerCase()??"";if(Z&&G&&B2.test(H)&&H!==N.organizationId){let U=K2($,H);M4($,U.config),c(U.configPath,U.config)}else if(u(g($))){try{if(u(d($).state))w0($)}catch{}for(let U of z3)y$(q0(g($),U),{force:!0})}A3($);let M=J0.parse({...N.config,stateDirectory:$.stateDirectory});return M4(N.config,M),c(q0($.stateDirectory,"worker.json"),M),y$(N.directory,{recursive:!0,force:!0}),M}var R3={before($){for(let{config:J}of y0($))try{let Z=J?o(J):null;if(J&&Z)W1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of y0(J)){if(Y)continue;try{let V=J0.parse(JSON.parse(s(X)));if(V.stateDirectory!==q0(N$($),Z))continue;let N=J0.parse({...V,stateDirectory:Q}),G=L0(N),H=b$(d(N).state,{proofStore:G,repair:!1});if(H?.worker?.configDigest===U0(V))k0({...H,worker:{...H.worker,configDigest:U0(N)}},d(N).state,{proofStore:G});c(X,N)}catch{}}}},P3=($)=>q0(N$($),"listed.json");function j4($){try{let J=JSON.parse(s(P3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function D4($,J){let Z=y0($),Q=Z.filter((G)=>G.account),X=Z.filter((G)=>!G.account),Y=j4($),V=Y&&!Y.listed?Y.reason:null,N=V||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&N.length===0&&(V||Y&&!Y.listed))return{workspaces:null,off:V};return{off:V,workspaces:[...Q,...N].map(({organizationId:G,config:H,account:M})=>{let U=!1,B=null,q=!1,L=null;try{U=H?$0(H).revoked:!1,B=H&&!U?o(H):null;let T=H?r$(d(H).daemon):null;q=J&&!!B&&T?.state==="connected",L=q?L4(T,B):null}catch{}return{...L?{permission_recovery:L}:{},organization_id:G,device_id:B?.deviceId??null,name:Y?.names?.[G]??null,root:B?.roots[0]?{id:B.roots[0].id,permissions:B.roots[0].permissions}:null,state:U?"removed":q?"connected":"not_running",blocked:!M&&!U&&!q&&(Y?.blocked.includes(G)??!1),...M?{account:!0}:{}}})}}function W4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),V=new Map,N=null,G=!1,H=j4(J)??{listed:!1,reason:null,blocked:[]},M=(j)=>{let{folders:D,...R}=J,I=Z.roots.slice(1).map((P)=>P.path);return J0.parse({...R,...I.length?{folders:I}:{},stateDirectory:q0(N$(J),j)})},U=async(j)=>{let D=V.get(j);if(!D)return;D.controller.abort(),await D.done},B=(j,D=!1)=>{let R=new AbortController,I=()=>R.abort();if(X.addEventListener("abort",I,{once:!0}),X.aborted)R.abort();let P={...j,controller:R,claims:0,done:Promise.resolve(),account:D};P.done=$.serve(j,R.signal,(C)=>{P.claims=C}).then(()=>{return},(C)=>{if(D&&C instanceof T0&&C.status===401&&q4.has(C.code)){try{R0(j.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${j.organizationId} (another account's) no longer accepts this computer (${C.code}); run \`reason connect\` signed in as that account to connect it again
 `)}else if(C instanceof T0&&C.status===401&&q4.has(C.code)){try{w0(j.config)}catch{}Y(`Reason worker: workspace ${j.organizationId} no longer accepts this computer
@@ -313,7 +313,7 @@ Usage:
 `),host:Z.host}),N=A4({...V,log:(q)=>Q.stderr.write(`${q}
 `)}),{configPath:G}=N,H=N.saved;if(!H)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let M=(q,L)=>{let T=V3(Z.home,Z.channel),_;try{let O=null;try{O=L.keep?null:o(H)?.orgId.toLowerCase()??null}catch{}if(_=N2(H,{prefer:o1(Z.home,Z.channel,H),...L}),_&&O)U2(_,O)}finally{T()}if(!_)return!1;H=_;let W="";try{W=` (workspace ${o(_)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${q}; this computer goes on running Sessions for its other Reason account${W}.
 `),!0};if($0(H).revoked&&!M("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(H.executionMode==="confined"||!M1(H)){let q=d0(H.stateDirectory)??void 0,L=q?null:o1(Z.home,Z.channel,H);if(!q&&!(L&&R1(H,L)))M("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let U=H.executionMode==="confined";if(U||!M1(H)){let q=d0(H.stateDirectory)??void 0;if(Q.stderr.write(U?V7:`Reason: this computer's connection expired; renewing it with ${q?"its API key":"your login"}\u2026
-`),await g9(J0.parse({...H,executionMode:"host"}),G,Q,X,q)!==0)return Q.stderr.write(q?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let B=new AbortController;if(!X.runWorker)import("./ask-relay-q0ysjj22.js").then(({runBackgroundAskRelay:q})=>q(B.signal,(L)=>Q.stderr.write(`${L}
+`),await g9(J0.parse({...H,executionMode:"host"}),G,Q,X,q)!==0)return Q.stderr.write(q?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let B=new AbortController;if(!X.runWorker)import("./ask-relay-gzds2969.js").then(({runBackgroundAskRelay:q})=>q(B.signal,(L)=>Q.stderr.write(`${L}
 `))).catch(()=>{});try{for(;;){let q=d0(H.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},L=X.runWorker?null:i2({stateDirectory:H.stateDirectory}),T=!1,_;try{_=await(X.runWorker??M$)(["start","--config",G],{deferOptionalLanes:!0,...X.worker,...q,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{L?.stop()}if(!T)return _;if(!M("this computer's connection was removed from Reason",{keep:!1}))break}return Q3(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{B.abort()}}async function wG($,J,Z){let{io:Q,options:X,home:Y,channel:V,environment:N}=Z;if(J&&await(X.controlWorker??K0)(J,"status").catch(()=>null))throw new l("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let G=g0(Y,V,!0),H=B7({parsed:$,saved:J,stateDirectory:G,lifetime:"ephemeral",home:Y,channel:V,options:X,environment:N}),M=K7(H,Z.apiKey??(J?d0(J.stateDirectory)??void 0:void 0)),U=F0(G,"worker.json");return e(G,!0),c(U,M),Q.stdout.write(y9(`Reason: connecting "${M.name}" while this command runs`,M,Z.host.platform,["Connecting\u2026"])),(X.runWorker??M$)(["start","--config",U],{...u9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:e2(Q.stderr)},onStartup:(B)=>{if(B==="ready")Q.stdout.write(`Connected. Start Sessions on "${M.name}" from Reason. Press Ctrl-C to stop.
 `);X.worker?.onStartup?.(B)}})}function yG($,J,Z,Q){if(Z.platform!=="darwin")throw new l("--keep-awake is for macOS.");if(!J)throw new l("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),h4(d(J).daemon,$);let X=T2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
 `),0}var kG=K.object({root:K.object({id:K.string().min(1).max(160),label:K.string().max(160),path_fingerprint:K.string()})});async function U7($,J,Z,Q){let X=await(u9(Q.worker,Z).enrollmentCredentials??j$)($,_$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new A$(X,{credentialsPath:_$($),fetchImpl:S0($.proxy)}),V=(N)=>N instanceof v0&&N.status===404&&!["device_not_found","root_not_found"].includes(N.code);return{add:async(N)=>{let G=H4($,N,{...J.roots[0].permissions,expose_mcp:!1}),H=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:G.pathFingerprint,label:G.label,permissions:{...G.permissions,expose_mcp:!1}}).catch((U)=>{if(V(U))throw Error("worker_folders_unavailable");if(U instanceof v0&&U.code==="root_limit_reached")throw new l("This computer already has the most folders Reason allows (32).");throw U}),M=kG.parse(H).root;if(M.path_fingerprint!==G.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...G,id:M.id,label:M.label}},remove:async(N)=>{await Y.removeDeviceRoot(J.deviceId,N).catch((G)=>{if(V(G))throw Error("worker_folders_unavailable");if(!(G instanceof v0&&G.code==="root_not_found"))throw G})}}}function N7($,J,Z){k0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},d($).state,{proofStore:L0($)})}async function H7($,J,Z,Q){let{io:X,options:Y,host:V}=Q,N=J&&!Q.apiKey&&d0(J.stateDirectory)===null?o1(Q.home,Q.channel,J):null,G=J&&N&&P$(J)&&!R1(J,N)?y0(J).find((P)=>P.account&&P.organizationId===N)??null:void 0;if(G===null)throw new l("This computer is not connected for your account. Run reason connect first.");let H=G?G.config:J,M=G?G.configPath:Z,U=H&&P$(H)&&!$0(H).revoked?o(H):null;if(!J||!H||!U||H.lifetime!=="persistent")throw new l("This computer is not connected to Reason. Run reason connect first.");let B=$.addFolder!==void 0,q=B?$.addFolder:$.removeFolder,L=Y.cwd??process.cwd(),T;try{T=o2(L,q)}catch(P){if(B)throw new l(P instanceof Error?P.message:String(P));T=RG(L,q)}if(T===H.workspaceRoot)throw new l(`${T} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let _=H.folders??[],W=U.roots.slice(1).find((P)=>P.path===T);if(!B&&!W&&!_.includes(T))throw new l(`${T} is not one of this computer's folders.`);if(B&&!D1(T,H.stateDirectory))throw new l(`${T} holds Reason's own settings.`);if(B&&!W&&_.length>=31)throw new l("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??d0(H.stateDirectory)??void 0,F=await U7(H,U,O,Y),z=U.roots.filter((P)=>P.path!==T);if(B)z=[...z,await F.add(T)];else if(W)await F.remove(W.id);N7(H,U,z);let j=B?[..._.filter((P)=>P!==T),T]:_.filter((P)=>P!==T),{folders:D,...R}=H;if(c(M,J0.parse({...R,...j.length?{folders:j}:{}})),!await(Y.controlWorker??K0)(J,"reload_roots").then(()=>!0,()=>!1))X$(J,V,"connect");return X.stdout.write(B?`Added ${T}. Sessions on "${H.name}" may run in it.

package/bin/vm-hands/{vm-hands-entry-lite-atg4z1vg.js → vm-hands-entry-lite-f50vcbjg.js}

@@ -1,3 +1,3 @@
 // @bun
-import{D as T,F as U}from"./vm-hands-entry-lite-trm3dn8c.js";import{_c as V}from"./vm-hands-entry-lite-rtt2w6c6.js";import{ni as M,pi as Q}from"./vm-hands-entry-lite-csecgmaa.js";import{Di as G}from"./vm-hands-entry-lite-ksz1k1dh.js";function W(j,B){let k=G(j,"REASON_API_URL")?.trim();if(!k)return Q(B);let z=new URL(k);if(z.protocol!=="https:"&&!(z.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(z.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return z.origin}function X(j){return G(j,"REASON_API_URL")?.trim()?W(j,"production"):void 0}function $(j){return G(j,"REASON_API_KEY")?.trim()||void 0}async function N(j,B){let k=j.env??process.env,z=$(k);if(!z)return(j.getCredentials??T)({apiOrigin:X(k),signal:B});let J=W(k,j.channel??M({env:k})),D=await(j.fetchImpl??fetch)(J+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+z,accept:"application/json"},signal:B}),L=await D.json().catch(()=>({})),w=V(L)?L:{};if(!D.ok){let H=typeof w.detail==="string"?w.detail:typeof w.message==="string"?w.message:"API key authentication failed ("+D.status+")";throw new U(D.status,typeof w.error==="string"?w.error:"api_key_auth_failed",H)}if(typeof w.org_id!=="string"||!w.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let Z=Array.isArray(w.scopes)?w.scopes.filter((H)=>typeof H==="string"):[];return{credentialKind:"api_key",apiOrigin:J,accessToken:z,orgId:w.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:Z}}async function P(j){let B=await N(j),k=X(j.env??process.env);if(!B)throw Error(k?`Not signed in to ${k}. Set REASON_API_KEY, or run \`reason login --api-url ${k}\`.`:"Not signed in. Run `reason login`, or set REASON_API_KEY.");return B}
+import{D as T,F as U}from"./vm-hands-entry-lite-cfwke54v.js";import{_c as V}from"./vm-hands-entry-lite-rtt2w6c6.js";import{ri as M,ti as Q}from"./vm-hands-entry-lite-gk3y60ap.js";import{Hi as G}from"./vm-hands-entry-lite-eatqxe5y.js";function W(j,B){let k=G(j,"REASON_API_URL")?.trim();if(!k)return Q(B);let z=new URL(k);if(z.protocol!=="https:"&&!(z.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(z.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return z.origin}function X(j){return G(j,"REASON_API_URL")?.trim()?W(j,"production"):void 0}function $(j){return G(j,"REASON_API_KEY")?.trim()||void 0}async function N(j,B){let k=j.env??process.env,z=$(k);if(!z)return(j.getCredentials??T)({apiOrigin:X(k),signal:B});let J=W(k,j.channel??M({env:k})),D=await(j.fetchImpl??fetch)(J+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+z,accept:"application/json"},signal:B}),L=await D.json().catch(()=>({})),w=V(L)?L:{};if(!D.ok){let H=typeof w.detail==="string"?w.detail:typeof w.message==="string"?w.message:"API key authentication failed ("+D.status+")";throw new U(D.status,typeof w.error==="string"?w.error:"api_key_auth_failed",H)}if(typeof w.org_id!=="string"||!w.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let Z=Array.isArray(w.scopes)?w.scopes.filter((H)=>typeof H==="string"):[];return{credentialKind:"api_key",apiOrigin:J,accessToken:z,orgId:w.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:Z}}async function P(j){let B=await N(j),k=X(j.env??process.env);if(!B)throw Error(k?`Not signed in to ${k}. Set REASON_API_KEY, or run \`reason login --api-url ${k}\`.`:"Not signed in. Run `reason login`, or set REASON_API_KEY.");return B}
 export{W as v,X as w,$ as x,N as y,P as z};