@reason-machines/cli-linux-arm64 0.2.401 → 0.2.403

package/bin/vm-hands/{vm-hands-entry-lite-h3vmfk68.js → vm-hands-entry-lite-nnrypv7q.js}

@@ -1,5 +1,5 @@
 // @bun
-import{$e as OJ,Jf as jJ,Se as _J,_e as gJ,af as RJ,bf as IJ}from"./vm-hands-entry-lite-09yt840b.js";import{createHash as m,randomBytes as WJ}from"crypto";import{closeSync as MJ,fsyncSync as TJ,mkdirSync as aJ,openSync as DJ,renameSync as nJ,rmSync as tJ,statSync as qJ,writeSync as xJ,constants as y}from"fs";import{join as t}from"path";var eJ=1;var e=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function FJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new F("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function AJ(J,Q){let{payload:$,authority:z}=J;if(!$||typeof $!=="object"||Array.isArray($)||!z||typeof z!=="object"||Array.isArray(z)||!Q.deviceId||!Q.rootId||$.run_id!==Q.runId||$.device_id!==Q.deviceId||z.device_id!==Q.deviceId||$.root_id!==Q.rootId||Q.snapshotId!==void 0&&$.snapshot_id!==Q.snapshotId)throw new F("vm_hands_env_invalid","environment does not match this Hands");return $}function SJ(J){if(J.capability!=="hands.connect")throw new F("vm_hands_bind_invalid","not a hands.connect claim");let Q=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Q.workspace_id==="string"&&e.test(Q.workspace_id)?Q.workspace_id:J.run_id,brain_generation:Q.target_generation,fence_id:Q.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Q.hands_confinement??""),browser_egress:Q.browser_egress??null,policy_digest:Q.vm_hands_policy_digest},cwd:typeof Q.cwd==="string"?Q.cwd:"",claim:J,env:FJ(J)?J.environment_sealed:null,workspace_deferred:JQ(J)}}function JQ(J){let Q=J.payload[OJ];if(Q===void 0)return!1;if(Q!==!0||J.payload.vm_hands_env_deferred!==!0||J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class F extends Error{code;constructor(J,Q){super(Q);this.code=J}}var I=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),b=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function c(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(c).join(",")}]`;return`{${Object.keys(J).sort().map((Q)=>`${JSON.stringify(Q)}:${c(J[Q])}`).join(",")}}`}async function SQ(J){let Q=await crypto.subtle.importKey("pkcs8",b(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),$=b(J.device_key.spki),z=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),L=new Uint8Array(await crypto.subtle.exportKey("spki",z.publicKey)),U=m("sha256").update($).digest("base64url");return{signing:{privateKey:Q},agreement:z,signingSpki:$,agreementSpki:L,fingerprint:U}}var QQ=4;class ZQ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(J){let Q=this.structural.then(J,J);return this.structural=Q.catch(()=>{return}),Q}constructor(J,Q,$,z){this.init=J;this.keys=Q;this.hooks=$;this.options=z;if(!e.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new F("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new F("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Q of this.bound.values())if(Q.runId===J)return!0;return!1}bindIdForRun(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Q,$){for(let z=Date.now()+Q;;){let L=this.bound.get(J);if(!L)return!1;if(L.envInstalled)return!0;if(Date.now()>=z||$?.aborted)return!1;await new Promise((U)=>setTimeout(U,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new F("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new F("vm_hands_challenge_invalid","bad register challenge");let Q={challenge:J,t:"register",v:eJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:I(this.keys.signingSpki),env_public_key:I(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:I(WJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},$=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(c(Q)));return{...Q,device_signature:I($)}}async helloFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","hello before register");let $=String((this.options.now??Date.now)()),z=I(WJ(32)),L=jJ({method:"GET",pathAndQuery:_J,timestamp:$,nonce:z,challenge:J,bodySha256:m("sha256").update("").digest("hex")}),U=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(L)));return{t:"hello",timestamp:$,nonce:z,signature:I($Q(U)),...Q?{vm_hands_previous_connection:Q}:{}}}registered(){if(this.identity!=="identity_free")throw new F("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new F("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new F("vm_hands_bind_invalid","bad bind");for(let $ of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!e.test($))throw new F("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new F("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new F("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new F("vm_hands_bind_invalid","bad policy or nonce");if(m("sha256").update(c({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new F("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some(($)=>$.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new F("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=QQ)throw new F("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new F("vm_hands_busy","a bind waits for its workspace beside the setup");if(J.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),J.workspace_deferred){let $,z,L=new Promise((U,N)=>{$=U,z=N});L.catch(()=>{return}),this.grants.set(J.bind_id,{promise:L,resolve:$,reject:z})}return this.exclusive(()=>this.setUp(J))}async setUp(J){let Q=[...this.bound.keys()],$=null,z=!1,L=this.grants.get(J.bind_id);try{if(L&&(Q.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(Q.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new F("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Q}),this.unverified.clear();this.servedRun=!0,z=!0;let{launchId:U,applied:N,readyData:O}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim,...L?{workspaceGrant:L.promise}:{}}),T=this.hooks.restatLayout();this.hooks.verifyMounts?.();let D=null,A=null;if(J.env){let w=J.claim?.owner??{},v=AJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:J.claim?.root_id??""});this.commandsSinceVerified=!0,D=this.hooks.installEnvironment(J.bind_id,v),A=typeof v.snapshot_id==="string"&&v.snapshot_id?v.snapshot_id:null,$=this.writeJobEnvRootOnly(J.bind_id,v)}if(this.unbinding.has(J.bind_id))throw new F("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:D!==null,rootId:J.claim?.root_id??"",envDirectory:$}),this.binding.delete(J.bind_id),this.grants.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:D,snapshot_id:A,layout:T,...O?{ready_data:O}:{},policy_digest:m("sha256").update(c({hands_confinement:N.hands_confinement??null,browser_egress:N.browser_egress??null})).digest("hex")}}catch(U){if($)KJ($);if(z){let O=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:O,own:!0}).catch(()=>{this.unverified.add(J.bind_id)})}this.binding.delete(J.bind_id),this.grants.delete(J.bind_id);let N=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof F?U:new F(N,"executor refused the bind")}}grantWorkspace(J){let Q=this.grants.get(J);if(!Q)throw new F("vm_hands_not_binding","no pre-bind waits for a workspace grant");Q.resolve()}abandonWorkspaceGrant(J){this.grants.get(J)?.reject(new F("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(J){let Q=this.bound.get(J.attemptId);if(!Q||this.unbinding.has(J.attemptId))throw new F("vm_hands_not_bound","environment delivered while not bound");if(!e.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new F("vm_hands_env_invalid","bad snapshot id");let $=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==$)throw new F("vm_hands_env_invalid","bad env envelope");let z=AJ(await this.openSealed(J.sealed,$),{runId:Q.runId,deviceId:J.deviceId,rootId:Q.rootId,snapshotId:J.snapshotId});this.commandsSinceVerified=!0;let L=this.hooks.installEnvironment(Q.bindId,z);if(Q.envInstalled=!0,Q.envDirectory)KJ(Q.envDirectory);return Q.envDirectory=null,Q.envDirectory=this.writeJobEnvRootOnly(`${Q.bindId}-r${L}`,z),{snapshot_id:J.snapshotId,installed_revision:L,installed:!0}}async attestFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new F("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new F("vm_hands_attest_invalid","attest beside a bind");let $=await this.hooks.runProbe({nonce:Q,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Q,exit_code:$.exitCode,markers:$.markers,proof_dir_inode:$.proofDirInode,script_sha256:m("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Q=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),this.abandonWorkspaceGrant(J),Q)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Q))}async retryUnbind(J){if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(J,this.unverifiedTeardowns.get(J)??null,!0)})}async tearDown(J,Q,$=!1){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((U)=>U!==J),L=!z.length&&($||!this.commandsSinceVerified);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:L?{bindId:J,own:!0}:void 0)}catch(U){if(this.unverified.add(J),!this.unverifiedTeardowns.has(J))this.unverifiedTeardowns.set(J,Q);throw U}if(this.unverified.delete(J),!z.length&&!$)this.unverified.clear(),this.commandsSinceVerified=!1;if(Q?.envDirectory)KJ(Q.envDirectory);return this.unverifiedTeardowns.delete(J),{bind_id:Q?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length||$?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Q){let $=()=>{throw new F("vm_hands_env_invalid","env did not decrypt")},z=await crypto.subtle.importKey("spki",b(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch($),L=await crypto.subtle.deriveKey({name:"ECDH",public:z},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),U=await crypto.subtle.decrypt({name:"AES-GCM",iv:b(J.iv),additionalData:new TextEncoder().encode(Q)},L,b(J.ct)).catch($),N=JSON.parse(new TextDecoder().decode(U));if(!N||typeof N!=="object"||Array.isArray(N))throw new F("vm_hands_env_invalid","env not an object");return N}writeJobEnvRootOnly(J,Q){let $=t(this.options.envRoot,`bind-${J}`);aJ($,{mode:448});let z=qJ($);if(!z.isDirectory()||(z.mode&63)!==0||z.uid!==(process.getuid?.()??-1))throw new F("vm_hands_env_dir_unsafe","env directory is not root's 0700");let L=Q.variables&&typeof Q.variables==="object"?Q.variables:{},U=Object.entries(L).filter(([T,D])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(T)&&typeof D==="string").map(([T,D])=>`export ${T}='${String(D).replaceAll("'","'\\''")}'`).join(`
+import{Lf as jJ,Ue as _J,af as gJ,bf as OJ,cf as RJ,df as IJ}from"./vm-hands-entry-lite-afjzr3v2.js";import{createHash as m,randomBytes as WJ}from"crypto";import{closeSync as MJ,fsyncSync as TJ,mkdirSync as aJ,openSync as DJ,renameSync as nJ,rmSync as tJ,statSync as qJ,writeSync as xJ,constants as y}from"fs";import{join as t}from"path";var eJ=1;var e=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function FJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new F("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function AJ(J,Q){let{payload:$,authority:z}=J;if(!$||typeof $!=="object"||Array.isArray($)||!z||typeof z!=="object"||Array.isArray(z)||!Q.deviceId||!Q.rootId||$.run_id!==Q.runId||$.device_id!==Q.deviceId||z.device_id!==Q.deviceId||$.root_id!==Q.rootId||Q.snapshotId!==void 0&&$.snapshot_id!==Q.snapshotId)throw new F("vm_hands_env_invalid","environment does not match this Hands");return $}function SJ(J){if(J.capability!=="hands.connect")throw new F("vm_hands_bind_invalid","not a hands.connect claim");let Q=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Q.workspace_id==="string"&&e.test(Q.workspace_id)?Q.workspace_id:J.run_id,brain_generation:Q.target_generation,fence_id:Q.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Q.hands_confinement??""),browser_egress:Q.browser_egress??null,policy_digest:Q.vm_hands_policy_digest},cwd:typeof Q.cwd==="string"?Q.cwd:"",claim:J,env:FJ(J)?J.environment_sealed:null,workspace_deferred:JQ(J)}}function JQ(J){let Q=J.payload[OJ];if(Q===void 0)return!1;if(Q!==!0||J.payload.vm_hands_env_deferred!==!0||J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class F extends Error{code;constructor(J,Q){super(Q);this.code=J}}var I=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),b=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function c(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(c).join(",")}]`;return`{${Object.keys(J).sort().map((Q)=>`${JSON.stringify(Q)}:${c(J[Q])}`).join(",")}}`}async function SQ(J){let Q=await crypto.subtle.importKey("pkcs8",b(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),$=b(J.device_key.spki),z=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),L=new Uint8Array(await crypto.subtle.exportKey("spki",z.publicKey)),U=m("sha256").update($).digest("base64url");return{signing:{privateKey:Q},agreement:z,signingSpki:$,agreementSpki:L,fingerprint:U}}var QQ=4;class ZQ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(J){let Q=this.structural.then(J,J);return this.structural=Q.catch(()=>{return}),Q}constructor(J,Q,$,z){this.init=J;this.keys=Q;this.hooks=$;this.options=z;if(!e.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new F("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new F("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Q of this.bound.values())if(Q.runId===J)return!0;return!1}bindIdForRun(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Q,$){for(let z=Date.now()+Q;;){let L=this.bound.get(J);if(!L)return!1;if(L.envInstalled)return!0;if(Date.now()>=z||$?.aborted)return!1;await new Promise((U)=>setTimeout(U,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new F("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new F("vm_hands_challenge_invalid","bad register challenge");let Q={challenge:J,t:"register",v:eJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:I(this.keys.signingSpki),env_public_key:I(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:I(WJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},$=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(c(Q)));return{...Q,device_signature:I($)}}async helloFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","hello before register");let $=String((this.options.now??Date.now)()),z=I(WJ(32)),L=jJ({method:"GET",pathAndQuery:_J,timestamp:$,nonce:z,challenge:J,bodySha256:m("sha256").update("").digest("hex")}),U=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(L)));return{t:"hello",timestamp:$,nonce:z,signature:I($Q(U)),...Q?{vm_hands_previous_connection:Q}:{}}}registered(){if(this.identity!=="identity_free")throw new F("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new F("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new F("vm_hands_bind_invalid","bad bind");for(let $ of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!e.test($))throw new F("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new F("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new F("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new F("vm_hands_bind_invalid","bad policy or nonce");if(m("sha256").update(c({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new F("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some(($)=>$.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new F("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=QQ)throw new F("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new F("vm_hands_busy","a bind waits for its workspace beside the setup");if(J.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),J.workspace_deferred){let $,z,L=new Promise((U,N)=>{$=U,z=N});L.catch(()=>{return}),this.grants.set(J.bind_id,{promise:L,resolve:$,reject:z})}return this.exclusive(()=>this.setUp(J))}async setUp(J){let Q=[...this.bound.keys()],$=null,z=!1,L=this.grants.get(J.bind_id);try{if(L&&(Q.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(Q.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new F("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Q}),this.unverified.clear();this.servedRun=!0,z=!0;let{launchId:U,applied:N,readyData:O}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim,...L?{workspaceGrant:L.promise}:{}}),T=this.hooks.restatLayout();this.hooks.verifyMounts?.();let D=null,A=null;if(J.env){let w=J.claim?.owner??{},v=AJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:J.claim?.root_id??""});this.commandsSinceVerified=!0,D=this.hooks.installEnvironment(J.bind_id,v),A=typeof v.snapshot_id==="string"&&v.snapshot_id?v.snapshot_id:null,$=this.writeJobEnvRootOnly(J.bind_id,v)}if(this.unbinding.has(J.bind_id))throw new F("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:D!==null,rootId:J.claim?.root_id??"",envDirectory:$}),this.binding.delete(J.bind_id),this.grants.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:D,snapshot_id:A,layout:T,...O?{ready_data:O}:{},policy_digest:m("sha256").update(c({hands_confinement:N.hands_confinement??null,browser_egress:N.browser_egress??null})).digest("hex")}}catch(U){if($)KJ($);if(z){let O=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:O,own:!0}).catch(()=>{this.unverified.add(J.bind_id)})}this.binding.delete(J.bind_id),this.grants.delete(J.bind_id);let N=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof F?U:new F(N,"executor refused the bind")}}grantWorkspace(J){let Q=this.grants.get(J);if(!Q)throw new F("vm_hands_not_binding","no pre-bind waits for a workspace grant");Q.resolve()}abandonWorkspaceGrant(J){this.grants.get(J)?.reject(new F("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(J){let Q=this.bound.get(J.attemptId);if(!Q||this.unbinding.has(J.attemptId))throw new F("vm_hands_not_bound","environment delivered while not bound");if(!e.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new F("vm_hands_env_invalid","bad snapshot id");let $=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==$)throw new F("vm_hands_env_invalid","bad env envelope");let z=AJ(await this.openSealed(J.sealed,$),{runId:Q.runId,deviceId:J.deviceId,rootId:Q.rootId,snapshotId:J.snapshotId});this.commandsSinceVerified=!0;let L=this.hooks.installEnvironment(Q.bindId,z);if(Q.envInstalled=!0,Q.envDirectory)KJ(Q.envDirectory);return Q.envDirectory=null,Q.envDirectory=this.writeJobEnvRootOnly(`${Q.bindId}-r${L}`,z),{snapshot_id:J.snapshotId,installed_revision:L,installed:!0}}async attestFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new F("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new F("vm_hands_attest_invalid","attest beside a bind");let $=await this.hooks.runProbe({nonce:Q,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Q,exit_code:$.exitCode,markers:$.markers,proof_dir_inode:$.proofDirInode,script_sha256:m("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Q=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),this.abandonWorkspaceGrant(J),Q)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Q))}async retryUnbind(J){if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(J,this.unverifiedTeardowns.get(J)??null,!0)})}async tearDown(J,Q,$=!1){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((U)=>U!==J),L=!z.length&&($||!this.commandsSinceVerified);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:L?{bindId:J,own:!0}:void 0)}catch(U){if(this.unverified.add(J),!this.unverifiedTeardowns.has(J))this.unverifiedTeardowns.set(J,Q);throw U}if(this.unverified.delete(J),!z.length&&!$)this.unverified.clear(),this.commandsSinceVerified=!1;if(Q?.envDirectory)KJ(Q.envDirectory);return this.unverifiedTeardowns.delete(J),{bind_id:Q?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length||$?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Q){let $=()=>{throw new F("vm_hands_env_invalid","env did not decrypt")},z=await crypto.subtle.importKey("spki",b(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch($),L=await crypto.subtle.deriveKey({name:"ECDH",public:z},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),U=await crypto.subtle.decrypt({name:"AES-GCM",iv:b(J.iv),additionalData:new TextEncoder().encode(Q)},L,b(J.ct)).catch($),N=JSON.parse(new TextDecoder().decode(U));if(!N||typeof N!=="object"||Array.isArray(N))throw new F("vm_hands_env_invalid","env not an object");return N}writeJobEnvRootOnly(J,Q){let $=t(this.options.envRoot,`bind-${J}`);aJ($,{mode:448});let z=qJ($);if(!z.isDirectory()||(z.mode&63)!==0||z.uid!==(process.getuid?.()??-1))throw new F("vm_hands_env_dir_unsafe","env directory is not root's 0700");let L=Q.variables&&typeof Q.variables==="object"?Q.variables:{},U=Object.entries(L).filter(([T,D])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(T)&&typeof D==="string").map(([T,D])=>`export ${T}='${String(D).replaceAll("'","'\\''")}'`).join(`
 `)+`
 `,N=t($,`.job.env.${WJ(8).toString("hex")}`),O=DJ(N,y.O_WRONLY|y.O_CREAT|y.O_EXCL|y.O_NOFOLLOW,384);try{xJ(O,U),TJ(O)}finally{MJ(O)}return nJ(N,t($,"job.env")),$}}function KJ(J){try{let Q=t(J,"job.env"),$=qJ(Q).size,z=DJ(Q,y.O_WRONLY|y.O_NOFOLLOW);try{xJ(z,Buffer.alloc($)),TJ(z)}finally{MJ(z)}}catch{}tJ(J,{recursive:!0,force:!0})}function $Q(J){if(J.length!==64)throw new F("vm_hands_signature_invalid","unexpected ECDSA signature length");let Q=(L)=>{let U=0;while(U<L.length-1&&L[U]===0)U++;let N=L.subarray(U),O=N[0]&128?Uint8Array.of(0,...N):N;return Uint8Array.of(2,O.length,...O)},$=Q(J.subarray(0,32)),z=Q(J.subarray(32));return Uint8Array.of(48,$.length+z.length,...$,...z)}import{randomUUID as zQ}from"crypto";var XQ="/app/local-runtime/session?register=vm_hands_v1",YQ="/app/local-runtime",wJ=25000,hJ=20000,GQ=1e4,yJ=5000,kJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),PJ=75000,WQ=2000,KQ=1e4,FQ=new Set(["vm_hands_no_register","vm_hands_register_failed"]),PQ=3,CQ=20000,NQ=250,UQ=2000;function fJ(J){let Q=Math.min(NQ*2**(J-1),UQ);return Math.round(Q/2+Math.random()*Q/2)}var EQ=5000;function BQ(J){return J>=500||J===408||J===429}var JJ=20000;function HJ(J,Q){return typeof J==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(J)?J:Q}class V extends Error{}var LQ=64,VJ=[1000,2000,4000,8000,15000,30000,60000,120000];function mJ(J){let Q=J&&typeof J==="object"&&"code"in J?J.code:null;return typeof Q==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(Q)?Q:"vm_hands_unbind_failed"}function AQ(J,Q,$,z,L){let U=$.turn.claim.attempt_id,N=J.healing??=new Set;if(N.has(U))return;N.add(U);let O=$.turn.claim.operation_id;(async()=>{for(let[T,D]of VJ.entries()){if(z.aborted)return;if(await new Promise((A)=>{let w=setTimeout(A,D);w.unref?.(),z.addEventListener("abort",()=>{clearTimeout(w),A()},{once:!0})}),z.aborted)return;try{let A=await Q.retryUnbind(U);L("vm_hands.unbind_healed",{operation_id:O,attempt:T+1}),J.receipts.push({...$,unbound:A}),J.flushReceipts?.();return}catch(A){let w=mJ(A);if(L("vm_hands.unbind_unverified",{operation_id:O,code:w,attempt:T+1}),w==="vm_hands_unbind_unknown")return}}L("vm_hands.unbind_heal_exhausted",{operation_id:O,attempts:VJ.length})})().finally(()=>N.delete(U))}async function bJ(J,Q){let $=[...J.modelOps.get(Q)??[]];for(let z of $)z.abort.abort();await Promise.race([Promise.all($.map((z)=>z.settled)),new Promise((z)=>setTimeout(z,yJ))])}async function _Q(J){let Q=[...J.personTerminals];for(let $ of Q)$.abort.abort();if(Q.length)await Promise.race([Promise.all(Q.map(($)=>$.settled)),new Promise(($)=>setTimeout($,yJ))]);return Q.length}async function p(J,Q,$){return await bJ(J,$),Q.unbind($)}function QJ(J){for(let Q of J.outbox?.splice(0)??[])Q.reject(Error("vm_hands_attempt_ended"))}var vJ=15000,OQ=1e4,jQ=1000;async function vQ(J){let Q=Date.now(),$={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:0},z=J.log??(()=>{}),L=async(O)=>{for(let[T,D]of[...$.turns]){$.turns.delete(T),J.onTurn?.(T,null),QJ(D);let A=await p($,J.agent,T).catch(()=>null);if(A)$.receipts.push({turn:D,failure:"vm_hands_bind_lost",unbound:A});z("vm_hands.bound_dropped",{reason:O})}},U=0,N=0;try{for(let O=0;!J.signal.aborted;O++){let T=await MQ(J,$).catch((A)=>{if(A instanceof F&&$.deviceId===null&&A.code==="vm_hands_no_session"&&Date.now()-Q<KQ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(A instanceof F&&$.deviceId===null&&FQ.has(A.code)&&U<PQ&&Date.now()-Q<CQ)return U++,N=fJ(U),z("vm_hands.register_retry",{attempt:U,code:A.code,delay_ms:N}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(A instanceof F&&$.deviceId===null)throw A;return{closeCode:0,closeReason:A instanceof Error?A.message:String(A)}});if(z("vm_hands.session_closed",{close_code:T.closeCode,reason:T.closeReason.slice(0,120),registered:$.deviceId!==null}),T.closeCode===4401||$.attest==="refused")return;if(J.signal.aborted)return;if($.turns.size&&Date.now()-$.lostAt>=PJ)await L("reconnect_deadline");if($.served)$.served=!1,O=0;let D=T.closeReason==="drain_reconnect"?0:T.closeReason==="vm_hands_register_retry"?N:T.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(O,5),2000):$.turns.size?Math.min(250*2**Math.min(O,5),5000,Math.max(0,$.lostAt+PJ-Date.now())):Math.min(500*2**O,30000);if(await new Promise((A)=>setTimeout(A,D)),$.turns.size&&Date.now()-$.lostAt>=PJ)await L("reconnect_deadline")}}finally{await L("session_ended")}}async function MQ(J,Q){let $=Q.deviceId,z=J.log??(()=>{}),L=$?`/app/local-runtime/session?device_id=${encodeURIComponent($)}`:XQ,U=`${J.apiOrigin.replace(/^http/,"ws")}${L}`,N=new WebSocket(U),O=0,T="",D=new Map,A=[],w=null,v=new Promise((Z)=>{N.onclose=(Y)=>{O=Y.code,T=Y.reason;for(let X of D.values())X.reject(new V(`session closed ${Y.code}`));for(let X of Q.attestWaiters.splice(0))X(!1);D.clear(),Z()}});N.onmessage=(Z)=>{let Y;try{Y=JSON.parse(String(Z.data))}catch{N.close(4400);return}if(Y.t==="res"){let X=Y;D.get(X.id)?.resolve({status:X.status,body:X.body}),D.delete(X.id);return}if(Y.t==="reconnect"){let X=Math.max(0,Math.min(Number(Y.after_ms)||0,jQ));z("vm_hands.drain_reconnect",{after_ms:X}),setTimeout(()=>{try{N.close(4001,"drain_reconnect")}catch{}},X).unref?.();return}if(!w?.(Y))A.push(Y)};let l=(Z,Y)=>new Promise((X,K)=>{let C=A.findIndex((B)=>Z.includes(B.t));if(C>=0){X(A.splice(C,1)[0]);return}let E=setTimeout(()=>{w=null,K(new F("vm_hands_no_register",`no ${Z.join("/")} in ${Y} ms`))},Y);w=(B)=>{if(!Z.includes(B.t))return!1;return clearTimeout(E),w=null,X(B),!0}}),u=(Z)=>N.send(JSON.stringify(Z)),k=(Z,Y)=>new Promise((X,K)=>{if(N.readyState!==WebSocket.OPEN){K(new V("session closed"));return}let C=zQ(),E=typeof Y.wait_ms==="number"?Y.wait_ms:0,B=setTimeout(()=>{if(!D.delete(C))return;K(new V(`no answer to ${Z.split("/").pop()} in ${E+vJ} ms`)),N.close(4000,"request_timeout")},E+vJ);D.set(C,{reject:(G)=>{clearTimeout(B),K(G)},resolve:({status:G,body:W})=>{clearTimeout(B);let P=null;try{P=W?JSON.parse(W):null}catch{}X({status:G,json:P})}}),u({t:"req",id:C,path:`${YQ}${Z}`,body:JSON.stringify(Y)})}),CJ=()=>N.close(1001,"stopping");J.signal.addEventListener("abort",CJ,{once:!0});let ZJ,o=new Map,d=new Map,$J=!1,zJ=new Set,XJ=new Set,YJ=Promise.resolve(),NJ=()=>{r().catch(()=>{return})},i=!1;try{await new Promise((G,W)=>{let P=setTimeout(()=>W(Error("session open timeout")),OQ);N.onopen=()=>{clearTimeout(P),z("vm_hands.ws_open",{}),G()},N.onerror=()=>{clearTimeout(P),W(Error("session socket error"))}});let Z=await l(["challenge"],5000);z("vm_hands.challenge",{});let Y=[],X=null,K;if($){u(await J.agent.helloFrame(Z.challenge,Q.connection));let G=await l(["ready"],1e4);if(typeof G.vm_hands_connection==="string")Q.connection=G.vm_hands_connection;if(K={device_id:$,...G.cadence?{cadence:G.cadence}:{}},typeof G.vm_hands_probe_script==="string"){if(X=G.vm_hands_probe_script,i=!0,J.agent.phase==="registered"&&!Q.turns.size)Q.attest="pending"}Q.served=!0,z("vm_hands.reconnected",{device_id:$});let W=Array.isArray(G.vm_hands_binds)?G.vm_hands_binds:G.vm_hands_bind?[G.vm_hands_bind]:[];for(let[P,M]of[...Q.turns]){if(W.some((x)=>x&&x.operation_id===M.claim.operation_id&&x.attempt_id===M.claim.attempt_id)){Y.push(M),z("vm_hands.bound_resumed",{operation_id:M.claim.operation_id});continue}Q.turns.delete(P),J.onTurn?.(P,null),QJ(M);let q=await p(Q,J.agent,P).catch((x)=>s(x,M,"vm_hands_bind_lost"));if(q)Q.receipts.push({turn:M,failure:"vm_hands_bind_lost",unbound:q});z("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{u(await J.agent.registerFrame(Z.challenge)),z("vm_hands.register_sent",{});let G=await Promise.race([l(["registered","register_refused"],1e4),v.then(()=>{throw new F(T==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(G.t==="register_refused")throw new F(G.code,"register refused");J.agent.registered();let W=G;if(K=W,Q.deviceId=W.device_id,typeof W.vm_hands_connection==="string")Q.connection=W.vm_hands_connection;if(typeof W.vm_hands_probe_script==="string"){if(X=W.vm_hands_probe_script,i=!0,J.agent.phase==="registered"&&!Q.turns.size)Q.attest="pending"}Q.served=!0,z("vm_hands.registered",{device_id:K.device_id})}let C=async()=>{let G=await k("/heartbeat",await J.heartbeat());if(G.status>=300)throw Error(`heartbeat ${G.status}`)};await C();let E=K.cadence?.presence_interval_ms??30000;if(ZJ=setInterval(()=>{C().catch(()=>N.close())},E),X&&Q.attest!=="accepted"&&J.agent.phase==="registered"&&!Q.turns.size)pJ(X,Z.challenge);let B=(G,W)=>{d.set(G,W().catch(async(P)=>{if(await UJ(P,G),P instanceof V)N.close();else await r().catch(()=>{return})}).finally(()=>{d.delete(G)}))};Q.flushReceipts=NJ;try{await r();for(let G of Y)G.flush=()=>EJ(G),G.flush(),B(G.claim.attempt_id,()=>BJ(G));while(!J.signal.aborted&&N.readyState===WebSocket.OPEN){let G=await k("/operations/claim",{wait_ms:Math.min(K.cadence?.claim_wait_ms??wJ,wJ)});if(G.status===204||!G.json)continue;if(G.status>=300)throw Error(`claim ${G.status}`);let W=G.json;if(W.capability==="hands.connect"){if(d.has(W.attempt_id)){h({claim:W,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}B(W.attempt_id,()=>lJ(W))}else oJ(W).catch(()=>{return})}}catch(G){await UJ(G,null)}}finally{if(ZJ)clearInterval(ZJ);J.signal.removeEventListener("abort",CJ);for(let Z of Q.turns.values())Z.flush=null;if(Q.flushReceipts===NJ)Q.flushReceipts=null;N.close(),await v,await Promise.all([...d.values()]);for(let Z of J.agent.liveBindIds){if(Q.turns.has(Z))continue;let Y=o.get(Z),X=Y?{...Y,eventSeq:Y.eventSeq+1}:null,K=await p(Q,J.agent,Z).catch((C)=>X?s(C,X,"vm_hands_bind_lost"):null);if(K&&X)Q.receipts.push({turn:X,failure:"vm_hands_bind_lost",unbound:K});z("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let Z of zJ)Z.abort()}return{closeCode:O,closeReason:T};async function UJ(Z,Y){if(Z instanceof V){if(!$J&&Q.turns.size)Q.lostAt=Date.now();$J=!0}else{let X=Y!==null?[Y]:[...new Set([...Q.turns.keys(),...J.agent.liveBindIds])];if(Y===null)$J=!0;for(let K of X){let C=Q.turns.get(K);if(Q.turns.delete(K),C)QJ(C),J.onTurn?.(K,null);if(J.agent.liveBindIds.includes(K)){let E=o.get(K)??C,B=E?{...E,eventSeq:E.eventSeq+1}:null,G=await p(Q,J.agent,K).catch((W)=>B?s(W,B,"vm_hands_bind_lost"):null);if(G&&B)Q.receipts.push({turn:B,failure:"vm_hands_bind_lost",unbound:G})}}}z("vm_hands.session_lost",{error:Z instanceof Error?Z.message:String(Z),bound_kept:Q.turns.size})}function h(Z){let Y=Z.claim,X={attempt_id:Y.attempt_id,attempt_token:Y.attempt_token},K=encodeURIComponent(Y.operation_id);return{fence:X,op:K,complete:(E,B={})=>k(`/operations/${K}/complete`,{...X,status:E,...B}),emit:(E,B)=>{let G=(Z.chain??Promise.resolve()).catch(()=>{return}).then(()=>C(E,B));return Z.chain=G,G}};async function C(E,B){let G=Z.eventSeq,W=(x)=>k(`/operations/${K}/events`,{...X,event_seq_start:x,events:[{kind:E,payload:{sequence:x,capability:String(Y.capability??"hands.connect"),data:B}}]}),P=G,M=await W(P),q=M.status===409?M.json?.expected_event_seq:void 0;if(typeof q==="number"&&q===G+1)M={status:200,json:{duplicate:!0}};else if(typeof q==="number"&&q>=0&&q!==G)P=q,M=await W(P);if(M.status<300)Z.eventSeq=P+1;return M}}function cJ(Z){return(Y,X)=>new Promise((K,C)=>{if(Q.turns.get(Z.claim.attempt_id)!==Z){C(Error("vm_hands_attempt_ended"));return}if(Z.outbox??=[],Z.outbox.length>=LQ){C(Error("vm_hands_outbox_full"));return}Z.outbox.push({kind:Y,data:X,resolve:K,reject:C}),Z.flush?.()})}function EJ(Z){if(XJ.has(Z))return;XJ.add(Z),(async()=>{try{while(Z.outbox?.length&&Q.turns.get(Z.claim.attempt_id)===Z&&N.readyState===WebSocket.OPEN){let Y=Z.outbox[0],X;try{X=await h(Z).emit(Y.kind,Y.data)}catch(K){if(K instanceof V)return;X={status:500}}if(Z.outbox.shift(),X.status<300)Y.resolve();else Y.reject(Error(`${Y.kind} refused ${X.status}`))}}finally{XJ.delete(Z)}})()}async function pJ(Z,Y){try{let X=await J.agent.attestFrame(Z,Y);if(N.readyState!==WebSocket.OPEN)return;u(X);let K=await l(["attested","attest_refused"],15000);Q.attest=K.t==="attested"?"accepted":"refused";for(let C of Q.attestWaiters.splice(0))C(Q.attest==="accepted");if(z("vm_hands.attest",{result:Q.attest,exit_code:X.exit_code,...K.t==="attest_refused"?{code:String(K.code??"")}:{}}),Q.attest==="refused")N.close(4401,"attest_refused")}catch(X){z("vm_hands.attest_failed",{code:X instanceof F?X.code:"probe_error"});for(let K of Q.attestWaiters.splice(0))K(!1);if(Q.attest!=="accepted")N.close(4000,"attest_unanswered")}}async function lJ(Z){let Y=i&&Q.attest==="pending",X=Z.vm_hands_attest,K=X;if(Q.attest==="refused"){z("vm_hands.claim_attest_refused",{said:typeof X==="string"?X.slice(0,16):typeof X,local:Q.attest}),await h({claim:Z,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(K==="accepted"){if(!Y&&Q.attest!=="accepted"){Q.attest="accepted";for(let _ of Q.attestWaiters.splice(0))_(!0)}}else if(K!=="pending"||!Y&&Q.attest!=="accepted"){z("vm_hands.claim_attest_refused",{said:typeof X==="string"?X.slice(0,16):typeof X,local:Q.attest}),await h({claim:Z,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Q.attest!=="accepted"){let _=Date.parse(Z.lease_until)-Date.now()-5000,H=Math.max(0,Math.min(JJ,Number.isFinite(_)?_:JJ));if(!await new Promise((n)=>{let sJ=setTimeout(()=>n(!1),H);Q.attestWaiters.push((rJ)=>{clearTimeout(sJ),n(rJ)})})){await h({claim:Z,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let C={claim:Z,eventSeq:0},{complete:E,emit:B}=h(C),G;try{if(Z.capability!=="hands.connect")throw new F("vm_hands_bind_invalid","not hands.connect");G=!FJ(Z)}catch(_){z("vm_hands.bind_refused",{code:_ instanceof F?_.code:"unexpected"}),await E("failed",{error_code:_ instanceof F?_.code:"vm_hands_bind_invalid"});return}let W,P=null,M=!1;Q.bindsStarting++;try{let _=await _Q(Q);if(_)z("vm_hands.person_terminals_closed",{count:_});let H=SJ(Z),a=J.agent.bind(H);if(H.workspace_deferred)M=!0,P=uJ(C,()=>M);W=await a}catch(_){z("vm_hands.bind_refused",{code:_ instanceof F?_.code:"unexpected"}),await E("failed",{error_code:_ instanceof F?_.code:"vm_hands_bind_failed"});return}finally{M=!1,Q.bindsStarting--}let q=P?await P:-1,x={...W.ready_data??J.readyData({launchId:W.launch_id,claim:Z})};if(G)delete x.environment_installed;let GJ=!G&&W.snapshot_revision!==null&&W.snapshot_id!==null?{environment_installed:{snapshot_id:W.snapshot_id,installed_revision:W.snapshot_revision}}:{};o.set(Z.attempt_id,{claim:Z,launchId:W.launch_id,readyData:x,eventSeq:C.eventSeq,ackSeq:-1});let g={...x,...GJ,vm_hands:{layout:W.layout,policy_digest:W.policy_digest,launch_id:W.launch_id}},f=Date.now()+EQ,R=1,j=await B("hands.ready",g);while(BQ(j.status)&&!J.signal.aborted){let _=fJ(R);if(Date.now()+_>=f)break;await new Promise((H)=>setTimeout(H,_)),R++,j=await B("hands.ready",g)}if(R>1)z("vm_hands.ready_retried",{attempts:R,status_class:`${Math.floor(j.status/100)}xx`});if(o.delete(Z.attempt_id),j.status>=300){await bJ(Q,Z.attempt_id),await J.agent.boundRefused(Z.attempt_id),await E("failed",{error_code:HJ(j.json?.error,"vm_hands_probe_failed")});return}let S={claim:Z,launchId:W.launch_id,readyData:x,eventSeq:C.eventSeq,ackSeq:q};Q.turns.set(Z.attempt_id,S),S.flush=()=>EJ(S),J.onTurn?.(Z.attempt_id,cJ(S)),await BJ(S)}async function uJ(Z,Y){let{fence:X,op:K}=h(Z),C=Z.claim.attempt_id,E=-1;try{for(;;){let B=await k(`/operations/${K}/heartbeat`,{...X,control_ack_seq:E,wait_ms:hJ});if(!Y())return E;if(B.status>=300)return J.agent.abandonWorkspaceGrant(C),E;let G=(B.json?.controls??[]).slice().sort((W,P)=>W.seq-P.seq);for(let W of G){if(W.seq<=E)continue;if(E=W.seq,W.kind===RJ)return z("vm_hands.workspace_granted",{}),J.agent.grantWorkspace(C),E;return z("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(W.kind)?W.kind:"other"}),J.agent.abandonWorkspaceGrant(C),E}}}catch{return J.agent.abandonWorkspaceGrant(C),E}}async function BJ(Z){let{fence:Y,op:X}=h(Z),K=null,C=null,E=J.agent.executorExited(Z.claim.attempt_id).then((B)=>{return C=B,null});J:for(;;){let B=await Promise.race([E,k(`/operations/${X}/heartbeat`,{...Y,control_ack_seq:Z.ackSeq,wait_ms:hJ})]);if(!B){K="vm_hands_executor_exited",z("vm_hands.executor_exited",{reason:C});break}if(B.status>=300)break;let G=(B.json?.controls??[]).slice().sort((W,P)=>W.seq-P.seq);for(let W of G){if(W.seq<=Z.ackSeq)continue;if(W.kind==="operation.cancel"||W.kind==="cancel"){Z.ackSeq=W.seq;break J}if(W.kind===gJ)try{await iJ(Z,W.payload??{})}catch(P){if(P instanceof V)throw P;K=P instanceof F?P.code:"environment_unavailable";let M=P&&typeof P==="object"&&"code"in P&&typeof P.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(P.code)?P.code:null;z("vm_hands.environment_refused",{code:K,cause:M});break J}Z.ackSeq=W.seq}}await dJ(Z,K)}async function oJ(Z){let Y=Z,X={claim:Y,eventSeq:0},{complete:K,emit:C,fence:E,op:B}={...h(X)},G=Z.vm_hands_origin==="person"?"person":"model",W=String(Z.capability??"");if(!J.executeOp){await K("failed",{error_code:"vm_hands_op_unsupported"});return}if(Z.vm_hands_attest==="accepted"&&Q.attest==="pending"&&!(i&&Q.attest==="pending")){Q.attest="accepted";for(let j of Q.attestWaiters.splice(0))j(!0)}if(Q.attest!=="accepted"){let j=Date.parse(String(Z.lease_until??""))-Date.now()-5000,S=Q.attest==="refused"?0:Math.max(0,Math.min(JJ,Number.isFinite(j)?j:JJ));if(!(S>0&&await new Promise((H)=>{let a=setTimeout(()=>H(!1),S);Q.attestWaiters.push((n)=>{clearTimeout(a),H(n)})}))){await K("failed",{error_code:"vm_hands_unattested"});return}}let P=J.agent.bindIdForRun(Y.run_id);if(G==="model"&&P===null){await K("failed",{error_code:"vm_hands_not_bound"});return}let M=W==="pty.start"&&G==="person"&&!Z.authority;if(M&&(J.agent.liveBindIds.length>0||Q.bindsStarting>0)){await K("failed",{error_code:"vm_hands_bound"});return}if(kJ.has(W)&&!M&&J.agent.liveBindIds.length===0){await K("failed",{error_code:"vm_hands_not_bound"});return}if(G==="model"&&P||kJ.has(W)&&!M)J.agent.opServed();let q=new AbortController;zJ.add(q);let x,GJ=new Promise((j)=>{x=j}),g={abort:q,settled:GJ};if(M)Q.personTerminals.add(g);if(G==="model"&&P){let j=Q.modelOps.get(P)??new Set;j.add(g),Q.modelOps.set(P,j),await J.agent.environmentInstalled(P,WQ,q.signal)}let f=-1,R=setInterval(()=>{k(`/operations/${B}/heartbeat`,{...E,control_ack_seq:f,wait_ms:0}).then((j)=>{if(j.status>=300){q.abort();return}let S=j.json?.controls??[];for(let _ of S)if(f=Math.max(f,_.seq),_.kind==="operation.cancel"||_.kind==="cancel")q.abort()},()=>q.abort())},GQ);try{let j=await J.executeOp({kind:G,claim:Z,...G==="model"&&P?{bindId:P}:{},signal:q.signal,emit:async(_)=>{await C(_.kind,_.data??{})}}),S=await K(j.status,{...j.result?{result:j.result}:{},...j.error_code?{error_code:HJ(j.error_code,"vm_hands_op_failed")}:{}});z("vm_hands.op",{capability:W,kind:G,status:j.status,code:j.error_code??null,...S.status>=300?{complete_status:S.status,complete_error:String(S.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval(R),zJ.delete(q),P)Q.modelOps.get(P)?.delete(g);Q.personTerminals.delete(g),x()}}async function dJ(Z,Y){let X=Z.claim.attempt_id;if(Q.turns.get(X)===Z)Q.turns.delete(X);J.onTurn?.(X,null),QJ(Z);let K=await p(Q,J.agent,X).catch((C)=>s(C,Z,Y));if(!K)return;Q.receipts.push({turn:Z,failure:Y,unbound:K}),await r()}function s(Z,Y,X){let K=mJ(Z);return z("vm_hands.unbind_unverified",{operation_id:Y.claim.operation_id,code:K,attempt:0}),h(Y).emit(IJ,{code:K}).catch(()=>{return}),AQ(Q,J.agent,{turn:Y,failure:X},J.signal,z),null}function r(){return YJ=YJ.then(LJ,LJ),YJ}async function LJ(){while(Q.receipts.length){let{turn:Z,failure:Y,unbound:X}=Q.receipts[0],{complete:K,emit:C}=h(Z);try{if(await C("hands.stopped",{...Z.readyData,reason_code:Y?"failed":"cancelled",killed_verified:X.killed_verified,shredded:X.shredded,...X.srt_fallbacks?{vm_hands_srt_fallbacks:X.srt_fallbacks}:{}}),Y)await K("failed",{error_code:Y});else await K("cancelled",{error_code:"driver_stopped"})}catch(E){if(E instanceof V)return}Q.receipts.shift()}}async function iJ(Z,Y){let{fence:X,op:K}=h(Z),C=Y.snapshot_id;if(Y.version!==1||typeof C!=="string"||Object.keys(Y).length!==2)throw new F("vm_hands_env_invalid","invalid environment delivery");let E=await k(`/operations/${K}/environment`,{...X,snapshot_id:C}),B=E.json?.environment_sealed;if(E.status!==200||!B||E.json?.payload!==void 0)throw new F("vm_hands_env_invalid","environment not delivered sealed");let G=await J.agent.deliverEnvironment({attemptId:Z.claim.attempt_id,snapshotId:C,deviceId:Q.deviceId??"",sealed:B});if((await k(`/operations/${K}/environment-ack`,{...X,...G})).status>=300)throw new F("vm_hands_env_ack_refused","environment ack refused")}}
-export{SQ as xa,ZQ as ya,vQ as za};
+export{SQ as za,ZQ as Aa,vQ as Ba};

package/bin/vm-hands/{vm-hands-entry-lite-g7h6wjqy.js → vm-hands-entry-lite-nqvb7a2m.js}

@@ -1,3 +1,3 @@
 // @bun
 import{spawn as N}from"child_process";import{statSync as O}from"fs";import{delimiter as Q,join as R}from"path";function X(q,z=process.env.PATH??"",D=process.env,G=process.platform){let A=G==="win32",H=q.includes("/")||A&&q.includes("\\");if(!q||H||q.includes("\x00"))return!1;let I=A?["",...(D.PATHEXT??".EXE;.CMD;.BAT;.COM").split(";")]:[""];return z.split(Q).some((C)=>{if(!C)return!1;return I.some((E)=>{if(E===void 0)return!1;try{let J=O(R(C,`${q}${E}`));if(!J.isFile())return!1;return A||(J.mode&73)!==0}catch{return!1}})})}async function K(q){if(!q)return"";let z=[];try{for await(let D of q)z.push(Buffer.from(D))}catch{}return Buffer.concat(z).toString("utf8")}async function Y(q,z){let[D,...G]=q;if(!D)throw Error("A child process probe requires a program.");if(z.signal?.aborted)return{exitCode:-1,stdout:"",stderr:""};let A=N(D,G,{stdio:["ignore","pipe","pipe"],...z.env?{env:z.env}:{}}),H=K(A.stdout),I=K(A.stderr),C=()=>{try{A.kill()}catch{}};if(z.signal?.aborted)C();else z.signal?.addEventListener("abort",C,{once:!0});let E;try{return{exitCode:await Promise.race([new Promise((F)=>{A.once("error",()=>F(-1)),A.once("close",(M)=>F(M??-1))}),new Promise((F)=>{E=setTimeout(()=>{C(),F(-1)},z.timeoutMs)})]),stdout:await H,stderr:await I}}finally{if(E)clearTimeout(E);z.signal?.removeEventListener("abort",C)}}function Z(q){if(!(q>0))return;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,q)}
-export{X as dd,Y as ed,Z as fd};
+export{X as fd,Y as gd,Z as hd};

package/bin/vm-hands/{vm-hands-entry-lite-ew7amfaf.js → vm-hands-entry-lite-qg11k3bf.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Mk as l}from"./vm-hands-entry-lite-hkvkfq0z.js";import{execFile as zj,spawn as I}from"child_process";var Cj="h264_ws_v1",kj="video",h=["smooth","sharp","data_saver","balanced"];var Yj="video_presets";var V=8388608,Y=65536,Lj="control",Aj="v1",d=200;function s(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q,J=(Q)=>typeof Q==="string"&&Q.length>0&&Q.length<=d;if(Object.keys(j).length!==2||!J(j.user_id)||!J(j.name))return null;return{user_id:j.user_id,name:j.name}}var xj="windows",Mj="v1",A=200,o=(q)=>typeof q==="string"&&h.includes(q);function fj(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q;if(Object.keys(j).length!==2||j.format!=="h264_ws_v1"||!o(j.preset))return null;return{format:"h264_ws_v1",preset:j.preset}}var $={hello:1,frame:2,stats:3,pong:4,serverClipboard:5,error:6,audioHello:7,audio:8,control:9,windows:10,pointer:16,key:17,config:18,ping:19,clientClipboard:20,keyframeRequest:21,ack:22,audioEnable:23};class U extends Error{constructor(q){super(q);this.name="DisplayVideoProtocolError"}}var e=new TextEncoder,jj=new TextDecoder("utf-8",{fatal:!0});function H(q,j){if(j.byteLength+1>V)throw new U("message_too_large");let J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,j.byteLength+1),Q.setUint8(4,q),J.set(j,5),J}function R(q){let j=e.encode(q);if(j.byteLength>Y)throw new U("text_too_large");return j}function f(q,j){if(!Number.isInteger(q)||q<0||q>65535)throw new U(`invalid_${j}`);return q}function qj(q){if(!Number.isFinite(q))throw new U("invalid_window");return Math.max(-2147483648,Math.min(2147483647,Math.round(q)))}function hj(q){switch(q.type){case"hello":{let j=R(q.codec),J=new Uint8Array(6+j.byteLength),Q=new DataView(J.buffer);return Q.setUint16(0,f(q.width,"width")),Q.setUint16(2,f(q.height,"height")),Q.setUint8(4,Math.max(1,Math.min(240,Math.round(q.fps)))),Q.setUint8(5,h.indexOf(q.preset)),J.set(j,6),H($.hello,J)}case"frame":{let j=new Uint8Array(13+q.data.byteLength),J=new DataView(j.buffer);return J.setUint8(0,q.key?1:0),J.setUint32(1,q.seq>>>0),J.setBigUint64(5,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,13),H($.frame,j)}case"stats":return H($.stats,R(JSON.stringify(q.stats)));case"pong":case"ping":{let j=new Uint8Array(8);return new DataView(j.buffer).setFloat64(0,q.token),H(q.type==="ping"?$.ping:$.pong,j)}case"serverClipboard":return H($.serverClipboard,R(q.text));case"clientClipboard":return H($.clientClipboard,R(q.text));case"error":return H($.error,R(q.code));case"pointer":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint16(0,f(q.x,"x")),J.setUint16(2,f(q.y,"y")),J.setUint8(4,q.buttons&255),H($.pointer,j)}case"key":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint8(0,q.down?1:0),J.setUint32(1,q.keysym>>>0),H($.key,j)}case"config":return H($.config,Uint8Array.of(h.indexOf(q.preset)));case"keyframeRequest":return H($.keyframeRequest,new Uint8Array(0));case"audioHello":{let j=R(q.codec),J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,q.sampleRate>>>0),Q.setUint8(4,q.channels&255),J.set(j,5),H($.audioHello,J)}case"audio":{let j=new Uint8Array(8+q.data.byteLength);return new DataView(j.buffer).setBigUint64(0,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,8),H($.audio,j)}case"control":return H($.control,R(JSON.stringify(q.control)));case"windows":{let j=q.bounds.slice(0,A),J=new Uint8Array(j.length*16),Q=new DataView(J.buffer);return j.forEach((Z,z)=>{[Z.x,Z.y,Z.width,Z.height].forEach((G,F)=>Q.setInt32(z*16+F*4,qj(G)))}),H($.windows,J)}case"audioEnable":return H($.audioEnable,Uint8Array.of(q.on?1:0));case"ack":{let j=new Uint8Array(4);return new DataView(j.buffer).setUint32(0,q.seq>>>0),H($.ack,j)}}}function T(q){let j=h[q];if(!j)throw new U("invalid_preset");return j}function C(q,j){if(q.byteLength!==j)throw new U("invalid_length")}function k(q){if(q.byteLength>Y)throw new U("text_too_large");try{return jj.decode(q)}catch{throw new U("invalid_text")}}function Jj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_stats")}let J=j;if(!J||typeof J!=="object"||["fps","kbps","dropped","restarts","queued_bytes"].some((Z)=>typeof J[Z]!=="number"||!Number.isFinite(J[Z])))throw new U("invalid_stats");return{fps:J.fps,kbps:J.kbps,dropped:J.dropped,restarts:J.restarts,queued_bytes:J.queued_bytes}}function Qj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_control")}let J=j;if(!J||typeof J!=="object"||typeof J.you!=="boolean"||typeof J.same_user!=="boolean")throw new U("invalid_control");let Q=J.holder===null?null:s(J.holder);if(Q===null&&J.holder!==null)throw new U("invalid_control");return{holder:Q,you:J.you,same_user:J.same_user}}function Zj(q,j){let J=new DataView(j.buffer,j.byteOffset,j.byteLength);switch(q){case $.hello:if(j.byteLength<6)throw new U("invalid_length");return{type:"hello",width:J.getUint16(0),height:J.getUint16(2),fps:J.getUint8(4),preset:T(J.getUint8(5)),codec:k(j.subarray(6))};case $.frame:if(j.byteLength<14)throw new U("invalid_length");if(J.getUint8(0)>1)throw new U("invalid_frame_flags");return{type:"frame",key:J.getUint8(0)===1,seq:J.getUint32(1),captureMicros:Number(J.getBigUint64(5)),data:j.subarray(13)};case $.stats:return{type:"stats",stats:Jj(j)};case $.ping:case $.pong:return C(j,8),{type:q===$.ping?"ping":"pong",token:J.getFloat64(0)};case $.serverClipboard:return{type:"serverClipboard",text:k(j)};case $.clientClipboard:return{type:"clientClipboard",text:k(j)};case $.error:return{type:"error",code:k(j)};case $.pointer:return C(j,5),{type:"pointer",x:J.getUint16(0),y:J.getUint16(2),buttons:J.getUint8(4)};case $.key:if(C(j,5),J.getUint8(0)>1)throw new U("invalid_key_flags");return{type:"key",down:J.getUint8(0)===1,keysym:J.getUint32(1)};case $.config:return C(j,1),{type:"config",preset:T(J.getUint8(0))};case $.keyframeRequest:return C(j,0),{type:"keyframeRequest"};case $.audioHello:if(j.byteLength<5)throw new U("invalid_length");return{type:"audioHello",sampleRate:J.getUint32(0),channels:J.getUint8(4),codec:k(j.subarray(5))};case $.audio:if(j.byteLength<9)throw new U("invalid_length");return{type:"audio",captureMicros:Number(J.getBigUint64(0)),data:j.subarray(8)};case $.audioEnable:if(C(j,1),J.getUint8(0)>1)throw new U("invalid_audio_flags");return{type:"audioEnable",on:J.getUint8(0)===1};case $.control:return{type:"control",control:Qj(j)};case $.windows:{if(j.byteLength%16!==0||j.byteLength>A*16)throw new U("invalid_length");let Q=[];for(let Z=0;Z<j.byteLength;Z+=16)Q.push({x:J.getInt32(Z),y:J.getInt32(Z+4),width:J.getInt32(Z+8),height:J.getInt32(Z+12)});return{type:"windows",bounds:Q}}case $.ack:return C(j,4),{type:"ack",seq:J.getUint32(0)};default:return null}}class $j{buffer=new Uint8Array(0);push(q){let j=new Uint8Array(this.buffer.byteLength+q.byteLength);j.set(this.buffer),j.set(q,this.buffer.byteLength);let J=[],Q=0;while(j.byteLength-Q>=4){let Z=new DataView(j.buffer,j.byteOffset+Q,4).getUint32(0);if(Z<1||Z>V)throw new U("invalid_message_length");if(j.byteLength-Q-4<Z)break;let z=j[Q+4],G=j.slice(Q+5,Q+4+Z),F=Zj(z,G);if(F)J.push(F);Q+=4+Z}return this.buffer=j.slice(Q),J}}var t="/usr/bin/osascript",Gj=5000,Kj=1048576,Uj=String.raw`
+import{Pk as l}from"./vm-hands-entry-lite-f28ehysx.js";import{execFile as zj,spawn as I}from"child_process";var Cj="h264_ws_v1",kj="video",h=["smooth","sharp","data_saver","balanced"];var Yj="video_presets";var V=8388608,Y=65536,Lj="control",Aj="v1",d=200;function s(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q,J=(Q)=>typeof Q==="string"&&Q.length>0&&Q.length<=d;if(Object.keys(j).length!==2||!J(j.user_id)||!J(j.name))return null;return{user_id:j.user_id,name:j.name}}var xj="windows",Mj="v1",A=200,o=(q)=>typeof q==="string"&&h.includes(q);function fj(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q;if(Object.keys(j).length!==2||j.format!=="h264_ws_v1"||!o(j.preset))return null;return{format:"h264_ws_v1",preset:j.preset}}var $={hello:1,frame:2,stats:3,pong:4,serverClipboard:5,error:6,audioHello:7,audio:8,control:9,windows:10,pointer:16,key:17,config:18,ping:19,clientClipboard:20,keyframeRequest:21,ack:22,audioEnable:23};class U extends Error{constructor(q){super(q);this.name="DisplayVideoProtocolError"}}var e=new TextEncoder,jj=new TextDecoder("utf-8",{fatal:!0});function H(q,j){if(j.byteLength+1>V)throw new U("message_too_large");let J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,j.byteLength+1),Q.setUint8(4,q),J.set(j,5),J}function R(q){let j=e.encode(q);if(j.byteLength>Y)throw new U("text_too_large");return j}function f(q,j){if(!Number.isInteger(q)||q<0||q>65535)throw new U(`invalid_${j}`);return q}function qj(q){if(!Number.isFinite(q))throw new U("invalid_window");return Math.max(-2147483648,Math.min(2147483647,Math.round(q)))}function hj(q){switch(q.type){case"hello":{let j=R(q.codec),J=new Uint8Array(6+j.byteLength),Q=new DataView(J.buffer);return Q.setUint16(0,f(q.width,"width")),Q.setUint16(2,f(q.height,"height")),Q.setUint8(4,Math.max(1,Math.min(240,Math.round(q.fps)))),Q.setUint8(5,h.indexOf(q.preset)),J.set(j,6),H($.hello,J)}case"frame":{let j=new Uint8Array(13+q.data.byteLength),J=new DataView(j.buffer);return J.setUint8(0,q.key?1:0),J.setUint32(1,q.seq>>>0),J.setBigUint64(5,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,13),H($.frame,j)}case"stats":return H($.stats,R(JSON.stringify(q.stats)));case"pong":case"ping":{let j=new Uint8Array(8);return new DataView(j.buffer).setFloat64(0,q.token),H(q.type==="ping"?$.ping:$.pong,j)}case"serverClipboard":return H($.serverClipboard,R(q.text));case"clientClipboard":return H($.clientClipboard,R(q.text));case"error":return H($.error,R(q.code));case"pointer":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint16(0,f(q.x,"x")),J.setUint16(2,f(q.y,"y")),J.setUint8(4,q.buttons&255),H($.pointer,j)}case"key":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint8(0,q.down?1:0),J.setUint32(1,q.keysym>>>0),H($.key,j)}case"config":return H($.config,Uint8Array.of(h.indexOf(q.preset)));case"keyframeRequest":return H($.keyframeRequest,new Uint8Array(0));case"audioHello":{let j=R(q.codec),J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,q.sampleRate>>>0),Q.setUint8(4,q.channels&255),J.set(j,5),H($.audioHello,J)}case"audio":{let j=new Uint8Array(8+q.data.byteLength);return new DataView(j.buffer).setBigUint64(0,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,8),H($.audio,j)}case"control":return H($.control,R(JSON.stringify(q.control)));case"windows":{let j=q.bounds.slice(0,A),J=new Uint8Array(j.length*16),Q=new DataView(J.buffer);return j.forEach((Z,z)=>{[Z.x,Z.y,Z.width,Z.height].forEach((G,F)=>Q.setInt32(z*16+F*4,qj(G)))}),H($.windows,J)}case"audioEnable":return H($.audioEnable,Uint8Array.of(q.on?1:0));case"ack":{let j=new Uint8Array(4);return new DataView(j.buffer).setUint32(0,q.seq>>>0),H($.ack,j)}}}function T(q){let j=h[q];if(!j)throw new U("invalid_preset");return j}function C(q,j){if(q.byteLength!==j)throw new U("invalid_length")}function k(q){if(q.byteLength>Y)throw new U("text_too_large");try{return jj.decode(q)}catch{throw new U("invalid_text")}}function Jj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_stats")}let J=j;if(!J||typeof J!=="object"||["fps","kbps","dropped","restarts","queued_bytes"].some((Z)=>typeof J[Z]!=="number"||!Number.isFinite(J[Z])))throw new U("invalid_stats");return{fps:J.fps,kbps:J.kbps,dropped:J.dropped,restarts:J.restarts,queued_bytes:J.queued_bytes}}function Qj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_control")}let J=j;if(!J||typeof J!=="object"||typeof J.you!=="boolean"||typeof J.same_user!=="boolean")throw new U("invalid_control");let Q=J.holder===null?null:s(J.holder);if(Q===null&&J.holder!==null)throw new U("invalid_control");return{holder:Q,you:J.you,same_user:J.same_user}}function Zj(q,j){let J=new DataView(j.buffer,j.byteOffset,j.byteLength);switch(q){case $.hello:if(j.byteLength<6)throw new U("invalid_length");return{type:"hello",width:J.getUint16(0),height:J.getUint16(2),fps:J.getUint8(4),preset:T(J.getUint8(5)),codec:k(j.subarray(6))};case $.frame:if(j.byteLength<14)throw new U("invalid_length");if(J.getUint8(0)>1)throw new U("invalid_frame_flags");return{type:"frame",key:J.getUint8(0)===1,seq:J.getUint32(1),captureMicros:Number(J.getBigUint64(5)),data:j.subarray(13)};case $.stats:return{type:"stats",stats:Jj(j)};case $.ping:case $.pong:return C(j,8),{type:q===$.ping?"ping":"pong",token:J.getFloat64(0)};case $.serverClipboard:return{type:"serverClipboard",text:k(j)};case $.clientClipboard:return{type:"clientClipboard",text:k(j)};case $.error:return{type:"error",code:k(j)};case $.pointer:return C(j,5),{type:"pointer",x:J.getUint16(0),y:J.getUint16(2),buttons:J.getUint8(4)};case $.key:if(C(j,5),J.getUint8(0)>1)throw new U("invalid_key_flags");return{type:"key",down:J.getUint8(0)===1,keysym:J.getUint32(1)};case $.config:return C(j,1),{type:"config",preset:T(J.getUint8(0))};case $.keyframeRequest:return C(j,0),{type:"keyframeRequest"};case $.audioHello:if(j.byteLength<5)throw new U("invalid_length");return{type:"audioHello",sampleRate:J.getUint32(0),channels:J.getUint8(4),codec:k(j.subarray(5))};case $.audio:if(j.byteLength<9)throw new U("invalid_length");return{type:"audio",captureMicros:Number(J.getBigUint64(0)),data:j.subarray(8)};case $.audioEnable:if(C(j,1),J.getUint8(0)>1)throw new U("invalid_audio_flags");return{type:"audioEnable",on:J.getUint8(0)===1};case $.control:return{type:"control",control:Qj(j)};case $.windows:{if(j.byteLength%16!==0||j.byteLength>A*16)throw new U("invalid_length");let Q=[];for(let Z=0;Z<j.byteLength;Z+=16)Q.push({x:J.getInt32(Z),y:J.getInt32(Z+4),width:J.getInt32(Z+8),height:J.getInt32(Z+12)});return{type:"windows",bounds:Q}}case $.ack:return C(j,4),{type:"ack",seq:J.getUint32(0)};default:return null}}class $j{buffer=new Uint8Array(0);push(q){let j=new Uint8Array(this.buffer.byteLength+q.byteLength);j.set(this.buffer),j.set(q,this.buffer.byteLength);let J=[],Q=0;while(j.byteLength-Q>=4){let Z=new DataView(j.buffer,j.byteOffset+Q,4).getUint32(0);if(Z<1||Z>V)throw new U("invalid_message_length");if(j.byteLength-Q-4<Z)break;let z=j[Q+4],G=j.slice(Q+5,Q+4+Z),F=Zj(z,G);if(F)J.push(F);Q+=4+Z}return this.buffer=j.slice(Q),J}}var t="/usr/bin/osascript",Gj=5000,Kj=1048576,Uj=String.raw`
 ObjC.import("CoreGraphics");
 ObjC.import("ApplicationServices");
 ObjC.import("AppKit");
@@ -109,4 +109,4 @@ function run() {
 `);X>=0;X=B.indexOf(`
 `)){let S=B.slice(0,X);if(B=B.slice(X+1),!S.startsWith("c "))continue;let O=S.slice(2);if(O.length>Math.ceil(Y/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(O)){K({reason:"display_protocol"});return}let _=Buffer.from(O,"base64");if(_.byteLength<=Y)q.clipboard(_.toString("utf8"));if(z)return}if(B.length>Math.ceil(Y/3)*4+2)K({reason:"display_protocol"})}),G.once("error",()=>W("Reason could not watch this Mac's desktop clipboard.")),G.once("exit",()=>{if(!z)W("Reason could not watch this Mac's desktop clipboard.")})};return J.stdout.on("data",(B)=>{if(z||Z===null)return;Z+=B.toString("utf8");let N=Z.indexOf(`
 `);if(N<0){if(Z.length>4096)K({reason:"display_protocol"});return}let X=y(Z.slice(0,N));if(Z=null,!X)K({reason:"display_protocol"});else if(!X.screen||!X.accessibility)W(j.length>0?"Reason's background worker needs Screen Recording and Accessibility on this Mac (its own Reason entry in System Settings > Privacy & Security, not the Reason app's): run `reason permissions allow` on this Mac.":"Allow Screen Recording and Accessibility for this Mac's Reason worker, then restart it.");else i(),q.ready({width:X.width,height:X.height})}),J.stdin.on("error",()=>{return}),J.once("error",()=>W("Reason could not start this Mac's desktop input.")),J.once("exit",()=>{if(Z!==null)W("Reason could not start this Mac's desktop input.");else K({reason:"display_closed"})}),{pointer:(B,N,X)=>L(Q.pointer(B,N,X)),key:(B,N)=>L(Q.key(B,N)),clipboard:(B)=>L([`c ${Buffer.from(B,"utf8").toString("base64")}`]),close(){z=!0,F()}}}
-export{Cj as Xj,kj as Yj,h as Zj,Yj as _j,Y as $j,Lj as ak,Aj as bk,s as ck,xj as dk,Mj as ek,fj as fk,hj as gk,$j as hk,y as ik,Sj as jk,_j as kk,Hj as lk,Tj as mk,a as nk,Vj as ok};
+export{Cj as _j,kj as $j,h as ak,Yj as bk,Y as ck,Lj as dk,Aj as ek,s as fk,xj as gk,Mj as hk,fj as ik,hj as jk,$j as kk,y as lk,Sj as mk,_j as nk,Hj as ok,Tj as pk,a as qk,Vj as rk};

package/bin/vm-hands/{vm-hands-entry-lite-mkynexaq.js → vm-hands-entry-lite-rbjky7rd.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Kk as D}from"./vm-hands-entry-lite-04y4b7c6.js";import{Lk as M}from"./vm-hands-entry-lite-0a1ch6wx.js";import{execFileSync as A}from"child_process";import{realpathSync as U,statSync as F}from"fs";import{tmpdir as j}from"os";import{createRequire as I}from"module";import{win32 as Z}from"path";var J=["/bin/bash","/usr/bin/bash"],u="Git Bash was not found. Install Git for Windows (https://git-scm.com/download/win), then run `reason connect`.";function k(K){try{return F(K).isFile()}catch{return!1}}var q=(K)=>[Z.join(K,"bin","bash.exe"),Z.join(K,"usr","bin","bash.exe")];function O(K,Q){let L=Z.normalize(K).toLowerCase(),Y=(Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows").toLowerCase();return L.startsWith(Z.join(Y,"system32").toLowerCase()+"\\")||L.startsWith(Z.join(Y,"sysnative").toLowerCase()+"\\")||L.includes("\\windowsapps\\")}function C(K=process.env,Q=k){let L=[];for(let Y of(K.PATH??K.Path??"").split(";"))if(Y&&Z.isAbsolute(Y))L.push(Z.join(Y,"git.exe"));for(let Y of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if(Y)L.push(Z.join(Y,"Git","cmd","git.exe"));if(K.LOCALAPPDATA)L.push(Z.join(K.LOCALAPPDATA,"Programs","Git","cmd","git.exe"));return L.find(Q)??null}var T;function w(K=process.platform){if(K!=="win32")return"git";return T??=C(),T}function P(K){let Q=process.platform==="win32"?C(K):"git";if(!Q)return null;try{return A(Q,["--exec-path"],{encoding:"utf8",timeout:5000,windowsHide:!0,stdio:["ignore","pipe","ignore"],env:K}).trim()||null}catch{return null}}function G(K=process.env,Q=P,L=k){let Y=[],H=Q(K);if(H)Y.push(...q(Z.resolve(H,"..","..","..")));for(let $ of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if($)Y.push(...q(Z.join($,"Git")));if(K.LOCALAPPDATA)Y.push(...q(Z.join(K.LOCALAPPDATA,"Programs","Git")));for(let $ of(K.PATH??K.Path??"").split(";"))if($&&Z.isAbsolute($))Y.push(Z.join($,"bash.exe"));return Y.find(($)=>!O($,K)&&L($))??null}var z;function W(K=process.platform){if(K!=="win32")return J.find(k)??null;return z??=G(),z}function f(K=process.platform){let Q=W(K);if(!Q)throw Error(K==="win32"?u:"bash_unavailable");return Q}function h(K=process.platform){return U(K==="win32"?j():"/tmp")}function X(K=process.platform,Q=process.env){if(K!=="win32")return"/usr/bin:/bin";let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return[Z.join(L,"System32"),L,Z.join(L,"System32","Wbem"),Z.join(L,"System32","WindowsPowerShell","v1.0")].join(";")}function _(K,Q=process.platform){if(Q!=="win32"||/[\\/]/.test(K))return K;let L=/\.exe$/i.test(K)?K:`${K}.exe`,Y=X(Q).split(";");return Z.join(L.toLowerCase()==="powershell.exe"?Y[3]:Y[0],L)}function v(K=process.platform,Q=process.env){if(K!=="win32")return{PATH:X(K)};let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return{PATH:X(K,Q),SystemRoot:L,WINDIR:L}}function c(K=process.platform){return K==="win32"?{windowsHide:!0}:{detached:!0}}var V;function N(){if(V===void 0)V=D(M)(I(import.meta.url));return V}function p(K,Q=process.platform){let L=K.pid;if(Q!=="win32"||L===void 0)return;let Y=N();if(Y?.track(L))K.once("close",()=>Y.release(L))}function l(K,Q="SIGTERM",L=process.platform){if(L!=="win32"){process.kill(-K,Q);return}if(Q===0){process.kill(K,0);return}if(N()?.terminate(K))return;A(_("taskkill",L),["/PID",String(K),"/T","/F"],{stdio:"ignore",timeout:1e4,windowsHide:!0})}function d(K,Q=63,L=process.platform){return L==="win32"||K.uid===process.getuid?.()&&(K.mode&Q)===0}var x=/^(?:con|prn|aux|nul|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3]|conin\$|conout\$)(?:\..*)?$|:|[. ]$/i;function s(K){return K!=="."&&K!==".."&&x.test(K)}
-export{u as xk,w as yk,W as zk,f as Ak,h as Bk,X as Ck,_ as Dk,v as Ek,c as Fk,p as Gk,l as Hk,d as Ik,s as Jk};
+import{Nk as D}from"./vm-hands-entry-lite-b8bcnenf.js";import{Ok as M}from"./vm-hands-entry-lite-x96qadgp.js";import{execFileSync as A}from"child_process";import{realpathSync as U,statSync as F}from"fs";import{tmpdir as j}from"os";import{createRequire as I}from"module";import{win32 as Z}from"path";var J=["/bin/bash","/usr/bin/bash"],u="Git Bash was not found. Install Git for Windows (https://git-scm.com/download/win), then run `reason connect`.";function k(K){try{return F(K).isFile()}catch{return!1}}var q=(K)=>[Z.join(K,"bin","bash.exe"),Z.join(K,"usr","bin","bash.exe")];function O(K,Q){let L=Z.normalize(K).toLowerCase(),Y=(Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows").toLowerCase();return L.startsWith(Z.join(Y,"system32").toLowerCase()+"\\")||L.startsWith(Z.join(Y,"sysnative").toLowerCase()+"\\")||L.includes("\\windowsapps\\")}function C(K=process.env,Q=k){let L=[];for(let Y of(K.PATH??K.Path??"").split(";"))if(Y&&Z.isAbsolute(Y))L.push(Z.join(Y,"git.exe"));for(let Y of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if(Y)L.push(Z.join(Y,"Git","cmd","git.exe"));if(K.LOCALAPPDATA)L.push(Z.join(K.LOCALAPPDATA,"Programs","Git","cmd","git.exe"));return L.find(Q)??null}var T;function w(K=process.platform){if(K!=="win32")return"git";return T??=C(),T}function P(K){let Q=process.platform==="win32"?C(K):"git";if(!Q)return null;try{return A(Q,["--exec-path"],{encoding:"utf8",timeout:5000,windowsHide:!0,stdio:["ignore","pipe","ignore"],env:K}).trim()||null}catch{return null}}function G(K=process.env,Q=P,L=k){let Y=[],H=Q(K);if(H)Y.push(...q(Z.resolve(H,"..","..","..")));for(let $ of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if($)Y.push(...q(Z.join($,"Git")));if(K.LOCALAPPDATA)Y.push(...q(Z.join(K.LOCALAPPDATA,"Programs","Git")));for(let $ of(K.PATH??K.Path??"").split(";"))if($&&Z.isAbsolute($))Y.push(Z.join($,"bash.exe"));return Y.find(($)=>!O($,K)&&L($))??null}var z;function W(K=process.platform){if(K!=="win32")return J.find(k)??null;return z??=G(),z}function f(K=process.platform){let Q=W(K);if(!Q)throw Error(K==="win32"?u:"bash_unavailable");return Q}function h(K=process.platform){return U(K==="win32"?j():"/tmp")}function X(K=process.platform,Q=process.env){if(K!=="win32")return"/usr/bin:/bin";let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return[Z.join(L,"System32"),L,Z.join(L,"System32","Wbem"),Z.join(L,"System32","WindowsPowerShell","v1.0")].join(";")}function _(K,Q=process.platform){if(Q!=="win32"||/[\\/]/.test(K))return K;let L=/\.exe$/i.test(K)?K:`${K}.exe`,Y=X(Q).split(";");return Z.join(L.toLowerCase()==="powershell.exe"?Y[3]:Y[0],L)}function v(K=process.platform,Q=process.env){if(K!=="win32")return{PATH:X(K)};let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return{PATH:X(K,Q),SystemRoot:L,WINDIR:L}}function c(K=process.platform){return K==="win32"?{windowsHide:!0}:{detached:!0}}var V;function N(){if(V===void 0)V=D(M)(I(import.meta.url));return V}function p(K,Q=process.platform){let L=K.pid;if(Q!=="win32"||L===void 0)return;let Y=N();if(Y?.track(L))K.once("close",()=>Y.release(L))}function l(K,Q="SIGTERM",L=process.platform){if(L!=="win32"){process.kill(-K,Q);return}if(Q===0){process.kill(K,0);return}if(N()?.terminate(K))return;A(_("taskkill",L),["/PID",String(K),"/T","/F"],{stdio:"ignore",timeout:1e4,windowsHide:!0})}function d(K,Q=63,L=process.platform){return L==="win32"||K.uid===process.getuid?.()&&(K.mode&Q)===0}var x=/^(?:con|prn|aux|nul|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3]|conin\$|conout\$)(?:\..*)?$|:|[. ]$/i;function s(K){return K!=="."&&K!==".."&&x.test(K)}
+export{u as Ak,w as Bk,W as Ck,f as Dk,h as Ek,X as Fk,_ as Gk,v as Hk,c as Ik,p as Jk,l as Kk,d as Lk,s as Mk};

package/bin/vm-hands/{vm-hands-entry-lite-rtt2w6c6.js → vm-hands-entry-lite-swwb5mp2.js}

@@ -1,3 +1,3 @@
 // @bun
 function r(n){return typeof n==="object"&&n!==null&&!Array.isArray(n)}
-export{r as _c};
+export{r as ad};

package/bin/vm-hands/{vm-hands-entry-lite-cbkszaqs.js → vm-hands-entry-lite-t4yebd6d.js}

@@ -1,5 +1,5 @@
 // @bun
-import{ne as Qz,re as Zz,te as R,we as $z}from"./vm-hands-entry-lite-ajmxhzs9.js";import{ti as zz}from"./vm-hands-entry-lite-923jmcs3.js";import{Ji as e}from"./vm-hands-entry-lite-shm5nhjk.js";import{bj as Hz,pj as V,rj as Jz}from"./vm-hands-entry-lite-h8ykfv9r.js";import{Dk as X}from"./vm-hands-entry-lite-mkynexaq.js";import{spawnSync as C}from"child_process";import{createHash as Iz,randomUUID as Wz}from"crypto";import{chmodSync as bz,existsSync as y,mkdirSync as Sz,readdirSync as wz,readFileSync as L,renameSync as _z,rmSync as Y,statSync as xz,writeFileSync as Rz}from"fs";import{dirname as yz,isAbsolute as Bz,join as N}from"path";import{spawnSync as Oz}from"child_process";import{readFileSync as Cz}from"fs";import{userInfo as v}from"os";import{join as Kz}from"path";var Vz="REASON_SCHEDULED_TASK";function l(H){return Kz(H,"AppData","Local","Reason","Tasks")}function A(H){if(/[\0-\x1f\x7f"%]/.test(H))throw Error(`A background task cannot use a value with a double quote, percent sign or control character: ${H}`);return`'${H.replace(/['\u2018\u2019\u201a\u201b]/g,"$&$&")}'`}function a(H){if(!/^[A-Za-z0-9._-]+$/.test(H))throw Error(`Invalid Windows Scheduled Task name: ${H}`);return`$env:${Vz}=${A(H)};`}function c(H){let z=Object.entries(H.environment).map(([Q,Z])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(Q))throw Error(`Invalid Windows Scheduled Task environment name: ${Q}`);return`$env:${Q}=${A(Z)};`}),J=`$global:LASTEXITCODE=1; & ${[H.program,...H.args].map(A).join(" ")} 2>&1 | ForEach-Object { Add-Content -LiteralPath ${A(H.log)} -Value $_.ToString() -Encoding UTF8 }; $c=$LASTEXITCODE;`;return[a(H.name),...z,"$ErrorActionPreference='Continue';",H.keepAlive?`do { ${J} if ($c) { Start-Sleep -Seconds 10 } } while ($c)`:`${J} exit $c`].join(" ")}function S(H){return H.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function Pz(){let H=process.env.USERDOMAIN?.trim();return H?`${H}\\${v().username}`:v().username}function h(H){let z=S(H.user??Pz()),J=H.schedule==="logon",Q=H.schedule==="logon"?`<LogonTrigger><Enabled>true</Enabled><UserId>${z}</UserId></LogonTrigger>`:`<TimeTrigger><Repetition><Interval>PT${H.schedule.everyMinutes}M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition><StartBoundary>2026-01-01T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger>`,Z=`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "${H.script}"`;return`<?xml version="1.0" encoding="UTF-16"?>
+import{pe as Qz,te as Zz,ve as R,ye as $z}from"./vm-hands-entry-lite-x0x1t6gp.js";import{vi as zz}from"./vm-hands-entry-lite-caxtg4j7.js";import{Li as e}from"./vm-hands-entry-lite-26d4ttdx.js";import{dj as Hz,sj as V,uj as Jz}from"./vm-hands-entry-lite-7pjz79dq.js";import{Gk as X}from"./vm-hands-entry-lite-rbjky7rd.js";import{spawnSync as C}from"child_process";import{createHash as Iz,randomUUID as Wz}from"crypto";import{chmodSync as bz,existsSync as y,mkdirSync as Sz,readdirSync as wz,readFileSync as L,renameSync as _z,rmSync as Y,statSync as xz,writeFileSync as Rz}from"fs";import{dirname as yz,isAbsolute as Bz,join as N}from"path";import{spawnSync as Oz}from"child_process";import{readFileSync as Cz}from"fs";import{userInfo as v}from"os";import{join as Kz}from"path";var Vz="REASON_SCHEDULED_TASK";function l(H){return Kz(H,"AppData","Local","Reason","Tasks")}function A(H){if(/[\0-\x1f\x7f"%]/.test(H))throw Error(`A background task cannot use a value with a double quote, percent sign or control character: ${H}`);return`'${H.replace(/['\u2018\u2019\u201a\u201b]/g,"$&$&")}'`}function a(H){if(!/^[A-Za-z0-9._-]+$/.test(H))throw Error(`Invalid Windows Scheduled Task name: ${H}`);return`$env:${Vz}=${A(H)};`}function c(H){let z=Object.entries(H.environment).map(([Q,Z])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(Q))throw Error(`Invalid Windows Scheduled Task environment name: ${Q}`);return`$env:${Q}=${A(Z)};`}),J=`$global:LASTEXITCODE=1; & ${[H.program,...H.args].map(A).join(" ")} 2>&1 | ForEach-Object { Add-Content -LiteralPath ${A(H.log)} -Value $_.ToString() -Encoding UTF8 }; $c=$LASTEXITCODE;`;return[a(H.name),...z,"$ErrorActionPreference='Continue';",H.keepAlive?`do { ${J} if ($c) { Start-Sleep -Seconds 10 } } while ($c)`:`${J} exit $c`].join(" ")}function S(H){return H.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function Pz(){let H=process.env.USERDOMAIN?.trim();return H?`${H}\\${v().username}`:v().username}function h(H){let z=S(H.user??Pz()),J=H.schedule==="logon",Q=H.schedule==="logon"?`<LogonTrigger><Enabled>true</Enabled><UserId>${z}</UserId></LogonTrigger>`:`<TimeTrigger><Repetition><Interval>PT${H.schedule.everyMinutes}M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition><StartBoundary>2026-01-01T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger>`,Z=`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "${H.script}"`;return`<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
     <Description>${S(H.description)}</Description>
@@ -102,4 +102,4 @@ UMask=0077
 [Install]
 WantedBy=default.target
 `}function Tz(H,z,J,Q){let Z=p(H,z);return h({description:Z.description,schedule:"logon",script:c({name:J.label,program:Q,args:Z.args,environment:{[P]:J.label,...Z.environment},log:J.logs,keepAlive:!0})})}function Lz(H,z,J){z.command("powershell.exe",x(H.label,{tree:J,keepWrapper:!J}))}function K(H,z,J){z.command("schtasks",["/Delete","/F","/TN",H.label]),z.command("powershell.exe",x(H.label,{tree:J,keepWrapper:!1})),Y(H.definition,{force:!0})}function b(H,z){Sz(yz(H),{recursive:!0,mode:448});let J=`${H}.${Wz()}.tmp`;try{Rz(J,z,{mode:384,flag:"wx"}),bz(J,384),_z(J,H)}finally{Y(J,{force:!0})}}function F(H){if(typeof H.uid!=="number"||!Number.isSafeInteger(H.uid)||H.uid<=0)throw new M("Set up a background service as your own user, not with sudo.","worker_service_root_user");return`gui/${H.uid}`}function TH(H){let{config:z,launcher:J,host:Q}=H,Z=H.kind??"serve",B=Dz(z,Q,Z),q=B!==null&&Q.insideService?.(B.label)===!0,$=T(z,Q,Z,q?m:I);if(!$)throw new M(Mz);if(Q.platform==="darwin")F(Q);if(Q.platform==="linux"&&Q.command("systemctl",["--user","show-environment"])!==0)throw new M("No background service here: this computer has no systemd user session.","worker_service_manager_missing");let j=Q.platform==="darwin"?Uz(z,Z,$,J,Q,H.path):null;if(b($.definition,j?j.plist:Q.platform==="win32"?n(Tz(z,Z,$,J)):Nz(z,Z,$,J,Q.home,H.path)),Xz(z,Q,$,q?null:B),j)return j.identity?$:{...$,identityProblem:kz};if(Q.platform==="win32")return $;return{...$,lingering:Q.command("loginctl",["enable-linger"])===0}}function Xz(H,z,J,Q){if(z.platform==="darwin"){let q=F(z);if(Q)z.command("/bin/launchctl",["bootout",`${q}/${Q.label}`]);if(Fz(H,J,z)){if(Q)Y(Q.definition,{force:!0});return}if(Y(J.definition,{force:!0}),Q)z.command("/bin/launchctl",["bootstrap",q,Q.definition]);throw new M("Could not start the background service (launchctl bootstrap failed).","worker_service_start_failed")}if(z.platform==="win32"){if(Q)K(Q,z,!0);if(z.command("schtasks",i(J.label,J.definition))===0){if(Lz(J,z,z.insideService?.(J.label)!==!0),z.command("schtasks",["/Run","/TN",J.label])===0)return}throw K(J,z,!0),new M("Could not start the background service (schtasks failed).")}let Z=`${J.label}.service`,B=Q?`${Q.label}.service`:null;if(z.command("systemctl",["--user","daemon-reload"])!==0||B!==null&&z.command("systemctl",["--user","disable","--now",B])!==0||z.command("systemctl",["--user","enable",Z])!==0||z.command("systemctl",["--user","restart",Z])!==0){if(z.command("systemctl",["--user","disable",Z]),Y(J.definition,{force:!0}),z.command("systemctl",["--user","daemon-reload"]),B)z.command("systemctl",["--user","enable","--now",B]);throw new M("Could not start the background service (systemctl --user failed).","worker_service_start_failed")}if(Q)Y(Q.definition,{force:!0}),z.command("systemctl",["--user","daemon-reload"])}function Fz(H,z,J){let Q=F(J);J.command("/bin/launchctl",["bootout",`${Q}/${z.label}`]);let Z=(Math.ceil(H.shutdownGraceMs/1000)+10)*1000;for(let B=0,q=100;;q=Math.min(q*2,2000)){if(J.command("/bin/launchctl",["bootstrap",Q,z.definition])===0)return!0;if(B>=Z)return!1;J.sleep(q),B+=q}}function LH(H,z,J){let Q=d(H,z,J);if(!Q)return null;let Z=z.insideService?.(Q.label)===!0;if(z.platform==="darwin"&&!Z)dz(Q.definition,z);let B=T(H,z,J);if(B&&Q.label!==B.label&&!Z)return b(B.definition,L(Q.definition,"utf8").replaceAll(Q.label,B.label)),Xz(H,z,B,Q),B;let q=z.platform==="darwin"&&Z,$;if(z.platform==="win32")Lz(Q,z,!Z),$=z.command("schtasks",["/Run","/TN",Q.label])===0;else if(q)$=z.command("/bin/launchctl",["kickstart","-k",`${F(z)}/${Q.label}`])===0;else if(z.platform==="darwin")$=Fz(H,Q,z);else z.command("systemctl",["--user","enable",`${Q.label}.service`]),$=z.command("systemctl",["--user","restart",`${Q.label}.service`])===0;if(!$)throw new M(`Could not restart the background service ${Q.label}.`,"worker_service_restart_failed");if(B&&Q.label===B.label)vz(H,z,J);return Q}function XH(H,z,J,Q){let Z=d(H,J,Q),B=T(z,J,Q);if(J.platform!=="darwin"||!Z||!B)return;let q=`<string>${D(Z.logs)}</string>`,$=L(Z.definition,"utf8");if($.includes(q))b(Z.definition,$.replaceAll(q,`<string>${D(B.logs)}</string>`))}function FH(H,z,J="serve"){let Q=Yz(H,z,J);for(let Z of Q){if(z.platform==="win32"){K(Z,z,z.insideService?.(Z.label,!1)!==!0);continue}if(z.platform==="darwin"){if(typeof z.uid==="number"&&z.uid>0)z.command("/bin/launchctl",["bootout",`gui/${z.uid}/${Z.label}`]);Y(Z.definition,{force:!0});continue}z.command("systemctl",["--user","disable","--now",`${Z.label}.service`]),Y(Z.definition,{force:!0}),z.command("systemctl",["--user","daemon-reload"])}return Q[0]??null}
-export{l as Pd,P as Qd,kz as Rd,qH as Sd,M as Td,jH as Ud,GH as Vd,MH as Wd,Gz as Xd,YH as Yd,DH as Zd,d as _d,vz as $d,UH as ae,NH as be,TH as ce,LH as de,XH as ee,FH as fe};
+export{l as Rd,P as Sd,kz as Td,qH as Ud,M as Vd,jH as Wd,GH as Xd,MH as Yd,Gz as Zd,YH as _d,DH as $d,d as ae,vz as be,UH as ce,NH as de,TH as ee,LH as fe,XH as ge,FH as he};