@reason-machines/cli-linux-arm64 0.2.405 → 0.2.406

package/bin/vm-hands/{vm-hands-entry-lite-nnrypv7q.js → vm-hands-entry-lite-8tcnbfnm.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Lf as jJ,Ue as _J,af as gJ,bf as OJ,cf as RJ,df as IJ}from"./vm-hands-entry-lite-afjzr3v2.js";import{createHash as m,randomBytes as WJ}from"crypto";import{closeSync as MJ,fsyncSync as TJ,mkdirSync as aJ,openSync as DJ,renameSync as nJ,rmSync as tJ,statSync as qJ,writeSync as xJ,constants as y}from"fs";import{join as t}from"path";var eJ=1;var e=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function FJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new F("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function AJ(J,Q){let{payload:$,authority:z}=J;if(!$||typeof $!=="object"||Array.isArray($)||!z||typeof z!=="object"||Array.isArray(z)||!Q.deviceId||!Q.rootId||$.run_id!==Q.runId||$.device_id!==Q.deviceId||z.device_id!==Q.deviceId||$.root_id!==Q.rootId||Q.snapshotId!==void 0&&$.snapshot_id!==Q.snapshotId)throw new F("vm_hands_env_invalid","environment does not match this Hands");return $}function SJ(J){if(J.capability!=="hands.connect")throw new F("vm_hands_bind_invalid","not a hands.connect claim");let Q=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Q.workspace_id==="string"&&e.test(Q.workspace_id)?Q.workspace_id:J.run_id,brain_generation:Q.target_generation,fence_id:Q.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Q.hands_confinement??""),browser_egress:Q.browser_egress??null,policy_digest:Q.vm_hands_policy_digest},cwd:typeof Q.cwd==="string"?Q.cwd:"",claim:J,env:FJ(J)?J.environment_sealed:null,workspace_deferred:JQ(J)}}function JQ(J){let Q=J.payload[OJ];if(Q===void 0)return!1;if(Q!==!0||J.payload.vm_hands_env_deferred!==!0||J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class F extends Error{code;constructor(J,Q){super(Q);this.code=J}}var I=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),b=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function c(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(c).join(",")}]`;return`{${Object.keys(J).sort().map((Q)=>`${JSON.stringify(Q)}:${c(J[Q])}`).join(",")}}`}async function SQ(J){let Q=await crypto.subtle.importKey("pkcs8",b(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),$=b(J.device_key.spki),z=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),L=new Uint8Array(await crypto.subtle.exportKey("spki",z.publicKey)),U=m("sha256").update($).digest("base64url");return{signing:{privateKey:Q},agreement:z,signingSpki:$,agreementSpki:L,fingerprint:U}}var QQ=4;class ZQ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(J){let Q=this.structural.then(J,J);return this.structural=Q.catch(()=>{return}),Q}constructor(J,Q,$,z){this.init=J;this.keys=Q;this.hooks=$;this.options=z;if(!e.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new F("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new F("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Q of this.bound.values())if(Q.runId===J)return!0;return!1}bindIdForRun(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Q,$){for(let z=Date.now()+Q;;){let L=this.bound.get(J);if(!L)return!1;if(L.envInstalled)return!0;if(Date.now()>=z||$?.aborted)return!1;await new Promise((U)=>setTimeout(U,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new F("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new F("vm_hands_challenge_invalid","bad register challenge");let Q={challenge:J,t:"register",v:eJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:I(this.keys.signingSpki),env_public_key:I(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:I(WJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},$=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(c(Q)));return{...Q,device_signature:I($)}}async helloFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","hello before register");let $=String((this.options.now??Date.now)()),z=I(WJ(32)),L=jJ({method:"GET",pathAndQuery:_J,timestamp:$,nonce:z,challenge:J,bodySha256:m("sha256").update("").digest("hex")}),U=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(L)));return{t:"hello",timestamp:$,nonce:z,signature:I($Q(U)),...Q?{vm_hands_previous_connection:Q}:{}}}registered(){if(this.identity!=="identity_free")throw new F("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new F("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new F("vm_hands_bind_invalid","bad bind");for(let $ of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!e.test($))throw new F("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new F("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new F("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new F("vm_hands_bind_invalid","bad policy or nonce");if(m("sha256").update(c({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new F("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some(($)=>$.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new F("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=QQ)throw new F("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new F("vm_hands_busy","a bind waits for its workspace beside the setup");if(J.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),J.workspace_deferred){let $,z,L=new Promise((U,N)=>{$=U,z=N});L.catch(()=>{return}),this.grants.set(J.bind_id,{promise:L,resolve:$,reject:z})}return this.exclusive(()=>this.setUp(J))}async setUp(J){let Q=[...this.bound.keys()],$=null,z=!1,L=this.grants.get(J.bind_id);try{if(L&&(Q.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(Q.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new F("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Q}),this.unverified.clear();this.servedRun=!0,z=!0;let{launchId:U,applied:N,readyData:O}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim,...L?{workspaceGrant:L.promise}:{}}),T=this.hooks.restatLayout();this.hooks.verifyMounts?.();let D=null,A=null;if(J.env){let w=J.claim?.owner??{},v=AJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:J.claim?.root_id??""});this.commandsSinceVerified=!0,D=this.hooks.installEnvironment(J.bind_id,v),A=typeof v.snapshot_id==="string"&&v.snapshot_id?v.snapshot_id:null,$=this.writeJobEnvRootOnly(J.bind_id,v)}if(this.unbinding.has(J.bind_id))throw new F("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:D!==null,rootId:J.claim?.root_id??"",envDirectory:$}),this.binding.delete(J.bind_id),this.grants.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:D,snapshot_id:A,layout:T,...O?{ready_data:O}:{},policy_digest:m("sha256").update(c({hands_confinement:N.hands_confinement??null,browser_egress:N.browser_egress??null})).digest("hex")}}catch(U){if($)KJ($);if(z){let O=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:O,own:!0}).catch(()=>{this.unverified.add(J.bind_id)})}this.binding.delete(J.bind_id),this.grants.delete(J.bind_id);let N=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof F?U:new F(N,"executor refused the bind")}}grantWorkspace(J){let Q=this.grants.get(J);if(!Q)throw new F("vm_hands_not_binding","no pre-bind waits for a workspace grant");Q.resolve()}abandonWorkspaceGrant(J){this.grants.get(J)?.reject(new F("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(J){let Q=this.bound.get(J.attemptId);if(!Q||this.unbinding.has(J.attemptId))throw new F("vm_hands_not_bound","environment delivered while not bound");if(!e.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new F("vm_hands_env_invalid","bad snapshot id");let $=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==$)throw new F("vm_hands_env_invalid","bad env envelope");let z=AJ(await this.openSealed(J.sealed,$),{runId:Q.runId,deviceId:J.deviceId,rootId:Q.rootId,snapshotId:J.snapshotId});this.commandsSinceVerified=!0;let L=this.hooks.installEnvironment(Q.bindId,z);if(Q.envInstalled=!0,Q.envDirectory)KJ(Q.envDirectory);return Q.envDirectory=null,Q.envDirectory=this.writeJobEnvRootOnly(`${Q.bindId}-r${L}`,z),{snapshot_id:J.snapshotId,installed_revision:L,installed:!0}}async attestFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new F("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new F("vm_hands_attest_invalid","attest beside a bind");let $=await this.hooks.runProbe({nonce:Q,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Q,exit_code:$.exitCode,markers:$.markers,proof_dir_inode:$.proofDirInode,script_sha256:m("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Q=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),this.abandonWorkspaceGrant(J),Q)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Q))}async retryUnbind(J){if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(J,this.unverifiedTeardowns.get(J)??null,!0)})}async tearDown(J,Q,$=!1){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((U)=>U!==J),L=!z.length&&($||!this.commandsSinceVerified);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:L?{bindId:J,own:!0}:void 0)}catch(U){if(this.unverified.add(J),!this.unverifiedTeardowns.has(J))this.unverifiedTeardowns.set(J,Q);throw U}if(this.unverified.delete(J),!z.length&&!$)this.unverified.clear(),this.commandsSinceVerified=!1;if(Q?.envDirectory)KJ(Q.envDirectory);return this.unverifiedTeardowns.delete(J),{bind_id:Q?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length||$?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Q){let $=()=>{throw new F("vm_hands_env_invalid","env did not decrypt")},z=await crypto.subtle.importKey("spki",b(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch($),L=await crypto.subtle.deriveKey({name:"ECDH",public:z},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),U=await crypto.subtle.decrypt({name:"AES-GCM",iv:b(J.iv),additionalData:new TextEncoder().encode(Q)},L,b(J.ct)).catch($),N=JSON.parse(new TextDecoder().decode(U));if(!N||typeof N!=="object"||Array.isArray(N))throw new F("vm_hands_env_invalid","env not an object");return N}writeJobEnvRootOnly(J,Q){let $=t(this.options.envRoot,`bind-${J}`);aJ($,{mode:448});let z=qJ($);if(!z.isDirectory()||(z.mode&63)!==0||z.uid!==(process.getuid?.()??-1))throw new F("vm_hands_env_dir_unsafe","env directory is not root's 0700");let L=Q.variables&&typeof Q.variables==="object"?Q.variables:{},U=Object.entries(L).filter(([T,D])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(T)&&typeof D==="string").map(([T,D])=>`export ${T}='${String(D).replaceAll("'","'\\''")}'`).join(`
+import{Nf as jJ,Ue as _J,af as gJ,bf as OJ,cf as RJ,df as IJ}from"./vm-hands-entry-lite-ky0w7t09.js";import{createHash as m,randomBytes as WJ}from"crypto";import{closeSync as MJ,fsyncSync as TJ,mkdirSync as aJ,openSync as DJ,renameSync as nJ,rmSync as tJ,statSync as qJ,writeSync as xJ,constants as y}from"fs";import{join as t}from"path";var eJ=1;var e=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function FJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new F("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function AJ(J,Q){let{payload:$,authority:z}=J;if(!$||typeof $!=="object"||Array.isArray($)||!z||typeof z!=="object"||Array.isArray(z)||!Q.deviceId||!Q.rootId||$.run_id!==Q.runId||$.device_id!==Q.deviceId||z.device_id!==Q.deviceId||$.root_id!==Q.rootId||Q.snapshotId!==void 0&&$.snapshot_id!==Q.snapshotId)throw new F("vm_hands_env_invalid","environment does not match this Hands");return $}function SJ(J){if(J.capability!=="hands.connect")throw new F("vm_hands_bind_invalid","not a hands.connect claim");let Q=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Q.workspace_id==="string"&&e.test(Q.workspace_id)?Q.workspace_id:J.run_id,brain_generation:Q.target_generation,fence_id:Q.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Q.hands_confinement??""),browser_egress:Q.browser_egress??null,policy_digest:Q.vm_hands_policy_digest},cwd:typeof Q.cwd==="string"?Q.cwd:"",claim:J,env:FJ(J)?J.environment_sealed:null,workspace_deferred:JQ(J)}}function JQ(J){let Q=J.payload[OJ];if(Q===void 0)return!1;if(Q!==!0||J.payload.vm_hands_env_deferred!==!0||J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class F extends Error{code;constructor(J,Q){super(Q);this.code=J}}var I=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),b=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function c(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(c).join(",")}]`;return`{${Object.keys(J).sort().map((Q)=>`${JSON.stringify(Q)}:${c(J[Q])}`).join(",")}}`}async function SQ(J){let Q=await crypto.subtle.importKey("pkcs8",b(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),$=b(J.device_key.spki),z=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),L=new Uint8Array(await crypto.subtle.exportKey("spki",z.publicKey)),U=m("sha256").update($).digest("base64url");return{signing:{privateKey:Q},agreement:z,signingSpki:$,agreementSpki:L,fingerprint:U}}var QQ=4;class ZQ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(J){let Q=this.structural.then(J,J);return this.structural=Q.catch(()=>{return}),Q}constructor(J,Q,$,z){this.init=J;this.keys=Q;this.hooks=$;this.options=z;if(!e.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new F("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new F("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Q of this.bound.values())if(Q.runId===J)return!0;return!1}bindIdForRun(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Q,$){for(let z=Date.now()+Q;;){let L=this.bound.get(J);if(!L)return!1;if(L.envInstalled)return!0;if(Date.now()>=z||$?.aborted)return!1;await new Promise((U)=>setTimeout(U,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new F("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new F("vm_hands_challenge_invalid","bad register challenge");let Q={challenge:J,t:"register",v:eJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:I(this.keys.signingSpki),env_public_key:I(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:I(WJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},$=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(c(Q)));return{...Q,device_signature:I($)}}async helloFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","hello before register");let $=String((this.options.now??Date.now)()),z=I(WJ(32)),L=jJ({method:"GET",pathAndQuery:_J,timestamp:$,nonce:z,challenge:J,bodySha256:m("sha256").update("").digest("hex")}),U=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(L)));return{t:"hello",timestamp:$,nonce:z,signature:I($Q(U)),...Q?{vm_hands_previous_connection:Q}:{}}}registered(){if(this.identity!=="identity_free")throw new F("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new F("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new F("vm_hands_bind_invalid","bad bind");for(let $ of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!e.test($))throw new F("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new F("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new F("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new F("vm_hands_bind_invalid","bad policy or nonce");if(m("sha256").update(c({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new F("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some(($)=>$.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new F("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=QQ)throw new F("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new F("vm_hands_busy","a bind waits for its workspace beside the setup");if(J.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),J.workspace_deferred){let $,z,L=new Promise((U,N)=>{$=U,z=N});L.catch(()=>{return}),this.grants.set(J.bind_id,{promise:L,resolve:$,reject:z})}return this.exclusive(()=>this.setUp(J))}async setUp(J){let Q=[...this.bound.keys()],$=null,z=!1,L=this.grants.get(J.bind_id);try{if(L&&(Q.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(Q.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new F("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Q}),this.unverified.clear();this.servedRun=!0,z=!0;let{launchId:U,applied:N,readyData:O}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim,...L?{workspaceGrant:L.promise}:{}}),T=this.hooks.restatLayout();this.hooks.verifyMounts?.();let D=null,A=null;if(J.env){let w=J.claim?.owner??{},v=AJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:J.claim?.root_id??""});this.commandsSinceVerified=!0,D=this.hooks.installEnvironment(J.bind_id,v),A=typeof v.snapshot_id==="string"&&v.snapshot_id?v.snapshot_id:null,$=this.writeJobEnvRootOnly(J.bind_id,v)}if(this.unbinding.has(J.bind_id))throw new F("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:D!==null,rootId:J.claim?.root_id??"",envDirectory:$}),this.binding.delete(J.bind_id),this.grants.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:D,snapshot_id:A,layout:T,...O?{ready_data:O}:{},policy_digest:m("sha256").update(c({hands_confinement:N.hands_confinement??null,browser_egress:N.browser_egress??null})).digest("hex")}}catch(U){if($)KJ($);if(z){let O=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:O,own:!0}).catch(()=>{this.unverified.add(J.bind_id)})}this.binding.delete(J.bind_id),this.grants.delete(J.bind_id);let N=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof F?U:new F(N,"executor refused the bind")}}grantWorkspace(J){let Q=this.grants.get(J);if(!Q)throw new F("vm_hands_not_binding","no pre-bind waits for a workspace grant");Q.resolve()}abandonWorkspaceGrant(J){this.grants.get(J)?.reject(new F("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(J){let Q=this.bound.get(J.attemptId);if(!Q||this.unbinding.has(J.attemptId))throw new F("vm_hands_not_bound","environment delivered while not bound");if(!e.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new F("vm_hands_env_invalid","bad snapshot id");let $=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==$)throw new F("vm_hands_env_invalid","bad env envelope");let z=AJ(await this.openSealed(J.sealed,$),{runId:Q.runId,deviceId:J.deviceId,rootId:Q.rootId,snapshotId:J.snapshotId});this.commandsSinceVerified=!0;let L=this.hooks.installEnvironment(Q.bindId,z);if(Q.envInstalled=!0,Q.envDirectory)KJ(Q.envDirectory);return Q.envDirectory=null,Q.envDirectory=this.writeJobEnvRootOnly(`${Q.bindId}-r${L}`,z),{snapshot_id:J.snapshotId,installed_revision:L,installed:!0}}async attestFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new F("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new F("vm_hands_attest_invalid","attest beside a bind");let $=await this.hooks.runProbe({nonce:Q,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Q,exit_code:$.exitCode,markers:$.markers,proof_dir_inode:$.proofDirInode,script_sha256:m("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Q=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),this.abandonWorkspaceGrant(J),Q)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Q))}async retryUnbind(J){if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(J,this.unverifiedTeardowns.get(J)??null,!0)})}async tearDown(J,Q,$=!1){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((U)=>U!==J),L=!z.length&&($||!this.commandsSinceVerified);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:L?{bindId:J,own:!0}:void 0)}catch(U){if(this.unverified.add(J),!this.unverifiedTeardowns.has(J))this.unverifiedTeardowns.set(J,Q);throw U}if(this.unverified.delete(J),!z.length&&!$)this.unverified.clear(),this.commandsSinceVerified=!1;if(Q?.envDirectory)KJ(Q.envDirectory);return this.unverifiedTeardowns.delete(J),{bind_id:Q?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length||$?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Q){let $=()=>{throw new F("vm_hands_env_invalid","env did not decrypt")},z=await crypto.subtle.importKey("spki",b(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch($),L=await crypto.subtle.deriveKey({name:"ECDH",public:z},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),U=await crypto.subtle.decrypt({name:"AES-GCM",iv:b(J.iv),additionalData:new TextEncoder().encode(Q)},L,b(J.ct)).catch($),N=JSON.parse(new TextDecoder().decode(U));if(!N||typeof N!=="object"||Array.isArray(N))throw new F("vm_hands_env_invalid","env not an object");return N}writeJobEnvRootOnly(J,Q){let $=t(this.options.envRoot,`bind-${J}`);aJ($,{mode:448});let z=qJ($);if(!z.isDirectory()||(z.mode&63)!==0||z.uid!==(process.getuid?.()??-1))throw new F("vm_hands_env_dir_unsafe","env directory is not root's 0700");let L=Q.variables&&typeof Q.variables==="object"?Q.variables:{},U=Object.entries(L).filter(([T,D])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(T)&&typeof D==="string").map(([T,D])=>`export ${T}='${String(D).replaceAll("'","'\\''")}'`).join(`
 `)+`
 `,N=t($,`.job.env.${WJ(8).toString("hex")}`),O=DJ(N,y.O_WRONLY|y.O_CREAT|y.O_EXCL|y.O_NOFOLLOW,384);try{xJ(O,U),TJ(O)}finally{MJ(O)}return nJ(N,t($,"job.env")),$}}function KJ(J){try{let Q=t(J,"job.env"),$=qJ(Q).size,z=DJ(Q,y.O_WRONLY|y.O_NOFOLLOW);try{xJ(z,Buffer.alloc($)),TJ(z)}finally{MJ(z)}}catch{}tJ(J,{recursive:!0,force:!0})}function $Q(J){if(J.length!==64)throw new F("vm_hands_signature_invalid","unexpected ECDSA signature length");let Q=(L)=>{let U=0;while(U<L.length-1&&L[U]===0)U++;let N=L.subarray(U),O=N[0]&128?Uint8Array.of(0,...N):N;return Uint8Array.of(2,O.length,...O)},$=Q(J.subarray(0,32)),z=Q(J.subarray(32));return Uint8Array.of(48,$.length+z.length,...$,...z)}import{randomUUID as zQ}from"crypto";var XQ="/app/local-runtime/session?register=vm_hands_v1",YQ="/app/local-runtime",wJ=25000,hJ=20000,GQ=1e4,yJ=5000,kJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),PJ=75000,WQ=2000,KQ=1e4,FQ=new Set(["vm_hands_no_register","vm_hands_register_failed"]),PQ=3,CQ=20000,NQ=250,UQ=2000;function fJ(J){let Q=Math.min(NQ*2**(J-1),UQ);return Math.round(Q/2+Math.random()*Q/2)}var EQ=5000;function BQ(J){return J>=500||J===408||J===429}var JJ=20000;function HJ(J,Q){return typeof J==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(J)?J:Q}class V extends Error{}var LQ=64,VJ=[1000,2000,4000,8000,15000,30000,60000,120000];function mJ(J){let Q=J&&typeof J==="object"&&"code"in J?J.code:null;return typeof Q==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(Q)?Q:"vm_hands_unbind_failed"}function AQ(J,Q,$,z,L){let U=$.turn.claim.attempt_id,N=J.healing??=new Set;if(N.has(U))return;N.add(U);let O=$.turn.claim.operation_id;(async()=>{for(let[T,D]of VJ.entries()){if(z.aborted)return;if(await new Promise((A)=>{let w=setTimeout(A,D);w.unref?.(),z.addEventListener("abort",()=>{clearTimeout(w),A()},{once:!0})}),z.aborted)return;try{let A=await Q.retryUnbind(U);L("vm_hands.unbind_healed",{operation_id:O,attempt:T+1}),J.receipts.push({...$,unbound:A}),J.flushReceipts?.();return}catch(A){let w=mJ(A);if(L("vm_hands.unbind_unverified",{operation_id:O,code:w,attempt:T+1}),w==="vm_hands_unbind_unknown")return}}L("vm_hands.unbind_heal_exhausted",{operation_id:O,attempts:VJ.length})})().finally(()=>N.delete(U))}async function bJ(J,Q){let $=[...J.modelOps.get(Q)??[]];for(let z of $)z.abort.abort();await Promise.race([Promise.all($.map((z)=>z.settled)),new Promise((z)=>setTimeout(z,yJ))])}async function _Q(J){let Q=[...J.personTerminals];for(let $ of Q)$.abort.abort();if(Q.length)await Promise.race([Promise.all(Q.map(($)=>$.settled)),new Promise(($)=>setTimeout($,yJ))]);return Q.length}async function p(J,Q,$){return await bJ(J,$),Q.unbind($)}function QJ(J){for(let Q of J.outbox?.splice(0)??[])Q.reject(Error("vm_hands_attempt_ended"))}var vJ=15000,OQ=1e4,jQ=1000;async function vQ(J){let Q=Date.now(),$={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:0},z=J.log??(()=>{}),L=async(O)=>{for(let[T,D]of[...$.turns]){$.turns.delete(T),J.onTurn?.(T,null),QJ(D);let A=await p($,J.agent,T).catch(()=>null);if(A)$.receipts.push({turn:D,failure:"vm_hands_bind_lost",unbound:A});z("vm_hands.bound_dropped",{reason:O})}},U=0,N=0;try{for(let O=0;!J.signal.aborted;O++){let T=await MQ(J,$).catch((A)=>{if(A instanceof F&&$.deviceId===null&&A.code==="vm_hands_no_session"&&Date.now()-Q<KQ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(A instanceof F&&$.deviceId===null&&FQ.has(A.code)&&U<PQ&&Date.now()-Q<CQ)return U++,N=fJ(U),z("vm_hands.register_retry",{attempt:U,code:A.code,delay_ms:N}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(A instanceof F&&$.deviceId===null)throw A;return{closeCode:0,closeReason:A instanceof Error?A.message:String(A)}});if(z("vm_hands.session_closed",{close_code:T.closeCode,reason:T.closeReason.slice(0,120),registered:$.deviceId!==null}),T.closeCode===4401||$.attest==="refused")return;if(J.signal.aborted)return;if($.turns.size&&Date.now()-$.lostAt>=PJ)await L("reconnect_deadline");if($.served)$.served=!1,O=0;let D=T.closeReason==="drain_reconnect"?0:T.closeReason==="vm_hands_register_retry"?N:T.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(O,5),2000):$.turns.size?Math.min(250*2**Math.min(O,5),5000,Math.max(0,$.lostAt+PJ-Date.now())):Math.min(500*2**O,30000);if(await new Promise((A)=>setTimeout(A,D)),$.turns.size&&Date.now()-$.lostAt>=PJ)await L("reconnect_deadline")}}finally{await L("session_ended")}}async function MQ(J,Q){let $=Q.deviceId,z=J.log??(()=>{}),L=$?`/app/local-runtime/session?device_id=${encodeURIComponent($)}`:XQ,U=`${J.apiOrigin.replace(/^http/,"ws")}${L}`,N=new WebSocket(U),O=0,T="",D=new Map,A=[],w=null,v=new Promise((Z)=>{N.onclose=(Y)=>{O=Y.code,T=Y.reason;for(let X of D.values())X.reject(new V(`session closed ${Y.code}`));for(let X of Q.attestWaiters.splice(0))X(!1);D.clear(),Z()}});N.onmessage=(Z)=>{let Y;try{Y=JSON.parse(String(Z.data))}catch{N.close(4400);return}if(Y.t==="res"){let X=Y;D.get(X.id)?.resolve({status:X.status,body:X.body}),D.delete(X.id);return}if(Y.t==="reconnect"){let X=Math.max(0,Math.min(Number(Y.after_ms)||0,jQ));z("vm_hands.drain_reconnect",{after_ms:X}),setTimeout(()=>{try{N.close(4001,"drain_reconnect")}catch{}},X).unref?.();return}if(!w?.(Y))A.push(Y)};let l=(Z,Y)=>new Promise((X,K)=>{let C=A.findIndex((B)=>Z.includes(B.t));if(C>=0){X(A.splice(C,1)[0]);return}let E=setTimeout(()=>{w=null,K(new F("vm_hands_no_register",`no ${Z.join("/")} in ${Y} ms`))},Y);w=(B)=>{if(!Z.includes(B.t))return!1;return clearTimeout(E),w=null,X(B),!0}}),u=(Z)=>N.send(JSON.stringify(Z)),k=(Z,Y)=>new Promise((X,K)=>{if(N.readyState!==WebSocket.OPEN){K(new V("session closed"));return}let C=zQ(),E=typeof Y.wait_ms==="number"?Y.wait_ms:0,B=setTimeout(()=>{if(!D.delete(C))return;K(new V(`no answer to ${Z.split("/").pop()} in ${E+vJ} ms`)),N.close(4000,"request_timeout")},E+vJ);D.set(C,{reject:(G)=>{clearTimeout(B),K(G)},resolve:({status:G,body:W})=>{clearTimeout(B);let P=null;try{P=W?JSON.parse(W):null}catch{}X({status:G,json:P})}}),u({t:"req",id:C,path:`${YQ}${Z}`,body:JSON.stringify(Y)})}),CJ=()=>N.close(1001,"stopping");J.signal.addEventListener("abort",CJ,{once:!0});let ZJ,o=new Map,d=new Map,$J=!1,zJ=new Set,XJ=new Set,YJ=Promise.resolve(),NJ=()=>{r().catch(()=>{return})},i=!1;try{await new Promise((G,W)=>{let P=setTimeout(()=>W(Error("session open timeout")),OQ);N.onopen=()=>{clearTimeout(P),z("vm_hands.ws_open",{}),G()},N.onerror=()=>{clearTimeout(P),W(Error("session socket error"))}});let Z=await l(["challenge"],5000);z("vm_hands.challenge",{});let Y=[],X=null,K;if($){u(await J.agent.helloFrame(Z.challenge,Q.connection));let G=await l(["ready"],1e4);if(typeof G.vm_hands_connection==="string")Q.connection=G.vm_hands_connection;if(K={device_id:$,...G.cadence?{cadence:G.cadence}:{}},typeof G.vm_hands_probe_script==="string"){if(X=G.vm_hands_probe_script,i=!0,J.agent.phase==="registered"&&!Q.turns.size)Q.attest="pending"}Q.served=!0,z("vm_hands.reconnected",{device_id:$});let W=Array.isArray(G.vm_hands_binds)?G.vm_hands_binds:G.vm_hands_bind?[G.vm_hands_bind]:[];for(let[P,M]of[...Q.turns]){if(W.some((x)=>x&&x.operation_id===M.claim.operation_id&&x.attempt_id===M.claim.attempt_id)){Y.push(M),z("vm_hands.bound_resumed",{operation_id:M.claim.operation_id});continue}Q.turns.delete(P),J.onTurn?.(P,null),QJ(M);let q=await p(Q,J.agent,P).catch((x)=>s(x,M,"vm_hands_bind_lost"));if(q)Q.receipts.push({turn:M,failure:"vm_hands_bind_lost",unbound:q});z("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{u(await J.agent.registerFrame(Z.challenge)),z("vm_hands.register_sent",{});let G=await Promise.race([l(["registered","register_refused"],1e4),v.then(()=>{throw new F(T==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(G.t==="register_refused")throw new F(G.code,"register refused");J.agent.registered();let W=G;if(K=W,Q.deviceId=W.device_id,typeof W.vm_hands_connection==="string")Q.connection=W.vm_hands_connection;if(typeof W.vm_hands_probe_script==="string"){if(X=W.vm_hands_probe_script,i=!0,J.agent.phase==="registered"&&!Q.turns.size)Q.attest="pending"}Q.served=!0,z("vm_hands.registered",{device_id:K.device_id})}let C=async()=>{let G=await k("/heartbeat",await J.heartbeat());if(G.status>=300)throw Error(`heartbeat ${G.status}`)};await C();let E=K.cadence?.presence_interval_ms??30000;if(ZJ=setInterval(()=>{C().catch(()=>N.close())},E),X&&Q.attest!=="accepted"&&J.agent.phase==="registered"&&!Q.turns.size)pJ(X,Z.challenge);let B=(G,W)=>{d.set(G,W().catch(async(P)=>{if(await UJ(P,G),P instanceof V)N.close();else await r().catch(()=>{return})}).finally(()=>{d.delete(G)}))};Q.flushReceipts=NJ;try{await r();for(let G of Y)G.flush=()=>EJ(G),G.flush(),B(G.claim.attempt_id,()=>BJ(G));while(!J.signal.aborted&&N.readyState===WebSocket.OPEN){let G=await k("/operations/claim",{wait_ms:Math.min(K.cadence?.claim_wait_ms??wJ,wJ)});if(G.status===204||!G.json)continue;if(G.status>=300)throw Error(`claim ${G.status}`);let W=G.json;if(W.capability==="hands.connect"){if(d.has(W.attempt_id)){h({claim:W,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}B(W.attempt_id,()=>lJ(W))}else oJ(W).catch(()=>{return})}}catch(G){await UJ(G,null)}}finally{if(ZJ)clearInterval(ZJ);J.signal.removeEventListener("abort",CJ);for(let Z of Q.turns.values())Z.flush=null;if(Q.flushReceipts===NJ)Q.flushReceipts=null;N.close(),await v,await Promise.all([...d.values()]);for(let Z of J.agent.liveBindIds){if(Q.turns.has(Z))continue;let Y=o.get(Z),X=Y?{...Y,eventSeq:Y.eventSeq+1}:null,K=await p(Q,J.agent,Z).catch((C)=>X?s(C,X,"vm_hands_bind_lost"):null);if(K&&X)Q.receipts.push({turn:X,failure:"vm_hands_bind_lost",unbound:K});z("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let Z of zJ)Z.abort()}return{closeCode:O,closeReason:T};async function UJ(Z,Y){if(Z instanceof V){if(!$J&&Q.turns.size)Q.lostAt=Date.now();$J=!0}else{let X=Y!==null?[Y]:[...new Set([...Q.turns.keys(),...J.agent.liveBindIds])];if(Y===null)$J=!0;for(let K of X){let C=Q.turns.get(K);if(Q.turns.delete(K),C)QJ(C),J.onTurn?.(K,null);if(J.agent.liveBindIds.includes(K)){let E=o.get(K)??C,B=E?{...E,eventSeq:E.eventSeq+1}:null,G=await p(Q,J.agent,K).catch((W)=>B?s(W,B,"vm_hands_bind_lost"):null);if(G&&B)Q.receipts.push({turn:B,failure:"vm_hands_bind_lost",unbound:G})}}}z("vm_hands.session_lost",{error:Z instanceof Error?Z.message:String(Z),bound_kept:Q.turns.size})}function h(Z){let Y=Z.claim,X={attempt_id:Y.attempt_id,attempt_token:Y.attempt_token},K=encodeURIComponent(Y.operation_id);return{fence:X,op:K,complete:(E,B={})=>k(`/operations/${K}/complete`,{...X,status:E,...B}),emit:(E,B)=>{let G=(Z.chain??Promise.resolve()).catch(()=>{return}).then(()=>C(E,B));return Z.chain=G,G}};async function C(E,B){let G=Z.eventSeq,W=(x)=>k(`/operations/${K}/events`,{...X,event_seq_start:x,events:[{kind:E,payload:{sequence:x,capability:String(Y.capability??"hands.connect"),data:B}}]}),P=G,M=await W(P),q=M.status===409?M.json?.expected_event_seq:void 0;if(typeof q==="number"&&q===G+1)M={status:200,json:{duplicate:!0}};else if(typeof q==="number"&&q>=0&&q!==G)P=q,M=await W(P);if(M.status<300)Z.eventSeq=P+1;return M}}function cJ(Z){return(Y,X)=>new Promise((K,C)=>{if(Q.turns.get(Z.claim.attempt_id)!==Z){C(Error("vm_hands_attempt_ended"));return}if(Z.outbox??=[],Z.outbox.length>=LQ){C(Error("vm_hands_outbox_full"));return}Z.outbox.push({kind:Y,data:X,resolve:K,reject:C}),Z.flush?.()})}function EJ(Z){if(XJ.has(Z))return;XJ.add(Z),(async()=>{try{while(Z.outbox?.length&&Q.turns.get(Z.claim.attempt_id)===Z&&N.readyState===WebSocket.OPEN){let Y=Z.outbox[0],X;try{X=await h(Z).emit(Y.kind,Y.data)}catch(K){if(K instanceof V)return;X={status:500}}if(Z.outbox.shift(),X.status<300)Y.resolve();else Y.reject(Error(`${Y.kind} refused ${X.status}`))}}finally{XJ.delete(Z)}})()}async function pJ(Z,Y){try{let X=await J.agent.attestFrame(Z,Y);if(N.readyState!==WebSocket.OPEN)return;u(X);let K=await l(["attested","attest_refused"],15000);Q.attest=K.t==="attested"?"accepted":"refused";for(let C of Q.attestWaiters.splice(0))C(Q.attest==="accepted");if(z("vm_hands.attest",{result:Q.attest,exit_code:X.exit_code,...K.t==="attest_refused"?{code:String(K.code??"")}:{}}),Q.attest==="refused")N.close(4401,"attest_refused")}catch(X){z("vm_hands.attest_failed",{code:X instanceof F?X.code:"probe_error"});for(let K of Q.attestWaiters.splice(0))K(!1);if(Q.attest!=="accepted")N.close(4000,"attest_unanswered")}}async function lJ(Z){let Y=i&&Q.attest==="pending",X=Z.vm_hands_attest,K=X;if(Q.attest==="refused"){z("vm_hands.claim_attest_refused",{said:typeof X==="string"?X.slice(0,16):typeof X,local:Q.attest}),await h({claim:Z,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(K==="accepted"){if(!Y&&Q.attest!=="accepted"){Q.attest="accepted";for(let _ of Q.attestWaiters.splice(0))_(!0)}}else if(K!=="pending"||!Y&&Q.attest!=="accepted"){z("vm_hands.claim_attest_refused",{said:typeof X==="string"?X.slice(0,16):typeof X,local:Q.attest}),await h({claim:Z,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Q.attest!=="accepted"){let _=Date.parse(Z.lease_until)-Date.now()-5000,H=Math.max(0,Math.min(JJ,Number.isFinite(_)?_:JJ));if(!await new Promise((n)=>{let sJ=setTimeout(()=>n(!1),H);Q.attestWaiters.push((rJ)=>{clearTimeout(sJ),n(rJ)})})){await h({claim:Z,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let C={claim:Z,eventSeq:0},{complete:E,emit:B}=h(C),G;try{if(Z.capability!=="hands.connect")throw new F("vm_hands_bind_invalid","not hands.connect");G=!FJ(Z)}catch(_){z("vm_hands.bind_refused",{code:_ instanceof F?_.code:"unexpected"}),await E("failed",{error_code:_ instanceof F?_.code:"vm_hands_bind_invalid"});return}let W,P=null,M=!1;Q.bindsStarting++;try{let _=await _Q(Q);if(_)z("vm_hands.person_terminals_closed",{count:_});let H=SJ(Z),a=J.agent.bind(H);if(H.workspace_deferred)M=!0,P=uJ(C,()=>M);W=await a}catch(_){z("vm_hands.bind_refused",{code:_ instanceof F?_.code:"unexpected"}),await E("failed",{error_code:_ instanceof F?_.code:"vm_hands_bind_failed"});return}finally{M=!1,Q.bindsStarting--}let q=P?await P:-1,x={...W.ready_data??J.readyData({launchId:W.launch_id,claim:Z})};if(G)delete x.environment_installed;let GJ=!G&&W.snapshot_revision!==null&&W.snapshot_id!==null?{environment_installed:{snapshot_id:W.snapshot_id,installed_revision:W.snapshot_revision}}:{};o.set(Z.attempt_id,{claim:Z,launchId:W.launch_id,readyData:x,eventSeq:C.eventSeq,ackSeq:-1});let g={...x,...GJ,vm_hands:{layout:W.layout,policy_digest:W.policy_digest,launch_id:W.launch_id}},f=Date.now()+EQ,R=1,j=await B("hands.ready",g);while(BQ(j.status)&&!J.signal.aborted){let _=fJ(R);if(Date.now()+_>=f)break;await new Promise((H)=>setTimeout(H,_)),R++,j=await B("hands.ready",g)}if(R>1)z("vm_hands.ready_retried",{attempts:R,status_class:`${Math.floor(j.status/100)}xx`});if(o.delete(Z.attempt_id),j.status>=300){await bJ(Q,Z.attempt_id),await J.agent.boundRefused(Z.attempt_id),await E("failed",{error_code:HJ(j.json?.error,"vm_hands_probe_failed")});return}let S={claim:Z,launchId:W.launch_id,readyData:x,eventSeq:C.eventSeq,ackSeq:q};Q.turns.set(Z.attempt_id,S),S.flush=()=>EJ(S),J.onTurn?.(Z.attempt_id,cJ(S)),await BJ(S)}async function uJ(Z,Y){let{fence:X,op:K}=h(Z),C=Z.claim.attempt_id,E=-1;try{for(;;){let B=await k(`/operations/${K}/heartbeat`,{...X,control_ack_seq:E,wait_ms:hJ});if(!Y())return E;if(B.status>=300)return J.agent.abandonWorkspaceGrant(C),E;let G=(B.json?.controls??[]).slice().sort((W,P)=>W.seq-P.seq);for(let W of G){if(W.seq<=E)continue;if(E=W.seq,W.kind===RJ)return z("vm_hands.workspace_granted",{}),J.agent.grantWorkspace(C),E;return z("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(W.kind)?W.kind:"other"}),J.agent.abandonWorkspaceGrant(C),E}}}catch{return J.agent.abandonWorkspaceGrant(C),E}}async function BJ(Z){let{fence:Y,op:X}=h(Z),K=null,C=null,E=J.agent.executorExited(Z.claim.attempt_id).then((B)=>{return C=B,null});J:for(;;){let B=await Promise.race([E,k(`/operations/${X}/heartbeat`,{...Y,control_ack_seq:Z.ackSeq,wait_ms:hJ})]);if(!B){K="vm_hands_executor_exited",z("vm_hands.executor_exited",{reason:C});break}if(B.status>=300)break;let G=(B.json?.controls??[]).slice().sort((W,P)=>W.seq-P.seq);for(let W of G){if(W.seq<=Z.ackSeq)continue;if(W.kind==="operation.cancel"||W.kind==="cancel"){Z.ackSeq=W.seq;break J}if(W.kind===gJ)try{await iJ(Z,W.payload??{})}catch(P){if(P instanceof V)throw P;K=P instanceof F?P.code:"environment_unavailable";let M=P&&typeof P==="object"&&"code"in P&&typeof P.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(P.code)?P.code:null;z("vm_hands.environment_refused",{code:K,cause:M});break J}Z.ackSeq=W.seq}}await dJ(Z,K)}async function oJ(Z){let Y=Z,X={claim:Y,eventSeq:0},{complete:K,emit:C,fence:E,op:B}={...h(X)},G=Z.vm_hands_origin==="person"?"person":"model",W=String(Z.capability??"");if(!J.executeOp){await K("failed",{error_code:"vm_hands_op_unsupported"});return}if(Z.vm_hands_attest==="accepted"&&Q.attest==="pending"&&!(i&&Q.attest==="pending")){Q.attest="accepted";for(let j of Q.attestWaiters.splice(0))j(!0)}if(Q.attest!=="accepted"){let j=Date.parse(String(Z.lease_until??""))-Date.now()-5000,S=Q.attest==="refused"?0:Math.max(0,Math.min(JJ,Number.isFinite(j)?j:JJ));if(!(S>0&&await new Promise((H)=>{let a=setTimeout(()=>H(!1),S);Q.attestWaiters.push((n)=>{clearTimeout(a),H(n)})}))){await K("failed",{error_code:"vm_hands_unattested"});return}}let P=J.agent.bindIdForRun(Y.run_id);if(G==="model"&&P===null){await K("failed",{error_code:"vm_hands_not_bound"});return}let M=W==="pty.start"&&G==="person"&&!Z.authority;if(M&&(J.agent.liveBindIds.length>0||Q.bindsStarting>0)){await K("failed",{error_code:"vm_hands_bound"});return}if(kJ.has(W)&&!M&&J.agent.liveBindIds.length===0){await K("failed",{error_code:"vm_hands_not_bound"});return}if(G==="model"&&P||kJ.has(W)&&!M)J.agent.opServed();let q=new AbortController;zJ.add(q);let x,GJ=new Promise((j)=>{x=j}),g={abort:q,settled:GJ};if(M)Q.personTerminals.add(g);if(G==="model"&&P){let j=Q.modelOps.get(P)??new Set;j.add(g),Q.modelOps.set(P,j),await J.agent.environmentInstalled(P,WQ,q.signal)}let f=-1,R=setInterval(()=>{k(`/operations/${B}/heartbeat`,{...E,control_ack_seq:f,wait_ms:0}).then((j)=>{if(j.status>=300){q.abort();return}let S=j.json?.controls??[];for(let _ of S)if(f=Math.max(f,_.seq),_.kind==="operation.cancel"||_.kind==="cancel")q.abort()},()=>q.abort())},GQ);try{let j=await J.executeOp({kind:G,claim:Z,...G==="model"&&P?{bindId:P}:{},signal:q.signal,emit:async(_)=>{await C(_.kind,_.data??{})}}),S=await K(j.status,{...j.result?{result:j.result}:{},...j.error_code?{error_code:HJ(j.error_code,"vm_hands_op_failed")}:{}});z("vm_hands.op",{capability:W,kind:G,status:j.status,code:j.error_code??null,...S.status>=300?{complete_status:S.status,complete_error:String(S.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval(R),zJ.delete(q),P)Q.modelOps.get(P)?.delete(g);Q.personTerminals.delete(g),x()}}async function dJ(Z,Y){let X=Z.claim.attempt_id;if(Q.turns.get(X)===Z)Q.turns.delete(X);J.onTurn?.(X,null),QJ(Z);let K=await p(Q,J.agent,X).catch((C)=>s(C,Z,Y));if(!K)return;Q.receipts.push({turn:Z,failure:Y,unbound:K}),await r()}function s(Z,Y,X){let K=mJ(Z);return z("vm_hands.unbind_unverified",{operation_id:Y.claim.operation_id,code:K,attempt:0}),h(Y).emit(IJ,{code:K}).catch(()=>{return}),AQ(Q,J.agent,{turn:Y,failure:X},J.signal,z),null}function r(){return YJ=YJ.then(LJ,LJ),YJ}async function LJ(){while(Q.receipts.length){let{turn:Z,failure:Y,unbound:X}=Q.receipts[0],{complete:K,emit:C}=h(Z);try{if(await C("hands.stopped",{...Z.readyData,reason_code:Y?"failed":"cancelled",killed_verified:X.killed_verified,shredded:X.shredded,...X.srt_fallbacks?{vm_hands_srt_fallbacks:X.srt_fallbacks}:{}}),Y)await K("failed",{error_code:Y});else await K("cancelled",{error_code:"driver_stopped"})}catch(E){if(E instanceof V)return}Q.receipts.shift()}}async function iJ(Z,Y){let{fence:X,op:K}=h(Z),C=Y.snapshot_id;if(Y.version!==1||typeof C!=="string"||Object.keys(Y).length!==2)throw new F("vm_hands_env_invalid","invalid environment delivery");let E=await k(`/operations/${K}/environment`,{...X,snapshot_id:C}),B=E.json?.environment_sealed;if(E.status!==200||!B||E.json?.payload!==void 0)throw new F("vm_hands_env_invalid","environment not delivered sealed");let G=await J.agent.deliverEnvironment({attemptId:Z.claim.attempt_id,snapshotId:C,deviceId:Q.deviceId??"",sealed:B});if((await k(`/operations/${K}/environment-ack`,{...X,...G})).status>=300)throw new F("vm_hands_env_ack_refused","environment ack refused")}}
 export{SQ as za,ZQ as Aa,vQ as Ba};

package/bin/vm-hands/{vm-hands-entry-lite-kntkyezs.js → vm-hands-entry-lite-9vf97byd.js}

@@ -1,4 +1,4 @@
 // @bun
-import{vj as J}from"./vm-hands-entry-lite-wsnr4fx8.js";import{readFileSync as L}from"fs";import{isAbsolute as M,normalize as Q}from"path";var W="REASON_WORKER_DESKTOP_USER",G=null;function X(q,B){for(let I of B.split(`
+import{xj as J}from"./vm-hands-entry-lite-hye6r7dy.js";import{readFileSync as L}from"fs";import{isAbsolute as M,normalize as Q}from"path";var W="REASON_WORKER_DESKTOP_USER",G=null;function X(q,B){for(let I of B.split(`
 `)){let j=I.split(":");if(j.length<7||Number(j[2])!==q||!/^\d+$/.test(j[2])||!/^\d+$/.test(j[3]))continue;let x=j[5];if(!/^[a-z_][a-z0-9_-]*$/i.test(j[0])||!M(x)||Q(x)!==x||x==="/")return null;return{username:j[0],uid:q,gid:Number(j[3]),home:x}}return null}function b(q={}){let B="value"in q?q.value:process.env[W];if(G=null,B===void 0||B==="")return null;let I=q.platform??process.platform,j="euid"in q?q.euid:process.geteuid?.(),x=/^[1-9]\d{0,9}$/.test(B)?Number(B):NaN,C=I==="linux"&&j===0&&Number.isSafeInteger(x)?X(x,(q.passwd??(()=>L("/etc/passwd","utf8")))()):null;if(!C||C.gid===0)throw Error("worker_desktop_user_invalid");return G=C,C}function k(){return G}function y(){return G?.home??J()}
-export{W as Xg,X as Yg,b as Zg,k as _g,y as $g};
+export{W as Zg,X as _g,b as $g,k as ah,y as bh};

package/bin/vm-hands/{vm-hands-entry-lite-6rzy866f.js → vm-hands-entry-lite-ac8sdh78.js}

@@ -1,5 +1,5 @@
 // @bun
-import{pe as Qz,te as Zz,ve as R,ye as $z}from"./vm-hands-entry-lite-x0x1t6gp.js";import{vi as zz}from"./vm-hands-entry-lite-caxtg4j7.js";import{Li as e}from"./vm-hands-entry-lite-26d4ttdx.js";import{dj as Hz,sj as V,uj as Jz}from"./vm-hands-entry-lite-evzskkcd.js";import{Gk as X}from"./vm-hands-entry-lite-rbjky7rd.js";import{spawnSync as C}from"child_process";import{createHash as Iz,randomUUID as Wz}from"crypto";import{chmodSync as bz,existsSync as y,mkdirSync as Sz,readdirSync as wz,readFileSync as L,renameSync as _z,rmSync as Y,statSync as xz,writeFileSync as Rz}from"fs";import{dirname as yz,isAbsolute as Bz,join as N}from"path";import{spawnSync as Oz}from"child_process";import{readFileSync as Cz}from"fs";import{userInfo as v}from"os";import{join as Kz}from"path";var Vz="REASON_SCHEDULED_TASK";function l(H){return Kz(H,"AppData","Local","Reason","Tasks")}function A(H){if(/[\0-\x1f\x7f"%]/.test(H))throw Error(`A background task cannot use a value with a double quote, percent sign or control character: ${H}`);return`'${H.replace(/['\u2018\u2019\u201a\u201b]/g,"$&$&")}'`}function a(H){if(!/^[A-Za-z0-9._-]+$/.test(H))throw Error(`Invalid Windows Scheduled Task name: ${H}`);return`$env:${Vz}=${A(H)};`}function c(H){let z=Object.entries(H.environment).map(([Q,Z])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(Q))throw Error(`Invalid Windows Scheduled Task environment name: ${Q}`);return`$env:${Q}=${A(Z)};`}),J=`$global:LASTEXITCODE=1; & ${[H.program,...H.args].map(A).join(" ")} 2>&1 | ForEach-Object { Add-Content -LiteralPath ${A(H.log)} -Value $_.ToString() -Encoding UTF8 }; $c=$LASTEXITCODE;`;return[a(H.name),...z,"$ErrorActionPreference='Continue';",H.keepAlive?`do { ${J} if ($c) { Start-Sleep -Seconds 10 } } while ($c)`:`${J} exit $c`].join(" ")}function S(H){return H.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function Pz(){let H=process.env.USERDOMAIN?.trim();return H?`${H}\\${v().username}`:v().username}function h(H){let z=S(H.user??Pz()),J=H.schedule==="logon",Q=H.schedule==="logon"?`<LogonTrigger><Enabled>true</Enabled><UserId>${z}</UserId></LogonTrigger>`:`<TimeTrigger><Repetition><Interval>PT${H.schedule.everyMinutes}M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition><StartBoundary>2026-01-01T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger>`,Z=`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "${H.script}"`;return`<?xml version="1.0" encoding="UTF-16"?>
+import{pe as Qz,te as Zz,ve as R,ye as $z}from"./vm-hands-entry-lite-np1fcr2t.js";import{xi as zz}from"./vm-hands-entry-lite-q4tcfj61.js";import{Ni as e}from"./vm-hands-entry-lite-fbpxs065.js";import{fj as Hz,uj as V,wj as Jz}from"./vm-hands-entry-lite-bmywbwj4.js";import{Ik as X}from"./vm-hands-entry-lite-8gjrr6hg.js";import{spawnSync as C}from"child_process";import{createHash as Iz,randomUUID as Wz}from"crypto";import{chmodSync as bz,existsSync as y,mkdirSync as Sz,readdirSync as wz,readFileSync as L,renameSync as _z,rmSync as Y,statSync as xz,writeFileSync as Rz}from"fs";import{dirname as yz,isAbsolute as Bz,join as N}from"path";import{spawnSync as Oz}from"child_process";import{readFileSync as Cz}from"fs";import{userInfo as v}from"os";import{join as Kz}from"path";var Vz="REASON_SCHEDULED_TASK";function l(H){return Kz(H,"AppData","Local","Reason","Tasks")}function A(H){if(/[\0-\x1f\x7f"%]/.test(H))throw Error(`A background task cannot use a value with a double quote, percent sign or control character: ${H}`);return`'${H.replace(/['\u2018\u2019\u201a\u201b]/g,"$&$&")}'`}function a(H){if(!/^[A-Za-z0-9._-]+$/.test(H))throw Error(`Invalid Windows Scheduled Task name: ${H}`);return`$env:${Vz}=${A(H)};`}function c(H){let z=Object.entries(H.environment).map(([Q,Z])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(Q))throw Error(`Invalid Windows Scheduled Task environment name: ${Q}`);return`$env:${Q}=${A(Z)};`}),J=`$global:LASTEXITCODE=1; & ${[H.program,...H.args].map(A).join(" ")} 2>&1 | ForEach-Object { Add-Content -LiteralPath ${A(H.log)} -Value $_.ToString() -Encoding UTF8 }; $c=$LASTEXITCODE;`;return[a(H.name),...z,"$ErrorActionPreference='Continue';",H.keepAlive?`do { ${J} if ($c) { Start-Sleep -Seconds 10 } } while ($c)`:`${J} exit $c`].join(" ")}function S(H){return H.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function Pz(){let H=process.env.USERDOMAIN?.trim();return H?`${H}\\${v().username}`:v().username}function h(H){let z=S(H.user??Pz()),J=H.schedule==="logon",Q=H.schedule==="logon"?`<LogonTrigger><Enabled>true</Enabled><UserId>${z}</UserId></LogonTrigger>`:`<TimeTrigger><Repetition><Interval>PT${H.schedule.everyMinutes}M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition><StartBoundary>2026-01-01T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger>`,Z=`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "${H.script}"`;return`<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
     <Description>${S(H.description)}</Description>

package/bin/vm-hands/{vm-hands-entry-lite-evzskkcd.js → vm-hands-entry-lite-bmywbwj4.js}

@@ -1,9 +1,9 @@
 // @bun
-import{vj as w}from"./vm-hands-entry-lite-wsnr4fx8.js";import{Vj as h}from"./vm-hands-entry-lite-mnf64x9n.js";import{randomUUID as d}from"crypto";import{spawnSync as F}from"child_process";import{chmodSync as Kj,cpSync as Nj,existsSync as I,lstatSync as H,mkdirSync as s,readdirSync as Qj,readFileSync as S,readlinkSync as Uj,realpathSync as B,renameSync as A,rmdirSync as Vj,rmSync as D,symlinkSync as y,writeFileSync as Wj}from"fs";import{dirname as G,join as V,relative as Xj,resolve as Yj}from"path";var Zj="so.ara.cli",E=[Zj,"com.reasonmachines.cli"],m="5LJFSBRY2F";function u(j){return`(${j.map((z)=>`identifier "${z}"`).join(" or ")}) and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${m}"`}var $j="Background/Reason.app",l="ReasonBackgroundIdentity",yj="Contents/Helpers/ReasonPermissionTile",wj="so.ara.cli.permission-tile",xj=u([wj,"com.reasonmachines.cli.permission-tile"]),k="AraBackgroundIdentity",Dj="Reason",gj=u(E),Pj=`anchor apple generic and (${E.map((j)=>`identifier "${j}"`).join(" or ")}) and certificate leaf[subject.OU] = "${m}"`;class C extends Error{code;constructor(j,z){super(z);this.code=j;this.name="MacOSBackgroundIdentityError"}}var M="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function L(j=w()){return V(j,"Library","Application Support","Reason","Background","Reason.app")}function O(j=w()){return V(j,"Library","Application Support","Ara","Background","Ara.app")}function bj(j=process.execPath){return V(G(B(j)),$j)}function qj(j){try{return H(j).isFile()}catch{return!1}}function f(j){return[l,k].map((z)=>V(j,"Contents","MacOS",z)).find(qj)??null}function Y(j){try{if(!H(j).isDirectory())return!1;let z=S(V(j,"Contents","Info.plist"),"utf8");return E.some((J)=>z.includes(`<string>${J}</string>`))&&(z.includes(`<string>${Dj}</string>`)||z.includes("<string>Ara</string>"))&&f(j)!==null}catch{return!1}}function c(j=w()){let z=L(j);if(!Y(z))return null;try{let J=S(V(z,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(J)?.[1]??null}catch{return null}}function Aj(j,z=w()){let J=c(z);return J===null||t(v(J.split(".")),v(j.split(/[.-]/).slice(0,3)))}var Gj=1e4;function i(j,z){return F(j,[...z],{stdio:"ignore",timeout:Gj}).status??1}var o=new Set;function r(j){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let z=(J)=>{try{return B(J)}catch{return Yj(J)}};if(j!==void 0&&z(j)!==z(w()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var n=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.(?:ara|reason)(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,p=new Set(["ara","ara.exe","reason","reason.exe"]);function v(j){return j.map((z)=>Number(z))}function t(j,z){for(let J=0;J<3;J+=1)if(j[J]!==z[J])return j[J]<z[J];return!1}var Lj=[0,2,161];function Tj(j){if(j===null)return!0;let z=Lj,J=null;try{J=B(process.execPath)}catch{}return j.some((K)=>{let N=n.exec(K);if(N){let Z=N[1]===void 0?N.slice(4,7):N.slice(1,4);return t(v(Z),z)}let Q=K.slice(K.lastIndexOf("/")+1);return p.has(Q)&&K!==J&&K!==process.execPath})}function _j(){let j=F("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(j.status!==0)return null;let z=[];for(let J of j.stdout.split(`
+import{xj as w}from"./vm-hands-entry-lite-hye6r7dy.js";import{Xj as h}from"./vm-hands-entry-lite-0c4nxpza.js";import{randomUUID as d}from"crypto";import{spawnSync as F}from"child_process";import{chmodSync as Kj,cpSync as Nj,existsSync as I,lstatSync as H,mkdirSync as s,readdirSync as Qj,readFileSync as S,readlinkSync as Uj,realpathSync as B,renameSync as A,rmdirSync as Vj,rmSync as D,symlinkSync as y,writeFileSync as Wj}from"fs";import{dirname as G,join as V,relative as Xj,resolve as Yj}from"path";var Zj="so.ara.cli",E=[Zj,"com.reasonmachines.cli"],m="5LJFSBRY2F";function u(j){return`(${j.map((z)=>`identifier "${z}"`).join(" or ")}) and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${m}"`}var $j="Background/Reason.app",l="ReasonBackgroundIdentity",yj="Contents/Helpers/ReasonPermissionTile",wj="so.ara.cli.permission-tile",xj=u([wj,"com.reasonmachines.cli.permission-tile"]),k="AraBackgroundIdentity",Dj="Reason",gj=u(E),Pj=`anchor apple generic and (${E.map((j)=>`identifier "${j}"`).join(" or ")}) and certificate leaf[subject.OU] = "${m}"`;class C extends Error{code;constructor(j,z){super(z);this.code=j;this.name="MacOSBackgroundIdentityError"}}var M="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function L(j=w()){return V(j,"Library","Application Support","Reason","Background","Reason.app")}function O(j=w()){return V(j,"Library","Application Support","Ara","Background","Ara.app")}function bj(j=process.execPath){return V(G(B(j)),$j)}function qj(j){try{return H(j).isFile()}catch{return!1}}function f(j){return[l,k].map((z)=>V(j,"Contents","MacOS",z)).find(qj)??null}function Y(j){try{if(!H(j).isDirectory())return!1;let z=S(V(j,"Contents","Info.plist"),"utf8");return E.some((J)=>z.includes(`<string>${J}</string>`))&&(z.includes(`<string>${Dj}</string>`)||z.includes("<string>Ara</string>"))&&f(j)!==null}catch{return!1}}function c(j=w()){let z=L(j);if(!Y(z))return null;try{let J=S(V(z,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(J)?.[1]??null}catch{return null}}function Aj(j,z=w()){let J=c(z);return J===null||t(v(J.split(".")),v(j.split(/[.-]/).slice(0,3)))}var Gj=1e4;function i(j,z){return F(j,[...z],{stdio:"ignore",timeout:Gj}).status??1}var o=new Set;function r(j){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let z=(J)=>{try{return B(J)}catch{return Yj(J)}};if(j!==void 0&&z(j)!==z(w()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var n=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.(?:ara|reason)(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,p=new Set(["ara","ara.exe","reason","reason.exe"]);function v(j){return j.map((z)=>Number(z))}function t(j,z){for(let J=0;J<3;J+=1)if(j[J]!==z[J])return j[J]<z[J];return!1}var Lj=[0,2,161];function Tj(j){if(j===null)return!0;let z=Lj,J=null;try{J=B(process.execPath)}catch{}return j.some((K)=>{let N=n.exec(K);if(N){let Z=N[1]===void 0?N.slice(4,7):N.slice(1,4);return t(v(Z),z)}let Q=K.slice(K.lastIndexOf("/")+1);return p.has(Q)&&K!==J&&K!==process.execPath})}function _j(){let j=F("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(j.status!==0)return null;let z=[];for(let J of j.stdout.split(`
 `)){let K=/^\s*(\d+)\s+(\S.*)$/.exec(J);if(!K||Number(K[1])===process.pid)continue;let N=K[2].trimEnd(),Q=N.slice(N.lastIndexOf("/")+1);if(!n.test(N)&&p.has(Q)){let W=F("/usr/sbin/lsof",["-a","-p",K[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
 `).find((X)=>X.startsWith("n/"));if(W)N=W.slice(1)}z.push(N)}return z}function Cj(j){if(r(j.home),!Y(j.sourceApp))throw new C("identity_invalid","The packaged Reason background identity is missing or invalid.");let z=j.command??i,J=L(j.home),K=G(J);s(K,{recursive:!0,mode:448}),Kj(K,448);let N=B(j.sourceApp),Q=null;try{Q=B(J)}catch{}if(N!==Q){let Z=`${process.pid}.${d()}`,W=V(K,`.Reason.app.${Z}.tmp`),X=V(K,`.Reason.app.${Z}.old`),P=!1;try{if(Nj(N,W,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!Y(W))throw new C("identity_invalid","The copied Reason background identity is invalid.");let T=j.releaseSigned?["--test-requirement",`=${Pj}`]:[];if(z("/usr/bin/codesign",["--verify","--strict",...T,W])!==0)throw new C("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let _=!1;for(let $=0;$<4;$+=1){let q=!1;try{A(J,X),q=!0,P=!0}catch(U){if(U.code!=="ENOENT")throw U}if($===0)j.beforePublish?.();try{A(W,J),_=!0}catch(U){let Jj=U.code;if(!["EEXIST","ENOTEMPTY"].includes(Jj??""))throw U;if(q)D(X,{recursive:!0,force:!0}),P=!1;if($===3)throw U;continue}if(q)D(X,{recursive:!0,force:!0}),P=!1;break}if(!_)throw Error("Could not publish Reason's background identity.")}catch(T){if(P&&!I(J)&&I(X))A(X,J);throw T}finally{D(W,{recursive:!0,force:!0}),D(X,{recursive:!0,force:!0})}}return zj(J,j,{verified:N!==Q}),J}function a(j){return V(G(j),".Reason.app.registered")}function e(j){try{let z=H(j);return z.isDirectory()?`${z.ino}:${z.birthtimeMs}`:null}catch{return null}}function R(j){let z=e(j);try{return z!==null&&S(a(j),"utf8")===z}catch{return!1}}function jj(j){if(Y(j))return"bundle";try{if(H(V(j,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return H(V(j,"Contents","MacOS",k)).isSymbolicLink()?"retired":null}catch{return null}}function zj(j,z,J={}){let K=z.command??i;if(!J.verified&&K("/usr/bin/codesign",["--verify","--strict",j])!==0)throw new C("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if(K(M,["-f",j])!==0)throw new C("identity_register_failed","Could not register Reason's macOS background identity.");let N=e(j);try{if(N)Wj(a(j),N,{mode:384})}catch{}try{Fj(j,z.home,K,z.runningExecutables??_j)}catch(Q){let Z=Q.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${Z})
 `)}}function Fj(j,z,J,K){let N=f(j);if(!N)return;let Q=O(z),Z=G(Q),W=(U)=>V(U,"Contents","MacOS",k),X=Xj(G(W(Q)),N),P=`${process.pid}.${d()}`,T=jj(Q);if(T===null)return;let _=T==="bundle";if(_)J(M,["-u",Q]);let $=V(Z,`.Ara.app.${P}.old`);if(!o.has(Q)&&!Tj(K())){if(!_)J(M,["-u",Q]);try{A(Q,$)}catch(U){if(U.code==="ENOENT")return;throw U}D($,{recursive:!0,force:!0}),Hj(Z);return}if(!_){if(Uj(W(Q))===X)return;let U=`${W(Q)}.${P}`;y(X,U);try{A(U,W(Q))}finally{D(U,{force:!0})}return}let q=V(Z,`.Ara.app.${P}.shim`);s(G(W(q)),{recursive:!0}),y(X,W(q));try{try{A(Q,$)}catch(U){if(U.code==="ENOENT")return;throw U}try{A(q,Q)}catch(U){if(I(Q))return;throw A($,Q),U}}finally{D(q,{recursive:!0,force:!0}),D($,{recursive:!0,force:!0})}}function Hj(j){try{if(Qj(j).some((J)=>J!==".DS_Store"))return;D(V(j,".DS_Store"),{force:!0}),Vj(j)}catch{}}var x=new Map;function Bj(j=w()){let z=x.get(j);if(z)return z;if(process.platform!=="darwin")return[];let J=g(j);if(J===null&&I(G(L(j))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),J=g(j);if(J===null)return[];return x.set(j,J),J}function g(j){let z=L(j),J=O(j);if(!Y(z)||!R(z))try{Oj({home:j,skipWhenSettled:!0})}catch{}let K=Y(z)&&(R(z)||!Y(J))?z:Y(J)?J:null,N=K?f(K):null;if(!N)return null;if(K===J)o.add(J);let Q=F(N,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return Q.status===0&&Q.stdout===`spawn
 `?[N,"--spawn"]:[]}var b=new Map;function Ij(j=w()){let z=Bj(j),J=z[0];if(!J)return[];let K=b.get(J);if(K===void 0){let N=F(J,["--can-spawn-computer-use"],{env:{},timeout:2000,encoding:"utf8"});K=N.status===0&&N.stdout===`spawn
 `,b.set(J,K)}return K?z:[]}function hj(j=Ij(),z=w()){if(j.length>0)return null;if(c(z)===null)return"computer_use_identity_missing";return Aj(h,z)?"computer_use_identity_outdated":"computer_use_identity_unavailable"}function Oj(j={}){r(j.home);let z=L(j.home);if(j.skipWhenSettled&&Y(z)&&R(z)&&jj(O(j.home))===null)return!0;if(!Y(z)){let J=O(j.home);if(!Y(J))return!1;try{return Cj({...j,sourceApp:J}),!0}catch(K){if(!Y(z))throw K}}return zj(z,j),!0}var Mj="REASON_WORKER_IDENTITY_APP";function dj(j,z=process.env,J=w()){let K=z[Mj];return K&&K===L(J)?K:j}function sj(j,z){if(process.platform!=="darwin")return null;let J=L(j),K=V(J,"Contents","MacOS",l),N=F(K,["--can-run-worker",z],{env:{},timeout:2000,encoding:"utf8"});return N.status===0&&N.stdout===`run-worker
 `?{app:J,executable:K}:null}
-export{Zj as dj,m as ej,u as fj,yj as gj,C as hj,M as ij,L as jj,bj as kj,c as lj,Aj as mj,Cj as nj,Bj as oj,Ij as pj,hj as qj,Oj as rj,Mj as sj,dj as tj,sj as uj};
+export{Zj as fj,m as gj,u as hj,yj as ij,C as jj,M as kj,L as lj,bj as mj,c as nj,Aj as oj,Cj as pj,Bj as qj,Ij as rj,hj as sj,Oj as tj,Mj as uj,dj as vj,sj as wj};

package/bin/vm-hands/{vm-hands-entry-lite-m5swxtdx.js → vm-hands-entry-lite-c60v3v0v.js}

@@ -1,5 +1,5 @@
 // @bun
-import{$b as J8,Ab as P7,Bb as T7,Cb as R7,Db as o4,Eb as q7,Fb as g7,Mb as E7,Qb as S7,Rb as f7,dc as x7,ec as y7,fc as Y8,gc as W8,ic as h7,kb as m4,kc as h8,lc as v0,mb as q2,mc as p0,nb as v4,nc as F2,ob as u4,pb as w7,qb as M7,qc as m7,rb as j7,tb as p4,tc as m8,ub as L7,uc as Z8,vb as I7,vc as Q8,wb as i4,wc as k1,xb as A7,yb as a3,yc as v7,zb as _7}from"./vm-hands-entry-lite-2abf7fnn.js";import{Fc as l7,Hc as s7,Ic as c7}from"./vm-hands-entry-lite-heehk76b.js";import{Nc as k7}from"./vm-hands-entry-lite-400hmvkg.js";import{$c as g0,Tc as e0,Uc as $1}from"./vm-hands-entry-lite-k9amte6k.js";import{ad as X1}from"./vm-hands-entry-lite-swwb5mp2.js";import{cd as t4,dd as e4}from"./vm-hands-entry-lite-wts79wdn.js";import{fd as u7}from"./vm-hands-entry-lite-nqvb7a2m.js";import{jd as H2,kd as C2,ld as B4,nd as V4,pd as G4,qd as X4,ud as U4,wd as z7}from"./vm-hands-entry-lite-xaaxvbk8.js";import{Ed as W2,Hd as V9,Qd as G9}from"./vm-hands-entry-lite-3098ecjq.js";import{$e as h6,$f as Y5,Af as G7,Bf as X7,Cf as U7,Df as F7,Ee as g1,Ef as Y7,Fe as E1,Ff as W7,Ge as n3,He as O2,Ie as y6,Je as r3,Ke as _4,Le as P4,Lf as i8,Me as j0,Mf as o8,Nf as t8,Of as e8,Pf as $5,Qe as C0,Qf as J5,Sf as Z5,Te as s,Tf as Q5,Ue as c1,Uf as K5,Vf as B5,Wf as V5,Xe as a8,Xf as G5,Yf as X5,Ze as n1,Zf as U5,_f as F5,af as m6,ef as v6,ff as u6,gf as p6,hf as d6,if as l6,jf as s6,kf as c6,lf as n6,mf as r6,nf as a6,of as i6,pf as o6,qf as t6,rf as e6,sf as $7,tf as J7,uf as Z7,vf as Q7,wf as K7,xf as B7,zf as V7}from"./vm-hands-entry-lite-afjzr3v2.js";import{fg as _6,jg as m5,kg as X6,qg as X9,tg as v5,ug as X2}from"./vm-hands-entry-lite-5p118s93.js";import{Cg as K9,Fg as B9,wg as J9,xg as Z9,yg as Q9}from"./vm-hands-entry-lite-2yt333v3.js";import{Og as $8,Vg as b7}from"./vm-hands-entry-lite-wtc8ebkr.js";import{_g as Y2}from"./vm-hands-entry-lite-kntkyezs.js";import{eh as u3,rh as N7}from"./vm-hands-entry-lite-0dr3sp75.js";import{Ni as p7,Oi as d7}from"./vm-hands-entry-lite-9cgye69h.js";import{$i as _1,_i as A1,aj as P1,bj as T1,cj as k0}from"./vm-hands-entry-lite-0mk8rxqv.js";import{vj as b1,wj as O7,xj as r4,yj as a4}from"./vm-hands-entry-lite-wsnr4fx8.js";import{Aj as v3,Cj as B1,Ij as y8,Jj as k4}from"./vm-hands-entry-lite-arw53mkf.js";import{$j as r7,_j as n7,ak as a7,bk as i7,dk as o7,ek as t7,gk as e7,hk as $9}from"./vm-hands-entry-lite-qg11k3bf.js";import{sk as V}from"./vm-hands-entry-lite-ysk49bnz.js";import{Ck as z5,Dk as c4,Ik as H7,Jk as C7,Kk as D7,Lk as n4,Mk as l1}from"./vm-hands-entry-lite-rbjky7rd.js";import{Nk as T4}from"./vm-hands-entry-lite-b8bcnenf.js";import{Pk as H}from"./vm-hands-entry-lite-f28ehysx.js";import{Vk as g8}from"./vm-hands-entry-lite-c3e25cks.js";import{request as T9}from"http";import{request as R9}from"https";import{lookup as q9}from"dns/promises";import{isIP as g9}from"net";async function E9($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?R9:T9)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:V4},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),K.end($.body)})}var F4=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),k9=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function Y4($,J=0){if(!$||typeof $!=="object"||J>3)return null;let Z=$.code;if(typeof Z==="string"){if(F4.has(Z))return"custom_endpoint_host_not_found";if(k9.has(Z))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(Z))return"custom_endpoint_tls_failed"}for(let Q of[...$ instanceof AggregateError?$.errors:[],$.cause]){let K=Y4(Q,J+1);if(K)return K}return null}async function S9($,J){let Z=Y4($),Q=new URL(J).hostname.replace(/^\[|\]$/g,"");if(Z!==null&&Z!=="custom_endpoint_connection_failed"||g9(Q)!==0)return Z;let K;return await Promise.race([q9(Q).then(()=>!0,(G)=>!F4.has(String(G?.code))),new Promise((G)=>{K=setTimeout(()=>G(!0),5000)})]).finally(()=>clearTimeout(K))?Z:"custom_endpoint_host_not_found"}function f9($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function b9($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let Y=Buffer.allocUnsafe(G.length*Q.length+B),F=0;for(let X of G){while(B&&Z[B]!==X){let W=K[B-1];F+=Z.copy(Y,F,0,B-W),B=W}if(Z[B]===X){if(B++,B===Z.length)F+=Q.copy(Y,F),B=0}else Y[F++]=X}if(U)F+=Z.copy(Y,F,0,B),B=0;return Y.subarray(0,F)}}async function W4($){$.signal.throwIfAborted();let J=X4.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=U4.parse(await $.credential($.signal));if(!G4(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,Y=0,F=f9(Q.apiKey),X=b9(Q.apiKey,F),W=async(N,C)=>{$.signal.throwIfAborted(),await new Promise((M,w)=>{let D=()=>{$.signal.removeEventListener("abort",D),w($.signal.reason)};if($.signal.addEventListener("abort",D,{once:!0}),$.signal.aborted){D();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(N,C)}).then(()=>{$.signal.removeEventListener("abort",D),M()},(j)=>{$.signal.removeEventListener("abort",D),w(j)})})},z=async(N)=>{if(G+=N.length,G>C2)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let C=0;C<N.length;C+=H2){if(Y>=B4)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await W(`custom_endpoint.chunk.${Y++}`,{eof:!1,data:N.subarray(C,C+H2).toString("base64")})}};try{let N=await E9({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=N.response,B=N.close;let C=K.statusCode??500;if(C>=300&&C<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let M={};for(let w of["content-type","retry-after","x-request-id","request-id"]){let D=K.headers[w];if(typeof D==="string")M[w]=D.replaceAll(Q.apiKey,F).slice(0,4096)}await W("custom_endpoint.headers",{status:C,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,F).slice(0,256),headers:M});for await(let w of K){$.signal.throwIfAborted();let D=Buffer.isBuffer(w)?w:Buffer.from(w);if(U+=D.length,U>C2)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await z(X(D))}return await z(X(Buffer.alloc(0),!0)),await W(`custom_endpoint.chunk.${Y}`,{eof:!0}),{bytes:G,chunks:Y}}catch(N){if($.signal.throwIfAborted(),N instanceof H)throw N;throw new H((K?null:await S9(N,Z.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as z4}from"path";function x9($,J){return $===z4(J,".ara","workspace")||$===z4(J,".reason","workspace")}function N4($,J){let Z=$.filter((Q)=>x9(Q.path,J));return Z.length===1?Z[0].path:null}var y9=/^[a-f0-9]{64}$/;var D2=32,h9=/^\/[^\x00-\x1f\x7f\\]*$/;function L1($){if(typeof $!=="string"||$.length>4096||!h9.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function O1($,J){let Z=J==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec($):null;if(!Z)return $;let Q=Z[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${Z[1].toUpperCase()}:${Q?`/${Q}`:""}`}function I1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!L1(J.home)||!Array.isArray(J.roots)||J.roots.length>D2)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!y9.test(K)||!L1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}function m9($){let J=/^Reason contributor (rc_[0-9a-f]{32})$/.exec($.name)?.[1];return $.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&J?J:void 0}function v9($){return m9($)??$.email.toLowerCase()}function w2($){let J=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec($.trim());return J?v9({name:J[1],email:J[2]}):$.trim().toLowerCase()}var r0=($)=>$.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(J)=>`[${J.toLowerCase()}${J.toUpperCase()}]`),u9=[...A1.map(($)=>`/(${$.map(r0).join("/")})(/|$)`),..._1.map(($)=>`/(${$.map(r0).join("/")})(/|$)`),...[...P1].map(($)=>`/(${r0($)})$`),`/${r0(".env.")}[^/]*$`,...T1.map(($)=>`/[^/]*${r0($)}$`)],H4=`function localGithubSandboxProfile(root, temporary) {
+import{$b as J8,Ab as P7,Bb as T7,Cb as R7,Db as o4,Eb as q7,Fb as g7,Mb as E7,Qb as S7,Rb as f7,dc as x7,ec as y7,fc as Y8,gc as W8,ic as h7,kb as m4,kc as h8,lc as v0,mb as q2,mc as p0,nb as v4,nc as F2,ob as u4,pb as w7,qb as M7,qc as m7,rb as j7,tb as p4,tc as m8,ub as L7,uc as Z8,vb as I7,vc as Q8,wb as i4,wc as k1,xb as A7,yb as a3,yc as v7,zb as _7}from"./vm-hands-entry-lite-5tgm1m3h.js";import{Fc as l7,Hc as s7,Ic as c7}from"./vm-hands-entry-lite-yg5h9mhm.js";import{Nc as k7}from"./vm-hands-entry-lite-69ray4x8.js";import{$c as g0,Tc as e0,Uc as $1}from"./vm-hands-entry-lite-jcd21jpm.js";import{ad as X1}from"./vm-hands-entry-lite-swwb5mp2.js";import{cd as t4,dd as e4}from"./vm-hands-entry-lite-5rkakg10.js";import{fd as u7}from"./vm-hands-entry-lite-nqvb7a2m.js";import{jd as H2,kd as C2,ld as B4,nd as V4,pd as G4,qd as X4,ud as U4,wd as z7}from"./vm-hands-entry-lite-jw5y1aa5.js";import{Ed as W2,Hd as V9,Qd as G9}from"./vm-hands-entry-lite-dsh32j5a.js";import{$e as h6,$f as U5,Bf as V7,Cf as G7,Df as X7,Ee as g1,Ef as U7,Fe as E1,Ff as F7,Ge as n3,Gf as Y7,He as O2,Hf as W7,Ie as y6,Je as r3,Ke as _4,Le as P4,Me as j0,Nf as i8,Of as o8,Pf as t8,Qe as C0,Qf as e8,Rf as $5,Sf as J5,Te as s,Ue as c1,Uf as Z5,Vf as Q5,Wf as K5,Xe as a8,Xf as B5,Yf as V5,Ze as n1,Zf as G5,_f as X5,af as m6,ag as F5,bg as Y5,ef as v6,ff as u6,gf as p6,hf as d6,if as l6,jf as s6,kf as c6,lf as n6,mf as r6,nf as a6,of as i6,pf as o6,qf as t6,rf as e6,sf as $7,tf as J7,uf as Z7,vf as Q7,wf as K7,xf as B7}from"./vm-hands-entry-lite-ky0w7t09.js";import{hg as _6,lg as m5,mg as X6,sg as X9,vg as v5,wg as X2}from"./vm-hands-entry-lite-vwpraybq.js";import{Ag as Q9,Eg as K9,Hg as B9,yg as J9,zg as Z9}from"./vm-hands-entry-lite-1sc3wc94.js";import{Qg as $8,Xg as b7}from"./vm-hands-entry-lite-yqrmr2c8.js";import{ah as Y2}from"./vm-hands-entry-lite-9vf97byd.js";import{gh as u3,th as N7}from"./vm-hands-entry-lite-mapxp682.js";import{Pi as p7,Qi as d7}from"./vm-hands-entry-lite-159860ns.js";import{aj as A1,bj as _1,cj as P1,dj as T1,ej as k0}from"./vm-hands-entry-lite-8f3px72v.js";import{Aj as a4,xj as b1,yj as O7,zj as r4}from"./vm-hands-entry-lite-hye6r7dy.js";import{Cj as v3,Ej as B1,Kj as y8,Lj as k4}from"./vm-hands-entry-lite-6berk108.js";import{ak as n7,bk as r7,ck as a7,dk as i7,fk as o7,gk as t7,ik as e7,jk as $9}from"./vm-hands-entry-lite-hd4a0a6f.js";import{uk as V}from"./vm-hands-entry-lite-vr38bh6k.js";import{Ek as z5,Fk as c4,Kk as H7,Lk as C7,Mk as D7,Nk as n4,Ok as l1}from"./vm-hands-entry-lite-8gjrr6hg.js";import{Pk as T4}from"./vm-hands-entry-lite-hepppjp0.js";import{Rk as H}from"./vm-hands-entry-lite-40nkzw38.js";import{Xk as g8}from"./vm-hands-entry-lite-72nn2b4n.js";import{request as T9}from"http";import{request as R9}from"https";import{lookup as q9}from"dns/promises";import{isIP as g9}from"net";async function E9($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?R9:T9)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:V4},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),K.end($.body)})}var F4=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),k9=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function Y4($,J=0){if(!$||typeof $!=="object"||J>3)return null;let Z=$.code;if(typeof Z==="string"){if(F4.has(Z))return"custom_endpoint_host_not_found";if(k9.has(Z))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(Z))return"custom_endpoint_tls_failed"}for(let Q of[...$ instanceof AggregateError?$.errors:[],$.cause]){let K=Y4(Q,J+1);if(K)return K}return null}async function S9($,J){let Z=Y4($),Q=new URL(J).hostname.replace(/^\[|\]$/g,"");if(Z!==null&&Z!=="custom_endpoint_connection_failed"||g9(Q)!==0)return Z;let K;return await Promise.race([q9(Q).then(()=>!0,(G)=>!F4.has(String(G?.code))),new Promise((G)=>{K=setTimeout(()=>G(!0),5000)})]).finally(()=>clearTimeout(K))?Z:"custom_endpoint_host_not_found"}function f9($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function b9($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let Y=Buffer.allocUnsafe(G.length*Q.length+B),F=0;for(let X of G){while(B&&Z[B]!==X){let W=K[B-1];F+=Z.copy(Y,F,0,B-W),B=W}if(Z[B]===X){if(B++,B===Z.length)F+=Q.copy(Y,F),B=0}else Y[F++]=X}if(U)F+=Z.copy(Y,F,0,B),B=0;return Y.subarray(0,F)}}async function W4($){$.signal.throwIfAborted();let J=X4.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=U4.parse(await $.credential($.signal));if(!G4(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,Y=0,F=f9(Q.apiKey),X=b9(Q.apiKey,F),W=async(N,C)=>{$.signal.throwIfAborted(),await new Promise((M,w)=>{let D=()=>{$.signal.removeEventListener("abort",D),w($.signal.reason)};if($.signal.addEventListener("abort",D,{once:!0}),$.signal.aborted){D();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(N,C)}).then(()=>{$.signal.removeEventListener("abort",D),M()},(j)=>{$.signal.removeEventListener("abort",D),w(j)})})},z=async(N)=>{if(G+=N.length,G>C2)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let C=0;C<N.length;C+=H2){if(Y>=B4)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await W(`custom_endpoint.chunk.${Y++}`,{eof:!1,data:N.subarray(C,C+H2).toString("base64")})}};try{let N=await E9({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=N.response,B=N.close;let C=K.statusCode??500;if(C>=300&&C<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let M={};for(let w of["content-type","retry-after","x-request-id","request-id"]){let D=K.headers[w];if(typeof D==="string")M[w]=D.replaceAll(Q.apiKey,F).slice(0,4096)}await W("custom_endpoint.headers",{status:C,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,F).slice(0,256),headers:M});for await(let w of K){$.signal.throwIfAborted();let D=Buffer.isBuffer(w)?w:Buffer.from(w);if(U+=D.length,U>C2)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await z(X(D))}return await z(X(Buffer.alloc(0),!0)),await W(`custom_endpoint.chunk.${Y}`,{eof:!0}),{bytes:G,chunks:Y}}catch(N){if($.signal.throwIfAborted(),N instanceof H)throw N;throw new H((K?null:await S9(N,Z.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as z4}from"path";function x9($,J){return $===z4(J,".ara","workspace")||$===z4(J,".reason","workspace")}function N4($,J){let Z=$.filter((Q)=>x9(Q.path,J));return Z.length===1?Z[0].path:null}var y9=/^[a-f0-9]{64}$/;var D2=32,h9=/^\/[^\x00-\x1f\x7f\\]*$/;function L1($){if(typeof $!=="string"||$.length>4096||!h9.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function O1($,J){let Z=J==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec($):null;if(!Z)return $;let Q=Z[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${Z[1].toUpperCase()}:${Q?`/${Q}`:""}`}function I1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!L1(J.home)||!Array.isArray(J.roots)||J.roots.length>D2)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!y9.test(K)||!L1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}function m9($){let J=/^Reason contributor (rc_[0-9a-f]{32})$/.exec($.name)?.[1];return $.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&J?J:void 0}function v9($){return m9($)??$.email.toLowerCase()}function w2($){let J=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec($.trim());return J?v9({name:J[1],email:J[2]}):$.trim().toLowerCase()}var r0=($)=>$.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(J)=>`[${J.toLowerCase()}${J.toUpperCase()}]`),u9=[...A1.map(($)=>`/(${$.map(r0).join("/")})(/|$)`),..._1.map(($)=>`/(${$.map(r0).join("/")})(/|$)`),...[...P1].map(($)=>`/(${r0($)})$`),`/${r0(".env.")}[^/]*$`,...T1.map(($)=>`/[^/]*${r0($)}$`)],H4=`function localGithubSandboxProfile(root, temporary) {
   return ['(version 1)','(deny default)','(import "system.sb")','(allow process-exec process-fork)',
     '(allow file-read* (subpath "/bin") (subpath "/sbin") (subpath "/usr/bin") (subpath "/usr/sbin") (subpath "/usr/libexec") (subpath "/usr/share") (subpath "/private/var/select") (literal "/private/var/db/xcode_select_link"))',
     '(allow file-read-metadata (path-ancestors "/opt/homebrew/bin") (path-ancestors "/usr/local/bin") (path-ancestors "/Library/Developer/CommandLineTools"))',
@@ -34,7 +34,7 @@ Content-Length: 0\r
 \r
 `),U8(Y,N,F)})().catch(()=>Y.destroy())}),await new Promise((U,Y)=>{B.once("error",Y),B.listen(0,"127.0.0.1",()=>U())});let{port:G}=B.address();return{url:`http://127.0.0.1:${G}`,close(){B.close();for(let U of Q)U.destroy()}}}import{createHash as l2,randomUUID as f$}from"crypto";import{closeSync as p1,constants as J0,fchownSync as b$,fstatSync as L0,fsyncSync as x$,linkSync as P8,lstatSync as v2,mkdirSync as T8,openSync as v1,readSync as E8,realpathSync as u2,unlinkSync as R8,writeSync as y$}from"fs";import{isAbsolute as h$,join as m$,relative as v$,sep as u$}from"path";import{platform as p2}from"os";import{getSystemErrorName as p$}from"util";var H8={type:"string",format:"uuid"},M8=String.raw`^(?![\\/])(?![A-Za-z]:[\\/])(?!.*(?:^|[\\/])\.\.(?:[\\/]|$))(?!.*\u0000)(?=.*\S)[\s\S]+$`,x1={type:"string",minLength:1,maxLength:4096,pattern:M8},b2=V.string().min(1).max(4096).regex(new RegExp(M8)),y1={device_id:V.string().uuid(),root_id:V.string().uuid(),timeout_ms:V.number().int().min(1000).max(60000).optional()},h1={device_id:H8,root_id:H8,timeout_ms:{type:"integer",minimum:1000,maximum:60000}},tB={read:{schema:V.object({...y1,path:b2,offset:V.number().int().min(0).optional(),max_bytes:V.number().int().min(1).max(131072).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path"],properties:{...h1,path:x1,offset:{type:"integer",minimum:0},max_bytes:{type:"integer",minimum:1,maximum:131072}},additionalProperties:!1}},write:{schema:V.object({...y1,path:b2,content:V.string().max(131072),mode:V.enum(["overwrite","append"]).optional(),create_parents:V.boolean().optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path","content"],properties:{...h1,path:x1,content:{type:"string",maxLength:131072},mode:{type:"string",enum:["overwrite","append"]},create_parents:{type:"boolean"}},additionalProperties:!1}},exec:{schema:V.object({...y1,command:V.string().min(1).max(16000),cwd:b2.optional(),mode:V.enum(["confined","host"]).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","command"],properties:{...h1,command:{type:"string",minLength:1,maxLength:16000},cwd:x1,mode:{type:"string",enum:["confined","host"],description:"Defaults to host: the existing permitted login shell with OS/account access, requiring execute and environment-discovery permission. Request confined explicitly for a scrubbed shell without network."}},additionalProperties:!1}}},z0=1073741824,Z1=600000,C8=String.raw`(?!\.{1,2}(?:/|(?![\s\S])))[^/\\\u0000]+`,j8=String.raw`^(?![A-Za-z]:/)(?=[\s\S]*\S)${C8}(?:/${C8})*(?![\s\S])`,L8=new RegExp(j8);function O8($){return typeof $==="string"&&$.length>0&&$.length<=4096&&L8.test($)}var x2=V.string().min(1).max(4096).regex(L8),y2={...x1,pattern:j8},I8=V.string().regex(/^[a-f0-9]{64}$/),A8=V.object({kind:V.literal("workspace"),path:x2}).strict(),E$=V.discriminatedUnion("kind",[A8,V.object({kind:V.literal("attachment"),attachment_id:V.string().min(1).max(120),sha256:I8}).strict()]),m1=1,Q1="cloud_workspace_id",h2="cloud_workspace",m2=1,k$=V.discriminatedUnion("kind",[A8,V.object({kind:V.literal("attachment"),download_url:V.string().min(1).max(16384),size_bytes:V.number().int().min(0).max(z0),sha256:I8}).strict()]),_8=V.object({source_version:V.literal(m1),source:k$,url:V.string().min(1).max(16384),transfer_cloud_scope:V.object({sandboxId:V.string().min(1).max(256),revision:V.number().int().nonnegative(),brainFence:V.string().uuid()}).strict().optional(),[Q1]:V.string().min(1).max(160).optional()}).strict(),eB=V.object({ready:V.literal(!0),cloud_source_version:V.literal(m1),source_kinds:V.array(V.enum(["workspace","attachment"]))});var D8=V.object({...y1,timeout_ms:V.number().int().min(1000).max(Z1).optional(),source_path:x2,destination_path:x2,idempotency_key:V.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/).optional()}).strict(),w8={type:"object",required:["device_id","root_id","source_path","destination_path"],properties:{...h1,timeout_ms:{type:"integer",minimum:1000,maximum:Z1},source_path:y2,destination_path:y2,idempotency_key:{type:"string",minLength:1,maxLength:160,pattern:"^[A-Za-z0-9._:-]+$"}},additionalProperties:!1},S$={oneOf:[{type:"object",required:["kind","path"],properties:{kind:{type:"string",const:"workspace"},path:y2},additionalProperties:!1},{type:"object",required:["kind","attachment_id","sha256"],properties:{kind:{type:"string",const:"attachment"},attachment_id:{type:"string",minLength:1,maxLength:120},sha256:{type:"string",pattern:"^[a-f0-9]{64}$"}},additionalProperties:!1}]},$V=V.union([D8,D8.omit({source_path:!0}).extend({source:E$}).strict()]),JV={...w8,required:["device_id","root_id","destination_path"],properties:{...w8.properties,source:S$},oneOf:[{required:["source_path"],not:{required:["source"]}},{required:["source"],not:{required:["source_path"]}}]};var s2=65536;function l($){throw new H($,$)}function d1($){return typeof $==="object"&&$!==null&&"code"in $&&typeof $.code==="string"?$.code:void 0}function u1($,J,Z){if(J.throwIfAborted(),$ instanceof H||$ instanceof Error&&$.name==="AbortError")throw $;return l(Z)}function d$($,J,Z){let Q;switch(d1($)){case"ENOENT":Q=Z==="export"?"transfer_source_missing":"transfer_path_unavailable";break;case"EACCES":case"EPERM":case"EROFS":Q="transfer_permission_denied";break;case"ELOOP":case"ENOTDIR":Q="transfer_path_unsafe";break;case"EEXIST":Q="transfer_destination_exists";break;default:Q="transfer_path_unavailable"}return u1($,J,Q)}function l$($){if(typeof $!=="string"||$.length>16384)return l("transfer_url_invalid");let J;try{J=new URL($)}catch{return l("transfer_url_invalid")}if(J.protocol!=="https:"||J.username||J.password||J.hash)return l("transfer_url_invalid");return J.href}var d2=J0.O_RDONLY|J0.O_DIRECTORY|J0.O_NOFOLLOW;async function s$(){if(p2()==="win32"){let F=new Map,X,W=-1,z=()=>Object.assign(Error("transfer_path_unsafe"),{code:"ELOOP"}),N=(D)=>{let j=v$(X,D);return j===""||j!==".."&&!j.startsWith(`..${u$}`)&&!h$(j)},C=(D)=>{let j=v2(D);if(j.isSymbolicLink())throw z();if(!j.isDirectory())throw Object.assign(Error("transfer_path_unsafe"),{code:"ENOTDIR"});let O=u2(D);if(X??=O,!N(O))throw z();return F.set(W,{path:D,real:O}),W--},M=(D)=>{let j=F.get(D);if(u2(j.path)!==j.real)throw z();return j.path},w=(D,j)=>{if(l1(j))throw Object.assign(Error("transfer_path_invalid"),{code:"ENOTDIR"});return m$(F.get(D).path,j)};return{root:C,openDirectory:(D,j)=>C(w(D,j)),open:(D,j,O,A=384)=>{let b=w(D,j);if(v2(b,{throwIfNoEntry:!1})?.isSymbolicLink())throw z();M(D);let I=v1(b,O,A);try{let R=L0(I),P=v2(b);if(P.isSymbolicLink()||R.ino!==P.ino||R.dev!==P.dev||!N(u2(b)))throw z()}catch(R){throw p1(I),R}return I},mkdir:(D,j)=>{let O=w(D,j);M(D),T8(O)},link:(D,j,O)=>{let A=w(D,j),b=w(D,O);M(D),P8(A,b)},unlink:(D,j)=>R8(w(D,j)),closeDirectory:(D)=>{F.delete(D)},inherit:()=>{},close:()=>{}}}let $={root:(F)=>v1(F,d2),closeDirectory:p1,inherit:c$};if(p2()==="linux")return{...$,openDirectory:(F,X)=>v1(`/proc/self/fd/${F}/${X}`,d2),open:(F,X,W,z=384)=>v1(`/proc/self/fd/${F}/${X}`,W,z),mkdir:(F,X)=>T8(`/proc/self/fd/${F}/${X}`,{mode:448}),link:(F,X,W)=>P8(`/proc/self/fd/${F}/${X}`,`/proc/self/fd/${F}/${W}`),unlink:(F,X)=>R8(`/proc/self/fd/${F}/${X}`),close:()=>{}};if(p2()!=="darwin")return l("transfer_platform_unsupported");let{dlopen:J,FFIType:Z,ptr:Q,read:K}=await import("bun:ffi"),B=J("/usr/lib/libSystem.B.dylib",{__error:{args:[],returns:Z.ptr},openat:{args:[Z.i32,Z.ptr,Z.i32,Z.i32,Z.i32,Z.i32,Z.i32,Z.i32,Z.i32],returns:Z.i32},mkdirat:{args:[Z.i32,Z.ptr,Z.i32],returns:Z.i32},linkat:{args:[Z.i32,Z.ptr,Z.i32,Z.ptr,Z.i32],returns:Z.i32},unlinkat:{args:[Z.i32,Z.ptr,Z.i32],returns:Z.i32}}),G=B.symbols.__error();if(G===null)return B.close(),l("transfer_path_unavailable");let U=(F)=>{if(F<0){let X=p$(-K.i32(G));throw Object.assign(Error("transfer_path_unavailable"),{code:X})}return F},Y=(F,X,W,z=384)=>U(B.symbols.openat(F,Q(Buffer.from(`${X}\x00`)),W,z,0,0,0,0,z));return{...$,openDirectory:(F,X)=>Y(F,X,d2),open:Y,mkdir:(F,X)=>{U(B.symbols.mkdirat(F,Q(Buffer.from(`${X}\x00`)),448))},link:(F,X,W)=>{U(B.symbols.linkat(F,Q(Buffer.from(`${X}\x00`)),F,Q(Buffer.from(`${W}\x00`)),0))},unlink:(F,X)=>{U(B.symbols.unlinkat(F,Q(Buffer.from(`${X}\x00`)),0))},close:()=>B.close()}}function c$($,J){let Z=L0($),Q=L0(J);if(Q.uid!==Z.uid||Q.gid!==Z.gid)b$(J,Z.uid,Z.gid)}function n$($,J,Z,Q){if(!O8(Z))return l("transfer_path_invalid");let K=Z.split("/"),B=$.root(J);try{for(let G of K.slice(0,-1)){let U;try{U=$.openDirectory(B,G)}catch(Y){if(!Q||d1(Y)!=="ENOENT")throw Y;try{$.mkdir(B,G)}catch(F){if(d1(F)!=="EEXIST")throw F}U=$.openDirectory(B,G),$.inherit(B,U)}$.closeDirectory(B),B=U}return{fd:B,leaf:K.at(-1)}}catch(G){throw $.closeDirectory(B),G}}function q8($,J){let Z=L0($,{bigint:!0});if(!Z.isFile()||Z.size>z0)return l("transfer_file_invalid");let Q=l2("sha256"),K=Buffer.alloc(s2),B=0;while(!0){J.throwIfAborted();let U=E8($,K,0,K.length,B);if(!U)break;if(B+=U,B>z0)return l("transfer_size_exceeded");Q.update(K.subarray(0,U))}let G=L0($,{bigint:!0});if(BigInt(B)!==Z.size||G.size!==Z.size||G.mtimeNs!==Z.mtimeNs||G.ctimeNs!==Z.ctimeNs)return l("transfer_source_changed");return{size_bytes:B,sha256:Q.digest("hex")}}async function E0($){$.signal.throwIfAborted();try{let J=l$($.payload.url),Z=await s$(),Q,K,B;try{if(Q=n$(Z,$.root,$.path,$.direction==="import"),$.direction==="export"){K=Z.open(Q.fd,Q.leaf,J0.O_RDONLY|J0.O_NOFOLLOW|J0.O_NONBLOCK);let z=L0(K,{bigint:!0});if(!z.isFile()||z.size>z0)return l("transfer_file_invalid");let N=l2("sha256"),C=0,M=K,w,D=new ReadableStream({pull(b){try{$.signal.throwIfAborted();let I=Buffer.alloc(s2),R=E8(M,I,0,I.length,C);if(!R){b.close();return}if(C+=R,C>z.size)return l("transfer_source_changed");N.update(I.subarray(0,R)),b.enqueue(I.subarray(0,R))}catch(I){throw w=I,I}}});try{let b=await($.fetchImpl??fetch)(J,Object.assign({method:"PUT",body:D,redirect:"error",signal:$.signal,headers:{"content-type":"application/octet-stream","content-length":String(z.size)}},{duplex:"half"}));if(w!==void 0)throw w;if(!b.ok)return l("transfer_upload_failed");await b.body?.cancel()}catch(b){if(w!==void 0)throw w;return u1(b,$.signal,"transfer_upload_failed")}let j=L0(K,{bigint:!0});if(BigInt(C)!==z.size||j.size!==z.size||j.mtimeNs!==z.mtimeNs||j.ctimeNs!==z.ctimeNs)return l("transfer_source_changed");let O=N.digest("hex"),A=q8(K,$.signal);if(A.size_bytes!==C||A.sha256!==O)return l("transfer_source_changed");return{size_bytes:C,sha256:O,outcome:"copied"}}let G=$.payload.size_bytes,U=$.payload.sha256;if(typeof G!=="number"||!Number.isSafeInteger(G)||G<0||G>z0||typeof U!=="string"||!/^[a-f0-9]{64}$/.test(U))return l("transfer_receipt_invalid");let Y;try{Y=Z.open(Q.fd,Q.leaf,J0.O_RDONLY|J0.O_NOFOLLOW|J0.O_NONBLOCK)}catch(z){if(d1(z)!=="ENOENT")throw z}if(Y!==void 0){try{let z=q8(Y,$.signal);if(z.size_bytes===G&&z.sha256===U)return{...z,outcome:"already_present"}}finally{p1(Y)}return l("transfer_destination_exists")}B=`.reason-copy-${f$()}`,K=Z.open(Q.fd,B,J0.O_CREAT|J0.O_EXCL|J0.O_WRONLY|J0.O_NOFOLLOW,384),Z.inherit(Q.fd,K);let F;try{let z=await($.fetchImpl??fetch)(J,{redirect:"error",signal:$.signal});if(!z.ok||!z.body)return l("transfer_download_failed");F=z.body.getReader()}catch(z){return u1(z,$.signal,"transfer_download_failed")}let X=l2("sha256"),W=0;try{while(!0){$.signal.throwIfAborted();let z=await F.read().catch((N)=>u1(N,$.signal,"transfer_download_failed"));if(z.done)break;if(W+=z.value.length,W>G)return l("transfer_size_mismatch");X.update(z.value);for(let N=0;N<z.value.length;)$.signal.throwIfAborted(),N+=y$(K,z.value,N,Math.min(s2,z.value.length-N))}}finally{await F.cancel().catch(()=>{})}if(W!==G||X.digest("hex")!==U)return l("transfer_hash_mismatch");return x$(K),await $.beforeCommit?.(),$.signal.throwIfAborted(),Z.link(Q.fd,B,Q.leaf),{size_bytes:G,sha256:U,outcome:"copied"}}finally{try{if(K!==void 0)p1(K)}finally{try{if(Q){if(B)try{Z.unlink(Q.fd,B)}catch{}Z.closeDirectory(Q.fd)}}finally{Z.close()}}}}catch(J){return d$(J,$.signal,$.direction)}}import{spawn as a$}from"child_process";import{mkdtempSync as i$,rmSync as o$,writeFileSync as t$}from"fs";import{constants as e$,platform as $J,tmpdir as JJ}from"os";import{join as b8}from"path";import{gunzipSync as r$,gzipSync as zV}from"zlib";var S8=900000,HV=S8+60000,K1=49152,k8=($)=>V.string().min(1).max($).regex(/^[A-Za-z0-9+/]+=*$/),f8=V.object({version:V.literal(1),script_gzip:k8(163840),stdin_gzip:k8(65536),cwd:V.string().min(1).max(4096).startsWith("/"),env:V.record(V.string().regex(/^[A-Z_][A-Z0-9_]{0,63}$/),V.string().max(4096)).refine(($)=>Object.keys($).length<=16,"too many variables"),timeout_ms:V.number().int().min(1000).max(S8)}).strict(),c2=V.string().max(K1+256),CV=V.object({exit_code:V.number().int().min(0).max(255),stdout:c2,stderr:c2,combined:c2.optional()}).strict();function n2($){return r$(Buffer.from($,"base64")).toString("utf8")}var ZJ="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",QJ=["RUSTUP_HOME","TZ","LC_ALL"],KJ=2000,BJ=100;function a2(){return $J()==="linux"&&process.geteuid?.()===0}function r2($){let J=Math.floor($/2),Z=[],Q=0,K=Buffer.alloc(0),B=0;return{push(G){B+=G.length;let U=G;if(Q<J){let Y=U.subarray(0,J-Q);Z.push(Y),Q+=Y.length,U=U.subarray(Y.length)}if(U.length)K=Buffer.concat([K,U]).subarray(-J)},text(){let G=B-Q-K.length;return Buffer.concat(Z).toString("utf8")+(G>0?`
 [reason: ${G} bytes of output omitted]
-`:"")+K.toString("utf8")}}}async function x8($,J){if(!a2())throw new H("workspace_setup_requires_root","Workspace setup runs only on a root Linux worker.");let Z=f8.safeParse($);if(!Z.success)throw new H("invalid_request","Reason sent an invalid workspace setup.");let Q=Z.data,K,B;try{K=n2(Q.script_gzip),B=n2(Q.stdin_gzip)}catch{throw new H("invalid_request","Reason sent an unreadable workspace setup.")}J.throwIfAborted();let G=i$(b8(JJ(),"reason-workspace-setup-"));try{let U=b8(G,"setup.sh");t$(U,K,{mode:384});let Y={PATH:ZJ,LANG:"C.UTF-8",HOME:"/root",USER:"root",LOGNAME:"root",SHELL:"/bin/bash",TMPDIR:"/tmp"};for(let A of QJ)if(process.env[A])Y[A]=process.env[A];Object.assign(Y,Q.env);let F=a$("/bin/bash",[U],{cwd:Q.cwd,env:Y,detached:!0,stdio:["pipe","pipe","pipe"]}),X=r2(K1),W=r2(K1),z=r2(K1);F.stdout.on("data",(A)=>{X.push(A),z.push(A)}),F.stderr.on("data",(A)=>{W.push(A),z.push(A)}),F.stdin.on("error",()=>{}),F.stdin.end(B);let N=(A)=>{try{if(F.pid)process.kill(-F.pid,A)}catch{}},C=!1,M,w=()=>{N("SIGTERM"),M??=setTimeout(()=>N("SIGKILL"),KJ)},D=setTimeout(()=>{C=!0,w()},Q.timeout_ms);J.addEventListener("abort",w,{once:!0});let j=await new Promise((A,b)=>{F.once("error",()=>b(new H("workspace_setup_start_failed","The workspace setup did not start."))),F.once("exit",(I,R)=>A({code:I,signal:R}))}).finally(()=>{clearTimeout(D),clearTimeout(M),J.removeEventListener("abort",w)});await new Promise((A)=>{let b=setTimeout(A,BJ);F.once("close",()=>{clearTimeout(b),A()})}),F.stdout.destroy(),F.stderr.destroy(),J.throwIfAborted();let O=C?124:j.signal?128+(e$.signals[j.signal]??0):j.code??1;return{exit_code:Math.min(255,O),stdout:X.text(),stderr:W.text(),...O!==0?{combined:z.text()}:{}}}finally{o$(G,{recursive:!0,force:!0})}}import{chmodSync as VJ,mkdtempSync as GJ,realpathSync as v8,rmSync as XJ}from"fs";import{tmpdir as UJ}from"os";import{dirname as FJ,join as i2,sep as YJ}from"path";function o2($){return m8($,h8($)!==null).repoPath}function u8($,J){let Z;try{if(typeof J!=="string")throw Error("invalid");Z=[B1,void 0].map((K)=>FJ(y8({kind:"managed",workspaceId:J,...K?{layout:K}:{}})))}catch{throw new H("cloud_copy_workspace_invalid","The Cloud copy workspace is invalid.")}let Q;for(let K of Z)try{Q=v8(i2($,K));break}catch{}if(Q===void 0)throw new H("cloud_copy_workspace_unavailable","The Session workspace is not on this computer.");if(!Q.startsWith(`${$}${YJ}`))throw new H("cloud_copy_workspace_invalid","The Cloud copy workspace is outside this worker's root.");return Q}async function p8($){$.signal.throwIfAborted();let J=$.source;if(J.kind==="workspace"){let Q=o2($.runtimeRoot);if(k0(Q)||k0(i2(Q,J.path)))throw new H("protected_path","Credential and secret paths are unavailable to local tasks.");return E0({direction:"export",root:Q,path:J.path,payload:{url:$.url},signal:$.signal,fetchImpl:$.fetchImpl})}let Z=GJ(i2(UJ(),`reason-cloud-copy-${process.pid}-`));try{VJ(Z,448);let Q=v8(Z);await E0({direction:"import",root:Q,path:"source",payload:{url:J.download_url,size_bytes:J.size_bytes,sha256:J.sha256},signal:$.signal,fetchImpl:$.fetchImpl});let K=await E0({direction:"export",root:Q,path:"source",payload:{url:$.url},signal:$.signal,fetchImpl:$.fetchImpl});if(K.size_bytes!==J.size_bytes||K.sha256!==J.sha256)throw new H("transfer_source_changed","The verified attachment changed before export.");return K}finally{XJ(Z,{recursive:!0,force:!0})}}import{constants as K0}from"fs";import{closeSync as U9,existsSync as F0,fstatSync as F9,ftruncateSync as cQ,lstatSync as p3,mkdirSync as nQ,mkdtempSync as rQ,openSync as Y9,readSync as aQ,realpathSync as X0,rmSync as iQ,statSync as w1,writeSync as oQ}from"fs";import{homedir as H1,platform as E,tmpdir as tQ}from"os";import{dirname as C1,isAbsolute as eQ,join as W9,relative as d3,resolve as $K,sep as JK}from"path";import{spawn as ZK}from"child_process";import{createHash as CJ,randomBytes as DJ}from"crypto";var t2=30000,WJ=1800000,zJ=5000,s1=30000,NJ=n1+15000,d8=/^\/app\/local-runtime\/operations\/[0-9a-fA-F-]{36}\/heartbeat$/,HJ=[/^\/app\/local-runtime\/operations\/claim$/,d8];class e2{options;current=null;connecting=null;retryAt=0;failures=0;nextId=0;closed=!1;reconnectTimer=null;constructor($){this.options=$}now(){return(this.options.now??Date.now)()}jitter($){return Math.floor((this.options.random??Math.random)()*$)}async request($,J,Z){Z?.throwIfAborted();let Q=this.current;if(!Q)return this.connect(),null;if(Q.pending.size>=Q.maxInFlight)return null;let K=String(++this.nextId),B=new Promise((Y)=>Q.pending.set(K,{path:$,resolve:Y}));if(!this.send(Q,{t:"req",id:K,path:$,body:J}))return Q.pending.delete(K),null;let G;if(HJ.some((Y)=>Y.test($)))G=setTimeout(()=>{if(Q.pending.has(K))this.drop(Q)},NJ);else{let Y=()=>{if(!Q.pending.has(K))return;let F=this.now()-Q.lastFrameAt;if(F>=s1)this.drop(Q);else G=setTimeout(Y,s1-F)};G=setTimeout(Y,s1)}if(B.finally(()=>clearTimeout(G)),!Z)return await B;let U=new Promise((Y,F)=>{let X=()=>{if(Q.pending.delete(K),clearTimeout(G),this.send(Q,{t:"abort",id:K}),this.now()-Q.lastFrameAt>s1)this.drop(Q);F(Z.reason)};if(Z.aborted)X();else Z.addEventListener("abort",X,{once:!0}),B.finally(()=>Z.removeEventListener("abort",X))});return await Promise.race([B,U])}cadence(){return this.current?.cadence??null}close(){if(this.closed=!0,this.reconnectTimer)clearTimeout(this.reconnectTimer);for(let $ of[this.current,this.connecting])if($)this.drop($)}send($,J){try{return $.socket.send(JSON.stringify(J)),!0}catch{return this.drop($),!1}}drop($){if($.dropped)return;$.dropped=!0,this.settle($);try{$.socket.close()}catch{}}settle($){for(let J of $.pending.values())J.resolve(null);if($.pending.clear(),this.current===$)this.current=null,this.retryAt=Math.max(this.retryAt,this.now()+this.jitter(zJ));if(this.connecting===$){this.connecting=null,this.failures+=1;let J=Math.min(WJ,t2*2**Math.min(this.failures-1,10));this.retryAt=Math.max(this.retryAt,this.now()+J/2+this.jitter(J/2))}}connect(){if(this.closed||this.connecting||this.now()<this.retryAt)return;let $=this.options.WebSocket??globalThis.WebSocket;if(!$){this.retryAt=Number.POSITIVE_INFINITY;return}let J=new URL(c1,this.options.apiOrigin);J.protocol=J.protocol==="https:"?"wss:":"ws:",J.searchParams.set("device_id",this.options.deviceId);let Z;try{Z=new $(J.toString())}catch{this.failures+=1,this.retryAt=this.now()+t2;return}let Q={socket:Z,pending:new Map,maxInFlight:0,cadence:null,lastFrameAt:this.now(),dropped:!1};this.connecting=Q,Z.onmessage=(K)=>this.receive(Q,K.data),Z.onclose=()=>this.settle(Q),Z.onerror=()=>this.settle(Q)}receive($,J){if(typeof J!=="string")return;let Z;try{Z=JSON.parse(J)}catch{return}if($.lastFrameAt=this.now(),Z.t==="res"){let Q=$.pending.get(Z.id);$.pending.delete(Z.id),Q?.resolve({status:Z.status,body:Z.body,retryAfter:Z.retry_after??null});return}if(Z.t==="challenge"&&this.connecting===$){let Q;try{Q=this.options.signHello(Z.challenge)}catch{this.drop($);return}this.send($,{t:"hello",...Q});return}if(Z.t==="ready"&&this.connecting===$){this.connecting=null,this.failures=0,$.maxInFlight=Math.max(1,Math.min(Z.max_in_flight,1000)),$.cadence=Z.cadence??null;let Q=this.current;if(this.current=$,Q){for(let[K,B]of Q.pending){if(!d8.test(B.path))continue;Q.pending.delete(K),this.send(Q,{t:"abort",id:K}),B.resolve(null)}if(Q.pending.size===0)this.drop(Q)}return}if(Z.t==="fallback"){this.retryAt=this.now()+Math.max(t2,Math.min(Z.retry_after_ms,86400000)),this.drop($);return}if(Z.t==="reconnect"&&this.current===$&&!this.reconnectTimer)this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.retryAt=0,this.connect()},Math.max(0,Math.min(Z.after_ms,60000)))}}var J3=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.run.v1","process.full.v1","preview.serve.v1","pty.start","git.run","process.list","ports.list","computer.use","browser.use","browser.recording.v1","browser.pr-proof.v1","hands.connect","jobs.control","environment.install","github.local.v1","inference.custom.v1","display.stream.v1","automation.call.v1","simulator.call.v1","simulator.stream.v1","tunnel.open","tunnel.close","workspace.setup.v1"];function pV($,J={}){let Z=wJ($),Q=J.rootPathsSupported===!0?I1($.root_paths):void 0;return{supported_operations:[...$.supported_operations],...J.accountRootMetadataSupported===!0&&typeof $.account_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test($.account_root_fingerprint)?{account_root_fingerprint:$.account_root_fingerprint}:{},...J.workspaceRootMetadataSupported===!0&&typeof $.workspace_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test($.workspace_root_fingerprint)?{workspace_root_fingerprint:$.workspace_root_fingerprint}:{},...J.accountRootPathSupported===!0&&typeof $.account_root_path==="string"&&$.account_root_path.startsWith("/")&&$.account_root_path.length<=4096?{account_root_path:$.account_root_path}:{},...J.homeContainedRootsSupported===!0&&Array.isArray($.home_contained_root_fingerprints)&&$.home_contained_root_fingerprints.length<=32&&$.home_contained_root_fingerprints.every((K)=>/^[a-f0-9]{64}$/.test(K))?{home_contained_root_fingerprints:[...$.home_contained_root_fingerprints]}:{},...Q?{root_paths:Q}:{},...Object.keys(Z).length?{operation_constraints:Z}:{},...$.hands_worker_artifact_sha256&&$.hands_worker_entrypoint?{hands_worker_artifact_sha256:$.hands_worker_artifact_sha256,hands_worker_entrypoint:$.hands_worker_entrypoint}:{},...$.hands_slots!==void 0?{hands_slots:$.hands_slots}:{}}}function wJ($){let J=(Q)=>Q===null||typeof Q==="boolean"||typeof Q==="number"&&Number.isFinite(Q)||typeof Q==="string"&&Q.length<=512,Z={};for(let Q of $.supported_operations){let K=$.operation_constraints?.[Q];if(!K||typeof K!=="object"||Array.isArray(K))continue;if(!("ready"in K)||typeof K.ready!=="boolean")continue;let B={};for(let[G,U]of Object.entries(K).slice(0,32)){if(!G.length||G.length>64||["__proto__","constructor","prototype"].includes(G))continue;if(J(U)||Array.isArray(U)&&U.length<=64&&U.every(J))B[G]=U}if(Object.keys(B).length)Z[Q]=B}return Z}class N0 extends Error{status;code;retryAfter;constructor($,J,Z,Q=null){super(Z);this.status=$;this.code=J;this.retryAfter=Q;this.name="LocalRuntimeHttpError"}}class r1 extends Error{timeoutMs;constructor($){super(`Reason Device request did not answer within ${$}ms.`);this.timeoutMs=$;this.name="LocalRuntimeRequestTimeoutError"}}function MJ($){return $===408||$===429||$===500||$===502||$===503||$===504}function jJ($){if($ instanceof N0)return!1;if($ instanceof r1)return!0;if(!($ instanceof Error))return!1;if($.name==="AbortError")return!1;if($ instanceof TypeError&&$.message.toLowerCase().includes("fetch failed"))return!0;for(let J of[$,$.cause])if(J&&typeof J==="object"&&"code"in J){let Z=String(J.code);if(["ECONNRESET","ECONNREFUSED","ETIMEDOUT","EHOSTUNREACH","ENOTFOUND","EAI_AGAIN","ConnectionClosed","ConnectionRefused","UND_ERR_SOCKET","UND_ERR_CONNECT_TIMEOUT"].includes(Z))return!0}return!1}function LJ($,J,Z=500){if(J instanceof N0&&J.retryAfter){let B=parseFloat(J.retryAfter);if(Number.isFinite(B)&&B>0)return Math.min(B*1000,1e4)}let Q=Z*2**$,K=Math.floor(Math.random()*200);return Math.min(Q+K,5000)}async function OJ($,J){if(J?.aborted)throw J.reason??new DOMException("The operation was aborted.","AbortError");await new Promise((Z,Q)=>{let K=()=>{clearTimeout(B),Q(J?.reason??new DOMException("The operation was aborted.","AbortError"))},B=setTimeout(()=>{J?.removeEventListener("abort",K),Z()},$);J?.addEventListener("abort",K,{once:!0})})}function dV($){return $ instanceof N0&&$.status===401&&($.code==="device_revoked"||$.code==="invalid_device_credential")}function l8($){return Buffer.byteLength(JSON.stringify($)??"null","utf8")}function s8($){return CJ("sha256").update($??"").digest("hex")}function IJ($){return i8({method:$.method,pathAndQuery:$.route,timestamp:$.timestamp,nonce:$.nonce,challenge:$.challenge,bodySha256:$.bodySha256})}function c8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}var AJ=20000,_J=1e4,n8=[2000,4000],PJ=30000,TJ=15000;function r8($){return $?{keepalive:!1}:{}}class $3 extends Error{constructor($){super(`Reason Device proof challenge did not answer within ${$}ms.`)}}class RJ{fetchImpl;proofStore;proofOptions;apiOrigin;spareChallenge=null;sessions=new Map;sessionsClosed=!1;constructor($,J=fetch,Z,Q={}){this.fetchImpl=J;this.proofStore=Z;this.proofOptions=Q;let K=new URL($);if(K.protocol!=="https:"&&K.hostname!=="127.0.0.1"&&K.hostname!=="localhost"&&K.hostname!=="[::1]"&&K.hostname!=="::1")throw Error("Reason Device API must use HTTPS, except for localhost development.");this.apiOrigin=K.origin}async parseResponse($){if($.status===204)return null;let J=await $.json().catch(()=>({}));if(!$.ok){let{code:Z,message:Q}=o8(J,$.status),K=$.headers?.get?.("retry-after")??null;throw new N0($.status,Z,Q,K)}return J}async challenge($,J,Z={fresh:!1}){let Q=this.proofOptions.challengeAttemptTimeoutsMs??n8;for(let K of Q)try{return await this.challengeAttempt($,J,K,Z.fresh)}catch(B){if(J?.aborted||!(B instanceof $3))throw B;Z.fresh=!0}return await this.challengeAttempt($,J,null,Z.fresh)}async challengeAttempt($,J,Z,Q=!1){let K=JSON.stringify({device_id:$}),B=Z===null?null:new AbortController,G=B&&Z!==null?setTimeout(()=>B.abort(new $3(Z)),Z):null;try{let U=await this.fetchImpl(`${this.apiOrigin}${s.authChallenge.path}`,{method:"POST",redirect:"error",headers:{accept:"application/json","content-type":"application/json"},body:K,...r8(Q),signal:B?J?AbortSignal.any([J,B.signal]):B.signal:J});return t8(await this.parseResponse(U))}catch(U){if(!J?.aborted&&B?.signal.aborted)throw B.signal.reason;throw U}finally{if(G)clearTimeout(G)}}async takeSpareChallenge($){let J=this.spareChallenge;if(this.spareChallenge=null,!J||J.deviceId!==$)return null;let Z=await J.challenge,Q=(this.proofOptions.now??Date.now)();return Z&&Date.parse(Z.expires_at)-Q>=AJ?Z:null}refillSpareChallenge($){let J=this.challengeAttempt($,void 0,n8[0]??2000).catch(()=>null);this.spareChallenge={deviceId:$,challenge:J}}async proofHeaders($,J,Z,Q,K=!1,B,G){let U=B&&Date.parse(B.expires_at)-(this.proofOptions.now??Date.now)()>=_J?B:null,Y=!U&&K?await this.takeSpareChallenge(Z.deviceId):null,F=U??Y??await this.challenge(Z.deviceId,Q,G);if(K)this.refillSpareChallenge(Z.deviceId);let X=s8(J),W=this.signProof("POST",$,F.challenge,X);return{"x-device-id":Z.deviceId,"x-device-timestamp":W.timestamp,"x-device-nonce":W.nonce,"x-device-challenge":F.challenge,"x-device-body-sha256":X,"x-device-signature":W.signature}}signProof($,J,Z,Q){let K=String(Math.trunc((this.proofOptions.now??Date.now)())),B=(this.proofOptions.nonce??(()=>DJ(24)))();if(B.byteLength<16||B.byteLength>32)throw Error("Invalid Reason Device proof nonce.");let G=Buffer.from(B).toString("base64url"),U=this.proofStore.sign(IJ({method:$,route:J,timestamp:K,nonce:G,challenge:Z,bodySha256:Q}));if(!/^[A-Za-z0-9_-]{8,128}$/.test(U))throw Error("Reason Device proof boundary returned an invalid signature.");return{timestamp:K,nonce:G,signature:U}}sessionFor($,J){if(!this.proofOptions.deviceSession||this.sessionsClosed||!J||!a8($.path))return null;let Z=this.sessions.get(J.deviceId);if(!Z)Z=new e2({apiOrigin:this.apiOrigin,deviceId:J.deviceId,signHello:(Q)=>this.signProof("GET",c1,Q,s8("")),...this.proofOptions.webSocket?{WebSocket:this.proofOptions.webSocket}:{},...this.proofOptions.now?{now:this.proofOptions.now}:{}}),this.sessions.set(J.deviceId,Z);return Z}sessionCadence($){let J=this.proofOptions.deviceSession&&!this.sessionsClosed?this.sessions.get($.deviceId)?.cadence()??null:null;return J?{presenceIntervalMs:J.presence_interval_ms,claimWaitMs:J.claim_wait_ms}:null}close(){this.sessionsClosed=!0;for(let $ of this.sessions.values())$.close();this.sessions.clear()}async request($,J){if(J.body!==void 0&&l8(J.body)>C0)throw Error("Reason Device request exceeds the 256 KB protocol limit.");if(J.authorization!==void 0&&J.device!==void 0)throw Error("Reason Device request cannot combine bearer and proof authentication.");let Z=J.authorization!==void 0,Q=J.device!==void 0;if(!($.auth==="none"?!Z&&!Q:$.auth==="registration_bearer"?Z&&!Q:Z!==Q))throw Error(`Reason Device request used invalid authentication for ${$.path}.`);let B=J.body===void 0?void 0:JSON.stringify(J.body),G=this.proofOptions.maxAttempts??4,U=this.proofOptions.sleep??OJ,Y=this.sessionFor($,J.device),F=Math.max(PJ,(J.holdMs??0)+TJ),X={fresh:!1},W;for(let z=0;z<G;z+=1)try{let N=await Y?.request($.path,J.sessionBody===void 0?B??"":JSON.stringify(J.sessionBody),J.signal)??null;if(N)return await this.parseResponse(new Response(N.status===204?null:N.body,{status:N.status,headers:N.retryAfter===null?{}:{"retry-after":N.retryAfter}}));let C=new AbortController,M=setTimeout(()=>C.abort(new r1(F)),F),w=J.signal?AbortSignal.any([J.signal,C.signal]):C.signal;try{let D=J.device===void 0?{}:await this.proofHeaders($.path,B,J.device,w,J.useSpareChallenge===!0&&z===0,z===0?J.issuedChallenge:void 0,X),j=await this.fetchImpl(`${this.apiOrigin}${$.path}`,{method:"POST",redirect:"error",headers:{...J.authorization===void 0?{}:{authorization:`Bearer ${J.authorization}`},...D,accept:"application/json",...J.body===void 0?{}:{"content-type":"application/json"}},body:B,...r8(X.fresh),signal:w});return await this.parseResponse(j)}catch(D){if(!J.signal?.aborted&&C.signal.aborted)throw C.signal.reason;throw D}finally{clearTimeout(M)}}catch(N){if(W=N,N instanceof r1)X.fresh=!0;if(J.signal?.aborted)throw N;let C=J.device!==void 0&&N instanceof N0&&N.status===401&&["invalid_device_proof","device_proof_replayed"].includes(N.code),M=N instanceof N0&&MJ(N.status),w=jJ(N),D=J.transientRetryOwner!=="caller"&&(M||w);if((C||D)&&z+1<G){let j=C?0:LJ(z,N,this.proofOptions.retryBaseDelayMs??500);if(j>0)await U(j,J.signal);continue}if(C&&z+1>=G)throw Error("Reason Device proof retry was exhausted.");throw N}throw W??Error("Reason Device request failed.")}async register($,J,Z){let Q=await this.request(s.register,{authorization:$,body:J,signal:Z});return e8(Q)}async enroll($,J,Z,Q){let K=await this.request(s.enroll,{body:{...Z,enrollment_ticket:$,code_verifier:J},signal:Q});return $5(K)}async heartbeat($,J,Z,Q){let K=await this.request(s.heartbeat,{device:$,body:J,signal:Z,...Q?{issuedChallenge:Q}:{}});return J5(K)}async syncRoots($,J,Z){let Q=await this.request(s.rootsSync,{device:$,body:{roots:J},signal:Z});return Z5(Q)}async identity($,J){let Z=await this.request(s.identity,{device:$,signal:J});return Q5(Z)}async disconnect($,J,Z,Q=[]){let K=await this.request(s.disconnect,{device:$,body:Z?{successor_device_id:Z,...Q.length?{successor_roots:Q}:{}}:{},signal:J});return K5(K)}async deviceLifecycle($,J,Z){let Q=await this.request(s.lifecycle,{device:$,body:J,signal:Z});V5(Q)}async localSubscription($,J,Z){return B5(await this.request(s.localSubscription,{device:$,body:J,signal:Z}))}async ownerWorkspaces($,J){let Q=(await this.request(s.ownerWorkspaces,{device:$,body:{},signal:J}))?.organizations;if(!Array.isArray(Q))throw Error("Reason returned an invalid workspace list.");return Q.flatMap((K)=>{let B=K;return typeof B?.id==="string"?[{id:B.id,...typeof B.name==="string"&&B.name.trim()?{name:B.name.trim()}:{},blocked:B.blocked===!0}]:[]})}async ownerWorkspaceEnrollment($,J,Z){return this.request(s.ownerWorkspaceEnrollment,{device:$,body:J,signal:Z})}async liveSessionWorktrees($,J,Z){let Q=await this.request(s.sessionWorktrees,{device:$,body:{worktree_ids:[...J]},signal:Z}).catch((K)=>{if(K instanceof N0&&K.status===404)return null;throw K});if(Q===null)return null;if(!c8(Q)||!Array.isArray(Q.live)||!Q.live.every((K)=>typeof K==="string"&&J.includes(K)))throw Error("Reason returned an invalid Session worktree answer.");return Q.live}async claimOperation($,J={}){let Z=Math.max(J.waitMs??25000,0),Q=(G)=>({wait_ms:Math.min(Z,G),...J.instanceGeneration===void 0?{}:{instance_generation:J.instanceGeneration}}),K=this.sessionCadence($)?.claimWaitMs,B=await this.request(s.operationClaim,{device:$,body:Q(30000),holdMs:Math.min(Z,30000),...K===void 0?{}:{sessionBody:Q(Math.min(K,n1))},signal:J.signal});if(B===null)return null;return G5(B,J3)}async operationHeartbeat($,J,Z={}){let Q=(G)=>this.request(s.operationHeartbeat.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,...Z.controlAckSeq===void 0?{}:{control_ack_seq:Z.controlAckSeq},...G?{client_retry_count:Z.clientRetryCount}:{},...G&&Z.waitMs!==void 0?{wait_ms:Math.min(Math.max(Z.waitMs,0),30000)}:{}},signal:Z.signal,transientRetryOwner:Z.transientRetryOwner,...G&&Z.waitMs!==void 0?{holdMs:Math.min(Math.max(Z.waitMs,0),30000)}:{}}),K=(Z.clientRetryCount??0)>0||Z.waitMs!==void 0,B;try{B=await Q(K)}catch(G){if(!K||!(G instanceof N0)||G.status!==400||G.code!=="invalid_operation_heartbeat")throw G;B=await Q(!1)}return X5(B)}async operationEvents($,J,Z){if(!Number.isInteger(Z.eventSeqStart)||Z.eventSeqStart<0||Z.events.length<1||Z.events.length>100||Z.events.some((K)=>!/^[A-Za-z0-9._:-]{1,64}$/.test(K.kind)||!c8(K.payload)))throw Error("Invalid Reason Device operation event batch.");let Q=await this.request(s.operationEvents.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,event_seq_start:Z.eventSeqStart,events:Z.events},signal:Z.signal,transientRetryOwner:Z.transientRetryOwner,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return U5(Q)}async completeOperation($,J,Z,Q){let K={attempt_id:J.attempt_id,attempt_token:J.attempt_token,status:Z.status,...Z.result===void 0?{}:{result:Z.result},...Z.error_code?{error_code:Z.error_code}:{}};if(l8(K)>C0)throw Error("Reason Device operation result exceeds the 256 KB protocol limit.");let B=await this.request(s.operationComplete.forOperation(J.operation_id),{device:$,body:K,signal:Q});return Y5(B)}async operationCustomEndpointCredential($,J,Z){let{CustomEndpointDeviceCredentialSchema:Q}=await import("./custom-endpoint-device-z400ftnh.js");return Q.parse(await this.request(s.operationCustomEndpointCredential.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token},signal:Z}))}async operationEnvironment($,J,Z,Q){let K=await this.request(s.operationEnvironment.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,snapshot_id:Z},signal:Q,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return F5(K)}async acknowledgeOperationEnvironment($,J,Z,Q){await this.request(s.operationEnvironmentAck.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,...Z},signal:Q,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}})}}var qJ=new Set(["process.run.v1","process.full.v1","computer.use","browser.use"]),V1=new Set(["jobs.control","environment.install","tunnel.open","tunnel.close","display.stream.v1","automation.call.v1","workspace.setup.v1","simulator.call.v1","simulator.stream.v1"]);function a1($,J){if(qJ.has($))return!1;if(V1.has($)&&!J.runtimeDirectory)return!1;if(($==="inference.custom.v1"||$==="preview.serve.v1"||$==="simulator.call.v1"||$==="simulator.stream.v1")&&(J.executionMode!=="unsandboxed"||!J.runtimeDirectory))return!1;if(J.executionMode!=="unsandboxed"&&(["exec.full","hands.connect","pty.start","browser.pr-proof.v1"].includes($)||V1.has($)))return!1;return!0}import{accessSync as gJ,constants as EJ,existsSync as kJ,statSync as SJ}from"fs";import{basename as fJ,isAbsolute as bJ}from"path";var G1=["-lic"],W5="/bin/zsh",xJ=new Set(["zsh","bash"]),N5=20000,Z3=60000,yJ=65536,hJ=64,mJ=8192,vJ=new Set(["NODE_OPTIONS","PATH","ZDOTDIR","BASH_ENV","ENV"]),uJ=["DYLD_","LD_"];function pJ($){let J=$.toUpperCase();return vJ.has(J)||uJ.some((Z)=>J.startsWith(Z))}function H5($=process.env){return!0}function dJ($){if(!bJ($)||$.includes("\x00"))return!1;if(!xJ.has(fJ($)))return!1;try{if(!SJ($).isFile())return!1;return gJ($,EJ.X_OK),!0}catch{return!1}}function S0($=process.env){if(process.platform==="win32")return z5()??W5;let J=$.SHELL?.trim();if(J&&dJ(J))return J;return W5}function Q3($=process.env){return H5($)&&kJ(S0($))}function K3($=process.env){if(!H5($))throw new H("full_control_disabled","Full-control execution is unavailable on this Reason Device.")}function B3($){if(typeof $!=="string"||$.length===0||$.includes("\x00")||Buffer.byteLength($,"utf8")>yJ)throw new H("invalid_payload","command is missing or too large.");return $}function V3($){if($===void 0||$===null)return{forwarded:{},ignored:[]};if(typeof $!=="object"||Array.isArray($))throw new H("invalid_payload","env must be an object of strings.");let J=Object.entries($);if(J.length>hJ)throw new H("invalid_payload","env has too many entries.");let Z={},Q=[];for(let[K,B]of J){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(K)||typeof B!=="string"||B.includes("\x00")||Buffer.byteLength(B,"utf8")>mJ)throw new H("invalid_payload","env entry is invalid or too large.");if(pJ(K)){Q.push(K);continue}Z[K]=B}return{forwarded:Z,ignored:Q}}async function C5($){let J=$.processEnv??process.env;if(K3(J),$.signal.aborted)throw new H("cancelled","Operation was cancelled.");let Z=B3($.command),Q=S0(J),{forwarded:K,ignored:B}=V3($.requestEnv),G=await $.spawn(Q,[...G1,Z],{cwd:$.cwd,timeoutMs:$.timeoutMs,signal:$.signal,env:{...J,...K}});return{exit_code:G.exitCode,signal:G.signal,stdout:G.stdout,stderr:G.stderr,timed_out:G.timedOut,truncated:G.truncated,shell:Q,shell_flags:[...G1],login:!0,interactive:!0,sandbox:"none",ignored_env:B}}function D5($=process.env){return{transport:"shell",shell:`${S0($)} ${G1.join(" ")}`,login_shell:!0,interactive_shell:!0,rc_files_loaded:!0,sandbox:"none",network:!0,environment:"inherited",privilege:"user",sudo:"argv_exact_nopasswd_only",activation:"explicit_device_grant",max_timeout_ms:Z3}}import{readFile as lJ,readdir as sJ,readlink as cJ,realpath as nJ}from"fs/promises";import{basename as rJ,relative as aJ,sep as iJ}from"path";var O0="/proc",oJ=250,w5=500,tJ=50,eJ=250,$Z=1024,M5=4096,JZ=1,ZZ=3,j5=9,QZ="0A",KZ=/^socket:\[(\d+)\]$/,G3={readDirectory:($)=>sJ($),readLink:($)=>cJ($),readTextFile:($)=>lJ($,"utf8"),realPath:($)=>nJ($)};function O5($,J){return J===$||J.startsWith(`${$}${iJ}`)}function BZ($,J){return aJ($,J)||"."}async function I5($){let J;try{J=await $.readDirectory(O0)}catch{return[]}return J.filter((Z)=>/^[0-9]+$/.test(Z)).map((Z)=>Number(Z)).filter((Z)=>Number.isSafeInteger(Z)&&Z>0).sort((Z,Q)=>Z-Q)}async function A5($,J){try{let Q=(await J.readTextFile(`${O0}/${$}/comm`)).slice(0,M5).split(`
+`:"")+K.toString("utf8")}}}async function x8($,J){if(!a2())throw new H("workspace_setup_requires_root","Workspace setup runs only on a root Linux worker.");let Z=f8.safeParse($);if(!Z.success)throw new H("invalid_request","Reason sent an invalid workspace setup.");let Q=Z.data,K,B;try{K=n2(Q.script_gzip),B=n2(Q.stdin_gzip)}catch{throw new H("invalid_request","Reason sent an unreadable workspace setup.")}J.throwIfAborted();let G=i$(b8(JJ(),"reason-workspace-setup-"));try{let U=b8(G,"setup.sh");t$(U,K,{mode:384});let Y={PATH:ZJ,LANG:"C.UTF-8",HOME:"/root",USER:"root",LOGNAME:"root",SHELL:"/bin/bash",TMPDIR:"/tmp"};for(let A of QJ)if(process.env[A])Y[A]=process.env[A];Object.assign(Y,Q.env);let F=a$("/bin/bash",[U],{cwd:Q.cwd,env:Y,detached:!0,stdio:["pipe","pipe","pipe"]}),X=r2(K1),W=r2(K1),z=r2(K1);F.stdout.on("data",(A)=>{X.push(A),z.push(A)}),F.stderr.on("data",(A)=>{W.push(A),z.push(A)}),F.stdin.on("error",()=>{}),F.stdin.end(B);let N=(A)=>{try{if(F.pid)process.kill(-F.pid,A)}catch{}},C=!1,M,w=()=>{N("SIGTERM"),M??=setTimeout(()=>N("SIGKILL"),KJ)},D=setTimeout(()=>{C=!0,w()},Q.timeout_ms);J.addEventListener("abort",w,{once:!0});let j=await new Promise((A,b)=>{F.once("error",()=>b(new H("workspace_setup_start_failed","The workspace setup did not start."))),F.once("exit",(I,R)=>A({code:I,signal:R}))}).finally(()=>{clearTimeout(D),clearTimeout(M),J.removeEventListener("abort",w)});await new Promise((A)=>{let b=setTimeout(A,BJ);F.once("close",()=>{clearTimeout(b),A()})}),F.stdout.destroy(),F.stderr.destroy(),J.throwIfAborted();let O=C?124:j.signal?128+(e$.signals[j.signal]??0):j.code??1;return{exit_code:Math.min(255,O),stdout:X.text(),stderr:W.text(),...O!==0?{combined:z.text()}:{}}}finally{o$(G,{recursive:!0,force:!0})}}import{chmodSync as VJ,mkdtempSync as GJ,realpathSync as v8,rmSync as XJ}from"fs";import{tmpdir as UJ}from"os";import{dirname as FJ,join as i2,sep as YJ}from"path";function o2($){return m8($,h8($)!==null).repoPath}function u8($,J){let Z;try{if(typeof J!=="string")throw Error("invalid");Z=[B1,void 0].map((K)=>FJ(y8({kind:"managed",workspaceId:J,...K?{layout:K}:{}})))}catch{throw new H("cloud_copy_workspace_invalid","The Cloud copy workspace is invalid.")}let Q;for(let K of Z)try{Q=v8(i2($,K));break}catch{}if(Q===void 0)throw new H("cloud_copy_workspace_unavailable","The Session workspace is not on this computer.");if(!Q.startsWith(`${$}${YJ}`))throw new H("cloud_copy_workspace_invalid","The Cloud copy workspace is outside this worker's root.");return Q}async function p8($){$.signal.throwIfAborted();let J=$.source;if(J.kind==="workspace"){let Q=o2($.runtimeRoot);if(k0(Q)||k0(i2(Q,J.path)))throw new H("protected_path","Credential and secret paths are unavailable to local tasks.");return E0({direction:"export",root:Q,path:J.path,payload:{url:$.url},signal:$.signal,fetchImpl:$.fetchImpl})}let Z=GJ(i2(UJ(),`reason-cloud-copy-${process.pid}-`));try{VJ(Z,448);let Q=v8(Z);await E0({direction:"import",root:Q,path:"source",payload:{url:J.download_url,size_bytes:J.size_bytes,sha256:J.sha256},signal:$.signal,fetchImpl:$.fetchImpl});let K=await E0({direction:"export",root:Q,path:"source",payload:{url:$.url},signal:$.signal,fetchImpl:$.fetchImpl});if(K.size_bytes!==J.size_bytes||K.sha256!==J.sha256)throw new H("transfer_source_changed","The verified attachment changed before export.");return K}finally{XJ(Z,{recursive:!0,force:!0})}}import{constants as K0}from"fs";import{closeSync as U9,existsSync as F0,fstatSync as F9,ftruncateSync as cQ,lstatSync as p3,mkdirSync as nQ,mkdtempSync as rQ,openSync as Y9,readSync as aQ,realpathSync as X0,rmSync as iQ,statSync as w1,writeSync as oQ}from"fs";import{homedir as H1,platform as E,tmpdir as tQ}from"os";import{dirname as C1,isAbsolute as eQ,join as W9,relative as d3,resolve as $K,sep as JK}from"path";import{spawn as ZK}from"child_process";import{createHash as CJ,randomBytes as DJ}from"crypto";var t2=30000,WJ=1800000,zJ=5000,s1=30000,NJ=n1+15000,d8=/^\/app\/local-runtime\/operations\/[0-9a-fA-F-]{36}\/heartbeat$/,HJ=[/^\/app\/local-runtime\/operations\/claim$/,d8];class e2{options;current=null;connecting=null;retryAt=0;failures=0;nextId=0;closed=!1;reconnectTimer=null;constructor($){this.options=$}now(){return(this.options.now??Date.now)()}jitter($){return Math.floor((this.options.random??Math.random)()*$)}async request($,J,Z){Z?.throwIfAborted();let Q=this.current;if(!Q)return this.connect(),null;if(Q.pending.size>=Q.maxInFlight)return null;let K=String(++this.nextId),B=new Promise((Y)=>Q.pending.set(K,{path:$,resolve:Y}));if(!this.send(Q,{t:"req",id:K,path:$,body:J}))return Q.pending.delete(K),null;let G;if(HJ.some((Y)=>Y.test($)))G=setTimeout(()=>{if(Q.pending.has(K))this.drop(Q)},NJ);else{let Y=()=>{if(!Q.pending.has(K))return;let F=this.now()-Q.lastFrameAt;if(F>=s1)this.drop(Q);else G=setTimeout(Y,s1-F)};G=setTimeout(Y,s1)}if(B.finally(()=>clearTimeout(G)),!Z)return await B;let U=new Promise((Y,F)=>{let X=()=>{if(Q.pending.delete(K),clearTimeout(G),this.send(Q,{t:"abort",id:K}),this.now()-Q.lastFrameAt>s1)this.drop(Q);F(Z.reason)};if(Z.aborted)X();else Z.addEventListener("abort",X,{once:!0}),B.finally(()=>Z.removeEventListener("abort",X))});return await Promise.race([B,U])}cadence(){return this.current?.cadence??null}close(){if(this.closed=!0,this.reconnectTimer)clearTimeout(this.reconnectTimer);for(let $ of[this.current,this.connecting])if($)this.drop($)}send($,J){try{return $.socket.send(JSON.stringify(J)),!0}catch{return this.drop($),!1}}drop($){if($.dropped)return;$.dropped=!0,this.settle($);try{$.socket.close()}catch{}}settle($){for(let J of $.pending.values())J.resolve(null);if($.pending.clear(),this.current===$)this.current=null,this.retryAt=Math.max(this.retryAt,this.now()+this.jitter(zJ));if(this.connecting===$){this.connecting=null,this.failures+=1;let J=Math.min(WJ,t2*2**Math.min(this.failures-1,10));this.retryAt=Math.max(this.retryAt,this.now()+J/2+this.jitter(J/2))}}connect(){if(this.closed||this.connecting||this.now()<this.retryAt)return;let $=this.options.WebSocket??globalThis.WebSocket;if(!$){this.retryAt=Number.POSITIVE_INFINITY;return}let J=new URL(c1,this.options.apiOrigin);J.protocol=J.protocol==="https:"?"wss:":"ws:",J.searchParams.set("device_id",this.options.deviceId);let Z;try{Z=new $(J.toString())}catch{this.failures+=1,this.retryAt=this.now()+t2;return}let Q={socket:Z,pending:new Map,maxInFlight:0,cadence:null,lastFrameAt:this.now(),dropped:!1};this.connecting=Q,Z.onmessage=(K)=>this.receive(Q,K.data),Z.onclose=()=>this.settle(Q),Z.onerror=()=>this.settle(Q)}receive($,J){if(typeof J!=="string")return;let Z;try{Z=JSON.parse(J)}catch{return}if($.lastFrameAt=this.now(),Z.t==="res"){let Q=$.pending.get(Z.id);$.pending.delete(Z.id),Q?.resolve({status:Z.status,body:Z.body,retryAfter:Z.retry_after??null});return}if(Z.t==="challenge"&&this.connecting===$){let Q;try{Q=this.options.signHello(Z.challenge)}catch{this.drop($);return}this.send($,{t:"hello",...Q});return}if(Z.t==="ready"&&this.connecting===$){this.connecting=null,this.failures=0,$.maxInFlight=Math.max(1,Math.min(Z.max_in_flight,1000)),$.cadence=Z.cadence??null;let Q=this.current;if(this.current=$,Q){for(let[K,B]of Q.pending){if(!d8.test(B.path))continue;Q.pending.delete(K),this.send(Q,{t:"abort",id:K}),B.resolve(null)}if(Q.pending.size===0)this.drop(Q)}return}if(Z.t==="fallback"){this.retryAt=this.now()+Math.max(t2,Math.min(Z.retry_after_ms,86400000)),this.drop($);return}if(Z.t==="reconnect"&&this.current===$&&!this.reconnectTimer)this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.retryAt=0,this.connect()},Math.max(0,Math.min(Z.after_ms,60000)))}}var J3=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.run.v1","process.full.v1","preview.serve.v1","pty.start","git.run","process.list","ports.list","computer.use","browser.use","browser.recording.v1","browser.pr-proof.v1","hands.connect","jobs.control","environment.install","github.local.v1","inference.custom.v1","display.stream.v1","automation.call.v1","simulator.call.v1","simulator.stream.v1","tunnel.open","tunnel.close","workspace.setup.v1"];function pV($,J={}){let Z=wJ($),Q=J.rootPathsSupported===!0?I1($.root_paths):void 0;return{supported_operations:[...$.supported_operations],...J.accountRootMetadataSupported===!0&&typeof $.account_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test($.account_root_fingerprint)?{account_root_fingerprint:$.account_root_fingerprint}:{},...J.workspaceRootMetadataSupported===!0&&typeof $.workspace_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test($.workspace_root_fingerprint)?{workspace_root_fingerprint:$.workspace_root_fingerprint}:{},...J.accountRootPathSupported===!0&&typeof $.account_root_path==="string"&&$.account_root_path.startsWith("/")&&$.account_root_path.length<=4096?{account_root_path:$.account_root_path}:{},...J.homeContainedRootsSupported===!0&&Array.isArray($.home_contained_root_fingerprints)&&$.home_contained_root_fingerprints.length<=32&&$.home_contained_root_fingerprints.every((K)=>/^[a-f0-9]{64}$/.test(K))?{home_contained_root_fingerprints:[...$.home_contained_root_fingerprints]}:{},...Q?{root_paths:Q}:{},...Object.keys(Z).length?{operation_constraints:Z}:{},...$.hands_worker_artifact_sha256&&$.hands_worker_entrypoint?{hands_worker_artifact_sha256:$.hands_worker_artifact_sha256,hands_worker_entrypoint:$.hands_worker_entrypoint}:{},...$.hands_slots!==void 0?{hands_slots:$.hands_slots}:{}}}function wJ($){let J=(Q)=>Q===null||typeof Q==="boolean"||typeof Q==="number"&&Number.isFinite(Q)||typeof Q==="string"&&Q.length<=512,Z={};for(let Q of $.supported_operations){let K=$.operation_constraints?.[Q];if(!K||typeof K!=="object"||Array.isArray(K))continue;if(!("ready"in K)||typeof K.ready!=="boolean")continue;let B={};for(let[G,U]of Object.entries(K).slice(0,32)){if(!G.length||G.length>64||["__proto__","constructor","prototype"].includes(G))continue;if(J(U)||Array.isArray(U)&&U.length<=64&&U.every(J))B[G]=U}if(Object.keys(B).length)Z[Q]=B}return Z}class N0 extends Error{status;code;retryAfter;constructor($,J,Z,Q=null){super(Z);this.status=$;this.code=J;this.retryAfter=Q;this.name="LocalRuntimeHttpError"}}class r1 extends Error{timeoutMs;constructor($){super(`Reason Device request did not answer within ${$}ms.`);this.timeoutMs=$;this.name="LocalRuntimeRequestTimeoutError"}}function MJ($){return $===408||$===429||$===500||$===502||$===503||$===504}function jJ($){if($ instanceof N0)return!1;if($ instanceof r1)return!0;if(!($ instanceof Error))return!1;if($.name==="AbortError")return!1;if($ instanceof TypeError&&$.message.toLowerCase().includes("fetch failed"))return!0;for(let J of[$,$.cause])if(J&&typeof J==="object"&&"code"in J){let Z=String(J.code);if(["ECONNRESET","ECONNREFUSED","ETIMEDOUT","EHOSTUNREACH","ENOTFOUND","EAI_AGAIN","ConnectionClosed","ConnectionRefused","UND_ERR_SOCKET","UND_ERR_CONNECT_TIMEOUT"].includes(Z))return!0}return!1}function LJ($,J,Z=500){if(J instanceof N0&&J.retryAfter){let B=parseFloat(J.retryAfter);if(Number.isFinite(B)&&B>0)return Math.min(B*1000,1e4)}let Q=Z*2**$,K=Math.floor(Math.random()*200);return Math.min(Q+K,5000)}async function OJ($,J){if(J?.aborted)throw J.reason??new DOMException("The operation was aborted.","AbortError");await new Promise((Z,Q)=>{let K=()=>{clearTimeout(B),Q(J?.reason??new DOMException("The operation was aborted.","AbortError"))},B=setTimeout(()=>{J?.removeEventListener("abort",K),Z()},$);J?.addEventListener("abort",K,{once:!0})})}function dV($){return $ instanceof N0&&$.status===401&&($.code==="device_revoked"||$.code==="invalid_device_credential")}function l8($){return Buffer.byteLength(JSON.stringify($)??"null","utf8")}function s8($){return CJ("sha256").update($??"").digest("hex")}function IJ($){return i8({method:$.method,pathAndQuery:$.route,timestamp:$.timestamp,nonce:$.nonce,challenge:$.challenge,bodySha256:$.bodySha256})}function c8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}var AJ=20000,_J=1e4,n8=[2000,4000],PJ=30000,TJ=15000;function r8($){return $?{keepalive:!1}:{}}class $3 extends Error{constructor($){super(`Reason Device proof challenge did not answer within ${$}ms.`)}}class RJ{fetchImpl;proofStore;proofOptions;apiOrigin;spareChallenge=null;sessions=new Map;sessionsClosed=!1;constructor($,J=fetch,Z,Q={}){this.fetchImpl=J;this.proofStore=Z;this.proofOptions=Q;let K=new URL($);if(K.protocol!=="https:"&&K.hostname!=="127.0.0.1"&&K.hostname!=="localhost"&&K.hostname!=="[::1]"&&K.hostname!=="::1")throw Error("Reason Device API must use HTTPS, except for localhost development.");this.apiOrigin=K.origin}async parseResponse($){if($.status===204)return null;let J=await $.json().catch(()=>({}));if(!$.ok){let{code:Z,message:Q}=o8(J,$.status),K=$.headers?.get?.("retry-after")??null;throw new N0($.status,Z,Q,K)}return J}async challenge($,J,Z={fresh:!1}){let Q=this.proofOptions.challengeAttemptTimeoutsMs??n8;for(let K of Q)try{return await this.challengeAttempt($,J,K,Z.fresh)}catch(B){if(J?.aborted||!(B instanceof $3))throw B;Z.fresh=!0}return await this.challengeAttempt($,J,null,Z.fresh)}async challengeAttempt($,J,Z,Q=!1){let K=JSON.stringify({device_id:$}),B=Z===null?null:new AbortController,G=B&&Z!==null?setTimeout(()=>B.abort(new $3(Z)),Z):null;try{let U=await this.fetchImpl(`${this.apiOrigin}${s.authChallenge.path}`,{method:"POST",redirect:"error",headers:{accept:"application/json","content-type":"application/json"},body:K,...r8(Q),signal:B?J?AbortSignal.any([J,B.signal]):B.signal:J});return t8(await this.parseResponse(U))}catch(U){if(!J?.aborted&&B?.signal.aborted)throw B.signal.reason;throw U}finally{if(G)clearTimeout(G)}}async takeSpareChallenge($){let J=this.spareChallenge;if(this.spareChallenge=null,!J||J.deviceId!==$)return null;let Z=await J.challenge,Q=(this.proofOptions.now??Date.now)();return Z&&Date.parse(Z.expires_at)-Q>=AJ?Z:null}refillSpareChallenge($){let J=this.challengeAttempt($,void 0,n8[0]??2000).catch(()=>null);this.spareChallenge={deviceId:$,challenge:J}}async proofHeaders($,J,Z,Q,K=!1,B,G){let U=B&&Date.parse(B.expires_at)-(this.proofOptions.now??Date.now)()>=_J?B:null,Y=!U&&K?await this.takeSpareChallenge(Z.deviceId):null,F=U??Y??await this.challenge(Z.deviceId,Q,G);if(K)this.refillSpareChallenge(Z.deviceId);let X=s8(J),W=this.signProof("POST",$,F.challenge,X);return{"x-device-id":Z.deviceId,"x-device-timestamp":W.timestamp,"x-device-nonce":W.nonce,"x-device-challenge":F.challenge,"x-device-body-sha256":X,"x-device-signature":W.signature}}signProof($,J,Z,Q){let K=String(Math.trunc((this.proofOptions.now??Date.now)())),B=(this.proofOptions.nonce??(()=>DJ(24)))();if(B.byteLength<16||B.byteLength>32)throw Error("Invalid Reason Device proof nonce.");let G=Buffer.from(B).toString("base64url"),U=this.proofStore.sign(IJ({method:$,route:J,timestamp:K,nonce:G,challenge:Z,bodySha256:Q}));if(!/^[A-Za-z0-9_-]{8,128}$/.test(U))throw Error("Reason Device proof boundary returned an invalid signature.");return{timestamp:K,nonce:G,signature:U}}sessionFor($,J){if(!this.proofOptions.deviceSession||this.sessionsClosed||!J||!a8($.path))return null;let Z=this.sessions.get(J.deviceId);if(!Z)Z=new e2({apiOrigin:this.apiOrigin,deviceId:J.deviceId,signHello:(Q)=>this.signProof("GET",c1,Q,s8("")),...this.proofOptions.webSocket?{WebSocket:this.proofOptions.webSocket}:{},...this.proofOptions.now?{now:this.proofOptions.now}:{}}),this.sessions.set(J.deviceId,Z);return Z}sessionCadence($){let J=this.proofOptions.deviceSession&&!this.sessionsClosed?this.sessions.get($.deviceId)?.cadence()??null:null;return J?{presenceIntervalMs:J.presence_interval_ms,claimWaitMs:J.claim_wait_ms}:null}close(){this.sessionsClosed=!0;for(let $ of this.sessions.values())$.close();this.sessions.clear()}async request($,J){if(J.body!==void 0&&l8(J.body)>C0)throw Error("Reason Device request exceeds the 256 KB protocol limit.");if(J.authorization!==void 0&&J.device!==void 0)throw Error("Reason Device request cannot combine bearer and proof authentication.");let Z=J.authorization!==void 0,Q=J.device!==void 0;if(!($.auth==="none"?!Z&&!Q:$.auth==="registration_bearer"?Z&&!Q:Z!==Q))throw Error(`Reason Device request used invalid authentication for ${$.path}.`);let B=J.body===void 0?void 0:JSON.stringify(J.body),G=this.proofOptions.maxAttempts??4,U=this.proofOptions.sleep??OJ,Y=this.sessionFor($,J.device),F=Math.max(PJ,(J.holdMs??0)+TJ),X={fresh:!1},W;for(let z=0;z<G;z+=1)try{let N=await Y?.request($.path,J.sessionBody===void 0?B??"":JSON.stringify(J.sessionBody),J.signal)??null;if(N)return await this.parseResponse(new Response(N.status===204?null:N.body,{status:N.status,headers:N.retryAfter===null?{}:{"retry-after":N.retryAfter}}));let C=new AbortController,M=setTimeout(()=>C.abort(new r1(F)),F),w=J.signal?AbortSignal.any([J.signal,C.signal]):C.signal;try{let D=J.device===void 0?{}:await this.proofHeaders($.path,B,J.device,w,J.useSpareChallenge===!0&&z===0,z===0?J.issuedChallenge:void 0,X),j=await this.fetchImpl(`${this.apiOrigin}${$.path}`,{method:"POST",redirect:"error",headers:{...J.authorization===void 0?{}:{authorization:`Bearer ${J.authorization}`},...D,accept:"application/json",...J.body===void 0?{}:{"content-type":"application/json"}},body:B,...r8(X.fresh),signal:w});return await this.parseResponse(j)}catch(D){if(!J.signal?.aborted&&C.signal.aborted)throw C.signal.reason;throw D}finally{clearTimeout(M)}}catch(N){if(W=N,N instanceof r1)X.fresh=!0;if(J.signal?.aborted)throw N;let C=J.device!==void 0&&N instanceof N0&&N.status===401&&["invalid_device_proof","device_proof_replayed"].includes(N.code),M=N instanceof N0&&MJ(N.status),w=jJ(N),D=J.transientRetryOwner!=="caller"&&(M||w);if((C||D)&&z+1<G){let j=C?0:LJ(z,N,this.proofOptions.retryBaseDelayMs??500);if(j>0)await U(j,J.signal);continue}if(C&&z+1>=G)throw Error("Reason Device proof retry was exhausted.");throw N}throw W??Error("Reason Device request failed.")}async register($,J,Z){let Q=await this.request(s.register,{authorization:$,body:J,signal:Z});return e8(Q)}async enroll($,J,Z,Q){let K=await this.request(s.enroll,{body:{...Z,enrollment_ticket:$,code_verifier:J},signal:Q});return $5(K)}async heartbeat($,J,Z,Q){let K=await this.request(s.heartbeat,{device:$,body:J,signal:Z,...Q?{issuedChallenge:Q}:{}});return J5(K)}async syncRoots($,J,Z){let Q=await this.request(s.rootsSync,{device:$,body:{roots:J},signal:Z});return Z5(Q)}async identity($,J){let Z=await this.request(s.identity,{device:$,signal:J});return Q5(Z)}async disconnect($,J,Z,Q=[]){let K=await this.request(s.disconnect,{device:$,body:Z?{successor_device_id:Z,...Q.length?{successor_roots:Q}:{}}:{},signal:J});return K5(K)}async deviceLifecycle($,J,Z){let Q=await this.request(s.lifecycle,{device:$,body:J,signal:Z});V5(Q)}async localSubscription($,J,Z){return B5(await this.request(s.localSubscription,{device:$,body:J,signal:Z}))}async ownerWorkspaces($,J){let Q=(await this.request(s.ownerWorkspaces,{device:$,body:{},signal:J}))?.organizations;if(!Array.isArray(Q))throw Error("Reason returned an invalid workspace list.");return Q.flatMap((K)=>{let B=K;return typeof B?.id==="string"?[{id:B.id,...typeof B.name==="string"&&B.name.trim()?{name:B.name.trim()}:{},blocked:B.blocked===!0}]:[]})}async ownerWorkspaceEnrollment($,J,Z){return this.request(s.ownerWorkspaceEnrollment,{device:$,body:J,signal:Z})}async liveSessionWorktrees($,J,Z){let Q=await this.request(s.sessionWorktrees,{device:$,body:{worktree_ids:[...J]},signal:Z}).catch((K)=>{if(K instanceof N0&&K.status===404)return null;throw K});if(Q===null)return null;if(!c8(Q)||!Array.isArray(Q.live)||!Q.live.every((K)=>typeof K==="string"&&J.includes(K)))throw Error("Reason returned an invalid Session worktree answer.");return Q.live}async claimOperation($,J={}){let Z=Math.max(J.waitMs??25000,0),Q=(G)=>({wait_ms:Math.min(Z,G),...J.instanceGeneration===void 0?{}:{instance_generation:J.instanceGeneration}}),K=this.sessionCadence($)?.claimWaitMs,B=await this.request(s.operationClaim,{device:$,body:Q(30000),holdMs:Math.min(Z,30000),...K===void 0?{}:{sessionBody:Q(Math.min(K,n1))},signal:J.signal});if(B===null)return null;return G5(B,J3)}async operationHeartbeat($,J,Z={}){let Q=(G)=>this.request(s.operationHeartbeat.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,...Z.controlAckSeq===void 0?{}:{control_ack_seq:Z.controlAckSeq},...G?{client_retry_count:Z.clientRetryCount}:{},...G&&Z.waitMs!==void 0?{wait_ms:Math.min(Math.max(Z.waitMs,0),30000)}:{}},signal:Z.signal,transientRetryOwner:Z.transientRetryOwner,...G&&Z.waitMs!==void 0?{holdMs:Math.min(Math.max(Z.waitMs,0),30000)}:{}}),K=(Z.clientRetryCount??0)>0||Z.waitMs!==void 0,B;try{B=await Q(K)}catch(G){if(!K||!(G instanceof N0)||G.status!==400||G.code!=="invalid_operation_heartbeat")throw G;B=await Q(!1)}return X5(B)}async operationEvents($,J,Z){if(!Number.isInteger(Z.eventSeqStart)||Z.eventSeqStart<0||Z.events.length<1||Z.events.length>100||Z.events.some((K)=>!/^[A-Za-z0-9._:-]{1,64}$/.test(K.kind)||!c8(K.payload)))throw Error("Invalid Reason Device operation event batch.");let Q=await this.request(s.operationEvents.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,event_seq_start:Z.eventSeqStart,events:Z.events},signal:Z.signal,transientRetryOwner:Z.transientRetryOwner,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return U5(Q)}async completeOperation($,J,Z,Q){let K={attempt_id:J.attempt_id,attempt_token:J.attempt_token,status:Z.status,...Z.result===void 0?{}:{result:Z.result},...Z.error_code?{error_code:Z.error_code}:{}};if(l8(K)>C0)throw Error("Reason Device operation result exceeds the 256 KB protocol limit.");let B=await this.request(s.operationComplete.forOperation(J.operation_id),{device:$,body:K,signal:Q});return Y5(B)}async operationCustomEndpointCredential($,J,Z){let{CustomEndpointDeviceCredentialSchema:Q}=await import("./custom-endpoint-device-8h95wy87.js");return Q.parse(await this.request(s.operationCustomEndpointCredential.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token},signal:Z}))}async operationEnvironment($,J,Z,Q){let K=await this.request(s.operationEnvironment.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,snapshot_id:Z},signal:Q,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return F5(K)}async acknowledgeOperationEnvironment($,J,Z,Q){await this.request(s.operationEnvironmentAck.forOperation(J.operation_id),{device:$,body:{attempt_id:J.attempt_id,attempt_token:J.attempt_token,...Z},signal:Q,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}})}}var qJ=new Set(["process.run.v1","process.full.v1","computer.use","browser.use"]),V1=new Set(["jobs.control","environment.install","tunnel.open","tunnel.close","display.stream.v1","automation.call.v1","workspace.setup.v1","simulator.call.v1","simulator.stream.v1"]);function a1($,J){if(qJ.has($))return!1;if(V1.has($)&&!J.runtimeDirectory)return!1;if(($==="inference.custom.v1"||$==="preview.serve.v1"||$==="simulator.call.v1"||$==="simulator.stream.v1")&&(J.executionMode!=="unsandboxed"||!J.runtimeDirectory))return!1;if(J.executionMode!=="unsandboxed"&&(["exec.full","hands.connect","pty.start","browser.pr-proof.v1"].includes($)||V1.has($)))return!1;return!0}import{accessSync as gJ,constants as EJ,existsSync as kJ,statSync as SJ}from"fs";import{basename as fJ,isAbsolute as bJ}from"path";var G1=["-lic"],W5="/bin/zsh",xJ=new Set(["zsh","bash"]),N5=20000,Z3=60000,yJ=65536,hJ=64,mJ=8192,vJ=new Set(["NODE_OPTIONS","PATH","ZDOTDIR","BASH_ENV","ENV"]),uJ=["DYLD_","LD_"];function pJ($){let J=$.toUpperCase();return vJ.has(J)||uJ.some((Z)=>J.startsWith(Z))}function H5($=process.env){return!0}function dJ($){if(!bJ($)||$.includes("\x00"))return!1;if(!xJ.has(fJ($)))return!1;try{if(!SJ($).isFile())return!1;return gJ($,EJ.X_OK),!0}catch{return!1}}function S0($=process.env){if(process.platform==="win32")return z5()??W5;let J=$.SHELL?.trim();if(J&&dJ(J))return J;return W5}function Q3($=process.env){return H5($)&&kJ(S0($))}function K3($=process.env){if(!H5($))throw new H("full_control_disabled","Full-control execution is unavailable on this Reason Device.")}function B3($){if(typeof $!=="string"||$.length===0||$.includes("\x00")||Buffer.byteLength($,"utf8")>yJ)throw new H("invalid_payload","command is missing or too large.");return $}function V3($){if($===void 0||$===null)return{forwarded:{},ignored:[]};if(typeof $!=="object"||Array.isArray($))throw new H("invalid_payload","env must be an object of strings.");let J=Object.entries($);if(J.length>hJ)throw new H("invalid_payload","env has too many entries.");let Z={},Q=[];for(let[K,B]of J){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(K)||typeof B!=="string"||B.includes("\x00")||Buffer.byteLength(B,"utf8")>mJ)throw new H("invalid_payload","env entry is invalid or too large.");if(pJ(K)){Q.push(K);continue}Z[K]=B}return{forwarded:Z,ignored:Q}}async function C5($){let J=$.processEnv??process.env;if(K3(J),$.signal.aborted)throw new H("cancelled","Operation was cancelled.");let Z=B3($.command),Q=S0(J),{forwarded:K,ignored:B}=V3($.requestEnv),G=await $.spawn(Q,[...G1,Z],{cwd:$.cwd,timeoutMs:$.timeoutMs,signal:$.signal,env:{...J,...K}});return{exit_code:G.exitCode,signal:G.signal,stdout:G.stdout,stderr:G.stderr,timed_out:G.timedOut,truncated:G.truncated,shell:Q,shell_flags:[...G1],login:!0,interactive:!0,sandbox:"none",ignored_env:B}}function D5($=process.env){return{transport:"shell",shell:`${S0($)} ${G1.join(" ")}`,login_shell:!0,interactive_shell:!0,rc_files_loaded:!0,sandbox:"none",network:!0,environment:"inherited",privilege:"user",sudo:"argv_exact_nopasswd_only",activation:"explicit_device_grant",max_timeout_ms:Z3}}import{readFile as lJ,readdir as sJ,readlink as cJ,realpath as nJ}from"fs/promises";import{basename as rJ,relative as aJ,sep as iJ}from"path";var O0="/proc",oJ=250,w5=500,tJ=50,eJ=250,$Z=1024,M5=4096,JZ=1,ZZ=3,j5=9,QZ="0A",KZ=/^socket:\[(\d+)\]$/,G3={readDirectory:($)=>sJ($),readLink:($)=>cJ($),readTextFile:($)=>lJ($,"utf8"),realPath:($)=>nJ($)};function O5($,J){return J===$||J.startsWith(`${$}${iJ}`)}function BZ($,J){return aJ($,J)||"."}async function I5($){let J;try{J=await $.readDirectory(O0)}catch{return[]}return J.filter((Z)=>/^[0-9]+$/.test(Z)).map((Z)=>Number(Z)).filter((Z)=>Number.isSafeInteger(Z)&&Z>0).sort((Z,Q)=>Z-Q)}async function A5($,J){try{let Q=(await J.readTextFile(`${O0}/${$}/comm`)).slice(0,M5).split(`
 `,1)[0]?.trim();if(Q)return Q}catch{}try{let Q=(await J.readTextFile(`${O0}/${$}/cmdline`)).slice(0,M5).split("\x00",1)[0]?.trim();return Q?rJ(Q):null}catch{return null}}async function _5($,J=G3){let Z;try{Z=await J.readLink(`${O0}/${$}/cwd`)}catch{return null}if(!Z)return null;try{return await J.realPath(Z)}catch{return null}}async function P5($,J=G3){let Z=[];for(let Q of await I5(J)){if(Z.length>=oJ)break;let K=await _5(Q,J);if(!K||!O5($,K))continue;Z.push({pid:Q,command:await A5(Q,J),cwd:BZ($,K)})}return{processes:Z}}function L5($){let J=[];for(let Z=0;Z<8;Z+=2)J.unshift(Number.parseInt($.slice(Z,Z+2),16));return J}function VZ($){let J=[];for(let Y=0;Y<16;Y+=2)J.push($[Y]<<8|$[Y+1]);if(J.slice(0,5).every((Y)=>Y===0)&&J[5]===65535)return`::ffff:${$.slice(12).join(".")}`;let Z=-1,Q=0,K=-1;for(let Y=0;Y<=J.length;Y+=1){if(Y<J.length&&J[Y]===0){if(K<0)K=Y;continue}if(K>=0){let F=Y-K;if(F>Q)Z=K,Q=F;K=-1}}let B=J.map((Y)=>Y.toString(16));if(Q<2)return B.join(":");let G=B.slice(0,Z).join(":"),U=B.slice(Z+Q).join(":");return`${G}::${U}`}function GZ($,J){if(/^[0-9A-Fa-f]{8}$/.test($)){let Z=L5($);if(Z.every((Q)=>Q===0))return`*:${J}`;return`${Z.join(".")}:${J}`}if(/^[0-9A-Fa-f]{32}$/.test($)){let Z=[];for(let Q=0;Q<4;Q+=1)Z.push(...L5($.slice(Q*8,Q*8+8)));if(Z.every((Q)=>Q===0))return`*:${J}`;return`[${VZ(Z)}]:${J}`}return null}function XZ($,J){let Z=[];for(let Q of $.split(`
 `).slice(1)){if(Z.length>=J)break;let K=Q.trim().split(/\s+/);if(K.length<=j5)continue;if(K[ZZ]?.toUpperCase()!==QZ)continue;let B=K[JZ]??"",G=B.lastIndexOf(":");if(G<0)continue;let U=Number.parseInt(B.slice(G+1),16);if(!Number.isInteger(U)||U<=0||U>65535)continue;let Y=GZ(B.slice(0,G),U),F=K[j5];if(!Y||!F||!/^[0-9]+$/.test(F))continue;Z.push({inode:F,port:U,address:Y})}return Z}async function UZ($){let J=[];for(let Z of["tcp","tcp6"]){if(J.length>=w5)break;let Q;try{Q=await $.readTextFile(`${O0}/net/${Z}`)}catch{continue}J.push(...XZ(Q,w5-J.length))}return J}async function FZ($,J){let Z=new Map;if($.size===0)return Z;for(let Q of await I5(J)){if(Z.size>=$.size)break;let K;try{K=await J.readDirectory(`${O0}/${Q}/fd`)}catch{continue}for(let B of K.slice(0,$Z)){let G;try{G=await J.readLink(`${O0}/${Q}/fd/${B}`)}catch{continue}let U=G.match(KZ)?.[1];if(!U||!$.has(U)||Z.has(U))continue;Z.set(U,Q)}}return Z}async function T5($,J=G3){let Z=await UZ(J),Q=await FZ(new Set(Z.map((X)=>X.inode)),J),K=[];for(let X of Z){let W=Q.get(X.inode);if(W===void 0)continue;K.push({pid:W,port:X.port,address:X.address})}K.sort((X,W)=>X.pid-W.pid||X.port-W.port||(X.address<W.address?-1:X.address>W.address?1:0));let B=[...new Set(K.map((X)=>X.pid))].slice(0,tJ),G=await Promise.all(B.map(async(X)=>[X,await _5(X,J)])),U=new Map(G),Y=K.filter((X)=>{let W=U.get(X.pid);return Boolean(W&&O5($,W))}),F=new Map(await Promise.all([...new Set(Y.map((X)=>X.pid))].map(async(X)=>[X,await A5(X,J)])));return{ports:Y.slice(0,eJ).map((X)=>({pid:X.pid,command:F.get(X.pid)??null,address:X.address}))}}import{posix as U3}from"path";var i1=200,YZ=250,WZ=250;async function o1($,J){let Z=await $(J);if(Z.timedOut||Z.truncated||Z.exitCode!==0&&Z.exitCode!==1)throw new H("process_inspection_failed","Reading this Mac's processes did not complete.");let Q=[],K=null;for(let B of Z.stdout.split(/\r?\n/))if(B.startsWith("p")){let G=Number(B.slice(1));if(K=Number.isInteger(G)&&G>0?{pid:G,command:null,names:[]}:null,K)Q.push(K)}else if(K&&B.startsWith("c"))K.command=B.slice(1)||null;else if(K&&B.startsWith("n"))K.names.push(B.slice(1));return Q}function X3($,J){return J===$||J.startsWith($==="/"?$:`${$}/`)}var R5="/System/Volumes/Data",zZ=["/tmp","/var","/etc"];function F3($){let J=U3.normalize($);if(J.startsWith(`${R5}/`))J=J.slice(R5.length);return zZ.find((Q)=>J===Q||J.startsWith(`${Q}/`))?`/private${J}`:J}function q5($){return $&&U3.isAbsolute($)?F3($):null}async function g5($,J){let Z=new Map;for(let Q=0;Q<J.length;Q+=i1){let K=J.slice(Q,Q+i1).join(",");for(let B of await o1($,["-a","-p",K,"-d","cwd","-Fpcn"]))Z.set(B.pid,{command:B.command,cwd:q5(B.names[0])})}return Z}async function E5($,J){let Z=F3($),Q=(await o1(J,["-d","cwd","-Fpn"])).filter((B)=>{let G=q5(B.names[0]);return G!==null&&X3(Z,G)}).map((B)=>B.pid).slice(0,YZ),K=await g5(J,Q);return{processes:Q.flatMap((B)=>{let G=K.get(B);return G?.cwd&&X3(Z,G.cwd)?[{pid:B,command:G.command,cwd:U3.relative(Z,G.cwd)||"."}]:[]})}}async function k5($,J){let Z=F3($),Q=["-nP","-iTCP","-sTCP:LISTEN","-Fpcn"],K=await o1(J,Q),B=await g5(J,K.map((F)=>F.pid)),G=K.map((F)=>F.pid).filter((F)=>{let X=B.get(F)?.cwd;return Boolean(X&&X3(Z,X))});if(G.length===0)return{ports:[]};let U=new Set(K.flatMap((F)=>F.names.map((X)=>`${F.pid} ${X}`))),Y=[];for(let F=0;F<G.length;F+=i1){let X=G.slice(F,F+i1).join(",");for(let W of await o1(J,["-a","-p",X,...Q]))for(let z of W.names)if(U.has(`${W.pid} ${z}`))Y.push({pid:W.pid,command:W.command,address:z})}return{ports:Y.slice(0,WZ)}}import{join as PZ}from"path";import{spawn as jZ}from"child_process";import{randomUUID as LZ}from"crypto";import{chmodSync as b5,lstatSync as x5,mkdirSync as OZ,readdirSync as IZ,statSync as AZ,unlinkSync as _Z}from"fs";import{join as W3}from"path";var Y3={targets:24,assets:128,sourceFiles:2000,sourceBytes:20000000,outputBytes:20000000};var t1=($,J=0,Z=1e6)=>typeof $==="number"&&Number.isFinite($)&&$>=J&&$<=Z;var I0=()=>{throw Error("proof_visual_contract_invalid")};class S5 extends Error{constructor(){super("proof_visual_contract_invalid")}}function HZ($){if(!X1($)||$.version!==1)return I0();if(typeof $.route!=="string"||!$.route.startsWith("/")||$.route.length>512||/[\x00-\x20\x7f\\?#%]/.test($.route)||$.route.startsWith("//"))throw new S5;if(!X1($.viewport)||!t1($.viewport.width,1,4096)||!t1($.viewport.height,1,4096)||!Array.isArray($.targets)||$.targets.length<1||$.targets.length>Y3.targets||Object.keys($).some((Q)=>!["version","route","viewport","targets","additionalViewports"].includes(Q)))return I0();let J=$.targets.map((Q)=>{if(!X1(Q)||typeof Q.id!=="string"||!/^[a-zA-Z0-9_-]{1,64}$/.test(Q.id)||typeof Q.selector!=="string"||!Q.selector.trim()||Q.selector.length>256||/[\x00-\x1f\x7f]/.test(Q.selector)||Object.keys(Q).some((K)=>!["id","selector"].includes(K)))return I0();return{id:Q.id,selector:Q.selector}});if(new Set(J.map((Q)=>Q.id)).size!==J.length)return I0();let Z;if($.additionalViewports!==void 0){if(!Array.isArray($.additionalViewports)||$.additionalViewports.length<1||$.additionalViewports.length>3)return I0();Z=$.additionalViewports.map((K)=>{if(!X1(K)||!t1(K.width,1,4096)||!Number.isInteger(K.width)||!t1(K.height,1,4096)||!Number.isInteger(K.height)||Object.keys(K).some((B)=>!["width","height"].includes(B)))return I0();return{width:K.width,height:K.height}});let Q=[$.viewport,...Z].map((K)=>`${K.width}x${K.height}`);if(new Set(Q).size!==Q.length)return I0()}return{version:1,route:$.route,viewport:{width:$.viewport.width,height:$.viewport.height},targets:J,...Z?{additionalViewports:Z}:{}}}var DZ=["organizationId","userId","sessionId","runId"],wZ=[...DZ,"prUrl","headSha","skillDigest","evidenceKind"],UG=[...wZ,"contextId","preparedAt","captureId","startedAt","finishedAt","sha256","kind","visualPlan","visualObservation"];var MZ={"image/png":{kind:"image",directory:"/tmp/ara-public-screenshots",extension:"png",maxBytes:8388608},"video/webm":{kind:"video",directory:"/tmp/ara-public-recordings",extension:"webm",maxBytes:10551296}};function f5($){return MZ[$].directory}var y5=10485760;function h5($={}){let J=$.directory??f5("video/webm"),Z=null;return{async start(Q){if(Z)throw Error("cloud_browser_recording_active");let K=Q?.seconds;if(!Number.isInteger(K)||Number(K)<1||Number(K)>15||!Q||Object.keys(Q).some((w)=>w!=="seconds"))throw Error("cloud_browser_recording_seconds_1_to_15_required");OZ(J,{recursive:!0,mode:457});let B=x5(J);if(!B.isDirectory()||B.isSymbolicLink()||B.uid!==process.getuid?.())throw Error("cloud_browser_recording_directory_invalid");b5(J,457);let G=IZ(J).filter((w)=>/^[a-f0-9-]{36}\.webm$/.test(w)).map((w)=>({name:w,time:AZ(W3(J,w)).mtimeMs})).sort((w,D)=>D.time-w.time);for(let w of G.slice(9))_Z(W3(J,w.name));let U=W3(J,`${LZ()}.webm`),Y=["-f","x11grab","-framerate","12","-i",$.display??":99"],F=($.spawn??jZ)($.ffmpeg??"ffmpeg",["-nostdin","-hide_banner","-loglevel","error","-y",...Y,"-t",String(K),"-vf","scale=1280:-2","-c:v","libvpx","-deadline","realtime","-b:v","700k","-an","-fs",String(y5),"-progress","pipe:1",U],{stdio:["ignore","pipe","ignore"],...$.env?{env:$.env}:{}}),X,W,z=!1,N=new Promise((w,D)=>{X=w,W=D});F.stdout.on("data",(w)=>{if(/frame=\s*[1-9]/.test(String(w)))z=!0,X()});let C=new Promise((w,D)=>{F.once("error",()=>{W(Error("cloud_browser_recording_unavailable")),D(Error("cloud_browser_recording_unavailable"))}),F.once("exit",(j)=>{try{if(j!==0&&j!==255)throw Error();let O=x5(U);if(!z||!O.isFile()||O.isSymbolicLink()||O.uid!==process.getuid?.()||O.size<128||O.size>y5+65536)throw Error();b5(U,420),X(),w({path:U,mimeType:"video/webm"})}catch{W(Error("cloud_browser_recording_failed")),D(Error("cloud_browser_recording_failed"))}})});C.catch(()=>{});let M=setTimeout(()=>F.kill("SIGKILL"),(Number(K)+5)*1000);C.finally(()=>clearTimeout(M)).catch(()=>{}),Z={done:C,stop:()=>{return F.kill("SIGINT"),C}};try{await N}catch(w){throw Z=null,w}return{recording:!0,seconds:Number(K)}},async stop(){if(!Z)throw Error("cloud_browser_recording_not_started");let Q=Z;return Z=null,Q.stop()},async close(){if(Z)await this.stop().catch(()=>{})}}}function u5($,J={}){if($.executionMode!=="unsandboxed"||!$.runtimeDirectory||(J.platform??process.platform)!=="linux")return null;let Z=(J.components??m5)(),Q=Z?.features.display?Z.ffmpeg:null;if(!Q)return null;let K=PZ($.runtimeDirectory,"recordings"),B=null;return{async start(G){let U=await(J.desktop??v5)();return B??=h5({directory:K,display:U.display,ffmpeg:Q,env:{HOME:b1(),PATH:"/usr/local/bin:/usr/bin:/bin",XAUTHORITY:U.xauthority},...J.spawn?{spawn:J.spawn}:{}}),B.start(G)},async stop(){if(!B)throw Error("cloud_browser_recording_not_started");return B.stop()},async close(){await B?.close()}}}import{spawn as E3}from"child_process";import{createHash as cZ,randomUUID as nZ}from"crypto";import{existsSync as Q0,mkdirSync as P3,mkdtempSync as k3,readdirSync as G2,readFileSync as S3,renameSync as rZ,rmSync as Y1,statSync as Q2,writeFileSync as aZ}from"fs";import{homedir as f3,tmpdir as U6}from"os";import{basename as F6,dirname as T3,join as k,relative as Y6,resolve as R3,sep as W6}from"path";var a=V.string().min(1).max(200),Z0=V.number().finite().min(0).max(1e4),e1=V.string().min(1).max(4096).refine(($)=>!$.includes("\x00")),p5=V.string().regex(/^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/),N3=V.object({id:V.string().min(1).max(500).optional(),label:V.string().min(1).max(500).optional()}).strict(),H3=["home","lock","side_button","siri","apple_pay"],TZ=V.enum(["tree","screenshot","both","none"]),RZ=V.object({...N3.shape,gone:V.boolean().optional()}).strict().refine(($)=>Boolean($.id||$.label),"wait_for needs an id or label"),D0={observe:TZ.optional(),wait_for:RZ.optional(),timeout:V.number().min(0).max(20).optional()},z3=V.discriminatedUnion("action",[V.object({action:V.literal("tap"),x:Z0.optional(),y:Z0.optional(),...N3.shape,duration:V.number().min(0).max(10).optional()}).strict().refine(($)=>$.x!==void 0&&$.y!==void 0||Boolean($.id||$.label),"pass x and y, or an id or label"),V.object({action:V.literal("swipe"),x:Z0,y:Z0,x2:Z0,y2:Z0,duration:V.number().min(0.05).max(5).optional()}).strict(),V.object({action:V.literal("type"),text:V.string().min(1).max(4000)}).strict(),V.object({action:V.literal("button"),name:V.enum(H3)}).strict(),V.object({action:V.literal("sleep"),seconds:V.number().min(0).max(10)}).strict()]),C3=V.discriminatedUnion("action",[V.object({action:V.literal("devices")}).strict(),V.object({action:V.literal("boot"),device:a}).strict(),V.object({action:V.literal("shutdown"),device:a}).strict(),V.object({action:V.literal("build"),path:e1.optional(),scheme:V.string().min(1).max(200).optional(),configuration:V.string().min(1).max(100).optional(),device:a.optional(),wait:V.boolean().optional()}).strict(),V.object({action:V.literal("run"),path:e1.optional(),scheme:V.string().min(1).max(200).optional(),configuration:V.string().min(1).max(100).optional(),device:a.optional(),steps:V.array(V.lazy(()=>z3)).max(30).optional(),...D0}).strict(),V.object({action:V.literal("build_status"),build_id:V.string().regex(/^build-[0-9a-z-]{4,64}$/),device:a.optional(),wait:V.boolean().optional()}).strict(),V.object({action:V.literal("launch"),device:a.optional(),app_path:e1.optional(),bundle_id:p5.optional(),steps:V.array(V.lazy(()=>z3)).max(30).optional(),...D0}).strict().refine(($)=>Boolean($.app_path)!==Boolean($.bundle_id),"pass exactly one of app_path or bundle_id"),V.object({action:V.literal("terminate"),device:a.optional(),bundle_id:p5}).strict(),V.object({action:V.literal("logs"),device:a.optional(),after:V.number().int().min(0).optional()}).strict(),V.object({action:V.literal("screenshot"),device:a.optional(),scale:V.union([V.literal(1),V.literal(2)]).optional(),save_path:e1.optional()}).strict(),V.object({action:V.literal("chrome"),device:a.optional()}).strict(),V.object({action:V.literal("inspect"),device:a.optional()}).strict(),V.object({action:V.literal("tap"),device:a.optional(),x:Z0.optional(),y:Z0.optional(),...N3.shape,duration:V.number().min(0).max(10).optional(),...D0}).strict().refine(($)=>$.x!==void 0&&$.y!==void 0||Boolean($.id||$.label),"pass x and y, or an id or label"),V.object({action:V.literal("swipe"),device:a.optional(),x:Z0,y:Z0,x2:Z0,y2:Z0,duration:V.number().min(0.05).max(5).optional(),...D0}).strict(),V.object({action:V.literal("type"),device:a.optional(),text:V.string().min(1).max(4000),...D0}).strict(),V.object({action:V.literal("button"),device:a.optional(),name:V.enum(H3),...D0}).strict(),V.object({action:V.literal("open_url"),device:a.optional(),url:V.string().min(1).max(4000),...D0}).strict(),V.object({action:V.literal("steps"),device:a.optional(),steps:V.array(z3).min(1).max(30),...D0}).strict(),V.object({action:V.literal("appearance"),device:a.optional(),mode:V.enum(["light","dark"])}).strict()]),d5=V.object({udid:V.string(),name:V.string(),runtime:V.string(),state:V.enum(["booted","shutdown","booting","shutting_down"]),kind:V.enum(["iphone","ipad","other"])}).strict(),RG=V.object({text:V.string(),error:V.string().optional(),device:d5.optional(),devices:V.array(d5).optional(),image:V.object({mime:V.literal("image/jpeg"),data:V.string(),width:V.number(),height:V.number()}).strict().optional(),build:V.object({id:V.string(),status:V.enum(["running","succeeded","failed"]),app_path:V.string().optional(),bundle_id:V.string().optional(),errors:V.array(V.string()),log_tail:V.string(),elapsed_ms:V.number()}).strict().optional(),logs:V.object({lines:V.array(V.string()),next:V.number()}).strict().optional(),screen:V.string().optional(),chrome:V.object({identifier:V.string(),screen:V.object({width:V.number(),height:V.number()}).strict(),inset:V.object({top:V.number(),left:V.number(),bottom:V.number(),right:V.number()}).strict(),padding:V.object({top:V.number(),left:V.number(),bottom:V.number(),right:V.number()}).strict(),screen_mask:V.string().optional(),pieces:V.record(V.enum(["topLeft","top","topRight","right","bottomRight","bottom","bottomLeft","left"]),V.object({image:V.string(),width:V.number(),height:V.number()}).strict()),buttons:V.array(V.object({name:V.string(),image:V.string(),x:V.number(),y:V.number(),width:V.number(),height:V.number()}).strict())}).strict().optional()}).strict();var qG=V.object({device_id:V.uuid().optional(),root_id:V.uuid().optional()}),$2={device_id:{type:"string",format:"uuid",description:"Reason machine id from devices.list; omit for the machine this Session runs on."},root_id:{type:"string",format:"uuid"},device:{type:"string",description:"Simulator UDID or exact name. Required for boot and shutdown; for other actions omit it for the booted one."},path:{type:"string",description:"build or run: a .xcodeproj, .xcworkspace, or a folder holding one (project.yml is generated with XcodeGen), absolute or relative to the Session's folder. Omit it when the folder holds one app project."},scheme:{type:"string"},configuration:{type:"string"},build_id:{type:"string",description:"build_status (required): the build_id a build or run returned."},app_path:{type:"string",description:"launch: the built .app from build_status (or pass bundle_id instead)."},bundle_id:{type:"string",description:"terminate (required); launch: an installed app's bundle id instead of app_path."},after:{type:"integer",minimum:0,description:"logs: only lines after this sequence number."},x:{type:"number",description:"tap (with y, unless id or label is given) or swipe (required): start point in device points."},y:{type:"number"},x2:{type:"number",description:"swipe (required, with y2): end point in device points."},y2:{type:"number"},id:{type:"string",description:"tap: accessibility identifier from inspect (instead of x and y)."},label:{type:"string",description:"tap: accessibility label from inspect (instead of x and y)."},duration:{type:"number",description:"tap: seconds held (above 0.5 is a long press); swipe: seconds."},text:{type:"string",description:"type (required): the text to type."},name:{type:"string",enum:[...H3],description:"button (required)."},url:{type:"string",description:"open_url (required): the URL or deep link."},mode:{type:"string",enum:["light","dark"],description:"appearance (required)."},steps:{type:"array",maxItems:30,description:"steps (required, at least one) or launch and run: run in order in one call (after launch, once the app is up). Each item is {action:'tap', id|label|x,y} | {action:'swipe', x,y,x2,y2} | {action:'type', text} | {action:'button', name} | {action:'sleep', seconds}. Taps by id or label wait for their element to appear.",items:{type:"object"}},observe:{type:"string",enum:["tree","screenshot","both","none"],description:"After tap, swipe, type, button, open_url, launch or steps: what to return about the settled screen. Default tree (the accessibility tree, so no separate inspect is needed); screenshot or both to see it."},wait_for:{type:"object",description:"After the action, wait until this element is on screen: {id} or {label}; add gone:true to wait for it to disappear.",properties:{id:{type:"string"},label:{type:"string"},gone:{type:"boolean"}},additionalProperties:!1},timeout:{type:"number",description:"Seconds to wait for wait_for (default 5, max 20)."},wait:{type:"boolean",description:"build or build_status: wait for the build to finish (up to ~45 s) instead of returning at once."},save_path:{type:"string",description:"screenshot: also save the full-resolution PNG at this path (absolute or relative to the Session's folder), for example to show the user."}},s5=C3.options.map(($)=>$.shape).filter(($)=>$.action.value!=="chrome"),qZ={tap:[{required:["x","y"]},{required:["id"]},{required:["label"]}],launch:[{required:["app_path"],without:["bundle_id"]},{required:["bundle_id"],without:["app_path"]}]},l5=new Set;function gZ($,J){let{description:Z,...Q}=$==="steps"&&J==="steps"?{...$2.steps,minItems:1}:$2[$];if(Z===void 0||l5.has($))return Q;return l5.add($),{...Q,description:Z}}var EZ=s5.flatMap(($)=>{let J=$.action.value,Z=Object.keys($).filter((K)=>Object.hasOwn($2,K)),Q=Z.filter((K)=>!$[K].safeParse(void 0).success);return(qZ[J]??[{required:[]}]).map((K)=>({type:"object",properties:Object.fromEntries([["action",{type:"string",const:J}],...["device_id","root_id",...Z].filter((B)=>!K.without?.includes(B)).map((B)=>[B,gZ(B,J)])]),required:["action",...Q,...K.required],additionalProperties:!1}))}),kZ={type:"object",properties:{action:{type:"string",enum:s5.map(($)=>$.action.value)},...$2},required:["action"],additionalProperties:!1},gG={...kZ,anyOf:EZ};import{spawn as j3}from"child_process";import{createHash as fZ}from"crypto";import{existsSync as w3,mkdirSync as J2,mkdtempSync as bZ,readdirSync as c5,readFileSync as n5,renameSync as xZ,rmSync as r5,symlinkSync as M3,writeFileSync as U1}from"fs";import{homedir as yZ}from"os";import{dirname as t5,join as x}from"path";import{createInterface as hZ}from"readline";var D3=`// Reason's simulator host: one warm process per booted iOS Simulator.
 //

package/bin/vm-hands/{vm-hands-entry-lite-3098ecjq.js → vm-hands-entry-lite-dsh32j5a.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ud as ae,Wd as ne}from"./vm-hands-entry-lite-6rzy866f.js";import{Ef as be}from"./vm-hands-entry-lite-afjzr3v2.js";import{ag as C,bg as ie,dg as M,eg as Oe,hg as Y,ig as z,jg as v,sg as O,tg as Be}from"./vm-hands-entry-lite-5p118s93.js";import{_g as Se}from"./vm-hands-entry-lite-kntkyezs.js";import{Pi as se}from"./vm-hands-entry-lite-9cgye69h.js";import{pj as J}from"./vm-hands-entry-lite-evzskkcd.js";import{vj as x}from"./vm-hands-entry-lite-wsnr4fx8.js";import{mk as Ne,nk as oe}from"./vm-hands-entry-lite-qg11k3bf.js";import{tk as ye,zk as Ie}from"./vm-hands-entry-lite-dj65hfea.js";import{Gk as xe}from"./vm-hands-entry-lite-rbjky7rd.js";import{Pk as p}from"./vm-hands-entry-lite-f28ehysx.js";import{spawn as S,spawnSync as pt}from"child_process";import{createHash as ft,randomUUID as Te}from"crypto";import{closeSync as mt,copyFileSync as de,existsSync as q,fstatSync as _t,mkdirSync as pe,openSync as ht,readdirSync as D,readFileSync as j,readlinkSync as wt,renameSync as ve,rmSync as gt,statSync as bt,writeFileSync as xt}from"fs";import{connect as St}from"net";import{tmpdir as F,userInfo as Re}from"os";import{basename as fe,delimiter as yt,dirname as B,join as f}from"path";var Z=`import { spawn, execFileSync } from "node:child_process";
+import{Ud as ae,Wd as ne}from"./vm-hands-entry-lite-ac8sdh78.js";import{Gf as be}from"./vm-hands-entry-lite-ky0w7t09.js";import{cg as C,dg as ie,fg as M,gg as Oe,jg as Y,kg as z,lg as v,ug as O,vg as Be}from"./vm-hands-entry-lite-vwpraybq.js";import{ah as Se}from"./vm-hands-entry-lite-9vf97byd.js";import{Ri as se}from"./vm-hands-entry-lite-159860ns.js";import{rj as J}from"./vm-hands-entry-lite-bmywbwj4.js";import{xj as x}from"./vm-hands-entry-lite-hye6r7dy.js";import{ok as Ne,pk as oe}from"./vm-hands-entry-lite-hd4a0a6f.js";import{Bk as Ie,vk as ye}from"./vm-hands-entry-lite-r2xmr627.js";import{Ik as xe}from"./vm-hands-entry-lite-8gjrr6hg.js";import{Rk as p}from"./vm-hands-entry-lite-40nkzw38.js";import{spawn as S,spawnSync as pt}from"child_process";import{createHash as ft,randomUUID as Te}from"crypto";import{closeSync as mt,copyFileSync as de,existsSync as q,fstatSync as _t,mkdirSync as pe,openSync as ht,readdirSync as D,readFileSync as j,readlinkSync as wt,renameSync as ve,rmSync as gt,statSync as bt,writeFileSync as xt}from"fs";import{connect as St}from"net";import{tmpdir as F,userInfo as Re}from"os";import{basename as fe,delimiter as yt,dirname as B,join as f}from"path";var Z=`import { spawn, execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
 import { tmpdir } from "node:os";

package/bin/vm-hands/{vm-hands-entry-lite-0tkwcetg.js → vm-hands-entry-lite-er3nrbb9.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Sk as e}from"./vm-hands-entry-lite-c3e25cks.js";var i=e((o,t)=>{t.exports={name:"playwright-core",version:"1.60.0",description:"A high-level API to automate web browsers",repository:{type:"git",url:"git+https://github.com/microsoft/playwright.git"},homepage:"https://playwright.dev",engines:{node:">=18"},author:{name:"Microsoft Corporation"},license:"Apache-2.0",exports:{".":{types:"./index.d.ts",import:"./index.mjs",require:"./index.js",default:"./index.js"},"./package.json":"./package.json","./lib/bootstrap":"./lib/bootstrap.js","./lib/coreBundle":"./lib/coreBundle.js","./lib/utilsBundle":"./lib/utilsBundle.js","./lib/tools/cli-client/program":"./lib/tools/cli-client/program.js"},bin:{"playwright-core":"cli.js"},types:"types/types.d.ts"}});
+import{Uk as e}from"./vm-hands-entry-lite-72nn2b4n.js";var i=e((o,t)=>{t.exports={name:"playwright-core",version:"1.60.0",description:"A high-level API to automate web browsers",repository:{type:"git",url:"git+https://github.com/microsoft/playwright.git"},homepage:"https://playwright.dev",engines:{node:">=18"},author:{name:"Microsoft Corporation"},license:"Apache-2.0",exports:{".":{types:"./index.d.ts",import:"./index.mjs",require:"./index.js",default:"./index.js"},"./package.json":"./package.json","./lib/bootstrap":"./lib/bootstrap.js","./lib/coreBundle":"./lib/coreBundle.js","./lib/utilsBundle":"./lib/utilsBundle.js","./lib/tools/cli-client/program":"./lib/tools/cli-client/program.js"},bin:{"playwright-core":"cli.js"},types:"types/types.d.ts"}});
 export{i as Ca};

package/bin/vm-hands/{vm-hands-entry-lite-26d4ttdx.js → vm-hands-entry-lite-fbpxs065.js}

@@ -1,3 +1,3 @@
 // @bun
 var p={REASON_API_KEY:"ARA_API_KEY",REASON_API_URL:"ARA_API_URL",REASON_CLI_CHANNEL:"ARA_CLI_CHANNEL",REASON_CLI_LAUNCHER_PATH:"ARA_CLI_LAUNCHER_PATH",REASON_MANAGED_RUNTIME_ROOT:"ARA_MANAGED_RUNTIME_ROOT",REASON_INSTALL_ALIAS_PATH:"ARA_INSTALL_ALIAS_PATH",REASON_INSTALL_DIR:"ARA_INSTALL_DIR",REASON_INSTALL_METHOD:"ARA_INSTALL_METHOD",REASON_INSTALL_PINNED_VERSION:"ARA_INSTALL_PINNED_VERSION",REASON_INSTALL_UPGRADE:"ARA_INSTALL_UPGRADE"},z=Object.values(p),x=new Set;function B(k,j){let q=k[j];if(q?.trim())return q;let w=k[p[j]];if(w?.trim())x.add(p[j]);return w}function D(k,j){return{[k]:j,[p[k]]:j}}
-export{B as Li,D as Mi};
+export{B as Ni,D as Oi};