@reason-machines/cli-linux-arm64 0.2.405 → 0.2.407

package/bin/vm-hands/{vm-hands-entry-lite-3098ecjq.js → vm-hands-entry-lite-vr4sva78.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ud as ae,Wd as ne}from"./vm-hands-entry-lite-6rzy866f.js";import{Ef as be}from"./vm-hands-entry-lite-afjzr3v2.js";import{ag as C,bg as ie,dg as M,eg as Oe,hg as Y,ig as z,jg as v,sg as O,tg as Be}from"./vm-hands-entry-lite-5p118s93.js";import{_g as Se}from"./vm-hands-entry-lite-kntkyezs.js";import{Pi as se}from"./vm-hands-entry-lite-9cgye69h.js";import{pj as J}from"./vm-hands-entry-lite-evzskkcd.js";import{vj as x}from"./vm-hands-entry-lite-wsnr4fx8.js";import{mk as Ne,nk as oe}from"./vm-hands-entry-lite-qg11k3bf.js";import{tk as ye,zk as Ie}from"./vm-hands-entry-lite-dj65hfea.js";import{Gk as xe}from"./vm-hands-entry-lite-rbjky7rd.js";import{Pk as p}from"./vm-hands-entry-lite-f28ehysx.js";import{spawn as S,spawnSync as pt}from"child_process";import{createHash as ft,randomUUID as Te}from"crypto";import{closeSync as mt,copyFileSync as de,existsSync as q,fstatSync as _t,mkdirSync as pe,openSync as ht,readdirSync as D,readFileSync as j,readlinkSync as wt,renameSync as ve,rmSync as gt,statSync as bt,writeFileSync as xt}from"fs";import{connect as St}from"net";import{tmpdir as F,userInfo as Re}from"os";import{basename as fe,delimiter as yt,dirname as B,join as f}from"path";var Z=`import { spawn, execFileSync } from "node:child_process";
+import{Ud as ae,Wd as ne}from"./vm-hands-entry-lite-r6f6qkw6.js";import{Gf as be}from"./vm-hands-entry-lite-ky0w7t09.js";import{cg as C,dg as ie,fg as M,gg as Oe,jg as Y,kg as z,lg as v,ug as O,vg as Be}from"./vm-hands-entry-lite-q590arx5.js";import{ah as Se}from"./vm-hands-entry-lite-9vf97byd.js";import{Ri as se}from"./vm-hands-entry-lite-7k3vp3fe.js";import{rj as J}from"./vm-hands-entry-lite-4bgxq9ps.js";import{xj as x}from"./vm-hands-entry-lite-hye6r7dy.js";import{ok as Ne,pk as oe}from"./vm-hands-entry-lite-hd4a0a6f.js";import{Bk as Ie,vk as ye}from"./vm-hands-entry-lite-r2xmr627.js";import{Ik as xe}from"./vm-hands-entry-lite-8gjrr6hg.js";import{Rk as p}from"./vm-hands-entry-lite-40nkzw38.js";import{spawn as S,spawnSync as pt}from"child_process";import{createHash as ft,randomUUID as Te}from"crypto";import{closeSync as mt,copyFileSync as de,existsSync as q,fstatSync as _t,mkdirSync as pe,openSync as ht,readdirSync as D,readFileSync as j,readlinkSync as wt,renameSync as ve,rmSync as gt,statSync as bt,writeFileSync as xt}from"fs";import{connect as St}from"net";import{tmpdir as F,userInfo as Re}from"os";import{basename as fe,delimiter as yt,dirname as B,join as f}from"path";var Z=`import { spawn, execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
 import { tmpdir } from "node:os";

package/bin/vm-hands/{vm-hands-entry-lite-bk5acpe9.js → vm-hands-entry-lite-wa261sf8.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Ec as v,zc as q}from"./vm-hands-entry-lite-heehk76b.js";function A(j=process.platform){if(q(),j==="linux"||j==="win32")v("strict")}
+import{Ec as v,zc as q}from"./vm-hands-entry-lite-yg5h9mhm.js";function A(j=process.platform){if(q(),j==="linux"||j==="win32")v("strict")}
 export{A as r};

package/bin/vm-hands/{vm-hands-entry-lite-x96qadgp.js → vm-hands-entry-lite-wer0qzxg.js}

@@ -64,4 +64,4 @@ var e=String.raw`(function(require) {
     },
   };
 })`;
-export{e as Ok};
+export{e as Qk};

package/bin/vm-hands/{vm-hands-entry-lite-8v6qhfxc.js → vm-hands-entry-lite-xqve205b.js}

@@ -242,4 +242,4 @@ var e=String.raw`(function(loadFfi, existsSync) {
   }
   return { available, unavailableReason, defaultShell, shellArgs, quoteArg, environmentBlock, spawn };
 })`;
-export{e as ah};
+export{e as ch};

package/bin/vm-hands/{vm-hands-entry-lite-heehk76b.js → vm-hands-entry-lite-yg5h9mhm.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Jc as n}from"./vm-hands-entry-lite-400hmvkg.js";import{fd as r}from"./vm-hands-entry-lite-nqvb7a2m.js";import{Ck as a,Dk as s,Gk as i}from"./vm-hands-entry-lite-rbjky7rd.js";import{Pk as B}from"./vm-hands-entry-lite-f28ehysx.js";import{spawn as f,spawnSync as v}from"child_process";import{existsSync as U,mkdtempSync as o,readFileSync as t,readdirSync as _j,realpathSync as Sj,rmSync as e,statSync as jj}from"fs";import{platform as h,tmpdir as qj}from"os";import{dirname as E,join as H,win32 as T}from"path";import{fileURLToPath as Mj,pathToFileURL as y}from"url";var kj=["bwrap","socat","rg"],Fj=2000,g=20000,Pj=3,w=4000,Ej=new Set([".git",".hg",".svn","node_modules"]),Rj=["runAsHostUid","sysrq-trigger"],zj=H(E(E(Mj(import.meta.url))),"packages","sandbox-runtime"),Dj=H(zj,"src","index.ts"),Gj=!1;function oj(){Gj=!0}function Jj(){return Gj?H(E(Sj(process.execPath)),"runtime","srt"):void 0}function C(){let j=H(Jj()??zj,"vendor","srt-win"),q=H(j,process.arch,"srt-win.exe"),G=H(j,"arm64","srt-win.exe");return process.arch==="x64"&&!U(q)&&U(G)?G:q}var tj="confined commands need the Windows sandbox: run `reason connect` and approve the Windows prompt.";function ej(j=C()){let q=v(j,["status"],{encoding:"utf8",timeout:15000,windowsHide:!0});try{let G=JSON.parse(q.stdout??"");return q.status===0&&G.user?.user?.exists===!0&&G.user.cred_present===!0}catch{return!1}}function jq(j=C()){let q=v(j,["install"],{stdio:["ignore","ignore","ignore"],timeout:120000,windowsHide:!0});return q.status===0?"installed":q.status===10?"cancelled":"failed"}async function Kj(){let j=Jj();if(j&&process.platform==="linux"&&!U(H(j,"vendor","seccomp",process.arch,"apply-seccomp")))throw Error("packaged_sandbox_runtime_vendor_missing");if(j&&process.platform==="win32"&&!U(C()))throw Error("packaged_sandbox_runtime_vendor_missing");if(j){let J=t(H(j,"sandbox-runtime.mjs"),"utf8");for(let K of Rj)if(!J.includes(K))throw Error(`packaged_sandbox_runtime_fork_missing:${K}`)}let z=(await import(j?y(H(j,"sandbox-runtime.mjs")).href:y(Dj).href)).SandboxManager;if(!z||typeof z.initialize!=="function"||typeof z.wrapWithSandboxArgv!=="function")throw Error("sandbox-runtime does not expose the expected SandboxManager API.");return{SandboxManager:z}}function Wj(j={}){if((j.platformName??h())!=="linux")return!1;let G=j.fileExists??U,z=j.readFile??((J)=>t(J,"utf8"));for(let J of["/.dockerenv","/run/.containerenv"])try{if(G(J))return!0}catch{}try{return/docker|containerd|kubepods|lxc|libpod/.test(z("/proc/1/cgroup"))}catch{return!1}}function Qj(j){return["/bin/true","/usr/bin/true"].find((q)=>j(q))??null}function xj(j,q){return j==="strict"?["--ro-bind","/","/","--unshare-pid","--unshare-user","--cap-drop","ALL","--proc","/proc","--",q]:["--ro-bind","/","/","--unshare-pid","--unshare-user","--bind","/proc","/proc","--",q]}function Oj(j,q){try{let G=v("bwrap",xj(j,q),{stdio:"ignore",timeout:Fj});return!G.error&&G.status===0}catch{return!1}}function fj(j){let q=j.platformName??h(),G=j.fileExists??U;if(q==="win32")return(j.bash??a)()&&G(C())?X??"strict":null;if(q!=="linux")return null;let z=j.hasExecutable??r;if(!kj.every((V)=>z(V)))return null;let J=Qj(G);if(!J)return null;let K=X??(j.containerized??Wj({platformName:q})?"weak":"strict");return(j.probeNamespaces??((V)=>Oj(V,J)))(K)?K:null}var _=null,R=!1,Y=null,c=null,u=null,X=null,S=null,P=null,M=null,D=[],N=new Map;function W(){throw A("sandbox_mode_conflict"),new B("sandbox_unavailable","Sandbox process policy conflicts with an existing probe or session. Restart the worker.")}function qq(j){if(X!==null&&X!==j||R&&_!==null&&_!==j||S!==null&&S!==j)W();X=j}function A(j){if(!Y)process.stderr.write(`Reason worker: confined commands are off (${j})
+import{Jc as n}from"./vm-hands-entry-lite-69ray4x8.js";import{fd as r}from"./vm-hands-entry-lite-nqvb7a2m.js";import{Ek as a,Fk as s,Ik as i}from"./vm-hands-entry-lite-8gjrr6hg.js";import{Rk as B}from"./vm-hands-entry-lite-40nkzw38.js";import{spawn as f,spawnSync as v}from"child_process";import{existsSync as U,mkdtempSync as o,readFileSync as t,readdirSync as _j,realpathSync as Sj,rmSync as e,statSync as jj}from"fs";import{platform as h,tmpdir as qj}from"os";import{dirname as E,join as H,win32 as T}from"path";import{fileURLToPath as Mj,pathToFileURL as y}from"url";var kj=["bwrap","socat","rg"],Fj=2000,g=20000,Pj=3,w=4000,Ej=new Set([".git",".hg",".svn","node_modules"]),Rj=["runAsHostUid","sysrq-trigger"],zj=H(E(E(Mj(import.meta.url))),"packages","sandbox-runtime"),Dj=H(zj,"src","index.ts"),Gj=!1;function oj(){Gj=!0}function Jj(){return Gj?H(E(Sj(process.execPath)),"runtime","srt"):void 0}function C(){let j=H(Jj()??zj,"vendor","srt-win"),q=H(j,process.arch,"srt-win.exe"),G=H(j,"arm64","srt-win.exe");return process.arch==="x64"&&!U(q)&&U(G)?G:q}var tj="confined commands need the Windows sandbox: run `reason connect` and approve the Windows prompt.";function ej(j=C()){let q=v(j,["status"],{encoding:"utf8",timeout:15000,windowsHide:!0});try{let G=JSON.parse(q.stdout??"");return q.status===0&&G.user?.user?.exists===!0&&G.user.cred_present===!0}catch{return!1}}function jq(j=C()){let q=v(j,["install"],{stdio:["ignore","ignore","ignore"],timeout:120000,windowsHide:!0});return q.status===0?"installed":q.status===10?"cancelled":"failed"}async function Kj(){let j=Jj();if(j&&process.platform==="linux"&&!U(H(j,"vendor","seccomp",process.arch,"apply-seccomp")))throw Error("packaged_sandbox_runtime_vendor_missing");if(j&&process.platform==="win32"&&!U(C()))throw Error("packaged_sandbox_runtime_vendor_missing");if(j){let J=t(H(j,"sandbox-runtime.mjs"),"utf8");for(let K of Rj)if(!J.includes(K))throw Error(`packaged_sandbox_runtime_fork_missing:${K}`)}let z=(await import(j?y(H(j,"sandbox-runtime.mjs")).href:y(Dj).href)).SandboxManager;if(!z||typeof z.initialize!=="function"||typeof z.wrapWithSandboxArgv!=="function")throw Error("sandbox-runtime does not expose the expected SandboxManager API.");return{SandboxManager:z}}function Wj(j={}){if((j.platformName??h())!=="linux")return!1;let G=j.fileExists??U,z=j.readFile??((J)=>t(J,"utf8"));for(let J of["/.dockerenv","/run/.containerenv"])try{if(G(J))return!0}catch{}try{return/docker|containerd|kubepods|lxc|libpod/.test(z("/proc/1/cgroup"))}catch{return!1}}function Qj(j){return["/bin/true","/usr/bin/true"].find((q)=>j(q))??null}function xj(j,q){return j==="strict"?["--ro-bind","/","/","--unshare-pid","--unshare-user","--cap-drop","ALL","--proc","/proc","--",q]:["--ro-bind","/","/","--unshare-pid","--unshare-user","--bind","/proc","/proc","--",q]}function Oj(j,q){try{let G=v("bwrap",xj(j,q),{stdio:"ignore",timeout:Fj});return!G.error&&G.status===0}catch{return!1}}function fj(j){let q=j.platformName??h(),G=j.fileExists??U;if(q==="win32")return(j.bash??a)()&&G(C())?X??"strict":null;if(q!=="linux")return null;let z=j.hasExecutable??r;if(!kj.every((V)=>z(V)))return null;let J=Qj(G);if(!J)return null;let K=X??(j.containerized??Wj({platformName:q})?"weak":"strict");return(j.probeNamespaces??((V)=>Oj(V,J)))(K)?K:null}var _=null,R=!1,Y=null,c=null,u=null,X=null,S=null,P=null,M=null,D=[],N=new Map;function W(){throw A("sandbox_mode_conflict"),new B("sandbox_unavailable","Sandbox process policy conflicts with an existing probe or session. Restart the worker.")}function qq(j){if(X!==null&&X!==j||R&&_!==null&&_!==j||S!==null&&S!==j)W();X=j}function A(j){if(!Y)process.stderr.write(`Reason worker: confined commands are off (${j})
 `);Y=j}function Vj(j){if(Y)return!1;if(!R){if(_=fj(j??{}),R=!0,_&&!j)Yj()}return _!==null}function vj(){return Vj()?_:null}var k=null,I=0;function x(j,q){if(Y)throw new B("sandbox_unavailable","Confined execution is unavailable in this worker process.");if(X&&j.sandboxMode&&X!==j.sandboxMode)W();let G=X??j.sandboxMode??vj();if(!G)throw new B("sandbox_unavailable","Confined command execution is unavailable on this operating system.");if(S&&S!==G)W();return S=G,k??=(async()=>{let{SandboxManager:z}=await(j.loadSandboxRuntime??Kj)();return await z.initialize(uj(G,q)),z})().catch((z)=>{if(k=null,q)P=null,process.stderr.write(`Reason worker: the Windows sandbox did not start for this folder (${String(z).slice(0,500)})
 `);else A(`initialize_failed: ${String(z)}`);throw z instanceof B?z:new B("sandbox_unavailable","The confined execution sandbox failed to start.")}),k.then((z)=>{if(Y)throw new B("sandbox_unavailable","Confined execution became unavailable during sandbox initialization.");return z})}function O(){if(I-=1,I===0)for(let j of D.splice(0))j()}async function Zj(j,q=!0,G,z){let J=z===void 0?1/0:Date.now()+z;await Bj();let K=bj();if(q)await K;let Q=JSON.stringify(j),V=!1,$=()=>{if(!V)return;V=!1;let Z=(N.get(Q)??1)-1;if(Z>0)N.set(Q,Z);else N.delete(Q)};try{for(;;){if(G?.aborted)throw new B("cancelled","Operation was cancelled.");if(Date.now()>=J)return!1;if(M){await M;continue}let Z=N.keys().next().value;if(P??=Z??Q,P===Q&&(Z===void 0||Z===Q))break;if(!V){V=!0,N.set(Q,(N.get(Q)??0)+1);continue}if(I===0&&Z===Q){$j();continue}await new Promise((L)=>{if(D.push(L),G?.addEventListener("abort",()=>L(),{once:!0}),J!==1/0)setTimeout(L,Math.max(0,J-Date.now())).unref?.()})}return I+=1,!0}finally{if(V&&I===0)for(let Z of D.splice(0))Z();$()}}function $j(){return M??=Xj().finally(()=>{M=null}),M}function Hj(j,q,G=process.env){let z=G.USERPROFILE?T.resolve(G.USERPROFILE).toLowerCase():null,J=T.resolve(j).toLowerCase(),K=z!==null&&J.startsWith(`${z}\\`),Q=q?Lj(G).filter((V)=>V.toLowerCase()===J||V.toLowerCase().startsWith(`${J}\\`)):[];return{denyRead:[],allowRead:[j],allowWrite:q?[j]:[],denyWrite:q?Q:K?[]:[j]}}function Lj(j,q=process.execPath){let G=new Map;for(let z of[...(j.PATH??j.Path??"").split(";"),T.dirname(q)]){if(!z||!T.isAbsolute(z))continue;let J=T.resolve(z);if(!G.has(J.toLowerCase()))G.set(J.toLowerCase(),J)}return[...G.values()]}function hj(j=process.env,q=process.execPath){let G=[j.SystemRoot,j.ProgramFiles,j["ProgramFiles(x86)"],j.ProgramW6432,j.ProgramData,j.USERPROFILE].filter((z)=>!!z).map((z)=>T.resolve(z).toLowerCase());return Lj(j,q).filter((z)=>{let J=z.toLowerCase();return!G.some((K)=>J===K||J.startsWith(`${K}\\`))})}var l=null,m=null;function Bj(j=C()){return m??=(async()=>{let q;try{q=JSON.parse((await Uj(j,["status"])).stdout).user?.user?.sid}catch{return null}if(typeof q!=="string"||!/^S-1-[0-9-]+$/.test(q))return null;if(!await new Promise((z)=>{let J=f(i("icacls"),[j,"/grant",`*${q}:(RX)`],{stdio:"ignore",windowsHide:!0,timeout:30000});J.on("error",()=>z(!1)),J.on("close",(K)=>z(K===0))}))process.stderr.write(`Reason worker: could not let the Windows sandbox user run srt-win.exe
 `);return q})(),m}function Uj(j,q,G){return new Promise((z)=>{let J=f(j,q,{stdio:["pipe","pipe","ignore"],windowsHide:!0,timeout:120000}),K="";J.stdout?.setEncoding("utf8").on("data",(Q)=>{K+=Q}),J.on("error",()=>z({status:null,stdout:K})),J.on("close",(Q)=>z({status:Q,stdout:K})),J.stdin?.end(G??"")})}function bj(j=C()){return l??=(async()=>{let q=hj();if(q.length===0)return;let G=await Bj(j),z=G?await Uj(j,["acl","stamp","--holder-pid",String(process.ppid),"--sandbox-user-sid",G],JSON.stringify({denyRead:[],denyWrite:q})):null;if(!z||z.status!==0&&z.status!==2)A(`program_folder_deny_failed: ${z?`exit ${z.status}`:"no sandbox user"}`),process.stderr.write(`Reason worker: could not deny the Windows sandbox writes to PATH folders (${z?`exit ${z.status}`:"no sandbox user"}); confined commands are off

package/bin/vm-hands/{vm-hands-entry-lite-wtc8ebkr.js → vm-hands-entry-lite-yqrmr2c8.js}

@@ -1,5 +1,5 @@
 // @bun
-import{ti as v}from"./vm-hands-entry-lite-399rn7a2.js";import{Bi as o,Ei as g,Fi as h,Gi as a,vi as r}from"./vm-hands-entry-lite-caxtg4j7.js";import{vj as V}from"./vm-hands-entry-lite-wsnr4fx8.js";import{sk as U}from"./vm-hands-entry-lite-ysk49bnz.js";import{createHmac as mQ,createPublicKey as CQ,randomBytes as LQ,randomUUID as t,verify as EQ}from"crypto";import{chmodSync as _,existsSync as e,mkdirSync as IQ,readFileSync as gQ,realpathSync as hQ,renameSync as vQ,statSync as yQ,unlinkSync as uQ,writeFileSync as pQ}from"fs";import{basename as cQ,dirname as F,isAbsolute as QQ,join as A,resolve as lQ}from"path";var WZ=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var zQ="REASON_DESKTOP_RUNTIME",UQ="REASON_DESKTOP_RUNTIME_CHANNEL",JQ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",MQ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",zZ={[zQ]:"ARA_DESKTOP_RUNTIME",[UQ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[JQ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[MQ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function m(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as N,existsSync as z,mkdirSync as O,readFileSync as C,realpathSync as xQ,renameSync as wQ,unlinkSync as R,writeFileSync as f}from"fs";import{createPrivateKey as KQ,createPublicKey as VQ,generateKeyPairSync as AQ,randomUUID as NQ,sign as OQ}from"crypto";import{createRequire as RQ}from"module";import{homedir as fQ,platform as y}from"os";import{dirname as kQ,join as J}from"path";var L=1,BQ=16384,M=65536,_Q=128,TQ=128,u=65536;class q extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function p(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var k=null;function c(){if(!k)try{k=RQ(import.meta.url)("bun:ffi")}catch{throw new q("native_boundary_unavailable")}return k}function FQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function PQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new q("invalid_credential_record");let Z=Q,$=FQ(Z.apiOrigin);if(Z.version!==L||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new q("invalid_credential_record");return{version:L,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function DQ(Q=process.execPath){let Z=Q;try{Z=xQ(Q)}catch{}return v(kQ(Z))}function j(Q){return c().ptr(Q)}function bQ(Q){if(!z(Q))throw new q("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=c();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(W){if(W instanceof q)throw W;throw new q("native_boundary_unavailable")}}function E(Q){return Buffer.from(Q).toString("base64url")}function x(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function l(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class d{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=DQ(),Z=y(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;m($)}symbols(){if(this.runtimePlatform!=="darwin")throw new q("unsupported_platform");this.library??=bQ(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(j(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new q("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(_Q),$=new BigUint64Array(1),W=Q==="load"?this.symbols().ara_device_key_load_public(j(Z),BigInt(Z.byteLength),j($)):this.symbols().ara_device_key_create_fresh_public(j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X!==65)throw new q("invalid_public_key");let Y=E(Z.subarray(0,X));if(!x(Y))throw new q("invalid_public_key");return Y}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=new Uint8Array(TQ),$=new BigUint64Array(1),W=this.symbols().ara_device_key_sign(j(Q),BigInt(Q.byteLength),j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q("proof_sign_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X<1||X>Z.byteLength)throw new q("invalid_signature");let Y=Z.subarray(0,X);if(!l(Y))throw new q("invalid_signature");return E(Y)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(j(Q));if(Z!==0||Q[0]!==1)throw new q("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(j(Q));if(Z!==0)throw new q("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(M),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("binding_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_binding");return Q.slice(0,W)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_create(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_update(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(j(Q));if(Z!==0)throw new q("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array(BQ),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("legacy_credential_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_credential_record");try{let X=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,W));return PQ(JSON.parse(X))}catch(X){if(X instanceof q)throw X;throw new q("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(j(Q));if(Z!==0)throw new q("legacy_credential_delete_failed",Z);return Q[0]===1}}function I(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new q("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),W=Buffer.from(Z.y,"base64url");if($.byteLength!==32||W.byteLength!==32)throw new q("invalid_public_key");let X=Buffer.concat([Buffer.of(4),$,W]).toString("base64url");if(!x(X))throw new q("invalid_public_key");return X}function SQ(){let Q=process.env.XDG_CONFIG_HOME?.trim()||J(fQ(),".config");h(Q);let Z=J(Q,"ara");return g(Z)?Z:J(Q,"reason")}class i{directory;constructor(Q=SQ()){this.directory=Q}keyPath(){return J(this.directory,"local-device.key")}bindingPath(){return J(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!z(Q))throw new q("proof_key_read_failed");try{let Z=C(Q,"utf8");return KQ({key:Z,format:"pem"})}catch{throw new q("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=VQ(Q);return I(Z)}createFreshPublicKey(){O(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=AQ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),W=this.keyPath();return f(W,$,{mode:384}),N(W,384),I(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=OQ("sha256",Q,Z)}catch{throw new q("proof_sign_failed")}if(!l($))throw new q("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!z(Q))return!1;return R(Q),!0}loadBinding(){let Q=this.bindingPath();if(!z(Q))return null;try{return new Uint8Array(C(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(z(Z))throw new q("binding_create_failed");f(Z,Q,{mode:384}),N(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!z(Z))throw new q("binding_update_failed");let $=`${Z}.${NQ()}`;try{f($,Q,{mode:384,flag:"wx"}),N($,384),wQ($,Z)}finally{if(z($))R($)}}deleteBinding(){let Q=this.bindingPath();if(!z(Q))return!1;return R(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function B(){return y()==="darwin"?new d:new i}var w=U.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/),s=U.object({id:w,kind:U.literal("permission_denied"),operation:U.enum(["bash","read","write","edit"]),provenance:U.enum(["sandbox_policy","os_permission_unknown"]),occurredAt:U.string().datetime(),expiresAt:U.string().datetime(),sessionId:w,deviceId:w,organizationId:w}).strict();var P=4;var K="macos-keychain-p256-v1",ZQ=1,dQ=`ARA-DEVICE-BINDING-V1
+import{vi as v}from"./vm-hands-entry-lite-2nec0vk1.js";import{Di as o,Gi as g,Hi as h,Ii as a,xi as r}from"./vm-hands-entry-lite-q4tcfj61.js";import{xj as V}from"./vm-hands-entry-lite-hye6r7dy.js";import{uk as U}from"./vm-hands-entry-lite-vr38bh6k.js";import{createHmac as mQ,createPublicKey as CQ,randomBytes as LQ,randomUUID as t,verify as EQ}from"crypto";import{chmodSync as _,existsSync as e,mkdirSync as IQ,readFileSync as gQ,realpathSync as hQ,renameSync as vQ,statSync as yQ,unlinkSync as uQ,writeFileSync as pQ}from"fs";import{basename as cQ,dirname as F,isAbsolute as QQ,join as A,resolve as lQ}from"path";var WZ=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var zQ="REASON_DESKTOP_RUNTIME",UQ="REASON_DESKTOP_RUNTIME_CHANNEL",JQ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",MQ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",zZ={[zQ]:"ARA_DESKTOP_RUNTIME",[UQ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[JQ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[MQ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function m(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as N,existsSync as z,mkdirSync as O,readFileSync as C,realpathSync as xQ,renameSync as wQ,unlinkSync as R,writeFileSync as f}from"fs";import{createPrivateKey as KQ,createPublicKey as VQ,generateKeyPairSync as AQ,randomUUID as NQ,sign as OQ}from"crypto";import{createRequire as RQ}from"module";import{homedir as fQ,platform as y}from"os";import{dirname as kQ,join as J}from"path";var L=1,BQ=16384,M=65536,_Q=128,TQ=128,u=65536;class q extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function p(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var k=null;function c(){if(!k)try{k=RQ(import.meta.url)("bun:ffi")}catch{throw new q("native_boundary_unavailable")}return k}function FQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function PQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new q("invalid_credential_record");let Z=Q,$=FQ(Z.apiOrigin);if(Z.version!==L||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new q("invalid_credential_record");return{version:L,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function DQ(Q=process.execPath){let Z=Q;try{Z=xQ(Q)}catch{}return v(kQ(Z))}function j(Q){return c().ptr(Q)}function bQ(Q){if(!z(Q))throw new q("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=c();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(W){if(W instanceof q)throw W;throw new q("native_boundary_unavailable")}}function E(Q){return Buffer.from(Q).toString("base64url")}function x(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function l(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class d{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=DQ(),Z=y(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;m($)}symbols(){if(this.runtimePlatform!=="darwin")throw new q("unsupported_platform");this.library??=bQ(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(j(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new q("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(_Q),$=new BigUint64Array(1),W=Q==="load"?this.symbols().ara_device_key_load_public(j(Z),BigInt(Z.byteLength),j($)):this.symbols().ara_device_key_create_fresh_public(j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X!==65)throw new q("invalid_public_key");let Y=E(Z.subarray(0,X));if(!x(Y))throw new q("invalid_public_key");return Y}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=new Uint8Array(TQ),$=new BigUint64Array(1),W=this.symbols().ara_device_key_sign(j(Q),BigInt(Q.byteLength),j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q("proof_sign_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X<1||X>Z.byteLength)throw new q("invalid_signature");let Y=Z.subarray(0,X);if(!l(Y))throw new q("invalid_signature");return E(Y)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(j(Q));if(Z!==0||Q[0]!==1)throw new q("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(j(Q));if(Z!==0)throw new q("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(M),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("binding_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_binding");return Q.slice(0,W)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_create(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_update(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(j(Q));if(Z!==0)throw new q("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array(BQ),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("legacy_credential_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_credential_record");try{let X=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,W));return PQ(JSON.parse(X))}catch(X){if(X instanceof q)throw X;throw new q("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(j(Q));if(Z!==0)throw new q("legacy_credential_delete_failed",Z);return Q[0]===1}}function I(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new q("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),W=Buffer.from(Z.y,"base64url");if($.byteLength!==32||W.byteLength!==32)throw new q("invalid_public_key");let X=Buffer.concat([Buffer.of(4),$,W]).toString("base64url");if(!x(X))throw new q("invalid_public_key");return X}function SQ(){let Q=process.env.XDG_CONFIG_HOME?.trim()||J(fQ(),".config");h(Q);let Z=J(Q,"ara");return g(Z)?Z:J(Q,"reason")}class i{directory;constructor(Q=SQ()){this.directory=Q}keyPath(){return J(this.directory,"local-device.key")}bindingPath(){return J(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!z(Q))throw new q("proof_key_read_failed");try{let Z=C(Q,"utf8");return KQ({key:Z,format:"pem"})}catch{throw new q("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=VQ(Q);return I(Z)}createFreshPublicKey(){O(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=AQ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),W=this.keyPath();return f(W,$,{mode:384}),N(W,384),I(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=OQ("sha256",Q,Z)}catch{throw new q("proof_sign_failed")}if(!l($))throw new q("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!z(Q))return!1;return R(Q),!0}loadBinding(){let Q=this.bindingPath();if(!z(Q))return null;try{return new Uint8Array(C(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(z(Z))throw new q("binding_create_failed");f(Z,Q,{mode:384}),N(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!z(Z))throw new q("binding_update_failed");let $=`${Z}.${NQ()}`;try{f($,Q,{mode:384,flag:"wx"}),N($,384),wQ($,Z)}finally{if(z($))R($)}}deleteBinding(){let Q=this.bindingPath();if(!z(Q))return!1;return R(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function B(){return y()==="darwin"?new d:new i}var w=U.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/),s=U.object({id:w,kind:U.literal("permission_denied"),operation:U.enum(["bash","read","write","edit"]),provenance:U.enum(["sandbox_policy","os_permission_unknown"]),occurredAt:U.string().datetime(),expiresAt:U.string().datetime(),sessionId:w,deviceId:w,organizationId:w}).strict();var P=4;var K="macos-keychain-p256-v1",ZQ=1,dQ=`ARA-DEVICE-BINDING-V1
 `;function iQ(Q){return Q===void 0||typeof Q==="number"&&Number.isInteger(Q)&&Q>=1&&Q<=4}function $Q(Q,Z=Date.now()){let $=s.safeParse(Q);if(!$.success)return!1;let W=$.data,X=typeof W.occurredAt==="string"?Date.parse(W.occurredAt):NaN,Y=typeof W.expiresAt==="string"?Date.parse(W.expiresAt):NaN;return W.kind==="permission_denied"&&["bash","read","write","edit"].includes(W.operation)&&["sandbox_policy","os_permission_unknown"].includes(W.provenance)&&Number.isFinite(X)&&X<=Z&&Y>Z&&Y>X&&Y-X<=600000}function LZ(Q,Z,$=Date.now()){if(!Q||!Z||Q.state!=="connected"||Q.deviceId!==Z.deviceId)return null;let W=Date.parse(Q.lastHeartbeatAt??""),X=Q.permissionRecovery;if(!($-W>=0&&$-W<30000)||!$Q(X,$)||X.deviceId!==Z.deviceId||X.organizationId!==Z.orgId)return null;try{process.kill(Q.pid,0)}catch{return null}return X}function WQ(Q={},Z=V()){let $=r({env:{...process.env,...Q}}),W=Q.XDG_CONFIG_HOME?.trim()||A(Z,".config");return a(W,...$==="staging"?["staging"]:[])}function D(Q={},Z=V()){return A(WQ(Q,Z),"local-device.json")}function qQ(Q={},Z=V()){return A(WQ(Q,Z),"local-daemon.json")}function b(Q,Z){IQ(F(Q),{recursive:!0,mode:448}),_(F(Q),448);let $=`${Q}.${process.pid}.${t()}.tmp`;try{pQ($,`${JSON.stringify(Z,null,2)}
 `,{mode:384,flag:"wx"}),_($,384),vQ($,Q),_(Q,384)}finally{if(e($))uQ($)}return Q}function S(Q){if(!e(Q))return null;try{return JSON.parse(gQ(Q,"utf8"))}catch{return null}}function T(Q,Z,$){try{Q.onCredentialLifecycle?.({event:Z,...$?{reasonCode:$}:{}})}catch{}}function sQ(Q){if(!Array.isArray(Q))return null;let Z=[];for(let $ of Q){if(!$||typeof $!=="object")return null;let W=$;if(typeof W.id!=="string"||typeof W.label!=="string"||typeof W.path!=="string"||typeof W.pathFingerprint!=="string"||!W.permissions||typeof W.permissions.read!=="boolean"||typeof W.permissions.write!=="boolean"||typeof W.permissions.execute!=="boolean"||typeof W.permissions.discover_environment!=="boolean"||typeof W.permissions.expose_mcp!=="boolean")return null;Z.push({id:W.id,label:W.label,path:W.path,pathFingerprint:W.pathFingerprint,permissions:W.permissions})}return Z}function XQ(Q,Z,$=[]){let W=Object.keys(Q);return Z.every((X)=>Object.hasOwn(Q,X))&&W.every((X)=>Z.includes(X)||$.includes(X))}function nQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost")return null;return Z.origin}catch{return null}}function YQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q,$=sQ(Z.roots),W=nQ(Z.apiOrigin);if(!W||typeof Z.orgId!=="string"||typeof Z.deviceId!=="string"||typeof Z.displayName!=="string"||typeof Z.registeredAt!=="string"||!iQ(Z.handsSlots)||Z.worker!==void 0&&(!Z.worker||!/^[a-f0-9]{64}$/.test(Z.worker.configDigest)||!["persistent","ephemeral"].includes(Z.worker.lifetime)||!Number.isFinite(Date.parse(Z.worker.expiresAt)))||!$)return null;return{apiOrigin:W,orgId:Z.orgId,deviceId:Z.deviceId,displayName:Z.displayName,registeredAt:Z.registeredAt,...Z.handsSlots!==void 0?{handsSlots:Z.handsSlots}:{},...Z.worker!==void 0?{worker:Z.worker}:{},roots:$}}function rQ(Q){return{...Q,credentialStorage:K}}function oQ(Q){return{version:P,apiOrigin:Q.apiOrigin,orgId:Q.orgId,deviceId:Q.deviceId,devicePublicKey:Q.devicePublicKey,displayName:Q.displayName,registeredAt:Q.registeredAt,...Q.handsSlots!==void 0?{handsSlots:Q.handsSlots}:{},...Q.worker!==void 0?{worker:Q.worker}:{},roots:Q.roots.map((Z)=>({id:Z.id,label:Z.label,path:Z.path,pathFingerprint:Z.pathFingerprint,permissions:{read:Z.permissions.read,write:Z.permissions.write,execute:Z.permissions.execute,discover_environment:Z.permissions.discover_environment,expose_mcp:Z.permissions.expose_mcp}})),credentialStorage:K}}function jQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q;if(!XQ(Z,["version","apiOrigin","orgId","deviceId","devicePublicKey","displayName","registeredAt","roots","credentialStorage"],["handsSlots","worker"]))return null;let $=YQ(Z);if(!$||Z.version!==P||Z.credentialStorage!==K||!x(Z.devicePublicKey))return null;return{version:P,...$,devicePublicKey:Z.devicePublicKey,credentialStorage:K}}function GQ(Q){return new TextEncoder().encode(`${dQ}${JSON.stringify(oQ(Q))}`)}function aQ(Q){let Z=Buffer.from(Q,"base64url");return CQ({format:"jwk",key:{kty:"EC",crv:"P-256",x:Z.subarray(1,33).toString("base64url"),y:Z.subarray(33,65).toString("base64url")}})}function tQ(Q,Z){let $={version:ZQ,state:Q,signature:Z.sign(GQ(Q))};return new TextEncoder().encode(JSON.stringify($))}function HQ(Q){let Z;try{Z=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(Q))}catch{throw new q("invalid_binding")}if(!Z||typeof Z!=="object"||Array.isArray(Z))throw new q("invalid_binding");let $=Z;if(!XQ($,["version","state","signature"])||$.version!==ZQ||typeof $.signature!=="string"||!/^[A-Za-z0-9_-]{10,128}$/.test($.signature))throw new q("invalid_binding");let W=jQ($.state);if(!W)throw new q("invalid_binding");let X=!1;try{X=EQ("sha256",GQ(W),aQ(W.devicePublicKey),Buffer.from($.signature,"base64url"))}catch{X=!1}if(!X)throw new q("invalid_binding");return W}function eQ(Q){let{credentialStorage:Z,...$}=Q;return $}function QZ(Q){return Q instanceof q?p(Q):"credential_boundary_failed"}function EZ(Q=D(),Z={}){let $=S(Q),W=Z.proofStore??Z.credentialStore??B(),X=W.loadBinding();if(!X){if($&&typeof $==="object"&&!Array.isArray($)&&ZZ($))return null;if($!==null)throw new q("invalid_binding");return null}let Y=HQ(X),G=W.loadPublicKey();if(W.privateKeyIsNonExtractable(),G!==Y.devicePublicKey)throw new q("invalid_public_key");let H=jQ($);if(Z.repair!==!1&&(!H||JSON.stringify(H)!==JSON.stringify(Y)))b(Q,Y);return eQ(Y)}function ZZ(Q){let Z=Q,$=YQ(Q);if(!$)return null;if(Z.version===2){if(typeof Z.deviceCredential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.deviceCredential)||Z.deviceCredential.length>4096)return null;return{state:$,credentialSource:"plaintext-v2"}}if(Z.version!==3||Z.credentialStorage!=="macos-keychain-v1"||"deviceCredential"in Z)return null;return{state:$,credentialSource:"keychain-v3"}}function IZ(Q,Z=D(),$={}){let W=$.proofStore??$.credentialStore??B();T($,"credential.store_started");try{if(!x(Q.devicePublicKey)||W.loadPublicKey()!==Q.devicePublicKey)throw new q("invalid_public_key");W.privateKeyIsNonExtractable();let X=rQ(Q),Y=W.loadBinding();if(Y){let H=HQ(Y);if(H.devicePublicKey!==Q.devicePublicKey||H.orgId!==Q.orgId||H.deviceId!==Q.deviceId||H.apiOrigin!==Q.apiOrigin&&!o(H.apiOrigin,Q.apiOrigin))throw new q("invalid_binding")}let G=tQ(X,W);if(Y)W.updateBinding(G);else W.createBinding(G);return b(Z,X),T($,"credential.store_completed"),Z}catch(X){throw T($,"credential.store_failed",QZ(X)),X}}function gZ(Q=qQ()){let Z=S(Q);if(!Z||typeof Z!=="object")return null;let $=Z;if($.version!==1||typeof $.pid!=="number"||!Number.isInteger($.pid)||!["starting","connected","stopped","error"].includes($.state??"")||typeof $.startedAt!=="string"||$.lastHeartbeatAt!==void 0&&typeof $.lastHeartbeatAt!=="string"||$.lastUsedAt!==void 0&&typeof $.lastUsedAt!=="string"||$.organizationId!==void 0&&typeof $.organizationId!=="string"||$.organizationName!==void 0&&typeof $.organizationName!=="string"||$.organizationSlug!==void 0&&typeof $.organizationSlug!=="string"||$.error!==void 0&&typeof $.error!=="string"||$.reconnectingSince!==void 0&&typeof $.reconnectingSince!=="string"||$.workspace!==void 0&&typeof $.workspace!=="string")return null;if($.permissionRecovery!==void 0&&!$Q($.permissionRecovery))delete $.permissionRecovery;return $}function hZ(Q,Z=qQ()){return b(Z,Q)}var n=1;function $Z(Q=D()){return A(F(Q),"local-device.proxy.json")}function vZ(Q=$Z()){let Z=S(Q);if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let $=Z;if($.version!==n||typeof $.url!=="string"||$.url.length===0||$.caFile!==void 0&&(typeof $.caFile!=="string"||!QQ($.caFile)))return null;return{version:n,url:$.url,...$.caFile?{caFile:$.caFile}:{}}}function yZ(Q,Z={read:!0,write:!1,execute:!1,discover_environment:!1,expose_mcp:!1},$=LQ(32)){let W=new Set,X=[];for(let Y of Q){let G=hQ(QQ(Y)?Y:lQ(Y));if(!yQ(G).isDirectory())throw Error(`Local execution root is not a directory: ${Y}`);if(W.has(G))continue;W.add(G),X.push({id:t(),label:cQ(G)||G,path:G,pathFingerprint:mQ("sha256",$).update(G).digest("hex"),permissions:{...Z}})}if(X.length===0)throw Error("At least one explicit local execution root is required.");return X}
-export{q as Gg,DQ as Hg,x as Ig,l as Jg,d as Kg,i as Lg,$Q as Mg,LZ as Ng,D as Og,qQ as Pg,EZ as Qg,IZ as Rg,gZ as Sg,hZ as Tg,n as Ug,vZ as Vg,yZ as Wg};
+export{q as Ig,DQ as Jg,x as Kg,l as Lg,d as Mg,i as Ng,$Q as Og,LZ as Pg,D as Qg,qQ as Rg,EZ as Sg,IZ as Tg,gZ as Ug,hZ as Vg,n as Wg,vZ as Xg,yZ as Yg};

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,2 +1,2 @@
 // @bun
-import"./vm-hands-entry-lite-nnrypv7q.js";import"./vm-hands-entry-lite-afjzr3v2.js";import"./vm-hands-entry-lite-ysk49bnz.js";import{Vk as A}from"./vm-hands-entry-lite-c3e25cks.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-hv2w4727.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-nwhmvw7n.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();
+import"./vm-hands-entry-lite-8tcnbfnm.js";import"./vm-hands-entry-lite-ky0w7t09.js";import"./vm-hands-entry-lite-vr38bh6k.js";import{Xk as B}from"./vm-hands-entry-lite-72nn2b4n.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var z=(q,b={})=>console.log(JSON.stringify({stage:q,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:j}=await import("./vm-hands-op-runner-bbp6fzn2.js");await j();return}z("parsed",{t0:Math.round(G)});let q="";try{q=J(3,"utf8")}catch{}z("fd3_read",{bytes:q.length});let b=null;if(q.trim())try{b=JSON.parse(q)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))z(q.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:C,runVmHands:D}=await import("./vm-hands-runtime-2x1ryrxr.js"),A=C(b);if(!A)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await D(A,z)}catch(j){let E=j&&typeof j==="object"&&"code"in j&&typeof j.code==="string"?j.code:"error";throw z("failed",{code:E}),j}process.exit(0)}K();

package/bin/vm-hands/{vm-hands-executor-1r4qb5m0.js → vm-hands-executor-etthkykm.js}

@@ -1,5 +1,5 @@
 // @bun
-import{s as wq}from"./vm-hands-entry-lite-h9fs5a19.js";import{Ob as Nq,sc as Aq,yb as jq,yc as Rq}from"./vm-hands-entry-lite-2abf7fnn.js";import"./vm-hands-entry-lite-400hmvkg.js";import"./vm-hands-entry-lite-k9amte6k.js";import"./vm-hands-entry-lite-wts79wdn.js";import"./vm-hands-entry-lite-afjzr3v2.js";import"./vm-hands-entry-lite-wtc8ebkr.js";import"./vm-hands-entry-lite-kntkyezs.js";import"./vm-hands-entry-lite-8v6qhfxc.js";import"./vm-hands-entry-lite-0dr3sp75.js";import"./vm-hands-entry-lite-399rn7a2.js";import"./vm-hands-entry-lite-caxtg4j7.js";import"./vm-hands-entry-lite-26d4ttdx.js";import"./vm-hands-entry-lite-0mk8rxqv.js";import"./vm-hands-entry-lite-wsnr4fx8.js";import"./vm-hands-entry-lite-arw53mkf.js";import"./vm-hands-entry-lite-6zsxed0z.js";import"./vm-hands-entry-lite-ysk49bnz.js";import"./vm-hands-entry-lite-dj65hfea.js";import"./vm-hands-entry-lite-rbjky7rd.js";import"./vm-hands-entry-lite-b8bcnenf.js";import"./vm-hands-entry-lite-x96qadgp.js";import"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";import{spawn as gq}from"child_process";import{chmodSync as Sq,chownSync as Eq,existsSync as l,lstatSync as e,mkdirSync as r,mkdtempSync as yq,readdirSync as s,readFileSync as I,realpathSync as mq,rmdirSync as qq,rmSync as uq,writeFileSync as y}from"fs";import{join as L}from"path";import{readFileSync as Wq,readlinkSync as Gq}from"fs";import{relative as _q}from"path";var Jq=16;function Yq(X){return X.replace(/\\([0-7]{3})/g,($,W)=>String.fromCharCode(Number.parseInt(W,8)))}function hq(X){let $=[];for(let W of X.split(`
+import{s as wq}from"./vm-hands-entry-lite-2s9the7x.js";import{Ob as Nq,sc as Aq,yb as jq,yc as Rq}from"./vm-hands-entry-lite-va3vbvsk.js";import"./vm-hands-entry-lite-69ray4x8.js";import"./vm-hands-entry-lite-jcd21jpm.js";import"./vm-hands-entry-lite-5rkakg10.js";import"./vm-hands-entry-lite-ky0w7t09.js";import"./vm-hands-entry-lite-yqrmr2c8.js";import"./vm-hands-entry-lite-9vf97byd.js";import"./vm-hands-entry-lite-xqve205b.js";import"./vm-hands-entry-lite-mapxp682.js";import"./vm-hands-entry-lite-2nec0vk1.js";import"./vm-hands-entry-lite-q4tcfj61.js";import"./vm-hands-entry-lite-fbpxs065.js";import"./vm-hands-entry-lite-8f3px72v.js";import"./vm-hands-entry-lite-hye6r7dy.js";import"./vm-hands-entry-lite-6berk108.js";import"./vm-hands-entry-lite-05qq23fw.js";import"./vm-hands-entry-lite-vr38bh6k.js";import"./vm-hands-entry-lite-r2xmr627.js";import"./vm-hands-entry-lite-8gjrr6hg.js";import"./vm-hands-entry-lite-hepppjp0.js";import"./vm-hands-entry-lite-wer0qzxg.js";import"./vm-hands-entry-lite-40nkzw38.js";import"./vm-hands-entry-lite-72nn2b4n.js";import{spawn as gq}from"child_process";import{chmodSync as Sq,chownSync as Eq,existsSync as l,lstatSync as e,mkdirSync as r,mkdtempSync as yq,readdirSync as s,readFileSync as I,realpathSync as mq,rmdirSync as qq,rmSync as uq,writeFileSync as y}from"fs";import{join as L}from"path";import{readFileSync as Wq,readlinkSync as Gq}from"fs";import{relative as _q}from"path";var Jq=16;function Yq(X){return X.replace(/\\([0-7]{3})/g,($,W)=>String.fromCharCode(Number.parseInt(W,8)))}function hq(X){let $=[];for(let W of X.split(`
 `)){let q=W.split(" ");if(q.length<10||!/^\d+:\d+$/.test(q[2]))continue;$.push({device:q[2],root:Yq(q[3]),mountPoint:Yq(q[4])})}return $}function kq(X,$,W){let q=X.replace(/\/+$/,"")||"/",J=(F)=>q==="/"||F===q||F.startsWith(`${q}/`),G=(F)=>new Map(hq(F).filter((R)=>J(R.mountPoint)).map((R)=>[`${R.mountPoint}\x00${R.device}\x00${R.root}`,R.mountPoint])),Y=G($),A=G(W),j=(F)=>_q(q,F)||".",f=[...Y].filter(([F])=>!A.has(F)).map(([,F])=>j(F)),O=[...A].filter(([F])=>!Y.has(F)).map(([,F])=>j(F));return{missing:f,extra:O,referenceCount:Y.size,ownCount:A.size}}function Kq(X,$,W,q="/proc"){let J,G,Y=null;try{J=Wq(`${q}/1/mountinfo`,"utf8"),G=Wq(`${q}/self/mountinfo`,"utf8")}catch(R){let v=R&&typeof R==="object"&&"code"in R&&typeof R.code==="string"?R.code:"unreadable";$("vm_hands.mount_check_unavailable",{code:v});return}try{Y=Gq(`${q}/1/ns/mnt`)===Gq(`${q}/self/ns/mnt`)}catch{}let{missing:A,extra:j,referenceCount:f,ownCount:O}=kq(X,J,G),F={reference_count:f,own_count:O,missing_count:A.length,extra_count:j.length,same_namespace:Y};if(j.length)$("vm_hands.mount_extra",{...F,extra:j.slice(0,Jq)});if(A.length)throw $("vm_hands.mount_mismatch",{...F,missing:A.slice(0,Jq)}),W(`${A.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var Pq="/sys/fs/cgroup/reason-payload",H="vm-hands",lq="/run/ara-srt/fallbacks.jsonl",E="/reason-person",Xq=5000,cq=1e4,Bq="__VM_HANDS_PROOF_DIR__",pq="__VM_HANDS_PROBE_NONCE__";class D extends Error{code;constructor(X,$){super($);this.code=X}}function aq(X,$){if(!/^[0-9a-f-]{36}$/i.test($))throw new D("vm_hands_bind_invalid","bad bind id");return L(X,H,`b-${$.toLowerCase()}`)}var tq=5000,Iq=(X)=>`'${X.replaceAll("'","'\\''")}'`;function JX(X){let $=X.cgroup??Pq,W=X.init.layout.payload_uid,q=X.log??(()=>{}),J=new Map,G=new Map,Y=0,A=()=>{try{let Z=I("/run/ara-srt/starts.jsonl","utf8"),z=Z.slice(Y>Z.length?0:Y).split(`
 `).filter(Boolean);Y=Z.length;let K=z.map((U)=>{try{return Number(JSON.parse(U).elapsed_ms)||0}catch{return 0}});if(K.length)q("vm_hands.srt_server_starts",{count:K.length,elapsed_ms:K.slice(0,8)})}catch{}},j=null,f=!1,O=X.srtCgroup??"/sys/fs/cgroup/reason-srt",F=()=>{j??=Uq()},R=0,v=()=>{try{let Z=I(lq,"utf8"),z=Z.slice(R>Z.length?0:R);R=Z.length;let K=z.split(`
 `).filter(Boolean).slice(0,1000);if(!K.length)return null;let U={},T=0;for(let N of K)try{let M=JSON.parse(N),B=typeof M.code==="string"&&/^[a-z_]{1,40}$/.test(M.code)?M.code:"other";if(U[B]=(U[B]??0)+1,typeof M.elapsed_ms==="number")T=Math.max(T,M.elapsed_ms)}catch{U.unparsed=(U.unparsed??0)+1}return q("vm_hands.srt_fallbacks",{count:K.length,codes:U,max_elapsed_ms:T}),{count:K.length,codes:U,max_elapsed_ms:T}}catch{return null}},P=!1,m=(Z,z,K)=>{if(P)throw Error("vm_hands_pool_held");return vq(Z,z,K)},i=(Z)=>(z,K,U)=>gq("/bin/sh",["-c",`echo $$ > ${Iq(L(Z,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",z,...K],U),vq=i(L($,H)),u=L($,H,"probe"),g=(Z)=>aq($,Z),bq=(Z)=>{let z=g(Z);try{r(z,{mode:493})}catch(K){if(!(K&&typeof K==="object"&&("code"in K)&&K.code==="EEXIST"))throw new D("vm_hands_bind_failed","bind cgroup")}return z},xq=(Z)=>{try{qq(g(Z))}catch{}},x=X.prespawn?Nq({spawnProcess:m,...X.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:X.relayDependencies.sourceEntrypoint}:{},log:(Z,z)=>q(Z,z??{})}):null;x?.arm();let n=x?setInterval(()=>{x.arm()},tq):null;n?.unref?.();async function c(Z){let z=J.get(Z);if(J.delete(Z),!z)return;z.abort.abort(),await z.done}return{bindCgroup:g,async startExecutor(Z){if(F(),G.set(Z.bindId,Uq()),f=!0,!Z.claim)throw new D("vm_hands_bind_invalid","an executor needs the claim it serves");await c(Z.bindId);let{claim:z,bindId:K}=Z,U=bq(K),T=z.owner;if(!T||typeof T.device_id!=="string"||typeof z.root_id!=="string")throw new D("vm_hands_bind_invalid","claim without its owner Device or root");let N=new AbortController,M,B,V=new Promise((Q,w)=>{M=Q,B=w}),_,C=new Promise((Q)=>{_=Q}),S=Rq({headless:!0,hostExecution:!0,runtimeDirectory:X.runtimeDirectory,deviceIdentity:{deviceId:T.device_id,rootId:z.root_id,apiOrigin:X.apiOrigin},claimOwner:z.owner,root:X.root,runId:z.run_id,operationId:z.operation_id,attemptId:z.attempt_id,payload:Object.fromEntries(Object.entries(z.payload).filter(([Q])=>!Q.startsWith("vm_hands_"))),signal:N.signal,...Z.workspaceGrant?{workspaceGrant:Z.workspaceGrant}:{},emitEvent:async(Q,w)=>{if(Q==="hands.ready"){M(w);return}if(Q==="hands.started"||Q==="hands.stopped"||Q==="hands.failed")return;await X.forward(K,Q,w)}},{...X.relayDependencies,spawnWorker:(Q)=>i(U)(Q.command,Q.args,Q.options),...x?{takePrespawnedWorker:(Q)=>{let w=x.take(Q);if(!w?.pid)return w;try{return y(L(U,"cgroup.procs"),String(w.pid)),w}catch{try{w.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:x.adopt}:{}}).then(()=>{_("executor_stopped")},(Q)=>{let w=Q&&typeof Q==="object"&&"code"in Q?String(Q.code):"executor_failed";B(new D(w,Q instanceof Error?Q.message:String(Q))),_(w)}).finally(()=>B(new D("vm_hands_executor_exited","executor ended before it was ready")));J.set(K,{abort:N,done:S,exited:C,operationId:z.operation_id,runId:z.run_id,expiresAtMs:Date.parse(String(z.payload.expires_at??""))||0});let h=await V,p=h.executor_launch_id;if(typeof p!=="string")throw new D("vm_hands_bind_failed","executor ready without a launch id");return{launchId:p,readyData:h,applied:{hands_confinement:typeof z.payload.hands_confinement==="string"?z.payload.hands_confinement:null,browser_egress:z.payload.browser_egress??null}}},takeSrtFallbacks:v,executorExited(Z){return J.get(Z)?.exited??new Promise(()=>{})},freezeBind(Z){let z=g(Z);if(l(L(z,"cgroup.freeze")))y(L(z,"cgroup.freeze"),"1")},async killAndVerifyPayload(Z){let z=new Set(Z?.keep??[]);if(z.size||Z?.own)return Hq(Z?.bindId??null,z,Z?.own===!0);P=!0;let K=Tq();try{await Mq();let U=Promise.all([...J.keys()].map((B)=>c(B).catch(()=>{return})));A();let T=Date.now()+Xq;await a($,T,"payload"),await U;let N=(f||X.srtWarmLate?.()===!0)&&l(L(O,"cgroup.events"));if(N)await a(O,T,"srt");let M=$q(W).filter((B)=>!b(B,E));if(j!==null){let B=Zq(j).filter((V)=>V!==process.pid&&!b(V,E));if(B.length)throw q("vm_hands.kill_strays",{strays:t(B)}),new D("vm_hands_kill_unverified",`${B.length} process(es) the run started survived it`);j=null}if(f=!1,N)X.onSrtReset?.();if(M.length)throw q("vm_hands.kill_survivors",{pids:M.slice(0,16)}),new D("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside the payload cgroup`);G.clear();for(let B of zq())try{qq(L($,H,B))}catch{}}finally{P=!1,K()}if(x)setTimeout(()=>{if(!J.size)x.arm()},100).unref?.()},async killProbe(){let Z=Date.now()+Xq;if(l(L(u,"cgroup.events"))){await a(u,Z,"probe");try{qq(u)}catch{}}let z=Qq(process.pid);if(z===null)throw new D("vm_hands_kill_unverified","agent start time unreadable");await dq($,z,Z);let K=(T)=>{let N=Qq(T);return N!==null&&N<=z},U=$q(W).filter((T)=>K(T)&&!b(T,E));if(U.length)throw q("vm_hands.kill_survivors",{pids:U.slice(0,16),at:"attest"}),new D("vm_hands_kill_unverified",`${U.length} payload-uid process(es) from before this agent`);if(j!==null){let T=[$,L($,H)].map((B)=>B.replace(/^\/sys\/fs\/cgroup/,"")),N=O.replace(/^\/sys\/fs\/cgroup/,""),M=Zq(j).filter((B)=>B!==process.pid&&!b(B,E)&&!b(B,"/reason-vm-hands")&&!b(B,N)&&!T.some((V)=>Lq(B,V)));if(M.length&&f)throw q("vm_hands.kill_strays",{strays:t(M),at:"attest"}),new D("vm_hands_kill_unverified",`${M.length} process(es) the run started survived it`);if(M.length)q("vm_hands.attest_concurrent",{processes:t(M),count:M.length});j=null}},async runProbe({nonce:Z,script:z}){if(F(),!z.includes(Bq))throw new D("vm_hands_probe_failed","probe names no proof directory");let K=X.proofParent??"/tmp/reason-vm-hands-proof";r(K,{mode:457,recursive:!0});let U=e(K);if(U.isSymbolicLink()||!U.isDirectory()||U.uid!==(process.getuid?.()??-1)||(U.mode&4095)!==457)throw new D("vm_hands_probe_failed","proof parent is not root's 0711 directory");let T=yq(L(K,"p-")),N=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(T)||!/^[A-Za-z0-9_-]{1,128}$/.test(Z))throw new D("vm_hands_probe_failed","proof directory path or nonce");Eq(T,W,W),Sq(T,448);let M=e(T).ino;try{r(u,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new D("vm_hands_probe_failed","probe cgroup")}let B=i(u)("/bin/bash",["-c",z.replaceAll(Bq,T).replaceAll(pq,Z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),V="";B.stdout?.on("data",(C)=>{if(V.length<16384)V+=C.toString("utf8").slice(0,16384-V.length)});let _=await new Promise((C)=>{let S=setTimeout(()=>{N=!0,B.kill("SIGKILL"),C(124)},cq);B.once("error",()=>{clearTimeout(S),C(127)}),B.once("close",(h)=>{clearTimeout(S),C(h??1)})});return q("vm_hands.probe",{nonce_len:Z.length,exit_code:_}),{exitCode:_,markers:V,proofDirInode:M}}finally{if(!N)uq(T,{recursive:!0,force:!0})}},restatLayout(){let{session_root:Z,alias:z}=X.init.layout,K="invalid";try{Aq(Z),K="0:0:755"}catch{}let U=!1,T=-1;try{let N=e(z);T=N.uid,U=K==="0:0:755"&&z===L(Z,"repo")&&!N.isSymbolicLink()&&N.isDirectory()&&mq(z)===z&&N.uid===W}catch{}return{root_mode:K,alias_ok:U,owner_uid:T}},verifyMounts(){Kq(X.init.layout.session_root,q,(Z)=>new D("vm_hands_mount_mismatch",Z))},installEnvironment(Z,z){let K=J.get(Z);if(!K)throw new D("environment_unavailable","no executor owns an environment");return jq({root:X.root,operationId:K.operationId,payload:z}).installed_revision},async stop(){if(n)clearInterval(n);x?.close(),await Promise.all([...J.keys()].map((Z)=>c(Z)))}};function zq(){try{return s(L($,H),{withFileTypes:!0}).filter((Z)=>Z.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(Z.name)).map((Z)=>Z.name)}catch{return[]}}async function Hq(Z,z,K=!1){let U=new Set([...z].map((N)=>N.toLowerCase())),T=Tq();try{await Mq();let N=Date.now()+Xq,M=new Set(zq().filter((Q)=>!U.has(Q.slice(2))).map((Q)=>Q.slice(2)));if(Z)M.add(Z.toLowerCase());let B=null;for(let Q of M){let w=c(Q).catch(()=>{return}),o=G.get(Q);if(o!==void 0)B=B===null?o:Math.min(B,o);if(l(L(g(Q),"cgroup.events")))await a(g(Q),N,"bind");await w}let V=[...U].map((Q)=>g(Q).replace(/^\/sys\/fs\/cgroup/,"")),_=[$,L($,H)].map((Q)=>Q.replace(/^\/sys\/fs\/cgroup/,"")),C=O.replace(/^\/sys\/fs\/cgroup/,""),S=(Q)=>b(Q,E)||V.some((w)=>b(Q,w)),h=K?[]:$q(W).filter((Q)=>!S(Q));if(h.length)throw q("vm_hands.kill_survivors",{pids:h.slice(0,16),beside:U.size}),new D("vm_hands_kill_unverified",`${h.length} payload-uid process(es) outside a live bind`);let p=(Q)=>!S(Q)&&!b(Q,"/reason-vm-hands")&&!b(Q,C)&&!_.some((w)=>Lq(Q,w));if(B!==null){let Q=Zq(B).filter((w)=>w!==process.pid&&p(w));if(Q.length)throw q("vm_hands.kill_strays",{strays:t(Q),beside:U.size}),new D("vm_hands_kill_unverified",`${Q.length} process(es) the run started survived it`)}for(let Q of M)G.delete(Q),xq(Q)}finally{T()}}}function Qq(X,$="/proc"){try{let W=I(L($,String(X),"stat"),"utf8"),q=Number(W.slice(W.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(q)?q:null}catch{return null}}function Cq(X,$="/proc"){try{let W=I(L($,String(X),"stat"),"utf8"),q=Number(W.slice(W.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(q)?q:null}catch{return null}}async function dq(X,$,W){try{y(L(X,"cgroup.freeze"),"1")}catch(q){throw new D("vm_hands_kill_unverified",`payload cgroup.freeze: ${q instanceof Error?q.message:String(q)}`)}try{for(;;){let q=Oq(X).filter((G)=>fq(G,X)),J=new Set(q.filter((G)=>{let Y=Qq(G);return Y!==null&&Y<=$}));for(let G=!0;G;){G=!1;for(let Y of q){if(J.has(Y))continue;let A=Cq(Y);if(A!==null&&J.has(A))J.add(Y),G=!0}}if(J.size===0)return;if(Date.now()>W)throw new D("vm_hands_kill_unverified",`${J.size} previous-boot process(es) survived`);for(let G of J)try{process.kill(G,"SIGKILL")}catch{}await new Promise((G)=>setTimeout(G,10))}}finally{try{y(L(X,"cgroup.freeze"),"0")}catch{}}}function Lq(X,$,W="/proc"){try{return I(L(W,String(X),"cgroup"),"utf8").split(`

package/bin/vm-hands/vm-hands-op-runner-bbp6fzn2.js

@@ -0,0 +1,2 @@
+// @bun
+import{s as a,t as b,u as c}from"./vm-hands-entry-lite-2s9the7x.js";import"./vm-hands-entry-lite-40nkzw38.js";import"./vm-hands-entry-lite-72nn2b4n.js";export{b as spawnSessionPty,c as runVmHandsOpRunner,a as VM_HANDS_OP_RUNNER_PERSON_ARG};

package/bin/vm-hands/{vm-hands-runtime-nwhmvw7n.js → vm-hands-runtime-2x1ryrxr.js}

@@ -1,4 +1,4 @@
 // @bun
-import{Aa as m,Ba as l,za as k}from"./vm-hands-entry-lite-nnrypv7q.js";import{Oe as p}from"./vm-hands-entry-lite-afjzr3v2.js";import"./vm-hands-entry-lite-ysk49bnz.js";import{Vk as F}from"./vm-hands-entry-lite-c3e25cks.js";import{spawn as i}from"child_process";import{createHash as t}from"crypto";import{lstatSync as A,mkdirSync as s,readFileSync as d,statSync as e,writeFileSync as c}from"fs";var C="/run/reason-vm-hands",R="/run/reason-vm-hands/env",h="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",qj=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],Jj=65536,Qj=21600000;function Zj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let q=A(j);if(!q.isDirectory()||q.uid!==0||(q.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}c(`${j}/base-keyed`,`1
-`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function y(Q,j){let q=(G)=>{return j("srt_warm_skipped",{reason:G}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return q("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>Jj||Z.toString("base64")!==Q.srt_base_settings)return q("settings_invalid");let X;try{let G=A(S);if(!G.isDirectory()||G.uid!==0||(G.mode&18)!==0)return q("cgroup_unsafe");let L=qj.find((M)=>A(M,{throwIfNoEntry:!1})!==void 0);if(!L)return q("cgroup_or_exec_missing");X=L;for(let[M,H]of[[X,!1],["/usr/local/bin",!0]]){let Y=A(M);if((H?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return q("srt_exec_unsafe")}}catch{return q("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return q("not_root");let z=performance.now(),f=t("sha256").update(Z).digest("hex"),D=`${C}/srt-base-settings.json`;try{c(D,Z,{mode:384,flag:"w"})}catch{return q("settings_write")}let W=i("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",X,"--settings",D,"--idle-ms",String(Qj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((G)=>{W.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),G()}),W.once("close",(L)=>{j(L===0?"srt_warm_done":"srt_warm_failed",{exit_code:L,warm_ms:Math.round(performance.now()-z),settings_sha256:f}),G()})})}var u=3000;function Nj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,q=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!q&&typeof q.session_root==="string"&&typeof q.alias==="string"&&Number.isSafeInteger(q.payload_uid)&&typeof q.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function v(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function $j(Q){let[{CLI_VERSION:j},q,Z,X]=await Promise.all([import("./version-1tqn5z1v.js"),import("./hands-worker-source-8621y83c.js"),import("./network-contract-hak6865b.js"),import("./device-workspace-ne4269qk.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-ane0wwzb.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:p,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:q.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var P=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],Xj=new Set(["pty.start","jobs.control"]);function zj(Q,j){let q=j([{id:"vm-hands",label:"workspace",path:h,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(P.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of P)X[z]={...q.operation_constraints?.[z]??{},ready:!0,execution_mode:q.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...P],operation_constraints:X}}}function Gj(Q){for(let j of d("/etc/passwd","utf8").split(`
-`)){let q=j.split(":");if(q.length>=4&&Number(q[2])===Q&&/^\d+$/.test(q[3]??"")&&Number(q[3])>0)return Number(q[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let q=j.owner;if(!q||typeof q.organization_id!=="string"||typeof q.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:h,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function Kj(Q=process.platform,j="/proc/self/oom_score_adj"){if(Q!=="linux")return null;let q;try{q=d(j,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(q))return{value:"unreadable"};let Z=Number(q);return Z<0?{value:Z}:null}async function Wj(Q,j){let q=Kj();if(q)j("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:q.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});v(C),v(R),Zj(j);let Z=y(Q,j),X=!1,z=async()=>{if(!await Promise.race([Z.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))X=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:f},{configureWorkerSandbox:D}]=await Promise.all([import("./desktop-account-t2f1aa9e.js"),import("./worker-sandbox-mn60tmqv.js")]);D();try{f({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let W=new AbortController;for(let J of["SIGTERM","SIGINT"])process.on(J,()=>W.abort());let G=new Map,L,M=new Promise((J)=>{L=J}),H=M.then(()=>import("./vm-hands-executor-1r4qb5m0.js")).then(({createVmHandsExecutor:J})=>{let $=J({init:Q,root:h,runtimeDirectory:C,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{X=!1,Z=y(Q,j)},srtWarmLate:()=>X,forward:(B,K,g)=>G.get(B)?.(K,g)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),Y=(J)=>async(...$)=>(await H)[J](...$),w=null;H.then((J)=>{w=($)=>J.executorExited($)});let N={startExecutor:async(...J)=>{return await z(),Y("startExecutor")(...J)},killAndVerifyPayload:Y("killAndVerifyPayload"),killProbe:Y("killProbe"),runProbe:async(...J)=>{return await z(),Y("runProbe")(...J)},restatLayout:()=>{throw Error("replaced below")},verifyMounts:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(J)=>w?w(J):new Promise(()=>{}),takeSrtFallbacks:()=>null};H.then((J)=>{N.restatLayout=()=>J.restatLayout(),N.verifyMounts=()=>J.verifyMounts(),N.installEnvironment=($,B)=>J.installEnvironment($,B),N.freezeBind=($)=>J.freezeBind($),N.takeSrtFallbacks=()=>J.takeSrtFallbacks?.()??null});let o=await k(Q),n=new m(Q,o,N,{envRoot:R}),b=$j(Q),E=null,a=Promise.all([b,import("./local-capabilities-6npp92ry.js")]).then(([J,$])=>{E=zj(J,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((J)=>j("device_ops_unavailable",{error:J instanceof Error?J.name:"error"})),T=M.then(()=>import("./vm-hands-executor-1r4qb5m0.js")).then(({createVmHandsOpRunners:J,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>J({payloadUid:Q.layout.payload_uid,payloadGid:Gj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,g)=>j(K,g)})).catch(()=>null);T.then((J)=>J?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:n,signal:W.signal,heartbeat:async()=>E??await b,executeOp:async({kind:J,claim:$,bindId:B,signal:K,emit:g})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let _={executionMode:"unsandboxed",runtimeDirectory:C,readiness:Object.fromEntries(P.map((U)=>[U,!0]))},I=(U)=>{let V=typeof U.kind==="string"?U.kind:"";if(V)g({kind:V,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&J!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&J!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&J==="person"&&!$.authority;if(Xj.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-6npp92ry.js");return U(x,$,{worker:_,signal:K,emit:(V)=>I(V)})}let O=await T;if(!O)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return O.run(J,{id:String($.attempt_id),claim:$,state:x,worker:_},I,K,B)},readyData:({launchId:J})=>({executor_launch_id:J}),log:(J,$)=>{if(J==="vm_hands.registered"||J==="vm_hands.reconnected")L();j(J,$)},onTurn:(J,$)=>{if($)G.set(J,$);else G.delete(J)}}),await(await H).stop(),(await T)?.stop()}export{Kj as vmHandsOomProtection,y as startBaseSrtServer,Wj as runVmHands,Nj as parseVmHandsInit,$j as heartbeatBody,Zj as enableBaseKeyedSrt};
+import{Aa as m,Ba as l,za as k}from"./vm-hands-entry-lite-8tcnbfnm.js";import{Oe as p}from"./vm-hands-entry-lite-ky0w7t09.js";import"./vm-hands-entry-lite-vr38bh6k.js";import{Xk as F}from"./vm-hands-entry-lite-72nn2b4n.js";import{spawn as i}from"child_process";import{createHash as t}from"crypto";import{lstatSync as A,mkdirSync as s,readFileSync as d,statSync as e,writeFileSync as c}from"fs";var C="/run/reason-vm-hands",R="/run/reason-vm-hands/env",h="/home/runner/.reason/workspace",jj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,S="/sys/fs/cgroup/reason-srt",qj=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],Jj=65536,Qj=21600000;function Zj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;s(j,{recursive:!0,mode:448});let q=A(j);if(!q.isDirectory()||q.uid!==0||(q.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}c(`${j}/base-keyed`,`1
+`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function y(Q,j){let q=(G)=>{return j("srt_warm_skipped",{reason:G}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return q("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>Jj||Z.toString("base64")!==Q.srt_base_settings)return q("settings_invalid");let X;try{let G=A(S);if(!G.isDirectory()||G.uid!==0||(G.mode&18)!==0)return q("cgroup_unsafe");let L=qj.find((M)=>A(M,{throwIfNoEntry:!1})!==void 0);if(!L)return q("cgroup_or_exec_missing");X=L;for(let[M,H]of[[X,!1],["/usr/local/bin",!0]]){let Y=A(M);if((H?!Y.isDirectory():!Y.isFile())||Y.uid!==0||(Y.mode&18)!==0)return q("srt_exec_unsafe")}}catch{return q("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return q("not_root");let z=performance.now(),f=t("sha256").update(Z).digest("hex"),D=`${C}/srt-base-settings.json`;try{c(D,Z,{mode:384,flag:"w"})}catch{return q("settings_write")}let W=i("/bin/sh",["-c",`echo $$ > ${S}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",X,"--settings",D,"--idle-ms",String(Qj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((G)=>{W.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),G()}),W.once("close",(L)=>{j(L===0?"srt_warm_done":"srt_warm_failed",{exit_code:L,warm_ms:Math.round(performance.now()-z),settings_sha256:f}),G()})})}var u=3000;function Nj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,q=j.layout,Z=j.device_key,X=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&jj.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!q&&typeof q.session_root==="string"&&typeof q.alias==="string"&&Number.isSafeInteger(q.payload_uid)&&typeof q.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function v(Q){s(Q,{recursive:!0,mode:448});let j=e(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function $j(Q){let[{CLI_VERSION:j},q,Z,X]=await Promise.all([import("./version-8qryvrwt.js"),import("./hands-worker-source-as5wepvk.js"),import("./network-contract-9smga6kn.js"),import("./device-workspace-nzz3kd5t.js")]),{REASON_HANDS_PROTOCOL_VERSION:z}=await import("./reason-hands-protocol-5fhd49en.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:p,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:q.REASON_HANDS_WORKER_VERSION,protocol_version:z,worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var P=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],Xj=new Set(["pty.start","jobs.control"]);function zj(Q,j){let q=j([{id:"vm-hands",label:"workspace",path:h,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(P.map((z)=>[z,!0]))}}),Z=Q.capabilities,X={...Z.operation_constraints};for(let z of P)X[z]={...q.operation_constraints?.[z]??{},ready:!0,execution_mode:q.operation_constraints?.[z]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...P],operation_constraints:X}}}function Gj(Q){for(let j of d("/etc/passwd","utf8").split(`
+`)){let q=j.split(":");if(q.length>=4&&Number(q[2])===Q&&/^\d+$/.test(q[3]??"")&&Number(q[3])>0)return Number(q[3])}throw Error("vm_hands_payload_account_unavailable")}function Fj(Q,j){let q=j.owner;if(!q||typeof q.organization_id!=="string"||typeof q.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:h,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function Kj(Q=process.platform,j="/proc/self/oom_score_adj"){if(Q!=="linux")return null;let q;try{q=d(j,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(q))return{value:"unreadable"};let Z=Number(q);return Z<0?{value:Z}:null}async function Wj(Q,j){let q=Kj();if(q)j("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:q.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});v(C),v(R),Zj(j);let Z=y(Q,j),X=!1,z=async()=>{if(!await Promise.race([Z.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),u).unref?.())]))X=!0,j("srt_warm_late",{wait_ms:u})},[{configureDesktopAccount:f},{configureWorkerSandbox:D}]=await Promise.all([import("./desktop-account-2kkxwv1y.js"),import("./worker-sandbox-p242st5d.js")]);D();try{f({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let W=new AbortController;for(let J of["SIGTERM","SIGINT"])process.on(J,()=>W.abort());let G=new Map,L,M=new Promise((J)=>{L=J}),H=M.then(()=>import("./vm-hands-executor-etthkykm.js")).then(({createVmHandsExecutor:J})=>{let $=J({init:Q,root:h,runtimeDirectory:C,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{X=!1,Z=y(Q,j)},srtWarmLate:()=>X,forward:(B,K,g)=>G.get(B)?.(K,g)??Promise.reject(Error("vm_hands_not_bound")),log:(B,K)=>j(B,K)});return j("executor_loaded"),$}),Y=(J)=>async(...$)=>(await H)[J](...$),w=null;H.then((J)=>{w=($)=>J.executorExited($)});let N={startExecutor:async(...J)=>{return await z(),Y("startExecutor")(...J)},killAndVerifyPayload:Y("killAndVerifyPayload"),killProbe:Y("killProbe"),runProbe:async(...J)=>{return await z(),Y("runProbe")(...J)},restatLayout:()=>{throw Error("replaced below")},verifyMounts:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(J)=>w?w(J):new Promise(()=>{}),takeSrtFallbacks:()=>null};H.then((J)=>{N.restatLayout=()=>J.restatLayout(),N.verifyMounts=()=>J.verifyMounts(),N.installEnvironment=($,B)=>J.installEnvironment($,B),N.freezeBind=($)=>J.freezeBind($),N.takeSrtFallbacks=()=>J.takeSrtFallbacks?.()??null});let o=await k(Q),n=new m(Q,o,N,{envRoot:R}),b=$j(Q),E=null,a=Promise.all([b,import("./local-capabilities-dgaqqaw9.js")]).then(([J,$])=>{E=zj(J,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((J)=>j("device_ops_unavailable",{error:J instanceof Error?J.name:"error"})),T=M.then(()=>import("./vm-hands-executor-etthkykm.js")).then(({createVmHandsOpRunners:J,vmHandsBindCgroup:$,VM_HANDS_PAYLOAD_CGROUP:B})=>J({payloadUid:Q.layout.payload_uid,payloadGid:Gj(Q.layout.payload_uid),bindCgroup:(K)=>$(B,K),log:(K,g)=>j(K,g)})).catch(()=>null);T.then((J)=>J?.warm("person")),j("agent_ready"),await l({apiOrigin:Q.api_origin,agent:n,signal:W.signal,heartbeat:async()=>E??await b,executeOp:async({kind:J,claim:$,bindId:B,signal:K,emit:g})=>{let x=Fj(Q,$);if(!x)return{status:"failed",error_code:"vm_hands_bind_invalid"};let _={executionMode:"unsandboxed",runtimeDirectory:C,readiness:Object.fromEntries(P.map((U)=>[U,!0]))},I=(U)=>{let V=typeof U.kind==="string"?U.kind:"";if(V)g({kind:V,...U.data&&typeof U.data==="object"?{data:U.data}:{}})};if($.capability==="exec.full"&&J!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&J!=="model")return{status:"failed",error_code:"capability_not_granted"};let r=$.capability==="pty.start"&&J==="person"&&!$.authority;if(Xj.has(String($.capability))&&!r){let{executeLocalOperation:U}=await import("./local-capabilities-dgaqqaw9.js");return U(x,$,{worker:_,signal:K,emit:(V)=>I(V)})}let O=await T;if(!O)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return O.run(J,{id:String($.attempt_id),claim:$,state:x,worker:_},I,K,B)},readyData:({launchId:J})=>({executor_launch_id:J}),log:(J,$)=>{if(J==="vm_hands.registered"||J==="vm_hands.reconnected")L();j(J,$)},onTurn:(J,$)=>{if($)G.set(J,$);else G.delete(J)}}),await(await H).stop(),(await T)?.stop()}export{Kj as vmHandsOomProtection,y as startBaseSrtServer,Wj as runVmHands,Nj as parseVmHandsInit,$j as heartbeatBody,Zj as enableBaseKeyedSrt};

package/bin/vm-hands/worker-sandbox-p242st5d.js

@@ -0,0 +1,2 @@
+// @bun
+import{r as a}from"./vm-hands-entry-lite-wa261sf8.js";import"./vm-hands-entry-lite-yg5h9mhm.js";import"./vm-hands-entry-lite-69ray4x8.js";import"./vm-hands-entry-lite-nqvb7a2m.js";import"./vm-hands-entry-lite-8f3px72v.js";import"./vm-hands-entry-lite-8gjrr6hg.js";import"./vm-hands-entry-lite-hepppjp0.js";import"./vm-hands-entry-lite-wer0qzxg.js";import"./vm-hands-entry-lite-40nkzw38.js";import"./vm-hands-entry-lite-72nn2b4n.js";export{a as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-arm64",
-  "version": "0.2.405",
+  "version": "0.2.407",
   "description": "Reason CLI native binary for linux-arm64",
   "os": [
     "linux"

package/bin/vm-hands/api-credentials-21wv0h6t.js

@@ -1,2 +0,0 @@
-// @bun
-import{v as a,w as b,x as c,y as d,z as e}from"./vm-hands-entry-lite-yz6a02cp.js";import"./vm-hands-entry-lite-2k459na8.js";import"./vm-hands-entry-lite-c1rexgd8.js";import"./vm-hands-entry-lite-swwb5mp2.js";import"./vm-hands-entry-lite-caxtg4j7.js";import"./vm-hands-entry-lite-26d4ttdx.js";import"./vm-hands-entry-lite-wsnr4fx8.js";import"./vm-hands-entry-lite-arw53mkf.js";import"./vm-hands-entry-lite-ysk49bnz.js";import"./vm-hands-entry-lite-rbjky7rd.js";import"./vm-hands-entry-lite-b8bcnenf.js";import"./vm-hands-entry-lite-x96qadgp.js";import"./vm-hands-entry-lite-c3e25cks.js";export{d as resolveApiCredentials,e as requireApiCredentials,b as explicitApiOrigin,c as environmentApiKey,a as apiOriginFromEnvironment};

package/bin/vm-hands/api-e050y588.js

@@ -1,2 +0,0 @@
-// @bun
-import{F as a,G as b,H as c,I as d,J as e,K as f}from"./vm-hands-entry-lite-2k459na8.js";import"./vm-hands-entry-lite-c1rexgd8.js";import"./vm-hands-entry-lite-caxtg4j7.js";import"./vm-hands-entry-lite-26d4ttdx.js";import"./vm-hands-entry-lite-wsnr4fx8.js";import"./vm-hands-entry-lite-arw53mkf.js";import"./vm-hands-entry-lite-ysk49bnz.js";import"./vm-hands-entry-lite-rbjky7rd.js";import"./vm-hands-entry-lite-b8bcnenf.js";import"./vm-hands-entry-lite-x96qadgp.js";import"./vm-hands-entry-lite-c3e25cks.js";export{d as sessionPlace,c as sessionMachine,e as createMachineEnrollmentTicketWithToken,f as ReasonApi,b as REASONING_EFFORTS,a as ApiError};

package/bin/vm-hands/connect-cli-v93j3dxw.js

@@ -1,2 +0,0 @@
-// @bun
-import{e as a,f as b,g as c,h as d,i as e,j as f,k as g,l as h,m as i,n as j,o as k,p as l,q as m}from"./vm-hands-entry-lite-shbxnvs4.js";import"./vm-hands-entry-lite-bk5acpe9.js";import"./vm-hands-entry-lite-yz6a02cp.js";import"./vm-hands-entry-lite-2k459na8.js";import"./vm-hands-entry-lite-4fjjxvjx.js";import"./vm-hands-entry-lite-c1rexgd8.js";import"./vm-hands-entry-lite-m5swxtdx.js";import"./vm-hands-entry-lite-2abf7fnn.js";import"./vm-hands-entry-lite-heehk76b.js";import"./vm-hands-entry-lite-400hmvkg.js";import"./vm-hands-entry-lite-k9amte6k.js";import"./vm-hands-entry-lite-swwb5mp2.js";import"./vm-hands-entry-lite-wts79wdn.js";import"./vm-hands-entry-lite-nqvb7a2m.js";import"./vm-hands-entry-lite-xaaxvbk8.js";import"./vm-hands-entry-lite-3098ecjq.js";import"./vm-hands-entry-lite-6rzy866f.js";import"./vm-hands-entry-lite-x0x1t6gp.js";import"./vm-hands-entry-lite-afjzr3v2.js";import"./vm-hands-entry-lite-5p118s93.js";import"./vm-hands-entry-lite-2yt333v3.js";import"./vm-hands-entry-lite-wtc8ebkr.js";import"./vm-hands-entry-lite-kntkyezs.js";import"./vm-hands-entry-lite-8v6qhfxc.js";import"./vm-hands-entry-lite-0dr3sp75.js";import"./vm-hands-entry-lite-399rn7a2.js";import"./vm-hands-entry-lite-caxtg4j7.js";import"./vm-hands-entry-lite-26d4ttdx.js";import"./vm-hands-entry-lite-9cgye69h.js";import"./vm-hands-entry-lite-0mk8rxqv.js";import"./vm-hands-entry-lite-evzskkcd.js";import"./vm-hands-entry-lite-wsnr4fx8.js";import"./vm-hands-entry-lite-arw53mkf.js";import"./vm-hands-entry-lite-mnf64x9n.js";import"./vm-hands-entry-lite-6zsxed0z.js";import"./vm-hands-entry-lite-qg11k3bf.js";import"./vm-hands-entry-lite-ysk49bnz.js";import"./vm-hands-entry-lite-dj65hfea.js";import"./vm-hands-entry-lite-rbjky7rd.js";import"./vm-hands-entry-lite-b8bcnenf.js";import"./vm-hands-entry-lite-x96qadgp.js";import"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};

package/bin/vm-hands/desktop-account-t2f1aa9e.js

@@ -1,2 +0,0 @@
-// @bun
-import{$g as e,Xg as a,Yg as b,Zg as c,_g as d}from"./vm-hands-entry-lite-kntkyezs.js";import"./vm-hands-entry-lite-wsnr4fx8.js";import"./vm-hands-entry-lite-arw53mkf.js";import"./vm-hands-entry-lite-c3e25cks.js";export{b as passwdAccount,e as desktopHome,d as desktopAccount,c as configureDesktopAccount,a as DESKTOP_USER_ENV};

package/bin/vm-hands/local-automation-2vcw552m.js

@@ -1,2 +0,0 @@
-// @bun
-import{Fd as a,Gd as b,Hd as c,Id as d,Jd as e,Kd as f,Ld as g,Md as h,Nd as i,Od as j,Pd as k,Qd as l}from"./vm-hands-entry-lite-3098ecjq.js";import"./vm-hands-entry-lite-6rzy866f.js";import"./vm-hands-entry-lite-x0x1t6gp.js";import"./vm-hands-entry-lite-afjzr3v2.js";import"./vm-hands-entry-lite-5p118s93.js";import"./vm-hands-entry-lite-2yt333v3.js";import"./vm-hands-entry-lite-wtc8ebkr.js";import"./vm-hands-entry-lite-kntkyezs.js";import"./vm-hands-entry-lite-8v6qhfxc.js";import"./vm-hands-entry-lite-0dr3sp75.js";import"./vm-hands-entry-lite-399rn7a2.js";import"./vm-hands-entry-lite-caxtg4j7.js";import"./vm-hands-entry-lite-26d4ttdx.js";import"./vm-hands-entry-lite-9cgye69h.js";import"./vm-hands-entry-lite-0mk8rxqv.js";import"./vm-hands-entry-lite-evzskkcd.js";import"./vm-hands-entry-lite-wsnr4fx8.js";import"./vm-hands-entry-lite-arw53mkf.js";import"./vm-hands-entry-lite-mnf64x9n.js";import"./vm-hands-entry-lite-6zsxed0z.js";import"./vm-hands-entry-lite-qg11k3bf.js";import"./vm-hands-entry-lite-ysk49bnz.js";import"./vm-hands-entry-lite-dj65hfea.js";import"./vm-hands-entry-lite-rbjky7rd.js";import"./vm-hands-entry-lite-b8bcnenf.js";import"./vm-hands-entry-lite-x96qadgp.js";import"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};

package/bin/vm-hands/local-capabilities-6npp92ry.js

@@ -1,2 +0,0 @@
-// @bun
-import{$a as k,Ta as c,Ua as d,Va as e,Wa as f,Xa as g,Ya as h,Za as i,_a as j,ab as l,bb as m,cb as n,db as o,eb as p,fb as q,gb as r,hb as s,ib as t,jb as u}from"./vm-hands-entry-lite-m5swxtdx.js";import"./vm-hands-entry-lite-2abf7fnn.js";import"./vm-hands-entry-lite-heehk76b.js";import"./vm-hands-entry-lite-400hmvkg.js";import"./vm-hands-entry-lite-k9amte6k.js";import"./vm-hands-entry-lite-swwb5mp2.js";import"./vm-hands-entry-lite-wts79wdn.js";import"./vm-hands-entry-lite-nqvb7a2m.js";import"./vm-hands-entry-lite-xaaxvbk8.js";import"./vm-hands-entry-lite-3098ecjq.js";import"./vm-hands-entry-lite-6rzy866f.js";import"./vm-hands-entry-lite-x0x1t6gp.js";import"./vm-hands-entry-lite-afjzr3v2.js";import"./vm-hands-entry-lite-5p118s93.js";import"./vm-hands-entry-lite-2yt333v3.js";import"./vm-hands-entry-lite-wtc8ebkr.js";import"./vm-hands-entry-lite-kntkyezs.js";import"./vm-hands-entry-lite-8v6qhfxc.js";import"./vm-hands-entry-lite-0dr3sp75.js";import"./vm-hands-entry-lite-399rn7a2.js";import"./vm-hands-entry-lite-caxtg4j7.js";import"./vm-hands-entry-lite-26d4ttdx.js";import"./vm-hands-entry-lite-9cgye69h.js";import{cj as b}from"./vm-hands-entry-lite-0mk8rxqv.js";import"./vm-hands-entry-lite-evzskkcd.js";import"./vm-hands-entry-lite-wsnr4fx8.js";import"./vm-hands-entry-lite-arw53mkf.js";import"./vm-hands-entry-lite-mnf64x9n.js";import"./vm-hands-entry-lite-6zsxed0z.js";import"./vm-hands-entry-lite-qg11k3bf.js";import"./vm-hands-entry-lite-ysk49bnz.js";import"./vm-hands-entry-lite-dj65hfea.js";import"./vm-hands-entry-lite-rbjky7rd.js";import"./vm-hands-entry-lite-b8bcnenf.js";import"./vm-hands-entry-lite-x96qadgp.js";import{Pk as a}from"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";export{j as writeOpenFlags,g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};

package/bin/vm-hands/local-desktop-users-4n5g9c2v.js

@@ -1,2 +0,0 @@
-// @bun
-import{tk as a,uk as b,vk as c,wk as d,xk as e,yk as f,zk as g}from"./vm-hands-entry-lite-dj65hfea.js";import"./vm-hands-entry-lite-rbjky7rd.js";import"./vm-hands-entry-lite-b8bcnenf.js";import"./vm-hands-entry-lite-x96qadgp.js";import"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";export{f as trackDesktopRun,c as releaseLocalDesktop,a as noteLocalDesktopUse,g as holdLocalDesktop,b as forgetLocalDesktopUse,e as DESKTOP_WAIT_MS,d as DESKTOP_IDLE_MS};

package/bin/vm-hands/local-display-mac-cqfc5xnc.js

@@ -1,2 +0,0 @@
-// @bun
-import{lk as a,mk as b,nk as c,ok as d,pk as e,qk as f,rk as g}from"./vm-hands-entry-lite-qg11k3bf.js";import"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";export{c as requestMacScreenAccess,d as parseMacWindowBounds,a as parseMacScreenStatus,e as openMacWindowBounds,g as openMacInput,b as macScreenStatus,f as MacInputTranslator};

package/bin/vm-hands/local-display-session-xk4aaa8y.js

@@ -1,2 +0,0 @@
-// @bun
-import{ng as a,og as b,pg as c,qg as d,rg as e,sg as f,tg as g,ug as h}from"./vm-hands-entry-lite-5p118s93.js";import"./vm-hands-entry-lite-2yt333v3.js";import"./vm-hands-entry-lite-wtc8ebkr.js";import"./vm-hands-entry-lite-kntkyezs.js";import"./vm-hands-entry-lite-8v6qhfxc.js";import"./vm-hands-entry-lite-0dr3sp75.js";import"./vm-hands-entry-lite-399rn7a2.js";import"./vm-hands-entry-lite-caxtg4j7.js";import"./vm-hands-entry-lite-26d4ttdx.js";import"./vm-hands-entry-lite-9cgye69h.js";import"./vm-hands-entry-lite-0mk8rxqv.js";import"./vm-hands-entry-lite-evzskkcd.js";import"./vm-hands-entry-lite-wsnr4fx8.js";import"./vm-hands-entry-lite-arw53mkf.js";import"./vm-hands-entry-lite-mnf64x9n.js";import"./vm-hands-entry-lite-6zsxed0z.js";import"./vm-hands-entry-lite-qg11k3bf.js";import"./vm-hands-entry-lite-ysk49bnz.js";import"./vm-hands-entry-lite-dj65hfea.js";import"./vm-hands-entry-lite-rbjky7rd.js";import"./vm-hands-entry-lite-b8bcnenf.js";import"./vm-hands-entry-lite-x96qadgp.js";import"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};

package/bin/vm-hands/local-pty-session-wyrzfc50.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ag as e,Bg as f,Cg as g,Dg as h,Eg as i,Fg as j,wg as a,xg as b,yg as c,zg as d}from"./vm-hands-entry-lite-2yt333v3.js";import"./vm-hands-entry-lite-wtc8ebkr.js";import"./vm-hands-entry-lite-8v6qhfxc.js";import"./vm-hands-entry-lite-0dr3sp75.js";import"./vm-hands-entry-lite-399rn7a2.js";import"./vm-hands-entry-lite-caxtg4j7.js";import"./vm-hands-entry-lite-26d4ttdx.js";import"./vm-hands-entry-lite-wsnr4fx8.js";import"./vm-hands-entry-lite-arw53mkf.js";import"./vm-hands-entry-lite-ysk49bnz.js";import"./vm-hands-entry-lite-b8bcnenf.js";import"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";export{j as runLocalPtySession,e as resolvePtyWorkingDirectory,g as ptyRuntimeSupported,d as parsePtyStartPayload,h as defaultSpawnPty,f as defaultLoginShell,i as defaultConnect,a as LOCAL_PTY_MAX_SESSION_MS,c as LOCAL_PTY_MAX_SESSIONS,b as LOCAL_PTY_MAX_BUFFERED_OUTPUT_BYTES};

package/bin/vm-hands/network-contract-hak6865b.js

@@ -1,2 +0,0 @@
-// @bun
-import{$e as n,$f as na,Af as O,Bf as P,Cf as Q,Df as R,Ef as S,Ff as T,Gf as U,Hf as V,If as W,Jf as X,Kf as Y,Lf as Z,Mf as _,Nf as $,Oe as a,Of as aa,Pe as b,Pf as ba,Qe as c,Qf as ca,Re as d,Rf as da,Se as e,Sf as ea,Te as f,Tf as fa,Ue as g,Uf as ga,Ve as h,Vf as ha,We as i,Wf as ia,Xe as j,Xf as ja,Ye as k,Yf as ka,Ze as l,Zf as la,_e as m,_f as ma,af as o,bf as p,cf as q,df as r,ef as s,ff as t,gf as u,hf as v,if as w,jf as x,kf as y,lf as z,mf as A,nf as B,of as C,pf as D,qf as E,rf as F,sf as G,tf as H,uf as I,vf as J,wf as K,xf as L,yf as M,zf as N}from"./vm-hands-entry-lite-afjzr3v2.js";import"./vm-hands-entry-lite-ysk49bnz.js";import"./vm-hands-entry-lite-c3e25cks.js";export{ea as parseLocalRuntimeRootsSyncResponse,aa as parseLocalRuntimeRegistrationResponse,$ as parseLocalRuntimeProofChallenge,ka as parseLocalRuntimeOperationHeartbeatResponse,la as parseLocalRuntimeOperationEventsResponse,ma as parseLocalRuntimeOperationEnvironmentResponse,na as parseLocalRuntimeOperationCompletionResponse,ja as parseLocalRuntimeOperationClaim,ha as parseLocalRuntimeLocalSubscriptionResponse,ia as parseLocalRuntimeLifecycleResponse,fa as parseLocalRuntimeIdentityResponse,ca as parseLocalRuntimeHeartbeatResponse,da as parseLocalRuntimeFirstHeartbeat,_ as parseLocalRuntimeErrorEnvelope,ba as parseLocalRuntimeEnrollmentResponse,ga as parseLocalRuntimeDisconnectResponse,j as localRuntimeSessionRoutable,Z as buildLocalRuntimeDeviceProofBytes,U as WORKER_STARTUP_TIMING_STAGES,P as WORKER_PREVIEW_CARRIED_JOBS,q as VM_HANDS_WORKSPACE_GRANT_CONTROL,p as VM_HANDS_WORKSPACE_DEFERRED_KEY,r as VM_HANDS_UNBIND_UNVERIFIED_EVENT,e as RELAY_HOST_ALIAS_VERSION,d as RELAY_HOST_ALIAS_HEADER,V as LOCAL_RUNTIME_WORKER_STARTUP_MAX_MS,k as LOCAL_RUNTIME_SESSION_VM_HANDS_REGISTER,h as LOCAL_RUNTIME_SESSION_PRE_AUTH_MAX_BYTES,g as LOCAL_RUNTIME_SESSION_PATH,m as LOCAL_RUNTIME_SESSION_CLOSE,l as LOCAL_RUNTIME_SESSION_CLAIM_WAIT_MAX_MS,i as LOCAL_RUNTIME_SESSION_AUTH_DEADLINE_MS,b as LOCAL_RUNTIME_ROUTE_PREFIX,f as LOCAL_RUNTIME_ROUTES,a as LOCAL_RUNTIME_PROTOCOL_VERSION,W as LOCAL_RUNTIME_LIFECYCLE_EVENTS,Y as LOCAL_RUNTIME_LEGACY_DEVICE_PROOF_TAG,X as LOCAL_RUNTIME_DEVICE_PROOF_TAG,c as LOCAL_OPERATION_MAX_BYTES,R as JOBS_START_WAIT_KEY,Q as JOBS_START_WAIT,v as HANDS_WORKSPACE_CHECK_KEY,u as HANDS_WORKSPACE_CHECK,M as HANDS_SESSION_GROUP_KEY,L as HANDS_SESSION_GROUP,O as HANDS_SESSION_CAP_NONE,N as HANDS_SESSION_CAP_KEY,x as HANDS_REBIND_KEY,y as HANDS_REBIND_CONTROL,w as HANDS_REBIND,I as HANDS_MODEL_JOBS_EGRESS_KEY,H as HANDS_MODEL_JOBS_EGRESS,E as HANDS_LARGE_ENVIRONMENT_KEY,D as HANDS_LARGE_ENVIRONMENT,K as HANDS_JOBS_USER_KEY,J as HANDS_JOBS_USER,C as HANDS_HEADLESS_BROWSER_KEY,B as HANDS_HEADLESS_BROWSER,o as HANDS_ENVIRONMENT_DELIVER_CONTROL,n as HANDS_ENVIRONMENT_DELIVERY,t as HANDS_ENVIRONMENT_AT_CLAIM_KEY,s as HANDS_ENVIRONMENT_AT_CLAIM,G as HANDS_CONFINEMENT_KEY,F as HANDS_CONFINEMENT,A as HANDS_CLOUD_ACCESS_KEY,z as HANDS_CLOUD_ACCESS,S as AUTOMATION_USER_CHROME,T as AUTOMATION_CLOUD_SESSIONS};

package/bin/vm-hands/package-jr4xjp4y.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ca as a}from"./vm-hands-entry-lite-0tkwcetg.js";import"./vm-hands-entry-lite-c3e25cks.js";export default a();

package/bin/vm-hands/permissions-e81qy49z.js

@@ -1,2 +0,0 @@
-// @bun
-import{Qi as a,Ri as b,Si as c,Ti as d,Ui as e,Vi as f,Wi as g,Xi as h,Yi as i,Zi as j}from"./vm-hands-entry-lite-9cgye69h.js";import"./vm-hands-entry-lite-0mk8rxqv.js";import"./vm-hands-entry-lite-evzskkcd.js";import"./vm-hands-entry-lite-wsnr4fx8.js";import"./vm-hands-entry-lite-arw53mkf.js";import"./vm-hands-entry-lite-mnf64x9n.js";import"./vm-hands-entry-lite-6zsxed0z.js";import"./vm-hands-entry-lite-qg11k3bf.js";import"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};

package/bin/vm-hands/version-1tqn5z1v.js

@@ -1,2 +0,0 @@
-// @bun
-import{Vj as a,Wj as b,Xj as c,Yj as d}from"./vm-hands-entry-lite-mnf64x9n.js";import"./vm-hands-entry-lite-6zsxed0z.js";import"./vm-hands-entry-lite-c3e25cks.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};

package/bin/vm-hands/vm-hands-op-runner-hv2w4727.js

@@ -1,2 +0,0 @@
-// @bun
-import{s as a,t as b,u as c}from"./vm-hands-entry-lite-h9fs5a19.js";import"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";export{b as spawnSessionPty,c as runVmHandsOpRunner,a as VM_HANDS_OP_RUNNER_PERSON_ARG};

package/bin/vm-hands/worker-sandbox-mn60tmqv.js

@@ -1,2 +0,0 @@
-// @bun
-import{r as a}from"./vm-hands-entry-lite-bk5acpe9.js";import"./vm-hands-entry-lite-heehk76b.js";import"./vm-hands-entry-lite-400hmvkg.js";import"./vm-hands-entry-lite-nqvb7a2m.js";import"./vm-hands-entry-lite-0mk8rxqv.js";import"./vm-hands-entry-lite-rbjky7rd.js";import"./vm-hands-entry-lite-b8bcnenf.js";import"./vm-hands-entry-lite-x96qadgp.js";import"./vm-hands-entry-lite-f28ehysx.js";import"./vm-hands-entry-lite-c3e25cks.js";export{a as configureWorkerSandbox};