@reason-machines/cli-linux-arm64 0.2.420 → 0.2.424

package/bin/vm-hands/vm-hands-entry-lite-f2qkz14f.js

@@ -1,128 +0,0 @@
-// @bun
-import{Gn,Ao,Jt}from"./vm-hands-entry-lite-jzz73e3f.js";import{Pn,Ve,ao,Tn,Rn,On,Pr,x}from"./vm-hands-entry-lite-2n4n9cs8.js";import{kt}from"./vm-hands-entry-lite-fbhqfzbq.js";import{Ir}from"./vm-hands-entry-lite-nzmkyezg.js";import{j}from"./vm-hands-entry-lite-pf5qtbj5.js";import{a}from"./vm-hands-entry-lite-jev771b3.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as Y,spawn as z}from"child_process";import{randomBytes as Te}from"crypto";import{chmodSync as he,existsSync as H,lstatSync as Qe,mkdirSync as _e,readFileSync as De,rmSync as I,writeFileSync as C}from"fs";import{connect as we}from"net";import{join as y}from"path";var P=32,w=76;var W="./desktop-wallpaper-0pjhgyfk.jpg";var B="./dock-browser-afp005mt.png";var O="./dock-files-rywdm96b.png";var F="./dock-terminal-s41cj1jp.png";var k=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
-# The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
-# python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
-# Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE
-import ctypes, sys
-import gi
-gi.require_version("GdkPixbuf", "2.0")
-from gi.repository import GdkPixbuf
-x = ctypes.cdll.LoadLibrary("libX11.so.6")
-x.XOpenDisplay.restype = ctypes.c_void_p
-x.XOpenDisplay.argtypes = [ctypes.c_char_p]
-d = x.XOpenDisplay(None)
-if not d: sys.exit("no display")
-for name, res, args in [
-    ("XDefaultScreen", ctypes.c_int, [ctypes.c_void_p]),
-    ("XRootWindow", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDisplayWidth", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDisplayHeight", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultDepth", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultVisual", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultGC", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_int]),
-    ("XCreatePixmap", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_uint, ctypes.c_uint, ctypes.c_uint]),
-    ("XCreateImage", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_uint, ctypes.c_int, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint, ctypes.c_uint, ctypes.c_int, ctypes.c_int]),
-    ("XPutImage", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_int, ctypes.c_int, ctypes.c_int, ctypes.c_int, ctypes.c_uint, ctypes.c_uint]),
-    ("XInternAtom", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_char_p, ctypes.c_int]),
-    ("XChangeProperty", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_int, ctypes.c_int, ctypes.c_void_p, ctypes.c_int]),
-    ("XSetWindowBackgroundPixmap", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_ulong]),
-    ("XClearWindow", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong]),
-    ("XSetCloseDownMode", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XCloseDisplay", ctypes.c_int, [ctypes.c_void_p]),
-]:
-    f = getattr(x, name); f.restype = res; f.argtypes = args
-s = x.XDefaultScreen(d); root = x.XRootWindow(d, s)
-w, h = x.XDisplayWidth(d, s), x.XDisplayHeight(d, s)
-if x.XDefaultDepth(d, s) != 24: sys.exit("unsupported depth")
-# Scale to cover the screen, then crop the centre.
-src = GdkPixbuf.Pixbuf.new_from_file(sys.argv[1])
-k = max(w / src.get_width(), h / src.get_height())
-sw, sh = max(w, round(src.get_width() * k)), max(h, round(src.get_height() * k))
-pb = src.scale_simple(sw, sh, GdkPixbuf.InterpType.BILINEAR).new_subpixbuf((sw - w) // 2, (sh - h) // 2, w, h).copy()
-if pb.get_has_alpha(): pb = pb.composite_color_simple(w, h, GdkPixbuf.InterpType.NEAREST, 255, 1, 0, 0)
-rgb, stride = pb.get_pixels(), pb.get_rowstride()
-bgrx = bytearray(w * h * 4)
-for y in range(h):
-    row = rgb[y * stride:y * stride + w * 3]; o = y * w * 4
-    bgrx[o:o + w * 4:4] = row[2::3]; bgrx[o + 1:o + w * 4:4] = row[1::3]; bgrx[o + 2:o + w * 4:4] = row[0::3]
-buf = ctypes.create_string_buffer(bytes(bgrx), len(bgrx))
-pix = x.XCreatePixmap(d, root, w, h, 24)
-img = x.XCreateImage(d, x.XDefaultVisual(d, s), 24, 2, 0, buf, w, h, 32, 0)  # ZPixmap
-x.XPutImage(d, pix, x.XDefaultGC(d, s), img, 0, 0, 0, 0, w, h)
-ref = ctypes.c_ulong(pix)
-for atom in (b"_XROOTPMAP_ID", b"ESETROOT_PMAP_ID"):
-    x.XChangeProperty(d, root, x.XInternAtom(d, atom, 0), 20, 32, 0, ctypes.byref(ref), 1)  # XA_PIXMAP, PropModeReplace
-x.XSetWindowBackgroundPixmap(d, root, pix)
-x.XClearWindow(d, root)
-x.XSetCloseDownMode(d, 1)  # RetainPermanent: the pixmap outlives this process
-x.XCloseDisplay(d)
-`;function ce(e){return`<?xml version="1.0" encoding="UTF-8"?>
-<openbox_config xmlns="http://openbox.org/3.4/rc">
-  <theme><keepBorder>no</keepBorder></theme>
-  <applications>
-    <!-- Debian Chromium is "Chromium"; Chrome for Testing is "Chromium-browser". -->
-    <application class="Chromium*">
-      <decor>no</decor>
-      <position force="yes"><x>${P}</x><y>${P}</y></position>
-      <size><width>${e.width-P*2}</width><height>${e.height-P-w}</height></size>
-    </application>
-  </applications>
-</openbox_config>`}var be=`# Remote sandbox dock \u2014 launcher icons only, centred, no panel fill
-panel_items = L
-panel_size = 100% 46
-panel_margin = 0 10
-panel_padding = 0 0 10
-panel_position = bottom center horizontal
-panel_shrink = 1
-panel_background_id = 0
-panel_layer = top
-mouse_effects = 1
-mouse_hover_icon_asb = 100 0 12
-mouse_pressed_icon_asb = 100 0 -12
-
-launcher_icon_size = 46
-launcher_padding = 0 0 10
-launcher_background_id = 0
-launcher_tooltip = 1
-
-launcher_item_app = /tmp/ara-chromium.desktop
-launcher_item_app = /tmp/ara-terminal.desktop
-launcher_item_app = /tmp/ara-files.desktop
-`,ye=`corner-radius = 12;
-rounded-corners-exclude = [
-  "class_g = 'tint2'",
-  "window_type = 'dock'",
-  "window_type = 'desktop'"
-];
-backend = "xrender";
-shadow = false;
-fading = false;
-vsync = false;
-inactive-opacity = 1.0;
-active-opacity = 1.0;
-`,le="/tmp/ara-dock-browser.png",ue=`[Desktop Entry]
-Name=Chrome
-Exec=chromium --no-sandbox %U
-Icon=${le}
-Type=Application
-Categories=Network;WebBrowser;
-`,Pe=`[Desktop Entry]
-Name=Terminal
-Exec=bash -c "DISPLAY=:99 xterm -fa DejaVuSansMono -fs 11 -bg black -fg white"
-Icon=/tmp/ara-dock-terminal.png
-Type=Application
-Categories=System;TerminalEmulator;
-`,Se=`[Desktop Entry]
-Name=Files
-Exec=bash -c "DISPLAY=:99 pcmanfm --no-desktop"
-Icon=/tmp/ara-dock-files.png
-Type=Application
-Categories=System;FileManager;
-`;var K={"wallpaper.jpg":W,"dock-browser.png":B,"dock-terminal.png":F,"dock-files.png":O},Xe=k,fe='set_wallpaper() { if command -v feh >/dev/null 2>&1; then feh --bg-fill "$1"; else python3 "$2" "$1"; fi; }';function v(e){let s=(i)=>i.replaceAll("DISPLAY=:99",`DISPLAY=${e.display}`).replaceAll("/tmp/ara-",`${e.root}/ara-`),p=new Set(e.absent??[]),n=be.split(`
-`).filter((i)=>!(p.has("terminal")&&i.endsWith("/ara-terminal.desktop"))&&!(p.has("files")&&i.endsWith("/ara-files.desktop"))).join(`
-`);return{files:{"openbox/rc.xml":ce(e.screen),"tint2/tint2rc":s(n),"picom/picom.conf":ye,...p.has("terminal")?{}:{"ara-terminal.desktop":s(Pe)},...p.has("files")?{}:{"ara-files.desktop":s(Se)},"ara-chromium.desktop":s(ue).replace("chromium --no-sandbox %U",e.browserExec),"ara-set-root-wallpaper.py":Xe},start:['ticks() { line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1; rest=${line##*) }; case $rest in Z*|X*) return 1;; esac; printf "%s" "$rest" | cut -d " " -f20; }','alive() { [ -f "$ROOT/$1.pid" ] || return 1; read -r pid start <"$ROOT/$1.pid"; current=$(ticks "$pid") || return 1; [ "$current" = "$start" ] && kill -0 "$pid" 2>/dev/null; }','launch() { name=$1; shift; "$@" 9>&- >"$ROOT/$name.log" 2>&1 & pid=$!; start=$(ticks "$pid"); printf "%s %s\\n" "$pid" "$start" >"$ROOT/$name.pid"; }',fe,'[ ! -f "$ROOT/ara-wallpaper.jpg" ] || set_wallpaper "$ROOT/ara-wallpaper.jpg" "$ROOT/ara-set-root-wallpaper.py" || true','if ! alive tint2 && command -v tint2 >/dev/null 2>&1; then launch tint2 tint2 -c "$ROOT/tint2/tint2rc"; fi','if ! alive picom && command -v picom >/dev/null 2>&1; then launch picom picom --config "$ROOT/picom/picom.conf"; fi']}}var Re=43200000,_=":99",de=60000,D=15000,L={width:1280,height:800},Ae=/^[A-Za-z0-9._:-]{1,160}$/;function Ne(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}var Ee=["video","viewer","viewer_same_network","viewer_network"];function Le(e,s=Date.now()){let p=["relay_url","session_id","expires_at"];if(!Ne(e)||p.some((c)=>!(c in e))||Object.keys(e).some((c)=>!p.includes(c)&&!Ee.includes(c)))throw new r("invalid_display_request","Reason desktop request is malformed.");let n="video"in e?Ao(e.video):void 0,t="viewer"in e?Gn(e.viewer):null;if(n===null)throw new r("invalid_display_request","Reason desktop video request is invalid.");let o=null;try{o=typeof e.relay_url==="string"?new URL(e.relay_url):null}catch{}if(!o||o.protocol!=="wss:"&&o.protocol!=="ws:"||o.username||o.password)throw new r("invalid_display_request","Reason desktop relay URL is invalid.");if(typeof e.session_id!=="string"||!Ae.test(e.session_id))throw new r("invalid_display_request","Reason desktop session identity is invalid.");let i=typeof e.expires_at==="string"?Date.parse(e.expires_at):Number.NaN;if(!Number.isFinite(i)||i<=s)throw new r("invalid_display_request","Reason desktop session has already expired.");return{relay_url:e.relay_url,session_id:e.session_id,expires_at:new Date(Math.min(i,s+Re)).toISOString(),...n?{video:n}:{},...t?{viewer:t}:{},...n&&e.viewer_same_network===!0?{viewer_same_network:!0}:{}}}function $t(e=process.platform){return(e==="linux"||e==="darwin"||e==="win32")&&x()?.features.display===!0}async function Ls(){if(process.platform==="win32")return $t()&&await Pr();if(process.platform!=="darwin")return $t();return await Pr()}function G(e){_e(e,{recursive:!0,mode:448});let s=Qe(e);if(!s.isDirectory()||s.isSymbolicLink()||process.getuid&&s.uid!==process.getuid())throw new r("display_unavailable","Reason desktop state directory is not private.");he(e,448)}function Je(e,s){let p=(t)=>{let o=Buffer.alloc(2);return o.writeUInt16BE(t.length),Buffer.concat([o,t])},n=Buffer.from([255,255]);return Buffer.concat([n,p(Buffer.alloc(0)),p(Buffer.from(e)),p(Buffer.from("MIT-MAGIC-COOKIE-1")),p(s)])}function f(e,s,p=2000){return new Promise((n)=>{let t=we(e),o="",i=(c)=>{t.destroy(),n(c)};t.setTimeout(p,()=>i(!1)),t.once("error",()=>i(!1)),t.once("close",()=>i(!1)),t.once("connect",()=>{if(!s)i(!0)}),t.on("data",(c)=>{if(o+=c.toString("latin1"),o.length>=4)i(o.startsWith("RFB "))})})}async function U(e,s){let p=Date.now()+s;while(Date.now()<p){if(await e())return!0;await new Promise((n)=>setTimeout(n,100))}return!1}function R(e,s,p){return new Promise((n)=>{let t=z(e,s,{detached:!0,stdio:"ignore",env:p});t.once("error",()=>n(-1)),t.once("exit",(o)=>n(o)),t.unref(),setTimeout(()=>n(null),D).unref()})}var J=null;function qe(e=a()){return J??=Ce(e).finally(()=>{J=null}),J}async function Ce(e){let s=x({home:e});if(!s?.xvfb||!s.x11vnc||!s.openbox)throw new r("display_unavailable","Run `reason desktop install` on this machine to enable its desktop.");kt({root:s.root,automation:s.automation,extensionDir:s.extensionDir});let p=y(s.root,"display");G(p);let n=await ge(e,p,s.x11vnc);if(n)return n;let t={display:_,xauthority:y(p,"Xauthority"),rfbSocket:y(p,"rfb.sock")},o=y(p,"pulse"),i=(async()=>{try{G(o)}catch{return null}return await ao(o,s.pulseaudio)})();G(y(p,"home"));let c=ee(p,t,s.pulseaudio),T=async()=>({...t,sound:await i});if(await f({path:t.rfbSocket},!0))return await T();if(!H(t.xauthority))C(t.xauthority,Je(_.slice(1),Te(16)),{mode:384,flag:"wx"});let l=se(y(p,"theme"),t.display,L),S={path:`/tmp/.X11-unix/X${_.slice(1)}`};if(!await f(S,!1)){let q=`${L.width}x${L.height}`;if(s.xvnc)I(t.rfbSocket,{force:!0}),R(s.xvnc,[t.display,"-geometry",q,"-depth","24","-nolisten","tcp","-auth",t.xauthority,"-rfbport","-1","-rfbunixpath",t.rfbSocket,"-SecurityTypes","None","-AlwaysShared","-desktop","Reason"],c);else R(s.xvfb,[t.display,"-screen","0",`${q}x24`,"-nolisten","tcp","-auth",t.xauthority],c);if(!await U(()=>f(S,!1),D)||s.xvnc&&!await U(()=>f({path:t.rfbSocket},!0),D))throw new r("display_unavailable","Reason could not start the virtual display.");R(s.openbox,["--config-file",l.openboxConfig],c)}if(await te(l,c),!await re(s.x11vnc,t,p,"x11vnc.log",c))throw new r("display_unavailable","Reason could not start the desktop server.");return await T()}function ee(e,s,p){let n={HOME:y(e,"home"),PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:s.display,XAUTHORITY:s.xauthority};if(p)n.PULSE_SERVER=Ve(Pn(y(e,"pulse")));return n}async function re(e,s,p,n,t){if(await f({path:s.rfbSocket},!0))return!0;I(s.rfbSocket,{force:!0});let o=await R(e,["-display",s.display,"-auth",s.xauthority,"-rfbport","0","-rfbportv6","-1","-unixsock",s.rfbSocket,"-nopw","-forever","-shared","-noxdamage","-sb","0","-rfbversion","3.7","-quiet","-bg","-o",y(p,n)],t);if(o!==null&&o!==0)return!1;return await U(()=>f({path:s.rfbSocket},!0),D)}async function Ue(){let e=["DISPLAY","XAUTHORITY","WAYLAND_DISPLAY","XDG_SESSION_TYPE"],s=(p)=>Object.fromEntries(e.flatMap((n)=>p[n]?[[n,p[n]]]:[]));if(process.env.DISPLAY)return s(process.env);try{let p=await new Promise((n,t)=>Y("systemctl",["--user","show-environment"],{encoding:"utf8",timeout:2000},(o,i)=>o?t(o):n(i)));return s(Object.fromEntries(p.split(`
-`).flatMap((n)=>{let t=n.indexOf("=");return t>0?[[n.slice(0,t),n.slice(t+1)]]:[]})))}catch{return{}}}var V=new Set;async function ge(e,s,p){let n=await Ue(),t=/^:(\d+)(?:\.\d+)?$/.exec(n.DISPLAY??"")?.[1];if(!t||`:${t}`===_||n.WAYLAND_DISPLAY||n.XDG_SESSION_TYPE==="wayland")return null;let o={display:`:${t}`,xauthority:n.XAUTHORITY??y(e,".Xauthority"),rfbSocket:y(s,`rfb-${t}.sock`)},i=`${o.display} ${o.xauthority}`;if(V.has(i)||!await f({path:`/tmp/.X11-unix/X${t}`},!1))return null;let c={HOME:e,PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:o.display,XAUTHORITY:o.xauthority};if(await re(p,o,s,`x11vnc-${t}.log`,c))return{...o,sound:null};return V.add(i),process.stderr.write(`Reason worker: your screen ${o.display} could not be served; using the virtual desktop
-`),null}function se(e,s,p){let n=`chromium --no-first-run --no-default-browser-check${process.geteuid?.()===0?" --no-sandbox":""} %U`,t=[["terminal","xterm"],["files","pcmanfm"]].filter(([,i])=>!H(`/usr/bin/${i}`)).map(([i])=>i),o=v({root:e,display:s,screen:p,browserExec:n,absent:t});for(let i of["","openbox","tint2","picom"])G(y(e,i));for(let[i,c]of Object.entries(o.files))C(y(e,i),c,{mode:384});for(let[i,c]of Object.entries(K))C(y(e,`ara-${i}`),De(c),{mode:384});return{root:e,openboxConfig:y(e,"openbox","rc.xml"),start:o.start}}async function te(e,s){let p=[`ROOT=${JSON.stringify(e.root)}`,...e.start,"openbox --reconfigure >/dev/null 2>&1 || true"].join(`
-`);await new Promise((n)=>{let t=z("/bin/sh",["-c",p],{stdio:"ignore",env:{...s,PATH:"/usr/bin:/bin"}}),o=setTimeout(()=>{t.kill(),n()},D);t.once("error",()=>{clearTimeout(o),n()}),t.once("exit",()=>{clearTimeout(o),n()})})}var me=2073600,Me=320;function We(e,s){let p=Math.min(1,Math.sqrt(me/(e.width*e.height))),n=(t,o)=>Math.min(Math.floor(o/8)*8,Math.max(Me,Math.round(t*p/8)*8));return{width:n(e.width,s.width),height:n(e.height,s.height)}}function ne(e,s,p){return new Promise((n)=>Y(e,s,{env:p,encoding:"utf8",timeout:5000},(t,o)=>n(t?null:o)))}function je(e){let s=/current (\d+) x (\d+), maximum (\d+) x (\d+)/.exec(e),p=e.split(`
-`),n=p.findIndex((o)=>/^\S+ connected/.test(o));if(!s||n<0)return null;let t=[];for(let o of p.slice(n+1)){let i=/^\s+(\d+x\d+)\s/.exec(o);if(!i)break;t.push(i[1])}return{current:{width:Number(s[1]),height:Number(s[2])},maximum:{width:Number(s[3]),height:Number(s[4])},output:p[n].split(" ")[0],modes:t}}async function Be(e,s,p){if(e.display!==_)return null;let n={PATH:"/usr/bin:/bin",DISPLAY:e.display,XAUTHORITY:e.xauthority},t=(T)=>ne("xrandr",T,n),o=je(await t(["--query"])??"");if(!o||o.maximum.width<=o.current.width&&o.maximum.height<=o.current.height)return null;let i=We(s,o.maximum);if(i.width===o.current.width&&i.height===o.current.height)return{size:i,changed:!1};let c=`${i.width}x${i.height}`;if(!o.modes.includes(c)){if(await t(["--newmode",c,"60",...[i.width,i.width,i.width,i.width,i.height,i.height,i.height,i.height].map(String)]),await t(["--addmode",o.output,c])===null)return null}return p(),await t(["--output",o.output,"--mode",c])===null?null:{size:i,changed:!0}}async function Oe(e,s){let p=x({home:a()});if(!p)return;let n=y(p.root,"display"),t=ee(n,e,p.pulseaudio);await te(se(y(n,"theme"),e.display,s),t);let o=s.width-P*2,i=s.height-P-w;await ne("xdotool",["search","--onlyvisible","--class","Chromium","windowsize","%@",String(o),String(i),"windowmove","%@",String(P),String(P)],{...t,PATH:"/usr/bin:/bin"})}var Z=Promise.resolve();function Fe(e,s,p=()=>{}){let n=Z.then(()=>Be(e,s,p));return Z=n.then((t)=>t?.changed?Oe(e,t.size):void 0).catch(()=>{}),n.then((t)=>t?.size??null,()=>null)}async function Bt(e,s={}){let p=s.now??Date.now,n=Le(e.payload,p());if(e.signal.throwIfAborted(),!n.video)throw new r("display_video_required","Reason desktops stream as video now; this request came without it.");let t=s.platform??process.platform;if(t!=="linux"&&t!=="darwin"&&t!=="win32")throw new r("display_video_unsupported","This machine does not serve desktop video.");let o=n.video,i=(s.video?.desktop??(t==="darwin"?async()=>Tn:t==="win32"?async()=>Rn:qe))();return await ke(e.signal,n,s,p,(c)=>On(c,{request:o,desktop:i,...n.viewer?{viewer:n.viewer}:{},viewerSameNetwork:n.viewer_same_network===!0},{resizeDesktop:Fe,...s.video}),(c)=>Jt({type:"error",code:c}))}function ke(e,s,p,n,t,o){let i=n();return new Promise((c,T)=>{let l=null,S=!1,q=!1,g,d,h,m=!1,u=null,X=(b)=>{if(q)return;if(u)b=u;q=!0,clearTimeout(g),clearTimeout(d),e.removeEventListener("abort",N),h?.close();try{l?.close(1000,"display_session_over")}catch{}if("error"in b){T(b.error);return}c({reason:b.reason,...h?.summary(),duration_ms:Math.max(0,n()-i)})},A=()=>X({error:new r("display_relay_unavailable","Reason could not reach the desktop relay.")}),N=()=>{let b=e.reason;X({error:b instanceof r?b:new r("cancelled","Reason closed the desktop session.")})},M=()=>{if(!u||!l)return;let b=u.error;try{l.send(o(b instanceof r?b.code:"display_unavailable"))}catch{}X(u)};if(h=t({get done(){return q||u!==null},get open(){return S&&!q&&u===null},get bufferedAmount(){return l?.bufferedAmount??0},send(b){if(q||u||!S||!l)return;try{l.send(b)}catch{X({reason:"relay_closed"})}},end:(b)=>{if(q||u)return;if(!("error"in b)){X(b);return}if(u=b,m&&S)M()}}),q){h.close();return}if(e.aborted){N();return}e.addEventListener("abort",N,{once:!0}),g=setTimeout(()=>X({reason:"session_expired"}),Math.max(1,Date.parse(s.expires_at)-n())),d=setTimeout(()=>X({reason:"viewer_absent"}),p.viewerWaitMs??de);try{l=(p.connect??Ir)(s.relay_url,(p.loadProxy??j)()?.url)}catch{A();return}l.binaryType="arraybuffer",l.onopen=()=>{if(q||!l)return;S=!0,h?.opened()},l.onmessage=(b)=>{if(q)return;let Q=b.data,E=Q instanceof ArrayBuffer?new Uint8Array(Q):ArrayBuffer.isView(Q)?new Uint8Array(Q.buffer,Q.byteOffset,Q.byteLength):null;if(!E||E.byteLength===0)return;if(clearTimeout(d),m=!0,u){M();return}h?.received(E)},l.onclose=()=>{if(q)return;if(!S){A();return}X({reason:"relay_closed"})},l.onerror=()=>{if(q||S)return;A()}})}
-export{$t,Ls,G,qe,Bt};

package/bin/vm-hands/vm-hands-entry-lite-hqmyd73s.js

@@ -1,2 +0,0 @@
-// @bun
-import{er}from"./vm-hands-entry-lite-1xwxazmz.js";var _t=er.version;export{_t};

package/bin/vm-hands/vm-hands-entry-lite-z76nfb19.js

@@ -1,3 +0,0 @@
-// @bun
-import{to,ro}from"./vm-hands-entry-lite-vpz54vwj.js";function ps(o=process.platform){if(to(),o==="linux"||o==="win32")ro("strict")}
-export{ps};

package/bin/vm-hands/vm-hands-entry-lite-zp6naptr.js

@@ -1,3 +0,0 @@
-// @bun
-function Be(n){return Function("return ("+n+")")()}
-export{Be};

package/bin/vm-hands/vm-hands-executor-p92kw8nz.js

@@ -1,11 +0,0 @@
-// @bun
-import"./vm-hands-entry-lite-4vks5phw.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-tdgtpx8e.js";import"./vm-hands-entry-lite-rfz60hb3.js";import{it,Zi,br,Ot}from"./vm-hands-entry-lite-004yshd1.js";import"./vm-hands-entry-lite-hk6trmwa.js";import"./vm-hands-entry-lite-beyyy1gz.js";import"./vm-hands-entry-lite-fbhqfzbq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-s5qkb1fk.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-pf5qtbj5.js";import"./vm-hands-entry-lite-21qpxvt8.js";import{ar,cr,Ct,At}from"./vm-hands-entry-lite-37kgczw8.js";import"./vm-hands-entry-lite-s4bharcb.js";import"./vm-hands-entry-lite-wx4ax7wg.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-6c67a3jc.js";import{spawn as Ae}from"child_process";import{chmodSync as De,chownSync as Me,existsSync as G,lstatSync as ne,mkdirSync as Z,mkdtempSync as Le,readdirSync as Q,readFileSync as k,realpathSync as Te,rmdirSync as te,rmSync as He,writeFileSync as j}from"fs";import{join as p}from"path";import{readFileSync as ce,readlinkSync as le}from"fs";import{relative as xe}from"path";var ue=16;function de(n){return n.replace(/\\([0-7]{3})/g,(r,i)=>String.fromCharCode(Number.parseInt(i,8)))}function Ie(n){let r=[];for(let i of n.split(`
-`)){let e=i.split(" ");if(e.length<10||!/^\d+:\d+$/.test(e[2]))continue;r.push({device:e[2],root:de(e[3]),mountPoint:de(e[4])})}return r}function Ne(n,r,i){let e=n.replace(/\/+$/,"")||"/",c=(_)=>e==="/"||_===e||_.startsWith(`${e}/`),a=(_)=>new Map(Ie(_).filter((v)=>c(v.mountPoint)).map((v)=>[`${v.mountPoint}\x00${v.device}\x00${v.root}`,v.mountPoint])),l=a(r),m=a(i),h=(_)=>xe(e,_)||".",P=[...l].filter(([_])=>!m.has(_)).map(([,_])=>h(_)),C=[...m].filter(([_])=>!l.has(_)).map(([,_])=>h(_));return{missing:P,extra:C,referenceCount:l.size,ownCount:m.size}}function pe(n,r,i,e="/proc"){let c,a,l=null;try{c=ce(`${e}/1/mountinfo`,"utf8"),a=ce(`${e}/self/mountinfo`,"utf8")}catch(v){let N=v&&typeof v==="object"&&"code"in v&&typeof v.code==="string"?v.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:N});return}try{l=le(`${e}/1/ns/mnt`)===le(`${e}/self/ns/mnt`)}catch{}let{missing:m,extra:h,referenceCount:P,ownCount:C}=Ne(n,c,a),_={reference_count:P,own_count:C,missing_count:m.length,extra_count:h.length,same_namespace:l};if(h.length)r("vm_hands.mount_extra",{..._,extra:h.slice(0,ue)});if(m.length)throw r("vm_hands.mount_mismatch",{..._,missing:m.slice(0,ue)}),i(`${m.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var ve="/sys/fs/cgroup/reason-payload",D="vm-hands",ze="/run/ara-srt/fallbacks.jsonl",F="/reason-person",We="surface",re=5000,Be=1e4,fe="__VM_HANDS_PROOF_DIR__",Ue="__VM_HANDS_PROBE_NONCE__";class y extends Error{code;constructor(n,r){super(r);this.code=n}}function Fe(n,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new y("vm_hands_bind_invalid","bad bind id");return p(n,D,`b-${r.toLowerCase()}`)}var Ke=5000,be=(n)=>`'${n.replaceAll("'","'\\''")}'`;function on(n){let r=n.cgroup??ve,i=n.init.layout.payload_uid,e=n.log??(()=>{}),c=new Map,a=new Map,l=0,m=()=>{try{let t=k("/run/ara-srt/starts.jsonl","utf8"),o=t.slice(l>t.length?0:l).split(`
-`).filter(Boolean);l=t.length;let u=o.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(u.length)e("vm_hands.srt_server_starts",{count:u.length,elapsed_ms:u.slice(0,8)})}catch{}},h=null,P=!1,C=n.srtCgroup??"/sys/fs/cgroup/reason-srt",_=()=>{h??=ge()},v=0,N=()=>{try{let t=k(ze,"utf8"),o=t.slice(v>t.length?0:v);v=t.length;let u=o.split(`
-`).filter(Boolean).slice(0,1000);if(!u.length)return null;let f={},g=0;for(let b of u)try{let w=JSON.parse(b),d=typeof w.code==="string"&&/^[a-z_]{1,40}$/.test(w.code)?w.code:"other";if(f[d]=(f[d]??0)+1,typeof w.elapsed_ms==="number")g=Math.max(g,w.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return e("vm_hands.srt_fallbacks",{count:u.length,codes:f,max_elapsed_ms:g}),{count:u.length,codes:f,max_elapsed_ms:g}}catch{return null}},O=!1,I=(t,o,u)=>{if(O)throw Error("vm_hands_pool_held");return K(t,o,u)},z=(t)=>(o,u,f)=>Ae("/bin/sh",["-c",`echo $$ > ${be(p(t,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",o,...u],f),K=z(p(r,D)),W=p(r,D,"probe"),B=(t)=>Fe(r,t),Ce=(t)=>{let o=B(t);try{Z(o,{mode:493})}catch(u){if(!(u&&typeof u==="object"&&("code"in u)&&u.code==="EEXIST"))throw new y("vm_hands_bind_failed","bind cgroup")}return o},Oe=(t)=>{try{te(B(t))}catch{}},M=n.prespawn?Zi({spawnProcess:I,...n.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:n.relayDependencies.sourceEntrypoint}:{},log:(t,o)=>e(t,o??{})}):null;M?.arm();let q=M?setInterval(()=>{M.arm()},Ke):null;q?.unref?.();async function E(t){let o=c.get(t);if(c.delete(t),!o)return;o.abort.abort(),await o.done}return{bindCgroup:B,async startExecutor(t){if(_(),a.set(t.bindId,ge()),P=!0,!t.claim)throw new y("vm_hands_bind_invalid","an executor needs the claim it serves");await E(t.bindId);let{claim:o,bindId:u}=t,f=Ce(u),g=o.owner;if(!g||typeof g.device_id!=="string"||typeof o.root_id!=="string")throw new y("vm_hands_bind_invalid","claim without its owner Device or root");let b=new AbortController,w,d,x=new Promise((s,S)=>{w=s,d=S}),L,R=new Promise((s)=>{L=s}),U=Ot({headless:!0,hostExecution:!0,runtimeDirectory:n.runtimeDirectory,deviceIdentity:{deviceId:g.device_id,rootId:o.root_id,apiOrigin:n.apiOrigin},claimOwner:o.owner,root:n.root,runId:o.run_id,operationId:o.operation_id,attemptId:o.attempt_id,payload:Object.fromEntries(Object.entries(o.payload).filter(([s])=>!s.startsWith("vm_hands_"))),signal:b.signal,...t.workspaceGrant?{workspaceGrant:t.workspaceGrant}:{},emitEvent:async(s,S)=>{if(s==="hands.ready"){w(S);return}if(s==="hands.started"||s==="hands.stopped"||s==="hands.failed")return;await n.forward(u,s,S)}},{...n.relayDependencies,spawnWorker:(s)=>z(f)(s.command,s.args,s.options),...M?{takePrespawnedWorker:(s)=>{let S=M.take(s);if(!S?.pid)return S;try{return j(p(f,"cgroup.procs"),String(S.pid)),S}catch{try{S.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:M.adopt}:{}}).then(()=>{L("executor_stopped")},(s)=>{let S=s&&typeof s==="object"&&"code"in s?String(s.code):"executor_failed";d(new y(S,s instanceof Error?s.message:String(s))),L(S)}).finally(()=>d(new y("vm_hands_executor_exited","executor ended before it was ready")));c.set(u,{abort:b,done:U,exited:R,operationId:o.operation_id,runId:o.run_id,expiresAtMs:Date.parse(String(o.payload.expires_at??""))||0});let T=await x,V=T.executor_launch_id;if(typeof V!=="string")throw new y("vm_hands_bind_failed","executor ready without a launch id");return{launchId:V,readyData:T,applied:{hands_confinement:typeof o.payload.hands_confinement==="string"?o.payload.hands_confinement:null,browser_egress:o.payload.browser_egress??null}}},takeSrtFallbacks:N,executorExited(t){return c.get(t)?.exited??new Promise(()=>{})},freezeBind(t){let o=B(t);if(G(p(o,"cgroup.freeze")))j(p(o,"cgroup.freeze"),"1")},async killAndVerifyPayload(t){let o=new Set(t?.keep??[]);if(o.size||t?.own)return $e(t?.bindId??null,o,t?.own===!0);O=!0;let u=he();try{await we();let f=Promise.all([...c.keys()].map((d)=>E(d).catch(()=>{return})));m();let g=Date.now()+re;await J(r,g,"payload"),await f;let b=(P||n.srtWarmLate?.()===!0)&&G(p(C,"cgroup.events"));if(b)await J(C,g,"srt");let w=oe(i).filter((d)=>!A(d,F));if(h!==null){let d=se(h).filter((x)=>x!==process.pid&&!A(x,F));if(d.length)throw e("vm_hands.kill_strays",{strays:Y(d)}),new y("vm_hands_kill_unverified",`${d.length} process(es) the run started survived it`);h=null}if(P=!1,b)n.onSrtReset?.();if(w.length)throw e("vm_hands.kill_survivors",{pids:w.slice(0,16)}),new y("vm_hands_kill_unverified",`${w.length} payload-uid process(es) outside the payload cgroup`);a.clear();for(let d of ae())try{te(p(r,D,d))}catch{}}finally{O=!1,u()}if(M)setTimeout(()=>{if(!c.size)M.arm()},100).unref?.()},async killProbe(){let t=Date.now()+re;if(G(p(W,"cgroup.events"))){await J(W,t,"probe");try{te(W)}catch{}}let o=ie(process.pid);if(o===null)throw new y("vm_hands_kill_unverified","agent start time unreadable");await je(r,o,t);let u=(g)=>{let b=ie(g);return b!==null&&b<=o},f=oe(i).filter((g)=>u(g)&&!A(g,F));if(f.length)throw e("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest"}),new y("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(h!==null){let g=[r,p(r,D)].map((d)=>d.replace(/^\/sys\/fs\/cgroup/,"")),b=C.replace(/^\/sys\/fs\/cgroup/,""),w=se(h).filter((d)=>d!==process.pid&&!A(d,F)&&!A(d,"/reason-vm-hands")&&!A(d,b)&&!g.some((x)=>me(d,x)));if(w.length&&P)throw e("vm_hands.kill_strays",{strays:Y(w),at:"attest"}),new y("vm_hands_kill_unverified",`${w.length} process(es) the run started survived it`);if(w.length)e("vm_hands.attest_concurrent",{processes:Y(w),count:w.length});h=null}},async runProbe({nonce:t,script:o}){if(_(),!o.includes(fe))throw new y("vm_hands_probe_failed","probe names no proof directory");let u=n.proofParent??"/tmp/reason-vm-hands-proof";Z(u,{mode:457,recursive:!0});let f=ne(u);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new y("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Le(p(u,"p-")),b=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(t))throw new y("vm_hands_probe_failed","proof directory path or nonce");Me(g,i,i),De(g,448);let w=ne(g).ino;try{Z(W,{mode:493})}catch(R){if(!(R&&typeof R==="object"&&("code"in R)&&R.code==="EEXIST"))throw new y("vm_hands_probe_failed","probe cgroup")}let d=z(W)("/bin/bash",["-c",o.replaceAll(fe,g).replaceAll(Ue,t)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),x="";d.stdout?.on("data",(R)=>{if(x.length<16384)x+=R.toString("utf8").slice(0,16384-x.length)});let L=await new Promise((R)=>{let U=setTimeout(()=>{b=!0,d.kill("SIGKILL"),R(124)},Be);d.once("error",()=>{clearTimeout(U),R(127)}),d.once("close",(T)=>{clearTimeout(U),R(T??1)})});return e("vm_hands.probe",{nonce_len:t.length,exit_code:L}),{exitCode:L,markers:x,proofDirInode:w}}finally{if(!b)He(g,{recursive:!0,force:!0})}},restatLayout(){let{session_root:t,alias:o}=n.init.layout,u="invalid";try{br(t),u="0:0:755"}catch{}let f=!1,g=-1;try{let b=ne(o);g=b.uid,f=u==="0:0:755"&&o===p(t,"repo")&&!b.isSymbolicLink()&&b.isDirectory()&&Te(o)===o&&b.uid===i}catch{}return{root_mode:u,alias_ok:f,owner_uid:g}},verifyMounts(){pe(n.init.layout.session_root,e,(t)=>new y("vm_hands_mount_mismatch",t))},installEnvironment(t,o){let u=c.get(t);if(!u)throw new y("environment_unavailable","no executor owns an environment");return it({root:n.root,operationId:u.operationId,payload:o}).installed_revision},async stop(){if(q)clearInterval(q);M?.close(),await Promise.all([...c.keys()].map((t)=>E(t)))}};function ae(){try{return Q(p(r,D),{withFileTypes:!0}).filter((t)=>t.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(t.name)).map((t)=>t.name)}catch{return[]}}async function $e(t,o,u=!1){let f=new Set([...o].map((b)=>b.toLowerCase())),g=he();try{await we();let b=Date.now()+re,w=new Set(ae().filter((s)=>!f.has(s.slice(2))).map((s)=>s.slice(2)));if(t)w.add(t.toLowerCase());let d=null;for(let s of w){let S=E(s).catch(()=>{return}),ee=a.get(s);if(ee!==void 0)d=d===null?ee:Math.min(d,ee);if(G(p(B(s),"cgroup.events")))await J(B(s),b,"bind");await S}let x=[...f].map((s)=>B(s).replace(/^\/sys\/fs\/cgroup/,"")),L=[r,p(r,D)].map((s)=>s.replace(/^\/sys\/fs\/cgroup/,"")),R=C.replace(/^\/sys\/fs\/cgroup/,""),U=(s)=>A(s,F)||x.some((S)=>A(s,S)),T=u?[]:oe(i).filter((s)=>!U(s));if(T.length)throw e("vm_hands.kill_survivors",{pids:T.slice(0,16),beside:f.size}),new y("vm_hands_kill_unverified",`${T.length} payload-uid process(es) outside a live bind`);let V=(s)=>!U(s)&&!A(s,"/reason-vm-hands")&&!A(s,R)&&!L.some((S)=>me(s,S));if(d!==null){let s=se(d).filter((S)=>S!==process.pid&&V(S));if(s.length)throw e("vm_hands.kill_strays",{strays:Y(s),beside:f.size}),new y("vm_hands_kill_unverified",`${s.length} process(es) the run started survived it`)}for(let s of w)a.delete(s),Oe(s)}finally{g()}}}function ie(n,r="/proc"){try{let i=k(p(r,String(n),"stat"),"utf8"),e=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(e)?e:null}catch{return null}}function Se(n,r="/proc"){try{let i=k(p(r,String(n),"stat"),"utf8"),e=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(e)?e:null}catch{return null}}async function je(n,r,i){try{j(p(n,"cgroup.freeze"),"1")}catch(e){throw new y("vm_hands_kill_unverified",`payload cgroup.freeze: ${e instanceof Error?e.message:String(e)}`)}try{for(;;){let e=Pe(n).filter((a)=>ke(a,n)),c=new Set(e.filter((a)=>{let l=ie(a);return l!==null&&l<=r}));for(let a=!0;a;){a=!1;for(let l of e){if(c.has(l))continue;let m=Se(l);if(m!==null&&c.has(m))c.add(l),a=!0}}if(c.size===0)return;if(Date.now()>i)throw new y("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let a of c)try{process.kill(a,"SIGKILL")}catch{}await new Promise((a)=>setTimeout(a,10))}}finally{try{j(p(n,"cgroup.freeze"),"0")}catch{}}}function me(n,r,i="/proc"){try{return k(p(i,String(n),"cgroup"),"utf8").split(`
-`).find((c)=>c.startsWith("0::"))?.slice(3)===r}catch{return!1}}function A(n,r,i="/proc"){try{let c=k(p(i,String(n),"cgroup"),"utf8").split(`
-`).find((a)=>a.startsWith("0::"))?.slice(3)??"";return c===r||c.startsWith(`${r}/`)}catch{return!1}}var Ge=100;function ge(){try{return Math.floor(Number(k("/proc/uptime","utf8").split(" ")[0])*Ge)}catch{return 0}}async function J(n,r,i){try{j(p(n,"cgroup.freeze"),"1")}catch(e){throw new y("vm_hands_kill_unverified",`${i} cgroup.freeze: ${e instanceof Error?e.message:String(e)}`)}while(!/^populated 0$/m.test(k(p(n,"cgroup.events"),"utf8"))){if(Date.now()>r)throw new y("vm_hands_kill_unverified",`${i} cgroup still populated (left frozen)`);for(let e of Pe(n)){if(!ke(e,n))continue;try{process.kill(e,"SIGKILL")}catch{}}await new Promise((e)=>setTimeout(e,10))}try{j(p(n,"cgroup.freeze"),"0")}catch(e){throw new y("vm_hands_kill_unverified",`${i} cgroup thaw: ${e instanceof Error?e.message:String(e)}`)}}function ke(n,r){let i=r.replace(/^\/sys\/fs\/cgroup/,"")||"/",e="";try{e=k(`/proc/${n}/cgroup`,"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??""}catch{return!1}let c=e.slice(3);return c===i||c.startsWith(`${i}/`)}function Pe(n){let r=[],i=(e)=>{try{for(let a of k(p(e,"cgroup.procs"),"utf8").split(`
-`))if(/^\d+$/.test(a))r.push(Number(a))}catch{}let c=[];try{c=Q(e,{withFileTypes:!0}).filter((a)=>a.isDirectory()).map((a)=>a.name)}catch{}for(let a of c)i(p(e,a))};return i(n),r}function Y(n,r="/proc"){return n.slice(0,16).map((i)=>{let e="?",c="?";try{e=k(p(r,String(i),"comm"),"utf8").trim().slice(0,32)}catch{}try{c=(k(p(r,String(i),"cgroup"),"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:i,comm:e,ppid:Se(i,r),cgroup:c}})}function se(n,r="/proc"){let i=[];for(let e of Q(r)){if(!/^\d+$/.test(e))continue;let c;try{c=k(p(r,e,"stat"),"utf8")}catch{continue}let a=c.slice(c.lastIndexOf(")")+2).split(" "),l=Number(a[1]),m=Number(a[6]),h=Number(a[19]);if(!((m&2097152)!==0||l===2||e==="2")&&a[0]!=="Z"&&h>=n)i.push(Number(e))}return i}function oe(n,r="/proc"){let i=[];for(let e of Q(r)){if(!/^\d+$/.test(e))continue;let c;try{c=k(p(r,e,"status"),"utf8")}catch{continue}let a=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(c);if(a&&a.slice(1).some((l)=>Number(l)===n))i.push(Number(e))}return i}function _e(n="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(k(n,"utf8").trim())>=1}catch{return!1}}var H=0,Re=[],X=new Set;function he(){H++;let n=!1;return()=>{if(n)return;if(n=!0,--H===0)for(let r of Re.splice(0))r()}}function Ee(){return H===0?Promise.resolve():new Promise((n)=>{Re.push(n)})}async function ye(){while(H>0)await Ee()}async function we(){let n=Date.now()+1000;while(X.size&&Date.now()<n)await new Promise((r)=>setTimeout(r,2))}function Ve(n,r){let i=r.replace(/^\/sys\/fs\/cgroup/,"");X.add(n);let e=()=>{let c="";try{c=k(`/proc/${n}/cgroup`,"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??""}catch{X.delete(n);return}if(c.slice(3)===i){X.delete(n);return}setTimeout(e,1)};e()}function an(n){let r={person:n.personCgroup??p("/sys/fs/cgroup",F,D),model:n.payloadCgroup??p(ve,D),surface:n.surfaceCgroup??p("/sys/fs/cgroup",F,D,We)},i=n.entry??process.argv[1]??"",e={},c=(l)=>l.startsWith("model:")&&n.bindCgroup?n.bindCgroup(l.slice(6)):r[l.startsWith("model")?"model":l==="surface"?"surface":"person"],a=(l)=>{let m=l.startsWith("model")?"model":l==="surface"?"surface":"person",h=new Map,P=String(n.payloadUid),C=String(n.payloadGid);if(m==="surface")try{Z(c(l),{mode:493})}catch{}let _=m==="surface"?'exec "$@"':`exec /usr/bin/setpriv --no-new-privs --reuid=${P} --regid=${C} --clear-groups -- "$@"`,v=Bun.spawn(["/bin/sh","-c",`echo $$ > ${be(p(c(l),"cgroup.procs"))} || exit 125; ${_}`,"vm-hands-op-join",process.execPath,"--no-install",i,"--vm-hands-op-runner",...m==="person"?[ar]:[],...m==="surface"?[cr,`${Ct}${P}`,`${At}${n.surfaceDirectory??""}`]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:m==="surface"?process.env.HOME||"/root":"/home/runner",...G("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(O){let I=O;if(m==="surface"&&I.t==="readiness"){let K=O;n.log?.("vm_hands.surface_ready",{lanes:Object.keys(K.lanes??{}).filter((W)=>K.lanes[W]===!0),display_video:K.display_video===!0}),n.onSurfaceReadiness?.(K);return}let z=h.get(I.id);if(!z)return;if(I.t==="event"&&I.event)z.onEvent(I.event);if(I.t==="done")h.delete(I.id),z.done(I.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});v.exited.then((O)=>{if(e[l]?.child===v)delete e[l];for(let[,I]of h)I.done({status:"failed",error_code:"vm_hands_op_runner_exited"});if(h.clear(),n.log?.("vm_hands.op_runner_exited",{kind:m,code:O}),m==="surface")n.onSurfaceReadiness?.(null)}),Ve(v.pid,c(l));let N={child:v,pending:h};return e[l]=N,N};return{run(l,m,h,P,C){if(!_e())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let _=l==="model"&&C&&n.bindCgroup?`model:${C.toLowerCase()}`:l,v=async()=>{while(!e[_]&&H>0)await ye()};return v().then(async()=>{if(!e[_]&&H>0)await v()}).then(()=>new Promise((N)=>{if(!e[_]&&H>0){N({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let O=e[_]??a(_);O.pending.set(m.id,{onEvent:h,done:N}),P.addEventListener("abort",()=>{try{O.child.send({t:"cancel",id:m.id})}catch{}},{once:!0});try{O.child.send({t:"op",...m})}catch{O.pending.delete(m.id),N({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(l){if(!e[l]&&_e())ye().then(()=>{if(!e[l]&&H===0)a(l)})},notify(l,m){let h=e[l];if(!h)return!1;try{return h.child.send(m),!0}catch{return!1}},stop(){for(let l of Object.keys(e))e[l]?.child.kill()}}}export{ve as VM_HANDS_PAYLOAD_CGROUP,D as VM_HANDS_PAYLOAD_JOIN,F as VM_HANDS_PERSON_CGROUP,Ue as VM_HANDS_PROBE_NONCE_TOKEN,fe as VM_HANDS_PROOF_DIR_TOKEN,We as VM_HANDS_SURFACE_JOIN,y as VmHandsExecutorError,on as createVmHandsExecutor,an as createVmHandsOpRunners,Y as describeProcesses,A as inCgroup,oe as payloadUidProcesses,se as processesStartedSince,_e as ptraceProtected,Pe as subtreePids,Fe as vmHandsBindCgroup};

package/bin/vm-hands/vm-hands-op-runner-ekgtqc07.js

@@ -1,2 +0,0 @@
-// @bun
-import{ar,cr,Ct,At,Pt,as}from"./vm-hands-entry-lite-37kgczw8.js";export{ar as VM_HANDS_OP_RUNNER_PERSON_ARG,cr as VM_HANDS_OP_RUNNER_SURFACE_ARG,At as VM_HANDS_SURFACE_DIRECTORY_ARG,Pt as VM_HANDS_SURFACE_OPS,Ct as VM_HANDS_SURFACE_UID_ARG,as as runVmHandsOpRunner};

package/bin/vm-hands/worker-preview-readiness-w62n91kr.js

@@ -1,2 +0,0 @@
-// @bun
-import{ds}from"./vm-hands-entry-lite-ec9jemny.js";import"./vm-hands-entry-lite-s4bharcb.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{ds as probeWorkerPreview};

package/bin/vm-hands/worker-sandbox-2r5nseff.js

@@ -1,2 +0,0 @@
-// @bun
-import{ps}from"./vm-hands-entry-lite-z76nfb19.js";import"./vm-hands-entry-lite-vpz54vwj.js";import"./vm-hands-entry-lite-s5qkb1fk.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{ps as configureWorkerSandbox};