@reason-machines/cli-linux-arm64 0.2.503 → 0.2.505

package/bin/vm-hands/{vm-hands-entry-lite-n4xgpgkw.js → vm-hands-entry-lite-x39tmj7j.js}

@@ -1,5 +1,5 @@
 // @bun
-import{_e,ye,we}from"./vm-hands-entry-lite-psywfz8m.js";import{De,Ne,Le}from"./vm-hands-entry-lite-87vmbt38.js";import{spawn as A}from"child_process";import{randomUUID as s}from"crypto";import{basename as C}from"path";import{fileURLToPath as E}from"url";function S(){let p=C(process.execPath).startsWith("bun");return{command:process.execPath,args:[...p?["--no-env-file",E(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function ms(p,a,m=S()){if(a.aborted||!["darwin","linux","win32"].includes(process.platform)||process.platform==="win32"&&!ye())return!1;let n=new AbortController,o=()=>n.abort();a.addEventListener("abort",o,{once:!0});let y=setTimeout(o,5000),t=A(m.command,m.args,{cwd:p,...Ne(),stdio:["pipe","pipe","ignore"],env:De()});Le(t);let l=!1,b=new Promise((e)=>t.once("close",()=>{l=!0,e()}));t.on("error",o);let f,w,k=new Promise((e)=>{f=e}),I=new Promise((e)=>{w=e}),v=new Promise((e)=>n.signal.addEventListener("abort",()=>e(null),{once:!0})),i="",g=0,P=!1;t.stdout.setEncoding("utf8"),t.stdout.on("data",(e)=>{if(g+=Buffer.byteLength(e),i+=e,g>512){o();return}while(i.includes(`
+import{_e,ye,we}from"./vm-hands-entry-lite-psywfz8m.js";import{De,Ne,Le}from"./vm-hands-entry-lite-87vmbt38.js";import{spawn as A}from"child_process";import{randomUUID as s}from"crypto";import{basename as C}from"path";import{fileURLToPath as E}from"url";function S(){let p=C(process.execPath).startsWith("bun");return{command:process.execPath,args:[...p?["--no-env-file",E(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function _s(p,a,m=S()){if(a.aborted||!["darwin","linux","win32"].includes(process.platform)||process.platform==="win32"&&!ye())return!1;let n=new AbortController,o=()=>n.abort();a.addEventListener("abort",o,{once:!0});let y=setTimeout(o,5000),t=A(m.command,m.args,{cwd:p,...Ne(),stdio:["pipe","pipe","ignore"],env:De()});Le(t);let l=!1,b=new Promise((e)=>t.once("close",()=>{l=!0,e()}));t.on("error",o);let f,w,k=new Promise((e)=>{f=e}),I=new Promise((e)=>{w=e}),v=new Promise((e)=>n.signal.addEventListener("abort",()=>e(null),{once:!0})),i="",g=0,P=!1;t.stdout.setEncoding("utf8"),t.stdout.on("data",(e)=>{if(g+=Buffer.byteLength(e),i+=e,g>512){o();return}while(i.includes(`
 `)){let c=i.indexOf(`
 `),d=i.slice(0,c);i=i.slice(c+1);try{if(!P){let r=JSON.parse(d);if(!r||Object.keys(r).length!==2||!Number.isInteger(r.port)||r.port<1024||r.port>65535||typeof r.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(r.token))throw Error("probe_receipt_invalid");P=!0,f({port:r.port,token:r.token})}else if(d==="ready")w(!0);else o()}catch{o()}}}),b.then(o);let h,u=!1;try{let e=await Promise.race([k,v]);if(!e||!t.pid||n.signal.aborted||a.aborted)return!1;let c=Date.now()+4500,d=s(),r={organizationId:s(),userId:s(),runId:s(),deviceId:s(),rootId:s(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:s(),port:e.port,expiresAtMs:c},L={binding:r,executorLaunchId:d,job:{jobId:r.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:c,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:t.pid,processGroupId:t.pid,executorLaunchId:d}}},x=we({binding:r,deniedPorts:new Set,readCurrentJob:async()=>!l&&!n.signal.aborted?L:null});h=await _e({binding:r,deviceRelayUrl:`ws://127.0.0.1:${e.port}/device/readiness/${e.token}`,port:x,signal:n.signal}),u=await Promise.race([I,v])===!0&&!n.signal.aborted&&!a.aborted}catch{u=!1}finally{if(clearTimeout(y),a.removeEventListener("abort",o),h?.close(),n.abort(),t.stdin.destroy(),!l)t.kill("SIGKILL");await b}return u&&l}
-export{ms};
+export{_s};

package/bin/vm-hands/{vm-hands-entry-lite-61yxnt1v.js → vm-hands-entry-lite-ybzrnrf1.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Mn,Eo,zt}from"./vm-hands-entry-lite-w0pegc58.js";import{On,Ve,po,In,Dn,Nn,Pr,x}from"./vm-hands-entry-lite-p7cqhtyg.js";import{xt}from"./vm-hands-entry-lite-1g1v87ky.js";import{Dr}from"./vm-hands-entry-lite-13rapgf5.js";import{j}from"./vm-hands-entry-lite-gc7550c0.js";import{a}from"./vm-hands-entry-lite-swrymqj9.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as z,spawn as H}from"child_process";import{randomBytes as Qe}from"crypto";import{chmodSync as De,existsSync as I,lstatSync as _e,mkdirSync as we,readFileSync as Re,rmSync as ee,writeFileSync as g}from"fs";import{connect as de}from"net";import{join as y}from"path";var S=32,w=76;var B="./desktop-wallpaper-0pjhgyfk.jpg";var O="./dock-browser-afp005mt.png";var F="./dock-files-rywdm96b.png";var k="./dock-terminal-s41cj1jp.png";var K=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
+import{$n,Eo,zt}from"./vm-hands-entry-lite-eabever7.js";import{On,Ve,po,In,Dn,Nn,Pr,x}from"./vm-hands-entry-lite-ydxrabqz.js";import{xt}from"./vm-hands-entry-lite-v9qq2cgv.js";import{Dr}from"./vm-hands-entry-lite-qpdpzg8g.js";import{j}from"./vm-hands-entry-lite-rzr2ncf5.js";import{a}from"./vm-hands-entry-lite-swrymqj9.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as z,spawn as H}from"child_process";import{randomBytes as Qe}from"crypto";import{chmodSync as De,existsSync as I,lstatSync as _e,mkdirSync as we,readFileSync as Re,rmSync as ee,writeFileSync as g}from"fs";import{connect as de}from"net";import{join as y}from"path";var S=32,w=76;var B="./desktop-wallpaper-0pjhgyfk.jpg";var O="./dock-browser-afp005mt.png";var F="./dock-files-rywdm96b.png";var k="./dock-terminal-s41cj1jp.png";var K=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
 # The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
 # python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
 # Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE
@@ -120,9 +120,9 @@ Type=Application
 Categories=System;FileManager;
 `;var V={"wallpaper.jpg":B,"dock-browser.png":O,"dock-terminal.png":k,"dock-files.png":F},Te=K,he='set_wallpaper() { if command -v feh >/dev/null 2>&1; then feh --bg-fill "$1"; else python3 "$2" "$1"; fi; }';function v(e){let s=(i)=>i.replaceAll("DISPLAY=:99",`DISPLAY=${e.display}`).replaceAll("/tmp/ara-",`${e.root}/ara-`),p=new Set(e.absent??[]),n=le.split(`
 `).filter((i)=>!(p.has("terminal")&&i.endsWith("/ara-terminal.desktop"))&&!(p.has("files")&&i.endsWith("/ara-files.desktop"))).join(`
-`),t={"openbox/rc.xml":ye(e.screen),"tint2/tint2rc":s(n),"picom/picom.conf":ue,...p.has("terminal")?{}:{"ara-terminal.desktop":s(Xe)},...p.has("files")?{}:{"ara-files.desktop":s(fe)},"ara-chromium.desktop":s(Se).replace("chromium --no-sandbox %U",e.browserExec),"ara-set-root-wallpaper.py":Te},o=[...R.slice(0,3),he,'[ ! -f "$ROOT/ara-wallpaper.jpg" ] || set_wallpaper "$ROOT/ara-wallpaper.jpg" "$ROOT/ara-set-root-wallpaper.py" || true',...R.slice(3)];return{files:t,start:o}}var R=['ticks() { line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1; rest=${line##*) }; case $rest in Z*|X*) return 1;; esac; printf "%s" "$rest" | cut -d " " -f20; }','alive() { [ -f "$ROOT/$1.pid" ] || return 1; read -r pid start <"$ROOT/$1.pid"; current=$(ticks "$pid") || return 1; [ "$current" = "$start" ] && kill -0 "$pid" 2>/dev/null; }','launch() { name=$1; shift; "$@" 9>&- >"$ROOT/$name.log" 2>&1 & pid=$!; start=$(ticks "$pid"); printf "%s %s\\n" "$pid" "$start" >"$ROOT/$name.pid"; }','if [ -f "$ROOT/tint2/tint2rc" ] && ! alive tint2 && command -v tint2 >/dev/null 2>&1; then launch tint2 tint2 -c "$ROOT/tint2/tint2rc"; fi','if [ -f "$ROOT/picom/picom.conf" ] && ! alive picom && command -v picom >/dev/null 2>&1; then launch picom picom --config "$ROOT/picom/picom.conf"; fi'];var Ae=43200000,D=":99",Ee=60000,_=15000,C={width:1280,height:800},Ne=/^[A-Za-z0-9._:-]{1,160}$/;function Le(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}var Je=["video","viewer","viewer_same_network","viewer_network"];function Ce(e,s=Date.now()){let p=["relay_url","session_id","expires_at"];if(!Le(e)||p.some((c)=>!(c in e))||Object.keys(e).some((c)=>!p.includes(c)&&!Je.includes(c)))throw new r("invalid_display_request","Reason desktop request is malformed.");let n="video"in e?Eo(e.video):void 0,t="viewer"in e?Mn(e.viewer):null;if(n===null)throw new r("invalid_display_request","Reason desktop video request is invalid.");let o=null;try{o=typeof e.relay_url==="string"?new URL(e.relay_url):null}catch{}if(!o||o.protocol!=="wss:"&&o.protocol!=="ws:"||o.username||o.password)throw new r("invalid_display_request","Reason desktop relay URL is invalid.");if(typeof e.session_id!=="string"||!Ne.test(e.session_id))throw new r("invalid_display_request","Reason desktop session identity is invalid.");let i=typeof e.expires_at==="string"?Date.parse(e.expires_at):Number.NaN;if(!Number.isFinite(i)||i<=s)throw new r("invalid_display_request","Reason desktop session has already expired.");return{relay_url:e.relay_url,session_id:e.session_id,expires_at:new Date(Math.min(i,s+Ae)).toISOString(),...n?{video:n}:{},...t?{viewer:t}:{},...n&&e.viewer_same_network===!0?{viewer_same_network:!0}:{}}}function $t(e=process.platform){return(e==="linux"||e==="darwin"||e==="win32")&&x()?.features.display===!0}async function Ms(){if(process.platform==="win32")return $t()&&await Pr();if(process.platform!=="darwin")return $t();return await Pr()}function G(e){we(e,{recursive:!0,mode:448});let s=_e(e);if(!s.isDirectory()||s.isSymbolicLink()||process.getuid&&s.uid!==process.getuid())throw new r("display_unavailable","Reason desktop state directory is not private.");De(e,448)}function Ue(e,s){let p=(t)=>{let o=Buffer.alloc(2);return o.writeUInt16BE(t.length),Buffer.concat([o,t])},n=Buffer.from([255,255]);return Buffer.concat([n,p(Buffer.alloc(0)),p(Buffer.from(e)),p(Buffer.from("MIT-MAGIC-COOKIE-1")),p(s)])}function T(e,s,p=2000){return new Promise((n)=>{let t=de(e),o="",i=(c)=>{t.destroy(),n(c)};t.setTimeout(p,()=>i(!1)),t.once("error",()=>i(!1)),t.once("close",()=>i(!1)),t.once("connect",()=>{if(!s)i(!0)}),t.on("data",(c)=>{if(o+=c.toString("latin1"),o.length>=4)i(o.startsWith("RFB "))})})}async function m(e,s){let p=Date.now()+s;while(Date.now()<p){if(await e())return!0;await new Promise((n)=>setTimeout(n,100))}return!1}function d(e,s,p){return new Promise((n)=>{let t=H(e,s,{detached:!0,stdio:"ignore",env:p});t.once("error",()=>n(-1)),t.once("exit",(o)=>n(o)),t.unref(),setTimeout(()=>n(null),_).unref()})}var U=null;function qe(e=a()){return U??=ge(e).finally(()=>{U=null}),U}async function ge(e){let s=x({home:e});if(!s?.xvfb||!s.x11vnc||!s.openbox)throw new r("display_unavailable","Run `reason desktop install` on this machine to enable its desktop.");xt({root:s.root,automation:s.automation,extensionDir:s.extensionDir});let p=y(s.root,"display");G(p);let n=await Me(e,p,s.x11vnc);if(n)return n;let t={display:D,xauthority:y(p,"Xauthority"),rfbSocket:y(p,"rfb.sock")},o=y(p,"pulse"),i=(async()=>{try{G(o)}catch{return null}return await po(o,s.pulseaudio)})();G(y(p,"home"));let c=re(p,t,s.pulseaudio),h=async()=>({...t,sound:await i});if(await T({path:t.rfbSocket},!0))return pe(y(p,"theme"),R,c),await h();if(!I(t.xauthority))g(t.xauthority,Ue(D.slice(1),Qe(16)),{mode:384,flag:"wx"});let l=te(y(p,"theme"),t.display,C),q={path:`/tmp/.X11-unix/X${D.slice(1)}`};if(!await T(q,!1)){let u=`${C.width}x${C.height}`;if(s.xvnc)ee(t.rfbSocket,{force:!0}),d(s.xvnc,[t.display,"-geometry",u,"-depth","24","-nolisten","tcp","-auth",t.xauthority,"-rfbport","-1","-rfbunixpath",t.rfbSocket,"-SecurityTypes","None","-UseBlacklist=0","-AlwaysShared","-desktop","Reason"],c);else d(s.xvfb,[t.display,"-screen","0",`${u}x24`,"-nolisten","tcp","-auth",t.xauthority],c);if(!await m(()=>T(q,!1),_)||s.xvnc&&!await m(()=>T({path:t.rfbSocket},!0),_))throw new r("display_unavailable","Reason could not start the virtual display.");d(s.openbox,["--config-file",l.openboxConfig],c)}if(await ne(l,c),!await se(s.x11vnc,t,p,"x11vnc.log",c))throw new r("display_unavailable","Reason could not start the desktop server.");return await h()}function re(e,s,p){let n={HOME:y(e,"home"),PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:s.display,XAUTHORITY:s.xauthority};if(p)n.PULSE_SERVER=Ve(On(y(e,"pulse")));return n}async function se(e,s,p,n,t){if(await T({path:s.rfbSocket},!0))return!0;ee(s.rfbSocket,{force:!0});let o=await d(e,["-display",s.display,"-auth",s.xauthority,"-rfbport","0","-rfbportv6","-1","-unixsock",s.rfbSocket,"-nopw","-forever","-shared","-noxdamage","-sb","0","-rfbversion","3.7","-quiet","-bg","-o",y(p,n)],t);if(o!==null&&o!==0)return!1;return await m(()=>T({path:s.rfbSocket},!0),_)}async function me(){let e=["DISPLAY","XAUTHORITY","WAYLAND_DISPLAY","XDG_SESSION_TYPE"],s=(p)=>Object.fromEntries(e.flatMap((n)=>p[n]?[[n,p[n]]]:[]));if(process.env.DISPLAY)return s(process.env);try{let p=await new Promise((n,t)=>z("systemctl",["--user","show-environment"],{encoding:"utf8",timeout:2000},(o,i)=>o?t(o):n(i)));return s(Object.fromEntries(p.split(`
+`),t={"openbox/rc.xml":ye(e.screen),"tint2/tint2rc":s(n),"picom/picom.conf":ue,...p.has("terminal")?{}:{"ara-terminal.desktop":s(Xe)},...p.has("files")?{}:{"ara-files.desktop":s(fe)},"ara-chromium.desktop":s(Se).replace("chromium --no-sandbox %U",e.browserExec),"ara-set-root-wallpaper.py":Te},o=[...R.slice(0,3),he,'[ ! -f "$ROOT/ara-wallpaper.jpg" ] || set_wallpaper "$ROOT/ara-wallpaper.jpg" "$ROOT/ara-set-root-wallpaper.py" || true',...R.slice(3)];return{files:t,start:o}}var R=['ticks() { line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1; rest=${line##*) }; case $rest in Z*|X*) return 1;; esac; printf "%s" "$rest" | cut -d " " -f20; }','alive() { [ -f "$ROOT/$1.pid" ] || return 1; read -r pid start <"$ROOT/$1.pid"; current=$(ticks "$pid") || return 1; [ "$current" = "$start" ] && kill -0 "$pid" 2>/dev/null; }','launch() { name=$1; shift; "$@" 9>&- >"$ROOT/$name.log" 2>&1 & pid=$!; start=$(ticks "$pid"); printf "%s %s\\n" "$pid" "$start" >"$ROOT/$name.pid"; }','if [ -f "$ROOT/tint2/tint2rc" ] && ! alive tint2 && command -v tint2 >/dev/null 2>&1; then launch tint2 tint2 -c "$ROOT/tint2/tint2rc"; fi','if [ -f "$ROOT/picom/picom.conf" ] && ! alive picom && command -v picom >/dev/null 2>&1; then launch picom picom --config "$ROOT/picom/picom.conf"; fi'];var Ae=43200000,D=":99",Ee=60000,_=15000,C={width:1280,height:800},Ne=/^[A-Za-z0-9._:-]{1,160}$/;function Le(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}var Je=["video","viewer","viewer_same_network","viewer_network"];function Ce(e,s=Date.now()){let p=["relay_url","session_id","expires_at"];if(!Le(e)||p.some((c)=>!(c in e))||Object.keys(e).some((c)=>!p.includes(c)&&!Je.includes(c)))throw new r("invalid_display_request","Reason desktop request is malformed.");let n="video"in e?Eo(e.video):void 0,t="viewer"in e?$n(e.viewer):null;if(n===null)throw new r("invalid_display_request","Reason desktop video request is invalid.");let o=null;try{o=typeof e.relay_url==="string"?new URL(e.relay_url):null}catch{}if(!o||o.protocol!=="wss:"&&o.protocol!=="ws:"||o.username||o.password)throw new r("invalid_display_request","Reason desktop relay URL is invalid.");if(typeof e.session_id!=="string"||!Ne.test(e.session_id))throw new r("invalid_display_request","Reason desktop session identity is invalid.");let i=typeof e.expires_at==="string"?Date.parse(e.expires_at):Number.NaN;if(!Number.isFinite(i)||i<=s)throw new r("invalid_display_request","Reason desktop session has already expired.");return{relay_url:e.relay_url,session_id:e.session_id,expires_at:new Date(Math.min(i,s+Ae)).toISOString(),...n?{video:n}:{},...t?{viewer:t}:{},...n&&e.viewer_same_network===!0?{viewer_same_network:!0}:{}}}function $t(e=process.platform){return(e==="linux"||e==="darwin"||e==="win32")&&x()?.features.display===!0}async function Bs(){if(process.platform==="win32")return $t()&&await Pr();if(process.platform!=="darwin")return $t();return await Pr()}function G(e){we(e,{recursive:!0,mode:448});let s=_e(e);if(!s.isDirectory()||s.isSymbolicLink()||process.getuid&&s.uid!==process.getuid())throw new r("display_unavailable","Reason desktop state directory is not private.");De(e,448)}function Ue(e,s){let p=(t)=>{let o=Buffer.alloc(2);return o.writeUInt16BE(t.length),Buffer.concat([o,t])},n=Buffer.from([255,255]);return Buffer.concat([n,p(Buffer.alloc(0)),p(Buffer.from(e)),p(Buffer.from("MIT-MAGIC-COOKIE-1")),p(s)])}function T(e,s,p=2000){return new Promise((n)=>{let t=de(e),o="",i=(c)=>{t.destroy(),n(c)};t.setTimeout(p,()=>i(!1)),t.once("error",()=>i(!1)),t.once("close",()=>i(!1)),t.once("connect",()=>{if(!s)i(!0)}),t.on("data",(c)=>{if(o+=c.toString("latin1"),o.length>=4)i(o.startsWith("RFB "))})})}async function m(e,s){let p=Date.now()+s;while(Date.now()<p){if(await e())return!0;await new Promise((n)=>setTimeout(n,100))}return!1}function d(e,s,p){return new Promise((n)=>{let t=H(e,s,{detached:!0,stdio:"ignore",env:p});t.once("error",()=>n(-1)),t.once("exit",(o)=>n(o)),t.unref(),setTimeout(()=>n(null),_).unref()})}var U=null;function qe(e=a()){return U??=ge(e).finally(()=>{U=null}),U}async function ge(e){let s=x({home:e});if(!s?.xvfb||!s.x11vnc||!s.openbox)throw new r("display_unavailable","Run `reason desktop install` on this machine to enable its desktop.");xt({root:s.root,automation:s.automation,extensionDir:s.extensionDir});let p=y(s.root,"display");G(p);let n=await Me(e,p,s.x11vnc);if(n)return n;let t={display:D,xauthority:y(p,"Xauthority"),rfbSocket:y(p,"rfb.sock")},o=y(p,"pulse"),i=(async()=>{try{G(o)}catch{return null}return await po(o,s.pulseaudio)})();G(y(p,"home"));let c=re(p,t,s.pulseaudio),h=async()=>({...t,sound:await i});if(await T({path:t.rfbSocket},!0))return pe(y(p,"theme"),R,c),await h();if(!I(t.xauthority))g(t.xauthority,Ue(D.slice(1),Qe(16)),{mode:384,flag:"wx"});let l=te(y(p,"theme"),t.display,C),q={path:`/tmp/.X11-unix/X${D.slice(1)}`};if(!await T(q,!1)){let u=`${C.width}x${C.height}`;if(s.xvnc)ee(t.rfbSocket,{force:!0}),d(s.xvnc,[t.display,"-geometry",u,"-depth","24","-nolisten","tcp","-auth",t.xauthority,"-rfbport","-1","-rfbunixpath",t.rfbSocket,"-SecurityTypes","None","-UseBlacklist=0","-AlwaysShared","-desktop","Reason"],c);else d(s.xvfb,[t.display,"-screen","0",`${u}x24`,"-nolisten","tcp","-auth",t.xauthority],c);if(!await m(()=>T(q,!1),_)||s.xvnc&&!await m(()=>T({path:t.rfbSocket},!0),_))throw new r("display_unavailable","Reason could not start the virtual display.");d(s.openbox,["--config-file",l.openboxConfig],c)}if(await ne(l,c),!await se(s.x11vnc,t,p,"x11vnc.log",c))throw new r("display_unavailable","Reason could not start the desktop server.");return await h()}function re(e,s,p){let n={HOME:y(e,"home"),PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:s.display,XAUTHORITY:s.xauthority};if(p)n.PULSE_SERVER=Ve(On(y(e,"pulse")));return n}async function se(e,s,p,n,t){if(await T({path:s.rfbSocket},!0))return!0;ee(s.rfbSocket,{force:!0});let o=await d(e,["-display",s.display,"-auth",s.xauthority,"-rfbport","0","-rfbportv6","-1","-unixsock",s.rfbSocket,"-nopw","-forever","-shared","-noxdamage","-sb","0","-rfbversion","3.7","-quiet","-bg","-o",y(p,n)],t);if(o!==null&&o!==0)return!1;return await m(()=>T({path:s.rfbSocket},!0),_)}async function me(){let e=["DISPLAY","XAUTHORITY","WAYLAND_DISPLAY","XDG_SESSION_TYPE"],s=(p)=>Object.fromEntries(e.flatMap((n)=>p[n]?[[n,p[n]]]:[]));if(process.env.DISPLAY)return s(process.env);try{let p=await new Promise((n,t)=>z("systemctl",["--user","show-environment"],{encoding:"utf8",timeout:2000},(o,i)=>o?t(o):n(i)));return s(Object.fromEntries(p.split(`
 `).flatMap((n)=>{let t=n.indexOf("=");return t>0?[[n.slice(0,t),n.slice(t+1)]]:[]})))}catch{return{}}}var Z=new Set;async function Me(e,s,p){let n=await me(),t=/^:(\d+)(?:\.\d+)?$/.exec(n.DISPLAY??"")?.[1];if(!t||`:${t}`===D||n.WAYLAND_DISPLAY||n.XDG_SESSION_TYPE==="wayland")return null;let o={display:`:${t}`,xauthority:n.XAUTHORITY??y(e,".Xauthority"),rfbSocket:y(s,`rfb-${t}.sock`)},i=`${o.display} ${o.xauthority}`;if(Z.has(i)||!await T({path:`/tmp/.X11-unix/X${t}`},!1))return null;let c={HOME:e,PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:o.display,XAUTHORITY:o.xauthority};if(await se(p,o,s,`x11vnc-${t}.log`,c))return{...o,sound:null};return Z.add(i),process.stderr.write(`Reason worker: your screen ${o.display} could not be served; using the virtual desktop
 `),null}function te(e,s,p){let n=`chromium --no-first-run --no-default-browser-check${process.geteuid?.()===0?" --no-sandbox":""} %U`,t=[["terminal","xterm"],["files","pcmanfm"]].filter(([,i])=>!I(`/usr/bin/${i}`)).map(([i])=>i),o=v({root:e,display:s,screen:p,browserExec:n,absent:t});for(let i of["","openbox","tint2","picom"])G(y(e,i));for(let[i,c]of Object.entries(o.files))g(y(e,i),c,{mode:384});for(let[i,c]of Object.entries(V))g(y(e,`ara-${i}`),Re(c),{mode:384});return{root:e,openboxConfig:y(e,"openbox","rc.xml"),start:o.start}}function ne(e,s){return pe(e.root,[...e.start,"openbox --reconfigure >/dev/null 2>&1 || true"],s)}function pe(e,s,p){let n=[`ROOT=${JSON.stringify(e)}`,...s].join(`
 `);return new Promise((t)=>{let o=H("/bin/sh",["-c",n],{stdio:"ignore",env:{...p,PATH:"/usr/bin:/bin"}}),i=setTimeout(()=>{o.kill(),t()},_);o.once("error",()=>{clearTimeout(i),t()}),o.once("exit",()=>{clearTimeout(i),t()})})}var We=2073600,je=320;function Be(e,s){let p=Math.min(1,Math.sqrt(We/(e.width*e.height))),n=(t,o)=>Math.min(Math.floor(o/8)*8,Math.max(je,Math.round(t*p/8)*8));return{width:n(e.width,s.width),height:n(e.height,s.height)}}function oe(e,s,p){return new Promise((n)=>z(e,s,{env:p,encoding:"utf8",timeout:5000},(t,o)=>n(t?null:o)))}function Oe(e){let s=/current (\d+) x (\d+), maximum (\d+) x (\d+)/.exec(e),p=e.split(`
 `),n=p.findIndex((o)=>/^\S+ connected/.test(o));if(!s||n<0)return null;let t=[];for(let o of p.slice(n+1)){let i=/^\s+(\d+x\d+)\s/.exec(o);if(!i)break;t.push(i[1])}return{current:{width:Number(s[1]),height:Number(s[2])},maximum:{width:Number(s[3]),height:Number(s[4])},output:p[n].split(" ")[0],modes:t}}async function Fe(e,s,p){if(e.display!==D)return null;let n={PATH:"/usr/bin:/bin",DISPLAY:e.display,XAUTHORITY:e.xauthority},t=(h)=>oe("xrandr",h,n),o=Oe(await t(["--query"])??"");if(!o||o.maximum.width<=o.current.width&&o.maximum.height<=o.current.height)return null;let i=Be(s,o.maximum);if(i.width===o.current.width&&i.height===o.current.height)return{size:i,changed:!1};let c=`${i.width}x${i.height}`;if(!o.modes.includes(c)){if(await t(["--newmode",c,"60",...[i.width,i.width,i.width,i.width,i.height,i.height,i.height,i.height].map(String)]),await t(["--addmode",o.output,c])===null)return null}return p(),await t(["--output",o.output,"--mode",c])===null?null:{size:i,changed:!0}}async function ke(e,s){let p=x({home:a()});if(!p)return;let n=y(p.root,"display"),t=re(n,e,p.pulseaudio);await ne(te(y(n,"theme"),e.display,s),t);let o=s.width-S*2,i=s.height-S-w;await oe("xdotool",["search","--onlyvisible","--class","Chromium","windowsize","%@",String(o),String(i),"windowmove","%@",String(S),String(S)],{...t,PATH:"/usr/bin:/bin"})}var Y=Promise.resolve();function Ge(e,s,p=()=>{}){let n=Y.then(()=>Fe(e,s,p));return Y=n.then((t)=>t?.changed?ke(e,t.size):void 0).catch(()=>{}),n.then((t)=>t?.size??null,()=>null)}async function Bt(e,s={}){let p=s.now??Date.now,n=Ce(e.payload,p());if(e.signal.throwIfAborted(),!n.video)throw new r("display_video_required","Reason desktops stream as video now; this request came without it.");let t=s.platform??process.platform;if(t!=="linux"&&t!=="darwin"&&t!=="win32")throw new r("display_video_unsupported","This machine does not serve desktop video.");let o=n.video,i=(s.video?.desktop??(t==="darwin"?async()=>In:t==="win32"?async()=>Dn:qe))();return await Ke(e.signal,n,s,p,(c)=>Nn(c,{request:o,desktop:i,...n.viewer?{viewer:n.viewer}:{},viewerSameNetwork:n.viewer_same_network===!0},{resizeDesktop:Ge,...s.video}),(c)=>zt({type:"error",code:c}))}function Ke(e,s,p,n,t,o){let i=n();return new Promise((c,h)=>{let l=null,q=!1,u=!1,M,A,Q,E=!1,P=null,X=(b)=>{if(u)return;if(P)b=P.outcome;u=!0,clearTimeout(M),clearTimeout(A),e.removeEventListener("abort",L),Q?.close();try{l?.close(1000,"display_session_over")}catch{}if("error"in b){h(b.error);return}c({reason:b.reason,...Q?.summary(),duration_ms:Math.max(0,n()-i)})},N=()=>X({error:new r("display_relay_unavailable","Reason could not reach the desktop relay.")}),L=()=>{let b=e.reason;X({error:b instanceof r?b:new r("cancelled","Reason closed the desktop session.")})},W=()=>{if(!P||!l)return;let{outcome:b}=P,f=!("error"in b)?b.reason:b.error instanceof r?b.error.code:"display_unavailable";if(!P.told)try{l.send(o(f))}catch{}X(b)};if(Q=t({get done(){return u||P!==null},get open(){return q&&!u&&P===null},get bufferedAmount(){return l?.bufferedAmount??0},send(b){if(u||P||!q||!l)return;try{l.send(b)}catch{X({reason:"relay_closed"})}},end:(b)=>{if(u||P)return;if(!("error"in b)&&E&&q){X(b);return}if(P={outcome:b,told:!("error"in b)&&q},E&&q)W()}}),u){Q.close();return}if(e.aborted){L();return}e.addEventListener("abort",L,{once:!0}),M=setTimeout(()=>X({reason:"session_expired"}),Math.max(1,Date.parse(s.expires_at)-n())),A=setTimeout(()=>X({reason:"viewer_absent"}),p.viewerWaitMs??Ee);try{l=(p.connect??Dr)(s.relay_url,(p.loadProxy??j)()?.url)}catch{N();return}l.binaryType="arraybuffer",l.onopen=()=>{if(u||!l)return;q=!0,Q?.opened()},l.onmessage=(b)=>{if(u)return;let f=b.data,J=f instanceof ArrayBuffer?new Uint8Array(f):ArrayBuffer.isView(f)?new Uint8Array(f.buffer,f.byteOffset,f.byteLength):null;if(!J||J.byteLength===0)return;if(clearTimeout(A),E=!0,P){W();return}Q?.received(J)},l.onclose=()=>{if(u)return;if(!q){N();return}X({reason:"relay_closed"})},l.onerror=()=>{if(u||q)return;N()}})}
-export{$t,Ms,G,qe,Bt};
+export{$t,Bs,G,qe,Bt};

package/bin/vm-hands/{vm-hands-entry-lite-p7cqhtyg.js → vm-hands-entry-lite-ydxrabqz.js}

@@ -1,5 +1,5 @@
 // @bun
-import{S,zt,$n,Ge,Bn,Fn}from"./vm-hands-entry-lite-w0pegc58.js";import{Yn}from"./vm-hands-entry-lite-hhhc7xx3.js";import{Kn}from"./vm-hands-entry-lite-8qhz89mt.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ys,spawn as qe}from"child_process";import{existsSync as ws}from"fs";import{connect as xs}from"net";function pn(){let e=new Set,t=null,n=(s)=>({holder:t?.viewer??null,you:t===s,same_user:Boolean(t?.viewer&&s.viewer&&t.viewer.user_id===s.viewer.user_id)}),o=()=>{for(let s of e)s.notify(n(s))};return{join(s){return e.add(s),s.notify(n(s)),()=>{if(!e.delete(s))return;if(t!==s)return;t=null,o()}},claim(s){if(t===s||!e.has(s))return;t=s,o()}}}var ut=pn();import{createHash as St}from"crypto";import{once as Sn}from"events";import{createWriteStream as vn,existsSync as mr,mkdirSync as gr,mkdtempSync as hr,readFileSync as le,readdirSync as br,renameSync as yr,realpathSync as En,rmSync as Pn,statSync as Ne,writeFileSync as wr}from"fs";import{delimiter as _r,dirname as vt,join as b}from"path";import{finished as Cn}from"stream/promises";var We="omljlfpmafedpplnpkkahegadhkimdje",uo="https://chromewebstore.google.com/detail/reason/omljlfpmafedpplnpkkahegadhkimdje";var O={ocu:{repository:"https://github.com/iFurySt/open-codex-computer-use.git",revision:"386a260d1ab8b690adbbb27f7471595cf0c2b752",version:"0.3.5"},obu:{repository:"https://github.com/iFurySt/open-browser-use.git",revision:"ac015846df75928fbcf0f3a0f3ba3a210ce1a507",version:"0.1.42"}},H={version:"155.0.8059.84",macArm64Sha256:"13b9e98ce56f5ce18e100a009f455c9285f399e7c9dc8a76fdf2f3a9755bb5f2",linux64Sha256:"cf0f049892dea22e6a6db26d47ed0d7776b7158edcbec4634086633df8bafcbc",win64Sha256:"507f2a031441d10c62b5e3d4e863f09ac1198a571c1419976cbd8387f639afde"};var J={ocu:{url:`https://registry.npmjs.org/open-computer-use/-/open-computer-use-${O.ocu.version}.tgz`,sha256:"7c16a87c8cd357787b02c0ebd040dd5f93880c1fb51c1901caa2e0c05d063130",size_bytes:5844280},obu:{url:`https://registry.npmjs.org/open-browser-use/-/open-browser-use-${O.obu.version}.tgz`,sha256:"9386d8ce0a147b3f55e1807b68edf736836378807541c457c9b5f6ca2cabaa4e",size_bytes:21372018},extension:{url:`https://github.com/iFurySt/open-browser-use/releases/download/v${O.obu.version}/open-browser-use-chrome-extension-${O.obu.version}.zip`,sha256:"c9c07bec1175e12ea6985b0e7784a5ef01fd03f014b958224a1e17dcd838a241",size_bytes:31070}},F="pnbmoicbkopffjjgfgfglopechaiemkp";import{spawn as Me}from"child_process";import{createRequire as fn}from"module";import{join as mn}from"path";var gn=30000,hn=1048576;function Te(){return process.env.SystemRoot??"C:\\Windows"}function bn(){return mn(Te(),"System32","WindowsPowerShell","v1.0","powershell.exe")}var yn=String.raw`
+import{S,zt,Bn,Ge,Fn,jn}from"./vm-hands-entry-lite-eabever7.js";import{Yn}from"./vm-hands-entry-lite-kcgjd70y.js";import{Mn}from"./vm-hands-entry-lite-ncbzy69k.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ys,spawn as qe}from"child_process";import{existsSync as ws}from"fs";import{connect as xs}from"net";function pn(){let e=new Set,t=null,n=(s)=>({holder:t?.viewer??null,you:t===s,same_user:Boolean(t?.viewer&&s.viewer&&t.viewer.user_id===s.viewer.user_id)}),o=()=>{for(let s of e)s.notify(n(s))};return{join(s){return e.add(s),s.notify(n(s)),()=>{if(!e.delete(s))return;if(t!==s)return;t=null,o()}},claim(s){if(t===s||!e.has(s))return;t=s,o()}}}var ut=pn();import{createHash as St}from"crypto";import{once as Sn}from"events";import{createWriteStream as vn,existsSync as mr,mkdirSync as gr,mkdtempSync as hr,readFileSync as le,readdirSync as br,renameSync as yr,realpathSync as En,rmSync as Pn,statSync as Ne,writeFileSync as wr}from"fs";import{delimiter as _r,dirname as vt,join as b}from"path";import{finished as Cn}from"stream/promises";var We="omljlfpmafedpplnpkkahegadhkimdje",uo="https://chromewebstore.google.com/detail/reason/omljlfpmafedpplnpkkahegadhkimdje";var O={ocu:{repository:"https://github.com/iFurySt/open-codex-computer-use.git",revision:"386a260d1ab8b690adbbb27f7471595cf0c2b752",version:"0.3.5"},obu:{repository:"https://github.com/iFurySt/open-browser-use.git",revision:"ac015846df75928fbcf0f3a0f3ba3a210ce1a507",version:"0.1.42"}},H={version:"155.0.8059.84",macArm64Sha256:"13b9e98ce56f5ce18e100a009f455c9285f399e7c9dc8a76fdf2f3a9755bb5f2",linux64Sha256:"cf0f049892dea22e6a6db26d47ed0d7776b7158edcbec4634086633df8bafcbc",win64Sha256:"507f2a031441d10c62b5e3d4e863f09ac1198a571c1419976cbd8387f639afde"};var J={ocu:{url:`https://registry.npmjs.org/open-computer-use/-/open-computer-use-${O.ocu.version}.tgz`,sha256:"7c16a87c8cd357787b02c0ebd040dd5f93880c1fb51c1901caa2e0c05d063130",size_bytes:5844280},obu:{url:`https://registry.npmjs.org/open-browser-use/-/open-browser-use-${O.obu.version}.tgz`,sha256:"9386d8ce0a147b3f55e1807b68edf736836378807541c457c9b5f6ca2cabaa4e",size_bytes:21372018},extension:{url:`https://github.com/iFurySt/open-browser-use/releases/download/v${O.obu.version}/open-browser-use-chrome-extension-${O.obu.version}.zip`,sha256:"c9c07bec1175e12ea6985b0e7784a5ef01fd03f014b958224a1e17dcd838a241",size_bytes:31070}},F="pnbmoicbkopffjjgfgfglopechaiemkp";import{spawn as Me}from"child_process";import{createRequire as fn}from"module";import{join as mn}from"path";var gn=30000,hn=1048576;function Te(){return process.env.SystemRoot??"C:\\Windows"}function bn(){return mn(Te(),"System32","WindowsPowerShell","v1.0","powershell.exe")}var yn=String.raw`
 $ErrorActionPreference = "Stop"
 Add-Type -TypeDefinition @"
 using System;
@@ -69,7 +69,7 @@ while ($null -ne ($line = [Console]::In.ReadLine())) {
 `).join("")),t.stdin.writableLength>hn)d({reason:"input_backpressure"})},g=()=>{i=Me(...Oe("clipboard"),{env:Ae(),stdio:["ignore","pipe","ignore"],windowsHide:!0});let p="";i.stdout?.on("data",(w)=>{if(s)return;p+=w.toString("ascii");for(let f=p.indexOf(`
 `);f>=0;f=p.indexOf(`
 `)){let M=p.slice(0,f).replace(/\r$/,"");if(p=p.slice(f+1),!M.startsWith("c "))continue;let E=M.slice(2);if(E.length>Math.ceil(S/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(E)){d({reason:"display_protocol"});return}let c=Buffer.from(E,"base64");if(c.byteLength<=S)e.clipboard(c.toString("utf8"));if(s)return}if(p.length>Math.ceil(S/3)*4+4)d({reason:"display_protocol"})}),i.once("error",()=>y("Reason could not watch this computer's desktop clipboard.")),i.once("exit",()=>{if(!s)y("Reason could not watch this computer's desktop clipboard.")})};return t.stdout.on("data",(p)=>{if(s||o===null)return;o+=p.toString("utf8");let w=o.indexOf(`
-`);if(w<0){if(o.length>4096)d({reason:"display_protocol"});return}let f=ht(o.slice(0,w).trim());if(o=null,!f)d({reason:"display_protocol"});else if(f.session===0)y("This Windows worker runs as a service, which has no desktop: run it in the signed-in desktop session.");else g(),e.ready({width:f.width,height:f.height})}),t.stdin.on("error",()=>{return}),t.once("error",()=>y("Reason could not start this computer's desktop input.")),t.once("exit",()=>{if(o!==null)y("Reason could not start this computer's desktop input.");else d({reason:"display_closed"})}),{pointer:(p,w,f)=>h(n.pointer(p,w,f)),key:(p,w)=>h(n.key(p,w)),clipboard:(p)=>h([`c ${Buffer.from(p,"utf8").toString("base64")}`]),close(){s=!0,a()}}}var Rn=["none","standard","all"],ue="22.23.3",Mn={"linux-x64":"1084aa36196bba4c3a5e69a1ee388a6e4ff729dad09445fbcd434b28fe3c24af","linux-arm64":"5ced2d48d1d7198739b7f86804de0171aefb6823b684b12341d3321afc3cb0b2","darwin-arm64":"23b25245dcfb9af7262f8ff142e9e2e0af025368117329e7a7458a51e5922f53","win32-x64":"2b0ff57b049cda1bbcea2240eec20467018713c1efe1f7360c2681859b90ed71","win32-arm64":"33dad22e4cef5ee8f9fbb1b0d037fdacd0e56d12a4580f0d63f68b894deab535"},$e={"linux-x64":{ocu:"dist/linux/amd64/open-computer-use",obu:"native/linux-amd64/open-browser-use"},"linux-arm64":{ocu:"dist/linux/arm64/open-computer-use",obu:"native/linux-arm64/open-browser-use"},"darwin-arm64":{ocu:"dist/Open Computer Use.app/Contents/MacOS/OpenComputerUse",obu:"native/darwin-arm64/open-browser-use"},"win32-x64":{ocu:"dist/windows/amd64/open-computer-use.exe",obu:"native/windows-amd64/open-browser-use.exe"},"win32-arm64":{ocu:"dist/windows/arm64/open-computer-use.exe",obu:"native/windows-arm64/open-browser-use.exe"}},Et="chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing",Dt="chrome-win64/chrome.exe",W={version:"9.0.2",url:"https://ffmpeg.martin-riedl.de/download/macos/arm64/1789931890_9.0.2/ffmpeg.zip",sha256:"c8ed4c4e6978a03c485edbfe4e0a5dc2380f8a30bba5150531b31b094492d924"},Tn={version:W.version,url:"https://ffmpeg.martin-riedl.de/download/macos/arm64/1789931890_9.0.2/ffprobe.zip",sha256:"fcbe839537485eaee7a7a8bc5cbc0f90d53617e80943e8a5b2e31cb851197ea6"},Le={version:W.version,url:`https://github.com/GyanD/codexffmpeg/releases/download/${W.version}/ffmpeg-${W.version}-essentials_build.zip`,sha256:"60f467265b1e312373dbcd92200c2618a74850f98d3d078e94296bb3fa2047ba"},_t=`ffmpeg-${Le.version}-essentials_build/bin`,z="com.ifuryst.open_browser_use.extension",It="com.reasonmachines.browser_use.extension",Ft="/tmp/reason-browser-use",Ue=["tint2","picom","xterm","pcmanfm"],Pt=["fonts-droid-fallback"],Ct=["pulseaudio"],Rt=["tigervnc-standalone-server"],An=["xvfb","openbox","x11vnc","x11-utils","x11-xserver-utils","xdotool","dbus-x11","at-spi2-core","python3","python3-gi","gir1.2-atspi-2.0","gir1.2-gtk-3.0","fonts-dejavu-core",...Pt,"galculator","chromium","ffmpeg","tmux",...Ct,...Rt,...Ue],Un=new Set([...Ue,...Pt,...Ct,...Rt]),kt=An.filter((e)=>e!=="chromium"&&!Un.has(e)),Hn=["Xvfb","openbox","x11vnc","xdotool","dbus-launch","python3","ffmpeg","tmux"],ce="/usr/bin/chromium",zn=["/usr/local/bin","/usr/bin","/bin","/opt/homebrew/bin"];function jn(e=process.platform,t=process.arch){let n=`${e}-${t}`;return n==="linux-x64"||n==="linux-arm64"||n==="darwin-arm64"||n==="win32-x64"||n==="win32-arm64"?n:null}function K(e){return e==="win32-x64"||e==="win32-arm64"}function Be(e){return K(e)?`node-v${ue}-${e.replace("win32","win")}`:`node-v${ue}-${e}`}function de(e){return{node:{version:ue,url:`https://nodejs.org/dist/v${ue}/${Be(e)}${K(e)?".zip":".tar.gz"}`,sha256:Mn[e]},open_computer_use:{version:O.ocu.version,url:J.ocu.url,sha256:J.ocu.sha256},open_browser_use:{version:O.obu.version,url:J.obu.url,sha256:J.obu.sha256},...e==="darwin-arm64"?{chrome_for_testing:{version:H.version,url:`https://storage.googleapis.com/chrome-for-testing-public/${H.version}/mac-arm64/chrome-mac-arm64.zip`,sha256:H.macArm64Sha256}}:K(e)?{chrome_for_testing:{version:H.version,url:`https://storage.googleapis.com/chrome-for-testing-public/${H.version}/win64/chrome-win64.zip`,sha256:H.win64Sha256}}:{}}}function Gn(e){let t={extension:F};for(let[n,o]of Object.entries(de(e)))t[n]=`${o.version}@${o.sha256}`;return t}function Mt(e){return b(e,".local","share","reason","desktop")}function Tr(e,t=Kn()){let n=Mt(t),o=(p)=>b(n,p,de(e)[p]?.version??""),s=o("open_computer_use"),i=o("open_browser_use"),a=e==="darwin-arm64",d=K(e),y=b(t,"Library","Application Support"),h=b(process.platform==="win32"&&process.env.LOCALAPPDATA?process.env.LOCALAPPDATA:b(t,"AppData","Local"),"OpenBrowserUse"),g=a?b(y,"Google","Chrome","NativeMessagingHosts",`${z}.json`):d?b(h,"NativeMessagingHosts",`${z}.json`):b(t,".config","google-chrome","NativeMessagingHosts",`${z}.json`);return{root:n,automation:b(vt(n),"automation"),receipt:b(n,"receipt.json"),minimal:is(t),node:d?b(o("node"),Be(e),"node.exe"):b(o("node"),"bin","node"),ocuDir:s,ocu:b(s,$e[e].ocu),ocuApp:a?b(s,"dist","Open Computer Use.app"):null,obuDir:i,obu:b(i,"cli","open-browser-use.js"),nativeHost:b(i,$e[e].obu),extensionDir:a?b(y,"OpenBrowserUse","chrome-extension","release"):d?b(h,"chrome-extension","release"):b(t,".local","share","open-browser-use","chrome-extension","release"),setupNativeHostManifest:g,nativeHostManifests:a?[g,b(y,"Google","ChromeForTesting","NativeMessagingHosts",`${z}.json`)]:d?[g]:[b(t,".config","chromium","NativeMessagingHosts",`${z}.json`),b(t,".config","google-chrome-for-testing","NativeMessagingHosts",`${z}.json`)],browser:a?b(o("chrome_for_testing"),Et):d?b(o("chrome_for_testing"),Dt):ce,userChromeHost:a?b(n,"user-chrome","reason-browser-use"):null,userChromeRegistration:a?b(y,"Google","Chrome","NativeMessagingHosts",`${It}.json`):null,ffmpegDir:b(n,"ffmpeg"),ffmpeg:a?b(n,"ffmpeg",W.version,"ffmpeg"):d?b(n,"ffmpeg",Le.version,_t,"ffmpeg.exe"):null,ffprobe:a?b(n,"ffprobe",Tn.version,"ffprobe"):d?b(n,"ffmpeg",Le.version,_t,"ffprobe.exe"):null}}function Vn(e){try{let t=JSON.parse(le(e,"utf8"));if(typeof t!=="object"||t===null)return null;let n=t,o=n.pins;if(n.schema_version!==1||typeof n.platform!=="string"||typeof o!=="object"||o===null||!Object.values(o).every((s)=>typeof s==="string")||!Rn.includes(n.permissions)||!Array.isArray(n.missing_system_packages)||!n.missing_system_packages.every((s)=>typeof s==="string")||typeof n.updated_at!=="string")return null;return{schema_version:1,platform:n.platform,pins:o,permissions:n.permissions,missing_system_packages:n.missing_system_packages,updated_at:n.updated_at}}catch{return null}}function A(e){try{return Ne(e).isFile()}catch{return!1}}function Tt(e){try{let t=Ne(e);return t.isFile()&&(t.mode&73)!==0}catch{return!1}}function Wn(e){try{return le(e,"utf8")}catch{return null}}function U(e){for(let t of zn){let n=b(t,e);try{let o=Ne(n);if(o.isFile()&&(o.mode&73)!==0)return n}catch{}}return null}function Xn(e){try{let t=JSON.parse(le(b(e,"package.json"),"utf8"));return typeof t==="object"&&t!==null&&typeof t.version==="string"?t.version:null}catch{return null}}function qn(e,t,n){let o=de(n)[e];if(!o)return!1;let s=K(n);if(e==="node")return A(s?b(t,Be(n),"node.exe"):b(t,"bin","node"));if(e==="chrome_for_testing")return A(b(t,s?Dt:Et));let i=$e[n][e==="open_computer_use"?"ocu":"obu"];return Xn(t)===o.version&&A(b(t,i))&&(e==="open_computer_use"||A(b(t,"cli","open-browser-use.js")))}function Jn(e){return St("sha256").update(Buffer.from(e,"base64")).digest("hex").slice(0,32).replace(/./g,(t)=>String.fromCharCode(97+Number.parseInt(t,16)))}function He(e){try{let t=JSON.parse(le(e,"utf8"));return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:null}catch{return null}}function Zn(e){let t=He(b(e.extensionDir,"manifest.json"));return t!==null&&t.version===O.obu.version&&typeof t.key==="string"&&Jn(t.key)===F}function Qn(e,t){let n=e?.allowed_origins;return e!==null&&e.name===z&&Array.isArray(n)&&n.length===1&&n[0]===`chrome-extension://${F}/`&&(t===void 0||e.path===t)}function es(e){return Zn(e)&&A(e.nativeHost)&&e.nativeHostManifests.every((t)=>Qn(He(t),e.nativeHost))}function ts(e){return`#!/bin/sh
+`);if(w<0){if(o.length>4096)d({reason:"display_protocol"});return}let f=ht(o.slice(0,w).trim());if(o=null,!f)d({reason:"display_protocol"});else if(f.session===0)y("This Windows worker runs as a service, which has no desktop: run it in the signed-in desktop session.");else g(),e.ready({width:f.width,height:f.height})}),t.stdin.on("error",()=>{return}),t.once("error",()=>y("Reason could not start this computer's desktop input.")),t.once("exit",()=>{if(o!==null)y("Reason could not start this computer's desktop input.");else d({reason:"display_closed"})}),{pointer:(p,w,f)=>h(n.pointer(p,w,f)),key:(p,w)=>h(n.key(p,w)),clipboard:(p)=>h([`c ${Buffer.from(p,"utf8").toString("base64")}`]),close(){s=!0,a()}}}var Rn=["none","standard","all"],ue="22.23.3",Tn={"linux-x64":"1084aa36196bba4c3a5e69a1ee388a6e4ff729dad09445fbcd434b28fe3c24af","linux-arm64":"5ced2d48d1d7198739b7f86804de0171aefb6823b684b12341d3321afc3cb0b2","darwin-arm64":"23b25245dcfb9af7262f8ff142e9e2e0af025368117329e7a7458a51e5922f53","win32-x64":"2b0ff57b049cda1bbcea2240eec20467018713c1efe1f7360c2681859b90ed71","win32-arm64":"33dad22e4cef5ee8f9fbb1b0d037fdacd0e56d12a4580f0d63f68b894deab535"},$e={"linux-x64":{ocu:"dist/linux/amd64/open-computer-use",obu:"native/linux-amd64/open-browser-use"},"linux-arm64":{ocu:"dist/linux/arm64/open-computer-use",obu:"native/linux-arm64/open-browser-use"},"darwin-arm64":{ocu:"dist/Open Computer Use.app/Contents/MacOS/OpenComputerUse",obu:"native/darwin-arm64/open-browser-use"},"win32-x64":{ocu:"dist/windows/amd64/open-computer-use.exe",obu:"native/windows-amd64/open-browser-use.exe"},"win32-arm64":{ocu:"dist/windows/arm64/open-computer-use.exe",obu:"native/windows-arm64/open-browser-use.exe"}},Et="chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing",Dt="chrome-win64/chrome.exe",W={version:"9.0.2",url:"https://ffmpeg.martin-riedl.de/download/macos/arm64/1789931890_9.0.2/ffmpeg.zip",sha256:"c8ed4c4e6978a03c485edbfe4e0a5dc2380f8a30bba5150531b31b094492d924"},An={version:W.version,url:"https://ffmpeg.martin-riedl.de/download/macos/arm64/1789931890_9.0.2/ffprobe.zip",sha256:"fcbe839537485eaee7a7a8bc5cbc0f90d53617e80943e8a5b2e31cb851197ea6"},Le={version:W.version,url:`https://github.com/GyanD/codexffmpeg/releases/download/${W.version}/ffmpeg-${W.version}-essentials_build.zip`,sha256:"60f467265b1e312373dbcd92200c2618a74850f98d3d078e94296bb3fa2047ba"},_t=`ffmpeg-${Le.version}-essentials_build/bin`,z="com.ifuryst.open_browser_use.extension",It="com.reasonmachines.browser_use.extension",Ft="/tmp/reason-browser-use",Ue=["tint2","picom","xterm","pcmanfm"],Pt=["fonts-droid-fallback"],Ct=["pulseaudio"],Rt=["tigervnc-standalone-server"],$n=["xvfb","openbox","x11vnc","x11-utils","x11-xserver-utils","xdotool","dbus-x11","at-spi2-core","python3","python3-gi","gir1.2-atspi-2.0","gir1.2-gtk-3.0","fonts-dejavu-core",...Pt,"galculator","chromium","ffmpeg","tmux",...Ct,...Rt,...Ue],Un=new Set([...Ue,...Pt,...Ct,...Rt]),kt=$n.filter((e)=>e!=="chromium"&&!Un.has(e)),Hn=["Xvfb","openbox","x11vnc","xdotool","dbus-launch","python3","ffmpeg","tmux"],ce="/usr/bin/chromium",zn=["/usr/local/bin","/usr/bin","/bin","/opt/homebrew/bin"];function Gn(e=process.platform,t=process.arch){let n=`${e}-${t}`;return n==="linux-x64"||n==="linux-arm64"||n==="darwin-arm64"||n==="win32-x64"||n==="win32-arm64"?n:null}function K(e){return e==="win32-x64"||e==="win32-arm64"}function Be(e){return K(e)?`node-v${ue}-${e.replace("win32","win")}`:`node-v${ue}-${e}`}function de(e){return{node:{version:ue,url:`https://nodejs.org/dist/v${ue}/${Be(e)}${K(e)?".zip":".tar.gz"}`,sha256:Tn[e]},open_computer_use:{version:O.ocu.version,url:J.ocu.url,sha256:J.ocu.sha256},open_browser_use:{version:O.obu.version,url:J.obu.url,sha256:J.obu.sha256},...e==="darwin-arm64"?{chrome_for_testing:{version:H.version,url:`https://storage.googleapis.com/chrome-for-testing-public/${H.version}/mac-arm64/chrome-mac-arm64.zip`,sha256:H.macArm64Sha256}}:K(e)?{chrome_for_testing:{version:H.version,url:`https://storage.googleapis.com/chrome-for-testing-public/${H.version}/win64/chrome-win64.zip`,sha256:H.win64Sha256}}:{}}}function Vn(e){let t={extension:F};for(let[n,o]of Object.entries(de(e)))t[n]=`${o.version}@${o.sha256}`;return t}function Mt(e){return b(e,".local","share","reason","desktop")}function Tr(e,t=Mn()){let n=Mt(t),o=(p)=>b(n,p,de(e)[p]?.version??""),s=o("open_computer_use"),i=o("open_browser_use"),a=e==="darwin-arm64",d=K(e),y=b(t,"Library","Application Support"),h=b(process.platform==="win32"&&process.env.LOCALAPPDATA?process.env.LOCALAPPDATA:b(t,"AppData","Local"),"OpenBrowserUse"),g=a?b(y,"Google","Chrome","NativeMessagingHosts",`${z}.json`):d?b(h,"NativeMessagingHosts",`${z}.json`):b(t,".config","google-chrome","NativeMessagingHosts",`${z}.json`);return{root:n,automation:b(vt(n),"automation"),receipt:b(n,"receipt.json"),minimal:is(t),node:d?b(o("node"),Be(e),"node.exe"):b(o("node"),"bin","node"),ocuDir:s,ocu:b(s,$e[e].ocu),ocuApp:a?b(s,"dist","Open Computer Use.app"):null,obuDir:i,obu:b(i,"cli","open-browser-use.js"),nativeHost:b(i,$e[e].obu),extensionDir:a?b(y,"OpenBrowserUse","chrome-extension","release"):d?b(h,"chrome-extension","release"):b(t,".local","share","open-browser-use","chrome-extension","release"),setupNativeHostManifest:g,nativeHostManifests:a?[g,b(y,"Google","ChromeForTesting","NativeMessagingHosts",`${z}.json`)]:d?[g]:[b(t,".config","chromium","NativeMessagingHosts",`${z}.json`),b(t,".config","google-chrome-for-testing","NativeMessagingHosts",`${z}.json`)],browser:a?b(o("chrome_for_testing"),Et):d?b(o("chrome_for_testing"),Dt):ce,userChromeHost:a?b(n,"user-chrome","reason-browser-use"):null,userChromeRegistration:a?b(y,"Google","Chrome","NativeMessagingHosts",`${It}.json`):null,ffmpegDir:b(n,"ffmpeg"),ffmpeg:a?b(n,"ffmpeg",W.version,"ffmpeg"):d?b(n,"ffmpeg",Le.version,_t,"ffmpeg.exe"):null,ffprobe:a?b(n,"ffprobe",An.version,"ffprobe"):d?b(n,"ffmpeg",Le.version,_t,"ffprobe.exe"):null}}function Wn(e){try{let t=JSON.parse(le(e,"utf8"));if(typeof t!=="object"||t===null)return null;let n=t,o=n.pins;if(n.schema_version!==1||typeof n.platform!=="string"||typeof o!=="object"||o===null||!Object.values(o).every((s)=>typeof s==="string")||!Rn.includes(n.permissions)||!Array.isArray(n.missing_system_packages)||!n.missing_system_packages.every((s)=>typeof s==="string")||typeof n.updated_at!=="string")return null;return{schema_version:1,platform:n.platform,pins:o,permissions:n.permissions,missing_system_packages:n.missing_system_packages,updated_at:n.updated_at}}catch{return null}}function A(e){try{return Ne(e).isFile()}catch{return!1}}function Tt(e){try{let t=Ne(e);return t.isFile()&&(t.mode&73)!==0}catch{return!1}}function Kn(e){try{return le(e,"utf8")}catch{return null}}function U(e){for(let t of zn){let n=b(t,e);try{let o=Ne(n);if(o.isFile()&&(o.mode&73)!==0)return n}catch{}}return null}function Xn(e){try{let t=JSON.parse(le(b(e,"package.json"),"utf8"));return typeof t==="object"&&t!==null&&typeof t.version==="string"?t.version:null}catch{return null}}function qn(e,t,n){let o=de(n)[e];if(!o)return!1;let s=K(n);if(e==="node")return A(s?b(t,Be(n),"node.exe"):b(t,"bin","node"));if(e==="chrome_for_testing")return A(b(t,s?Dt:Et));let i=$e[n][e==="open_computer_use"?"ocu":"obu"];return Xn(t)===o.version&&A(b(t,i))&&(e==="open_computer_use"||A(b(t,"cli","open-browser-use.js")))}function Jn(e){return St("sha256").update(Buffer.from(e,"base64")).digest("hex").slice(0,32).replace(/./g,(t)=>String.fromCharCode(97+Number.parseInt(t,16)))}function He(e){try{let t=JSON.parse(le(e,"utf8"));return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:null}catch{return null}}function Zn(e){let t=He(b(e.extensionDir,"manifest.json"));return t!==null&&t.version===O.obu.version&&typeof t.key==="string"&&Jn(t.key)===F}function Qn(e,t){let n=e?.allowed_origins;return e!==null&&e.name===z&&Array.isArray(n)&&n.length===1&&n[0]===`chrome-extension://${F}/`&&(t===void 0||e.path===t)}function es(e){return Zn(e)&&A(e.nativeHost)&&e.nativeHostManifests.every((t)=>Qn(He(t),e.nativeHost))}function ts(e){return`#!/bin/sh
 # Reason's Chrome extension host (reason desktop install): Open Browser Use on Reason's socket directory.
 obu=${`'${e.replaceAll("'","'\\''")}'`}
 case "$1" in
@@ -77,7 +77,7 @@ case "$1" in
   mcp) shift; exec "$obu" mcp --socket-dir ${Ft} "$@" ;;
 esac
 exec "$obu" "$@"
-`}function ns(e){let t=He(e),n=t?.allowed_origins;return t!==null&&t.name===It&&t.type==="stdio"&&Array.isArray(n)&&n.includes(`chrome-extension://${We}/`)&&typeof t.path==="string"&&Tt(t.path)}function ss(e,t){if(!e.userChromeHost||!e.userChromeRegistration)return null;if(!t||Wn(e.userChromeHost)!==ts(e.nativeHost)||!Tt(e.userChromeHost))return{code:"user_chrome_browser_use_missing"};return ns(e.userChromeRegistration)?{host:e.userChromeHost}:{code:"user_chrome_native_host_unregistered"}}var rs={display:["display","desktop_session","desktop_video"],computer:["display","desktop_session","system_packages","node","open_computer_use"],browser:["display","desktop_session","system_packages","node","open_computer_use","open_browser_use","browser_extension","browser","chrome_for_testing"]};function x(e={}){let t=e.platform===void 0?jn():e.platform;if(!t)return null;let n=Tr(t,e.home),o=Vn(n.receipt),s=Gn(t),i=o!==null&&o.platform===t&&JSON.stringify(Object.entries(o.pins).sort())===JSON.stringify(Object.entries(s).sort()),a=[],d=de(t);for(let c of["node","open_computer_use","open_browser_use","chrome_for_testing"]){let _=d[c];if(!_)continue;let v=qn(c,b(n.root,c,_.version),t),D=o?.pins[c],L=v&&D===s[c]?"ready":D!==void 0&&D!==s[c]?"outdated":"missing";a.push({name:c,state:L,detail:_.version})}let y=o?.pins.extension===F&&es(n);a.push({name:"browser_extension",state:y?"ready":"missing",detail:F});let h=U("Xvfb"),g=U("x11vnc"),p=U("openbox");if(K(t))a.push(yt()?{name:"desktop_session",state:"ready",detail:"signed-in desktop session"}:{name:"desktop_session",state:"missing",detail:"run the worker in the signed-in desktop session, not as a service"}),a.push(n.ffmpeg&&A(n.ffmpeg)?{name:"desktop_video",state:"ready",detail:n.ffmpeg}:{name:"desktop_video",state:"missing",detail:"run `reason desktop install` for desktop video"});else if(t!=="darwin-arm64"){a.push(A(ce)?{name:"browser",state:"ready",detail:ce}:{name:"browser",state:"missing",detail:`non-snap Chromium at ${ce}`});let c=h!==null&&g!==null&&p!==null;a.push({name:"display",state:c?"ready":"missing",detail:"Xvfb + openbox + x11vnc"});let _=Hn.filter((P)=>U(P)===null),v=(o?.missing_system_packages??kt).filter((P)=>kt.includes(P)),D=_.length===0&&v.length===0;a.push(D?{name:"system_packages",state:"ready"}:{name:"system_packages",state:"missing",detail:[...new Set([...v,..._])].join(" ")});let L=Ue.filter((P)=>U(P)===null);a.push(L.length===0?{name:"desktop_look",state:"ready"}:{name:"desktop_look",state:"missing",detail:L.join(" ")})}let w=n.ffmpeg&&A(n.ffmpeg)?n.ffmpeg:U("ffmpeg"),f=!w?null:w===n.ffmpeg?n.ffprobe:b(vt(En(w)),"ffprobe"),M=i&&a.every((c)=>c.state==="ready"),E=(c)=>i&&a.every((_)=>!rs[c].includes(_.name)||_.state==="ready");return{platform:t,root:n.root,automation:n.automation,ready:M,features:{display:E("display"),computer:E("computer"),browser:E("browser")},node:n.node,ocu:n.ocu,obu:n.obu,nativeHost:n.nativeHost,extensionDir:n.extensionDir,browser:n.browser,ffmpeg:w,ffprobe:f&&A(f)?f:null,userChrome:ss(n,i&&["node","open_browser_use"].every((c)=>a.find((_)=>_.name===c)?.state==="ready")),pulseaudio:U("pulseaudio"),xvnc:U("Xvnc"),xvfb:h,x11vnc:g,openbox:p,components:a}}function Ot(e){return os(e)?Yn():[]}function os(e){return e?.platform==="darwin-arm64"&&e.ffmpeg===b(e.root,"ffmpeg",W.version,"ffmpeg")}async function ho(e,t,n,o=fetch){try{let s=await o(e,{redirect:"follow"});if(!s.ok||!s.body)throw Error(`download failed (HTTP ${s.status}): ${e}`);let i=St("sha256"),a=vn(n,{mode:384});try{let y=s.body.getReader();for(let h=await y.read();!h.done;h=await y.read())if(i.update(h.value),!a.write(h.value))await Sn(a,"drain")}finally{a.end(),await Cn(a)}let d=i.digest("hex");if(d!==t)throw Error(`digest mismatch for ${e}: expected ${t}, got ${d}`)}catch(s){throw Pn(n,{force:!0}),s}}function is(e){return b(Mt(e),"minimal.json")}import{spawn as as}from"child_process";import{existsSync as cs}from"fs";import{connect as us}from"net";import{join as pe}from"path";var $t="reason_desktop",Q={sampleRate:48000,channels:2,codec:"opus"},ls=5000,ds=107,ps=262144,On=(e)=>pe(e,"native"),Ve=(e)=>`unix:${e}`;function Fe(e,t=1000){if(!cs(e))return Promise.resolve(!1);return new Promise((n)=>{let o=us({path:e}),s=(i)=>{o.destroy(),n(i)};o.setTimeout(t,()=>s(!1)),o.once("error",()=>s(!1)),o.once("close",()=>s(!1)),o.once("connect",()=>s(!0))})}async function po(e,t){if(!t)return null;let n=On(e);if(Buffer.byteLength(n)>ds||/["'\\\s]/.test(n))return null;try{if(await Fe(n))return n;let o=as(t,["--daemonize=no","--system=no","--use-pid-file=no","--exit-idle-time=-1","--disallow-exit=yes","--realtime=no","--high-priority=no","--disallow-module-loading=yes","--log-level=warning",`--log-target=file:${pe(e,"pulseaudio.log")}`,"-n",`--load=module-native-protocol-unix socket="${n}" auth-anonymous=1 auth-cookie-enabled=0`,`--load=module-null-sink sink_name=${$t} rate=${Q.sampleRate} channels=${Q.channels} sink_properties=device.description=Reason_desktop`],{detached:!0,stdio:"ignore",env:{HOME:e,PATH:"/usr/bin:/bin",XDG_RUNTIME_DIR:e,PULSE_RUNTIME_PATH:pe(e,"runtime"),PULSE_STATE_PATH:pe(e,"state")}}),s=!1;o.once("error",()=>{s=!0}),o.once("exit",()=>{s=!0}),o.unref();let i=Date.now()+ls;while(Date.now()<i){if(await Fe(n))return n;if(s)return await Fe(n)?n:null;await new Promise((a)=>setTimeout(a,50))}if(!s)o.kill("SIGKILL");return null}catch{return null}}function Lt(){let{sampleRate:e,channels:t}=Q;return["-hide_banner","-loglevel","error","-nostdin","-fflags","nobuffer","-f","pulse","-sample_rate",String(e),"-channels",String(t),"-fragment_size",String(e*t*2/50),"-i",`${$t}.monitor`,"-vn","-ac",String(t),"-ar",String(e),"-c:a","libopus","-b:a","64k","-application","lowdelay","-frame_duration","20","-flush_packets","1","-page_duration","20000","-f","ogg","pipe:1"]}var fs=[79,103,103,83],ms=Buffer.from("OpusHead"),gs=Buffer.from("OpusTags"),At=(e,t)=>e.byteLength>=t.byteLength&&t.every((n,o)=>e[o]===n);class ze extends Error{constructor(e){super(e);this.name="OggProtocolError"}}class je{buffer=new Uint8Array(0);partial=[];partialBytes=0;push(e){let t=new Uint8Array(this.buffer.byteLength+e.byteLength);t.set(this.buffer),t.set(e,this.buffer.byteLength);let n=[],o=0;while(t.byteLength-o>=27){if(fs.some((w,f)=>t[o+f]!==w)||t[o+4]!==0)throw new ze("invalid_page");let s=(t[o+5]&1)!==0,i=t[o+26];if(t.byteLength-o<27+i)break;let a=t.subarray(o+27,o+27+i),d=a.reduce((w,f)=>w+f,0),y=27+i+d;if(t.byteLength-o<y)break;if(!s&&this.partialBytes>0)this.resetPartial();let h=s&&this.partialBytes===0,g=o+27+i,p=g;for(let w of a){if(g+=w,w===255)continue;if(this.appendPartial(t.subarray(p,g),h),p=g,!h){let f=this.takePartial();if(f.byteLength>0&&!At(f,ms)&&!At(f,gs))n.push(f)}h=!1,this.resetPartial()}if(p<g)this.appendPartial(t.subarray(p,g),h);o+=y}return this.buffer=t.slice(o),n}appendPartial(e,t){if(t||e.byteLength===0)return;if(this.partialBytes+=e.byteLength,this.partialBytes>ps)throw new ze("packet_too_large");this.partial.push(e.slice())}takePartial(){if(this.partial.length===1)return this.partial[0];let e=new Uint8Array(this.partialBytes),t=0;for(let n of this.partial)e.set(n,t),t+=n.byteLength;return e}resetPartial(){this.partial=[],this.partialBytes=0}}import{spawn as hs}from"child_process";var Nt=1048576,bs=String.raw`
+`}function ns(e){let t=He(e),n=t?.allowed_origins;return t!==null&&t.name===It&&t.type==="stdio"&&Array.isArray(n)&&n.includes(`chrome-extension://${We}/`)&&typeof t.path==="string"&&Tt(t.path)}function ss(e,t){if(!e.userChromeHost||!e.userChromeRegistration)return null;if(!t||Kn(e.userChromeHost)!==ts(e.nativeHost)||!Tt(e.userChromeHost))return{code:"user_chrome_browser_use_missing"};return ns(e.userChromeRegistration)?{host:e.userChromeHost}:{code:"user_chrome_native_host_unregistered"}}var rs={display:["display","desktop_session","desktop_video"],computer:["display","desktop_session","system_packages","node","open_computer_use"],browser:["display","desktop_session","system_packages","node","open_computer_use","open_browser_use","browser_extension","browser","chrome_for_testing"]};function x(e={}){let t=e.platform===void 0?Gn():e.platform;if(!t)return null;let n=Tr(t,e.home),o=Wn(n.receipt),s=Vn(t),i=o!==null&&o.platform===t&&JSON.stringify(Object.entries(o.pins).sort())===JSON.stringify(Object.entries(s).sort()),a=[],d=de(t);for(let c of["node","open_computer_use","open_browser_use","chrome_for_testing"]){let _=d[c];if(!_)continue;let v=qn(c,b(n.root,c,_.version),t),D=o?.pins[c],L=v&&D===s[c]?"ready":D!==void 0&&D!==s[c]?"outdated":"missing";a.push({name:c,state:L,detail:_.version})}let y=o?.pins.extension===F&&es(n);a.push({name:"browser_extension",state:y?"ready":"missing",detail:F});let h=U("Xvfb"),g=U("x11vnc"),p=U("openbox");if(K(t))a.push(yt()?{name:"desktop_session",state:"ready",detail:"signed-in desktop session"}:{name:"desktop_session",state:"missing",detail:"run the worker in the signed-in desktop session, not as a service"}),a.push(n.ffmpeg&&A(n.ffmpeg)?{name:"desktop_video",state:"ready",detail:n.ffmpeg}:{name:"desktop_video",state:"missing",detail:"run `reason desktop install` for desktop video"});else if(t!=="darwin-arm64"){a.push(A(ce)?{name:"browser",state:"ready",detail:ce}:{name:"browser",state:"missing",detail:`non-snap Chromium at ${ce}`});let c=h!==null&&g!==null&&p!==null;a.push({name:"display",state:c?"ready":"missing",detail:"Xvfb + openbox + x11vnc"});let _=Hn.filter((P)=>U(P)===null),v=(o?.missing_system_packages??kt).filter((P)=>kt.includes(P)),D=_.length===0&&v.length===0;a.push(D?{name:"system_packages",state:"ready"}:{name:"system_packages",state:"missing",detail:[...new Set([...v,..._])].join(" ")});let L=Ue.filter((P)=>U(P)===null);a.push(L.length===0?{name:"desktop_look",state:"ready"}:{name:"desktop_look",state:"missing",detail:L.join(" ")})}let w=n.ffmpeg&&A(n.ffmpeg)?n.ffmpeg:U("ffmpeg"),f=!w?null:w===n.ffmpeg?n.ffprobe:b(vt(En(w)),"ffprobe"),M=i&&a.every((c)=>c.state==="ready"),E=(c)=>i&&a.every((_)=>!rs[c].includes(_.name)||_.state==="ready");return{platform:t,root:n.root,automation:n.automation,ready:M,features:{display:E("display"),computer:E("computer"),browser:E("browser")},node:n.node,ocu:n.ocu,obu:n.obu,nativeHost:n.nativeHost,extensionDir:n.extensionDir,browser:n.browser,ffmpeg:w,ffprobe:f&&A(f)?f:null,userChrome:ss(n,i&&["node","open_browser_use"].every((c)=>a.find((_)=>_.name===c)?.state==="ready")),pulseaudio:U("pulseaudio"),xvnc:U("Xvnc"),xvfb:h,x11vnc:g,openbox:p,components:a}}function Ot(e){return os(e)?Yn():[]}function os(e){return e?.platform==="darwin-arm64"&&e.ffmpeg===b(e.root,"ffmpeg",W.version,"ffmpeg")}async function ho(e,t,n,o=fetch){try{let s=await o(e,{redirect:"follow"});if(!s.ok||!s.body)throw Error(`download failed (HTTP ${s.status}): ${e}`);let i=St("sha256"),a=vn(n,{mode:384});try{let y=s.body.getReader();for(let h=await y.read();!h.done;h=await y.read())if(i.update(h.value),!a.write(h.value))await Sn(a,"drain")}finally{a.end(),await Cn(a)}let d=i.digest("hex");if(d!==t)throw Error(`digest mismatch for ${e}: expected ${t}, got ${d}`)}catch(s){throw Pn(n,{force:!0}),s}}function is(e){return b(Mt(e),"minimal.json")}import{spawn as as}from"child_process";import{existsSync as cs}from"fs";import{connect as us}from"net";import{join as pe}from"path";var $t="reason_desktop",Q={sampleRate:48000,channels:2,codec:"opus"},ls=5000,ds=107,ps=262144,On=(e)=>pe(e,"native"),Ve=(e)=>`unix:${e}`;function Fe(e,t=1000){if(!cs(e))return Promise.resolve(!1);return new Promise((n)=>{let o=us({path:e}),s=(i)=>{o.destroy(),n(i)};o.setTimeout(t,()=>s(!1)),o.once("error",()=>s(!1)),o.once("close",()=>s(!1)),o.once("connect",()=>s(!0))})}async function po(e,t){if(!t)return null;let n=On(e);if(Buffer.byteLength(n)>ds||/["'\\\s]/.test(n))return null;try{if(await Fe(n))return n;let o=as(t,["--daemonize=no","--system=no","--use-pid-file=no","--exit-idle-time=-1","--disallow-exit=yes","--realtime=no","--high-priority=no","--disallow-module-loading=yes","--log-level=warning",`--log-target=file:${pe(e,"pulseaudio.log")}`,"-n",`--load=module-native-protocol-unix socket="${n}" auth-anonymous=1 auth-cookie-enabled=0`,`--load=module-null-sink sink_name=${$t} rate=${Q.sampleRate} channels=${Q.channels} sink_properties=device.description=Reason_desktop`],{detached:!0,stdio:"ignore",env:{HOME:e,PATH:"/usr/bin:/bin",XDG_RUNTIME_DIR:e,PULSE_RUNTIME_PATH:pe(e,"runtime"),PULSE_STATE_PATH:pe(e,"state")}}),s=!1;o.once("error",()=>{s=!0}),o.once("exit",()=>{s=!0}),o.unref();let i=Date.now()+ls;while(Date.now()<i){if(await Fe(n))return n;if(s)return await Fe(n)?n:null;await new Promise((a)=>setTimeout(a,50))}if(!s)o.kill("SIGKILL");return null}catch{return null}}function Lt(){let{sampleRate:e,channels:t}=Q;return["-hide_banner","-loglevel","error","-nostdin","-fflags","nobuffer","-f","pulse","-sample_rate",String(e),"-channels",String(t),"-fragment_size",String(e*t*2/50),"-i",`${$t}.monitor`,"-vn","-ac",String(t),"-ar",String(e),"-c:a","libopus","-b:a","64k","-application","lowdelay","-frame_duration","20","-flush_packets","1","-page_duration","20000","-f","ogg","pipe:1"]}var fs=[79,103,103,83],ms=Buffer.from("OpusHead"),gs=Buffer.from("OpusTags"),At=(e,t)=>e.byteLength>=t.byteLength&&t.every((n,o)=>e[o]===n);class ze extends Error{constructor(e){super(e);this.name="OggProtocolError"}}class je{buffer=new Uint8Array(0);partial=[];partialBytes=0;push(e){let t=new Uint8Array(this.buffer.byteLength+e.byteLength);t.set(this.buffer),t.set(e,this.buffer.byteLength);let n=[],o=0;while(t.byteLength-o>=27){if(fs.some((w,f)=>t[o+f]!==w)||t[o+4]!==0)throw new ze("invalid_page");let s=(t[o+5]&1)!==0,i=t[o+26];if(t.byteLength-o<27+i)break;let a=t.subarray(o+27,o+27+i),d=a.reduce((w,f)=>w+f,0),y=27+i+d;if(t.byteLength-o<y)break;if(!s&&this.partialBytes>0)this.resetPartial();let h=s&&this.partialBytes===0,g=o+27+i,p=g;for(let w of a){if(g+=w,w===255)continue;if(this.appendPartial(t.subarray(p,g),h),p=g,!h){let f=this.takePartial();if(f.byteLength>0&&!At(f,ms)&&!At(f,gs))n.push(f)}h=!1,this.resetPartial()}if(p<g)this.appendPartial(t.subarray(p,g),h);o+=y}return this.buffer=t.slice(o),n}appendPartial(e,t){if(t||e.byteLength===0)return;if(this.partialBytes+=e.byteLength,this.partialBytes>ps)throw new ze("packet_too_large");this.partial.push(e.slice())}takePartial(){if(this.partial.length===1)return this.partial[0];let e=new Uint8Array(this.partialBytes),t=0;for(let n of this.partial)e.set(n,t),t+=n.byteLength;return e}resetPartial(){this.partial=[],this.partialBytes=0}}import{spawn as hs}from"child_process";var Nt=1048576,bs=String.raw`
 import gi, json, os, sys
 gi.require_version("Gtk", "3.0")
 from gi.repository import Gtk, Gdk, GLib
@@ -122,5 +122,5 @@ Gtk.main()
 `);f>=0;f=i.indexOf(`
 `)){let M=i.slice(0,f);i=i.slice(f+1);let E;try{E=JSON.parse(M)}catch{g();return}if(E==="ready"||E==="ack"){clearTimeout(y),s=!1;while(!s&&!o&&d.length){let c=d.shift();a-=c.bytes,c.apply()}}else if(E&&typeof E==="object"&&"text"in E&&typeof E.text==="string"&&Buffer.byteLength(E.text)<=S)t.clipboard(E.text);else{g();return}if(o)return}if(i.length>S*6+32)g()}),n.stdin.on("error",g),n.once("error",g),n.once("exit",g),{apply:p,write(w){if(Buffer.byteLength(w)>S||w.includes("\x00")){g();return}let f=`${JSON.stringify(w)}
 `;p(()=>{if(s=!0,y=setTimeout(()=>g(),5000),n.stdin.write(f),n.stdin.writableLength>Nt)h(),t.end({reason:"input_backpressure"})},Buffer.byteLength(f))},close:h}}var X={smooth:{fps:60,crf:23,kbps:8000,x264Preset:"ultrafast",threads:2,scale:1},sharp:{fps:30,crf:19,kbps:1e4,x264Preset:"superfast",scale:1},data_saver:{fps:20,crf:28,kbps:2000,x264Preset:"ultrafast",scale:0.75},balanced:{fps:30,crf:23,kbps:4000,x264Preset:"ultrafast",threads:2,scale:1}},_s="avc1.4D002A",Bt={width:1920,height:1080},ks=262144,Ss=0.2,vs=250,Es=1e4,Ds=1024,Ke=1e4,Is=500,Ps=60,Cs=1e4,Rs=1000,Ht=1048576,Ms=-223,Ts=-308,In={kind:"mac_screen",sound:null},Dn={kind:"windows_screen",sound:null},Os,jt=()=>Os??=x()?.ffmpeg??null,me=(e,t,n)=>qe(e,t,{env:n,stdio:["ignore","pipe","ignore"],windowsHide:!0}),As,Ye=()=>As??=Ot(x()),Gt=(e,t,n)=>{let[o,...s]=[...Ye(),e];return me(o,[...s,...t],n)},Vt=()=>nn?.videotoolbox?"h264_videotoolbox":"libx264",$s=()=>Math.round(performance.now()*1000),Xe=new Set,Wt=!1;function Jt(e){if(Xe.add(e),e.once("exit",()=>Xe.delete(e)),Wt)return;Wt=!0,process.once("exit",()=>{for(let t of Xe)try{t.kill("SIGKILL")}catch{}})}function Zt(e){try{e.stdout?.destroy()}catch{}if(e.exitCode!==null||e.signalCode!==null)return;try{e.kill("SIGTERM")}catch{return}let t=setTimeout(()=>{if(e.exitCode===null&&e.signalCode===null)try{e.kill("SIGKILL")}catch{}},Is);e.once("exit",()=>clearTimeout(t))}function Ls(e,t,n){return{args:["-f","x11grab","-draw_mouse","1","-framerate",String(e),"-video_size",`${t.width}x${t.height}`,"-i",n],size:t}}function Ns(e){return{args:["-f","avfoundation","-capture_cursor","1","-pixel_format","nv12","-framerate",String(e),"-i","Capture screen 0:none"],size:null}}function Us(e,t){return{args:["-f","gdigrab","-draw_mouse","1","-framerate",String(e),"-offset_x","0","-offset_y","0","-video_size",`${t.width}x${t.height}`,"-i","desktop"],size:t}}function Bs(e){return{args:["-probesize","32","-analyzeduration","0","-f","image2pipe","-c:v","mjpeg","-framerate",String(e),"-i","pipe:0"],size:null}}var Qt=1700000;function en(e){return Math.min(1,Math.round(Math.sqrt(Qt/(e.width*e.height))*100)/100)}function Hs(e,t,n){let o=qe(n.axe,["stream-video","--udid",n.udid,"--format","ffmpeg","--fps","30","--quality","85","--scale",String(Math.min(0.99,en(n.size)))],{stdio:["ignore","pipe","ignore"]}),s=qe(e,t,{env:{},stdio:["pipe","pipe","ignore"]});o.stdout.pipe(s.stdin),s.stdin.on("error",()=>{});let i=()=>{if(o.exitCode===null&&o.signalCode===null)o.kill("SIGTERM")};return s.once("exit",i),s.once("error",i),o.once("exit",()=>{if(s.exitCode===null&&s.signalCode===null)s.kill("SIGTERM")}),o.once("error",()=>{if(s.exitCode===null&&s.signalCode===null)s.kill("SIGTERM")}),s}function Kt(e){let t=Math.min(1,Bt.width/e.width,Bt.height/e.height);return{width:Math.round(e.width*t),height:Math.round(e.height*t)}}function fe(e,t,n,o="libx264"){let s=X[e],i=(p)=>Math.max(2,Math.floor(p/2)*2),a={width:i(n.width*s.scale),height:i(n.height*s.scale)},d=a.width!==t.size?.width||a.height!==t.size.height,y=Math.max(1,Math.round(s.kbps*2/s.fps)),h=["-g",String(s.fps*Ps)],g=o==="h264_videotoolbox"?["-c:v","h264_videotoolbox","-realtime","1","-prio_speed","1","-allow_sw","1","-profile:v","main","-level","4.2","-bf","0","-pix_fmt","nv12",...h,"-b:v",`${s.kbps}k`,"-maxrate",`${s.kbps}k`,"-bufsize",`${y}k`,"-bsf:v","h264_metadata=aud=insert"]:["-c:v","libx264","-preset",s.x264Preset,"-tune","zerolatency","-profile:v","main","-level","4.2","-bf","0","-pix_fmt","yuv420p",...s.threads?["-threads",String(s.threads)]:[],"-x264-params","aud=1:repeat-headers=1",...h,"-crf",String(s.crf),"-maxrate",`${s.kbps}k`,"-bufsize",`${y}k`];return["-hide_banner","-loglevel","error","-nostdin","-fflags","nobuffer",...t.args,"-an",...d?["-vf",`scale=${a.width}:${a.height}:flags=fast_bilinear`]:[],...g,"-flush_packets","1","-f","h264","pipe:1"]}class tn{buffer=new Uint8Array(0);scanned=0;key=!1;micros=0;push(e,t){if(this.buffer.byteLength===0)this.micros=t;let n=new Uint8Array(this.buffer.byteLength+e.byteLength);n.set(this.buffer),n.set(e,this.buffer.byteLength),this.buffer=n;let o=[],s=this.scanned;while(s+3<this.buffer.byteLength){if(this.buffer[s]!==0||this.buffer[s+1]!==0||this.buffer[s+2]!==1){s++;continue}let i=this.buffer[s+3]&31,a=s>0&&this.buffer[s-1]===0?s-1:s;if(i===9&&a>0)o.push({data:this.buffer.slice(0,a),key:this.key,micros:this.micros}),this.buffer=this.buffer.subarray(a),this.key=!1,this.micros=t,s-=a;if(i===5)this.key=!0;s+=3}return this.scanned=s,o}}function Fs(e,t){let n=xs({path:e}),o=Buffer.alloc(0),s="version",i=0,a=!1,d=[],y=0,h=!1,g=(c)=>{if(h)return;h=!0,n.destroy(),t.end(c)},p=()=>g({reason:"display_protocol"}),w=(c)=>{if(h)return;if(!a){if(y+=c.byteLength,y>Ht)g({reason:"input_backpressure"});else d.push(c);return}if(n.write(c),n.writableLength>Ht)g({reason:"input_backpressure"})},f=(c)=>{o=o.subarray(c)},M=()=>{switch(s){case"version":{if(o.byteLength<12)return!1;let c=/^RFB (\d{3})\.(\d{3})\n$/.exec(o.subarray(0,12).toString("latin1"));if(!c||Number(c[1])*1000+Number(c[2])<3007)return p(),!1;return f(12),n.write(`RFB 003.007
-`),s="security",!0}case"security":{if(o.byteLength<1)return!1;let c=o[0];if(c===0)return p(),!1;if(o.byteLength<1+c)return!1;if(!o.subarray(1,1+c).includes(1))return p(),!1;return f(1+c),n.write(Buffer.from([1,1])),s="init",!0}case"init":{if(o.byteLength<24)return!1;let c=o.readUInt32BE(20);if(c>65536)return p(),!1;if(o.byteLength<24+c)return!1;let _={width:o.readUInt16BE(0),height:o.readUInt16BE(2)};if(f(24+c),_.width===0||_.height===0)return p(),!1;s="messages";let v=Buffer.alloc(12);v.writeUInt8(2,0),v.writeUInt16BE(2,2),v.writeInt32BE(Ts,4),v.writeInt32BE(Ms,8),n.write(v),a=!0;for(let D of d)n.write(D);return d=[],y=0,t.ready(_),!h}case"skip":{let c=Math.min(i,o.byteLength);if(f(c),i-=c,i>0)return!1;return s="messages",!0}case"messages":{if(o.byteLength<1)return!1;switch(o[0]){case 1:{if(o.byteLength<6)return!1;let c=6+o.readUInt16BE(4)*6;if(o.byteLength<c)return!1;return f(c),!0}case 2:return f(1),!0;case 3:{if(o.byteLength<8)return!1;let c=o.readUInt32BE(4);if(c>S/2)return f(8),s="skip",i=c,!0;if(o.byteLength<8+c)return!1;let _=o.subarray(8,8+c).toString("latin1");return f(8+c),t.clipboard(_),!h}default:return p(),!1}}}},E=!1;return n.once("connect",()=>{E=!0}),n.on("data",(c)=>{if(h)return;o=o.byteLength?Buffer.concat([o,c]):c;while(!h&&M());}),n.once("error",()=>{if(!E)g({error:new r("display_unavailable","Reason could not reach this machine's desktop server.")})}),n.once("close",()=>g({reason:"display_closed"})),{pointer(c,_,v){let D=Buffer.alloc(6);D.writeUInt8(5,0),D.writeUInt8(v&255,1),D.writeUInt16BE(c,2),D.writeUInt16BE(_,4),w(D)},key(c,_){let v=Buffer.alloc(8);v.writeUInt8(4,0),v.writeUInt8(c?1:0,1),v.writeUInt32BE(_>>>0,4),w(v)},clipboard(c){if(Array.from(c).some((D)=>D.codePointAt(0)>255)){g({reason:"clipboard_unicode_unsupported"});return}let _=Buffer.from(c,"latin1"),v=Buffer.alloc(8);v.writeUInt8(6,0),v.writeUInt32BE(_.byteLength,4),w(Buffer.concat([v,_]))},close(){h=!0,n.destroy()}}}class Je{run=null;viewers=new Set;get running(){return this.run!==null}start(e,t,n,o){this.viewers.add(e),this.stop();let s;try{s=n()}catch{this.fail();return}Jt(s);let i={child:s,splitter:new tn};this.run=i;for(let d of[...this.viewers])d.started(t);s.stdout?.on("data",(d)=>{if(this.run!==i)return;for(let y of i.splitter.push(d,o()))for(let h of[...this.viewers])h.unit(y)});let a=()=>{if(this.run!==i)return;this.run=null,this.fail()};s.once("exit",a),s.once("error",a)}leave(e){if(!this.viewers.delete(e))return;if(this.viewers.size===0)this.stop()}stop(){if(!this.run)return;Zt(this.run.child),this.run=null}fail(){for(let e of[...this.viewers])e.failed()}}var Xt=new WeakMap;function zs(e){let t=Xt.get(e);if(!t)Xt.set(e,t=new Je);return t}var ee=new Map;function Nn(e,t,n={}){let o=n.micros??$s,s=new $n,i=t.request.preset,a=null,d=null,y=null,h=!1,g=null,p=!1,w=!1,f=null,M=0,E=0,c=!1,_=null,v=null,D=0,L=null,P=[],te=0,N=[],Ze=new Uint32Array(Ke+1),ge=0,he=null,be=0,q=0,ye=0,Qe=0,et=0,ne=null,we=0,j={frames:0,bytes:0,since:o()},G=[],Y=0,xe,_e=!1,rn=o(),R={},V=()=>Math.round((o()-rn)/1000),tt=n.control??ut,ke=null,Se=null,nt=0,ve=!1,st={pause(){if(!g?.running)return;g.stop(),ve=!0},adopt(u){let l=u!==null&&(u.width!==d?.width||u.height!==d?.height);if(l)d=u;if(!l&&!ve)return;if(ve=!1,g)ae();else Ie()}},on=(u)=>{if(!n.resizeDesktop||!a||"kind"in a||e.done)return;let l=a.display,m=()=>[...ee.get(l)??[]];nt++,n.resizeDesktop(a,u,()=>{for(let k of m())k.pause()}).then((k)=>{for(let I of m())I.adopt(k)})},T=(u)=>{let l=zt(u);return e.send(l),Qe+=l.byteLength,l.byteLength},se=(u)=>{if(e.done)return;if(e.open)T({type:"error",code:u});e.end({reason:u})},re=()=>Math.max(ks,X[i].kbps*1000/8*Ss),oe=()=>o()/1000,an=()=>{while(N.length>1&&N[0].atMs<oe()-Es)N.shift();return N[0]?.rttMs??null},rt=(u)=>{let l=an();if(l===null||P.length===0)return!1;let m=(l+vs)*u;return oe()-P[0].sentMs>m||te>m/1000*X[i].kbps*1000/8},cn=(u)=>{if(D===0)return;let l=Math.min(u,D-1);if(L!==null&&l<=L)return;L=l;let m=oe();while(P.length&&P[0].seq<=l){let k=P.shift();if(te-=k.bytes,k.seq!==l)continue;let I=Math.max(0,m-k.sentMs);while(N.length&&N.at(-1).rttMs>=I)N.pop();N.push({atMs:m,rttMs:I}),Ze[Math.min(Ke,Math.round(I))]++,ge++,he=Math.min(he??I,I)}},un=()=>{let u=0;for(let l=0;l<=Ke;l++)if(u+=Ze[l],u*2>=ge)return l;return 0},ln=()=>e.bufferedAmount<=re()/2&&!rt(0.5),ot=()=>{_e=!0,G=[],Y=0,g?.leave(Ee),g=null},it=(u)=>{if(e.done)return;if(u.key)R.first_key_ms??=V();if(!h){if(!g||G.length===0&&!u.key)return;if(G.push(u),Y+=u.data.byteLength,Y>re())ot();return}if(c){q++;return}if(e.bufferedAmount>re()||rt(1)){c=!0,q++,_=setInterval(()=>{if(e.done||!ln())return;if(_)clearInterval(_);_=null,c=!1,ae()},n.drainPollMs??25);return}if(!p){if(!u.key){q++;return}if(T({type:"hello",width:d.width,height:d.height,fps:X[i].fps,preset:i,codec:_s}),p=!0,R.first_frame_ms??=V(),!w&&a?.sound)T({type:"audioHello",...Q}),w=!0}let l=T({type:"frame",key:u.key,seq:D,captureMicros:u.micros,data:u.data});if(P.push({seq:D,sentMs:oe(),bytes:l}),te+=l,P.length>Ds)te-=P.shift().bytes;D++,be++,ne??=u.micros,we=u.micros,j.frames++,j.bytes+=l},Ee={started(u){i=u,p=!1,G=[],Y=0},unit:it,failed:()=>se("encoder_failed")},De=()=>{let u=(n.ffmpeg??jt)();if(!a||!d){se("encoder_failed");return}let[l,m]=[a,d],k="kind"in l&&l.kind==="simulator"?l.stream:null;if(!u&&!k){se("encoder_failed");return}if(g??="kind"in l&&l.kind==="mac_screen"?zs(n.spawn??Gt):new Je,R.encoder_ms===void 0)R.encoder_ms=V(),R.encoder_shared=g.running;g.start(Ee,i,()=>{let I=X[i].fps;if(k)return k(I,X[i].kbps,Qt);if("kind"in l&&l.kind==="simulator"){let C=Math.min(0.99,en(l.size)),B={width:l.size.width*C,height:l.size.height*C};return Hs(u,fe(i,Bs(Math.min(I,30)),B,(n.macEncoder??Vt)()),l)}if("kind"in l&&l.kind==="windows_screen")return(n.spawn??me)(u,fe(i,Us(I,m),Kt(m)),{SystemRoot:process.env.SystemRoot??"C:\\Windows"});return"kind"in l?(n.spawn??Gt)(u,fe(i,Ns(I),Kt(m),(n.macEncoder??Vt)()),{}):(n.spawn??me)(u,fe(i,Ls(I,m,l.display),m),{DISPLAY:l.display,XAUTHORITY:l.xauthority})},o)},ie=()=>{if(!f)return;Zt(f.child),f=null},dn=()=>{let u=(n.ffmpeg??jt)();if(f||e.done||!w||!a?.sound||!u)return;let l;try{l=(n.spawn??me)(u,Lt(),{PULSE_SERVER:Ve(a.sound)})}catch{return}Jt(l);let m={child:l,reader:new je};f=m,l.stdout?.on("data",(I)=>{if(f!==m||e.done)return;let C;try{C=m.reader.push(I)}catch{ie();return}let B=o();for(let Ce of C){if(e.bufferedAmount>re()){E++;continue}T({type:"audio",captureMicros:B,data:Ce}),M++}});let k=()=>{if(f===m)ie()};l.once("exit",k),l.once("error",k)},ae=()=>{if(!g||e.done)return;ye++,De()},Ie=()=>{if(e.done||!d)return;if(!h){if(g||_e)return;De(),xe=setTimeout(()=>{if(!h)ot()},Cs);return}if(clearTimeout(xe),R.encoder_early===void 0){if(R.encoder_early=g!==null,_e)R.hold_lapsed=!0}if(!g)De();let u=G;G=[],Y=0;for(let l of u)it(l);v??=setInterval(()=>{let l=o(),m=Math.max(0.001,(l-j.since)/1e6);T({type:"stats",stats:{fps:Math.round(j.frames/m*10)/10,kbps:Math.round(j.bytes*8/1000/m),dropped:q,restarts:ye,queued_bytes:e.bufferedAmount}}),j={frames:0,bytes:0,since:l}},Rs)};t.desktop.then((u)=>{if(e.done)return;a=u;let l={ready(m){d=m,R.desktop_ms??=V(),Ie()},clipboard(m){if(e.open&&Buffer.byteLength(m)<=S)T({type:"serverClipboard",text:m})},end(m){if("reason"in m&&e.open)T({type:"error",code:m.reason});e.end(m)}};if("kind"in u&&u.kind==="simulator")y=u.input,l.ready(u.points);else if("kind"in u&&u.kind==="windows_screen")y=(n.windowsInput??xt)(l);else if("kind"in u)y=(n.macInput??((m)=>Fn(m,Ye())))(l);else{let m=ee.get(u.display);if(!m)ee.set(u.display,m=new Set);m.add(st);let k=(n.linuxClipboard??Ut)(u,l),I=Fs(u.rfbSocket,{...l,clipboard:(C)=>{if(!k)l.clipboard(C)}});y=k?{pointer:(C,B,Ce)=>k.apply(()=>I.pointer(C,B,Ce)),key:(C,B)=>k.apply(()=>I.key(C,B)),clipboard:(C)=>k.write(C),close(){k.close(),I.close()}}:I}at()},(u)=>e.end({error:u}));function at(){if(Se||!t.viewerSameNetwork||!h||e.done||!a||!("kind"in a)||a.kind!=="mac_screen")return;Se=(n.macWindows??Bn)((u)=>{if(e.open)T({type:"windows",bounds:u})})}let ct={viewer:t.viewer??null,notify(u){if(e.open)T({type:"control",control:u})}},Pe=(u)=>{if(!y)return;if(!a||!("kind"in a)||a.kind!=="simulator")tt.claim(ct);u(y)};return{opened(){R.relay_ms??=V()},received(u){et+=u.byteLength;let l;try{l=s.push(u)}catch{se("viewer_protocol");return}for(let m of l){if(e.done)return;switch(m.type){case"ping":T({type:"pong",token:m.token});break;case"pointer":Pe((k)=>k.pointer(m.x,m.y,m.buttons));break;case"key":Pe((k)=>k.key(m.down,m.keysym));break;case"clientClipboard":Pe((k)=>k.clipboard(m.text));break;case"config":if(m.preset!==i)i=m.preset,ae();break;case"keyframeRequest":if(p&&!c)ae();break;case"ack":cn(m.seq);break;case"audioEnable":if(m.on)dn();else ie();break;case"resize":on({width:m.width,height:m.height});break;default:break}}if(!h&&!e.done){if(h=!0,R.viewer_ms=V(),t.viewer)ke=tt.join(ct);Ie(),at()}},close(){if(a&&!("kind"in a)){let u=ee.get(a.display);if(u?.delete(st),u?.size===0)ee.delete(a.display)}if(ke?.(),ke=null,Se?.close(),_)clearInterval(_);if(v)clearInterval(v);clearTimeout(xe),g?.leave(Ee),ie(),y?.close()},summary:()=>({output_bytes:Qe,input_bytes:et,video:{preset:i,frames:be,dropped:q,restarts:ye,avg_fps:ne!==null&&we>ne?Math.round((be-1)/((we-ne)/1e6)*10)/10:0,min_rtt_ms:Math.round(he??0),p50_rtt_ms:ge?un():0,audio_packets:M,audio_dropped:E,resizes:nt,connect:R}})}}var qt=null,nn=null,js=null,Gs=null;function Vs(){let e=x();return e?.features.display?e.ffmpeg:null}function sn(e){return qt??=new Promise((t)=>{ys(e,["-hide_banner","-encoders"],{env:{},timeout:5000,killSignal:"SIGKILL",maxBuffer:1048576,encoding:"utf8"},(n,o)=>{let s=(i)=>!n&&new RegExp(`^\\s*V\\S*\\s+${i}\\s`,"m").test(o);t(nn={x264:s("libx264"),videotoolbox:s("h264_videotoolbox")})})}),qt}var Yt=null;function Ln(){return Yt??=(async()=>{let e=[x()?.ffmpeg,"/opt/homebrew/bin/ffmpeg","/usr/local/bin/ffmpeg"].find((n)=>Boolean(n&&ws(n)));if(!e)return null;let t=await sn(e);return t.videotoolbox||t.x264?e:null})(),Yt}function Pr(e=process.platform,t={}){if(e!=="linux"&&e!=="darwin"&&e!=="win32")return Promise.resolve(!1);let n=(t.ffmpeg??Vs)();if(!n)return Promise.resolve(!1);let o=(t.encoders??sn)(n);if(e==="linux")return o.then((i)=>i.x264);if(e==="win32"){let i=t.windowsScreen?t.windowsScreen():Gs??=bt();return Promise.all([o,i]).then(([a,d])=>a.x264&&(d?.session??0)>0)}let s=t.macScreen?t.macScreen():js??=Ge(Ye());return Promise.all([o,s]).then(([i,a])=>(i.x264||i.videotoolbox)&&a?.screen===!0&&a.accessibility)}
+`),s="security",!0}case"security":{if(o.byteLength<1)return!1;let c=o[0];if(c===0)return p(),!1;if(o.byteLength<1+c)return!1;if(!o.subarray(1,1+c).includes(1))return p(),!1;return f(1+c),n.write(Buffer.from([1,1])),s="init",!0}case"init":{if(o.byteLength<24)return!1;let c=o.readUInt32BE(20);if(c>65536)return p(),!1;if(o.byteLength<24+c)return!1;let _={width:o.readUInt16BE(0),height:o.readUInt16BE(2)};if(f(24+c),_.width===0||_.height===0)return p(),!1;s="messages";let v=Buffer.alloc(12);v.writeUInt8(2,0),v.writeUInt16BE(2,2),v.writeInt32BE(Ts,4),v.writeInt32BE(Ms,8),n.write(v),a=!0;for(let D of d)n.write(D);return d=[],y=0,t.ready(_),!h}case"skip":{let c=Math.min(i,o.byteLength);if(f(c),i-=c,i>0)return!1;return s="messages",!0}case"messages":{if(o.byteLength<1)return!1;switch(o[0]){case 1:{if(o.byteLength<6)return!1;let c=6+o.readUInt16BE(4)*6;if(o.byteLength<c)return!1;return f(c),!0}case 2:return f(1),!0;case 3:{if(o.byteLength<8)return!1;let c=o.readUInt32BE(4);if(c>S/2)return f(8),s="skip",i=c,!0;if(o.byteLength<8+c)return!1;let _=o.subarray(8,8+c).toString("latin1");return f(8+c),t.clipboard(_),!h}default:return p(),!1}}}},E=!1;return n.once("connect",()=>{E=!0}),n.on("data",(c)=>{if(h)return;o=o.byteLength?Buffer.concat([o,c]):c;while(!h&&M());}),n.once("error",()=>{if(!E)g({error:new r("display_unavailable","Reason could not reach this machine's desktop server.")})}),n.once("close",()=>g({reason:"display_closed"})),{pointer(c,_,v){let D=Buffer.alloc(6);D.writeUInt8(5,0),D.writeUInt8(v&255,1),D.writeUInt16BE(c,2),D.writeUInt16BE(_,4),w(D)},key(c,_){let v=Buffer.alloc(8);v.writeUInt8(4,0),v.writeUInt8(c?1:0,1),v.writeUInt32BE(_>>>0,4),w(v)},clipboard(c){if(Array.from(c).some((D)=>D.codePointAt(0)>255)){g({reason:"clipboard_unicode_unsupported"});return}let _=Buffer.from(c,"latin1"),v=Buffer.alloc(8);v.writeUInt8(6,0),v.writeUInt32BE(_.byteLength,4),w(Buffer.concat([v,_]))},close(){h=!0,n.destroy()}}}class Je{run=null;viewers=new Set;get running(){return this.run!==null}start(e,t,n,o){this.viewers.add(e),this.stop();let s;try{s=n()}catch{this.fail();return}Jt(s);let i={child:s,splitter:new tn};this.run=i;for(let d of[...this.viewers])d.started(t);s.stdout?.on("data",(d)=>{if(this.run!==i)return;for(let y of i.splitter.push(d,o()))for(let h of[...this.viewers])h.unit(y)});let a=()=>{if(this.run!==i)return;this.run=null,this.fail()};s.once("exit",a),s.once("error",a)}leave(e){if(!this.viewers.delete(e))return;if(this.viewers.size===0)this.stop()}stop(){if(!this.run)return;Zt(this.run.child),this.run=null}fail(){for(let e of[...this.viewers])e.failed()}}var Xt=new WeakMap;function zs(e){let t=Xt.get(e);if(!t)Xt.set(e,t=new Je);return t}var ee=new Map;function Nn(e,t,n={}){let o=n.micros??$s,s=new Bn,i=t.request.preset,a=null,d=null,y=null,h=!1,g=null,p=!1,w=!1,f=null,M=0,E=0,c=!1,_=null,v=null,D=0,L=null,P=[],te=0,N=[],Ze=new Uint32Array(Ke+1),ge=0,he=null,be=0,q=0,ye=0,Qe=0,et=0,ne=null,we=0,j={frames:0,bytes:0,since:o()},G=[],Y=0,xe,_e=!1,rn=o(),R={},V=()=>Math.round((o()-rn)/1000),tt=n.control??ut,ke=null,Se=null,nt=0,ve=!1,st={pause(){if(!g?.running)return;g.stop(),ve=!0},adopt(u){let l=u!==null&&(u.width!==d?.width||u.height!==d?.height);if(l)d=u;if(!l&&!ve)return;if(ve=!1,g)ae();else Ie()}},on=(u)=>{if(!n.resizeDesktop||!a||"kind"in a||e.done)return;let l=a.display,m=()=>[...ee.get(l)??[]];nt++,n.resizeDesktop(a,u,()=>{for(let k of m())k.pause()}).then((k)=>{for(let I of m())I.adopt(k)})},T=(u)=>{let l=zt(u);return e.send(l),Qe+=l.byteLength,l.byteLength},se=(u)=>{if(e.done)return;if(e.open)T({type:"error",code:u});e.end({reason:u})},re=()=>Math.max(ks,X[i].kbps*1000/8*Ss),oe=()=>o()/1000,an=()=>{while(N.length>1&&N[0].atMs<oe()-Es)N.shift();return N[0]?.rttMs??null},rt=(u)=>{let l=an();if(l===null||P.length===0)return!1;let m=(l+vs)*u;return oe()-P[0].sentMs>m||te>m/1000*X[i].kbps*1000/8},cn=(u)=>{if(D===0)return;let l=Math.min(u,D-1);if(L!==null&&l<=L)return;L=l;let m=oe();while(P.length&&P[0].seq<=l){let k=P.shift();if(te-=k.bytes,k.seq!==l)continue;let I=Math.max(0,m-k.sentMs);while(N.length&&N.at(-1).rttMs>=I)N.pop();N.push({atMs:m,rttMs:I}),Ze[Math.min(Ke,Math.round(I))]++,ge++,he=Math.min(he??I,I)}},un=()=>{let u=0;for(let l=0;l<=Ke;l++)if(u+=Ze[l],u*2>=ge)return l;return 0},ln=()=>e.bufferedAmount<=re()/2&&!rt(0.5),ot=()=>{_e=!0,G=[],Y=0,g?.leave(Ee),g=null},it=(u)=>{if(e.done)return;if(u.key)R.first_key_ms??=V();if(!h){if(!g||G.length===0&&!u.key)return;if(G.push(u),Y+=u.data.byteLength,Y>re())ot();return}if(c){q++;return}if(e.bufferedAmount>re()||rt(1)){c=!0,q++,_=setInterval(()=>{if(e.done||!ln())return;if(_)clearInterval(_);_=null,c=!1,ae()},n.drainPollMs??25);return}if(!p){if(!u.key){q++;return}if(T({type:"hello",width:d.width,height:d.height,fps:X[i].fps,preset:i,codec:_s}),p=!0,R.first_frame_ms??=V(),!w&&a?.sound)T({type:"audioHello",...Q}),w=!0}let l=T({type:"frame",key:u.key,seq:D,captureMicros:u.micros,data:u.data});if(P.push({seq:D,sentMs:oe(),bytes:l}),te+=l,P.length>Ds)te-=P.shift().bytes;D++,be++,ne??=u.micros,we=u.micros,j.frames++,j.bytes+=l},Ee={started(u){i=u,p=!1,G=[],Y=0},unit:it,failed:()=>se("encoder_failed")},De=()=>{let u=(n.ffmpeg??jt)();if(!a||!d){se("encoder_failed");return}let[l,m]=[a,d],k="kind"in l&&l.kind==="simulator"?l.stream:null;if(!u&&!k){se("encoder_failed");return}if(g??="kind"in l&&l.kind==="mac_screen"?zs(n.spawn??Gt):new Je,R.encoder_ms===void 0)R.encoder_ms=V(),R.encoder_shared=g.running;g.start(Ee,i,()=>{let I=X[i].fps;if(k)return k(I,X[i].kbps,Qt);if("kind"in l&&l.kind==="simulator"){let C=Math.min(0.99,en(l.size)),B={width:l.size.width*C,height:l.size.height*C};return Hs(u,fe(i,Bs(Math.min(I,30)),B,(n.macEncoder??Vt)()),l)}if("kind"in l&&l.kind==="windows_screen")return(n.spawn??me)(u,fe(i,Us(I,m),Kt(m)),{SystemRoot:process.env.SystemRoot??"C:\\Windows"});return"kind"in l?(n.spawn??Gt)(u,fe(i,Ns(I),Kt(m),(n.macEncoder??Vt)()),{}):(n.spawn??me)(u,fe(i,Ls(I,m,l.display),m),{DISPLAY:l.display,XAUTHORITY:l.xauthority})},o)},ie=()=>{if(!f)return;Zt(f.child),f=null},dn=()=>{let u=(n.ffmpeg??jt)();if(f||e.done||!w||!a?.sound||!u)return;let l;try{l=(n.spawn??me)(u,Lt(),{PULSE_SERVER:Ve(a.sound)})}catch{return}Jt(l);let m={child:l,reader:new je};f=m,l.stdout?.on("data",(I)=>{if(f!==m||e.done)return;let C;try{C=m.reader.push(I)}catch{ie();return}let B=o();for(let Ce of C){if(e.bufferedAmount>re()){E++;continue}T({type:"audio",captureMicros:B,data:Ce}),M++}});let k=()=>{if(f===m)ie()};l.once("exit",k),l.once("error",k)},ae=()=>{if(!g||e.done)return;ye++,De()},Ie=()=>{if(e.done||!d)return;if(!h){if(g||_e)return;De(),xe=setTimeout(()=>{if(!h)ot()},Cs);return}if(clearTimeout(xe),R.encoder_early===void 0){if(R.encoder_early=g!==null,_e)R.hold_lapsed=!0}if(!g)De();let u=G;G=[],Y=0;for(let l of u)it(l);v??=setInterval(()=>{let l=o(),m=Math.max(0.001,(l-j.since)/1e6);T({type:"stats",stats:{fps:Math.round(j.frames/m*10)/10,kbps:Math.round(j.bytes*8/1000/m),dropped:q,restarts:ye,queued_bytes:e.bufferedAmount}}),j={frames:0,bytes:0,since:l}},Rs)};t.desktop.then((u)=>{if(e.done)return;a=u;let l={ready(m){d=m,R.desktop_ms??=V(),Ie()},clipboard(m){if(e.open&&Buffer.byteLength(m)<=S)T({type:"serverClipboard",text:m})},end(m){if("reason"in m&&e.open)T({type:"error",code:m.reason});e.end(m)}};if("kind"in u&&u.kind==="simulator")y=u.input,l.ready(u.points);else if("kind"in u&&u.kind==="windows_screen")y=(n.windowsInput??xt)(l);else if("kind"in u)y=(n.macInput??((m)=>jn(m,Ye())))(l);else{let m=ee.get(u.display);if(!m)ee.set(u.display,m=new Set);m.add(st);let k=(n.linuxClipboard??Ut)(u,l),I=Fs(u.rfbSocket,{...l,clipboard:(C)=>{if(!k)l.clipboard(C)}});y=k?{pointer:(C,B,Ce)=>k.apply(()=>I.pointer(C,B,Ce)),key:(C,B)=>k.apply(()=>I.key(C,B)),clipboard:(C)=>k.write(C),close(){k.close(),I.close()}}:I}at()},(u)=>e.end({error:u}));function at(){if(Se||!t.viewerSameNetwork||!h||e.done||!a||!("kind"in a)||a.kind!=="mac_screen")return;Se=(n.macWindows??Fn)((u)=>{if(e.open)T({type:"windows",bounds:u})})}let ct={viewer:t.viewer??null,notify(u){if(e.open)T({type:"control",control:u})}},Pe=(u)=>{if(!y)return;if(!a||!("kind"in a)||a.kind!=="simulator")tt.claim(ct);u(y)};return{opened(){R.relay_ms??=V()},received(u){et+=u.byteLength;let l;try{l=s.push(u)}catch{se("viewer_protocol");return}for(let m of l){if(e.done)return;switch(m.type){case"ping":T({type:"pong",token:m.token});break;case"pointer":Pe((k)=>k.pointer(m.x,m.y,m.buttons));break;case"key":Pe((k)=>k.key(m.down,m.keysym));break;case"clientClipboard":Pe((k)=>k.clipboard(m.text));break;case"config":if(m.preset!==i)i=m.preset,ae();break;case"keyframeRequest":if(p&&!c)ae();break;case"ack":cn(m.seq);break;case"audioEnable":if(m.on)dn();else ie();break;case"resize":on({width:m.width,height:m.height});break;default:break}}if(!h&&!e.done){if(h=!0,R.viewer_ms=V(),t.viewer)ke=tt.join(ct);Ie(),at()}},close(){if(a&&!("kind"in a)){let u=ee.get(a.display);if(u?.delete(st),u?.size===0)ee.delete(a.display)}if(ke?.(),ke=null,Se?.close(),_)clearInterval(_);if(v)clearInterval(v);clearTimeout(xe),g?.leave(Ee),ie(),y?.close()},summary:()=>({output_bytes:Qe,input_bytes:et,video:{preset:i,frames:be,dropped:q,restarts:ye,avg_fps:ne!==null&&we>ne?Math.round((be-1)/((we-ne)/1e6)*10)/10:0,min_rtt_ms:Math.round(he??0),p50_rtt_ms:ge?un():0,audio_packets:M,audio_dropped:E,resizes:nt,connect:R}})}}var qt=null,nn=null,js=null,Gs=null;function Vs(){let e=x();return e?.features.display?e.ffmpeg:null}function sn(e){return qt??=new Promise((t)=>{ys(e,["-hide_banner","-encoders"],{env:{},timeout:5000,killSignal:"SIGKILL",maxBuffer:1048576,encoding:"utf8"},(n,o)=>{let s=(i)=>!n&&new RegExp(`^\\s*V\\S*\\s+${i}\\s`,"m").test(o);t(nn={x264:s("libx264"),videotoolbox:s("h264_videotoolbox")})})}),qt}var Yt=null;function Ln(){return Yt??=(async()=>{let e=[x()?.ffmpeg,"/opt/homebrew/bin/ffmpeg","/usr/local/bin/ffmpeg"].find((n)=>Boolean(n&&ws(n)));if(!e)return null;let t=await sn(e);return t.videotoolbox||t.x264?e:null})(),Yt}function Pr(e=process.platform,t={}){if(e!=="linux"&&e!=="darwin"&&e!=="win32")return Promise.resolve(!1);let n=(t.ffmpeg??Vs)();if(!n)return Promise.resolve(!1);let o=(t.encoders??sn)(n);if(e==="linux")return o.then((i)=>i.x264);if(e==="win32"){let i=t.windowsScreen?t.windowsScreen():Gs??=bt();return Promise.all([o,i]).then(([a,d])=>a.x264&&(d?.session??0)>0)}let s=t.macScreen?t.macScreen():js??=Ge(Ye());return Promise.all([o,s]).then(([i,a])=>(i.x264||i.videotoolbox)&&a?.screen===!0&&a.accessibility)}
 export{We,uo,F,On,Ve,po,In,Dn,Nn,Ln,Pr,Ft,Tr,x,ho};

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,4 +1,4 @@
 // @bun
-import{ii,bt,si,ai,ci,Oi}from"./vm-hands-entry-lite-9wa2y4x0.js";import{createHash as H,randomBytes as he}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Xe,openSync as Oe,renameSync as Qe,rmSync as Ze,statSync as De,writeSync as Me,constants as W}from"fs";import{join as se}from"path";var en=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:r}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!r||typeof r!=="object"||Array.isArray(r)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||r.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:nn(e)}}function nn(e){let n=e.payload[si];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var G=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),K=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function Fi(e){let n=await crypto.subtle.importKey("pkcs8",K(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=K(e.device_key.spki),r=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),h=new Uint8Array(await crypto.subtle.exportKey("spki",r.publicKey)),m=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:r,signingSpki:i,agreementSpki:h,fingerprint:m}}var tn=16;class ln{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,r){this.init=e;this.keys=n;this.hooks=i;this.options=r;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let r=Date.now()+n;;){let h=this.bound.get(e);if(!h)return!1;if(h.envInstalled)return!0;if(Date.now()>=r||i?.aborted)return!1;await new Promise((m)=>setTimeout(m,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:en,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:G(this.keys.signingSpki),env_public_key:G(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:G(he(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:G(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),r=G(he(32)),h=Oi({method:"GET",pathAndQuery:ii,timestamp:i,nonce:r,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),m=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(h)));return{t:"hello",timestamp:i,nonce:r,signature:G(rn(m)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let r of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(r))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((r)=>r.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=tn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((r)=>r.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let r,h,m=new Promise((_,k)=>{r=_,h=k});return m.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:m,resolve:r,reject:h}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(v){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(v,"the bind's kill-verify failed")}let i,r=new Promise((v)=>{i=v}),h=!1,m=!1,_=()=>{m=!0,i()},k=n.promise.then(()=>new Promise((v,I)=>{this.exclusive(async()=>{if(m){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}h=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();v()}catch(w){I(w)}await r})}));k.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:k,inTurn:()=>h,leave:_})}finally{_()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,r=!1;try{if(!n)await this.prepareBind(e);r=!0;let{launchId:h,applied:m,readyData:_}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),k=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let v=null,I=null;if(e.env){let w=e.claim?.owner??{},E=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:e.claim?.root_id??""});v=this.hooks.installEnvironment(e.bind_id,E),I=typeof E.snapshot_id==="string"&&E.snapshot_id?E.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,E)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:h,envInstalled:v!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:h,snapshot_revision:v,snapshot_id:I,layout:k,..._?{ready_data:_}:{},policy_digest:H("sha256").update(V({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(h){if(i)fe(i);if(r){let m=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(m);else await m()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(h,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let r=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),h=this.hooks.installEnvironment(n.bindId,r);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${h}`,r),{snapshot_id:e.snapshotId,installed_revision:h,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let r=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:r})}catch(h){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw h}if(this.unverified.delete(e),!r.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:r.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},r=await crypto.subtle.importKey("spki",K(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),h=await crypto.subtle.deriveKey({name:"ECDH",public:r},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:K(e.iv),additionalData:new TextEncoder().encode(n)},h,K(e.ct)).catch(i),_=JSON.parse(new TextDecoder().decode(m));if(!_||typeof _!=="object"||Array.isArray(_))throw new l("vm_hands_env_invalid","env not an object");return _}writeJobEnvRootOnly(e,n){let i=se(this.options.envRoot,`bind-${e}`);Xe(i,{mode:448});let r=De(i);if(!r.isDirectory()||(r.mode&63)!==0||r.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let h=n.variables&&typeof n.variables==="object"?n.variables:{},m=Object.entries(h).filter(([v,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(v)&&typeof I==="string").map(([v,I])=>`export ${v}='${String(I).replaceAll("'","'\\''")}'`).join(`
+import{ii,bt,si,ai,ci,Oi}from"./vm-hands-entry-lite-5tbntcyq.js";import{createHash as H,randomBytes as he}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Xe,openSync as Oe,renameSync as Qe,rmSync as Ze,statSync as De,writeSync as Me,constants as W}from"fs";import{join as se}from"path";var en=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:r}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!r||typeof r!=="object"||Array.isArray(r)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||r.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:nn(e)}}function nn(e){let n=e.payload[si];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var G=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),K=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function Fi(e){let n=await crypto.subtle.importKey("pkcs8",K(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=K(e.device_key.spki),r=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),h=new Uint8Array(await crypto.subtle.exportKey("spki",r.publicKey)),m=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:r,signingSpki:i,agreementSpki:h,fingerprint:m}}var tn=16;class ln{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,r){this.init=e;this.keys=n;this.hooks=i;this.options=r;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let r=Date.now()+n;;){let h=this.bound.get(e);if(!h)return!1;if(h.envInstalled)return!0;if(Date.now()>=r||i?.aborted)return!1;await new Promise((m)=>setTimeout(m,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:en,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:G(this.keys.signingSpki),env_public_key:G(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:G(he(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:G(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),r=G(he(32)),h=Oi({method:"GET",pathAndQuery:ii,timestamp:i,nonce:r,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),m=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(h)));return{t:"hello",timestamp:i,nonce:r,signature:G(rn(m)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let r of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(r))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((r)=>r.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=tn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((r)=>r.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let r,h,m=new Promise((_,k)=>{r=_,h=k});return m.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:m,resolve:r,reject:h}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(v){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(v,"the bind's kill-verify failed")}let i,r=new Promise((v)=>{i=v}),h=!1,m=!1,_=()=>{m=!0,i()},k=n.promise.then(()=>new Promise((v,I)=>{this.exclusive(async()=>{if(m){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}h=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();v()}catch(w){I(w)}await r})}));k.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:k,inTurn:()=>h,leave:_})}finally{_()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,r=!1;try{if(!n)await this.prepareBind(e);r=!0;let{launchId:h,applied:m,readyData:_}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),k=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let v=null,I=null;if(e.env){let w=e.claim?.owner??{},E=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:e.claim?.root_id??""});v=this.hooks.installEnvironment(e.bind_id,E),I=typeof E.snapshot_id==="string"&&E.snapshot_id?E.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,E)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:h,envInstalled:v!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:h,snapshot_revision:v,snapshot_id:I,layout:k,..._?{ready_data:_}:{},policy_digest:H("sha256").update(V({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(h){if(i)fe(i);if(r){let m=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(m);else await m()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(h,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let r=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),h=this.hooks.installEnvironment(n.bindId,r);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${h}`,r),{snapshot_id:e.snapshotId,installed_revision:h,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let r=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:r})}catch(h){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw h}if(this.unverified.delete(e),!r.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:r.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},r=await crypto.subtle.importKey("spki",K(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),h=await crypto.subtle.deriveKey({name:"ECDH",public:r},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:K(e.iv),additionalData:new TextEncoder().encode(n)},h,K(e.ct)).catch(i),_=JSON.parse(new TextDecoder().decode(m));if(!_||typeof _!=="object"||Array.isArray(_))throw new l("vm_hands_env_invalid","env not an object");return _}writeJobEnvRootOnly(e,n){let i=se(this.options.envRoot,`bind-${e}`);Xe(i,{mode:448});let r=De(i);if(!r.isDirectory()||(r.mode&63)!==0||r.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let h=n.variables&&typeof n.variables==="object"?n.variables:{},m=Object.entries(h).filter(([v,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(v)&&typeof I==="string").map(([v,I])=>`export ${v}='${String(I).replaceAll("'","'\\''")}'`).join(`
 `)+`
-`,_=se(i,`.job.env.${he(8).toString("hex")}`),k=Oe(_,W.O_WRONLY|W.O_CREAT|W.O_EXCL|W.O_NOFOLLOW,384);try{Me(k,m),xe(k)}finally{Ae(k)}return Qe(_,se(i,"job.env")),i}}function fe(e){try{let n=se(e,"job.env"),i=De(n).size,r=Oe(n,W.O_WRONLY|W.O_NOFOLLOW);try{Me(r,Buffer.alloc(i)),xe(r)}finally{Ae(r)}}catch{}Ze(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as sn}from"crypto";var on="/app/local-runtime/session?register=vm_hands_v1",an="/app/local-runtime",Ce=25000,we=20000,dn=1e4,Ue=5000,cn=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),un="preview.serve.v1",_n=60000,ye=75000,mn=2000,gn=1e4,hn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),fn=3,pn=20000,vn=250,wn=2000;function $e(e){let n=Math.min(vn*2**(e-1),wn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function bn(e){return e>=500||e===408||e===429}var ae=20000;function Be(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class D extends Error{}var kn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function je(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Sn(e,n,i,r,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[v,I]of qe.entries()){if(r.aborted)return;if(await new Promise((w)=>{let E=setTimeout(w,I);E.unref?.(),r.addEventListener("abort",()=>{clearTimeout(E),w()},{once:!0})}),r.aborted)return;try{let w=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:v+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let E=je(w);if(h("vm_hands.unbind_unverified",{operation_id:k,code:E,attempt:v+1}),E==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:qe.length})})().finally(()=>_.delete(m))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))])}async function In(e,n){let i=[...e.personTerminals].filter((r)=>r.session===null||r.session===n);for(let r of i)r.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))]);return i.length}function Pn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Tn=1000;async function ji(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},r=e.log??(()=>{}),h=async(k)=>{for(let[v,I]of[...i.turns]){i.turns.delete(v),e.onTurn?.(v,null),de(I);let w=await L(i,e.agent,v).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});r("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let v=await Rn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&hn.has(w.code)&&m<fn&&Date.now()-n<pn)return m++,_=$e(m),r("vm_hands.register_retry",{attempt:m,code:w.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(r("vm_hands.session_closed",{close_code:v.closeCode,reason:v.closeReason.slice(0,120),registered:i.deviceId!==null}),v.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=v.closeReason==="drain_reconnect"?0:v.closeReason==="vm_hands_register_retry"?_:v.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ye-Date.now())):Math.min(500*2**k,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Rn(e,n){let i=n.deviceId,r=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:on,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,v="",I=new Map,w=[],E=null,ce=new Promise((t)=>{_.onclose=(o)=>{k=o.code,v=o.reason;for(let s of I.values())s.reject(new D(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,Tn));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!E?.(o))w.push(o)};let J=(t,o)=>new Promise((s,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){s(w.splice(u,1)[0]);return}let f=setTimeout(()=>{E=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);E=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),E=null,s(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),q=(t,o)=>new Promise((s,a)=>{if(_.readyState!==WebSocket.OPEN){a(new D("session closed"));return}let u=sn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new D(`no answer to ${t.split("/").pop()} in ${f+Ne} ms`)),_.close(4000,"request_timeout")},f+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}s({status:c,json:g})}}),Y({t:"req",id:u,path:`${an}${t}`,body:JSON.stringify(o)})}),be=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",be,{once:!0});let le,X=new Map,Q=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);_.onopen=()=>{clearTimeout(g),r("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(s=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((T)=>T&&T.operation_id===S.claim.operation_id&&T.attempt_id===S.claim.attempt_id)){o.push(S),r("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),de(S);let P=await L(n,e.agent,g).catch((T)=>ee(T,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),ce.then(()=>{throw new l(v==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await q("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=q,ce.then(()=>{if(n.request===q)n.request=null}),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(s,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await Se(g,c),g instanceof D)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ke;try{await ne();for(let c of o)c.flush=()=>Ie(c),c.flush(),p(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await q("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Ce,Ce)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",be);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;_.close(),await ce,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>s?ee(u,s,"vm_hands_bind_lost"):null);if(a&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:a});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:k,closeReason:v};async function Se(t,o){if(t instanceof D){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)ue=!0;for(let a of s){let u=n.turns.get(a);if(n.turns.delete(a),u)de(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=q){let s=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>s(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(R)=>s(`/operations/${f}/events`,{...u,event_seq_start:R,events:[{kind:c,payload:{sequence:R,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,T=await S(P),M=T.status===409?T.json?.expected_event_seq:void 0;if(typeof M==="number"&&M>=0&&M!==g)P=M,T=await S(P);if(T.status<300)t.eventSeq=P+1;return T}}function We(t){return(o,s)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=kn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:a,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof D)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{_e.delete(t)}})()}async function ze(t,o){try{let s=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(s);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function Fe(t){let o=Z&&n.attest==="pending",s=t.vm_hands_attest,a=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,B=Math.max(0,Math.min(ae,Number.isFinite(b)?b:ae));if(!await new Promise((ie)=>{let y=setTimeout(()=>ie(!1),B);n.attestWaiters.push((x)=>{clearTimeout(y),ie(x)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await In(n,P);if(b)r("vm_hands.person_terminals_closed",{count:b});let B=ve(t),j=e.agent.bind(B);if(B.workspace_deferred)S=!0,g=He(u,()=>S);d=await j}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let T=g?await g:-1,M={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete M.environment_installed;let R=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:-1});let F={...M,...R,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},te=Date.now()+yn,U=1,N=await p("hands.ready",F);while(bn(N.status)&&!e.signal.aborted){let b=$e(U);if(Date.now()+b>=te)break;await new Promise((B)=>setTimeout(B,b)),U++,N=await p("hands.ready",F)}if(U>1)r("vm_hands.ready_retried",{attempts:U,status_class:`${Math.floor(N.status/100)}xx`});if(X.delete(t.attempt_id),N.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Be(N.json?.error,"vm_hands_probe_failed")});return}let C={claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:T};n.turns.set(t.attempt_id,C),C.flush=()=>Ie(C),e.onTurn?.(t.attempt_id,We(C)),await Pe(C)}async function He(t,o){let{fence:s,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await q(`/operations/${a}/heartbeat`,{...s,control_ack_seq:f,wait_ms:we});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===ai)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Pe(t){let{fence:o,op:s}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,q(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!p){a="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===bt)try{await Le(t,d.payload??{})}catch(g){if(g instanceof D)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;r("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ve(t,a)}async function ge(t,o){let s=Date.now()+_n;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof D))throw u}if(Date.now()>=s||e.signal.aborted)throw new D("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,s={claim:o,eventSeq:0},a=String(t.capability??""),u=a===un,{complete:f,emit:p,fence:c,op:d}={...O(s,ge)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let y of n.attestWaiters.splice(0))y(!0)}if(n.attest!=="accepted"){let y=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(y)?y:ae));if(!(x>0&&await new Promise((re)=>{let Je=setTimeout(()=>re(!1),x);n.attestWaiters.push((Ye)=>{clearTimeout(Je),re(Ye)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,T=P?Pn(t):null;if(P&&((y)=>y===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(y)||n.bindsStarting.has(y))(T)){await f("failed",{error_code:"vm_hands_bound"});return}if(cn.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let R=new AbortController,F=()=>R.abort();e.signal.addEventListener("abort",F,{once:!0});let te,U=new Promise((y)=>{te=y}),N={abort:R,settled:U},C=P?{...N,session:T}:null;if(C)n.personTerminals.add(C);if(g==="model"&&S&&a!=="preview.serve.v1"){let y=n.modelOps.get(S)??new Set;y.add(N),n.modelOps.set(S,y),await e.agent.environmentInstalled(S,mn,R.signal)}let b=-1,B=!1,j=!1,ie=u?void 0:setInterval(()=>{if(j)return;j=!0,ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:0}).then((y)=>{if(y.status>=300){R.abort();return}let x=y.json?.controls??[];for(let A of x)if(b=Math.max(b,A.seq),A.kind==="operation.cancel"||A.kind==="cancel")R.abort()},()=>R.abort()).finally(()=>{j=!1})},dn);if(u)(async()=>{while(!B&&!R.signal.aborted){let y;try{y=await ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:we})}catch{R.abort();return}if(B)return;if(y.status>=300){R.abort();return}let x=(y.json?.controls??[]).slice().sort((A,re)=>A.seq-re.seq);for(let A of x){if(A.seq<=b)continue;if(A.kind==="operation.cancel"||A.kind==="cancel")R.abort();else await e.controlOp?.({claim:t,control:A}).catch(()=>!1);b=A.seq}}})();try{let y=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:R.signal,emit:async(A)=>{await p(A.kind,A.data??{})}}),x=await f(y.status,{...y.result?{result:y.result}:{},...y.error_code?{error_code:Be(y.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:y.status,acknowledged:x.status<300}),r("vm_hands.op",{capability:a,kind:g,status:y.status,code:y.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(B=!0,clearInterval(ie),e.signal.removeEventListener("abort",F),S)n.modelOps.get(S)?.delete(N);if(C)n.personTerminals.delete(C);te()}}async function Ve(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),de(t);let a=await L(n,e.agent,s).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,s){let a=je(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(ci,{code:a}).catch(()=>{return}),Sn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function ne(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof D)return}n.receipts.shift()}}async function Le(t,o){let{fence:s,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await q(`/operations/${a}/environment`,{...s,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await q(`/operations/${a}/environment-ack`,{...s,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as xn}from"fs";var An=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function On(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-mh0haxhr.js");await m();return}z("parsed",{t0:Math.round(An)});let e="";try{e=xn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-hg3yrdp9.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}On();export{Fi,ln,ji};
+`,_=se(i,`.job.env.${he(8).toString("hex")}`),k=Oe(_,W.O_WRONLY|W.O_CREAT|W.O_EXCL|W.O_NOFOLLOW,384);try{Me(k,m),xe(k)}finally{Ae(k)}return Qe(_,se(i,"job.env")),i}}function fe(e){try{let n=se(e,"job.env"),i=De(n).size,r=Oe(n,W.O_WRONLY|W.O_NOFOLLOW);try{Me(r,Buffer.alloc(i)),xe(r)}finally{Ae(r)}}catch{}Ze(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as sn}from"crypto";var on="/app/local-runtime/session?register=vm_hands_v1",an="/app/local-runtime",Ce=25000,we=20000,dn=1e4,Ue=5000,cn=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),un="preview.serve.v1",_n=60000,ye=75000,mn=2000,gn=1e4,hn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),fn=3,pn=20000,vn=250,wn=2000;function $e(e){let n=Math.min(vn*2**(e-1),wn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function bn(e){return e>=500||e===408||e===429}var ae=20000;function Be(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class D extends Error{}var kn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function je(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Sn(e,n,i,r,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[v,I]of qe.entries()){if(r.aborted)return;if(await new Promise((w)=>{let E=setTimeout(w,I);E.unref?.(),r.addEventListener("abort",()=>{clearTimeout(E),w()},{once:!0})}),r.aborted)return;try{let w=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:v+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let E=je(w);if(h("vm_hands.unbind_unverified",{operation_id:k,code:E,attempt:v+1}),E==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:qe.length})})().finally(()=>_.delete(m))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))])}async function In(e,n){let i=[...e.personTerminals].filter((r)=>r.session===null||r.session===n);for(let r of i)r.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))]);return i.length}function Pn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Tn=1000;async function ji(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},r=e.log??(()=>{}),h=async(k)=>{for(let[v,I]of[...i.turns]){i.turns.delete(v),e.onTurn?.(v,null),de(I);let w=await L(i,e.agent,v).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});r("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let v=await Rn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&hn.has(w.code)&&m<fn&&Date.now()-n<pn)return m++,_=$e(m),r("vm_hands.register_retry",{attempt:m,code:w.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(r("vm_hands.session_closed",{close_code:v.closeCode,reason:v.closeReason.slice(0,120),registered:i.deviceId!==null}),v.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=v.closeReason==="drain_reconnect"?0:v.closeReason==="vm_hands_register_retry"?_:v.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ye-Date.now())):Math.min(500*2**k,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Rn(e,n){let i=n.deviceId,r=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:on,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,v="",I=new Map,w=[],E=null,ce=new Promise((t)=>{_.onclose=(o)=>{k=o.code,v=o.reason;for(let s of I.values())s.reject(new D(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,Tn));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!E?.(o))w.push(o)};let J=(t,o)=>new Promise((s,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){s(w.splice(u,1)[0]);return}let f=setTimeout(()=>{E=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);E=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),E=null,s(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),q=(t,o)=>new Promise((s,a)=>{if(_.readyState!==WebSocket.OPEN){a(new D("session closed"));return}let u=sn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new D(`no answer to ${t.split("/").pop()} in ${f+Ne} ms`)),_.close(4000,"request_timeout")},f+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}s({status:c,json:g})}}),Y({t:"req",id:u,path:`${an}${t}`,body:JSON.stringify(o)})}),be=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",be,{once:!0});let le,X=new Map,Q=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);_.onopen=()=>{clearTimeout(g),r("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(s=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((T)=>T&&T.operation_id===S.claim.operation_id&&T.attempt_id===S.claim.attempt_id)){o.push(S),r("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),de(S);let P=await L(n,e.agent,g).catch((T)=>ee(T,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),ce.then(()=>{throw new l(v==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await q("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=q,ce.then(()=>{if(n.request===q)n.request=null}),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(s,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await Se(g,c),g instanceof D)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ke;try{await ne();for(let c of o)c.flush=()=>Ie(c),c.flush(),p(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await q("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Ce,Ce)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",be);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;_.close(),await ce,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>s?ee(u,s,"vm_hands_bind_lost"):null);if(a&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:a});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:k,closeReason:v};async function Se(t,o){if(t instanceof D){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)ue=!0;for(let a of s){let u=n.turns.get(a);if(n.turns.delete(a),u)de(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=q){let s=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>s(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(R)=>s(`/operations/${f}/events`,{...u,event_seq_start:R,events:[{kind:c,payload:{sequence:R,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,T=await S(P),M=T.status===409?T.json?.expected_event_seq:void 0;if(typeof M==="number"&&M>=0&&M!==g)P=M,T=await S(P);if(T.status<300)t.eventSeq=P+1;return T}}function We(t){return(o,s)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=kn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:a,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof D)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{_e.delete(t)}})()}async function ze(t,o){try{let s=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(s);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function Fe(t){let o=Z&&n.attest==="pending",s=t.vm_hands_attest,a=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,B=Math.max(0,Math.min(ae,Number.isFinite(b)?b:ae));if(!await new Promise((ie)=>{let y=setTimeout(()=>ie(!1),B);n.attestWaiters.push((x)=>{clearTimeout(y),ie(x)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await In(n,P);if(b)r("vm_hands.person_terminals_closed",{count:b});let B=ve(t),j=e.agent.bind(B);if(B.workspace_deferred)S=!0,g=He(u,()=>S);d=await j}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let T=g?await g:-1,M={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete M.environment_installed;let R=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:-1});let F={...M,...R,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},te=Date.now()+yn,U=1,N=await p("hands.ready",F);while(bn(N.status)&&!e.signal.aborted){let b=$e(U);if(Date.now()+b>=te)break;await new Promise((B)=>setTimeout(B,b)),U++,N=await p("hands.ready",F)}if(U>1)r("vm_hands.ready_retried",{attempts:U,status_class:`${Math.floor(N.status/100)}xx`});if(X.delete(t.attempt_id),N.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Be(N.json?.error,"vm_hands_probe_failed")});return}let C={claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:T};n.turns.set(t.attempt_id,C),C.flush=()=>Ie(C),e.onTurn?.(t.attempt_id,We(C)),await Pe(C)}async function He(t,o){let{fence:s,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await q(`/operations/${a}/heartbeat`,{...s,control_ack_seq:f,wait_ms:we});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===ai)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Pe(t){let{fence:o,op:s}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,q(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!p){a="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===bt)try{await Le(t,d.payload??{})}catch(g){if(g instanceof D)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;r("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ve(t,a)}async function ge(t,o){let s=Date.now()+_n;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof D))throw u}if(Date.now()>=s||e.signal.aborted)throw new D("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,s={claim:o,eventSeq:0},a=String(t.capability??""),u=a===un,{complete:f,emit:p,fence:c,op:d}={...O(s,ge)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let y of n.attestWaiters.splice(0))y(!0)}if(n.attest!=="accepted"){let y=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(y)?y:ae));if(!(x>0&&await new Promise((re)=>{let Je=setTimeout(()=>re(!1),x);n.attestWaiters.push((Ye)=>{clearTimeout(Je),re(Ye)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,T=P?Pn(t):null;if(P&&((y)=>y===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(y)||n.bindsStarting.has(y))(T)){await f("failed",{error_code:"vm_hands_bound"});return}if(cn.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let R=new AbortController,F=()=>R.abort();e.signal.addEventListener("abort",F,{once:!0});let te,U=new Promise((y)=>{te=y}),N={abort:R,settled:U},C=P?{...N,session:T}:null;if(C)n.personTerminals.add(C);if(g==="model"&&S&&a!=="preview.serve.v1"){let y=n.modelOps.get(S)??new Set;y.add(N),n.modelOps.set(S,y),await e.agent.environmentInstalled(S,mn,R.signal)}let b=-1,B=!1,j=!1,ie=u?void 0:setInterval(()=>{if(j)return;j=!0,ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:0}).then((y)=>{if(y.status>=300){R.abort();return}let x=y.json?.controls??[];for(let A of x)if(b=Math.max(b,A.seq),A.kind==="operation.cancel"||A.kind==="cancel")R.abort()},()=>R.abort()).finally(()=>{j=!1})},dn);if(u)(async()=>{while(!B&&!R.signal.aborted){let y;try{y=await ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:we})}catch{R.abort();return}if(B)return;if(y.status>=300){R.abort();return}let x=(y.json?.controls??[]).slice().sort((A,re)=>A.seq-re.seq);for(let A of x){if(A.seq<=b)continue;if(A.kind==="operation.cancel"||A.kind==="cancel")R.abort();else await e.controlOp?.({claim:t,control:A}).catch(()=>!1);b=A.seq}}})();try{let y=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:R.signal,emit:async(A)=>{await p(A.kind,A.data??{})}}),x=await f(y.status,{...y.result?{result:y.result}:{},...y.error_code?{error_code:Be(y.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:y.status,acknowledged:x.status<300}),r("vm_hands.op",{capability:a,kind:g,status:y.status,code:y.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(B=!0,clearInterval(ie),e.signal.removeEventListener("abort",F),S)n.modelOps.get(S)?.delete(N);if(C)n.personTerminals.delete(C);te()}}async function Ve(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),de(t);let a=await L(n,e.agent,s).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,s){let a=je(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(ci,{code:a}).catch(()=>{return}),Sn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function ne(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof D)return}n.receipts.shift()}}async function Le(t,o){let{fence:s,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await q(`/operations/${a}/environment`,{...s,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await q(`/operations/${a}/environment-ack`,{...s,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as xn}from"fs";var An=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function On(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-xedpsm42.js");await m();return}z("parsed",{t0:Math.round(An)});let e="";try{e=xn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-j28b11b3.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}On();export{Fi,ln,ji};

package/bin/vm-hands/{vm-hands-executor-seqvbxb7.js → vm-hands-executor-f36kfbpn.js}

@@ -1,5 +1,5 @@
 // @bun
-import"./vm-hands-entry-lite-9wa2y4x0.js";import"./vm-hands-entry-lite-38g65s5x.js";import"./vm-hands-entry-lite-dw558ggz.js";import"./vm-hands-entry-lite-rfz60hb3.js";import{ot,no,vr,Ot}from"./vm-hands-entry-lite-yas2db7h.js";import"./vm-hands-entry-lite-8qhz89mt.js";import"./vm-hands-entry-lite-3gztfxwt.js";import"./vm-hands-entry-lite-1g1v87ky.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-tebh7dcm.js";import"./vm-hands-entry-lite-nqdstx24.js";import"./vm-hands-entry-lite-gc7550c0.js";import"./vm-hands-entry-lite-wrvz9jxy.js";import{ar,cr,kt,Ct}from"./vm-hands-entry-lite-azpzxdzz.js";import"./vm-hands-entry-lite-psywfz8m.js";import"./vm-hands-entry-lite-f69t48dj.js";import"./vm-hands-entry-lite-swrymqj9.js";import"./vm-hands-entry-lite-87vmbt38.js";import{spawn as Ae}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as G,lstatSync as q,mkdirSync as V,mkdtempSync as Te,readdirSync as Z,readFileSync as k,realpathSync as We,rmdirSync as de,rmSync as He,writeFileSync as B}from"fs";import{basename as ze,dirname as Ue,join as d}from"path";import{readFileSync as ie,readlinkSync as ae}from"fs";import{relative as Ie}from"path";var ce=16;function ue(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Ne(e){let r=[];for(let t of e.split(`
+import"./vm-hands-entry-lite-5tbntcyq.js";import"./vm-hands-entry-lite-38g65s5x.js";import"./vm-hands-entry-lite-5gevvgec.js";import"./vm-hands-entry-lite-rfz60hb3.js";import{ot,no,vr,Ot}from"./vm-hands-entry-lite-4zyae165.js";import"./vm-hands-entry-lite-ncbzy69k.js";import"./vm-hands-entry-lite-77j164ps.js";import"./vm-hands-entry-lite-v9qq2cgv.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-tebh7dcm.js";import"./vm-hands-entry-lite-nqdstx24.js";import"./vm-hands-entry-lite-rzr2ncf5.js";import"./vm-hands-entry-lite-wrvz9jxy.js";import{ar,cr,kt,Ct}from"./vm-hands-entry-lite-k8sm0xpa.js";import"./vm-hands-entry-lite-psywfz8m.js";import"./vm-hands-entry-lite-f69t48dj.js";import"./vm-hands-entry-lite-swrymqj9.js";import"./vm-hands-entry-lite-87vmbt38.js";import{spawn as Ae}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as G,lstatSync as q,mkdirSync as V,mkdtempSync as Te,readdirSync as Z,readFileSync as k,realpathSync as We,rmdirSync as de,rmSync as He,writeFileSync as B}from"fs";import{basename as ze,dirname as Ue,join as d}from"path";import{readFileSync as ie,readlinkSync as ae}from"fs";import{relative as Ie}from"path";var ce=16;function ue(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Ne(e){let r=[];for(let t of e.split(`
 `)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:ue(n[3]),mountPoint:ue(n[4])})}return r}function De(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(Ne(m).filter((_)=>c(_.mountPoint)).map((_)=>[`${_.mountPoint}\x00${_.device}\x00${_.root}`,_.mountPoint])),u=o(r),p=o(t),b=(m)=>Ie(n,m)||".",P=[...u].filter(([m])=>!p.has(m)).map(([,m])=>b(m)),x=[...p].filter(([m])=>!u.has(m)).map(([,m])=>b(m));return{missing:P,extra:x,referenceCount:u.size,ownCount:p.size}}function le(e,r,t,n="/proc"){let c,o,u=null;try{c=ie(`${n}/1/mountinfo`,"utf8"),o=ie(`${n}/self/mountinfo`,"utf8")}catch(_){let O=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{u=ae(`${n}/1/ns/mnt`)===ae(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:b,referenceCount:P,ownCount:x}=De(e,c,o),m={reference_count:P,own_count:x,missing_count:p.length,extra_count:b.length,same_namespace:u};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ce)});if(p.length)throw r("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ce)}),t(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var we="/sys/fs/cgroup/reason-payload",M="vm-hands",Be="/run/ara-srt/fallbacks.jsonl",se="/reason-person",Fe="/reason-workload",Ke="surface",ee=5000,je=1e4,pe="__VM_HANDS_PROOF_DIR__",Ge="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,r){super(r);this.code=e}}function Ee(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new w("vm_hands_bind_invalid","bad bind id");return d(e,M,`b-${r.toLowerCase()}`)}var Ve=5000,ve=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Je(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=d(Ue(e),r.toLowerCase());return ze(e).toLowerCase()===r.toLowerCase()?e:t}function gn(e){let r=e.cgroup??we,t=e.init.layout.payload_uid,n=e.init.workload_ended!==!0,c=(s)=>z(s,se)||n&&z(s,Fe),o=e.log??(()=>{}),u=(s)=>Je(e.init.layout.session_root,s),p=new Map,b=new Map,P=0,x=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(P>s.length?0:P).split(`
 `).filter(Boolean);P=s.length;let l=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(l.length)o("vm_hands.srt_server_starts",{count:l.length,elapsed_ms:l.slice(0,8)})}catch{}},m=null,_=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",I=()=>{m??=fe()},R=0,F=()=>{try{let s=k(Be,"utf8"),i=s.slice(R>s.length?0:R);R=s.length;let l=i.split(`
 `).filter(Boolean).slice(0,1000);if(!l.length)return null;let f={},g=0;for(let S of l)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:l.length,codes:f,max_elapsed_ms:g}),{count:l.length,codes:f,max_elapsed_ms:g}}catch{return null}},U=(s,i,l)=>Re(s,i,l),K=(s)=>(i,l,f)=>Ae("/bin/sh",["-c",`echo $$ > ${ve(d(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...l],f),Re=K(d(r,M)),j=d(r,M,"probe"),T=(s)=>Ee(r,s),Ce=(s)=>{let i=T(s);try{V(i,{mode:493})}catch(l){if(!(l&&typeof l==="object"&&("code"in l)&&l.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},Oe=(s)=>{try{de(T(s))}catch{}},W=e.prespawn?no({spawnProcess:U,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;W?.arm();let X=W?setInterval(()=>{W.arm()},Ve):null;X?.unref?.();async function Y(s){let i=p.get(s);if(p.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:T,async startExecutor(s){if(I(),b.set(s.bindId,fe()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await Y(s.bindId);let{claim:i,bindId:l}=s,f=Ce(l),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,N=new Promise((a,v)=>{h=a,y=v}),D,C=new Promise((a)=>{D=a}),H=Ot({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(l,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...W?{takePrespawnedWorker:(a)=>{let v=W.take(a);if(!v?.pid)return v;try{return B(d(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:W.adopt}:{}}).then(()=>{D("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),D(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));p.set(l,{abort:S,done:H,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0});let A=await N,E=A.executor_launch_id;if(typeof E!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:A,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return p.get(s)?.exited??new Promise(()=>{})},freezeBind(s){let i=T(s);if(G(d(i,"cgroup.freeze")))B(d(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){let i=new Set(s?.keep??[]);if(await $e(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&G(d(O,"cgroup.events")))x(),await te(O,Date.now()+ee,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ee;if(G(d(j,"cgroup.events"))){await te(j,s,"probe");try{de(j)}catch{}}let i=oe(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Ze(r,i,s);let l=(g)=>{let S=oe(g);return S!==null&&S<=i},f=he(t).filter((g)=>l(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...me(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,d(r,M)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=ge(m).filter((y)=>y!==process.pid&&!c(y)&&!z(y,"/reason-vm-hands")&&!z(y,S)&&!g.some((N)=>ne(y,N)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:re(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:re(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(I(),!i.includes(pe))throw new w("vm_hands_probe_failed","probe names no proof directory");let l=e.proofParent??"/tmp/reason-vm-hands-proof";V(l,{mode:457,recursive:!0});let f=q(l);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Te(d(l,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Le(g,t,t),Me(g,448);let h=q(g).ino;try{V(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(pe,g).replaceAll(Ge,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),N="";y.stdout?.on("data",(C)=>{if(N.length<16384)N+=C.toString("utf8").slice(0,16384-N.length)});let D=await new Promise((C)=>{let H=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},je);y.once("error",()=>{clearTimeout(H),C(127)}),y.once("close",(A)=>{clearTimeout(H),C(A??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:D}),{exitCode:D,markers:N,proofDirInode:h}}finally{if(!S)He(g,{recursive:!0,force:!0})}},restatLayout(s){let i=u(s),l=i===e.init.layout.session_root?e.init.layout.alias:d(i,"repo"),f="invalid";try{vr(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=q(l);S=h.uid,g=f==="0:0:755"&&l===d(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&We(l)===l&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=u(s);try{le(i,o,(l)=>new w("vm_hands_mount_mismatch",l))}catch(l){if(i!==e.init.layout.session_root&&l instanceof w&&l.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw l}},installEnvironment(s,i){let l=p.get(s);if(!l)throw new w("environment_unavailable","no executor owns an environment");return ot({root:e.root,operationId:l.operationId,payload:i}).installed_revision},async stop(){if(X)clearInterval(X);W?.close(),await Promise.all([...p.keys()].map((s)=>Y(s)))}};function xe(){try{return Z(d(r,M),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function $e(s,i,l=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=qe();try{await nn();let S=Date.now()+ee,h=new Set(xe().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=Y(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(G(d(T(a),"cgroup.events")))await te(T(a),S,"bind");await v}let N=[...f].map((a)=>T(a).replace(/^\/sys\/fs\/cgroup/,"")),D=["/",...[r,d(r,M)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),H=(a)=>c(a)||N.some((v)=>z(a,v))||D.some((v)=>ne(a,v)),A=l?[]:he(t).filter((a)=>!H(a));if(A.length)throw o("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size,...me(A)}),new w("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let E=(a)=>!H(a)&&!z(a,"/reason-vm-hands")&&!z(a,C)&&!D.some((v)=>ne(a,v));if(y!==null){let a=ge(y).filter((v)=>v!==process.pid&&E(v));if(a.length)throw o("vm_hands.kill_strays",{strays:re(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),Oe(a)}finally{g()}}}function oe(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function be(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ze(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=ke(e).filter((o)=>Se(o,e)),c=new Set(n.filter((o)=>{let u=oe(o);return u!==null&&u<=r}));for(let o=!0;o;){o=!1;for(let u of n){if(c.has(u))continue;let p=be(u);if(p!==null&&c.has(p))c.add(u),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,r,t="/proc"){try{return k(d(t,String(e),"cgroup"),"utf8").split(`

package/bin/vm-hands/{vm-hands-op-runner-mh0haxhr.js → vm-hands-op-runner-xedpsm42.js}

@@ -1,2 +1,2 @@
 // @bun
-import{ar,cr,kt,Ct,At,us}from"./vm-hands-entry-lite-azpzxdzz.js";export{ar as VM_HANDS_OP_RUNNER_PERSON_ARG,cr as VM_HANDS_OP_RUNNER_SURFACE_ARG,Ct as VM_HANDS_SURFACE_DIRECTORY_ARG,At as VM_HANDS_SURFACE_OPS,kt as VM_HANDS_SURFACE_UID_ARG,us as runVmHandsOpRunner};
+import{ar,cr,kt,Ct,At,ps}from"./vm-hands-entry-lite-k8sm0xpa.js";export{ar as VM_HANDS_OP_RUNNER_PERSON_ARG,cr as VM_HANDS_OP_RUNNER_SURFACE_ARG,Ct as VM_HANDS_SURFACE_DIRECTORY_ARG,At as VM_HANDS_SURFACE_OPS,kt as VM_HANDS_SURFACE_UID_ARG,ps as runVmHandsOpRunner};