@reason-machines/cli-linux-x64 0.2.401 → 0.2.402

package/bin/vm-hands/{vm-hands-entry-lite-cbkszaqs.js → vm-hands-entry-lite-kaht6v11.js}

@@ -1,5 +1,5 @@
 // @bun
-import{ne as Qz,re as Zz,te as R,we as $z}from"./vm-hands-entry-lite-ajmxhzs9.js";import{ti as zz}from"./vm-hands-entry-lite-923jmcs3.js";import{Ji as e}from"./vm-hands-entry-lite-shm5nhjk.js";import{bj as Hz,pj as V,rj as Jz}from"./vm-hands-entry-lite-h8ykfv9r.js";import{Dk as X}from"./vm-hands-entry-lite-mkynexaq.js";import{spawnSync as C}from"child_process";import{createHash as Iz,randomUUID as Wz}from"crypto";import{chmodSync as bz,existsSync as y,mkdirSync as Sz,readdirSync as wz,readFileSync as L,renameSync as _z,rmSync as Y,statSync as xz,writeFileSync as Rz}from"fs";import{dirname as yz,isAbsolute as Bz,join as N}from"path";import{spawnSync as Oz}from"child_process";import{readFileSync as Cz}from"fs";import{userInfo as v}from"os";import{join as Kz}from"path";var Vz="REASON_SCHEDULED_TASK";function l(H){return Kz(H,"AppData","Local","Reason","Tasks")}function A(H){if(/[\0-\x1f\x7f"%]/.test(H))throw Error(`A background task cannot use a value with a double quote, percent sign or control character: ${H}`);return`'${H.replace(/['\u2018\u2019\u201a\u201b]/g,"$&$&")}'`}function a(H){if(!/^[A-Za-z0-9._-]+$/.test(H))throw Error(`Invalid Windows Scheduled Task name: ${H}`);return`$env:${Vz}=${A(H)};`}function c(H){let z=Object.entries(H.environment).map(([Q,Z])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(Q))throw Error(`Invalid Windows Scheduled Task environment name: ${Q}`);return`$env:${Q}=${A(Z)};`}),J=`$global:LASTEXITCODE=1; & ${[H.program,...H.args].map(A).join(" ")} 2>&1 | ForEach-Object { Add-Content -LiteralPath ${A(H.log)} -Value $_.ToString() -Encoding UTF8 }; $c=$LASTEXITCODE;`;return[a(H.name),...z,"$ErrorActionPreference='Continue';",H.keepAlive?`do { ${J} if ($c) { Start-Sleep -Seconds 10 } } while ($c)`:`${J} exit $c`].join(" ")}function S(H){return H.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function Pz(){let H=process.env.USERDOMAIN?.trim();return H?`${H}\\${v().username}`:v().username}function h(H){let z=S(H.user??Pz()),J=H.schedule==="logon",Q=H.schedule==="logon"?`<LogonTrigger><Enabled>true</Enabled><UserId>${z}</UserId></LogonTrigger>`:`<TimeTrigger><Repetition><Interval>PT${H.schedule.everyMinutes}M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition><StartBoundary>2026-01-01T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger>`,Z=`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "${H.script}"`;return`<?xml version="1.0" encoding="UTF-16"?>
+import{pe as Qz,te as Zz,ve as R,ye as $z}from"./vm-hands-entry-lite-x0x1t6gp.js";import{vi as zz}from"./vm-hands-entry-lite-caxtg4j7.js";import{Li as e}from"./vm-hands-entry-lite-26d4ttdx.js";import{dj as Hz,sj as V,uj as Jz}from"./vm-hands-entry-lite-gp85aqkt.js";import{Gk as X}from"./vm-hands-entry-lite-rbjky7rd.js";import{spawnSync as C}from"child_process";import{createHash as Iz,randomUUID as Wz}from"crypto";import{chmodSync as bz,existsSync as y,mkdirSync as Sz,readdirSync as wz,readFileSync as L,renameSync as _z,rmSync as Y,statSync as xz,writeFileSync as Rz}from"fs";import{dirname as yz,isAbsolute as Bz,join as N}from"path";import{spawnSync as Oz}from"child_process";import{readFileSync as Cz}from"fs";import{userInfo as v}from"os";import{join as Kz}from"path";var Vz="REASON_SCHEDULED_TASK";function l(H){return Kz(H,"AppData","Local","Reason","Tasks")}function A(H){if(/[\0-\x1f\x7f"%]/.test(H))throw Error(`A background task cannot use a value with a double quote, percent sign or control character: ${H}`);return`'${H.replace(/['\u2018\u2019\u201a\u201b]/g,"$&$&")}'`}function a(H){if(!/^[A-Za-z0-9._-]+$/.test(H))throw Error(`Invalid Windows Scheduled Task name: ${H}`);return`$env:${Vz}=${A(H)};`}function c(H){let z=Object.entries(H.environment).map(([Q,Z])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(Q))throw Error(`Invalid Windows Scheduled Task environment name: ${Q}`);return`$env:${Q}=${A(Z)};`}),J=`$global:LASTEXITCODE=1; & ${[H.program,...H.args].map(A).join(" ")} 2>&1 | ForEach-Object { Add-Content -LiteralPath ${A(H.log)} -Value $_.ToString() -Encoding UTF8 }; $c=$LASTEXITCODE;`;return[a(H.name),...z,"$ErrorActionPreference='Continue';",H.keepAlive?`do { ${J} if ($c) { Start-Sleep -Seconds 10 } } while ($c)`:`${J} exit $c`].join(" ")}function S(H){return H.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function Pz(){let H=process.env.USERDOMAIN?.trim();return H?`${H}\\${v().username}`:v().username}function h(H){let z=S(H.user??Pz()),J=H.schedule==="logon",Q=H.schedule==="logon"?`<LogonTrigger><Enabled>true</Enabled><UserId>${z}</UserId></LogonTrigger>`:`<TimeTrigger><Repetition><Interval>PT${H.schedule.everyMinutes}M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition><StartBoundary>2026-01-01T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger>`,Z=`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "${H.script}"`;return`<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
     <Description>${S(H.description)}</Description>
@@ -102,4 +102,4 @@ UMask=0077
 [Install]
 WantedBy=default.target
 `}function Tz(H,z,J,Q){let Z=p(H,z);return h({description:Z.description,schedule:"logon",script:c({name:J.label,program:Q,args:Z.args,environment:{[P]:J.label,...Z.environment},log:J.logs,keepAlive:!0})})}function Lz(H,z,J){z.command("powershell.exe",x(H.label,{tree:J,keepWrapper:!J}))}function K(H,z,J){z.command("schtasks",["/Delete","/F","/TN",H.label]),z.command("powershell.exe",x(H.label,{tree:J,keepWrapper:!1})),Y(H.definition,{force:!0})}function b(H,z){Sz(yz(H),{recursive:!0,mode:448});let J=`${H}.${Wz()}.tmp`;try{Rz(J,z,{mode:384,flag:"wx"}),bz(J,384),_z(J,H)}finally{Y(J,{force:!0})}}function F(H){if(typeof H.uid!=="number"||!Number.isSafeInteger(H.uid)||H.uid<=0)throw new M("Set up a background service as your own user, not with sudo.","worker_service_root_user");return`gui/${H.uid}`}function TH(H){let{config:z,launcher:J,host:Q}=H,Z=H.kind??"serve",B=Dz(z,Q,Z),q=B!==null&&Q.insideService?.(B.label)===!0,$=T(z,Q,Z,q?m:I);if(!$)throw new M(Mz);if(Q.platform==="darwin")F(Q);if(Q.platform==="linux"&&Q.command("systemctl",["--user","show-environment"])!==0)throw new M("No background service here: this computer has no systemd user session.","worker_service_manager_missing");let j=Q.platform==="darwin"?Uz(z,Z,$,J,Q,H.path):null;if(b($.definition,j?j.plist:Q.platform==="win32"?n(Tz(z,Z,$,J)):Nz(z,Z,$,J,Q.home,H.path)),Xz(z,Q,$,q?null:B),j)return j.identity?$:{...$,identityProblem:kz};if(Q.platform==="win32")return $;return{...$,lingering:Q.command("loginctl",["enable-linger"])===0}}function Xz(H,z,J,Q){if(z.platform==="darwin"){let q=F(z);if(Q)z.command("/bin/launchctl",["bootout",`${q}/${Q.label}`]);if(Fz(H,J,z)){if(Q)Y(Q.definition,{force:!0});return}if(Y(J.definition,{force:!0}),Q)z.command("/bin/launchctl",["bootstrap",q,Q.definition]);throw new M("Could not start the background service (launchctl bootstrap failed).","worker_service_start_failed")}if(z.platform==="win32"){if(Q)K(Q,z,!0);if(z.command("schtasks",i(J.label,J.definition))===0){if(Lz(J,z,z.insideService?.(J.label)!==!0),z.command("schtasks",["/Run","/TN",J.label])===0)return}throw K(J,z,!0),new M("Could not start the background service (schtasks failed).")}let Z=`${J.label}.service`,B=Q?`${Q.label}.service`:null;if(z.command("systemctl",["--user","daemon-reload"])!==0||B!==null&&z.command("systemctl",["--user","disable","--now",B])!==0||z.command("systemctl",["--user","enable",Z])!==0||z.command("systemctl",["--user","restart",Z])!==0){if(z.command("systemctl",["--user","disable",Z]),Y(J.definition,{force:!0}),z.command("systemctl",["--user","daemon-reload"]),B)z.command("systemctl",["--user","enable","--now",B]);throw new M("Could not start the background service (systemctl --user failed).","worker_service_start_failed")}if(Q)Y(Q.definition,{force:!0}),z.command("systemctl",["--user","daemon-reload"])}function Fz(H,z,J){let Q=F(J);J.command("/bin/launchctl",["bootout",`${Q}/${z.label}`]);let Z=(Math.ceil(H.shutdownGraceMs/1000)+10)*1000;for(let B=0,q=100;;q=Math.min(q*2,2000)){if(J.command("/bin/launchctl",["bootstrap",Q,z.definition])===0)return!0;if(B>=Z)return!1;J.sleep(q),B+=q}}function LH(H,z,J){let Q=d(H,z,J);if(!Q)return null;let Z=z.insideService?.(Q.label)===!0;if(z.platform==="darwin"&&!Z)dz(Q.definition,z);let B=T(H,z,J);if(B&&Q.label!==B.label&&!Z)return b(B.definition,L(Q.definition,"utf8").replaceAll(Q.label,B.label)),Xz(H,z,B,Q),B;let q=z.platform==="darwin"&&Z,$;if(z.platform==="win32")Lz(Q,z,!Z),$=z.command("schtasks",["/Run","/TN",Q.label])===0;else if(q)$=z.command("/bin/launchctl",["kickstart","-k",`${F(z)}/${Q.label}`])===0;else if(z.platform==="darwin")$=Fz(H,Q,z);else z.command("systemctl",["--user","enable",`${Q.label}.service`]),$=z.command("systemctl",["--user","restart",`${Q.label}.service`])===0;if(!$)throw new M(`Could not restart the background service ${Q.label}.`,"worker_service_restart_failed");if(B&&Q.label===B.label)vz(H,z,J);return Q}function XH(H,z,J,Q){let Z=d(H,J,Q),B=T(z,J,Q);if(J.platform!=="darwin"||!Z||!B)return;let q=`<string>${D(Z.logs)}</string>`,$=L(Z.definition,"utf8");if($.includes(q))b(Z.definition,$.replaceAll(q,`<string>${D(B.logs)}</string>`))}function FH(H,z,J="serve"){let Q=Yz(H,z,J);for(let Z of Q){if(z.platform==="win32"){K(Z,z,z.insideService?.(Z.label,!1)!==!0);continue}if(z.platform==="darwin"){if(typeof z.uid==="number"&&z.uid>0)z.command("/bin/launchctl",["bootout",`gui/${z.uid}/${Z.label}`]);Y(Z.definition,{force:!0});continue}z.command("systemctl",["--user","disable","--now",`${Z.label}.service`]),Y(Z.definition,{force:!0}),z.command("systemctl",["--user","daemon-reload"])}return Q[0]??null}
-export{l as Pd,P as Qd,kz as Rd,qH as Sd,M as Td,jH as Ud,GH as Vd,MH as Wd,Gz as Xd,YH as Yd,DH as Zd,d as _d,vz as $d,UH as ae,NH as be,TH as ce,LH as de,XH as ee,FH as fe};
+export{l as Rd,P as Sd,kz as Td,qH as Ud,M as Vd,jH as Wd,GH as Xd,MH as Yd,Gz as Zd,YH as _d,DH as $d,d as ae,vz as be,UH as ce,NH as de,TH as ee,LH as fe,XH as ge,FH as he};

package/bin/vm-hands/{vm-hands-entry-lite-0kzefw0a.js → vm-hands-entry-lite-kntkyezs.js}

@@ -1,4 +1,4 @@
 // @bun
-import{sj as J}from"./vm-hands-entry-lite-ecgyzbdp.js";import{readFileSync as L}from"fs";import{isAbsolute as M,normalize as Q}from"path";var W="REASON_WORKER_DESKTOP_USER",G=null;function X(q,B){for(let I of B.split(`
+import{vj as J}from"./vm-hands-entry-lite-wsnr4fx8.js";import{readFileSync as L}from"fs";import{isAbsolute as M,normalize as Q}from"path";var W="REASON_WORKER_DESKTOP_USER",G=null;function X(q,B){for(let I of B.split(`
 `)){let j=I.split(":");if(j.length<7||Number(j[2])!==q||!/^\d+$/.test(j[2])||!/^\d+$/.test(j[3]))continue;let x=j[5];if(!/^[a-z_][a-z0-9_-]*$/i.test(j[0])||!M(x)||Q(x)!==x||x==="/")return null;return{username:j[0],uid:q,gid:Number(j[3]),home:x}}return null}function b(q={}){let B="value"in q?q.value:process.env[W];if(G=null,B===void 0||B==="")return null;let I=q.platform??process.platform,j="euid"in q?q.euid:process.geteuid?.(),x=/^[1-9]\d{0,9}$/.test(B)?Number(B):NaN,C=I==="linux"&&j===0&&Number.isSafeInteger(x)?X(x,(q.passwd??(()=>L("/etc/passwd","utf8")))()):null;if(!C||C.gid===0)throw Error("worker_desktop_user_invalid");return G=C,C}function k(){return G}function y(){return G?.home??J()}
-export{W as Vg,X as Wg,b as Xg,k as Yg,y as Zg};
+export{W as Xg,X as Yg,b as Zg,k as _g,y as $g};

package/bin/vm-hands/{vm-hands-entry-lite-8bqyx62p.js → vm-hands-entry-lite-m7vam0j2.js}

@@ -1,5 +1,5 @@
 // @bun
-import{r as m0}from"./vm-hands-entry-lite-bw28d85m.js";import{v as $2,x as n6,y as t9}from"./vm-hands-entry-lite-4yw77epm.js";import{A as K2,B as i6,C as V4,D as G4,E as R6,F as v0,J as P6,K as I$}from"./vm-hands-entry-lite-n71rv7kv.js";import{V as a2,oa as Z$,ra as s1,ta as RJ}from"./vm-hands-entry-lite-qmjrfhkv.js";import{Ba as $J,Ca as JJ,Da as V8,Ea as G8,Fa as mJ,Ga as gJ,Ha as A9,Ia as Z5,Ja as U8,Ka as L0,La as S1,Ma as b1,Na as I0,Oa as c1,Pa as X5,Qa as R5,Ra as l3,Sa as N5,Wa as H5,db as pJ,eb as lJ,fb as cJ,gb as sJ,hb as P9}from"./vm-hands-entry-lite-80jthkkx.js";import{$b as K0,Eb as g8,Fb as u8,Gb as B8,Hb as K8,Ib as wJ,Jb as yJ,Lb as j8,Mb as hJ,Nb as L1,Qb as Q3,Rb as X3,Sb as p6,Tb as l6,Ub as c6,Vb as b0,Wb as $0,Xb as g,Yb as R9,Zb as z1,_b as e1,ac as fJ,fc as W5,hc as f4,jb as U6,kc as b2,mb as P8,mc as J5,nb as C8,nc as J9,pc as d8,qb as o8,rb as I8,ub as _8,vc as vJ,wb as k8,wc as t3,zb as h8}from"./vm-hands-entry-lite-qmtk8vgg.js";import{Ac as h1,Bc as s6,Ec as N8,xc as m9,yc as g9,zc as Q5}from"./vm-hands-entry-lite-qwxmr70t.js";import{Lc as $5}from"./vm-hands-entry-lite-fkkmhfjc.js";import{Rc as f8,Sc as v8,Zc as m8}from"./vm-hands-entry-lite-xz9w76j7.js";import{_c as L$}from"./vm-hands-entry-lite-rtt2w6c6.js";import{$c as u,ad as o,bd as s,cd as c}from"./vm-hands-entry-lite-39wk67c3.js";import{ud as Y8}from"./vm-hands-entry-lite-saemagkr.js";import{Fd as V5,Id as uJ,Ld as ZJ,Md as QJ}from"./vm-hands-entry-lite-m2y0x4v3.js";import{$d as o6,Pd as OJ,Qd as s$,Sd as V$,Td as E$,Ud as T1,Wd as C6,Xd as r6,Yd as t6,_d as F1,ae as u9,be as e6,ce as e2,de as G$,ee as x4,fe as $3}from"./vm-hands-entry-lite-cbkszaqs.js";import{Ef as D6,Ff as e$,Le as W2,Pe as SJ,Pf as G2,Qe as bJ,wf as X8}from"./vm-hands-entry-lite-09yt840b.js";import{ag as a6,bg as l2,eg as dJ,hg as v1,jg as F7,kg as _7,pg as U5}from"./vm-hands-entry-lite-psw2ymp5.js";import{tg as p8}from"./vm-hands-entry-lite-fgdtrsf4.js";import{Eg as V0,Fg as Y2,Gg as nJ,Hg as rJ,Ig as o$,Jg as F3,Kg as I2,Lg as L4,Ng as E2,Og as k$,Pg as h0,Qg as $1,Rg as x2,Ug as h$}from"./vm-hands-entry-lite-ht482g94.js";import{Xg as a1,Yg as e8}from"./vm-hands-entry-lite-0kzefw0a.js";import{ch as y8}from"./vm-hands-entry-lite-k90ysszf.js";import{Ai as g6,Bi as u6,Di as _2,Ei as d6,Fi as W9,Gi as I4,Hi as E4,Ii as J1,ti as Y$,xi as R$,yi as C0,zi as $4}from"./vm-hands-entry-lite-923jmcs3.js";import{Ji as l1,Ki as C1}from"./vm-hands-entry-lite-shm5nhjk.js";import{fj as k6,nj as Y5,oj as O9,qj as H8}from"./vm-hands-entry-lite-h8ykfv9r.js";import{sj as U0,uj as WJ}from"./vm-hands-entry-lite-ecgyzbdp.js";import{Sj as r}from"./vm-hands-entry-lite-shsqhwgs.js";import{pk as K}from"./vm-hands-entry-lite-18kfytsa.js";import{sk as kJ}from"./vm-hands-entry-lite-mrw8bv5s.js";import{Dk as DJ,Ek as z8,Fk as A8,Gk as R8,xk as t8,zk as V1}from"./vm-hands-entry-lite-mkynexaq.js";import{Mk as f0}from"./vm-hands-entry-lite-hkvkfq0z.js";import{Sk as WG}from"./vm-hands-entry-lite-4yw8vx5h.js";import{spawn as $7,spawnSync as OG}from"child_process";import{closeSync as J7,existsSync as zG,mkdirSync as AG,openSync as Z7,readdirSync as RG,realpathSync as B$,rmSync as j1}from"fs";import{hostname as PG}from"os";import{dirname as d9,join as T0,resolve as CG}from"path";import{createHash as D7}from"crypto";import{unlinkSync as W7}from"fs";import{platform as O7}from"os";import{join as z7}from"path";var o9=K.discriminatedUnion("store",[K.strictObject({version:K.literal(1),store:K.literal("keychain")}),K.strictObject({version:K.literal(1),store:K.literal("file"),api_key:K.string().min(1).max(4096)})]),y$=($)=>z7($,"api-key.json");function W$($){let J=D7("sha256").update(`reason-connect-api-key
+import{r as m0}from"./vm-hands-entry-lite-bk5acpe9.js";import{v as $2,x as n6,y as t9}from"./vm-hands-entry-lite-yz6a02cp.js";import{A as K2,B as i6,C as V4,D as G4,E as R6,F as v0,J as P6,K as I$}from"./vm-hands-entry-lite-2k459na8.js";import{X as a2,qa as Z$,ta as s1,va as RJ}from"./vm-hands-entry-lite-x914078k.js";import{Da as $J,Ea as JJ,Fa as V8,Ga as G8,Ha as mJ,Ia as gJ,Ja as A9,Ka as Z5,La as U8,Ma as L0,Na as S1,Oa as b1,Pa as I0,Qa as c1,Ra as X5,Sa as R5,Ta as l3,Ua as N5,Ya as H5,fb as pJ,gb as lJ,hb as cJ,ib as sJ,jb as P9}from"./vm-hands-entry-lite-cwd9y2pv.js";import{$b as z1,Bb as h8,Gb as g8,Hb as u8,Ib as B8,Jb as K8,Kb as wJ,Lb as yJ,Nb as j8,Ob as hJ,Pb as L1,Sb as Q3,Tb as X3,Ub as p6,Vb as l6,Wb as c6,Xb as b0,Yb as $0,Zb as g,_b as R9,ac as e1,bc as K0,cc as fJ,hc as W5,jc as f4,lb as U6,mc as b2,ob as P8,oc as J5,pb as C8,pc as J9,rc as d8,sb as o8,tb as I8,wb as _8,xc as vJ,yb as k8,yc as t3}from"./vm-hands-entry-lite-2grs67fz.js";import{Ac as g9,Bc as Q5,Cc as h1,Dc as s6,Gc as N8,zc as m9}from"./vm-hands-entry-lite-heehk76b.js";import{Nc as $5}from"./vm-hands-entry-lite-400hmvkg.js";import{$c as m8,Tc as f8,Uc as v8}from"./vm-hands-entry-lite-k9amte6k.js";import{ad as L$}from"./vm-hands-entry-lite-swwb5mp2.js";import{bd as u,cd as o,dd as s,ed as c}from"./vm-hands-entry-lite-wts79wdn.js";import{wd as Y8}from"./vm-hands-entry-lite-xaaxvbk8.js";import{Hd as V5,Kd as uJ,Nd as ZJ,Od as QJ}from"./vm-hands-entry-lite-mwj7bnse.js";import{Rd as OJ,Sd as s$,Ud as V$,Vd as E$,Wd as T1,Yd as C6,Zd as r6,_d as t6,ae as F1,be as o6,ce as u9,de as e6,ee as e2,fe as G$,ge as x4,he as $3}from"./vm-hands-entry-lite-kaht6v11.js";import{Gf as D6,Hf as e$,Ne as W2,Re as SJ,Rf as G2,Se as bJ,yf as X8}from"./vm-hands-entry-lite-afjzr3v2.js";import{cg as a6,dg as l2,gg as dJ,jg as v1,lg as F7,mg as _7,rg as U5}from"./vm-hands-entry-lite-0badx5n8.js";import{vg as p8}from"./vm-hands-entry-lite-2yt333v3.js";import{Gg as V0,Hg as Y2,Ig as nJ,Jg as rJ,Kg as o$,Lg as F3,Mg as I2,Ng as L4,Pg as E2,Qg as k$,Rg as h0,Sg as $1,Tg as x2,Wg as h$}from"./vm-hands-entry-lite-wtc8ebkr.js";import{Zg as a1,_g as e8}from"./vm-hands-entry-lite-kntkyezs.js";import{eh as y8}from"./vm-hands-entry-lite-0dr3sp75.js";import{Ai as C0,Bi as $4,Ci as g6,Di as u6,Fi as _2,Gi as d6,Hi as W9,Ii as I4,Ji as E4,Ki as J1,vi as Y$,zi as R$}from"./vm-hands-entry-lite-caxtg4j7.js";import{Li as l1,Mi as C1}from"./vm-hands-entry-lite-26d4ttdx.js";import{ij as k6,qj as Y5,rj as O9,tj as H8}from"./vm-hands-entry-lite-gp85aqkt.js";import{vj as U0,xj as WJ}from"./vm-hands-entry-lite-wsnr4fx8.js";import{Vj as r}from"./vm-hands-entry-lite-gbf8h13w.js";import{sk as K}from"./vm-hands-entry-lite-ysk49bnz.js";import{vk as kJ}from"./vm-hands-entry-lite-dj65hfea.js";import{Ak as t8,Ck as V1,Gk as DJ,Hk as z8,Ik as A8,Jk as R8}from"./vm-hands-entry-lite-rbjky7rd.js";import{Pk as f0}from"./vm-hands-entry-lite-f28ehysx.js";import{Vk as WG}from"./vm-hands-entry-lite-c3e25cks.js";import{spawn as $7,spawnSync as OG}from"child_process";import{closeSync as J7,existsSync as zG,mkdirSync as AG,openSync as Z7,readdirSync as RG,realpathSync as B$,rmSync as j1}from"fs";import{hostname as PG}from"os";import{dirname as d9,join as T0,resolve as CG}from"path";import{createHash as D7}from"crypto";import{unlinkSync as W7}from"fs";import{platform as O7}from"os";import{join as z7}from"path";var o9=K.discriminatedUnion("store",[K.strictObject({version:K.literal(1),store:K.literal("keychain")}),K.strictObject({version:K.literal(1),store:K.literal("file"),api_key:K.string().min(1).max(4096)})]),y$=($)=>z7($,"api-key.json");function W$($){let J=D7("sha256").update(`reason-connect-api-key
 ${$}`).digest("hex");return new o$(Y2(),O7(),J)}function L3($,J,Z=W$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(y$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof V0))throw Q}c(y$($),{version:1,store:"file",api_key:J})}function p0($,J=W$($)){if(!u(y$($)))return null;let Z=o9.parse(JSON.parse(s(y$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof V0))throw Q;throw Error("worker_api_key_unreadable")}}function e9($,J=W$($)){if(!u(y$($)))return;if(o9.parse(JSON.parse(s(y$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof V0))throw Z}W7(y$($))}async function T3($,J){let Z;try{Z=await t9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:b0($.proxy)})}catch(Q){if(Q instanceof v0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as d7,renameSync as p7,rmSync as f$}from"fs";import{join as N0}from"path";import{createHash as A7}from"crypto";import{realpathSync as R7,statSync as P7,unlinkSync as V2}from"fs";import{platform as C7}from"os";import{join as w0}from"path";function d($){return{state:w0(g($),"device.json"),control:w0(g($),"control.json"),lock:w0(g($),"lifecycle.lock"),socket:w0(g($),"control.sock"),daemon:w0(g($),"daemon.json"),releaseCheck:w0(g($),"release-check.json"),updateDeferral:w0(g($),"update-deferral.json"),firstHeartbeat:w0(g($),"first-heartbeat.json")}}var I7=K.object({version:K.literal(1),device_id:K.string().min(1).max(160),offer:K.unknown().optional(),enrollment_ms:K.number().int().nonnegative().max(e$).optional()});function J4($,J,Z){o(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function _3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=I7.safeParse(JSON.parse(s(Z)));if(V2(Z),!Q.success||Q.data.device_id!==J)return null;let X=G2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function M0($,J=!1){o(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=w0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?j3($):new F3(g($))}function B2($,J){M0($,!0),S7($);let Z=J??j3($),Q=new F3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof V0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function j3($){return new o$(Y2(),C7(),E7($))}function E7($){let J=D3($);return A7("sha256").update(`reason-worker
 ${J?.directory??g($)}`).digest("hex")}function A1($,J){c(w0(g($),R1),{version:1,directory:D3($)?.directory??g($),devicePublicKey:J})}var R1="keychain-scope.json";function Z4($){return u(w0(g($),R1))}var x7=K.strictObject({version:K.literal(1),directory:K.string().min(1),devicePublicKey:K.string().min(1)});function D3($){let J=w0(g($),R1);if(!u(J))return null;let Z=x7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function S7($){let J=w0(g($),R1);if(!u(J))return;if(D3($))try{let Z=j3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof V0))throw Z}V2(J)}function H$($){let J=R7($.workspaceRoot);if(J!==$.workspaceRoot||!P7(J).isDirectory()||!z1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=k$(d($).state,{proofStore:M0($),repair:!1}),Z=J!==null&&$4($.apiOrigin,J.apiOrigin),Q=Z?[K0($),K0({...$,apiOrigin:J.apiOrigin})]:[K0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var Q4=K.strictObject({version:K.literal(1),drained:K.boolean(),revoked:K.boolean()});function e($){let J=d($).control;return u(J)?Q4.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function P0($,J){c(d($).control,Q4.parse(J))}function y0($){let J=M0($);J.deleteBinding(),J.deleteKey();let Z=w0(g($),R1);if(u(Z))V2(Z);let Q=d($).state;if(u(Q))V2(Q)}var b7=K.strictObject({read:K.boolean(),write:K.boolean(),execute:K.boolean(),discover_environment:K.boolean(),expose_mcp:K.literal(!1)}),W3=K.strictObject({version:K.literal(1),organization_id:K.string().min(1).max(160),enrollment_ticket:K.string().min(1).max(4096),code_verifier:K.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/),root:K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/),permissions:b7,execution_mode:K.enum(["confined","host"]).default("confined")}),folders:K.array(K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),w7=K.object({device_id:K.string().min(1).max(160),organization_id:K.string().min(1).max(160),auth_scheme:K.literal("p256"),protocol_version:K.literal(2),roots:K.array(K.object({id:K.string().min(1),label:K.string(),path_fingerprint:K.string()})).min(1).max(32),headless:K.object({lifecycle:K.enum(["persistent","ephemeral"]),expires_at:K.iso.datetime({offset:!0})}),first_heartbeat:K.unknown().optional()}),O3=30000;class $$ extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function y7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(O3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new $$(X?.error==="device_revoked")}return Q.json()}async function z3($,J,Z,Q){m0();let X=W3.parse(JSON.parse(s(J)));return J$($,X,Z,Q)}async function J$($,J,Z,Q=(Y,V)=>y7(Y,V,b0($.proxy)),X=performance.now()){let Y=Y4($,J,Z),V=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(V,X)}async function X4($,J,Z,Q,X=performance.now()){let Y=Y4($,J,Z),V=await Q(Y.request,J.code_verifier);return V===null?null:Y.receipt(V,X)}function Y4($,J,Z){if(m0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=h$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((G,H)=>{let M=h$([G],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(M.path!==G||M.pathFingerprint!==J.folders?.[H]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return M});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],V;try{V=Z.loadPublicKey()}catch{V=Z.createFreshPublicKey()}return{request:{device_public_key:V,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((G)=>({label:G.label,path_fingerprint:G.pathFingerprint,permissions:J.root.permissions}))},receipt(G,H){let M=w7.parse(G);if(M.organization_id!==J.organization_id||M.roots.length!==Y.length||M.roots.some((B,q)=>B.path_fingerprint!==Y[q].pathFingerprint)||M.headless.lifecycle!==$.lifetime||Date.parse(M.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let U=G2(M.first_heartbeat);try{J4($,M.device_id,{...U?{offer:U}:{},enrollmentMs:Math.min(e$,Math.max(0,Math.round(performance.now()-H)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:M.organization_id,deviceId:M.device_id,devicePublicKey:V,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:K0($),lifetime:$.lifetime,expiresAt:M.headless.expires_at},roots:M.roots.map((B,q)=>({id:B.id,label:B.label,path:Y[q].path,pathFingerprint:B.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as k7,randomUUID as h7}from"crypto";import{unlinkSync as f7}from"fs";import{join as v7}from"path";var B4=K.strictObject({version:K.literal(1),install_id:K.uuid(),fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/)}),m7=K.object({enrollment_ticket:K.string().min(1).max(4096),expires_at:K.iso.datetime({offset:!0}),device_kind:K.literal("headless"),lifecycle:K.enum(["persistent","ephemeral"]),device_expires_at:K.iso.datetime({offset:!0})});function A3($){return m7.parse($)}var g7=K.object({credentialKind:K.enum(["oauth","api_key"]).optional(),apiOrigin:K.url(),clientId:K.string(),accessToken:K.string().min(1).max(32768),refreshToken:K.string().max(32768),expiresAt:K.iso.datetime({offset:!0}),scopes:K.array(K.string().max(128)).max(128),orgId:K.string().min(1).max(160)});function O$($){return K2(C1("REASON_CLI_CHANNEL",$.channel),U0())}async function z$($,J=O$($)){if(!u(J))return null;let Z=g7.parse(JSON.parse(s(J)));if(!C0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=b0($.proxy),X=Object.assign((V,N)=>Q(V,{...N,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await G4({path:J,fetchImpl:X});if(Y&&!C0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function K4($,J,Z){if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=A$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function U4($,J,Z,Q,X){let Y=performance.now();if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=A$($),N=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(N){let G=await X4($,V.direct(J.orgId),Q,(H,M)=>N({approval:V.request,code_verifier:M,registration:H}).catch((U)=>{throw u7(U)}),Y);if(G)return G}return J$($,V.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(V.request)),Q,X,Y)}function u7($){if(!($ instanceof v0))return $;if($.status===409)return new $$($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new $$(!1);return $}var P1=($)=>v7(g($),"enrollment-install.json");function N4($){if(u(P1($)))f7(P1($))}function A$($,{stored:J=!0}={}){m0();let Z=P1($),Q=J&&u(Z)?B4.parse(JSON.parse(s(Z))):{version:1,install_id:h7(),fingerprint_key:k7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),V=h$([$.workspaceRoot],X,Y)[0];if(V.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let N=($.folders??[]).map((U)=>{let B=h$([U],X,Y)[0];if(B.path!==U)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:B.pathFingerprint}}),G=V4(),H={install_id:Q.install_id,code_challenge:G.challenge,lifecycle:$.lifetime,roots:[V.pathFingerprint,...N.map((U)=>U.path_fingerprint)].map((U)=>({path_fingerprint:U,permissions:X,execution_mode:$.executionMode}))},M=(U)=>({version:1,organization_id:U,code_verifier:G.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:V.pathFingerprint,permissions:X,execution_mode:$.executionMode},...N.length?{folders:N}:{}});return{request:H,saveInstall(U){o(g(U),!0),c(P1(U),Q)},complete(U,B){let q=A3(B);if(q.lifecycle!==$.lifetime||Date.parse(q.expires_at)<=Date.now()||Date.parse(q.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...M(U),enrollment_ticket:q.enrollment_ticket}},direct:M}}function H4($,J,Z){let Q=P1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=B4.parse(JSON.parse(s(Q)));return h$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var U2=8,T4=600000,F4=15000,q4=new Set(["device_revoked","invalid_device_credential"]),N2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,q$=($)=>N0(g($),"workspaces"),_4="account.json",R3=($)=>u(N0($,_4));function k0($){let J;try{J=d7(q$($))}catch{return[]}return J.filter((Z)=>N2.test(Z)).sort().map((Z)=>{let Q=N0(q$($),Z),X=N0(Q,"worker.json"),Y=null;try{let V=$0.safeParse(JSON.parse(s(X)));if(V.success&&V.data.stateDirectory===Q)Y=V.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:R3(Q)}})}function H2($,J){let Z=J.toLowerCase();if(!N2.test(Z))throw Error("worker_workspace_id_invalid");let Q=$0.parse({...$,stateDirectory:N0(q$($),Z)});return o(Q.stateDirectory,!0),c(N0(Q.stateDirectory,_4),{version:1}),{config:Q,configPath:N0(Q.stateDirectory,"worker.json")}}function q2($,J){try{let{config:Z,configPath:Q}=H2($,J);o(g(Z),!0),P0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function I1($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||k0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var P3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function M4($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");A1($,Z.devicePublicKey),o(g(J),!0);for(let Y of P3)f$(N0(g(J),Y),{force:!0});for(let Y of P3){let V=N0(g($),Y);if(u(V))p7(V,N0(g(J),Y))}let Q=M0(J),X=k$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");h0({...X,worker:{...X.worker,configDigest:K0(J)}},d(J).state,{proofStore:Q})}function C3($){for(let J of k0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))y0(J.config)}catch{}f$(J.directory,{recursive:!0,force:!0})}f$(E3($),{force:!0})}function M2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(U)=>Number(Date.parse(U.worker?.expiresAt??"")>X+60000),N=k0($).flatMap((U)=>{if(!U.account||!U.config)return[];try{if(e(U.config).revoked)return[];let B=t(U.config);return B&&B.orgId.toLowerCase()===U.organizationId&&(!Q||Y(B))?[{...U,config:U.config,state:B}]:[]}catch{return[]}}).sort((U,B)=>Number(B.organizationId===J)-Number(U.organizationId===J)||Y(B.state)-Y(U.state))[0];if(!N)return null;let G=null;try{G=e($).revoked?null:t($)}catch{}let H=G?.orgId.toLowerCase()??"";if(Z&&G&&N2.test(H)&&H!==N.organizationId){let U=H2($,H);M4($,U.config),c(U.configPath,U.config)}else if(u(g($))){try{if(u(d($).state))y0($)}catch{}for(let U of P3)f$(N0(g($),U),{force:!0})}C3($);let M=$0.parse({...N.config,stateDirectory:$.stateDirectory});return M4(N.config,M),c(N0($.stateDirectory,"worker.json"),M),f$(N.directory,{recursive:!0,force:!0}),M}var I3={before($){for(let{config:J}of k0($))try{let Z=J?t(J):null;if(J&&Z)A1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of k0(J)){if(Y)continue;try{let V=$0.parse(JSON.parse(s(X)));if(V.stateDirectory!==N0(q$($),Z))continue;let N=$0.parse({...V,stateDirectory:Q}),G=M0(N),H=k$(d(N).state,{proofStore:G,repair:!1});if(H?.worker?.configDigest===K0(V))h0({...H,worker:{...H.worker,configDigest:K0(N)}},d(N).state,{proofStore:G});c(X,N)}catch{}}}},E3=($)=>N0(q$($),"listed.json");function j4($){try{let J=JSON.parse(s(E3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function D4($,J){let Z=k0($),Q=Z.filter((G)=>G.account),X=Z.filter((G)=>!G.account),Y=j4($),V=Y&&!Y.listed?Y.reason:null,N=V||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&N.length===0&&(V||Y&&!Y.listed))return{workspaces:null,off:V};return{off:V,workspaces:[...Q,...N].map(({organizationId:G,config:H,account:M})=>{let U=!1,B=null,q=!1,L=null;try{U=H?e(H).revoked:!1,B=H&&!U?t(H):null;let T=H?$1(d(H).daemon):null;q=J&&!!B&&T?.state==="connected",L=q?L4(T,B):null}catch{}return{...L?{permission_recovery:L}:{},organization_id:G,device_id:B?.deviceId??null,name:Y?.names?.[G]??null,root:B?.roots[0]?{id:B.roots[0].id,permissions:B.roots[0].permissions}:null,state:U?"removed":q?"connected":"not_running",blocked:!M&&!U&&!q&&(Y?.blocked.includes(G)??!1),...M?{account:!0}:{}}})}}function W4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),V=new Map,N=null,G=!1,H=j4(J)??{listed:!1,reason:null,blocked:[]},M=(j)=>{let{folders:D,...R}=J,I=Z.roots.slice(1).map((P)=>P.path);return $0.parse({...R,...I.length?{folders:I}:{},stateDirectory:N0(q$(J),j)})},U=async(j)=>{let D=V.get(j);if(!D)return;D.controller.abort(),await D.done},B=(j,D=!1)=>{let R=new AbortController,I=()=>R.abort();if(X.addEventListener("abort",I,{once:!0}),X.aborted)R.abort();let P={...j,controller:R,claims:0,done:Promise.resolve(),account:D};P.done=$.serve(j,R.signal,(C)=>{P.claims=C}).then(()=>{return},(C)=>{if(D&&C instanceof L0&&C.status===401&&q4.has(C.code)){try{P0(j.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${j.organizationId} (another account's) no longer accepts this computer (${C.code}); run \`reason connect\` signed in as that account to connect it again
 `)}else if(C instanceof L0&&C.status===401&&q4.has(C.code)){try{y0(j.config)}catch{}Y(`Reason worker: workspace ${j.organizationId} no longer accepts this computer
@@ -313,7 +313,7 @@ Usage:
 `),host:Z.host}),N=A4({...V,log:(q)=>Q.stderr.write(`${q}
 `)}),{configPath:G}=N,H=N.saved;if(!H)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let M=(q,L)=>{let T=K3(Z.home,Z.channel),_;try{let O=null;try{O=L.keep?null:t(H)?.orgId.toLowerCase()??null}catch{}if(_=M2(H,{prefer:J2(Z.home,Z.channel,H),...L}),_&&O)q2(_,O)}finally{T()}if(!_)return!1;H=_;let W="";try{W=` (workspace ${t(_)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${q}; this computer goes on running Sessions for its other Reason account${W}.
 `),!0};if(e(H).revoked&&!M("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(H.executionMode==="confined"||!_1(H)){let q=p0(H.stateDirectory)??void 0,L=q?null:J2(Z.home,Z.channel,H);if(!q&&!(L&&I1(H,L)))M("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let U=H.executionMode==="confined";if(U||!_1(H)){let q=p0(H.stateDirectory)??void 0;if(Q.stderr.write(U?V7:`Reason: this computer's connection expired; renewing it with ${q?"its API key":"your login"}\u2026
-`),await p9($0.parse({...H,executionMode:"host"}),G,Q,X,q)!==0)return Q.stderr.write(q?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let B=new AbortController;if(!X.runWorker)import("./ask-relay-f46eb3zs.js").then(({runBackgroundAskRelay:q})=>q(B.signal,(L)=>Q.stderr.write(`${L}
+`),await p9($0.parse({...H,executionMode:"host"}),G,Q,X,q)!==0)return Q.stderr.write(q?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let B=new AbortController;if(!X.runWorker)import("./ask-relay-zc05zxz4.js").then(({runBackgroundAskRelay:q})=>q(B.signal,(L)=>Q.stderr.write(`${L}
 `))).catch(()=>{});try{for(;;){let q=p0(H.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},L=X.runWorker?null:t2({stateDirectory:H.stateDirectory}),T=!1,_;try{_=await(X.runWorker??T$)(["start","--config",G],{deferOptionalLanes:!0,...X.worker,...q,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{L?.stop()}if(!T)return _;if(!M("this computer's connection was removed from Reason",{keep:!1}))break}return V3(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{B.abort()}}async function kG($,J,Z){let{io:Q,options:X,home:Y,channel:V,environment:N}=Z;if(J&&await(X.controlWorker??B0)(J,"status").catch(()=>null))throw new l("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let G=g0(Y,V,!0),H=B7({parsed:$,saved:J,stateDirectory:G,lifetime:"ephemeral",home:Y,channel:V,options:X,environment:N}),M=K7(H,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),U=T0(G,"worker.json");return o(G,!0),c(U,M),Q.stdout.write(f9(`Reason: connecting "${M.name}" while this command runs`,M,Z.host.platform,["Connecting\u2026"])),(X.runWorker??T$)(["start","--config",U],{...l9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:Z3(Q.stderr)},onStartup:(B)=>{if(B==="ready")Q.stdout.write(`Connected. Start Sessions on "${M.name}" from Reason. Press Ctrl-C to stop.
 `);X.worker?.onStartup?.(B)}})}function hG($,J,Z,Q){if(Z.platform!=="darwin")throw new l("--keep-awake is for macOS.");if(!J)throw new l("This computer is not connected to Reason. Run reason connect first.");o(g(J),!0),h4(d(J).daemon,$);let X=j2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
 `),0}var fG=K.object({root:K.object({id:K.string().min(1).max(160),label:K.string().max(160),path_fingerprint:K.string()})});async function U7($,J,Z,Q){let X=await(l9(Q.worker,Z).enrollmentCredentials??z$)($,O$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new I$(X,{credentialsPath:O$($),fetchImpl:b0($.proxy)}),V=(N)=>N instanceof v0&&N.status===404&&!["device_not_found","root_not_found"].includes(N.code);return{add:async(N)=>{let G=H4($,N,{...J.roots[0].permissions,expose_mcp:!1}),H=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:G.pathFingerprint,label:G.label,permissions:{...G.permissions,expose_mcp:!1}}).catch((U)=>{if(V(U))throw Error("worker_folders_unavailable");if(U instanceof v0&&U.code==="root_limit_reached")throw new l("This computer already has the most folders Reason allows (32).");throw U}),M=fG.parse(H).root;if(M.path_fingerprint!==G.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...G,id:M.id,label:M.label}},remove:async(N)=>{await Y.removeDeviceRoot(J.deviceId,N).catch((G)=>{if(V(G))throw Error("worker_folders_unavailable");if(!(G instanceof v0&&G.code==="root_not_found"))throw G})}}}function N7($,J,Z){h0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:K0($)}},d($).state,{proofStore:M0($)})}async function H7($,J,Z,Q){let{io:X,options:Y,host:V}=Q,N=J&&!Q.apiKey&&p0(J.stateDirectory)===null?J2(Q.home,Q.channel,J):null,G=J&&N&&x$(J)&&!I1(J,N)?k0(J).find((P)=>P.account&&P.organizationId===N)??null:void 0;if(G===null)throw new l("This computer is not connected for your account. Run reason connect first.");let H=G?G.config:J,M=G?G.configPath:Z,U=H&&x$(H)&&!e(H).revoked?t(H):null;if(!J||!H||!U||H.lifetime!=="persistent")throw new l("This computer is not connected to Reason. Run reason connect first.");let B=$.addFolder!==void 0,q=B?$.addFolder:$.removeFolder,L=Y.cwd??process.cwd(),T;try{T=J3(L,q)}catch(P){if(B)throw new l(P instanceof Error?P.message:String(P));T=CG(L,q)}if(T===H.workspaceRoot)throw new l(`${T} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let _=H.folders??[],W=U.roots.slice(1).find((P)=>P.path===T);if(!B&&!W&&!_.includes(T))throw new l(`${T} is not one of this computer's folders.`);if(B&&!z1(T,H.stateDirectory))throw new l(`${T} holds Reason's own settings.`);if(B&&!W&&_.length>=31)throw new l("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??p0(H.stateDirectory)??void 0,F=await U7(H,U,O,Y),z=U.roots.filter((P)=>P.path!==T);if(B)z=[...z,await F.add(T)];else if(W)await F.remove(W.id);N7(H,U,z);let j=B?[..._.filter((P)=>P!==T),T]:_.filter((P)=>P!==T),{folders:D,...R}=H;if(c(M,$0.parse({...R,...j.length?{folders:j}:{}})),!await(Y.controlWorker??B0)(J,"reload_roots").then(()=>!0,()=>!1))G$(J,V,"connect");return X.stdout.write(B?`Added ${T}. Sessions on "${H.name}" may run in it.

package/bin/vm-hands/{vm-hands-entry-lite-m2y0x4v3.js → vm-hands-entry-lite-mwj7bnse.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Sd as ae,Ud as ne}from"./vm-hands-entry-lite-cbkszaqs.js";import{Cf as be}from"./vm-hands-entry-lite-09yt840b.js";import{$f as ie,_f as C,bg as M,cg as Oe,fg as Y,gg as z,hg as v,qg as O,rg as Be}from"./vm-hands-entry-lite-psw2ymp5.js";import{Yg as Se}from"./vm-hands-entry-lite-0kzefw0a.js";import{Ni as se}from"./vm-hands-entry-lite-cneah70y.js";import{mj as J}from"./vm-hands-entry-lite-h8ykfv9r.js";import{sj as x}from"./vm-hands-entry-lite-ecgyzbdp.js";import{jk as Ne,kk as oe}from"./vm-hands-entry-lite-ew7amfaf.js";import{qk as ye,wk as Ie}from"./vm-hands-entry-lite-mrw8bv5s.js";import{Dk as xe}from"./vm-hands-entry-lite-mkynexaq.js";import{Mk as p}from"./vm-hands-entry-lite-hkvkfq0z.js";import{spawn as S,spawnSync as pt}from"child_process";import{createHash as ft,randomUUID as Te}from"crypto";import{closeSync as mt,copyFileSync as de,existsSync as q,fstatSync as _t,mkdirSync as pe,openSync as ht,readdirSync as D,readFileSync as j,readlinkSync as wt,renameSync as ve,rmSync as gt,statSync as bt,writeFileSync as xt}from"fs";import{connect as St}from"net";import{tmpdir as F,userInfo as Re}from"os";import{basename as fe,delimiter as yt,dirname as B,join as f}from"path";var Z=`import { spawn, execFileSync } from "node:child_process";
+import{Ud as ae,Wd as ne}from"./vm-hands-entry-lite-kaht6v11.js";import{Ef as be}from"./vm-hands-entry-lite-afjzr3v2.js";import{ag as C,bg as ie,dg as M,eg as Oe,hg as Y,ig as z,jg as v,sg as O,tg as Be}from"./vm-hands-entry-lite-0badx5n8.js";import{_g as Se}from"./vm-hands-entry-lite-kntkyezs.js";import{Pi as se}from"./vm-hands-entry-lite-nhhpc9n2.js";import{pj as J}from"./vm-hands-entry-lite-gp85aqkt.js";import{vj as x}from"./vm-hands-entry-lite-wsnr4fx8.js";import{mk as Ne,nk as oe}from"./vm-hands-entry-lite-qg11k3bf.js";import{tk as ye,zk as Ie}from"./vm-hands-entry-lite-dj65hfea.js";import{Gk as xe}from"./vm-hands-entry-lite-rbjky7rd.js";import{Pk as p}from"./vm-hands-entry-lite-f28ehysx.js";import{spawn as S,spawnSync as pt}from"child_process";import{createHash as ft,randomUUID as Te}from"crypto";import{closeSync as mt,copyFileSync as de,existsSync as q,fstatSync as _t,mkdirSync as pe,openSync as ht,readdirSync as D,readFileSync as j,readlinkSync as wt,renameSync as ve,rmSync as gt,statSync as bt,writeFileSync as xt}from"fs";import{connect as St}from"net";import{tmpdir as F,userInfo as Re}from"os";import{basename as fe,delimiter as yt,dirname as B,join as f}from"path";var Z=`import { spawn, execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -856,4 +856,4 @@ if(process.env.REASON_CLOUD_GATEWAY_EXEC === "1") {
 `),1;if(e.length===1&&e[0]==="doctor"){let a=await(r.grants??Ne)(i);if(!a)return t.write(`Reason computer use: Reason's permissions could not be read (computer_use_permission_status_unavailable)
 `),1;return(r.stdout??process.stdout).write(Ct(a)),0}if(e.length!==1||e[0]!=="mcp")return t.write(`Usage: reason __computer-use mcp|doctor
 `),2;let[s,...c]=i;return(r.run??Wt)(s,[...c,o.ocu,"mcp"],{...process.env,OPEN_COMPUTER_USE_DISABLE_APP_AGENT_PROXY:"1"})}function qr(e=v){return e()?.userChrome??{code:"user_chrome_browser_use_missing"}}function Ae(e,r,t,i){return new Promise((o)=>{let s=S(e,r,{env:t,stdio:"ignore",windowsHide:!0}),c=setTimeout(()=>{s.kill("SIGKILL"),o(-1)},i);s.once("error",()=>{clearTimeout(c),o(-1)}),s.once("exit",(a)=>{clearTimeout(c),o(a??-1)})})}function Et(e,r,t,i){return new Promise((o)=>{let s=S(e,r,{env:t,stdio:["ignore","pipe","ignore"],windowsHide:!0}),c="";s.stdout.setEncoding("utf8").on("data",(l)=>{c+=l});let a=setTimeout(()=>{s.kill("SIGKILL"),o(null)},i);s.once("error",()=>{clearTimeout(a),o(null)}),s.once("close",(l)=>{clearTimeout(a),o(l===0?c:null)})})}function qt(e){return T(e)?f(F(),"open-browser-use"):"/tmp/open-browser-use"}function T(e){return e.platform==="win32-x64"||e.platform==="win32-arm64"}var Dt=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,Ft=33554432;function Bt(e,r){let t;try{t=e===null?null:JSON.parse(e)}catch{return null}let i=W(t)&&W(t.result)?t.result.metadata:null;if(!W(i)||i.extensionId!==r)return null;return typeof i.extensionInstanceId==="string"&&Dt.test(i.extensionInstanceId)?i.extensionInstanceId:null}async function ke(e,r,t){let i=t.storages.map((a)=>{try{return D(a).filter((l)=>l.endsWith(".log")||l.endsWith(".ldb")).map((l)=>f(a,l))}catch{return[]}}),o;try{o=i.some((a)=>a.length>0)?D(t.socketDir).filter((a)=>a.endsWith(".sock")):[]}catch{return[]}let s=[];for(let a of o){let l=f(t.socketDir,a),d=Bt(await Et(e,["info","--socket",l,"--timeout","2s"],r,5000),t.extensionId);if(d)s.push({instance:d,socket:l})}let c=[];for(let[a,l]of(s.length>0?i:[]).entries())for(let d of l)try{if(bt(d).size>Ft)continue;let n=j(d),u=s.find((m)=>n.includes(m.instance));if(u){c.push({storage:t.storages[a],...u});break}}catch{}return c}async function Ut(e,r,t){return(await ke(e,r,t))[0]?.instance??null}function Pe(e,r,t){return Ut(e.nativeHost,r,{socketDir:qt(e),extensionId:M,storages:[f(t,"browser-profile","Default","Local Extension Settings",M)]})}var _e=/^(Default|Profile ([0-9]+))$/;async function Lt(e,r,t=x(),i=Y){let o=f(t,"Library","Application Support","Google","Chrome"),s=[];try{s=D(o)}catch(n){if(n.code==="EPERM")throw new p("browser_use_chrome_access_denied","macOS blocked Reason from reading Chrome's profiles. Allow Full Disk Access for Reason on this Mac and try again.")}let c=(n)=>Number(_e.exec(n)?.[2]??-1),a=s.filter((n)=>_e.test(n)&&q(f(o,n,"Extensions",C))).sort((n,u)=>c(n)-c(u)),l=(n)=>f(o,n,"Local Extension Settings",C);return(await ke(e,r,{socketDir:i,extensionId:C,storages:a.map(l)})).map(({storage:n,instance:u,socket:m})=>({profile:a.find((_)=>l(_)===n),instance:u,socket:m}))}async function Gt(e,r,t=x(),i=Y){let o=(await Lt(e,r,t,i))[0]?.instance;if(!o)throw new p("automation_user_chrome_not_connected","No Chrome profile on this Mac is connected to Reason. Open Chrome with the Reason extension, then try again.");return o}function he(e){return new Promise((r)=>{let t=St({path:e}),i=(o)=>{t.destroy(),r(o)};t.setTimeout(1000,()=>i(!1)),t.once("error",()=>i(!1)),t.once("connect",()=>i(!0))})}async function Ce(e,r){let t=Date.now()+r;while(Date.now()<t){if(await e())return!0;await new Promise((i)=>setTimeout(i,200))}return!1}var L=new Map;function G(e,r){let t=L.get(e);if(!t)t=r().finally(()=>L.delete(e)),L.set(e,t);return t}async function Mt(e,r){if(await he(e))return;if(gt(e,{force:!0}),await Ae("dbus-daemon",["--session",`--address=unix:path=${e}`,"--fork"],r,1e4)!==0||!await Ce(()=>he(e),5000))throw new p("automation_unavailable","Reason could not start the desktop session bus.")}async function we(e,r,t){let i=e.platform==="darwin-arm64"||T(e)?async()=>await Pe(e,r,t)!==null:async()=>await Ae(e.nativeHost,["info"],r,5000)===0;if(await i())return;let o=["--profile-directory=Default",`--load-extension=${e.extensionDir}`,"--no-first-run","--no-default-browser-check","--window-size=1280,800","about:blank"],s,c=null,a=0;if(e.platform==="darwin-arm64"){let n=f(t,"browser-profile");O(n);let u=f(n,"NativeMessagingHosts");pe(u,{recursive:!0,mode:448});let m=z(e.platform).nativeHostManifests[0];de(m,f(u,fe(m)));let _=e.browser.slice(0,e.browser.indexOf(".app/")+4),g=o.filter((N)=>N!=="about:blank").concat("--no-startup-window","--use-mock-keychain");s=S("/usr/bin/open",["-g","-n","-a",_,"--args",`--user-data-dir=${n}`,...g],{env:r,stdio:"ignore"})}else if(T(e)){let n=f(t,"browser-profile");O(n),pt(xe("icacls"),[B(e.browser),"/grant","*S-1-15-2-1:(OI)(CI)(RX)","*S-1-15-2-2:(OI)(CI)(RX)"],{stdio:"ignore",windowsHide:!0,timeout:60000});let u=o.filter((m)=>m!=="about:blank").concat("--no-startup-window","--keep-alive-for-test");s=S(e.browser,[`--user-data-dir=${n}`,...u],{detached:!0,stdio:"ignore",env:r})}else{let n=f(r.HOME,".config","google-chrome"),u=f(n,"NativeMessagingHosts");pe(u,{recursive:!0,mode:448});let m=z(e.platform).nativeHostManifests[0];de(m,f(u,fe(m)));let _=process.geteuid?.()===0?["--no-sandbox"]:[];c=f(t,"browser.log");let g=ht(c,"a",384);a=_t(g).size,s=S(e.browser,[`--user-data-dir=${n}`,...o,..._,"--force-renderer-accessibility"],{detached:!0,stdio:["ignore",g,g],env:{...r,ACCESSIBILITY_ENABLED:"1"}}),mt(g)}let l=!1;s.once("error",()=>{l=!0}),s.once("exit",(n)=>{l||=n!==0}),s.unref();let d=!1;if(await Ce(async()=>l||(d=await i()),$t),!d){if(c&&j(c).subarray(a).toString("utf8").includes("No usable sandbox"))throw new p("automation_browser_sandbox_unavailable","Chromium found no usable sandbox on this machine. Run the worker as a non-root user with unprivileged user namespaces enabled, or in a container with seccomp unconfined.");throw new p("automation_browser_unavailable","Reason could not connect the desktop browser.")}}async function Dr(e){await qe(e,!0)}function Fr(e){return We(e,Ee(e))}function We(e,r){return e.platform==="darwin-arm64"||T(e)?f(r,"browser-profile"):f(r,"home",".config","google-chrome")}function Ee(e){let r=f(e.root,"automation");if(!q(r)||!Kt(e.automation))return e.automation;if(!zt(We(e,r)))try{ve(r,e.automation)}catch{}return q(r)?r:e.automation}function Kt(e){try{return D(e).length===0}catch(r){return r.code==="ENOENT"}}function zt(e){let r;try{r=wt(f(e,"SingletonLock"))}catch{return!1}let t=Number(r.slice(r.lastIndexOf("-")+1));if(!Number.isSafeInteger(t)||t<=0)return!0;try{return process.kill(t,0),!0}catch(i){return i.code==="EPERM"}}async function qe(e,r){ye({root:e.root,automation:e.automation,extensionDir:e.extensionDir});let t=Ee(e);O(t);let i=Re().username,o={USER:i,LOGNAME:i,REASON_AUTOMATION_OCU:e.ocu,REASON_AUTOMATION_OBU:e.nativeHost};if(e.platform==="darwin-arm64"||T(e)){let n=T(e)?{...o,...Jt(),HOME:x()}:{...o,HOME:x(),PATH:`${B(e.node)}:/usr/bin:/bin:/usr/sbin:/sbin`,REASON_AUTOMATION_OCU:process.execPath,REASON_AUTOMATION_OCU_SUBCOMMAND:Pt};if(!r)return n;await G("browser",()=>we(e,n,t));let u=await Pe(e,n,t);if(!u)throw new p("automation_browser_unavailable","Reason could not connect the desktop browser.");return{...n,REASON_AUTOMATION_OBU_INSTANCE:u,REASON_AUTOMATION_BACKGROUND_TABS:"1"}}let s=await Be(),c=f(t,"home"),a=f(t,"runtime");O(c),O(a);let l=f(t,"bus"),d={...o,HOME:c,PATH:`${B(e.node)}:/usr/bin:/bin`,DISPLAY:s.display,XAUTHORITY:s.xauthority,XDG_RUNTIME_DIR:a,DBUS_SESSION_BUS_ADDRESS:`unix:path=${l}`,...s.sound?{PULSE_SERVER:Oe(s.sound)}:{}};if(await G("bus",()=>Mt(l,d)),r)await G("browser",()=>we(e,d,t));return d}function Jt(){let e=process.env.SystemRoot??"C:\\Windows",r=Object.fromEntries(["SystemDrive","USERPROFILE","LOCALAPPDATA","APPDATA","ProgramData","ProgramFiles","PATHEXT","ComSpec","USERNAME","USERDOMAIN","COMPUTERNAME","NUMBER_OF_PROCESSORS","PROCESSOR_ARCHITECTURE","PSModuleAnalysisCachePath"].flatMap((i)=>process.env[i]?[[i,process.env[i]]]:[])),t=f(e,"System32");return{...r,SystemRoot:e,windir:e,TEMP:F(),TMP:F(),PATH:[t,f(t,"WindowsPowerShell","v1.0"),e].join(yt)}}async function jt(e,r,t){let i=Re().username,o={USER:i,LOGNAME:i,HOME:x(),PATH:`${B(e.node)}:/usr/bin:/bin:/usr/sbin:/sbin`,REASON_AUTOMATION_OBU:r,REASON_AUTOMATION_BACKGROUND_TABS:"1"},s=await Gt(r,o);return t.throwIfAborted(),{...o,REASON_AUTOMATION_OBU_INSTANCE:s}}function Yt(e){if(process.platform!=="win32")return["--input-type=module","--eval",e];let r=f(F(),`reason-automation-${ft("sha256").update(e).digest("hex").slice(0,16)}.mjs`);if(!q(r)||j(r,"utf8")!==e){let t=`${r}.${process.pid}.tmp`;xt(t,e,{mode:384}),ve(t,r)}return[r]}function De(e,r,t,i){if(typeof me!=="string")return Promise.reject(new p("automation_unavailable","This Reason build has no automation runtime."));let o=me;return new Promise((s,c)=>{let a=S(e,Yt(o),{env:{...r,REASON_CLOUD_GATEWAY_EXEC:"1",REASON_AUTOMATION_INLINE_RESULT:"1"},stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0}),l=[],d=0,n="",u=null,m=!1,_=(h)=>{if(u??=h,process.platform==="win32"&&a.pid){S(f(process.env.SystemRoot??"C:\\Windows","System32","taskkill.exe"),["/pid",String(a.pid),"/t","/f"],{stdio:"ignore",windowsHide:!0}).once("error",()=>a.kill("SIGKILL"));return}try{process.kill(-a.pid,"SIGKILL")}catch{a.kill("SIGKILL")}},g=(h)=>{if(m)return;m=!0,clearTimeout(N),i.removeEventListener("abort",y),h()},N=setTimeout(()=>_(new p("automation_timed_out","Reason automation did not finish in time.")),Tt),y=()=>_(new p("cancelled","Reason cancelled the automation call."));if(i.addEventListener("abort",y,{once:!0}),a.stdout.on("data",(h)=>{if(d+=h.byteLength,d>It)_(new p("automation_output_too_large","Reason automation output is too large."));else l.push(h)}),a.stderr.setEncoding("utf8").on("data",(h)=>{n=(n+h).slice(-Nt)}),a.stdin.on("error",()=>{}),a.once("error",()=>g(()=>c(u??new p("automation_unavailable","Reason could not start the automation runtime.")))),a.once("close",(h)=>g(()=>{if(u)c(u);else s({code:h??1,stdout:Buffer.concat(l),stderr:n})})),i.aborted)y();a.stdin.end(t)})}var I=new Map;function Xt(e,r,t){for(let[o,s]of I)if(s.expiresAt<=t)I.delete(o);while(I.size>=Rt)I.delete(I.keys().next().value);let i=Te();return I.set(i,{runId:e,bytes:r,expiresAt:t+vt}),i}async function Fe(e,r,t,i={}){let o=await(i.environment??qe)(e,r.kind==="browser");return t.throwIfAborted(),await(i.runtime??De)(e.node,o,JSON.stringify(r),t)}async function Br(e,r){let t=$e({call:e});if(!("call"in t))E();let i=v();if(!i?.features.computer||t.call.kind==="browser"&&!i.features.browser)throw new p("automation_unavailable","Run `reason desktop install` on this machine to enable computer and browser use.");return await Fe(i,t.call,r)}function ge(e,r,t){let i=e.stdout.byteLength>K?Xt(r,e.stdout,t):void 0;return{code:e.code,stderr:e.stderr,instance_id:kt,output_bytes:e.stdout.byteLength,chunk:e.stdout.subarray(0,K).toString("base64"),...i?{output_id:i}:{}}}async function Ur(e,r={}){let t=$e(e.payload),i=(r.now??Date.now)();if("output_id"in t){let _=I.get(t.output_id);if(!_||_.runId!==e.runId||_.expiresAt<=i||t.offset>_.bytes.byteLength)throw new p("automation_output_unavailable","Reason automation output expired.");return{chunk:_.bytes.subarray(t.offset,t.offset+K).toString("base64")}}let o=(r.components??v)(),s=(r.platform??process.platform)==="darwin",c=s?(r.macIdentity??J)():[],a=r.macSetup??P,l=!o?.features.computer||t.call.kind==="browser"&&!t.userChrome&&!o.features.browser;if(s&&(l||c.length===0||t.call.kind==="browser"&&t.userChrome&&!e.userChrome))return ge(await le({runId:e.runId,call:t.call,identity:c,desktopMissing:l,signal:e.signal},a),e.runId,i);if(!o?.features.computer)throw new p("automation_unavailable","Run `reason desktop install` on this machine to enable computer and browser use.");let d=t.userChrome?e.userChrome:void 0;if(t.userChrome&&!d)throw new p("automation_user_chrome_unavailable","Your own Chrome is not enabled on this computer: run `reason desktop install` on this Mac (and `reason connect --user-chrome on` if you turned it off).");if(t.call.kind==="browser"&&!d&&!o.features.browser)throw new p("automation_browser_not_installed",!o.platform.startsWith("linux")?"Browser use is unavailable on this machine: re-run `reason desktop install`.":"Browser use is unavailable on this machine: install a non-snap Chromium at /usr/bin/chromium, then re-run `reason desktop install`.");e.signal.throwIfAborted();let n=await Ie(e.runId,e.signal,r.now),u="account"in r?r.account??null:Se(),m;try{if(d){let _=await(r.userChromeEnvironment??jt)(o,d,e.signal);e.signal.throwIfAborted(),m=await(r.runtime??De)(o.node,_,JSON.stringify(t.call),e.signal)}else if(u)m=await(r.delegate??H)(u,t.call,e.signal);else m=await Fe(o,t.call,e.signal,r)}finally{n()}if(s)m=await ue({runId:e.runId,call:t.call,identity:c,output:m,signal:e.signal},a);return ge(m,e.runId,i)}
-export{Ze as Cd,K as Dd,$e as Ed,Wr as Fd,Wt as Gd,Er as Hd,qr as Id,Lt as Jd,Gt as Kd,Dr as Ld,Fr as Md,Br as Nd,Ur as Od};
+export{Ze as Ed,K as Fd,$e as Gd,Wr as Hd,Wt as Id,Er as Jd,qr as Kd,Lt as Ld,Gt as Md,Dr as Nd,Fr as Od,Br as Pd,Ur as Qd};

package/bin/vm-hands/{vm-hands-entry-lite-cneah70y.js → vm-hands-entry-lite-nhhpc9n2.js}

@@ -1,5 +1,5 @@
 // @bun
-import{aj as F}from"./vm-hands-entry-lite-6ffdqdyw.js";import{dj as T,gj as d,ij as p,mj as n,nj as a}from"./vm-hands-entry-lite-h8ykfv9r.js";import{sj as j,uj as v}from"./vm-hands-entry-lite-ecgyzbdp.js";import{Sj as l}from"./vm-hands-entry-lite-shsqhwgs.js";import{jk as m,kk as h}from"./vm-hands-entry-lite-ew7amfaf.js";import{Sk as y}from"./vm-hands-entry-lite-4yw8vx5h.js";import{spawnSync as Eq}from"child_process";import{dirname as I}from"path";import{spawn as r}from"child_process";import{accessSync as e,constants as qq}from"fs";import{basename as zq,join as Jq}from"path";var V=null;function O(q){if(V===q)V=null;if(q.exitCode===null&&q.signalCode===null)q.kill("SIGTERM")}var _=(q,z)=>{if(V)O(V);let Q=Jq(q,T);try{e(Q,qq.X_OK)}catch{return()=>{}}let J;try{J=r(Q,["--app",q,"--name",zq(q,".app"),"--permission",z==="screen"?"screen_recording":"accessibility"],{detached:!0,stdio:"ignore"})}catch{return()=>{}}return J.on("error",()=>{if(V===J)V=null}),J.once("exit",()=>{if(V===J)V=null}),J.unref(),V=J,()=>O(J)};import{chmodSync as Qq,existsSync as x,mkdirSync as Xq,readFileSync as Zq,realpathSync as k,renameSync as $q,statSync as G,writeFileSync as Kq}from"fs";import{dirname as P,isAbsolute as Rq,join as Vq,resolve as S,sep as W}from"path";function U(q=j()){return Vq(v(q),"reason","protected-path-grants.json")}var B=null;function Yq(q){let z=JSON.parse(q);if(!Array.isArray(z?.grants))return[];return z.grants.flatMap((Q)=>{let J=Q;return J&&typeof J.path==="string"&&Rq(J.path)&&(J.kind==="file"||J.kind==="folder")&&typeof J.grantedAt==="number"?[{path:J.path,kind:J.kind,grantedAt:J.grantedAt}]:[]})}function D(q=U()){try{let{mtimeMs:z}=G(q);if(B&&B.file===q&&B.mtimeMs===z)return B.grants;let Q=Yq(Zq(q,"utf8"));return B={file:q,mtimeMs:z,grants:Q},Q}catch{return[]}}function Bq(q,z){return q.kind==="file"?z===q.path:z===q.path||z.startsWith(`${q.path}${W}`)}function Dq(q,z){let Q=S(q);return D(z).some((J)=>Bq(J,Q))}function Sq(q,z){return F(q)&&!Dq(q,z)}function w(q,z){Xq(P(z),{recursive:!0,mode:448});let Q=`${z}.${process.pid}.tmp`;Kq(Q,`${JSON.stringify({version:1,grants:q},null,2)}
+import{cj as F}from"./vm-hands-entry-lite-0mk8rxqv.js";import{gj as T,jj as d,lj as p,pj as n,qj as a}from"./vm-hands-entry-lite-gp85aqkt.js";import{vj as j,xj as v}from"./vm-hands-entry-lite-wsnr4fx8.js";import{Vj as l}from"./vm-hands-entry-lite-gbf8h13w.js";import{mk as m,nk as h}from"./vm-hands-entry-lite-qg11k3bf.js";import{Vk as y}from"./vm-hands-entry-lite-c3e25cks.js";import{spawnSync as Eq}from"child_process";import{dirname as I}from"path";import{spawn as r}from"child_process";import{accessSync as e,constants as qq}from"fs";import{basename as zq,join as Jq}from"path";var V=null;function O(q){if(V===q)V=null;if(q.exitCode===null&&q.signalCode===null)q.kill("SIGTERM")}var _=(q,z)=>{if(V)O(V);let Q=Jq(q,T);try{e(Q,qq.X_OK)}catch{return()=>{}}let J;try{J=r(Q,["--app",q,"--name",zq(q,".app"),"--permission",z==="screen"?"screen_recording":"accessibility"],{detached:!0,stdio:"ignore"})}catch{return()=>{}}return J.on("error",()=>{if(V===J)V=null}),J.once("exit",()=>{if(V===J)V=null}),J.unref(),V=J,()=>O(J)};import{chmodSync as Qq,existsSync as x,mkdirSync as Xq,readFileSync as Zq,realpathSync as k,renameSync as $q,statSync as G,writeFileSync as Kq}from"fs";import{dirname as P,isAbsolute as Rq,join as Vq,resolve as S,sep as W}from"path";function U(q=j()){return Vq(v(q),"reason","protected-path-grants.json")}var B=null;function Yq(q){let z=JSON.parse(q);if(!Array.isArray(z?.grants))return[];return z.grants.flatMap((Q)=>{let J=Q;return J&&typeof J.path==="string"&&Rq(J.path)&&(J.kind==="file"||J.kind==="folder")&&typeof J.grantedAt==="number"?[{path:J.path,kind:J.kind,grantedAt:J.grantedAt}]:[]})}function D(q=U()){try{let{mtimeMs:z}=G(q);if(B&&B.file===q&&B.mtimeMs===z)return B.grants;let Q=Yq(Zq(q,"utf8"));return B={file:q,mtimeMs:z,grants:Q},Q}catch{return[]}}function Bq(q,z){return q.kind==="file"?z===q.path:z===q.path||z.startsWith(`${q.path}${W}`)}function Dq(q,z){let Q=S(q);return D(z).some((J)=>Bq(J,Q))}function Sq(q,z){return F(q)&&!Dq(q,z)}function w(q,z){Xq(P(z),{recursive:!0,mode:448});let Q=`${z}.${process.pid}.tmp`;Kq(Q,`${JSON.stringify({version:1,grants:q},null,2)}
 `,{mode:384}),Qq(Q,384),$q(Q,z),B=null}function b(q,z=U(),Q=Date.now()){if(!x(q))throw Error(`No file or folder at ${q}.`);let J=k(q),X=P(z);if(X===J||X.startsWith(`${J}${W}`)||J.startsWith(`${X}${W}`))throw Error("Reason's own configuration folder cannot be allowed.");let Z={path:J,kind:G(J).isDirectory()?"folder":"file",grantedAt:Q},$=D(z).filter((R)=>R.path!==J);return w([...$,Z],z),Z}function u(q,z=U()){let Q=x(q)?k(q):S(q),J=D(z),X=J.filter((Z)=>Z.path!==Q);if(X.length===J.length)return!1;return w(X,z),!0}function wq(q,z,Q){let J=z?"file-read* file-write*":"file-read*";return D(Q).filter((X)=>X.path===q||X.path.startsWith(`${q}${W}`)).map((X)=>`(allow ${J} (${X.kind==="file"?"literal":"subpath"} ${JSON.stringify(X.path)}))`)}var f=`Reason permissions
 
 Usage:
@@ -20,7 +20,7 @@ this Mac may open. Only you can change this list; Sessions cannot.
 allow asks for each missing one, or the one named. macOS cannot ask for Full
 Disk Access: allow disk opens its pane, shows the file to add in Finder and
 waits until the worker has it.
-`,M="x-apple.systempreferences:com.apple.preference.security",Nq="curl -fsSL https://reasonmachines.com/install.sh | bash",Hq=180000,Wq=2000,A=["screen","accessibility","disk"],L={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${M}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${M}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${M}?Privacy_AllFiles`}};function s(q){return q.executable}function jq(q,z){if(q==="computer_use_identity_missing")return`Reason's background identity is not installed (${q}); reinstall Reason: ${Nq}`;if(q==="computer_use_identity_outdated")return`Reason's background identity is outdated (${p(z)??"unknown"}; this CLI is ${l}) (${q}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${q}); run the installed \`reason\``}function Cq(q=j()){let z=n(q);if(z.length>0)return{state:"ready",path:I(I(I(z[0]))),prefix:z};let Q=a(z,q)??"computer_use_identity_unavailable";return{state:Q,path:d(q),detail:jq(Q,q)}}function o(){return{identity:()=>Cq(),grants:(q)=>m(q),request:(q,z)=>h(q,z),worker:async()=>(await import("./status-n78zf8a8.js")).connectionMacState(),open:(q)=>{Eq("/usr/bin/open",q,{stdio:"ignore",timeout:1e4})},tile:_,restartConnection:async()=>(await import("./connect-cli-y59ghysm.js")).restartConnection(),sleep:(q)=>new Promise((z)=>setTimeout(z,q)),now:()=>Date.now()}}function c(q,z,Q){if(q.state!=="ready"||!z)return"unknown";return z[Q]?"granted":"missing"}async function i(q){let z=q.identity(),Q=z.state==="ready"?await q.grants(z.prefix):null,J=await q.worker(),X=J?s(J):null,Z=!X||J?.full_disk_access==="unknown"?"unknown":J?.full_disk_access==="granted"?"granted":"missing",$=(R,Y,K)=>{let{label:E,purpose:H,level:N}=L[R];return{id:R,label:E,purpose:H,level:N,state:Y,holder:K}};return{identity:{state:z.state,path:z.path,detail:z.state==="ready"?null:z.detail},worker_detail:X?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[$("screen",c(z,Q,"screen"),z.path),$("accessibility",c(z,Q,"accessibility"),z.path),$("disk",Z,X)]}}function dq(q){let z=q.identity.state==="ready"?null:q.identity.state,Q=q.permissions.filter((Z)=>Z.state==="granted").length,J=[...z?[z]:[],...q.permissions.filter((Z)=>Z.state!=="granted"&&!(z&&Z.id!=="disk")).map((Z)=>`${Z.label} ${Z.state}`)],X=!z&&q.permissions.some((Z)=>Z.state==="missing");return`Permissions: ${Q} of ${q.permissions.length}${J.length>0?` (${J.join(", ")})`:""}`+(X?" \u2014 reason permissions allow":J.length>0?" \u2014 reason permissions":"")}function Uq(q){let z=[];if(q.identity.detail)z.push(q.identity.detail);z.push(`Reason: ${q.identity.path}`);let Q=q.permissions.find((J)=>J.id==="disk");z.push(Q?.holder?`Worker: ${Q.holder}`:`Worker: ${q.worker_detail}`),z.push("");for(let J of q.permissions){let X=`${J.label}${J.level==="recommended"?" (recommended)":""}`;z.push(`  ${J.id.padEnd(13)}  ${J.state.padEnd(7)}  ${X}: ${J.purpose}`)}if(q.permissions.some((J)=>J.state==="missing"))z.push("","Allow the missing ones: reason permissions allow");return`${z.join(`
+`,M="x-apple.systempreferences:com.apple.preference.security",Nq="curl -fsSL https://reasonmachines.com/install.sh | bash",Hq=180000,Wq=2000,A=["screen","accessibility","disk"],L={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${M}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${M}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${M}?Privacy_AllFiles`}};function s(q){return q.executable}function jq(q,z){if(q==="computer_use_identity_missing")return`Reason's background identity is not installed (${q}); reinstall Reason: ${Nq}`;if(q==="computer_use_identity_outdated")return`Reason's background identity is outdated (${p(z)??"unknown"}; this CLI is ${l}) (${q}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${q}); run the installed \`reason\``}function Cq(q=j()){let z=n(q);if(z.length>0)return{state:"ready",path:I(I(I(z[0]))),prefix:z};let Q=a(z,q)??"computer_use_identity_unavailable";return{state:Q,path:d(q),detail:jq(Q,q)}}function o(){return{identity:()=>Cq(),grants:(q)=>m(q),request:(q,z)=>h(q,z),worker:async()=>(await import("./status-sf4634w4.js")).connectionMacState(),open:(q)=>{Eq("/usr/bin/open",q,{stdio:"ignore",timeout:1e4})},tile:_,restartConnection:async()=>(await import("./connect-cli-npxeps2h.js")).restartConnection(),sleep:(q)=>new Promise((z)=>setTimeout(z,q)),now:()=>Date.now()}}function c(q,z,Q){if(q.state!=="ready"||!z)return"unknown";return z[Q]?"granted":"missing"}async function i(q){let z=q.identity(),Q=z.state==="ready"?await q.grants(z.prefix):null,J=await q.worker(),X=J?s(J):null,Z=!X||J?.full_disk_access==="unknown"?"unknown":J?.full_disk_access==="granted"?"granted":"missing",$=(R,Y,K)=>{let{label:E,purpose:H,level:N}=L[R];return{id:R,label:E,purpose:H,level:N,state:Y,holder:K}};return{identity:{state:z.state,path:z.path,detail:z.state==="ready"?null:z.detail},worker_detail:X?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[$("screen",c(z,Q,"screen"),z.path),$("accessibility",c(z,Q,"accessibility"),z.path),$("disk",Z,X)]}}function dq(q){let z=q.identity.state==="ready"?null:q.identity.state,Q=q.permissions.filter((Z)=>Z.state==="granted").length,J=[...z?[z]:[],...q.permissions.filter((Z)=>Z.state!=="granted"&&!(z&&Z.id!=="disk")).map((Z)=>`${Z.label} ${Z.state}`)],X=!z&&q.permissions.some((Z)=>Z.state==="missing");return`Permissions: ${Q} of ${q.permissions.length}${J.length>0?` (${J.join(", ")})`:""}`+(X?" \u2014 reason permissions allow":J.length>0?" \u2014 reason permissions":"")}function Uq(q){let z=[];if(q.identity.detail)z.push(q.identity.detail);z.push(`Reason: ${q.identity.path}`);let Q=q.permissions.find((J)=>J.id==="disk");z.push(Q?.holder?`Worker: ${Q.holder}`:`Worker: ${q.worker_detail}`),z.push("");for(let J of q.permissions){let X=`${J.label}${J.level==="recommended"?" (recommended)":""}`;z.push(`  ${J.id.padEnd(13)}  ${J.state.padEnd(7)}  ${X}: ${J.purpose}`)}if(q.permissions.some((J)=>J.state==="missing"))z.push("","Allow the missing ones: reason permissions allow");return`${z.join(`
 `)}
 `}async function g(q,z){let Q=z.now()+Hq;for(;;){if(await q())return!0;if(z.now()>=Q)return!1;await z.sleep(Wq)}}async function Iq(q,z){let Q=z.host??o(),{io:J}=z,X=await i(Q),Z=X.permissions.filter((K)=>q.includes(K.id)&&K.state!=="granted");if(Z.length===0)return J.stdout.write(`Reason permissions: ${q.map((K)=>L[K].label).join(", ")} already allowed.
 `),0;let $=!1,R=!1,Y=Q.identity();for(let K of Z){let{label:E,pane:H}=L[K.id];if(K.id!=="disk"){if(Y.state!=="ready"){if(!$)J.stderr.write(`Reason permissions: ${Y.detail}
@@ -49,4 +49,4 @@ ${f}`),1;if(J.command==="help")return Q.stdout.write(f),0;if(J.command==="protec
 `).join(""):`No protected paths are allowed on this computer.
 `),0}catch(Q){return z.stderr.write(`${Q instanceof Error?Q.message:String(Q)}
 `),1}}
-export{Sq as Li,wq as Mi,_ as Ni,f as Oi,A as Pi,s as Qi,Cq as Ri,i as Si,dq as Ti,Uq as Ui,Iq as Vi,Mq as Wi,pq as Xi};
+export{Sq as Ni,wq as Oi,_ as Pi,f as Qi,A as Ri,s as Si,Cq as Ti,i as Ui,dq as Vi,Uq as Wi,Iq as Xi,Mq as Yi,pq as Zi};

package/bin/vm-hands/{vm-hands-entry-lite-h3vmfk68.js → vm-hands-entry-lite-nnrypv7q.js}

@@ -1,5 +1,5 @@
 // @bun
-import{$e as OJ,Jf as jJ,Se as _J,_e as gJ,af as RJ,bf as IJ}from"./vm-hands-entry-lite-09yt840b.js";import{createHash as m,randomBytes as WJ}from"crypto";import{closeSync as MJ,fsyncSync as TJ,mkdirSync as aJ,openSync as DJ,renameSync as nJ,rmSync as tJ,statSync as qJ,writeSync as xJ,constants as y}from"fs";import{join as t}from"path";var eJ=1;var e=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function FJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new F("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function AJ(J,Q){let{payload:$,authority:z}=J;if(!$||typeof $!=="object"||Array.isArray($)||!z||typeof z!=="object"||Array.isArray(z)||!Q.deviceId||!Q.rootId||$.run_id!==Q.runId||$.device_id!==Q.deviceId||z.device_id!==Q.deviceId||$.root_id!==Q.rootId||Q.snapshotId!==void 0&&$.snapshot_id!==Q.snapshotId)throw new F("vm_hands_env_invalid","environment does not match this Hands");return $}function SJ(J){if(J.capability!=="hands.connect")throw new F("vm_hands_bind_invalid","not a hands.connect claim");let Q=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Q.workspace_id==="string"&&e.test(Q.workspace_id)?Q.workspace_id:J.run_id,brain_generation:Q.target_generation,fence_id:Q.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Q.hands_confinement??""),browser_egress:Q.browser_egress??null,policy_digest:Q.vm_hands_policy_digest},cwd:typeof Q.cwd==="string"?Q.cwd:"",claim:J,env:FJ(J)?J.environment_sealed:null,workspace_deferred:JQ(J)}}function JQ(J){let Q=J.payload[OJ];if(Q===void 0)return!1;if(Q!==!0||J.payload.vm_hands_env_deferred!==!0||J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class F extends Error{code;constructor(J,Q){super(Q);this.code=J}}var I=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),b=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function c(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(c).join(",")}]`;return`{${Object.keys(J).sort().map((Q)=>`${JSON.stringify(Q)}:${c(J[Q])}`).join(",")}}`}async function SQ(J){let Q=await crypto.subtle.importKey("pkcs8",b(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),$=b(J.device_key.spki),z=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),L=new Uint8Array(await crypto.subtle.exportKey("spki",z.publicKey)),U=m("sha256").update($).digest("base64url");return{signing:{privateKey:Q},agreement:z,signingSpki:$,agreementSpki:L,fingerprint:U}}var QQ=4;class ZQ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(J){let Q=this.structural.then(J,J);return this.structural=Q.catch(()=>{return}),Q}constructor(J,Q,$,z){this.init=J;this.keys=Q;this.hooks=$;this.options=z;if(!e.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new F("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new F("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Q of this.bound.values())if(Q.runId===J)return!0;return!1}bindIdForRun(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Q,$){for(let z=Date.now()+Q;;){let L=this.bound.get(J);if(!L)return!1;if(L.envInstalled)return!0;if(Date.now()>=z||$?.aborted)return!1;await new Promise((U)=>setTimeout(U,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new F("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new F("vm_hands_challenge_invalid","bad register challenge");let Q={challenge:J,t:"register",v:eJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:I(this.keys.signingSpki),env_public_key:I(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:I(WJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},$=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(c(Q)));return{...Q,device_signature:I($)}}async helloFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","hello before register");let $=String((this.options.now??Date.now)()),z=I(WJ(32)),L=jJ({method:"GET",pathAndQuery:_J,timestamp:$,nonce:z,challenge:J,bodySha256:m("sha256").update("").digest("hex")}),U=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(L)));return{t:"hello",timestamp:$,nonce:z,signature:I($Q(U)),...Q?{vm_hands_previous_connection:Q}:{}}}registered(){if(this.identity!=="identity_free")throw new F("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new F("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new F("vm_hands_bind_invalid","bad bind");for(let $ of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!e.test($))throw new F("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new F("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new F("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new F("vm_hands_bind_invalid","bad policy or nonce");if(m("sha256").update(c({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new F("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some(($)=>$.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new F("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=QQ)throw new F("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new F("vm_hands_busy","a bind waits for its workspace beside the setup");if(J.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),J.workspace_deferred){let $,z,L=new Promise((U,N)=>{$=U,z=N});L.catch(()=>{return}),this.grants.set(J.bind_id,{promise:L,resolve:$,reject:z})}return this.exclusive(()=>this.setUp(J))}async setUp(J){let Q=[...this.bound.keys()],$=null,z=!1,L=this.grants.get(J.bind_id);try{if(L&&(Q.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(Q.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new F("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Q}),this.unverified.clear();this.servedRun=!0,z=!0;let{launchId:U,applied:N,readyData:O}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim,...L?{workspaceGrant:L.promise}:{}}),T=this.hooks.restatLayout();this.hooks.verifyMounts?.();let D=null,A=null;if(J.env){let w=J.claim?.owner??{},v=AJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:J.claim?.root_id??""});this.commandsSinceVerified=!0,D=this.hooks.installEnvironment(J.bind_id,v),A=typeof v.snapshot_id==="string"&&v.snapshot_id?v.snapshot_id:null,$=this.writeJobEnvRootOnly(J.bind_id,v)}if(this.unbinding.has(J.bind_id))throw new F("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:D!==null,rootId:J.claim?.root_id??"",envDirectory:$}),this.binding.delete(J.bind_id),this.grants.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:D,snapshot_id:A,layout:T,...O?{ready_data:O}:{},policy_digest:m("sha256").update(c({hands_confinement:N.hands_confinement??null,browser_egress:N.browser_egress??null})).digest("hex")}}catch(U){if($)KJ($);if(z){let O=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:O,own:!0}).catch(()=>{this.unverified.add(J.bind_id)})}this.binding.delete(J.bind_id),this.grants.delete(J.bind_id);let N=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof F?U:new F(N,"executor refused the bind")}}grantWorkspace(J){let Q=this.grants.get(J);if(!Q)throw new F("vm_hands_not_binding","no pre-bind waits for a workspace grant");Q.resolve()}abandonWorkspaceGrant(J){this.grants.get(J)?.reject(new F("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(J){let Q=this.bound.get(J.attemptId);if(!Q||this.unbinding.has(J.attemptId))throw new F("vm_hands_not_bound","environment delivered while not bound");if(!e.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new F("vm_hands_env_invalid","bad snapshot id");let $=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==$)throw new F("vm_hands_env_invalid","bad env envelope");let z=AJ(await this.openSealed(J.sealed,$),{runId:Q.runId,deviceId:J.deviceId,rootId:Q.rootId,snapshotId:J.snapshotId});this.commandsSinceVerified=!0;let L=this.hooks.installEnvironment(Q.bindId,z);if(Q.envInstalled=!0,Q.envDirectory)KJ(Q.envDirectory);return Q.envDirectory=null,Q.envDirectory=this.writeJobEnvRootOnly(`${Q.bindId}-r${L}`,z),{snapshot_id:J.snapshotId,installed_revision:L,installed:!0}}async attestFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new F("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new F("vm_hands_attest_invalid","attest beside a bind");let $=await this.hooks.runProbe({nonce:Q,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Q,exit_code:$.exitCode,markers:$.markers,proof_dir_inode:$.proofDirInode,script_sha256:m("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Q=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),this.abandonWorkspaceGrant(J),Q)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Q))}async retryUnbind(J){if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(J,this.unverifiedTeardowns.get(J)??null,!0)})}async tearDown(J,Q,$=!1){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((U)=>U!==J),L=!z.length&&($||!this.commandsSinceVerified);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:L?{bindId:J,own:!0}:void 0)}catch(U){if(this.unverified.add(J),!this.unverifiedTeardowns.has(J))this.unverifiedTeardowns.set(J,Q);throw U}if(this.unverified.delete(J),!z.length&&!$)this.unverified.clear(),this.commandsSinceVerified=!1;if(Q?.envDirectory)KJ(Q.envDirectory);return this.unverifiedTeardowns.delete(J),{bind_id:Q?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length||$?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Q){let $=()=>{throw new F("vm_hands_env_invalid","env did not decrypt")},z=await crypto.subtle.importKey("spki",b(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch($),L=await crypto.subtle.deriveKey({name:"ECDH",public:z},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),U=await crypto.subtle.decrypt({name:"AES-GCM",iv:b(J.iv),additionalData:new TextEncoder().encode(Q)},L,b(J.ct)).catch($),N=JSON.parse(new TextDecoder().decode(U));if(!N||typeof N!=="object"||Array.isArray(N))throw new F("vm_hands_env_invalid","env not an object");return N}writeJobEnvRootOnly(J,Q){let $=t(this.options.envRoot,`bind-${J}`);aJ($,{mode:448});let z=qJ($);if(!z.isDirectory()||(z.mode&63)!==0||z.uid!==(process.getuid?.()??-1))throw new F("vm_hands_env_dir_unsafe","env directory is not root's 0700");let L=Q.variables&&typeof Q.variables==="object"?Q.variables:{},U=Object.entries(L).filter(([T,D])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(T)&&typeof D==="string").map(([T,D])=>`export ${T}='${String(D).replaceAll("'","'\\''")}'`).join(`
+import{Lf as jJ,Ue as _J,af as gJ,bf as OJ,cf as RJ,df as IJ}from"./vm-hands-entry-lite-afjzr3v2.js";import{createHash as m,randomBytes as WJ}from"crypto";import{closeSync as MJ,fsyncSync as TJ,mkdirSync as aJ,openSync as DJ,renameSync as nJ,rmSync as tJ,statSync as qJ,writeSync as xJ,constants as y}from"fs";import{join as t}from"path";var eJ=1;var e=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function FJ(J){if(J.environment!==void 0||J.payload.environment!==void 0)throw new F("vm_hands_bind_invalid","bind carries a plaintext environment");if(J.payload.vm_hands_env_deferred===!0&&J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","split bind carries an environment");return J.environment_sealed!==void 0}function AJ(J,Q){let{payload:$,authority:z}=J;if(!$||typeof $!=="object"||Array.isArray($)||!z||typeof z!=="object"||Array.isArray(z)||!Q.deviceId||!Q.rootId||$.run_id!==Q.runId||$.device_id!==Q.deviceId||z.device_id!==Q.deviceId||$.root_id!==Q.rootId||Q.snapshotId!==void 0&&$.snapshot_id!==Q.snapshotId)throw new F("vm_hands_env_invalid","environment does not match this Hands");return $}function SJ(J){if(J.capability!=="hands.connect")throw new F("vm_hands_bind_invalid","not a hands.connect claim");let Q=J.payload;return{kind:"vm_hands.bind",v:1,bind_id:J.attempt_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,run_id:J.run_id,session_id:typeof Q.workspace_id==="string"&&e.test(Q.workspace_id)?Q.workspace_id:J.run_id,brain_generation:Q.target_generation,fence_id:Q.target_fence_id,lease_until:J.lease_until,policy:{agent_profile:"",confinement_key:String(Q.hands_confinement??""),browser_egress:Q.browser_egress??null,policy_digest:Q.vm_hands_policy_digest},cwd:typeof Q.cwd==="string"?Q.cwd:"",claim:J,env:FJ(J)?J.environment_sealed:null,workspace_deferred:JQ(J)}}function JQ(J){let Q=J.payload[OJ];if(Q===void 0)return!1;if(Q!==!0||J.payload.vm_hands_env_deferred!==!0||J.environment_sealed!==void 0)throw new F("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class F extends Error{code;constructor(J,Q){super(Q);this.code=J}}var I=(J)=>Buffer.from(J instanceof Uint8Array?J:new Uint8Array(J)).toString("base64url"),b=(J)=>new Uint8Array(Buffer.from(J,"base64url"));function c(J){if(J===null||typeof J!=="object")return JSON.stringify(J);if(Array.isArray(J))return`[${J.map(c).join(",")}]`;return`{${Object.keys(J).sort().map((Q)=>`${JSON.stringify(Q)}:${c(J[Q])}`).join(",")}}`}async function SQ(J){let Q=await crypto.subtle.importKey("pkcs8",b(J.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),$=b(J.device_key.spki),z=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),L=new Uint8Array(await crypto.subtle.exportKey("spki",z.publicKey)),U=m("sha256").update($).digest("base64url");return{signing:{privateKey:Q},agreement:z,signingSpki:$,agreementSpki:L,fingerprint:U}}var QQ=4;class ZQ{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(J){let Q=this.structural.then(J,J);return this.structural=Q.catch(()=>{return}),Q}constructor(J,Q,$,z){this.init=J;this.keys=Q;this.hooks=$;this.options=z;if(!e.test(J.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(J.workspace_id))throw new F("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(J.instance_generation)||J.instance_generation<1)throw new F("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(J){for(let Q of this.bound.values())if(Q.runId===J)return!0;return!1}bindIdForRun(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(J,Q,$){for(let z=Date.now()+Q;;){let L=this.bound.get(J);if(!L)return!1;if(L.envInstalled)return!0;if(Date.now()>=z||$?.aborted)return!1;await new Promise((U)=>setTimeout(U,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(J){for(let Q of this.bound.values())if(Q.runId===J)return Q.envInstalled;return!1}async registerFrame(J){if(this.identity!=="identity_free")throw new F("vm_hands_register_twice","already registered");if(typeof J!=="string"||J.length<16||J.length>256)throw new F("vm_hands_challenge_invalid","bad register challenge");let Q={challenge:J,t:"register",v:eJ,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:I(this.keys.signingSpki),env_public_key:I(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:I(WJ(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},$=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(c(Q)));return{...Q,device_signature:I($)}}async helloFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","hello before register");let $=String((this.options.now??Date.now)()),z=I(WJ(32)),L=jJ({method:"GET",pathAndQuery:_J,timestamp:$,nonce:z,challenge:J,bodySha256:m("sha256").update("").digest("hex")}),U=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(L)));return{t:"hello",timestamp:$,nonce:z,signature:I($Q(U)),...Q?{vm_hands_previous_connection:Q}:{}}}registered(){if(this.identity!=="identity_free")throw new F("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(J){if(this.identity!=="registered")throw new F("vm_hands_not_registered","bind before register");if(J.kind!=="vm_hands.bind"||J.v!==1)throw new F("vm_hands_bind_invalid","bad bind");for(let $ of[J.bind_id,J.attempt_id,J.run_id,J.session_id,J.fence_id])if(!e.test($))throw new F("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(J.brain_generation)||J.brain_generation<=(this.lastBrainGeneration.get(J.run_id)??0))throw new F("vm_hands_generation_stale","brain generation not strictly higher");if(J.env&&(J.env.aad!==J.bind_id||J.env.alg!=="ECDH-P256+A256GCM"))throw new F("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(J.policy.policy_digest))throw new F("vm_hands_bind_invalid","bad policy or nonce");if(m("sha256").update(c({hands_confinement:J.policy.confinement_key||null,browser_egress:J.policy.browser_egress??null})).digest("hex")!==J.policy.policy_digest)throw new F("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(J.bind_id)||[...this.bound.values()].some(($)=>$.runId===J.run_id)||[...this.binding.values()].includes(J.run_id))throw new F("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=QQ)throw new F("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new F("vm_hands_busy","a bind waits for its workspace beside the setup");if(J.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(J.run_id,J.brain_generation),this.binding.set(J.bind_id,J.run_id),J.workspace_deferred){let $,z,L=new Promise((U,N)=>{$=U,z=N});L.catch(()=>{return}),this.grants.set(J.bind_id,{promise:L,resolve:$,reject:z})}return this.exclusive(()=>this.setUp(J))}async setUp(J){let Q=[...this.bound.keys()],$=null,z=!1,L=this.grants.get(J.bind_id);try{if(L&&(Q.length||this.commandsSinceVerified))throw new F("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(Q.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new F("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:Q}),this.unverified.clear();this.servedRun=!0,z=!0;let{launchId:U,applied:N,readyData:O}=await this.hooks.startExecutor({bindId:J.bind_id,sessionId:J.session_id,policyDigest:J.policy.policy_digest,confinementKey:J.policy.confinement_key,browserEgress:J.policy.browser_egress,cwd:J.cwd,claim:J.claim,...L?{workspaceGrant:L.promise}:{}}),T=this.hooks.restatLayout();this.hooks.verifyMounts?.();let D=null,A=null;if(J.env){let w=J.claim?.owner??{},v=AJ(await this.openSealed(J.env,J.bind_id),{runId:J.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:J.claim?.root_id??""});this.commandsSinceVerified=!0,D=this.hooks.installEnvironment(J.bind_id,v),A=typeof v.snapshot_id==="string"&&v.snapshot_id?v.snapshot_id:null,$=this.writeJobEnvRootOnly(J.bind_id,v)}if(this.unbinding.has(J.bind_id))throw new F("vm_hands_bind_lost","unbound while binding");return this.bound.set(J.bind_id,{bindId:J.bind_id,runId:J.run_id,sessionId:J.session_id,brainGeneration:J.brain_generation,policyDigest:J.policy.policy_digest,launchId:U,envInstalled:D!==null,rootId:J.claim?.root_id??"",envDirectory:$}),this.binding.delete(J.bind_id),this.grants.delete(J.bind_id),{bind_id:J.bind_id,attempt_id:J.attempt_id,attempt_token:J.attempt_token,launch_id:U,snapshot_revision:D,snapshot_id:A,layout:T,...O?{ready_data:O}:{},policy_digest:m("sha256").update(c({hands_confinement:N.hands_confinement??null,browser_egress:N.browser_egress??null})).digest("hex")}}catch(U){if($)KJ($);if(z){let O=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:J.bind_id,keep:O,own:!0}).catch(()=>{this.unverified.add(J.bind_id)})}this.binding.delete(J.bind_id),this.grants.delete(J.bind_id);let N=U&&typeof U==="object"&&"code"in U&&typeof U.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(U.code)?U.code:"vm_hands_bind_failed";throw U instanceof F?U:new F(N,"executor refused the bind")}}grantWorkspace(J){let Q=this.grants.get(J);if(!Q)throw new F("vm_hands_not_binding","no pre-bind waits for a workspace grant");Q.resolve()}abandonWorkspaceGrant(J){this.grants.get(J)?.reject(new F("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(J){let Q=this.bound.get(J.attemptId);if(!Q||this.unbinding.has(J.attemptId))throw new F("vm_hands_not_bound","environment delivered while not bound");if(!e.test(J.attemptId)||typeof J.snapshotId!=="string"||!J.snapshotId||J.snapshotId.length>128||J.snapshotId.includes("/"))throw new F("vm_hands_env_invalid","bad snapshot id");let $=`${J.attemptId}/${J.snapshotId}`;if(J.sealed?.alg!=="ECDH-P256+A256GCM"||J.sealed.aad!==$)throw new F("vm_hands_env_invalid","bad env envelope");let z=AJ(await this.openSealed(J.sealed,$),{runId:Q.runId,deviceId:J.deviceId,rootId:Q.rootId,snapshotId:J.snapshotId});this.commandsSinceVerified=!0;let L=this.hooks.installEnvironment(Q.bindId,z);if(Q.envInstalled=!0,Q.envDirectory)KJ(Q.envDirectory);return Q.envDirectory=null,Q.envDirectory=this.writeJobEnvRootOnly(`${Q.bindId}-r${L}`,z),{snapshot_id:J.snapshotId,installed_revision:L,installed:!0}}async attestFrame(J,Q){if(this.identity==="identity_free")throw new F("vm_hands_not_registered","attest before register");if(!J||J.length>65536)throw new F("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new F("vm_hands_attest_invalid","attest beside a bind");let $=await this.hooks.runProbe({nonce:Q,script:J});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:Q,exit_code:$.exitCode,markers:$.markers,proof_dir_inode:$.proofDirInode,script_sha256:m("sha256").update(J).digest("hex")}})}executorExited(J){return this.hooks.executorExited?.(J)??new Promise(()=>{})}async boundRefused(J){await this.unbind(J)}async unbind(J){let Q=this.bound.get(J)??null;if(this.unbinding.add(J),this.bound.delete(J),this.abandonWorkspaceGrant(J),Q)try{this.hooks.freezeBind?.(J)}catch{}return this.exclusive(()=>this.tearDown(J,Q))}async retryUnbind(J){if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(J))throw new F("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(J,this.unverifiedTeardowns.get(J)??null,!0)})}async tearDown(J,Q,$=!1){try{this.bound.delete(J);let z=[...this.bound.keys()].filter((U)=>U!==J),L=!z.length&&($||!this.commandsSinceVerified);try{await this.hooks.killAndVerifyPayload(z.length?{bindId:J,keep:z}:L?{bindId:J,own:!0}:void 0)}catch(U){if(this.unverified.add(J),!this.unverifiedTeardowns.has(J))this.unverifiedTeardowns.set(J,Q);throw U}if(this.unverified.delete(J),!z.length&&!$)this.unverified.clear(),this.commandsSinceVerified=!1;if(Q?.envDirectory)KJ(Q.envDirectory);return this.unverifiedTeardowns.delete(J),{bind_id:Q?J:null,killed_verified:!0,shredded:!0,srt_fallbacks:z.length||$?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(J)}}async openSealed(J,Q){let $=()=>{throw new F("vm_hands_env_invalid","env did not decrypt")},z=await crypto.subtle.importKey("spki",b(J.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch($),L=await crypto.subtle.deriveKey({name:"ECDH",public:z},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),U=await crypto.subtle.decrypt({name:"AES-GCM",iv:b(J.iv),additionalData:new TextEncoder().encode(Q)},L,b(J.ct)).catch($),N=JSON.parse(new TextDecoder().decode(U));if(!N||typeof N!=="object"||Array.isArray(N))throw new F("vm_hands_env_invalid","env not an object");return N}writeJobEnvRootOnly(J,Q){let $=t(this.options.envRoot,`bind-${J}`);aJ($,{mode:448});let z=qJ($);if(!z.isDirectory()||(z.mode&63)!==0||z.uid!==(process.getuid?.()??-1))throw new F("vm_hands_env_dir_unsafe","env directory is not root's 0700");let L=Q.variables&&typeof Q.variables==="object"?Q.variables:{},U=Object.entries(L).filter(([T,D])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(T)&&typeof D==="string").map(([T,D])=>`export ${T}='${String(D).replaceAll("'","'\\''")}'`).join(`
 `)+`
 `,N=t($,`.job.env.${WJ(8).toString("hex")}`),O=DJ(N,y.O_WRONLY|y.O_CREAT|y.O_EXCL|y.O_NOFOLLOW,384);try{xJ(O,U),TJ(O)}finally{MJ(O)}return nJ(N,t($,"job.env")),$}}function KJ(J){try{let Q=t(J,"job.env"),$=qJ(Q).size,z=DJ(Q,y.O_WRONLY|y.O_NOFOLLOW);try{xJ(z,Buffer.alloc($)),TJ(z)}finally{MJ(z)}}catch{}tJ(J,{recursive:!0,force:!0})}function $Q(J){if(J.length!==64)throw new F("vm_hands_signature_invalid","unexpected ECDSA signature length");let Q=(L)=>{let U=0;while(U<L.length-1&&L[U]===0)U++;let N=L.subarray(U),O=N[0]&128?Uint8Array.of(0,...N):N;return Uint8Array.of(2,O.length,...O)},$=Q(J.subarray(0,32)),z=Q(J.subarray(32));return Uint8Array.of(48,$.length+z.length,...$,...z)}import{randomUUID as zQ}from"crypto";var XQ="/app/local-runtime/session?register=vm_hands_v1",YQ="/app/local-runtime",wJ=25000,hJ=20000,GQ=1e4,yJ=5000,kJ=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),PJ=75000,WQ=2000,KQ=1e4,FQ=new Set(["vm_hands_no_register","vm_hands_register_failed"]),PQ=3,CQ=20000,NQ=250,UQ=2000;function fJ(J){let Q=Math.min(NQ*2**(J-1),UQ);return Math.round(Q/2+Math.random()*Q/2)}var EQ=5000;function BQ(J){return J>=500||J===408||J===429}var JJ=20000;function HJ(J,Q){return typeof J==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(J)?J:Q}class V extends Error{}var LQ=64,VJ=[1000,2000,4000,8000,15000,30000,60000,120000];function mJ(J){let Q=J&&typeof J==="object"&&"code"in J?J.code:null;return typeof Q==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(Q)?Q:"vm_hands_unbind_failed"}function AQ(J,Q,$,z,L){let U=$.turn.claim.attempt_id,N=J.healing??=new Set;if(N.has(U))return;N.add(U);let O=$.turn.claim.operation_id;(async()=>{for(let[T,D]of VJ.entries()){if(z.aborted)return;if(await new Promise((A)=>{let w=setTimeout(A,D);w.unref?.(),z.addEventListener("abort",()=>{clearTimeout(w),A()},{once:!0})}),z.aborted)return;try{let A=await Q.retryUnbind(U);L("vm_hands.unbind_healed",{operation_id:O,attempt:T+1}),J.receipts.push({...$,unbound:A}),J.flushReceipts?.();return}catch(A){let w=mJ(A);if(L("vm_hands.unbind_unverified",{operation_id:O,code:w,attempt:T+1}),w==="vm_hands_unbind_unknown")return}}L("vm_hands.unbind_heal_exhausted",{operation_id:O,attempts:VJ.length})})().finally(()=>N.delete(U))}async function bJ(J,Q){let $=[...J.modelOps.get(Q)??[]];for(let z of $)z.abort.abort();await Promise.race([Promise.all($.map((z)=>z.settled)),new Promise((z)=>setTimeout(z,yJ))])}async function _Q(J){let Q=[...J.personTerminals];for(let $ of Q)$.abort.abort();if(Q.length)await Promise.race([Promise.all(Q.map(($)=>$.settled)),new Promise(($)=>setTimeout($,yJ))]);return Q.length}async function p(J,Q,$){return await bJ(J,$),Q.unbind($)}function QJ(J){for(let Q of J.outbox?.splice(0)??[])Q.reject(Error("vm_hands_attempt_ended"))}var vJ=15000,OQ=1e4,jQ=1000;async function vQ(J){let Q=Date.now(),$={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:0},z=J.log??(()=>{}),L=async(O)=>{for(let[T,D]of[...$.turns]){$.turns.delete(T),J.onTurn?.(T,null),QJ(D);let A=await p($,J.agent,T).catch(()=>null);if(A)$.receipts.push({turn:D,failure:"vm_hands_bind_lost",unbound:A});z("vm_hands.bound_dropped",{reason:O})}},U=0,N=0;try{for(let O=0;!J.signal.aborted;O++){let T=await MQ(J,$).catch((A)=>{if(A instanceof F&&$.deviceId===null&&A.code==="vm_hands_no_session"&&Date.now()-Q<KQ)return{closeCode:0,closeReason:"vm_hands_no_session"};if(A instanceof F&&$.deviceId===null&&FQ.has(A.code)&&U<PQ&&Date.now()-Q<CQ)return U++,N=fJ(U),z("vm_hands.register_retry",{attempt:U,code:A.code,delay_ms:N}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(A instanceof F&&$.deviceId===null)throw A;return{closeCode:0,closeReason:A instanceof Error?A.message:String(A)}});if(z("vm_hands.session_closed",{close_code:T.closeCode,reason:T.closeReason.slice(0,120),registered:$.deviceId!==null}),T.closeCode===4401||$.attest==="refused")return;if(J.signal.aborted)return;if($.turns.size&&Date.now()-$.lostAt>=PJ)await L("reconnect_deadline");if($.served)$.served=!1,O=0;let D=T.closeReason==="drain_reconnect"?0:T.closeReason==="vm_hands_register_retry"?N:T.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(O,5),2000):$.turns.size?Math.min(250*2**Math.min(O,5),5000,Math.max(0,$.lostAt+PJ-Date.now())):Math.min(500*2**O,30000);if(await new Promise((A)=>setTimeout(A,D)),$.turns.size&&Date.now()-$.lostAt>=PJ)await L("reconnect_deadline")}}finally{await L("session_ended")}}async function MQ(J,Q){let $=Q.deviceId,z=J.log??(()=>{}),L=$?`/app/local-runtime/session?device_id=${encodeURIComponent($)}`:XQ,U=`${J.apiOrigin.replace(/^http/,"ws")}${L}`,N=new WebSocket(U),O=0,T="",D=new Map,A=[],w=null,v=new Promise((Z)=>{N.onclose=(Y)=>{O=Y.code,T=Y.reason;for(let X of D.values())X.reject(new V(`session closed ${Y.code}`));for(let X of Q.attestWaiters.splice(0))X(!1);D.clear(),Z()}});N.onmessage=(Z)=>{let Y;try{Y=JSON.parse(String(Z.data))}catch{N.close(4400);return}if(Y.t==="res"){let X=Y;D.get(X.id)?.resolve({status:X.status,body:X.body}),D.delete(X.id);return}if(Y.t==="reconnect"){let X=Math.max(0,Math.min(Number(Y.after_ms)||0,jQ));z("vm_hands.drain_reconnect",{after_ms:X}),setTimeout(()=>{try{N.close(4001,"drain_reconnect")}catch{}},X).unref?.();return}if(!w?.(Y))A.push(Y)};let l=(Z,Y)=>new Promise((X,K)=>{let C=A.findIndex((B)=>Z.includes(B.t));if(C>=0){X(A.splice(C,1)[0]);return}let E=setTimeout(()=>{w=null,K(new F("vm_hands_no_register",`no ${Z.join("/")} in ${Y} ms`))},Y);w=(B)=>{if(!Z.includes(B.t))return!1;return clearTimeout(E),w=null,X(B),!0}}),u=(Z)=>N.send(JSON.stringify(Z)),k=(Z,Y)=>new Promise((X,K)=>{if(N.readyState!==WebSocket.OPEN){K(new V("session closed"));return}let C=zQ(),E=typeof Y.wait_ms==="number"?Y.wait_ms:0,B=setTimeout(()=>{if(!D.delete(C))return;K(new V(`no answer to ${Z.split("/").pop()} in ${E+vJ} ms`)),N.close(4000,"request_timeout")},E+vJ);D.set(C,{reject:(G)=>{clearTimeout(B),K(G)},resolve:({status:G,body:W})=>{clearTimeout(B);let P=null;try{P=W?JSON.parse(W):null}catch{}X({status:G,json:P})}}),u({t:"req",id:C,path:`${YQ}${Z}`,body:JSON.stringify(Y)})}),CJ=()=>N.close(1001,"stopping");J.signal.addEventListener("abort",CJ,{once:!0});let ZJ,o=new Map,d=new Map,$J=!1,zJ=new Set,XJ=new Set,YJ=Promise.resolve(),NJ=()=>{r().catch(()=>{return})},i=!1;try{await new Promise((G,W)=>{let P=setTimeout(()=>W(Error("session open timeout")),OQ);N.onopen=()=>{clearTimeout(P),z("vm_hands.ws_open",{}),G()},N.onerror=()=>{clearTimeout(P),W(Error("session socket error"))}});let Z=await l(["challenge"],5000);z("vm_hands.challenge",{});let Y=[],X=null,K;if($){u(await J.agent.helloFrame(Z.challenge,Q.connection));let G=await l(["ready"],1e4);if(typeof G.vm_hands_connection==="string")Q.connection=G.vm_hands_connection;if(K={device_id:$,...G.cadence?{cadence:G.cadence}:{}},typeof G.vm_hands_probe_script==="string"){if(X=G.vm_hands_probe_script,i=!0,J.agent.phase==="registered"&&!Q.turns.size)Q.attest="pending"}Q.served=!0,z("vm_hands.reconnected",{device_id:$});let W=Array.isArray(G.vm_hands_binds)?G.vm_hands_binds:G.vm_hands_bind?[G.vm_hands_bind]:[];for(let[P,M]of[...Q.turns]){if(W.some((x)=>x&&x.operation_id===M.claim.operation_id&&x.attempt_id===M.claim.attempt_id)){Y.push(M),z("vm_hands.bound_resumed",{operation_id:M.claim.operation_id});continue}Q.turns.delete(P),J.onTurn?.(P,null),QJ(M);let q=await p(Q,J.agent,P).catch((x)=>s(x,M,"vm_hands_bind_lost"));if(q)Q.receipts.push({turn:M,failure:"vm_hands_bind_lost",unbound:q});z("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{u(await J.agent.registerFrame(Z.challenge)),z("vm_hands.register_sent",{});let G=await Promise.race([l(["registered","register_refused"],1e4),v.then(()=>{throw new F(T==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(G.t==="register_refused")throw new F(G.code,"register refused");J.agent.registered();let W=G;if(K=W,Q.deviceId=W.device_id,typeof W.vm_hands_connection==="string")Q.connection=W.vm_hands_connection;if(typeof W.vm_hands_probe_script==="string"){if(X=W.vm_hands_probe_script,i=!0,J.agent.phase==="registered"&&!Q.turns.size)Q.attest="pending"}Q.served=!0,z("vm_hands.registered",{device_id:K.device_id})}let C=async()=>{let G=await k("/heartbeat",await J.heartbeat());if(G.status>=300)throw Error(`heartbeat ${G.status}`)};await C();let E=K.cadence?.presence_interval_ms??30000;if(ZJ=setInterval(()=>{C().catch(()=>N.close())},E),X&&Q.attest!=="accepted"&&J.agent.phase==="registered"&&!Q.turns.size)pJ(X,Z.challenge);let B=(G,W)=>{d.set(G,W().catch(async(P)=>{if(await UJ(P,G),P instanceof V)N.close();else await r().catch(()=>{return})}).finally(()=>{d.delete(G)}))};Q.flushReceipts=NJ;try{await r();for(let G of Y)G.flush=()=>EJ(G),G.flush(),B(G.claim.attempt_id,()=>BJ(G));while(!J.signal.aborted&&N.readyState===WebSocket.OPEN){let G=await k("/operations/claim",{wait_ms:Math.min(K.cadence?.claim_wait_ms??wJ,wJ)});if(G.status===204||!G.json)continue;if(G.status>=300)throw Error(`claim ${G.status}`);let W=G.json;if(W.capability==="hands.connect"){if(d.has(W.attempt_id)){h({claim:W,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}B(W.attempt_id,()=>lJ(W))}else oJ(W).catch(()=>{return})}}catch(G){await UJ(G,null)}}finally{if(ZJ)clearInterval(ZJ);J.signal.removeEventListener("abort",CJ);for(let Z of Q.turns.values())Z.flush=null;if(Q.flushReceipts===NJ)Q.flushReceipts=null;N.close(),await v,await Promise.all([...d.values()]);for(let Z of J.agent.liveBindIds){if(Q.turns.has(Z))continue;let Y=o.get(Z),X=Y?{...Y,eventSeq:Y.eventSeq+1}:null,K=await p(Q,J.agent,Z).catch((C)=>X?s(C,X,"vm_hands_bind_lost"):null);if(K&&X)Q.receipts.push({turn:X,failure:"vm_hands_bind_lost",unbound:K});z("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let Z of zJ)Z.abort()}return{closeCode:O,closeReason:T};async function UJ(Z,Y){if(Z instanceof V){if(!$J&&Q.turns.size)Q.lostAt=Date.now();$J=!0}else{let X=Y!==null?[Y]:[...new Set([...Q.turns.keys(),...J.agent.liveBindIds])];if(Y===null)$J=!0;for(let K of X){let C=Q.turns.get(K);if(Q.turns.delete(K),C)QJ(C),J.onTurn?.(K,null);if(J.agent.liveBindIds.includes(K)){let E=o.get(K)??C,B=E?{...E,eventSeq:E.eventSeq+1}:null,G=await p(Q,J.agent,K).catch((W)=>B?s(W,B,"vm_hands_bind_lost"):null);if(G&&B)Q.receipts.push({turn:B,failure:"vm_hands_bind_lost",unbound:G})}}}z("vm_hands.session_lost",{error:Z instanceof Error?Z.message:String(Z),bound_kept:Q.turns.size})}function h(Z){let Y=Z.claim,X={attempt_id:Y.attempt_id,attempt_token:Y.attempt_token},K=encodeURIComponent(Y.operation_id);return{fence:X,op:K,complete:(E,B={})=>k(`/operations/${K}/complete`,{...X,status:E,...B}),emit:(E,B)=>{let G=(Z.chain??Promise.resolve()).catch(()=>{return}).then(()=>C(E,B));return Z.chain=G,G}};async function C(E,B){let G=Z.eventSeq,W=(x)=>k(`/operations/${K}/events`,{...X,event_seq_start:x,events:[{kind:E,payload:{sequence:x,capability:String(Y.capability??"hands.connect"),data:B}}]}),P=G,M=await W(P),q=M.status===409?M.json?.expected_event_seq:void 0;if(typeof q==="number"&&q===G+1)M={status:200,json:{duplicate:!0}};else if(typeof q==="number"&&q>=0&&q!==G)P=q,M=await W(P);if(M.status<300)Z.eventSeq=P+1;return M}}function cJ(Z){return(Y,X)=>new Promise((K,C)=>{if(Q.turns.get(Z.claim.attempt_id)!==Z){C(Error("vm_hands_attempt_ended"));return}if(Z.outbox??=[],Z.outbox.length>=LQ){C(Error("vm_hands_outbox_full"));return}Z.outbox.push({kind:Y,data:X,resolve:K,reject:C}),Z.flush?.()})}function EJ(Z){if(XJ.has(Z))return;XJ.add(Z),(async()=>{try{while(Z.outbox?.length&&Q.turns.get(Z.claim.attempt_id)===Z&&N.readyState===WebSocket.OPEN){let Y=Z.outbox[0],X;try{X=await h(Z).emit(Y.kind,Y.data)}catch(K){if(K instanceof V)return;X={status:500}}if(Z.outbox.shift(),X.status<300)Y.resolve();else Y.reject(Error(`${Y.kind} refused ${X.status}`))}}finally{XJ.delete(Z)}})()}async function pJ(Z,Y){try{let X=await J.agent.attestFrame(Z,Y);if(N.readyState!==WebSocket.OPEN)return;u(X);let K=await l(["attested","attest_refused"],15000);Q.attest=K.t==="attested"?"accepted":"refused";for(let C of Q.attestWaiters.splice(0))C(Q.attest==="accepted");if(z("vm_hands.attest",{result:Q.attest,exit_code:X.exit_code,...K.t==="attest_refused"?{code:String(K.code??"")}:{}}),Q.attest==="refused")N.close(4401,"attest_refused")}catch(X){z("vm_hands.attest_failed",{code:X instanceof F?X.code:"probe_error"});for(let K of Q.attestWaiters.splice(0))K(!1);if(Q.attest!=="accepted")N.close(4000,"attest_unanswered")}}async function lJ(Z){let Y=i&&Q.attest==="pending",X=Z.vm_hands_attest,K=X;if(Q.attest==="refused"){z("vm_hands.claim_attest_refused",{said:typeof X==="string"?X.slice(0,16):typeof X,local:Q.attest}),await h({claim:Z,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(K==="accepted"){if(!Y&&Q.attest!=="accepted"){Q.attest="accepted";for(let _ of Q.attestWaiters.splice(0))_(!0)}}else if(K!=="pending"||!Y&&Q.attest!=="accepted"){z("vm_hands.claim_attest_refused",{said:typeof X==="string"?X.slice(0,16):typeof X,local:Q.attest}),await h({claim:Z,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(Q.attest!=="accepted"){let _=Date.parse(Z.lease_until)-Date.now()-5000,H=Math.max(0,Math.min(JJ,Number.isFinite(_)?_:JJ));if(!await new Promise((n)=>{let sJ=setTimeout(()=>n(!1),H);Q.attestWaiters.push((rJ)=>{clearTimeout(sJ),n(rJ)})})){await h({claim:Z,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let C={claim:Z,eventSeq:0},{complete:E,emit:B}=h(C),G;try{if(Z.capability!=="hands.connect")throw new F("vm_hands_bind_invalid","not hands.connect");G=!FJ(Z)}catch(_){z("vm_hands.bind_refused",{code:_ instanceof F?_.code:"unexpected"}),await E("failed",{error_code:_ instanceof F?_.code:"vm_hands_bind_invalid"});return}let W,P=null,M=!1;Q.bindsStarting++;try{let _=await _Q(Q);if(_)z("vm_hands.person_terminals_closed",{count:_});let H=SJ(Z),a=J.agent.bind(H);if(H.workspace_deferred)M=!0,P=uJ(C,()=>M);W=await a}catch(_){z("vm_hands.bind_refused",{code:_ instanceof F?_.code:"unexpected"}),await E("failed",{error_code:_ instanceof F?_.code:"vm_hands_bind_failed"});return}finally{M=!1,Q.bindsStarting--}let q=P?await P:-1,x={...W.ready_data??J.readyData({launchId:W.launch_id,claim:Z})};if(G)delete x.environment_installed;let GJ=!G&&W.snapshot_revision!==null&&W.snapshot_id!==null?{environment_installed:{snapshot_id:W.snapshot_id,installed_revision:W.snapshot_revision}}:{};o.set(Z.attempt_id,{claim:Z,launchId:W.launch_id,readyData:x,eventSeq:C.eventSeq,ackSeq:-1});let g={...x,...GJ,vm_hands:{layout:W.layout,policy_digest:W.policy_digest,launch_id:W.launch_id}},f=Date.now()+EQ,R=1,j=await B("hands.ready",g);while(BQ(j.status)&&!J.signal.aborted){let _=fJ(R);if(Date.now()+_>=f)break;await new Promise((H)=>setTimeout(H,_)),R++,j=await B("hands.ready",g)}if(R>1)z("vm_hands.ready_retried",{attempts:R,status_class:`${Math.floor(j.status/100)}xx`});if(o.delete(Z.attempt_id),j.status>=300){await bJ(Q,Z.attempt_id),await J.agent.boundRefused(Z.attempt_id),await E("failed",{error_code:HJ(j.json?.error,"vm_hands_probe_failed")});return}let S={claim:Z,launchId:W.launch_id,readyData:x,eventSeq:C.eventSeq,ackSeq:q};Q.turns.set(Z.attempt_id,S),S.flush=()=>EJ(S),J.onTurn?.(Z.attempt_id,cJ(S)),await BJ(S)}async function uJ(Z,Y){let{fence:X,op:K}=h(Z),C=Z.claim.attempt_id,E=-1;try{for(;;){let B=await k(`/operations/${K}/heartbeat`,{...X,control_ack_seq:E,wait_ms:hJ});if(!Y())return E;if(B.status>=300)return J.agent.abandonWorkspaceGrant(C),E;let G=(B.json?.controls??[]).slice().sort((W,P)=>W.seq-P.seq);for(let W of G){if(W.seq<=E)continue;if(E=W.seq,W.kind===RJ)return z("vm_hands.workspace_granted",{}),J.agent.grantWorkspace(C),E;return z("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(W.kind)?W.kind:"other"}),J.agent.abandonWorkspaceGrant(C),E}}}catch{return J.agent.abandonWorkspaceGrant(C),E}}async function BJ(Z){let{fence:Y,op:X}=h(Z),K=null,C=null,E=J.agent.executorExited(Z.claim.attempt_id).then((B)=>{return C=B,null});J:for(;;){let B=await Promise.race([E,k(`/operations/${X}/heartbeat`,{...Y,control_ack_seq:Z.ackSeq,wait_ms:hJ})]);if(!B){K="vm_hands_executor_exited",z("vm_hands.executor_exited",{reason:C});break}if(B.status>=300)break;let G=(B.json?.controls??[]).slice().sort((W,P)=>W.seq-P.seq);for(let W of G){if(W.seq<=Z.ackSeq)continue;if(W.kind==="operation.cancel"||W.kind==="cancel"){Z.ackSeq=W.seq;break J}if(W.kind===gJ)try{await iJ(Z,W.payload??{})}catch(P){if(P instanceof V)throw P;K=P instanceof F?P.code:"environment_unavailable";let M=P&&typeof P==="object"&&"code"in P&&typeof P.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(P.code)?P.code:null;z("vm_hands.environment_refused",{code:K,cause:M});break J}Z.ackSeq=W.seq}}await dJ(Z,K)}async function oJ(Z){let Y=Z,X={claim:Y,eventSeq:0},{complete:K,emit:C,fence:E,op:B}={...h(X)},G=Z.vm_hands_origin==="person"?"person":"model",W=String(Z.capability??"");if(!J.executeOp){await K("failed",{error_code:"vm_hands_op_unsupported"});return}if(Z.vm_hands_attest==="accepted"&&Q.attest==="pending"&&!(i&&Q.attest==="pending")){Q.attest="accepted";for(let j of Q.attestWaiters.splice(0))j(!0)}if(Q.attest!=="accepted"){let j=Date.parse(String(Z.lease_until??""))-Date.now()-5000,S=Q.attest==="refused"?0:Math.max(0,Math.min(JJ,Number.isFinite(j)?j:JJ));if(!(S>0&&await new Promise((H)=>{let a=setTimeout(()=>H(!1),S);Q.attestWaiters.push((n)=>{clearTimeout(a),H(n)})}))){await K("failed",{error_code:"vm_hands_unattested"});return}}let P=J.agent.bindIdForRun(Y.run_id);if(G==="model"&&P===null){await K("failed",{error_code:"vm_hands_not_bound"});return}let M=W==="pty.start"&&G==="person"&&!Z.authority;if(M&&(J.agent.liveBindIds.length>0||Q.bindsStarting>0)){await K("failed",{error_code:"vm_hands_bound"});return}if(kJ.has(W)&&!M&&J.agent.liveBindIds.length===0){await K("failed",{error_code:"vm_hands_not_bound"});return}if(G==="model"&&P||kJ.has(W)&&!M)J.agent.opServed();let q=new AbortController;zJ.add(q);let x,GJ=new Promise((j)=>{x=j}),g={abort:q,settled:GJ};if(M)Q.personTerminals.add(g);if(G==="model"&&P){let j=Q.modelOps.get(P)??new Set;j.add(g),Q.modelOps.set(P,j),await J.agent.environmentInstalled(P,WQ,q.signal)}let f=-1,R=setInterval(()=>{k(`/operations/${B}/heartbeat`,{...E,control_ack_seq:f,wait_ms:0}).then((j)=>{if(j.status>=300){q.abort();return}let S=j.json?.controls??[];for(let _ of S)if(f=Math.max(f,_.seq),_.kind==="operation.cancel"||_.kind==="cancel")q.abort()},()=>q.abort())},GQ);try{let j=await J.executeOp({kind:G,claim:Z,...G==="model"&&P?{bindId:P}:{},signal:q.signal,emit:async(_)=>{await C(_.kind,_.data??{})}}),S=await K(j.status,{...j.result?{result:j.result}:{},...j.error_code?{error_code:HJ(j.error_code,"vm_hands_op_failed")}:{}});z("vm_hands.op",{capability:W,kind:G,status:j.status,code:j.error_code??null,...S.status>=300?{complete_status:S.status,complete_error:String(S.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval(R),zJ.delete(q),P)Q.modelOps.get(P)?.delete(g);Q.personTerminals.delete(g),x()}}async function dJ(Z,Y){let X=Z.claim.attempt_id;if(Q.turns.get(X)===Z)Q.turns.delete(X);J.onTurn?.(X,null),QJ(Z);let K=await p(Q,J.agent,X).catch((C)=>s(C,Z,Y));if(!K)return;Q.receipts.push({turn:Z,failure:Y,unbound:K}),await r()}function s(Z,Y,X){let K=mJ(Z);return z("vm_hands.unbind_unverified",{operation_id:Y.claim.operation_id,code:K,attempt:0}),h(Y).emit(IJ,{code:K}).catch(()=>{return}),AQ(Q,J.agent,{turn:Y,failure:X},J.signal,z),null}function r(){return YJ=YJ.then(LJ,LJ),YJ}async function LJ(){while(Q.receipts.length){let{turn:Z,failure:Y,unbound:X}=Q.receipts[0],{complete:K,emit:C}=h(Z);try{if(await C("hands.stopped",{...Z.readyData,reason_code:Y?"failed":"cancelled",killed_verified:X.killed_verified,shredded:X.shredded,...X.srt_fallbacks?{vm_hands_srt_fallbacks:X.srt_fallbacks}:{}}),Y)await K("failed",{error_code:Y});else await K("cancelled",{error_code:"driver_stopped"})}catch(E){if(E instanceof V)return}Q.receipts.shift()}}async function iJ(Z,Y){let{fence:X,op:K}=h(Z),C=Y.snapshot_id;if(Y.version!==1||typeof C!=="string"||Object.keys(Y).length!==2)throw new F("vm_hands_env_invalid","invalid environment delivery");let E=await k(`/operations/${K}/environment`,{...X,snapshot_id:C}),B=E.json?.environment_sealed;if(E.status!==200||!B||E.json?.payload!==void 0)throw new F("vm_hands_env_invalid","environment not delivered sealed");let G=await J.agent.deliverEnvironment({attemptId:Z.claim.attempt_id,snapshotId:C,deviceId:Q.deviceId??"",sealed:B});if((await k(`/operations/${K}/environment-ack`,{...X,...G})).status>=300)throw new F("vm_hands_env_ack_refused","environment ack refused")}}
-export{SQ as xa,ZQ as ya,vQ as za};
+export{SQ as za,ZQ as Aa,vQ as Ba};

package/bin/vm-hands/{vm-hands-entry-lite-g7h6wjqy.js → vm-hands-entry-lite-nqvb7a2m.js}

@@ -1,3 +1,3 @@
 // @bun
 import{spawn as N}from"child_process";import{statSync as O}from"fs";import{delimiter as Q,join as R}from"path";function X(q,z=process.env.PATH??"",D=process.env,G=process.platform){let A=G==="win32",H=q.includes("/")||A&&q.includes("\\");if(!q||H||q.includes("\x00"))return!1;let I=A?["",...(D.PATHEXT??".EXE;.CMD;.BAT;.COM").split(";")]:[""];return z.split(Q).some((C)=>{if(!C)return!1;return I.some((E)=>{if(E===void 0)return!1;try{let J=O(R(C,`${q}${E}`));if(!J.isFile())return!1;return A||(J.mode&73)!==0}catch{return!1}})})}async function K(q){if(!q)return"";let z=[];try{for await(let D of q)z.push(Buffer.from(D))}catch{}return Buffer.concat(z).toString("utf8")}async function Y(q,z){let[D,...G]=q;if(!D)throw Error("A child process probe requires a program.");if(z.signal?.aborted)return{exitCode:-1,stdout:"",stderr:""};let A=N(D,G,{stdio:["ignore","pipe","pipe"],...z.env?{env:z.env}:{}}),H=K(A.stdout),I=K(A.stderr),C=()=>{try{A.kill()}catch{}};if(z.signal?.aborted)C();else z.signal?.addEventListener("abort",C,{once:!0});let E;try{return{exitCode:await Promise.race([new Promise((F)=>{A.once("error",()=>F(-1)),A.once("close",(M)=>F(M??-1))}),new Promise((F)=>{E=setTimeout(()=>{C(),F(-1)},z.timeoutMs)})]),stdout:await H,stderr:await I}}finally{if(E)clearTimeout(E);z.signal?.removeEventListener("abort",C)}}function Z(q){if(!(q>0))return;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,q)}
-export{X as dd,Y as ed,Z as fd};
+export{X as fd,Y as gd,Z as hd};

package/bin/vm-hands/{vm-hands-entry-lite-ew7amfaf.js → vm-hands-entry-lite-qg11k3bf.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Mk as l}from"./vm-hands-entry-lite-hkvkfq0z.js";import{execFile as zj,spawn as I}from"child_process";var Cj="h264_ws_v1",kj="video",h=["smooth","sharp","data_saver","balanced"];var Yj="video_presets";var V=8388608,Y=65536,Lj="control",Aj="v1",d=200;function s(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q,J=(Q)=>typeof Q==="string"&&Q.length>0&&Q.length<=d;if(Object.keys(j).length!==2||!J(j.user_id)||!J(j.name))return null;return{user_id:j.user_id,name:j.name}}var xj="windows",Mj="v1",A=200,o=(q)=>typeof q==="string"&&h.includes(q);function fj(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q;if(Object.keys(j).length!==2||j.format!=="h264_ws_v1"||!o(j.preset))return null;return{format:"h264_ws_v1",preset:j.preset}}var $={hello:1,frame:2,stats:3,pong:4,serverClipboard:5,error:6,audioHello:7,audio:8,control:9,windows:10,pointer:16,key:17,config:18,ping:19,clientClipboard:20,keyframeRequest:21,ack:22,audioEnable:23};class U extends Error{constructor(q){super(q);this.name="DisplayVideoProtocolError"}}var e=new TextEncoder,jj=new TextDecoder("utf-8",{fatal:!0});function H(q,j){if(j.byteLength+1>V)throw new U("message_too_large");let J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,j.byteLength+1),Q.setUint8(4,q),J.set(j,5),J}function R(q){let j=e.encode(q);if(j.byteLength>Y)throw new U("text_too_large");return j}function f(q,j){if(!Number.isInteger(q)||q<0||q>65535)throw new U(`invalid_${j}`);return q}function qj(q){if(!Number.isFinite(q))throw new U("invalid_window");return Math.max(-2147483648,Math.min(2147483647,Math.round(q)))}function hj(q){switch(q.type){case"hello":{let j=R(q.codec),J=new Uint8Array(6+j.byteLength),Q=new DataView(J.buffer);return Q.setUint16(0,f(q.width,"width")),Q.setUint16(2,f(q.height,"height")),Q.setUint8(4,Math.max(1,Math.min(240,Math.round(q.fps)))),Q.setUint8(5,h.indexOf(q.preset)),J.set(j,6),H($.hello,J)}case"frame":{let j=new Uint8Array(13+q.data.byteLength),J=new DataView(j.buffer);return J.setUint8(0,q.key?1:0),J.setUint32(1,q.seq>>>0),J.setBigUint64(5,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,13),H($.frame,j)}case"stats":return H($.stats,R(JSON.stringify(q.stats)));case"pong":case"ping":{let j=new Uint8Array(8);return new DataView(j.buffer).setFloat64(0,q.token),H(q.type==="ping"?$.ping:$.pong,j)}case"serverClipboard":return H($.serverClipboard,R(q.text));case"clientClipboard":return H($.clientClipboard,R(q.text));case"error":return H($.error,R(q.code));case"pointer":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint16(0,f(q.x,"x")),J.setUint16(2,f(q.y,"y")),J.setUint8(4,q.buttons&255),H($.pointer,j)}case"key":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint8(0,q.down?1:0),J.setUint32(1,q.keysym>>>0),H($.key,j)}case"config":return H($.config,Uint8Array.of(h.indexOf(q.preset)));case"keyframeRequest":return H($.keyframeRequest,new Uint8Array(0));case"audioHello":{let j=R(q.codec),J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,q.sampleRate>>>0),Q.setUint8(4,q.channels&255),J.set(j,5),H($.audioHello,J)}case"audio":{let j=new Uint8Array(8+q.data.byteLength);return new DataView(j.buffer).setBigUint64(0,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,8),H($.audio,j)}case"control":return H($.control,R(JSON.stringify(q.control)));case"windows":{let j=q.bounds.slice(0,A),J=new Uint8Array(j.length*16),Q=new DataView(J.buffer);return j.forEach((Z,z)=>{[Z.x,Z.y,Z.width,Z.height].forEach((G,F)=>Q.setInt32(z*16+F*4,qj(G)))}),H($.windows,J)}case"audioEnable":return H($.audioEnable,Uint8Array.of(q.on?1:0));case"ack":{let j=new Uint8Array(4);return new DataView(j.buffer).setUint32(0,q.seq>>>0),H($.ack,j)}}}function T(q){let j=h[q];if(!j)throw new U("invalid_preset");return j}function C(q,j){if(q.byteLength!==j)throw new U("invalid_length")}function k(q){if(q.byteLength>Y)throw new U("text_too_large");try{return jj.decode(q)}catch{throw new U("invalid_text")}}function Jj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_stats")}let J=j;if(!J||typeof J!=="object"||["fps","kbps","dropped","restarts","queued_bytes"].some((Z)=>typeof J[Z]!=="number"||!Number.isFinite(J[Z])))throw new U("invalid_stats");return{fps:J.fps,kbps:J.kbps,dropped:J.dropped,restarts:J.restarts,queued_bytes:J.queued_bytes}}function Qj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_control")}let J=j;if(!J||typeof J!=="object"||typeof J.you!=="boolean"||typeof J.same_user!=="boolean")throw new U("invalid_control");let Q=J.holder===null?null:s(J.holder);if(Q===null&&J.holder!==null)throw new U("invalid_control");return{holder:Q,you:J.you,same_user:J.same_user}}function Zj(q,j){let J=new DataView(j.buffer,j.byteOffset,j.byteLength);switch(q){case $.hello:if(j.byteLength<6)throw new U("invalid_length");return{type:"hello",width:J.getUint16(0),height:J.getUint16(2),fps:J.getUint8(4),preset:T(J.getUint8(5)),codec:k(j.subarray(6))};case $.frame:if(j.byteLength<14)throw new U("invalid_length");if(J.getUint8(0)>1)throw new U("invalid_frame_flags");return{type:"frame",key:J.getUint8(0)===1,seq:J.getUint32(1),captureMicros:Number(J.getBigUint64(5)),data:j.subarray(13)};case $.stats:return{type:"stats",stats:Jj(j)};case $.ping:case $.pong:return C(j,8),{type:q===$.ping?"ping":"pong",token:J.getFloat64(0)};case $.serverClipboard:return{type:"serverClipboard",text:k(j)};case $.clientClipboard:return{type:"clientClipboard",text:k(j)};case $.error:return{type:"error",code:k(j)};case $.pointer:return C(j,5),{type:"pointer",x:J.getUint16(0),y:J.getUint16(2),buttons:J.getUint8(4)};case $.key:if(C(j,5),J.getUint8(0)>1)throw new U("invalid_key_flags");return{type:"key",down:J.getUint8(0)===1,keysym:J.getUint32(1)};case $.config:return C(j,1),{type:"config",preset:T(J.getUint8(0))};case $.keyframeRequest:return C(j,0),{type:"keyframeRequest"};case $.audioHello:if(j.byteLength<5)throw new U("invalid_length");return{type:"audioHello",sampleRate:J.getUint32(0),channels:J.getUint8(4),codec:k(j.subarray(5))};case $.audio:if(j.byteLength<9)throw new U("invalid_length");return{type:"audio",captureMicros:Number(J.getBigUint64(0)),data:j.subarray(8)};case $.audioEnable:if(C(j,1),J.getUint8(0)>1)throw new U("invalid_audio_flags");return{type:"audioEnable",on:J.getUint8(0)===1};case $.control:return{type:"control",control:Qj(j)};case $.windows:{if(j.byteLength%16!==0||j.byteLength>A*16)throw new U("invalid_length");let Q=[];for(let Z=0;Z<j.byteLength;Z+=16)Q.push({x:J.getInt32(Z),y:J.getInt32(Z+4),width:J.getInt32(Z+8),height:J.getInt32(Z+12)});return{type:"windows",bounds:Q}}case $.ack:return C(j,4),{type:"ack",seq:J.getUint32(0)};default:return null}}class $j{buffer=new Uint8Array(0);push(q){let j=new Uint8Array(this.buffer.byteLength+q.byteLength);j.set(this.buffer),j.set(q,this.buffer.byteLength);let J=[],Q=0;while(j.byteLength-Q>=4){let Z=new DataView(j.buffer,j.byteOffset+Q,4).getUint32(0);if(Z<1||Z>V)throw new U("invalid_message_length");if(j.byteLength-Q-4<Z)break;let z=j[Q+4],G=j.slice(Q+5,Q+4+Z),F=Zj(z,G);if(F)J.push(F);Q+=4+Z}return this.buffer=j.slice(Q),J}}var t="/usr/bin/osascript",Gj=5000,Kj=1048576,Uj=String.raw`
+import{Pk as l}from"./vm-hands-entry-lite-f28ehysx.js";import{execFile as zj,spawn as I}from"child_process";var Cj="h264_ws_v1",kj="video",h=["smooth","sharp","data_saver","balanced"];var Yj="video_presets";var V=8388608,Y=65536,Lj="control",Aj="v1",d=200;function s(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q,J=(Q)=>typeof Q==="string"&&Q.length>0&&Q.length<=d;if(Object.keys(j).length!==2||!J(j.user_id)||!J(j.name))return null;return{user_id:j.user_id,name:j.name}}var xj="windows",Mj="v1",A=200,o=(q)=>typeof q==="string"&&h.includes(q);function fj(q){if(!q||typeof q!=="object"||Array.isArray(q))return null;let j=q;if(Object.keys(j).length!==2||j.format!=="h264_ws_v1"||!o(j.preset))return null;return{format:"h264_ws_v1",preset:j.preset}}var $={hello:1,frame:2,stats:3,pong:4,serverClipboard:5,error:6,audioHello:7,audio:8,control:9,windows:10,pointer:16,key:17,config:18,ping:19,clientClipboard:20,keyframeRequest:21,ack:22,audioEnable:23};class U extends Error{constructor(q){super(q);this.name="DisplayVideoProtocolError"}}var e=new TextEncoder,jj=new TextDecoder("utf-8",{fatal:!0});function H(q,j){if(j.byteLength+1>V)throw new U("message_too_large");let J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,j.byteLength+1),Q.setUint8(4,q),J.set(j,5),J}function R(q){let j=e.encode(q);if(j.byteLength>Y)throw new U("text_too_large");return j}function f(q,j){if(!Number.isInteger(q)||q<0||q>65535)throw new U(`invalid_${j}`);return q}function qj(q){if(!Number.isFinite(q))throw new U("invalid_window");return Math.max(-2147483648,Math.min(2147483647,Math.round(q)))}function hj(q){switch(q.type){case"hello":{let j=R(q.codec),J=new Uint8Array(6+j.byteLength),Q=new DataView(J.buffer);return Q.setUint16(0,f(q.width,"width")),Q.setUint16(2,f(q.height,"height")),Q.setUint8(4,Math.max(1,Math.min(240,Math.round(q.fps)))),Q.setUint8(5,h.indexOf(q.preset)),J.set(j,6),H($.hello,J)}case"frame":{let j=new Uint8Array(13+q.data.byteLength),J=new DataView(j.buffer);return J.setUint8(0,q.key?1:0),J.setUint32(1,q.seq>>>0),J.setBigUint64(5,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,13),H($.frame,j)}case"stats":return H($.stats,R(JSON.stringify(q.stats)));case"pong":case"ping":{let j=new Uint8Array(8);return new DataView(j.buffer).setFloat64(0,q.token),H(q.type==="ping"?$.ping:$.pong,j)}case"serverClipboard":return H($.serverClipboard,R(q.text));case"clientClipboard":return H($.clientClipboard,R(q.text));case"error":return H($.error,R(q.code));case"pointer":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint16(0,f(q.x,"x")),J.setUint16(2,f(q.y,"y")),J.setUint8(4,q.buttons&255),H($.pointer,j)}case"key":{let j=new Uint8Array(5),J=new DataView(j.buffer);return J.setUint8(0,q.down?1:0),J.setUint32(1,q.keysym>>>0),H($.key,j)}case"config":return H($.config,Uint8Array.of(h.indexOf(q.preset)));case"keyframeRequest":return H($.keyframeRequest,new Uint8Array(0));case"audioHello":{let j=R(q.codec),J=new Uint8Array(5+j.byteLength),Q=new DataView(J.buffer);return Q.setUint32(0,q.sampleRate>>>0),Q.setUint8(4,q.channels&255),J.set(j,5),H($.audioHello,J)}case"audio":{let j=new Uint8Array(8+q.data.byteLength);return new DataView(j.buffer).setBigUint64(0,BigInt(Math.max(0,Math.floor(q.captureMicros)))),j.set(q.data,8),H($.audio,j)}case"control":return H($.control,R(JSON.stringify(q.control)));case"windows":{let j=q.bounds.slice(0,A),J=new Uint8Array(j.length*16),Q=new DataView(J.buffer);return j.forEach((Z,z)=>{[Z.x,Z.y,Z.width,Z.height].forEach((G,F)=>Q.setInt32(z*16+F*4,qj(G)))}),H($.windows,J)}case"audioEnable":return H($.audioEnable,Uint8Array.of(q.on?1:0));case"ack":{let j=new Uint8Array(4);return new DataView(j.buffer).setUint32(0,q.seq>>>0),H($.ack,j)}}}function T(q){let j=h[q];if(!j)throw new U("invalid_preset");return j}function C(q,j){if(q.byteLength!==j)throw new U("invalid_length")}function k(q){if(q.byteLength>Y)throw new U("text_too_large");try{return jj.decode(q)}catch{throw new U("invalid_text")}}function Jj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_stats")}let J=j;if(!J||typeof J!=="object"||["fps","kbps","dropped","restarts","queued_bytes"].some((Z)=>typeof J[Z]!=="number"||!Number.isFinite(J[Z])))throw new U("invalid_stats");return{fps:J.fps,kbps:J.kbps,dropped:J.dropped,restarts:J.restarts,queued_bytes:J.queued_bytes}}function Qj(q){let j;try{j=JSON.parse(k(q))}catch{throw new U("invalid_control")}let J=j;if(!J||typeof J!=="object"||typeof J.you!=="boolean"||typeof J.same_user!=="boolean")throw new U("invalid_control");let Q=J.holder===null?null:s(J.holder);if(Q===null&&J.holder!==null)throw new U("invalid_control");return{holder:Q,you:J.you,same_user:J.same_user}}function Zj(q,j){let J=new DataView(j.buffer,j.byteOffset,j.byteLength);switch(q){case $.hello:if(j.byteLength<6)throw new U("invalid_length");return{type:"hello",width:J.getUint16(0),height:J.getUint16(2),fps:J.getUint8(4),preset:T(J.getUint8(5)),codec:k(j.subarray(6))};case $.frame:if(j.byteLength<14)throw new U("invalid_length");if(J.getUint8(0)>1)throw new U("invalid_frame_flags");return{type:"frame",key:J.getUint8(0)===1,seq:J.getUint32(1),captureMicros:Number(J.getBigUint64(5)),data:j.subarray(13)};case $.stats:return{type:"stats",stats:Jj(j)};case $.ping:case $.pong:return C(j,8),{type:q===$.ping?"ping":"pong",token:J.getFloat64(0)};case $.serverClipboard:return{type:"serverClipboard",text:k(j)};case $.clientClipboard:return{type:"clientClipboard",text:k(j)};case $.error:return{type:"error",code:k(j)};case $.pointer:return C(j,5),{type:"pointer",x:J.getUint16(0),y:J.getUint16(2),buttons:J.getUint8(4)};case $.key:if(C(j,5),J.getUint8(0)>1)throw new U("invalid_key_flags");return{type:"key",down:J.getUint8(0)===1,keysym:J.getUint32(1)};case $.config:return C(j,1),{type:"config",preset:T(J.getUint8(0))};case $.keyframeRequest:return C(j,0),{type:"keyframeRequest"};case $.audioHello:if(j.byteLength<5)throw new U("invalid_length");return{type:"audioHello",sampleRate:J.getUint32(0),channels:J.getUint8(4),codec:k(j.subarray(5))};case $.audio:if(j.byteLength<9)throw new U("invalid_length");return{type:"audio",captureMicros:Number(J.getBigUint64(0)),data:j.subarray(8)};case $.audioEnable:if(C(j,1),J.getUint8(0)>1)throw new U("invalid_audio_flags");return{type:"audioEnable",on:J.getUint8(0)===1};case $.control:return{type:"control",control:Qj(j)};case $.windows:{if(j.byteLength%16!==0||j.byteLength>A*16)throw new U("invalid_length");let Q=[];for(let Z=0;Z<j.byteLength;Z+=16)Q.push({x:J.getInt32(Z),y:J.getInt32(Z+4),width:J.getInt32(Z+8),height:J.getInt32(Z+12)});return{type:"windows",bounds:Q}}case $.ack:return C(j,4),{type:"ack",seq:J.getUint32(0)};default:return null}}class $j{buffer=new Uint8Array(0);push(q){let j=new Uint8Array(this.buffer.byteLength+q.byteLength);j.set(this.buffer),j.set(q,this.buffer.byteLength);let J=[],Q=0;while(j.byteLength-Q>=4){let Z=new DataView(j.buffer,j.byteOffset+Q,4).getUint32(0);if(Z<1||Z>V)throw new U("invalid_message_length");if(j.byteLength-Q-4<Z)break;let z=j[Q+4],G=j.slice(Q+5,Q+4+Z),F=Zj(z,G);if(F)J.push(F);Q+=4+Z}return this.buffer=j.slice(Q),J}}var t="/usr/bin/osascript",Gj=5000,Kj=1048576,Uj=String.raw`
 ObjC.import("CoreGraphics");
 ObjC.import("ApplicationServices");
 ObjC.import("AppKit");
@@ -109,4 +109,4 @@ function run() {
 `);X>=0;X=B.indexOf(`
 `)){let S=B.slice(0,X);if(B=B.slice(X+1),!S.startsWith("c "))continue;let O=S.slice(2);if(O.length>Math.ceil(Y/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(O)){K({reason:"display_protocol"});return}let _=Buffer.from(O,"base64");if(_.byteLength<=Y)q.clipboard(_.toString("utf8"));if(z)return}if(B.length>Math.ceil(Y/3)*4+2)K({reason:"display_protocol"})}),G.once("error",()=>W("Reason could not watch this Mac's desktop clipboard.")),G.once("exit",()=>{if(!z)W("Reason could not watch this Mac's desktop clipboard.")})};return J.stdout.on("data",(B)=>{if(z||Z===null)return;Z+=B.toString("utf8");let N=Z.indexOf(`
 `);if(N<0){if(Z.length>4096)K({reason:"display_protocol"});return}let X=y(Z.slice(0,N));if(Z=null,!X)K({reason:"display_protocol"});else if(!X.screen||!X.accessibility)W(j.length>0?"Reason's background worker needs Screen Recording and Accessibility on this Mac (its own Reason entry in System Settings > Privacy & Security, not the Reason app's): run `reason permissions allow` on this Mac.":"Allow Screen Recording and Accessibility for this Mac's Reason worker, then restart it.");else i(),q.ready({width:X.width,height:X.height})}),J.stdin.on("error",()=>{return}),J.once("error",()=>W("Reason could not start this Mac's desktop input.")),J.once("exit",()=>{if(Z!==null)W("Reason could not start this Mac's desktop input.");else K({reason:"display_closed"})}),{pointer:(B,N,X)=>L(Q.pointer(B,N,X)),key:(B,N)=>L(Q.key(B,N)),clipboard:(B)=>L([`c ${Buffer.from(B,"utf8").toString("base64")}`]),close(){z=!0,F()}}}
-export{Cj as Xj,kj as Yj,h as Zj,Yj as _j,Y as $j,Lj as ak,Aj as bk,s as ck,xj as dk,Mj as ek,fj as fk,hj as gk,$j as hk,y as ik,Sj as jk,_j as kk,Hj as lk,Tj as mk,a as nk,Vj as ok};
+export{Cj as _j,kj as $j,h as ak,Yj as bk,Y as ck,Lj as dk,Aj as ek,s as fk,xj as gk,Mj as hk,fj as ik,hj as jk,$j as kk,y as lk,Sj as mk,_j as nk,Hj as ok,Tj as pk,a as qk,Vj as rk};

package/bin/vm-hands/{vm-hands-entry-lite-mkynexaq.js → vm-hands-entry-lite-rbjky7rd.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Kk as D}from"./vm-hands-entry-lite-04y4b7c6.js";import{Lk as M}from"./vm-hands-entry-lite-0a1ch6wx.js";import{execFileSync as A}from"child_process";import{realpathSync as U,statSync as F}from"fs";import{tmpdir as j}from"os";import{createRequire as I}from"module";import{win32 as Z}from"path";var J=["/bin/bash","/usr/bin/bash"],u="Git Bash was not found. Install Git for Windows (https://git-scm.com/download/win), then run `reason connect`.";function k(K){try{return F(K).isFile()}catch{return!1}}var q=(K)=>[Z.join(K,"bin","bash.exe"),Z.join(K,"usr","bin","bash.exe")];function O(K,Q){let L=Z.normalize(K).toLowerCase(),Y=(Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows").toLowerCase();return L.startsWith(Z.join(Y,"system32").toLowerCase()+"\\")||L.startsWith(Z.join(Y,"sysnative").toLowerCase()+"\\")||L.includes("\\windowsapps\\")}function C(K=process.env,Q=k){let L=[];for(let Y of(K.PATH??K.Path??"").split(";"))if(Y&&Z.isAbsolute(Y))L.push(Z.join(Y,"git.exe"));for(let Y of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if(Y)L.push(Z.join(Y,"Git","cmd","git.exe"));if(K.LOCALAPPDATA)L.push(Z.join(K.LOCALAPPDATA,"Programs","Git","cmd","git.exe"));return L.find(Q)??null}var T;function w(K=process.platform){if(K!=="win32")return"git";return T??=C(),T}function P(K){let Q=process.platform==="win32"?C(K):"git";if(!Q)return null;try{return A(Q,["--exec-path"],{encoding:"utf8",timeout:5000,windowsHide:!0,stdio:["ignore","pipe","ignore"],env:K}).trim()||null}catch{return null}}function G(K=process.env,Q=P,L=k){let Y=[],H=Q(K);if(H)Y.push(...q(Z.resolve(H,"..","..","..")));for(let $ of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if($)Y.push(...q(Z.join($,"Git")));if(K.LOCALAPPDATA)Y.push(...q(Z.join(K.LOCALAPPDATA,"Programs","Git")));for(let $ of(K.PATH??K.Path??"").split(";"))if($&&Z.isAbsolute($))Y.push(Z.join($,"bash.exe"));return Y.find(($)=>!O($,K)&&L($))??null}var z;function W(K=process.platform){if(K!=="win32")return J.find(k)??null;return z??=G(),z}function f(K=process.platform){let Q=W(K);if(!Q)throw Error(K==="win32"?u:"bash_unavailable");return Q}function h(K=process.platform){return U(K==="win32"?j():"/tmp")}function X(K=process.platform,Q=process.env){if(K!=="win32")return"/usr/bin:/bin";let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return[Z.join(L,"System32"),L,Z.join(L,"System32","Wbem"),Z.join(L,"System32","WindowsPowerShell","v1.0")].join(";")}function _(K,Q=process.platform){if(Q!=="win32"||/[\\/]/.test(K))return K;let L=/\.exe$/i.test(K)?K:`${K}.exe`,Y=X(Q).split(";");return Z.join(L.toLowerCase()==="powershell.exe"?Y[3]:Y[0],L)}function v(K=process.platform,Q=process.env){if(K!=="win32")return{PATH:X(K)};let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return{PATH:X(K,Q),SystemRoot:L,WINDIR:L}}function c(K=process.platform){return K==="win32"?{windowsHide:!0}:{detached:!0}}var V;function N(){if(V===void 0)V=D(M)(I(import.meta.url));return V}function p(K,Q=process.platform){let L=K.pid;if(Q!=="win32"||L===void 0)return;let Y=N();if(Y?.track(L))K.once("close",()=>Y.release(L))}function l(K,Q="SIGTERM",L=process.platform){if(L!=="win32"){process.kill(-K,Q);return}if(Q===0){process.kill(K,0);return}if(N()?.terminate(K))return;A(_("taskkill",L),["/PID",String(K),"/T","/F"],{stdio:"ignore",timeout:1e4,windowsHide:!0})}function d(K,Q=63,L=process.platform){return L==="win32"||K.uid===process.getuid?.()&&(K.mode&Q)===0}var x=/^(?:con|prn|aux|nul|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3]|conin\$|conout\$)(?:\..*)?$|:|[. ]$/i;function s(K){return K!=="."&&K!==".."&&x.test(K)}
-export{u as xk,w as yk,W as zk,f as Ak,h as Bk,X as Ck,_ as Dk,v as Ek,c as Fk,p as Gk,l as Hk,d as Ik,s as Jk};
+import{Nk as D}from"./vm-hands-entry-lite-b8bcnenf.js";import{Ok as M}from"./vm-hands-entry-lite-x96qadgp.js";import{execFileSync as A}from"child_process";import{realpathSync as U,statSync as F}from"fs";import{tmpdir as j}from"os";import{createRequire as I}from"module";import{win32 as Z}from"path";var J=["/bin/bash","/usr/bin/bash"],u="Git Bash was not found. Install Git for Windows (https://git-scm.com/download/win), then run `reason connect`.";function k(K){try{return F(K).isFile()}catch{return!1}}var q=(K)=>[Z.join(K,"bin","bash.exe"),Z.join(K,"usr","bin","bash.exe")];function O(K,Q){let L=Z.normalize(K).toLowerCase(),Y=(Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows").toLowerCase();return L.startsWith(Z.join(Y,"system32").toLowerCase()+"\\")||L.startsWith(Z.join(Y,"sysnative").toLowerCase()+"\\")||L.includes("\\windowsapps\\")}function C(K=process.env,Q=k){let L=[];for(let Y of(K.PATH??K.Path??"").split(";"))if(Y&&Z.isAbsolute(Y))L.push(Z.join(Y,"git.exe"));for(let Y of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if(Y)L.push(Z.join(Y,"Git","cmd","git.exe"));if(K.LOCALAPPDATA)L.push(Z.join(K.LOCALAPPDATA,"Programs","Git","cmd","git.exe"));return L.find(Q)??null}var T;function w(K=process.platform){if(K!=="win32")return"git";return T??=C(),T}function P(K){let Q=process.platform==="win32"?C(K):"git";if(!Q)return null;try{return A(Q,["--exec-path"],{encoding:"utf8",timeout:5000,windowsHide:!0,stdio:["ignore","pipe","ignore"],env:K}).trim()||null}catch{return null}}function G(K=process.env,Q=P,L=k){let Y=[],H=Q(K);if(H)Y.push(...q(Z.resolve(H,"..","..","..")));for(let $ of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if($)Y.push(...q(Z.join($,"Git")));if(K.LOCALAPPDATA)Y.push(...q(Z.join(K.LOCALAPPDATA,"Programs","Git")));for(let $ of(K.PATH??K.Path??"").split(";"))if($&&Z.isAbsolute($))Y.push(Z.join($,"bash.exe"));return Y.find(($)=>!O($,K)&&L($))??null}var z;function W(K=process.platform){if(K!=="win32")return J.find(k)??null;return z??=G(),z}function f(K=process.platform){let Q=W(K);if(!Q)throw Error(K==="win32"?u:"bash_unavailable");return Q}function h(K=process.platform){return U(K==="win32"?j():"/tmp")}function X(K=process.platform,Q=process.env){if(K!=="win32")return"/usr/bin:/bin";let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return[Z.join(L,"System32"),L,Z.join(L,"System32","Wbem"),Z.join(L,"System32","WindowsPowerShell","v1.0")].join(";")}function _(K,Q=process.platform){if(Q!=="win32"||/[\\/]/.test(K))return K;let L=/\.exe$/i.test(K)?K:`${K}.exe`,Y=X(Q).split(";");return Z.join(L.toLowerCase()==="powershell.exe"?Y[3]:Y[0],L)}function v(K=process.platform,Q=process.env){if(K!=="win32")return{PATH:X(K)};let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return{PATH:X(K,Q),SystemRoot:L,WINDIR:L}}function c(K=process.platform){return K==="win32"?{windowsHide:!0}:{detached:!0}}var V;function N(){if(V===void 0)V=D(M)(I(import.meta.url));return V}function p(K,Q=process.platform){let L=K.pid;if(Q!=="win32"||L===void 0)return;let Y=N();if(Y?.track(L))K.once("close",()=>Y.release(L))}function l(K,Q="SIGTERM",L=process.platform){if(L!=="win32"){process.kill(-K,Q);return}if(Q===0){process.kill(K,0);return}if(N()?.terminate(K))return;A(_("taskkill",L),["/PID",String(K),"/T","/F"],{stdio:"ignore",timeout:1e4,windowsHide:!0})}function d(K,Q=63,L=process.platform){return L==="win32"||K.uid===process.getuid?.()&&(K.mode&Q)===0}var x=/^(?:con|prn|aux|nul|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3]|conin\$|conout\$)(?:\..*)?$|:|[. ]$/i;function s(K){return K!=="."&&K!==".."&&x.test(K)}
+export{u as Ak,w as Bk,W as Ck,f as Dk,h as Ek,X as Fk,_ as Gk,v as Hk,c as Ik,p as Jk,l as Kk,d as Lk,s as Mk};

package/bin/vm-hands/{vm-hands-entry-lite-rtt2w6c6.js → vm-hands-entry-lite-swwb5mp2.js}

@@ -1,3 +1,3 @@
 // @bun
 function r(n){return typeof n==="object"&&n!==null&&!Array.isArray(n)}
-export{r as _c};
+export{r as ad};

package/bin/vm-hands/{vm-hands-entry-lite-ecgyzbdp.js → vm-hands-entry-lite-wsnr4fx8.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Bj as X,Dj as Y,Fj as Z}from"./vm-hands-entry-lite-3pecyp8y.js";import{execFileSync as z}from"child_process";import{existsSync as V,realpathSync as M}from"fs";import{userInfo as D}from"os";import{isAbsolute as $,join as C,normalize as F,parse as K}from"path";function Q(){let q=F(D().homedir);if(!$(q)||q===K(q).root)throw Error("Could not resolve the canonical user home.");return q}function O(q,B,J=Q()){let L=Z(B);if(B.kind==="managed"&&B.base){let G=M(J);return{anchor:G,boundary:C(G,B.base),path:C(G,L)}}if(B.kind==="root"&&Y(B.path)){let G=M(J);return{anchor:G,boundary:C(G,X),path:C(G,L)}}return{anchor:q,boundary:q,path:C(q,L)}}function _(q=Q()){return C(q,".config")}function b(){if(process.platform!=="darwin")return null;try{let q=z("/usr/bin/getconf",["DARWIN_USER_DIR"],{encoding:"utf8",timeout:5000}).trim();return $(q)?M(q):null}catch{return null}}function g(q=Q()){let B=C(q,"Library","Application Support","Ara"),J=C(q,"Library","Application Support","Reason");return V(B)&&!V(J)?B:J}
-export{Q as sj,O as tj,_ as uj,b as vj,g as wj};
+import{Ej as X,Gj as Y,Ij as Z}from"./vm-hands-entry-lite-arw53mkf.js";import{execFileSync as z}from"child_process";import{existsSync as V,realpathSync as M}from"fs";import{userInfo as D}from"os";import{isAbsolute as $,join as C,normalize as F,parse as K}from"path";function Q(){let q=F(D().homedir);if(!$(q)||q===K(q).root)throw Error("Could not resolve the canonical user home.");return q}function O(q,B,J=Q()){let L=Z(B);if(B.kind==="managed"&&B.base){let G=M(J);return{anchor:G,boundary:C(G,B.base),path:C(G,L)}}if(B.kind==="root"&&Y(B.path)){let G=M(J);return{anchor:G,boundary:C(G,X),path:C(G,L)}}return{anchor:q,boundary:q,path:C(q,L)}}function _(q=Q()){return C(q,".config")}function b(){if(process.platform!=="darwin")return null;try{let q=z("/usr/bin/getconf",["DARWIN_USER_DIR"],{encoding:"utf8",timeout:5000}).trim();return $(q)?M(q):null}catch{return null}}function g(q=Q()){let B=C(q,"Library","Application Support","Ara"),J=C(q,"Library","Application Support","Reason");return V(B)&&!V(J)?B:J}
+export{Q as vj,O as wj,_ as xj,b as yj,g as zj};