@reason-machines/cli-linux-x64 0.2.408 → 0.2.410

package/bin/vm-hands/{vm-hands-entry-lite-6whxyzz2.js → vm-hands-entry-lite-w59z67hf.js}

@@ -1,8 +1,8 @@
 // @bun
-import{g,Vi,ve}from"./vm-hands-entry-lite-5p5h1eng.js";import{l,Pt,Be,br,Tt,Sr,Qe}from"./vm-hands-entry-lite-dq1m5ykp.js";import{lt,Wt}from"./vm-hands-entry-lite-ym1djztp.js";import{Xr}from"./vm-hands-entry-lite-qffs74x1.js";import{B,m,ee,Ne}from"./vm-hands-entry-lite-et2bh990.js";import{F}from"./vm-hands-entry-lite-e5hbehqn.js";import{so}from"./vm-hands-entry-lite-wf7ksh4e.js";import{be,He,kn,Or}from"./vm-hands-entry-lite-hee1h411.js";import{f,b,h}from"./vm-hands-entry-lite-wyh6dp1t.js";import{a}from"./vm-hands-entry-lite-dkcm3hyn.js";import{fo,Wr,y,t,A,ht,o,d,Pe,u,i,c,_,Lo,s,n,Vr}from"./vm-hands-entry-lite-zn0v259d.js";import{closeSync as qh,existsSync as zh,mkdirSync as Kh,openSync as Vh,readdirSync as Jh,realpathSync as pe,rmSync as Gh}from"fs";import{dirname as Xh,join as J,resolve as Zh}from"path";import{createHash as At}from"crypto";import{platform as It}from"os";import{join as xt}from"path";var Ot=_("store",[c({version:n(1),store:n("keychain")}),c({version:n(1),store:n("file"),api_key:t().min(1).max(4096)})]),$e=(e)=>xt(e,"api-key.json");function Ue(e){let r=At("sha256").update(`reason-connect-api-key
-${e}`).digest("hex");return new Be(Pt(),It(),r)}function ge(e,r=Ue(e)){if(!f($e(e)))return null;let p=Ot.parse(JSON.parse(h($e(e))));if(p.store==="file")return p.api_key;try{let k=r.loadBinding();return k?new TextDecoder().decode(k):null}catch(k){if(!(k instanceof l))throw k;throw Error("worker_api_key_unreadable")}}import{readdirSync as Xt,renameSync as Kn,rmSync as Vn}from"fs";import{join as te}from"path";import{createHash as Dt}from"crypto";import{platform as Nt}from"os";import{join as N}from"path";function w(e){return{state:N(m(e),"device.json"),control:N(m(e),"control.json"),lock:N(m(e),"lifecycle.lock"),socket:N(m(e),"control.sock"),daemon:N(m(e),"daemon.json"),releaseCheck:N(m(e),"release-check.json"),updateDeferral:N(m(e),"update-deferral.json"),firstHeartbeat:N(m(e),"first-heartbeat.json")}}var ln=i({version:n(1),device_id:t().min(1).max(160),offer:Pe().optional(),enrollment_ms:o().int().nonnegative().max(Wt).optional()});function z(e,r=!1){b(m(e),r);let p=["local-device.key","local-device.binding","device.json"].filter((k)=>{let S=N(m(e),k);if(!f(S))return!1;return h(S),!0});return e.lifetime==="persistent"&&p.join()==="device.json"?Ht(e):new br(m(e))}function Ht(e){return new Be(Pt(),Nt(),$t(e))}function $t(e){let r=Ft(e);return Dt("sha256").update(`reason-worker
-${r?.directory??m(e)}`).digest("hex")}var Bt="keychain-scope.json";var Ut=c({version:n(1),directory:t().min(1),devicePublicKey:t().min(1)});function Ft(e){let r=N(m(e),Bt);if(!f(r))return null;let p=Ut.safeParse(JSON.parse(h(r))),k=w(e).state;if(!p.success||!f(k))return null;return JSON.parse(h(k))?.devicePublicKey===p.data.devicePublicKey?p.data:null}function M(e){if(!f(m(e)))return null;let r=Sr(w(e).state,{proofStore:z(e),repair:!1}),p=r!==null&&Vi(e.apiOrigin,r.apiOrigin),k=p?[ee(e),ee({...e,apiOrigin:r.apiOrigin})]:[ee(e)];if(r&&(!k.includes(r.worker?.configDigest??"")||r.worker.lifetime!==e.lifetime||r.apiOrigin!==e.apiOrigin&&!p||r.roots.length>32||r.roots[0]?.path!==e.workspaceRoot||r.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return r}var jt=c({version:n(1),drained:d(),revoked:d()});function H(e){let r=w(e).control;return f(r)?jt.parse(JSON.parse(h(r))):{version:1,drained:!1,revoked:!1}}var zt=c({read:d(),write:d(),execute:d(),discover_environment:d(),expose_mcp:n(!1)}),Kt=c({version:n(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:zt,execution_mode:s(["confined","host"]).default("confined")}),folders:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),Sn=i({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:n("p256"),protocol_version:n(2),roots:u(i({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:i({lifecycle:s(["persistent","ephemeral"]),expires_at:y.datetime({offset:!0})}),first_heartbeat:Pe().optional()});var Un=c({version:n(1),install_id:A(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),Fn=i({enrollment_ticket:t().min(1).max(4096),expires_at:y.datetime({offset:!0}),device_kind:n("headless"),lifecycle:s(["persistent","ephemeral"]),device_expires_at:y.datetime({offset:!0})});var jn=i({credentialKind:s(["oauth","api_key"]).optional(),apiOrigin:ht(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:y.datetime({offset:!0}),scopes:u(t().max(128)).max(128),orgId:t().min(1).max(160)});var ze=8;var Zt=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,_e=(e)=>te(m(e),"workspaces"),Qt="account.json",er=(e)=>f(te(e,Qt));function Re(e){let r;try{r=Xt(_e(e))}catch{return[]}return r.filter((p)=>Zt.test(p)).sort().map((p)=>{let k=te(_e(e),p),S=te(k,"worker.json"),v=null;try{let P=B.safeParse(JSON.parse(h(S)));if(P.success&&P.data.stateDirectory===k)v=P.data}catch{}return{organizationId:p,directory:k,configPath:S,config:v,account:er(k)}})}var tr=(e)=>te(_e(e),"listed.json");function rr(e){try{let r=JSON.parse(h(tr(e))),p=r.names&&typeof r.names==="object"&&!Array.isArray(r.names)?Object.fromEntries(Object.entries(r.names).filter((k)=>typeof k[1]==="string")):{};return{listed:r.listed===!0,reason:r.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(r.blocked)?r.blocked.filter((k)=>typeof k==="string"):[],names:p}}catch{return null}}function Ke(e,r){let p=Re(e),k=p.filter((E)=>E.account),S=p.filter((E)=>!E.account),v=rr(e),P=v&&!v.listed?v.reason:null,R=P||S.length===0&&v&&!v.listed?[]:S;if(k.length===0&&R.length===0&&(P||v&&!v.listed))return{workspaces:null,off:P};return{off:P,workspaces:[...k,...R].map(({organizationId:E,config:L,account:x})=>{let C=!1,T=null,D=!1,he=null;try{C=L?H(L).revoked:!1,T=L&&!C?M(L):null;let We=L?Qe(w(L).daemon):null;D=r&&!!T&&We?.state==="connected",he=D?Tt(We,T):null}catch{}return{...he?{permission_recovery:he}:{},organization_id:E,device_id:T?.deviceId??null,name:v?.names?.[E]??null,root:T?.roots[0]?{id:T.roots[0].id,permissions:T.roots[0].permissions}:null,state:C?"removed":D?"connected":"not_running",blocked:!x&&!C&&!D&&(v?.blocked.includes(E)??!1),...x?{account:!0}:{}}})}}import{readFileSync as nr}from"fs";function Jt(e){try{let r=JSON.parse(nr(`${e}.keep-awake.json`,"utf8"));return r!==null&&typeof r==="object"&&"version"in r&&r.version===1&&"enabled"in r&&r.enabled===!0?"battery_and_ac":void 0}catch(r){return r.code==="ENOENT"?"battery_and_ac":void 0}}import{chmodSync as Bi,lstatSync as et,mkdtempSync as Ui,realpathSync as ir,rmdirSync as Fi,rmSync as ji,unlinkSync as qi}from"fs";import{createConnection as ar,createServer as Ki}from"net";import{basename as Ye,dirname as Xe,join as oe}from"path";var sr=s(["status","drain","resume","stop","reload_roots"]),cr=c({version:n(1),instanceId:t(),deviceId:t(),phase:s(["starting","running","reconnecting","stopping"]),drained:d(),activeClaims:o().int().nonnegative(),activeSessions:o().int().nonnegative().optional(),executionEligible:d(),supportedOperations:u(s(lt)).max(lt.length).optional(),capabilityReadiness:Lo(s(lt),d()).optional(),lastHeartbeat:t().nullable(),expiresAt:t()}),Qi=c({nonce:t(),action:sr}),lr=i({nonce:A()}),dr=c({version:n(1),nonce:A(),socketPath:t().max(100)});function ur(e){return oe(w(e).lock,"control.json")}function tt(e){return b(w(e).lock),lr.parse(JSON.parse(h(oe(w(e).lock,"owner.json"))))}function Ze(e){if(!f(e))return!1;let r=et(e);if(!r.isSocket()||r.uid!==process.getuid?.()||(r.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function rt(e,r){let p=ur(e);if(!f(p)){let v=w(e).socket;if(!f(v)||!et(v).isSocket())return null;return Ze(v)?v:null}let k=dr.parse(JSON.parse(h(p)));if(k.nonce!==r)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!fr.test(k.socketPath))throw Error("worker_control_endpoint_invalid");return k.socketPath}let S=Xe(k.socketPath);if(Xe(S)!==ir("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(Ye(S))||Ye(k.socketPath)!=="control.sock"||Buffer.byteLength(k.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!f(S))return null;return b(S),Ze(k.socketPath)?k.socketPath:null}var fr=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;function mr(e,r){try{let p=JSON.parse(h(oe(w(e).lock,"owner.json"))),k=p&&typeof p==="object"?p[r]:void 0;return typeof k==="string"?k:null}catch{return null}}function ot(e){return mr(e,"runtime_version")}function nt(e,r){if(r)return r.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!f(oe(w(e).lock,"owner.json")))return"no_lock";return rt(e,tt(e).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var ea=c({instance:t().nullable(),since:o().int().nonnegative()});async function G(e,r){let p=w(e);if(!f(oe(p.lock,"owner.json")))return null;let k=tt(e),S=rt(e,k.nonce);if(!S)return null;return new Promise((v,P)=>{let R=ar(S),E="",L=!1,x=(C,T)=>{if(L)return;if(L=!0,R.destroy(),T)P(T);else v(C)};R.setTimeout(2000,()=>R.destroy(Error("worker_control_timeout"))),R.on("connect",()=>R.write(JSON.stringify({nonce:k.nonce,action:r})+`
-`)),R.on("data",(C)=>{if(E+=C.toString(),Buffer.byteLength(E)>16384)R.destroy(Error("worker_control_oversize"))}),R.on("error",(C)=>{if("code"in C&&["ECONNREFUSED","ENOENT"].includes(String(C.code)))x(null);else x(null,C.message==="worker_control_timeout"?C:Error("worker_control_unavailable"))}),R.on("end",()=>{try{let C=cr.parse(JSON.parse(E));if(C.instanceId!==k.nonce)throw Error("worker_instance_changed");x(C)}catch{x(null,Error("worker_control_invalid_response"))}}),R.once("close",()=>x(null,Error("worker_control_unavailable")))})}import{realpathSync as gr}from"fs";import{constants as Ee}from"fs";import{open as pr}from"fs/promises";var sa={platform:process.platform,home:a,async openFile(e){let r=await pr(e,Ee.O_RDONLY|Ee.O_NOFOLLOW|Ee.O_NONBLOCK);return{isFile:async()=>(await r.stat()).isFile(),close:()=>r.close()}}};var Fa=so(gr(process.execPath));var Ps=Buffer.from([0,255,3,4]);import{execFile as to}from"child_process";import{promisify as ro}from"util";var Rr=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var Pr=new Set(["png","jpg","jpeg","gif","webp"]),Er=new Set(["webm","mp4"]);function Cr(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function st(e,r){let p;try{p=new URL(e)}catch{return null}let k=Cr(r),S=p.hostname==="ara.so"||p.hostname.endsWith(".ara.so")||p.hostname==="reasonmachines.ai"||p.hostname.endsWith(".reasonmachines.ai")||p.hostname==="reasonmachines.com"||p.hostname.endsWith(".reasonmachines.com");if(p.protocol!=="https:"||!S&&p.origin!==k||p.username||p.password||p.port||p.search||p.hash)return null;let v=Rr.exec(p.pathname);if(!v)return null;let P=v[1]?.toLowerCase(),R=v[2]?.toLowerCase(),E=v[3]?.toLowerCase(),L=v[4]?.toLowerCase();if(!P||!R||!E||!L)return null;let x=Pr.has(L)?"image":Er.has(L)?"video":null;if(!x)return null;let C=/^(before|after)[\s:_-]+/.exec(E),T=p.pathname.replace(/^\/media\//,"");return{url:p.toString(),storagePath:T,runId:P,artifactId:R,fileName:`${E}.${L}`,kind:x,phase:C?.[1]==="before"||C?.[1]==="after"?C[1]:null}}var Ar=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,ct=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),K=()=>{throw Error("cloud_browser_media_request_invalid")};function Ae(e){if(!ct(e)||Object.keys(e).some((v)=>!["runId","configuredMediaOrigin","media"].includes(v))||typeof e.runId!=="string"||!Ar.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return K();let r;try{r=new URL(e.configuredMediaOrigin)}catch{return K()}if(r.protocol!=="https:"||r.username||r.password||r.port||!Ne(r.origin,{mode:"public_web"}).allowed)return K();let p=e.runId.toLowerCase(),k=new Set,S=e.media.map((v)=>{if(!ct(v)||Object.keys(v).some((R)=>!["url","sourceUrl","kind"].includes(R))||typeof v.url!=="string"||v.url.length>2048||typeof v.sourceUrl!=="string"||v.sourceUrl.length>8192||!["image","video"].includes(String(v.kind)))return K();let P=st(v.url,r.origin);if(!P||new URL(P.url).origin!==r.origin||P.runId!==p||P.kind!==v.kind||P.url!==v.url||k.has(v.url))return K();if(k.add(v.url),v.sourceUrl!==v.url){let R;try{R=new URL(v.sourceUrl)}catch{return K()}let E=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(R.pathname)?.[1];if(v.kind!=="image"||R.origin!=="https://camo.githubusercontent.com"||R.username||R.password||R.search||R.hash||!E||E.length%2!==0||Buffer.from(E,"hex").toString("utf8")!==v.url)return K()}return{url:v.url,sourceUrl:v.sourceUrl,kind:v.kind}});return{runId:e.runId,configuredMediaOrigin:r.origin,media:S}}var I=t().uuid(),X=t().regex(/^[a-f0-9]{64}$/),V=y.datetime({precision:3}),xe=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),ft=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),U=i({kind:n("primary_mac"),version:n(1),organizationId:xe,userId:xe,sessionId:xe,runId:I,deviceId:I,rootId:I,rootRevision:t().min(1).max(64),binding:s(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:I,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Ir=Vr().transform((e,r)=>{try{return Xr(e)}catch{return r.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),fo}}),ue=i({version:n(1),owner:U,contextId:I,preparedAt:V,expiresAt:V,prUrl:ft,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:X,evidenceKind:s(["image","video"]),visualPlan:Ir.optional(),uploadOrigin:t().url().refine((e)=>{let r=new URL(e);return r.protocol==="https:"&&r.origin===e&&!r.username&&!r.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),xr=i({version:n(1),producer:n("primary_mac"),context:ue,captureId:I,operationId:I,attemptId:I,tabId:o().int().positive(),startedAt:V,finishedAt:V,sha256:X,media:_("contentType",[i({contentType:n("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),i({contentType:n("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,r)=>{let p=Date.parse(e.startedAt),k=Date.parse(e.finishedAt);if(p<Date.parse(e.context.preparedAt)||k<p||k>Date.parse(e.context.expiresAt)||k-p>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((k-p)/1000-e.media.durationSeconds)>0.1))r.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),vc=_("action",[i({action:n("screenshot"),context_id:I,tab_id:o().int().positive()}).strict(),i({action:n("start_video"),context_id:I,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),i({action:n("stop_video"),recording_operation_id:I}).strict()]),fe=i({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),ce=t().regex(/^[1-9][0-9]{0,19}$/),le=i({version:n(1),owner:U,expectedActorId:ce.nullable(),repositoryId:ce,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),Lr=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],Mr=_("status",[le.extend({status:n("ready"),observedActor:fe,checkedAt:V}),le.extend({status:n("not_ready"),reason:s(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:s(Lr).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),Y=i({version:n(1),owner:U,expectedActorId:ce.nullable(),authenticatedActor:fe,attemptId:I,captureId:I,prUrl:ft,repositoryId:ce,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:X,sizeBytes:o().int().min(128).max(10485760),contentType:n("video/webm")}).strict(),mt=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),Tr=_("status",[Y.extend({status:n("not_attempted"),reason:s(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),Y.extend({status:n("uncertain"),reason:n("upload_outcome_unknown")}),Y.extend({status:n("uploaded"),observedActor:fe,nativeUrl:mt,uploadedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),de=Y.extend({nativeUrl:mt,observedActor:fe,bodySha256:X}),Dr=_("status",[de.extend({status:n("incomplete"),reason:s(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),de.extend({status:n("verified"),sourceSha256:X,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:n(!0),verifiedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Nr=Vr().transform((e,r)=>{try{let p=Ae(e);if(p.media.some((k)=>k.kind!=="image"))throw Error();return p}catch{return r.addIssue({code:"custom",message:"proof_media_request_invalid"}),fo}}),Hr=_("action",[i({action:n("auth_check"),input:le}).strict(),i({action:n("prepare"),context:ue}).strict(),i({action:n("capture_png"),owner:U,contextId:I,tabId:o().int().positive()}).strict(),i({action:n("start_video"),owner:U,contextId:I,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),i({action:n("inspect_capture"),owner:U,captureId:I}).strict(),i({action:n("publish_video"),input:Y}).strict(),i({action:n("verify_png_media"),owner:U,media:Nr}).strict().refine((e)=>e.media.runId===e.owner.runId),i({action:n("verify_saved_media"),input:de}).strict(),i({action:n("publish_png"),owner:U,attemptId:I,captureId:I,sha256:X,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var $r=i({requestId:I,command:Hr}).strict();var Br={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},dt={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},ut={type:"integer",minimum:1,description:"An already-owned tab's id."},Sc={...Br,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:dt,tab_id:ut}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:dt,tab_id:ut,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};var Ac=i({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict();var Ur=String.raw`async (media) => {
+import{g,Ki,ve}from"./vm-hands-entry-lite-ckv17tn8.js";import{l,Rt,Fe,Sr,Ot,xr,et}from"./vm-hands-entry-lite-q0k6kx6d.js";import{ut,Gt}from"./vm-hands-entry-lite-k278g9kj.js";import{Qr}from"./vm-hands-entry-lite-bk6akkdt.js";import{B,m,ee,Le}from"./vm-hands-entry-lite-70ba2bqj.js";import{F}from"./vm-hands-entry-lite-05rrh8yg.js";import{co}from"./vm-hands-entry-lite-10sbjfzx.js";import{be,qe,An,Dr}from"./vm-hands-entry-lite-46fkv5sp.js";import{f,b,h}from"./vm-hands-entry-lite-09m2cdkw.js";import{a}from"./vm-hands-entry-lite-89z488gz.js";import{go,Gr,y,t,A,mt,o,d,Te,u,i,c,_,$o,s,n,Kr}from"./vm-hands-entry-lite-907pa7f9.js";import{closeSync as Kh,existsSync as Vh,mkdirSync as Jh,openSync as Gh,readdirSync as Yh,realpathSync as pe,rmSync as Xh}from"fs";import{dirname as Qh,join as J,resolve as ew}from"path";import{createHash as At}from"crypto";import{platform as It}from"os";import{join as xt}from"path";var Lt=_("store",[c({version:n(1),store:n("keychain")}),c({version:n(1),store:n("file"),api_key:t().min(1).max(4096)})]),He=(e)=>xt(e,"api-key.json");function $e(e){let r=At("sha256").update(`reason-connect-api-key
+${e}`).digest("hex");return new Fe(Rt(),It(),r)}function ge(e,r=$e(e)){if(!f(He(e)))return null;let p=Lt.parse(JSON.parse(h(He(e))));if(p.store==="file")return p.api_key;try{let k=r.loadBinding();return k?new TextDecoder().decode(k):null}catch(k){if(!(k instanceof l))throw k;throw Error("worker_api_key_unreadable")}}import{readdirSync as Yt,renameSync as Kn,rmSync as Vn}from"fs";import{join as te}from"path";import{createHash as Dt}from"crypto";import{platform as Wt}from"os";import{join as N}from"path";function w(e){return{state:N(m(e),"device.json"),control:N(m(e),"control.json"),lock:N(m(e),"lifecycle.lock"),socket:N(m(e),"control.sock"),daemon:N(m(e),"daemon.json"),releaseCheck:N(m(e),"release-check.json"),updateDeferral:N(m(e),"update-deferral.json"),firstHeartbeat:N(m(e),"first-heartbeat.json")}}var ln=i({version:n(1),device_id:t().min(1).max(160),offer:Te().optional(),enrollment_ms:o().int().nonnegative().max(Gt).optional()});function z(e,r=!1){b(m(e),r);let p=["local-device.key","local-device.binding","device.json"].filter((k)=>{let S=N(m(e),k);if(!f(S))return!1;return h(S),!0});return e.lifetime==="persistent"&&p.join()==="device.json"?Nt(e):new Sr(m(e))}function Nt(e){return new Fe(Rt(),Wt(),Ht(e))}function Ht(e){let r=Ut(e);return Dt("sha256").update(`reason-worker
+${r?.directory??m(e)}`).digest("hex")}var $t="keychain-scope.json";var Bt=c({version:n(1),directory:t().min(1),devicePublicKey:t().min(1)});function Ut(e){let r=N(m(e),$t);if(!f(r))return null;let p=Bt.safeParse(JSON.parse(h(r))),k=w(e).state;if(!p.success||!f(k))return null;return JSON.parse(h(k))?.devicePublicKey===p.data.devicePublicKey?p.data:null}function M(e){if(!f(m(e)))return null;let r=xr(w(e).state,{proofStore:z(e),repair:!1}),p=r!==null&&Ki(e.apiOrigin,r.apiOrigin),k=p?[ee(e),ee({...e,apiOrigin:r.apiOrigin})]:[ee(e)];if(r&&(!k.includes(r.worker?.configDigest??"")||r.worker.lifetime!==e.lifetime||r.apiOrigin!==e.apiOrigin&&!p||r.roots.length>32||r.roots[0]?.path!==e.workspaceRoot||r.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return r}var Ft=c({version:n(1),drained:d(),revoked:d()});function H(e){let r=w(e).control;return f(r)?Ft.parse(JSON.parse(h(r))):{version:1,drained:!1,revoked:!1}}var qt=c({read:d(),write:d(),execute:d(),discover_environment:d(),expose_mcp:n(!1)}),zt=c({version:n(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:qt,execution_mode:s(["confined","host"]).default("confined")}),folders:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),vn=i({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:n("p256"),protocol_version:n(2),roots:u(i({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:i({lifecycle:s(["persistent","ephemeral"]),expires_at:y.datetime({offset:!0})}),first_heartbeat:Te().optional()});var Un=c({version:n(1),install_id:A(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),Fn=i({enrollment_ticket:t().min(1).max(4096),expires_at:y.datetime({offset:!0}),device_kind:n("headless"),lifecycle:s(["persistent","ephemeral"]),device_expires_at:y.datetime({offset:!0})});var jn=i({credentialKind:s(["oauth","api_key"]).optional(),apiOrigin:mt(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:y.datetime({offset:!0}),scopes:u(t().max(128)).max(128),orgId:t().min(1).max(160)});var ze=8;var Zt=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,_e=(e)=>te(m(e),"workspaces"),Qt="account.json",er=(e)=>f(te(e,Qt));function Re(e){let r;try{r=Yt(_e(e))}catch{return[]}return r.filter((p)=>Zt.test(p)).sort().map((p)=>{let k=te(_e(e),p),S=te(k,"worker.json"),v=null;try{let P=B.safeParse(JSON.parse(h(S)));if(P.success&&P.data.stateDirectory===k)v=P.data}catch{}return{organizationId:p,directory:k,configPath:S,config:v,account:er(k)}})}var tr=(e)=>te(_e(e),"listed.json");function rr(e){try{let r=JSON.parse(h(tr(e))),p=r.names&&typeof r.names==="object"&&!Array.isArray(r.names)?Object.fromEntries(Object.entries(r.names).filter((k)=>typeof k[1]==="string")):{};return{listed:r.listed===!0,reason:r.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(r.blocked)?r.blocked.filter((k)=>typeof k==="string"):[],names:p}}catch{return null}}function Ve(e,r){let p=Re(e),k=p.filter((E)=>E.account),S=p.filter((E)=>!E.account),v=rr(e),P=v&&!v.listed?v.reason:null,R=P||S.length===0&&v&&!v.listed?[]:S;if(k.length===0&&R.length===0&&(P||v&&!v.listed))return{workspaces:null,off:P};return{off:P,workspaces:[...k,...R].map(({organizationId:E,config:L,account:x})=>{let C=!1,T=null,D=!1,he=null;try{C=L?H(L).revoked:!1,T=L&&!C?M(L):null;let Ne=L?et(w(L).daemon):null;D=r&&!!T&&Ne?.state==="connected",he=D?Ot(Ne,T):null}catch{}return{...he?{permission_recovery:he}:{},organization_id:E,device_id:T?.deviceId??null,name:v?.names?.[E]??null,root:T?.roots[0]?{id:T.roots[0].id,permissions:T.roots[0].permissions}:null,state:C?"removed":D?"connected":"not_running",blocked:!x&&!C&&!D&&(v?.blocked.includes(E)??!1),...x?{account:!0}:{}}})}}import{readFileSync as nr}from"fs";function Xt(e){try{let r=JSON.parse(nr(`${e}.keep-awake.json`,"utf8"));return r!==null&&typeof r==="object"&&"version"in r&&r.version===1&&"enabled"in r&&r.enabled===!0?"battery_and_ac":void 0}catch(r){return r.code==="ENOENT"?"battery_and_ac":void 0}}import{chmodSync as Bi,lstatSync as Qe,mkdtempSync as Ui,realpathSync as ir,rmdirSync as Fi,rmSync as ji,unlinkSync as qi}from"fs";import{createConnection as ar,createServer as Vi}from"net";import{basename as Ye,dirname as Xe,join as oe}from"path";var sr=s(["status","drain","resume","stop","reload_roots"]),cr=c({version:n(1),instanceId:t(),deviceId:t(),phase:s(["starting","running","reconnecting","stopping"]),drained:d(),activeClaims:o().int().nonnegative(),activeSessions:o().int().nonnegative().optional(),executionEligible:d(),supportedOperations:u(s(ut)).max(ut.length).optional(),capabilityReadiness:$o(s(ut),d()).optional(),lastHeartbeat:t().nullable(),expiresAt:t()}),Qi=c({nonce:t(),action:sr}),lr=i({nonce:A()}),dr=c({version:n(1),nonce:A(),socketPath:t().max(100)});function ur(e){return oe(w(e).lock,"control.json")}function tt(e){return b(w(e).lock),lr.parse(JSON.parse(h(oe(w(e).lock,"owner.json"))))}function Ze(e){if(!f(e))return!1;let r=Qe(e);if(!r.isSocket()||r.uid!==process.getuid?.()||(r.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function rt(e,r){let p=ur(e);if(!f(p)){let v=w(e).socket;if(!f(v)||!Qe(v).isSocket())return null;return Ze(v)?v:null}let k=dr.parse(JSON.parse(h(p)));if(k.nonce!==r)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!fr.test(k.socketPath))throw Error("worker_control_endpoint_invalid");return k.socketPath}let S=Xe(k.socketPath);if(Xe(S)!==ir("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(Ye(S))||Ye(k.socketPath)!=="control.sock"||Buffer.byteLength(k.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!f(S))return null;return b(S),Ze(k.socketPath)?k.socketPath:null}var fr=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;function mr(e,r){try{let p=JSON.parse(h(oe(w(e).lock,"owner.json"))),k=p&&typeof p==="object"?p[r]:void 0;return typeof k==="string"?k:null}catch{return null}}function ot(e){return mr(e,"runtime_version")}function nt(e,r){if(r)return r.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!f(oe(w(e).lock,"owner.json")))return"no_lock";return rt(e,tt(e).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var ea=c({instance:t().nullable(),since:o().int().nonnegative()});async function G(e,r){let p=w(e);if(!f(oe(p.lock,"owner.json")))return null;let k=tt(e),S=rt(e,k.nonce);if(!S)return null;return new Promise((v,P)=>{let R=ar(S),E="",L=!1,x=(C,T)=>{if(L)return;if(L=!0,R.destroy(),T)P(T);else v(C)};R.setTimeout(2000,()=>R.destroy(Error("worker_control_timeout"))),R.on("connect",()=>R.write(JSON.stringify({nonce:k.nonce,action:r})+`
+`)),R.on("data",(C)=>{if(E+=C.toString(),Buffer.byteLength(E)>16384)R.destroy(Error("worker_control_oversize"))}),R.on("error",(C)=>{if("code"in C&&["ECONNREFUSED","ENOENT"].includes(String(C.code)))x(null);else x(null,C.message==="worker_control_timeout"?C:Error("worker_control_unavailable"))}),R.on("end",()=>{try{let C=cr.parse(JSON.parse(E));if(C.instanceId!==k.nonce)throw Error("worker_instance_changed");x(C)}catch{x(null,Error("worker_control_invalid_response"))}}),R.once("close",()=>x(null,Error("worker_control_unavailable")))})}import{realpathSync as gr}from"fs";import{constants as Pe}from"fs";import{open as pr}from"fs/promises";var sa={platform:process.platform,home:a,async openFile(e){let r=await pr(e,Pe.O_RDONLY|Pe.O_NOFOLLOW|Pe.O_NONBLOCK);return{isFile:async()=>(await r.stat()).isFile(),close:()=>r.close()}}};var Fa=co(gr(process.execPath));var Ps=Buffer.from([0,255,3,4]);import{execFile as to}from"child_process";import{promisify as ro}from"util";var vr=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var Rr=new Set(["png","jpg","jpeg","gif","webp"]),Pr=new Set(["webm","mp4"]);function Er(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function st(e,r){let p;try{p=new URL(e)}catch{return null}let k=Er(r),S=p.hostname==="ara.so"||p.hostname.endsWith(".ara.so")||p.hostname==="reasonmachines.ai"||p.hostname.endsWith(".reasonmachines.ai")||p.hostname==="reasonmachines.com"||p.hostname.endsWith(".reasonmachines.com");if(p.protocol!=="https:"||!S&&p.origin!==k||p.username||p.password||p.port||p.search||p.hash)return null;let v=vr.exec(p.pathname);if(!v)return null;let P=v[1]?.toLowerCase(),R=v[2]?.toLowerCase(),E=v[3]?.toLowerCase(),L=v[4]?.toLowerCase();if(!P||!R||!E||!L)return null;let x=Rr.has(L)?"image":Pr.has(L)?"video":null;if(!x)return null;let C=/^(before|after)[\s:_-]+/.exec(E),T=p.pathname.replace(/^\/media\//,"");return{url:p.toString(),storagePath:T,runId:P,artifactId:R,fileName:`${E}.${L}`,kind:x,phase:C?.[1]==="before"||C?.[1]==="after"?C[1]:null}}var Cr=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,ct=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),K=()=>{throw Error("cloud_browser_media_request_invalid")};function Ce(e){if(!ct(e)||Object.keys(e).some((v)=>!["runId","configuredMediaOrigin","media"].includes(v))||typeof e.runId!=="string"||!Cr.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return K();let r;try{r=new URL(e.configuredMediaOrigin)}catch{return K()}if(r.protocol!=="https:"||r.username||r.password||r.port||!Le(r.origin,{mode:"public_web"}).allowed)return K();let p=e.runId.toLowerCase(),k=new Set,S=e.media.map((v)=>{if(!ct(v)||Object.keys(v).some((R)=>!["url","sourceUrl","kind"].includes(R))||typeof v.url!=="string"||v.url.length>2048||typeof v.sourceUrl!=="string"||v.sourceUrl.length>8192||!["image","video"].includes(String(v.kind)))return K();let P=st(v.url,r.origin);if(!P||new URL(P.url).origin!==r.origin||P.runId!==p||P.kind!==v.kind||P.url!==v.url||k.has(v.url))return K();if(k.add(v.url),v.sourceUrl!==v.url){let R;try{R=new URL(v.sourceUrl)}catch{return K()}let E=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(R.pathname)?.[1];if(v.kind!=="image"||R.origin!=="https://camo.githubusercontent.com"||R.username||R.password||R.search||R.hash||!E||E.length%2!==0||Buffer.from(E,"hex").toString("utf8")!==v.url)return K()}return{url:v.url,sourceUrl:v.sourceUrl,kind:v.kind}});return{runId:e.runId,configuredMediaOrigin:r.origin,media:S}}var I=t().uuid(),X=t().regex(/^[a-f0-9]{64}$/),V=y.datetime({precision:3}),Ae=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),ft=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),U=i({kind:n("primary_mac"),version:n(1),organizationId:Ae,userId:Ae,sessionId:Ae,runId:I,deviceId:I,rootId:I,rootRevision:t().min(1).max(64),binding:s(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:I,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Ar=Kr().transform((e,r)=>{try{return Qr(e)}catch{return r.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),go}}),ue=i({version:n(1),owner:U,contextId:I,preparedAt:V,expiresAt:V,prUrl:ft,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:X,evidenceKind:s(["image","video"]),visualPlan:Ar.optional(),uploadOrigin:t().url().refine((e)=>{let r=new URL(e);return r.protocol==="https:"&&r.origin===e&&!r.username&&!r.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),Ir=i({version:n(1),producer:n("primary_mac"),context:ue,captureId:I,operationId:I,attemptId:I,tabId:o().int().positive(),startedAt:V,finishedAt:V,sha256:X,media:_("contentType",[i({contentType:n("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),i({contentType:n("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,r)=>{let p=Date.parse(e.startedAt),k=Date.parse(e.finishedAt);if(p<Date.parse(e.context.preparedAt)||k<p||k>Date.parse(e.context.expiresAt)||k-p>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((k-p)/1000-e.media.durationSeconds)>0.1))r.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),vc=_("action",[i({action:n("screenshot"),context_id:I,tab_id:o().int().positive()}).strict(),i({action:n("start_video"),context_id:I,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),i({action:n("stop_video"),recording_operation_id:I}).strict()]),fe=i({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),ce=t().regex(/^[1-9][0-9]{0,19}$/),le=i({version:n(1),owner:U,expectedActorId:ce.nullable(),repositoryId:ce,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),Or=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],Lr=_("status",[le.extend({status:n("ready"),observedActor:fe,checkedAt:V}),le.extend({status:n("not_ready"),reason:s(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:s(Or).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),Y=i({version:n(1),owner:U,expectedActorId:ce.nullable(),authenticatedActor:fe,attemptId:I,captureId:I,prUrl:ft,repositoryId:ce,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:X,sizeBytes:o().int().min(128).max(10485760),contentType:n("video/webm")}).strict(),pt=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),Mr=_("status",[Y.extend({status:n("not_attempted"),reason:s(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),Y.extend({status:n("uncertain"),reason:n("upload_outcome_unknown")}),Y.extend({status:n("uploaded"),observedActor:fe,nativeUrl:pt,uploadedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),de=Y.extend({nativeUrl:pt,observedActor:fe,bodySha256:X}),Tr=_("status",[de.extend({status:n("incomplete"),reason:s(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),de.extend({status:n("verified"),sourceSha256:X,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:n(!0),verifiedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Wr=Kr().transform((e,r)=>{try{let p=Ce(e);if(p.media.some((k)=>k.kind!=="image"))throw Error();return p}catch{return r.addIssue({code:"custom",message:"proof_media_request_invalid"}),go}}),Nr=_("action",[i({action:n("auth_check"),input:le}).strict(),i({action:n("prepare"),context:ue}).strict(),i({action:n("capture_png"),owner:U,contextId:I,tabId:o().int().positive()}).strict(),i({action:n("start_video"),owner:U,contextId:I,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),i({action:n("inspect_capture"),owner:U,captureId:I}).strict(),i({action:n("publish_video"),input:Y}).strict(),i({action:n("verify_png_media"),owner:U,media:Wr}).strict().refine((e)=>e.media.runId===e.owner.runId),i({action:n("verify_saved_media"),input:de}).strict(),i({action:n("publish_png"),owner:U,attemptId:I,captureId:I,sha256:X,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var Hr=i({requestId:I,command:Nr}).strict();var $r={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},lt={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},dt={type:"integer",minimum:1,description:"An already-owned tab's id."},Sc={...$r,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:lt,tab_id:dt}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:lt,tab_id:dt,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};var Ac=i({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict();var Br=String.raw`async (media) => {
   const deadline = (promise) => {
     let timer;
     return Promise.race([promise, new Promise((_, reject) => {
@@ -49,4 +49,4 @@ ${r?.directory??m(e)}`).digest("hex")}var Bt="keychain-scope.json";var Ut=c({ver
     }
   }));
   return { verified: true, items };
-}`;import{execFile as Fr}from"child_process";import{promisify as jr}from"util";var Tc=jr(Fr);var Xc=_("ok",[i({ok:n(!0),actor:i({login:t(),id:t().nullable()}).strict()}).strict(),i({ok:n(!1),reason:s(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),Zc=i({version:n("0.1.42"),metadata:i({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var tl=i({version:n(1),recording_operation_id:t().uuid(),proof_ready:n(!1),acknowledged_at:y.datetime()}).strict(),me=i({action:n("start"),request_id:t().uuid(),profile:t().regex(/^(Default|Profile [0-9]+)$/),tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),pt=i({action:n("inspect"),recording_operation_id:t().uuid()}).strict(),rl=_("action",[me,pt]),wt=i({recording_operation_id:t().uuid()}).strict(),Le={device_id:t().uuid(),root_id:t().uuid()},zr=_("action",[me.extend(Le),pt.extend(Le),wt.extend({...Le,action:n("stop")})]),ol=Wr(zr),nl=i({version:n(1),recordingId:t().uuid(),proofReady:n(!1),capture:i({captureId:t().uuid(),contentType:n("video/webm"),sha256:t().regex(/^[a-f0-9]{64}$/),sizeBytes:o().int().min(128).max(10485760),startedAt:y.datetime(),finishedAt:y.datetime(),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000),owner:i({runId:t().uuid(),deviceId:t().uuid(),rootId:t().uuid(),rootRevision:t().max(64),profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024),generation:t().uuid(),browserScope:t().max(128),tabId:o().int().positive()}).strict()}).strict().refine((e)=>e.receivedFrameCount>=e.frameCount&&Math.abs((Date.parse(e.finishedAt)-Date.parse(e.startedAt))/1000-e.durationSeconds)<=0.1)}).strict();var pl=me.extend({action:s(["start","inspect"]),recording_boot_generation:t().uuid(),recording_operation_id:t().uuid().optional(),recording_attempt_id:t().uuid().optional()}).strict();import{execFile as Kr}from"child_process";import{promisify as Jr}from"util";var yl=Jr(Kr);var Gr=s(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var j=t().min(1).max(1024),gt=i({path:j,sha256:t().regex(/^[a-f0-9]{64}$/)}).strict(),Yr=i({owner:i({runId:j,deviceId:j,rootId:j,rootRevision:j,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:j,generation:j,browserScope:j,tabId:o().int().positive()}).strict(),socketPath:j,extensionId:t().regex(/^[a-p]{32}$/),nativeHostName:j,seconds:o().int().min(1).max(15),encoder:i({ffmpeg:gt,ffprobe:gt}).strict()}).strict();var $l=i({version:n("0.1.42"),metadata:i({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var Xl=i({operationId:t().uuid()}).strict();var yd=ro(to);var _d=i({version:n("0.1.42"),metadata:i({extensionId:n(F),extensionInstanceId:t().min(1).max(1024)})});var Me=1;var $f=c({type:n("configure"),protocol:n(Me),version:t(),config:B}),Bf=c({type:n("ticket"),organizationId:t().min(1).max(160),receipt:Pe()}),Uf=c({type:s(["ping","stop"])});var om=c({type:n("hello"),protocol:n(Me),version:t(),platform:s(["linux","darwin"]),architecture:s(["arm64","x64"]),enrolled:d()}),nm=c({type:n("ticket-request"),request:c({install_id:A(),code_challenge:t().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:s(["persistent","ephemeral"]),roots:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),execution_mode:s(["confined","host"]),permissions:c({read:n(!0),write:n(!0),execute:n(!0),discover_environment:n(!0),expose_mcp:n(!1)})})).length(1)})}),im=_("type",[c({type:n("running"),deviceId:t().min(1).max(160),expiresAt:y.datetime({offset:!0}),lifetime:s(["persistent","ephemeral"]),supervision:n("ssh-foreground")}),c({type:n("pong")}),c({type:n("stopped")})]);var ko=1;var Z=A(),vo=c({kind:n("install_only"),authorityId:Z,organizationId:Z,userId:Z,connectionId:Z,attemptId:Z,purpose:n("install"),generation:o().int().positive(),transport:n("reverse_ssh"),expiresAt:y.datetime({offset:!0}),maxDurationMs:n(300000),maxChannels:n(1),allowTcpForwarding:n(!1),allowPty:n(!1)}),So=t().max(2048).superRefine((e,r)=>{let p;try{p=new URL(e)}catch{r.addIssue({code:"custom",message:"invalid relay url"});return}if(p.protocol!=="ws:"&&p.protocol!=="wss:"){r.addIssue({code:"custom",message:"invalid relay protocol"});return}if(p.username||p.password||p.search||p.hash){r.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let k=p.pathname.split("/");if(k.length!==4||k[1]!=="device"||!Z.safeParse(k[2]).success||!/^[a-f0-9]{64}$/.test(k[3]??""))r.addIssue({code:"custom",message:"invalid device relay path"});if(p.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(p.hostname))r.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var cm=c({protocol:n(ko),type:n("ssh_install_relay"),authorityToken:t().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:vo,relayUrl:So,endpoint:c({host:n("127.0.0.1"),port:n(22)})});class Et extends Error{}function Ie(e){if(!f(e))return null;let r=new Et(`${e} is not a valid worker config. Remove it to start over.`),p;try{p=JSON.parse(h(e))}catch(S){if(S instanceof SyntaxError)throw r;throw S}let k=B.safeParse(p);if(!k.success)throw r;return k.data}var Mo=200;var rh=c({version:n(1),session_ids:u(t().min(1).max(200)).max(Mo)});function Ge(e,r,p=!1){let k=To(e,r,p);return k.length===1?k[0]:J(ve(J(e,".config")),...Ct(r,p))}var Ct=(e,r)=>[...e==="production"?[]:[e],r?"connect-once":"connect"];function To(e,r,p=!1){let k=e;try{k=pe(e)}catch{}return["ara","reason"].map((S)=>J(k,".config",S,...Ct(r,p))).filter(Do)}function Do(e){try{if(pe(e)!==e)return!1;return Ie(J(e,"worker.json"))?.stateDirectory===e}catch{return!1}}var Wo="disconnected.json";function Bo(e,r){return f(J(Ge(e,r),Wo))}function No(e,r){return r==="darwin"&&e.userChrome!==!1}var Ow=i({root:i({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});var Lw=Symbol("serve here");async function Fo(e={}){let r=pe(e.home??a()),p=Ie(J(Ge(r,e.channel??g()),"worker.json"));if(!p)return null;let k,S=await(e.controlWorker??G)(p,"status").catch((D)=>(k=D instanceof Error?D:Error(String(D)),null)),v=S?ot(p):null,P=e.serviceHost??be(r),R=He(p,P,"connect"),E=H(p).revoked,L=!E&&!S,x=(()=>{try{return M(p)}catch{return null}})(),{workspaces:C,off:T}=E||ge(p.stateDirectory)!==null?{workspaces:null,off:null}:Ke(p,S?.phase==="running");return{workspaces:C,workspaces_off:T,workspaces_max:ze+(C?.filter((D)=>D.account).length??0),name:p.name,device_id:x?.deviceId??null,organization_id:x?.orgId??null,folder:p.workspaceRoot,mode:p.executionMode,sessions_max:null,user_chrome:No(p,P.platform),cloud_sessions:p.cloudSessions===!0,root:x?.roots[0]?{id:x.roots[0].id,permissions:x.roots[0].permissions}:null,roots:x?.roots.map((D)=>({id:D.id,folder:D.path,permissions:D.permissions}))??[],state:E?"removed":S?S.phase==="running"?"connected":S.phase:"not_running",not_running_reason:L?nt(p,k):null,worker_alive:L&&R?kn(R,P):null,sessions_running:S?.activeSessions??null,version:v,service:R?{label:R.label,logs:R.logs}:null}}function jo(e={}){let r=pe(e.home??a()),p=Ie(J(Ge(r,e.channel??g()),"worker.json"));if(!p)return null;return Or(p,e.serviceHost??be(r),"connect")?.label??null}export{w,M,Jt,Ie,Ge,Bo,Fo,jo};
+}`;import{execFile as Ur}from"child_process";import{promisify as Fr}from"util";var Tc=Fr(Ur);var Xc=_("ok",[i({ok:n(!0),actor:i({login:t(),id:t().nullable()}).strict()}).strict(),i({ok:n(!1),reason:s(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),Zc=i({version:n("0.1.42"),metadata:i({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var tl=i({version:n(1),recording_operation_id:t().uuid(),proof_ready:n(!1),acknowledged_at:y.datetime()}).strict(),me=i({action:n("start"),request_id:t().uuid(),profile:t().regex(/^(Default|Profile [0-9]+)$/),tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),ht=i({action:n("inspect"),recording_operation_id:t().uuid()}).strict(),rl=_("action",[me,ht]),wt=i({recording_operation_id:t().uuid()}).strict(),xe={device_id:t().uuid(),root_id:t().uuid()},qr=_("action",[me.extend(xe),ht.extend(xe),wt.extend({...xe,action:n("stop")})]),ol=Gr(qr),nl=i({version:n(1),recordingId:t().uuid(),proofReady:n(!1),capture:i({captureId:t().uuid(),contentType:n("video/webm"),sha256:t().regex(/^[a-f0-9]{64}$/),sizeBytes:o().int().min(128).max(10485760),startedAt:y.datetime(),finishedAt:y.datetime(),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000),owner:i({runId:t().uuid(),deviceId:t().uuid(),rootId:t().uuid(),rootRevision:t().max(64),profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024),generation:t().uuid(),browserScope:t().max(128),tabId:o().int().positive()}).strict()}).strict().refine((e)=>e.receivedFrameCount>=e.frameCount&&Math.abs((Date.parse(e.finishedAt)-Date.parse(e.startedAt))/1000-e.durationSeconds)<=0.1)}).strict();var pl=me.extend({action:s(["start","inspect"]),recording_boot_generation:t().uuid(),recording_operation_id:t().uuid().optional(),recording_attempt_id:t().uuid().optional()}).strict();import{execFile as zr}from"child_process";import{promisify as Vr}from"util";var yl=Vr(zr);var Jr=s(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var j=t().min(1).max(1024),gt=i({path:j,sha256:t().regex(/^[a-f0-9]{64}$/)}).strict(),Yr=i({owner:i({runId:j,deviceId:j,rootId:j,rootRevision:j,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:j,generation:j,browserScope:j,tabId:o().int().positive()}).strict(),socketPath:j,extensionId:t().regex(/^[a-p]{32}$/),nativeHostName:j,seconds:o().int().min(1).max(15),encoder:i({ffmpeg:gt,ffprobe:gt}).strict()}).strict();var $l=i({version:n("0.1.42"),metadata:i({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var Xl=i({operationId:t().uuid()}).strict();var yd=ro(to);var _d=i({version:n("0.1.42"),metadata:i({extensionId:n(F),extensionInstanceId:t().min(1).max(1024)})});var Oe=1;var Uf=c({type:n("configure"),protocol:n(Oe),version:t(),config:B}),Ff=c({type:n("ticket"),organizationId:t().min(1).max(160),receipt:Te()}),jf=c({type:s(["ping","stop"])});var im=c({type:n("hello"),protocol:n(Oe),version:t(),platform:s(["linux","darwin"]),architecture:s(["arm64","x64"]),enrolled:d()}),am=c({type:n("ticket-request"),request:c({install_id:A(),code_challenge:t().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:s(["persistent","ephemeral"]),roots:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),execution_mode:s(["confined","host"]),permissions:c({read:n(!0),write:n(!0),execute:n(!0),discover_environment:n(!0),expose_mcp:n(!1)})})).length(1)})}),sm=_("type",[c({type:n("running"),deviceId:t().min(1).max(160),expiresAt:y.datetime({offset:!0}),lifetime:s(["persistent","ephemeral"]),supervision:n("ssh-foreground")}),c({type:n("pong")}),c({type:n("stopped")})]);var ko=1;var Z=A(),vo=c({kind:n("install_only"),authorityId:Z,organizationId:Z,userId:Z,connectionId:Z,attemptId:Z,purpose:n("install"),generation:o().int().positive(),transport:n("reverse_ssh"),expiresAt:y.datetime({offset:!0}),maxDurationMs:n(300000),maxChannels:n(1),allowTcpForwarding:n(!1),allowPty:n(!1)}),So=t().max(2048).superRefine((e,r)=>{let p;try{p=new URL(e)}catch{r.addIssue({code:"custom",message:"invalid relay url"});return}if(p.protocol!=="ws:"&&p.protocol!=="wss:"){r.addIssue({code:"custom",message:"invalid relay protocol"});return}if(p.username||p.password||p.search||p.hash){r.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let k=p.pathname.split("/");if(k.length!==4||k[1]!=="device"||!Z.safeParse(k[2]).success||!/^[a-f0-9]{64}$/.test(k[3]??""))r.addIssue({code:"custom",message:"invalid device relay path"});if(p.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(p.hostname))r.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var dm=c({protocol:n(ko),type:n("ssh_install_relay"),authorityToken:t().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:vo,relayUrl:So,endpoint:c({host:n("127.0.0.1"),port:n(22)})});class Et extends Error{}function De(e){if(!f(e))return null;let r=new Et(`${e} is not a valid worker config. Remove it to start over.`),p;try{p=JSON.parse(h(e))}catch(S){if(S instanceof SyntaxError)throw r;throw S}let k=B.safeParse(p);if(!k.success)throw r;return k.data}var Lo=200;var nh=c({version:n(1),session_ids:u(t().min(1).max(200)).max(Lo)});function Ke(e,r,p=!1){let k=Mo(e,r,p);return k.length===1?k[0]:J(ve(J(e,".config")),...Ct(r,p))}var Ct=(e,r)=>[...e==="production"?[]:[e],r?"connect-once":"connect"];function Mo(e,r,p=!1){let k=e;try{k=pe(e)}catch{}return["ara","reason"].map((S)=>J(k,".config",S,...Ct(r,p))).filter(To)}function To(e){try{if(pe(e)!==e)return!1;return De(J(e,"worker.json"))?.stateDirectory===e}catch{return!1}}var Do="disconnected.json";function jo(e,r){return f(J(Ke(e,r),Do))}function Wo(e,r){return r==="darwin"&&e.userChrome!==!1}var Mw=i({root:i({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});var Tw=Symbol("serve here");async function Uo(e={}){let r=pe(e.home??a()),p=De(J(Ke(r,e.channel??g()),"worker.json"));if(!p)return null;let k,S=await(e.controlWorker??G)(p,"status").catch((D)=>(k=D instanceof Error?D:Error(String(D)),null)),v=S?ot(p):null,P=e.serviceHost??be(r),R=qe(p,P,"connect"),E=H(p).revoked,L=!E&&!S,x=(()=>{try{return M(p)}catch{return null}})(),{workspaces:C,off:T}=E||ge(p.stateDirectory)!==null?{workspaces:null,off:null}:Ve(p,S?.phase==="running");return{workspaces:C,workspaces_off:T,workspaces_max:ze+(C?.filter((D)=>D.account).length??0),name:p.name,device_id:x?.deviceId??null,organization_id:x?.orgId??null,folder:p.workspaceRoot,mode:p.executionMode,sessions_max:null,user_chrome:Wo(p,P.platform),cloud_sessions:p.cloudSessions===!0,root:x?.roots[0]?{id:x.roots[0].id,permissions:x.roots[0].permissions}:null,roots:x?.roots.map((D)=>({id:D.id,folder:D.path,permissions:D.permissions}))??[],state:E?"removed":S?S.phase==="running"?"connected":S.phase:"not_running",not_running_reason:L?nt(p,k):null,worker_alive:L&&R?An(R,P):null,sessions_running:S?.activeSessions??null,version:v,service:R?{label:R.label,logs:R.logs}:null}}function Ho(e={}){let r=pe(e.home??a()),p=De(J(Ke(r,e.channel??g()),"worker.json"));if(!p)return null;return Dr(p,e.serviceHost??be(r),"connect")?.label??null}export{w,M,Xt,De,Ke,jo,Uo,Ho};

package/bin/vm-hands/{vm-hands-entry-lite-w9ckj5k4.js → vm-hands-entry-lite-zg36myyf.js}

@@ -1,5 +1,5 @@
 // @bun
-import{C}from"./vm-hands-entry-lite-t7an5zg2.js";import{g,Nr,Wi,ve}from"./vm-hands-entry-lite-5p5h1eng.js";import{t,o,d,u,i,No,Q,_,s,n}from"./vm-hands-entry-lite-zn0v259d.js";var J=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function P(e){let r=typeof e==="string"?J.exec(e):null;return r?{major:Number(r[1]),minor:Number(r[2])}:null}var K=25,Le=i({machine:t().min(1).max(200),person:t().min(1).max(200),team:t().min(1).max(200),version:t().max(64).optional(),wait_seconds:o().int().min(0).max(K).optional()}),W=_("kind",[i({id:t(),kind:n("who"),all:d().optional()}),i({id:t(),kind:n("send"),to:t(),body:t(),from_name:t(),from_agent:t(),wake:d(),reply_to:t().max(100).optional(),notify:d().optional()})]),x=i({job:W.nullable(),retry_after_seconds:o().optional()}),V=i({address:t(),person:t(),machine:t(),agent:t(),repo:t().nullable(),branch:t().nullable(),status:t(),since:o().nullable(),doing:t().nullable(),worker:d(),tier:t().max(10).optional()}),Y=i({person:t(),machine:t(),online:d()}),X=i({team:t().nullable(),sessions:u(V).max(2000),machines:u(Y).max(500),all:d().optional()}),Z=i({address:t().max(300),state:t().max(40),note:t().max(500)}),Ne=Q([i({who:X}),i({sent:i({ids:u(t().max(100)).max(500),recipients:u(t().max(300)).max(500),from:t().max(300),deliveries:u(Z).max(500).optional()})}),i({error:t().min(1).max(2000)})]),ee=i({id:t().max(100),from:t().max(300),from_agent:t().max(100).nullable(),to:t().max(300),reply_to:t().max(100).nullable(),body:t().max(64000),sent_at:o()}),De=i({messages:u(ee).max(100)});import{randomBytes as ne}from"crypto";import{chmodSync as A,existsSync as U,lstatSync as te,mkdirSync as se,readFileSync as T,renameSync as oe,unlinkSync as q,writeFileSync as O}from"fs";import{homedir as re}from"os";import{dirname as ie,join as I}from"path";function b(e=process.env,r=re()){let a=e.XDG_CONFIG_HOME?.trim()||I(r,".config"),c=g({env:e})==="staging"?["staging"]:[];return I(ve(a,...c),"credentials.json")}function z(e,r=b()){return se(ie(r),{recursive:!0,mode:448}),O(r,`${JSON.stringify(e,null,2)}
-`,{mode:384}),A(r,384),r}function v(e=b()){if(!U(e))return null;try{let r=T(e,"utf8"),a=JSON.parse(r);if(typeof a.apiOrigin!=="string"||typeof a.clientId!=="string"||typeof a.accessToken!=="string"||typeof a.refreshToken!=="string"||typeof a.expiresAt!=="string"||typeof a.orgId!=="string"||!Array.isArray(a.scopes))return null;let l=new URL(a.apiOrigin).origin,c=Nr(l);if(c!==l)ae(e,r,c);return{apiOrigin:c,clientId:a.clientId,accessToken:a.accessToken,refreshToken:a.refreshToken,expiresAt:a.expiresAt,scopes:a.scopes.filter((m)=>typeof m==="string"),orgId:a.orgId}}catch{return null}}function ae(e,r,a){let l=`${e}.${process.pid}.${ne(6).toString("hex")}.tmp`;try{let c=te(e);if(!c.isFile()||process.platform!=="win32"&&c.uid!==process.geteuid?.())return;let m=JSON.parse(r);if(O(l,`${JSON.stringify({...m,apiOrigin:a},null,2)}
-`,{mode:384,flag:"wx"}),A(l,384),T(e,"utf8")!==r)throw Error("credentials_changed");oe(l,e)}catch{try{q(l)}catch{}}}function M(e=b()){if(!U(e))return!1;return q(e),!0}var j=["run","mcp:read","mcp:write","secrets:read","secrets:write","sessions:read","sessions:debug","devices:read","devices:write","devices:use","ssh:write","knowledge:read","memory:read","memory:write","skills:read","skills:write","repos:read","repos:write","reviews:read","reviews:write","deployment:read","analytics:read","org:read","org:write","attachments:read","attachments:write","guardrails:read","guardrails:write","network:read","network:write","automations:read","automations:write","agent_auth:read"];var cn=j.filter((e)=>e!=="network:read"&&e!=="network:write");class w extends Error{oauthCode;constructor(e,r=null){super(e);this.oauthCode=r;this.name="LoginError"}}function le(e,r){let a=typeof e.error==="string"?e.error:null,l=typeof e.error_description==="string"?e.error_description:a?a:r;return new w(l,a)}async function ce(e,r,a,l){let c=await a(`${e}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:r,signal:l}),m=await c.json().catch(()=>({}));if(!c.ok)throw le(m,`OAuth token request failed (${c.status})`);return m}var de=1e4;async function me(e,r={}){let a=r.fetchImpl??fetch,l=await ce(e.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:e.clientId,refresh_token:e.refreshToken}),a,AbortSignal.timeout(de)).catch((m)=>{if(m instanceof Error&&m.name==="TimeoutError")throw new w("Reason did not answer the login refresh in time. Check the network and retry.");throw m});if(typeof l.access_token!=="string"||typeof l.refresh_token!=="string"||typeof l.expires_in!=="number")throw new w("Reason returned an incomplete refreshed login.");let c={...e,accessToken:l.access_token,refreshToken:l.refresh_token,expiresAt:new Date(Date.now()+l.expires_in*1000).toISOString(),scopes:typeof l.scope==="string"?l.scope.split(/\s+/).filter(Boolean):e.scopes};return z(c,r.path??b()),c}var S=new Map;function E(e,r){if(!r)return e;if(r.aborted)return Promise.reject(r.reason);return new Promise((a,l)=>{let c=()=>l(r.reason);r.addEventListener("abort",c,{once:!0}),e.then(a,l).finally(()=>r.removeEventListener("abort",c))})}async function mt(e={}){let r=e.path??b(),a=v(r);if(!a)return null;let l=e.apiOrigin??C(process.env,"REASON_API_URL")?.trim();if(l&&!Wi(a.apiOrigin,new URL(l).origin))return null;let c=Date.parse(a.expiresAt)<=Date.now()+60000;if(!e.forceRefresh&&!c)return a;let m=[r,a.apiOrigin,a.clientId,a.refreshToken].join("\x00"),p=S.get(m);if(p)return E(p,e.signal);let f;return f=me(a,{fetchImpl:e.fetchImpl,path:r}).catch(async(y)=>{if(!(y instanceof w)||y.oauthCode!=="invalid_grant"&&y.oauthCode!=="invalid_client")throw y;let k=v(r),B=y.oauthCode==="invalid_client"?k?.clientId!==a.clientId:k?.refreshToken!==a.refreshToken;if(k&&B)return mt({fetchImpl:e.fetchImpl,path:r});return M(r),null}).finally(()=>{if(S.get(m)===f)S.delete(m)}),S.set(m,f),E(f,e.signal)}var ue=i({label:t(),used_percent:o().min(0).max(100).nullable(),resets_at:t().nullable(),exhausted:d().nullable()}),ge=i({groups:u(i({selectable:d().optional(),accounts:u(i({source_id:t().min(1),model_ids:u(t().min(1)).optional()}))}))});function he(e){let r=ge.safeParse(e);if(!r.success)return;return r.data.groups.some((a)=>a.selectable!==!1&&a.accounts.some((l)=>l.model_ids===void 0||l.model_ids.length>0))}class R extends Error{status;code;suggestedModel;retryAfterMs;resolutionReason;constructor(e,r,a,l,c,m){super(a);this.status=e;this.code=r;this.suggestedModel=l;this.retryAfterMs=c;this.resolutionReason=m;this.name="ApiError"}static rateLimitDelayMs(e,r){if(!(e instanceof R)||e.status!==429)return null;return Math.min(60000,Math.max(r,e.retryAfterMs??0))}}var pe=["minimal","low","medium","high","xhigh","max"],fe=i({id:t().min(1),kind:t(),name:t(),custom_name:t().nullish(),status:t(),online:d(),compatible:d().optional(),compatibility_reason:t().nullish(),folder_lane_of:t().nullish(),roots:u(i({id:t().min(1),label:t()}))}),ye=i({devices:u(fe),end_cursor:t().nullish(),has_next_page:d().optional()}),_e=i({id:t().min(1),name:t()}),be=i({items:u(_e)}),Re=i({id:t().min(1),name:t(),main:d(),mine:d(),session_id:t().nullish(),appearance:i({color:t().nullish()}).nullish().catch(null)}),we=i({items:u(Re)}),Se=i({skill_id:t().min(1),name:t(),description:t().nullish(),activation_keywords:u(t()).default([]),is_enabled:d().default(!0)}),ke=i({items:u(Se).default([])}),Pe=i({id:t().min(1),kind:t(),enabled:d(),schedule:i({expression:t().nullish(),every_seconds:o().nullish(),next_run_at:t().nullish()}).nullish(),github:i({event:t().nullish(),action:t().nullish(),repo:t().nullish()}).nullish(),last_fired_at:t().nullish()}),N=i({id:t().min(1),name:t().nullish(),instructions:t().nullish(),enabled:d(),triggers:u(Pe).default([])}),xe=i({items:u(N).default([]),end_cursor:t().nullish(),has_next_page:d().optional()}),Ie=i({id:t().min(1),slug:t().nullish(),name:t(),description:t().nullish(),transport:t().nullish(),url:t().nullish(),enabled:d()}),Ce=i({items:u(Ie).default([])}),$e=i({status:t(),summary:t().nullish(),category:t().nullish(),outcome:t().nullish(),message_count:o().nullish(),pr_url:t().nullish(),cost_usd:o().nullish(),generated_at:t().nullish()}),L=i({tags:u(t()).default([])}),Ae=s(["linux","macos"]),D=i({id:t().min(1),name:t().min(1),platform:Ae.nullable(),workers:i({total:o().int(),online:o().int(),busy:o().int(),idle:o().int()}),sessions:i({queued:o().int(),running:o().int()})}),Ue=i({machines:u(D)}),Te=i({machine:D}),qe=i({deleted:n(!0),revoked_workers:o().int(),revoked_tokens:o().int()}),Oe=i({token:i({id:t().min(1),machine_id:t().min(1),token_prefix:t()}),secret:t().startsWith("rmt_")}),H=No({machine_id:t().min(1),machine_name:t().min(1)}),ze=H.extend({organization_id:t().min(1)}),pn=i({id:t().min(1),name:t().min(1),state:s(["waiting","placed"]),queue_position:o().int().nullable()});var fn=Q([i({kind:n("cloud")}),i({kind:s(["mac","headless"]),device_id:t().min(1),root_id:t().min(1)})]);function h(e,r,a){let l=e.safeParse(r);if(!l.success)throw new R(502,a,"Reason returned an unexpected response.");return l.data}var Me=i({error:i({type:t(),message:t()})});function F(e,r,a){let l=Me.safeParse(r),c=typeof r.error==="string"?r.error:l.success?l.data.error.type:`http_${e}`,m=typeof r.detail==="string"?r.detail:typeof r.message==="string"?r.message:l.success?l.data.error.message:`Reason request failed (${e}${typeof r.error==="string"?` ${r.error}`:""})`,p=c==="github_connection_required"&&typeof r.connect_url==="string"&&/^https?:\/\//.test(r.connect_url)?` Connect it at ${r.connect_url}`:"",f=a===null||a.trim()===""?NaN:Number(a);return new R(e,c,`${m}${p}`,typeof r.suggested_model==="string"?r.suggested_model:void 0,Number.isFinite(f)&&f>=0?f*1000:void 0,typeof r.resolution_reason==="string"?r.resolution_reason:void 0)}async function zo(e){let r=await(e.fetchImpl??fetch)(`${e.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${e.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:AbortSignal.timeout(30000),redirect:"error"}),a=await r.json().catch(()=>({}));if(!r.ok)throw F(r.status,a,r.headers.get("retry-after"));return h(ze,a,"invalid_machine_ticket")}class vo{options;credentials;constructor(e,r={}){this.options=r;this.credentials=e}trackEvent(e,r={}){}async request(e,r={},a=!1){let l=this.options.fetchImpl??fetch,c=await l(`${this.credentials.apiOrigin}/v3${e}`,{method:r.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...r.raw?{"content-type":r.raw.contentType}:r.body===void 0?{}:{"content-type":"application/json"},...r.headers},body:r.raw?r.raw.bytes:r.body===void 0?void 0:JSON.stringify(r.body),signal:r.signal,redirect:"error"}),m=await c.json().catch(()=>({}));if(c.status===401&&!a&&r.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let p=await mt({fetchImpl:l,path:this.options.credentialsPath,forceRefresh:!0,signal:r.signal});if(p)return this.credentials=p,this.request(e,r,!0)}if(!c.ok)throw F(c.status,m,c.headers.get("retry-after"));return m}createHeadlessDeviceEnrollmentTicket(e){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:e,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice(e){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:e,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(r){if(r instanceof R&&(r.status===404||r.status===405||r.status===403&&r.code==="endpoint_not_available"))return null;throw r}}addDeviceRoot(e,r){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent(e)}/roots`,{method:"POST",body:r,signal:AbortSignal.timeout(30000)})}removeDeviceRoot(e,r){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent(e)}/roots/${encodeURIComponent(r)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath(e,r=""){let a=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return e===void 0?a:`${a}/${encodeURIComponent(e)}${r}`}async listMachines(){return h(Ue,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine(e){let r=await this.request(this.machinePath(),{method:"POST",body:{name:e.name,...e.platform?{platform:e.platform}:{}}});return h(Te,r,"invalid_machine").machine}async deleteMachine(e){let r=await this.request(this.machinePath(e),{method:"DELETE"});return h(qe,r,"invalid_machine_deletion")}async createMachineToken(e){let r=await this.request(this.machinePath(e,"/tokens"),{method:"POST",body:{}});return h(Oe,r,"invalid_machine_token")}async createMachineEnrollmentTicket(e,r){let a=await this.request(this.machinePath(e,"/enrollment-tickets"),{method:"POST",body:r,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return h(H,a,"invalid_machine_ticket")}self(e){return this.request("/self",{signal:e})}agentNetwork(){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{signal:AbortSignal.timeout(30000)})}startAgentNetwork(e){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{method:"POST",body:e,signal:AbortSignal.timeout(30000)})}rotateAgentNetwork(e){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{method:"PUT",body:e,signal:AbortSignal.timeout(30000)})}async claimAgentNetworkRelayJob(e,r){let a=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/claim`,{method:"POST",body:e,signal:r});return h(x,a,"invalid_agent_network_job")}async completeAgentNetworkRelayJob(e,r){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/jobs/${encodeURIComponent(e)}`,{method:"POST",body:r,signal:AbortSignal.timeout(30000)})}async recordAgentNetworkRelayReplies(e){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/replies`,{method:"POST",body:{messages:e},signal:AbortSignal.timeout(30000)})}async workspaceMembers(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/members/users`,{signal:AbortSignal.timeout(30000)})).items??[]).flatMap((r)=>typeof r.email==="string"?[{email:r.email,role:typeof r.role==="string"?r.role:"member"}]:[])}claimExistingCliPairing(e){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:e}})}async claudeCodeSignIn(e){return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials`,{retryUnauthorized:!1,signal:e?AbortSignal.any([e,AbortSignal.timeout(15000)]):AbortSignal.timeout(15000)})).claude_code_sign_in===!0}connectAnthropicProvider(e,r,a={}){let l=e.kind==="setup_token"?{setup_token:e.token}:{access_token:e.credential.access,refresh_token:e.credential.refresh,expires_at:new Date(e.credential.expires).toISOString()};return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:a.retryUnauthorized,signal:a.signal,body:{...l,...r?{account_key:r}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((r)=>{let a=typeof r.full_name==="string"?r.full_name:typeof r.repo_full_name==="string"?r.repo_full_name:null;if(!a)return[];return[{repo_id:typeof r.repo_id==="string"?r.repo_id:void 0,full_name:a,provider:r.provider==="gitlab"?"gitlab":"github",default_branch:typeof r.default_branch==="string"?r.default_branch:null,private:typeof r.private==="boolean"?r.private:void 0}]})}async listProjects(){let e=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),r=be.safeParse(e);if(!r.success)throw new R(502,"invalid_project_list","Reason returned an unexpected project list.");return r.data.items}async listReasons(){let e=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons`);return h(we,e,"invalid_reason_list").items}async openReasonConversation(e){let r=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons/${encodeURIComponent(e)}/conversation`,{method:"POST"});return h(i({session_id:t().min(1)}),r,"invalid_reason_conversation").session_id}async listSkills(){try{let e=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return h(ke,e,"invalid_skill_list").items}catch(e){if(e instanceof R&&(e.status===403||e.status===404))return[];throw e}}async listDevices(){let e=[],r=null;for(let a=0;a<50;a+=1){let l=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${r?`?after=${encodeURIComponent(r)}`:""}`),c=ye.safeParse(l);if(!c.success)throw new R(502,"invalid_device_list","Reason returned an unexpected machine list.");if(e.push(...c.data.devices),r=c.data.has_next_page?c.data.end_cursor??null:null,!r)break}return e}async listModels(){try{let r=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((c)=>c.hidden!==!0),a=r.filter((c)=>c.available!==!1).map(({reasoning_efforts:c,hidden:m,available:p,...f})=>({...f,...Array.isArray(c)?{reasoning_efforts:pe.filter((y)=>c.includes(y))}:{}})),l=new Set(a.map((c)=>c.detail));return{models:a.length>1&&l.size===1?a.map(({detail:c,...m})=>m):a,runnable:a.length>0||r.length===0}}catch(e){if(e instanceof R&&(e.status===403||e.status===404))return{models:[],runnable:!0};throw e}}async getAgentVersion(e){try{let r=await this.request("/deployment",{signal:e,retryUnauthorized:!1});return P(r.reason_version)?r.reason_version:null}catch{return null}}async getUsageQuota(){try{let e=ue.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!e.success)return null;let r;try{r=he(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...e.data,own_inference:r}}catch(e){if(e instanceof R&&(e.status===403||e.status===404))return null;throw e}}async listSessions(e=50,r,a={}){let l=new URLSearchParams({first:String(Math.min(Math.max(e,1),200)),status:a.status??"active"});if(r)l.set("project_id",r);if(a.origin)l.set("origin",a.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${l.toString()}`)).items??[]}getSession(e,r){let a=r?.fields.length?`?fields=${encodeURIComponent(r.fields.join(","))}`:"";return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}${a}`)}async prestartSession(e){let r=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:e}});return r?.status==="starting"||r?.status==="ready"}async createSession(e){let r=e.mode==="ephemeral"||e.workspaceOwnership==="externally-managed";if(e.attachments?.length)await this.requireSessionAttachments();if(r||e.runtimeProfile){let c=await this.request("/deployment");if(r&&(!Array.isArray(c.session_modes)||!c.session_modes.includes(e.mode??"standard")||!Array.isArray(c.workspace_ownerships)||!c.workspace_ownerships.includes(e.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if(e.runtimeProfile&&(!Array.isArray(c.experimental_runtime_profiles)||!c.experimental_runtime_profiles.includes(e.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let a=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:e.prompt,...e.attachments?.length?{attachments:e.attachments}:{},...e.mode?{mode:e.mode}:{},...e.workspaceOwnership?{workspace_ownership:e.workspaceOwnership}:{},...e.target?{target:e.target}:{},...e.repo?{repo:e.repo}:{},...e.provider?{provider:e.provider}:{},...e.model?{model:e.model}:{},...e.reasoningEffort?{reasoning_effort:e.reasoningEffort}:{},...e.runtimeProfile?{experimental_runtime_profile:e.runtimeProfile}:{},...e.ref?{ref:e.ref}:{},...e.branch?{branch:e.branch}:{},...e.completionMode?{completion_mode:e.completionMode}:{},...e.env&&Object.keys(e.env).length>0?{env:e.env}:{},...e.clientSessionId?{client_session_id:e.clientSessionId}:{},...e.longRunning?{long_running:{enabled:!0}}:{},...e.spendLimitRcu?{spend_limit_rcu:e.spendLimitRcu}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),l=await this.getSession(a.session_id);if(r){let c=l.session_policy,m=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!c||c.version!==1||c.mode!==(e.mode??"standard")||c.workspaceOwnership!==(e.workspaceOwnership??"managed")||!c.components||m.some((p)=>c.components[p]!==!0))throw await this.cancelSession(a.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if(e.runtimeProfile&&l.experimental_runtime_profile!==e.runtimeProfile)throw await this.cancelSession(a.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return l}async getEvents(e,r=-1,a={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/events?after_seq=${r}&limit=500${a.waitMs?`&wait_ms=${a.waitMs}`:""}`,a.signal?{signal:a.signal}:{})}catch(l){if(!(l instanceof R)||l.status!==403&&l.status!==404)throw l;return{session:await this.getSession(e),items:[],next_seq:r}}}async getMessages(e,r){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/messages?first=500${r===void 0?"":`&after_seq=${r}`}`)}async getAttachments(e,r){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/attachments${r?`?view=${r}`:""}`)).items??[]}catch(a){if(a instanceof R&&(a.status===403||a.status===404))return[];throw a}}async requireSessionAttachments(){let e=await this.request("/deployment",{headers:{"cache-control":"no-cache"}});if(e.session_attachments!==!0){let r=typeof e.reason_version==="string"&&/^\d+\.\d+(?:\.\d+)?$/.test(e.reason_version)?`Agent ${e.reason_version}`:null,a=typeof e.commit_sha==="string"&&/^[a-f0-9]{40,64}$/i.test(e.commit_sha)?`server ${e.commit_sha.slice(0,12)}`:null,l=[r,a].filter(Boolean).join(", ");throw Error(`This server does not support Session image attachments: ${new URL(this.credentials.apiOrigin).host}${l?` (${l})`:""}. The API server needs an attachment-capable deployment; updating the Agent version alone is not enough. Your image was not sent; retry after the server update.`)}}async sendMessage(e,r,a={}){if(a.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/messages`,{method:"POST",body:{message:r,...a.attachments?.length?{attachments:a.attachments}:{},...a.model?{model:a.model}:{},...a.reasoningEffort?{reasoning_effort:a.reasoningEffort}:{},...a.target?{target:a.target}:{},...a.delivery?{delivery:a.delivery}:{}}})}async steerQueuedMessage(e,r){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/messages/${encodeURIComponent(r)}/steer`,{method:"POST",body:{}})}async withdrawQueuedMessage(e,r){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/messages/${encodeURIComponent(r)}/queued`,{method:"DELETE"})}async getConversation(e){let r=[],a=null;for(let l=0;l<50;l+=1){let c=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/conversation${a?`?after=${encodeURIComponent(a)}`:""}`);if(r.push(...c.items??[]),!c.has_next_page||!c.end_cursor)break;a=c.end_cursor}return r}createSharedLink(e,r){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/shared-links`,{method:"POST",body:{url:r.url,...r.label?{label:r.label}:{},...r.expiresInSeconds!==void 0?{expires_in_seconds:r.expiresInSeconds}:{}}})}sessionAction(e,r,a={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/${r}`,{method:"POST",body:a})}renameSession(e,r){return this.sessionAction(e,"rename",{title:r||null})}moveSessionToProject(e,r){return this.sessionAction(e,"project",{project_id:r})}compactSession(e){return this.sessionAction(e,"compact")}retrySession(e){return this.sessionAction(e,"retry")}rewindSession(e,r){return this.sessionAction(e,"rewind",{message_id:r.messageId,content:r.content,request_id:r.requestId})}forkSession(e,r){return this.sessionAction(e,"fork",{...r.message?{message:r.message}:{},client_session_id:r.clientSessionId})}cancelSession(e,r={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/cancel`,{method:"POST",body:r.mode==="hard"?{mode:"hard"}:{}})}sessionPath(e,r=""){return`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}${r}`}async archiveSession(e){await this.request(this.sessionPath(e,"/archive"),{method:"POST",body:{}})}async unarchiveSession(e){await this.request(this.sessionPath(e,"/unarchive"),{method:"POST",body:{}})}async deleteSession(e){await this.request(this.sessionPath(e),{method:"DELETE"})}async listSessionTags(e){return h(L,await this.request(this.sessionPath(e,"/tags")),"invalid_session_tags").tags}async appendSessionTags(e,r){let a=await this.request(this.sessionPath(e,"/tags"),{method:"POST",body:{tags:r}});return h(L,a,"invalid_session_tags").tags}async sessionInsight(e,r=!1){let a=await this.request(this.sessionPath(e,r?"/insights/generate":"/insights"),r?{method:"POST",body:{}}:{});return h($e,a,"invalid_session_insight")}async listAutomations(){let e=[],r=null;for(let a=0;a<20;a+=1){let l=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations?first=100${r?`&after=${encodeURIComponent(r)}`:""}`),c=h(xe,l,"invalid_automation_list");if(e.push(...c.items),r=c.has_next_page?c.end_cursor??null:null,!r)break}return e}async createScheduledAutomation(e,r){let a=`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations`,l=h(N,await this.request(a,{method:"POST",body:{name:e.name,instructions:e.instructions,...e.repo?{repo:e.repo.full_name,provider:e.repo.provider}:{}}}),"invalid_automation");try{await this.request(`${a}/${encodeURIComponent(l.id)}/triggers`,{method:"POST",body:r})}catch(c){throw await this.deleteAutomation(l.id).catch(()=>{return}),c}return l}async setAutomationEnabled(e,r){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent(e)}`,{method:"PATCH",body:{enabled:r}})}async deleteAutomation(e){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent(e)}`,{method:"DELETE"})}async transcribe(e,r){let a=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/transcribe`,{method:"POST",raw:{bytes:e,contentType:r}});return h(i({transcript:t()}),a,"invalid_transcript").transcript}async listMcpServers(){let e=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/mcp-servers`);return h(Ce,e,"invalid_mcp_server_list").items}async setSkillEnabled(e,r){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills/${encodeURIComponent(e)}`,{method:"PUT",body:{is_enabled:r}})}}
-export{mt,R,zo,vo};
+import{C}from"./vm-hands-entry-lite-t7an5zg2.js";import{g,Mr,Gi,ve}from"./vm-hands-entry-lite-ckv17tn8.js";import{t,o,d,u,i,Mo,Q,_,s,n}from"./vm-hands-entry-lite-907pa7f9.js";var J=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function P(e){let r=typeof e==="string"?J.exec(e):null;return r?{major:Number(r[1]),minor:Number(r[2])}:null}var K=25,Le=i({machine:t().min(1).max(200),person:t().min(1).max(200),team:t().min(1).max(200),version:t().max(64).optional(),wait_seconds:o().int().min(0).max(K).optional()}),W=_("kind",[i({id:t(),kind:n("who"),all:d().optional()}),i({id:t(),kind:n("send"),to:t(),body:t(),from_name:t(),from_agent:t(),wake:d(),reply_to:t().max(100).optional(),notify:d().optional()})]),x=i({job:W.nullable(),retry_after_seconds:o().optional()}),V=i({address:t(),person:t(),machine:t(),agent:t(),repo:t().nullable(),branch:t().nullable(),status:t(),since:o().nullable(),doing:t().nullable(),worker:d(),tier:t().max(10).optional()}),Y=i({person:t(),machine:t(),online:d()}),X=i({team:t().nullable(),sessions:u(V).max(2000),machines:u(Y).max(500),all:d().optional()}),Z=i({address:t().max(300),state:t().max(40),note:t().max(500)}),Ne=Q([i({who:X}),i({sent:i({ids:u(t().max(100)).max(500),recipients:u(t().max(300)).max(500),from:t().max(300),deliveries:u(Z).max(500).optional()})}),i({error:t().min(1).max(2000)})]),ee=i({id:t().max(100),from:t().max(300),from_agent:t().max(100).nullable(),to:t().max(300),reply_to:t().max(100).nullable(),body:t().max(64000),sent_at:o()}),De=i({messages:u(ee).max(100)});import{randomBytes as ne}from"crypto";import{chmodSync as A,existsSync as U,lstatSync as te,mkdirSync as se,readFileSync as T,renameSync as oe,unlinkSync as q,writeFileSync as O}from"fs";import{homedir as re}from"os";import{dirname as ie,join as I}from"path";function b(e=process.env,r=re()){let a=e.XDG_CONFIG_HOME?.trim()||I(r,".config"),c=g({env:e})==="staging"?["staging"]:[];return I(ve(a,...c),"credentials.json")}function z(e,r=b()){return se(ie(r),{recursive:!0,mode:448}),O(r,`${JSON.stringify(e,null,2)}
+`,{mode:384}),A(r,384),r}function v(e=b()){if(!U(e))return null;try{let r=T(e,"utf8"),a=JSON.parse(r);if(typeof a.apiOrigin!=="string"||typeof a.clientId!=="string"||typeof a.accessToken!=="string"||typeof a.refreshToken!=="string"||typeof a.expiresAt!=="string"||typeof a.orgId!=="string"||!Array.isArray(a.scopes))return null;let l=new URL(a.apiOrigin).origin,c=Mr(l);if(c!==l)ae(e,r,c);return{apiOrigin:c,clientId:a.clientId,accessToken:a.accessToken,refreshToken:a.refreshToken,expiresAt:a.expiresAt,scopes:a.scopes.filter((m)=>typeof m==="string"),orgId:a.orgId}}catch{return null}}function ae(e,r,a){let l=`${e}.${process.pid}.${ne(6).toString("hex")}.tmp`;try{let c=te(e);if(!c.isFile()||process.platform!=="win32"&&c.uid!==process.geteuid?.())return;let m=JSON.parse(r);if(O(l,`${JSON.stringify({...m,apiOrigin:a},null,2)}
+`,{mode:384,flag:"wx"}),A(l,384),T(e,"utf8")!==r)throw Error("credentials_changed");oe(l,e)}catch{try{q(l)}catch{}}}function M(e=b()){if(!U(e))return!1;return q(e),!0}var j=["run","mcp:read","mcp:write","secrets:read","secrets:write","sessions:read","sessions:debug","devices:read","devices:write","devices:use","ssh:write","knowledge:read","memory:read","memory:write","skills:read","skills:write","repos:read","repos:write","reviews:read","reviews:write","deployment:read","analytics:read","org:read","org:write","attachments:read","attachments:write","guardrails:read","guardrails:write","network:read","network:write","automations:read","automations:write","agent_auth:read"];var cn=j.filter((e)=>e!=="network:read"&&e!=="network:write");class w extends Error{oauthCode;constructor(e,r=null){super(e);this.oauthCode=r;this.name="LoginError"}}function le(e,r){let a=typeof e.error==="string"?e.error:null,l=typeof e.error_description==="string"?e.error_description:a?a:r;return new w(l,a)}async function ce(e,r,a,l){let c=await a(`${e}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:r,signal:l}),m=await c.json().catch(()=>({}));if(!c.ok)throw le(m,`OAuth token request failed (${c.status})`);return m}var de=1e4;async function me(e,r={}){let a=r.fetchImpl??fetch,l=await ce(e.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:e.clientId,refresh_token:e.refreshToken}),a,AbortSignal.timeout(de)).catch((m)=>{if(m instanceof Error&&m.name==="TimeoutError")throw new w("Reason did not answer the login refresh in time. Check the network and retry.");throw m});if(typeof l.access_token!=="string"||typeof l.refresh_token!=="string"||typeof l.expires_in!=="number")throw new w("Reason returned an incomplete refreshed login.");let c={...e,accessToken:l.access_token,refreshToken:l.refresh_token,expiresAt:new Date(Date.now()+l.expires_in*1000).toISOString(),scopes:typeof l.scope==="string"?l.scope.split(/\s+/).filter(Boolean):e.scopes};return z(c,r.path??b()),c}var S=new Map;function E(e,r){if(!r)return e;if(r.aborted)return Promise.reject(r.reason);return new Promise((a,l)=>{let c=()=>l(r.reason);r.addEventListener("abort",c,{once:!0}),e.then(a,l).finally(()=>r.removeEventListener("abort",c))})}async function _t(e={}){let r=e.path??b(),a=v(r);if(!a)return null;let l=e.apiOrigin??C(process.env,"REASON_API_URL")?.trim();if(l&&!Gi(a.apiOrigin,new URL(l).origin))return null;let c=Date.parse(a.expiresAt)<=Date.now()+60000;if(!e.forceRefresh&&!c)return a;let m=[r,a.apiOrigin,a.clientId,a.refreshToken].join("\x00"),p=S.get(m);if(p)return E(p,e.signal);let f;return f=me(a,{fetchImpl:e.fetchImpl,path:r}).catch(async(y)=>{if(!(y instanceof w)||y.oauthCode!=="invalid_grant"&&y.oauthCode!=="invalid_client")throw y;let k=v(r),B=y.oauthCode==="invalid_client"?k?.clientId!==a.clientId:k?.refreshToken!==a.refreshToken;if(k&&B)return _t({fetchImpl:e.fetchImpl,path:r});return M(r),null}).finally(()=>{if(S.get(m)===f)S.delete(m)}),S.set(m,f),E(f,e.signal)}var ue=i({label:t(),used_percent:o().min(0).max(100).nullable(),resets_at:t().nullable(),exhausted:d().nullable()}),ge=i({groups:u(i({selectable:d().optional(),accounts:u(i({source_id:t().min(1),model_ids:u(t().min(1)).optional()}))}))});function he(e){let r=ge.safeParse(e);if(!r.success)return;return r.data.groups.some((a)=>a.selectable!==!1&&a.accounts.some((l)=>l.model_ids===void 0||l.model_ids.length>0))}class R extends Error{status;code;suggestedModel;retryAfterMs;resolutionReason;constructor(e,r,a,l,c,m){super(a);this.status=e;this.code=r;this.suggestedModel=l;this.retryAfterMs=c;this.resolutionReason=m;this.name="ApiError"}static rateLimitDelayMs(e,r){if(!(e instanceof R)||e.status!==429)return null;return Math.min(60000,Math.max(r,e.retryAfterMs??0))}}var pe=["minimal","low","medium","high","xhigh","max"],fe=i({id:t().min(1),kind:t(),name:t(),custom_name:t().nullish(),status:t(),online:d(),compatible:d().optional(),compatibility_reason:t().nullish(),folder_lane_of:t().nullish(),roots:u(i({id:t().min(1),label:t()}))}),ye=i({devices:u(fe),end_cursor:t().nullish(),has_next_page:d().optional()}),_e=i({id:t().min(1),name:t()}),be=i({items:u(_e)}),Re=i({id:t().min(1),name:t(),main:d(),mine:d(),session_id:t().nullish(),appearance:i({color:t().nullish()}).nullish().catch(null)}),we=i({items:u(Re)}),Se=i({skill_id:t().min(1),name:t(),description:t().nullish(),activation_keywords:u(t()).default([]),is_enabled:d().default(!0)}),ke=i({items:u(Se).default([])}),Pe=i({id:t().min(1),kind:t(),enabled:d(),schedule:i({expression:t().nullish(),every_seconds:o().nullish(),next_run_at:t().nullish()}).nullish(),github:i({event:t().nullish(),action:t().nullish(),repo:t().nullish()}).nullish(),last_fired_at:t().nullish()}),N=i({id:t().min(1),name:t().nullish(),instructions:t().nullish(),enabled:d(),triggers:u(Pe).default([])}),xe=i({items:u(N).default([]),end_cursor:t().nullish(),has_next_page:d().optional()}),Ie=i({id:t().min(1),slug:t().nullish(),name:t(),description:t().nullish(),transport:t().nullish(),url:t().nullish(),enabled:d()}),Ce=i({items:u(Ie).default([])}),$e=i({status:t(),summary:t().nullish(),category:t().nullish(),outcome:t().nullish(),message_count:o().nullish(),pr_url:t().nullish(),cost_usd:o().nullish(),generated_at:t().nullish()}),L=i({tags:u(t()).default([])}),Ae=s(["linux","macos"]),D=i({id:t().min(1),name:t().min(1),platform:Ae.nullable(),workers:i({total:o().int(),online:o().int(),busy:o().int(),idle:o().int()}),sessions:i({queued:o().int(),running:o().int()})}),Ue=i({machines:u(D)}),Te=i({machine:D}),qe=i({deleted:n(!0),revoked_workers:o().int(),revoked_tokens:o().int()}),Oe=i({token:i({id:t().min(1),machine_id:t().min(1),token_prefix:t()}),secret:t().startsWith("rmt_")}),H=Mo({machine_id:t().min(1),machine_name:t().min(1)}),ze=H.extend({organization_id:t().min(1)}),pn=i({id:t().min(1),name:t().min(1),state:s(["waiting","placed"]),queue_position:o().int().nullable()});var fn=Q([i({kind:n("cloud")}),i({kind:s(["mac","headless"]),device_id:t().min(1),root_id:t().min(1)})]);function h(e,r,a){let l=e.safeParse(r);if(!l.success)throw new R(502,a,"Reason returned an unexpected response.");return l.data}var Me=i({error:i({type:t(),message:t()})});function F(e,r,a){let l=Me.safeParse(r),c=typeof r.error==="string"?r.error:l.success?l.data.error.type:`http_${e}`,m=typeof r.detail==="string"?r.detail:typeof r.message==="string"?r.message:l.success?l.data.error.message:`Reason request failed (${e}${typeof r.error==="string"?` ${r.error}`:""})`,p=c==="github_connection_required"&&typeof r.connect_url==="string"&&/^https?:\/\//.test(r.connect_url)?` Connect it at ${r.connect_url}`:"",f=a===null||a.trim()===""?NaN:Number(a);return new R(e,c,`${m}${p}`,typeof r.suggested_model==="string"?r.suggested_model:void 0,Number.isFinite(f)&&f>=0?f*1000:void 0,typeof r.resolution_reason==="string"?r.resolution_reason:void 0)}async function Vo(e){let r=await(e.fetchImpl??fetch)(`${e.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${e.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:AbortSignal.timeout(30000),redirect:"error"}),a=await r.json().catch(()=>({}));if(!r.ok)throw F(r.status,a,r.headers.get("retry-after"));return h(ze,a,"invalid_machine_ticket")}class Eo{options;credentials;constructor(e,r={}){this.options=r;this.credentials=e}trackEvent(e,r={}){}async request(e,r={},a=!1){let l=this.options.fetchImpl??fetch,c=await l(`${this.credentials.apiOrigin}/v3${e}`,{method:r.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...r.raw?{"content-type":r.raw.contentType}:r.body===void 0?{}:{"content-type":"application/json"},...r.headers},body:r.raw?r.raw.bytes:r.body===void 0?void 0:JSON.stringify(r.body),signal:r.signal,redirect:"error"}),m=await c.json().catch(()=>({}));if(c.status===401&&!a&&r.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let p=await _t({fetchImpl:l,path:this.options.credentialsPath,forceRefresh:!0,signal:r.signal});if(p)return this.credentials=p,this.request(e,r,!0)}if(!c.ok)throw F(c.status,m,c.headers.get("retry-after"));return m}createHeadlessDeviceEnrollmentTicket(e){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:e,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice(e){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:e,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(r){if(r instanceof R&&(r.status===404||r.status===405||r.status===403&&r.code==="endpoint_not_available"))return null;throw r}}addDeviceRoot(e,r){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent(e)}/roots`,{method:"POST",body:r,signal:AbortSignal.timeout(30000)})}removeDeviceRoot(e,r){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent(e)}/roots/${encodeURIComponent(r)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath(e,r=""){let a=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return e===void 0?a:`${a}/${encodeURIComponent(e)}${r}`}async listMachines(){return h(Ue,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine(e){let r=await this.request(this.machinePath(),{method:"POST",body:{name:e.name,...e.platform?{platform:e.platform}:{}}});return h(Te,r,"invalid_machine").machine}async deleteMachine(e){let r=await this.request(this.machinePath(e),{method:"DELETE"});return h(qe,r,"invalid_machine_deletion")}async createMachineToken(e){let r=await this.request(this.machinePath(e,"/tokens"),{method:"POST",body:{}});return h(Oe,r,"invalid_machine_token")}async createMachineEnrollmentTicket(e,r){let a=await this.request(this.machinePath(e,"/enrollment-tickets"),{method:"POST",body:r,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return h(H,a,"invalid_machine_ticket")}self(e){return this.request("/self",{signal:e})}agentNetwork(){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{signal:AbortSignal.timeout(30000)})}startAgentNetwork(e){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{method:"POST",body:e,signal:AbortSignal.timeout(30000)})}rotateAgentNetwork(e){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network`,{method:"PUT",body:e,signal:AbortSignal.timeout(30000)})}async claimAgentNetworkRelayJob(e,r){let a=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/claim`,{method:"POST",body:e,signal:r});return h(x,a,"invalid_agent_network_job")}async completeAgentNetworkRelayJob(e,r){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/jobs/${encodeURIComponent(e)}`,{method:"POST",body:r,signal:AbortSignal.timeout(30000)})}async recordAgentNetworkRelayReplies(e){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-network/relay/replies`,{method:"POST",body:{messages:e},signal:AbortSignal.timeout(30000)})}async workspaceMembers(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/members/users`,{signal:AbortSignal.timeout(30000)})).items??[]).flatMap((r)=>typeof r.email==="string"?[{email:r.email,role:typeof r.role==="string"?r.role:"member"}]:[])}claimExistingCliPairing(e){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:e}})}async claudeCodeSignIn(e){return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials`,{retryUnauthorized:!1,signal:e?AbortSignal.any([e,AbortSignal.timeout(15000)]):AbortSignal.timeout(15000)})).claude_code_sign_in===!0}connectAnthropicProvider(e,r,a={}){let l=e.kind==="setup_token"?{setup_token:e.token}:{access_token:e.credential.access,refresh_token:e.credential.refresh,expires_at:new Date(e.credential.expires).toISOString()};return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:a.retryUnauthorized,signal:a.signal,body:{...l,...r?{account_key:r}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((r)=>{let a=typeof r.full_name==="string"?r.full_name:typeof r.repo_full_name==="string"?r.repo_full_name:null;if(!a)return[];return[{repo_id:typeof r.repo_id==="string"?r.repo_id:void 0,full_name:a,provider:r.provider==="gitlab"?"gitlab":"github",default_branch:typeof r.default_branch==="string"?r.default_branch:null,private:typeof r.private==="boolean"?r.private:void 0}]})}async listProjects(){let e=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),r=be.safeParse(e);if(!r.success)throw new R(502,"invalid_project_list","Reason returned an unexpected project list.");return r.data.items}async listReasons(){let e=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons`);return h(we,e,"invalid_reason_list").items}async openReasonConversation(e){let r=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons/${encodeURIComponent(e)}/conversation`,{method:"POST"});return h(i({session_id:t().min(1)}),r,"invalid_reason_conversation").session_id}async listSkills(){try{let e=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return h(ke,e,"invalid_skill_list").items}catch(e){if(e instanceof R&&(e.status===403||e.status===404))return[];throw e}}async listDevices(){let e=[],r=null;for(let a=0;a<50;a+=1){let l=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${r?`?after=${encodeURIComponent(r)}`:""}`),c=ye.safeParse(l);if(!c.success)throw new R(502,"invalid_device_list","Reason returned an unexpected machine list.");if(e.push(...c.data.devices),r=c.data.has_next_page?c.data.end_cursor??null:null,!r)break}return e}async listModels(){try{let r=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((c)=>c.hidden!==!0),a=r.filter((c)=>c.available!==!1).map(({reasoning_efforts:c,hidden:m,available:p,...f})=>({...f,...Array.isArray(c)?{reasoning_efforts:pe.filter((y)=>c.includes(y))}:{}})),l=new Set(a.map((c)=>c.detail));return{models:a.length>1&&l.size===1?a.map(({detail:c,...m})=>m):a,runnable:a.length>0||r.length===0}}catch(e){if(e instanceof R&&(e.status===403||e.status===404))return{models:[],runnable:!0};throw e}}async getAgentVersion(e){try{let r=await this.request("/deployment",{signal:e,retryUnauthorized:!1});return P(r.reason_version)?r.reason_version:null}catch{return null}}async getUsageQuota(){try{let e=ue.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!e.success)return null;let r;try{r=he(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...e.data,own_inference:r}}catch(e){if(e instanceof R&&(e.status===403||e.status===404))return null;throw e}}async listSessions(e=50,r,a={}){let l=new URLSearchParams({first:String(Math.min(Math.max(e,1),200)),status:a.status??"active"});if(r)l.set("project_id",r);if(a.origin)l.set("origin",a.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${l.toString()}`)).items??[]}getSession(e,r){let a=r?.fields.length?`?fields=${encodeURIComponent(r.fields.join(","))}`:"";return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}${a}`)}async prestartSession(e){let r=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:e}});return r?.status==="starting"||r?.status==="ready"}async createSession(e){let r=e.mode==="ephemeral"||e.workspaceOwnership==="externally-managed";if(e.attachments?.length)await this.requireSessionAttachments();if(r||e.runtimeProfile){let c=await this.request("/deployment");if(r&&(!Array.isArray(c.session_modes)||!c.session_modes.includes(e.mode??"standard")||!Array.isArray(c.workspace_ownerships)||!c.workspace_ownerships.includes(e.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if(e.runtimeProfile&&(!Array.isArray(c.experimental_runtime_profiles)||!c.experimental_runtime_profiles.includes(e.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let a=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:e.prompt,...e.attachments?.length?{attachments:e.attachments}:{},...e.mode?{mode:e.mode}:{},...e.workspaceOwnership?{workspace_ownership:e.workspaceOwnership}:{},...e.target?{target:e.target}:{},...e.repo?{repo:e.repo}:{},...e.provider?{provider:e.provider}:{},...e.model?{model:e.model}:{},...e.reasoningEffort?{reasoning_effort:e.reasoningEffort}:{},...e.runtimeProfile?{experimental_runtime_profile:e.runtimeProfile}:{},...e.ref?{ref:e.ref}:{},...e.branch?{branch:e.branch}:{},...e.completionMode?{completion_mode:e.completionMode}:{},...e.env&&Object.keys(e.env).length>0?{env:e.env}:{},...e.clientSessionId?{client_session_id:e.clientSessionId}:{},...e.longRunning?{long_running:{enabled:!0}}:{},...e.spendLimitRcu?{spend_limit_rcu:e.spendLimitRcu}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),l=await this.getSession(a.session_id);if(r){let c=l.session_policy,m=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!c||c.version!==1||c.mode!==(e.mode??"standard")||c.workspaceOwnership!==(e.workspaceOwnership??"managed")||!c.components||m.some((p)=>c.components[p]!==!0))throw await this.cancelSession(a.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if(e.runtimeProfile&&l.experimental_runtime_profile!==e.runtimeProfile)throw await this.cancelSession(a.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return l}async getEvents(e,r=-1,a={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/events?after_seq=${r}&limit=500${a.waitMs?`&wait_ms=${a.waitMs}`:""}`,a.signal?{signal:a.signal}:{})}catch(l){if(!(l instanceof R)||l.status!==403&&l.status!==404)throw l;return{session:await this.getSession(e),items:[],next_seq:r}}}async getMessages(e,r){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/messages?first=500${r===void 0?"":`&after_seq=${r}`}`)}async getAttachments(e,r){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/attachments${r?`?view=${r}`:""}`)).items??[]}catch(a){if(a instanceof R&&(a.status===403||a.status===404))return[];throw a}}async requireSessionAttachments(){let e=await this.request("/deployment",{headers:{"cache-control":"no-cache"}});if(e.session_attachments!==!0){let r=typeof e.reason_version==="string"&&/^\d+\.\d+(?:\.\d+)?$/.test(e.reason_version)?`Agent ${e.reason_version}`:null,a=typeof e.commit_sha==="string"&&/^[a-f0-9]{40,64}$/i.test(e.commit_sha)?`server ${e.commit_sha.slice(0,12)}`:null,l=[r,a].filter(Boolean).join(", ");throw Error(`This server does not support Session image attachments: ${new URL(this.credentials.apiOrigin).host}${l?` (${l})`:""}. The API server needs an attachment-capable deployment; updating the Agent version alone is not enough. Your image was not sent; retry after the server update.`)}}async sendMessage(e,r,a={}){if(a.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/messages`,{method:"POST",body:{message:r,...a.attachments?.length?{attachments:a.attachments}:{},...a.model?{model:a.model}:{},...a.reasoningEffort?{reasoning_effort:a.reasoningEffort}:{},...a.target?{target:a.target}:{},...a.delivery?{delivery:a.delivery}:{}}})}async steerQueuedMessage(e,r){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/messages/${encodeURIComponent(r)}/steer`,{method:"POST",body:{}})}async withdrawQueuedMessage(e,r){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/messages/${encodeURIComponent(r)}/queued`,{method:"DELETE"})}async getConversation(e){let r=[],a=null;for(let l=0;l<50;l+=1){let c=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/conversation${a?`?after=${encodeURIComponent(a)}`:""}`);if(r.push(...c.items??[]),!c.has_next_page||!c.end_cursor)break;a=c.end_cursor}return r}createSharedLink(e,r){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/shared-links`,{method:"POST",body:{url:r.url,...r.label?{label:r.label}:{},...r.expiresInSeconds!==void 0?{expires_in_seconds:r.expiresInSeconds}:{}}})}sessionAction(e,r,a={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/${r}`,{method:"POST",body:a})}renameSession(e,r){return this.sessionAction(e,"rename",{title:r||null})}moveSessionToProject(e,r){return this.sessionAction(e,"project",{project_id:r})}compactSession(e){return this.sessionAction(e,"compact")}retrySession(e){return this.sessionAction(e,"retry")}rewindSession(e,r){return this.sessionAction(e,"rewind",{message_id:r.messageId,content:r.content,request_id:r.requestId})}forkSession(e,r){return this.sessionAction(e,"fork",{...r.message?{message:r.message}:{},client_session_id:r.clientSessionId})}cancelSession(e,r={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}/cancel`,{method:"POST",body:r.mode==="hard"?{mode:"hard"}:{}})}sessionPath(e,r=""){return`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent(e)}${r}`}async archiveSession(e){await this.request(this.sessionPath(e,"/archive"),{method:"POST",body:{}})}async unarchiveSession(e){await this.request(this.sessionPath(e,"/unarchive"),{method:"POST",body:{}})}async deleteSession(e){await this.request(this.sessionPath(e),{method:"DELETE"})}async listSessionTags(e){return h(L,await this.request(this.sessionPath(e,"/tags")),"invalid_session_tags").tags}async appendSessionTags(e,r){let a=await this.request(this.sessionPath(e,"/tags"),{method:"POST",body:{tags:r}});return h(L,a,"invalid_session_tags").tags}async sessionInsight(e,r=!1){let a=await this.request(this.sessionPath(e,r?"/insights/generate":"/insights"),r?{method:"POST",body:{}}:{});return h($e,a,"invalid_session_insight")}async listAutomations(){let e=[],r=null;for(let a=0;a<20;a+=1){let l=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations?first=100${r?`&after=${encodeURIComponent(r)}`:""}`),c=h(xe,l,"invalid_automation_list");if(e.push(...c.items),r=c.has_next_page?c.end_cursor??null:null,!r)break}return e}async createScheduledAutomation(e,r){let a=`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations`,l=h(N,await this.request(a,{method:"POST",body:{name:e.name,instructions:e.instructions,...e.repo?{repo:e.repo.full_name,provider:e.repo.provider}:{}}}),"invalid_automation");try{await this.request(`${a}/${encodeURIComponent(l.id)}/triggers`,{method:"POST",body:r})}catch(c){throw await this.deleteAutomation(l.id).catch(()=>{return}),c}return l}async setAutomationEnabled(e,r){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent(e)}`,{method:"PATCH",body:{enabled:r}})}async deleteAutomation(e){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent(e)}`,{method:"DELETE"})}async transcribe(e,r){let a=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/transcribe`,{method:"POST",raw:{bytes:e,contentType:r}});return h(i({transcript:t()}),a,"invalid_transcript").transcript}async listMcpServers(){let e=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/mcp-servers`);return h(Ce,e,"invalid_mcp_server_list").items}async setSkillEnabled(e,r){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills/${encodeURIComponent(e)}`,{method:"PUT",body:{is_enabled:r}})}}
+export{_t,R,Vo,Eo};

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,4 +1,4 @@
 // @bun
-import{Mn,ut,Bn,Fn,jn,li}from"./vm-hands-entry-lite-ym1djztp.js";import{createHash as W,randomBytes as le}from"crypto";import{closeSync as be,fsyncSync as ke,mkdirSync as Ke,openSync as Se,renameSync as He,rmSync as Le,statSync as Ie,writeSync as Ee,constants as q}from"fs";import{join as ee}from"path";var Je=1;var ne=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function ue(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function ye(e,n){let{payload:i,authority:r}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!r||typeof r!=="object"||Array.isArray(r)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||r.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function Pe(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&ne.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:ue(e)?e.environment_sealed:null,workspace_deferred:Ye(e)}}function Ye(e){let n=e.payload[Bn];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}var B=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),F=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function _i(e){let n=await crypto.subtle.importKey("pkcs8",F(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=F(e.device_key.spki),r=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),g=new Uint8Array(await crypto.subtle.exportKey("spki",r.publicKey)),_=W("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:r,signingSpki:i,agreementSpki:g,fingerprint:_}}var Xe=4;class Jr{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,r){this.init=e;this.keys=n;this.hooks=i;this.options=r;if(!ne.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(e,n,i){for(let r=Date.now()+n;;){let g=this.bound.get(e);if(!g)return!1;if(g.envInstalled)return!0;if(Date.now()>=r||i?.aborted)return!1;await new Promise((_)=>setTimeout(_,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:Je,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:B(this.keys.signingSpki),env_public_key:B(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:B(le(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:B(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),r=B(le(32)),g=li({method:"GET",pathAndQuery:Mn,timestamp:i,nonce:r,challenge:e,bodySha256:W("sha256").update("").digest("hex")}),_=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(g)));return{t:"hello",timestamp:i,nonce:r,signature:B(Qe(_)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let i of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!ne.test(i))throw new l("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<=(this.lastBrainGeneration.get(e.run_id)??0))throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(W("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((i)=>i.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=Xe)throw new l("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new l("vm_hands_busy","a bind waits for its workspace beside the setup");if(e.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new l("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let i,r,g=new Promise((_,u)=>{i=_,r=u});g.catch(()=>{return}),this.grants.set(e.bind_id,{promise:g,resolve:i,reject:r})}return this.exclusive(()=>this.setUp(e))}async setUp(e){let n=[...this.bound.keys()],i=null,r=!1,g=this.grants.get(e.bind_id);try{if(g&&(n.length||this.commandsSinceVerified))throw new l("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(n.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:n}),this.unverified.clear();this.servedRun=!0,r=!0;let{launchId:_,applied:u,readyData:y}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...g?{workspaceGrant:g.promise}:{}}),S=this.hooks.restatLayout();this.hooks.verifyMounts?.();let I=null,v=null;if(e.env){let A=e.claim?.owner??{},M=ye(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof A.device_id==="string"?A.device_id:"",rootId:e.claim?.root_id??""});this.commandsSinceVerified=!0,I=this.hooks.installEnvironment(e.bind_id,M),v=typeof M.snapshot_id==="string"&&M.snapshot_id?M.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,M)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:_,envInstalled:I!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:_,snapshot_revision:I,snapshot_id:v,layout:S,...y?{ready_data:y}:{},policy_digest:W("sha256").update(V({hands_confinement:u.hands_confinement??null,browser_egress:u.browser_egress??null})).digest("hex")}}catch(_){if(i)_e(i);if(r){let y=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:y,own:!0}).catch(()=>{this.unverified.add(e.bind_id)})}this.binding.delete(e.bind_id),this.grants.delete(e.bind_id);let u=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:"vm_hands_bind_failed";throw _ instanceof l?_:new l(u,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!ne.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let r=ye(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId});this.commandsSinceVerified=!0;let g=this.hooks.installEnvironment(n.bindId,r);if(n.envInstalled=!0,n.envDirectory)_e(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${g}`,r),{snapshot_id:e.snapshotId,installed_revision:g,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:W("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let r=[...this.bound.keys()].filter((_)=>_!==e),g=!r.length&&(i||!this.commandsSinceVerified);try{await this.hooks.killAndVerifyPayload(r.length?{bindId:e,keep:r}:g?{bindId:e,own:!0}:void 0)}catch(_){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw _}if(this.unverified.delete(e),!r.length&&!i)this.unverified.clear(),this.commandsSinceVerified=!1;if(n?.envDirectory)_e(n.envDirectory);return this.unverifiedTeardowns.delete(e),{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:r.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},r=await crypto.subtle.importKey("spki",F(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),g=await crypto.subtle.deriveKey({name:"ECDH",public:r},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),_=await crypto.subtle.decrypt({name:"AES-GCM",iv:F(e.iv),additionalData:new TextEncoder().encode(n)},g,F(e.ct)).catch(i),u=JSON.parse(new TextDecoder().decode(_));if(!u||typeof u!=="object"||Array.isArray(u))throw new l("vm_hands_env_invalid","env not an object");return u}writeJobEnvRootOnly(e,n){let i=ee(this.options.envRoot,`bind-${e}`);Ke(i,{mode:448});let r=Ie(i);if(!r.isDirectory()||(r.mode&63)!==0||r.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let g=n.variables&&typeof n.variables==="object"?n.variables:{},_=Object.entries(g).filter(([S,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(S)&&typeof I==="string").map(([S,I])=>`export ${S}='${String(I).replaceAll("'","'\\''")}'`).join(`
+import{Bn,dt,Ae,pt,jn,di}from"./vm-hands-entry-lite-k278g9kj.js";import{createHash as W,randomBytes as le}from"crypto";import{closeSync as be,fsyncSync as ke,mkdirSync as He,openSync as Se,renameSync as Le,rmSync as Je,statSync as Ie,writeSync as Ee,constants as q}from"fs";import{join as ee}from"path";var Ye=1;var ne=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function ue(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function ye(e,n){let{payload:i,authority:r}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!r||typeof r!=="object"||Array.isArray(r)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||r.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function Pe(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&ne.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:ue(e)?e.environment_sealed:null,workspace_deferred:Xe(e)}}function Xe(e){let n=e.payload[Ae];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}var B=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),F=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function wi(e){let n=await crypto.subtle.importKey("pkcs8",F(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=F(e.device_key.spki),r=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),g=new Uint8Array(await crypto.subtle.exportKey("spki",r.publicKey)),_=W("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:r,signingSpki:i,agreementSpki:g,fingerprint:_}}var Qe=4;class Xr{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;commandsSinceVerified=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,r){this.init=e;this.keys=n;this.hooks=i;this.options=r;if(!ne.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}async environmentInstalled(e,n,i){for(let r=Date.now()+n;;){let g=this.bound.get(e);if(!g)return!1;if(g.envInstalled)return!0;if(Date.now()>=r||i?.aborted)return!1;await new Promise((_)=>setTimeout(_,25))}}opServed(){this.commandsSinceVerified=!0}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:Ye,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:B(this.keys.signingSpki),env_public_key:B(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:B(le(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:B(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),r=B(le(32)),g=di({method:"GET",pathAndQuery:Bn,timestamp:i,nonce:r,challenge:e,bodySha256:W("sha256").update("").digest("hex")}),_=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(g)));return{t:"hello",timestamp:i,nonce:r,signature:B(Ze(_)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let i of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!ne.test(i))throw new l("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<=(this.lastBrainGeneration.get(e.run_id)??0))throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(W("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((i)=>i.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=Qe)throw new l("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new l("vm_hands_busy","a bind waits for its workspace beside the setup");if(e.workspace_deferred&&(this.liveBindIds.length||this.commandsSinceVerified))throw new l("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let i,r,g=new Promise((_,u)=>{i=_,r=u});g.catch(()=>{return}),this.grants.set(e.bind_id,{promise:g,resolve:i,reject:r})}return this.exclusive(()=>this.setUp(e))}async setUp(e){let n=[...this.bound.keys()],i=null,r=!1,g=this.grants.get(e.bind_id);try{if(g&&(n.length||this.commandsSinceVerified))throw new l("vm_hands_prebind_unsafe","a pre-bind needs a VM that served nothing since its last full kill");if(n.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.commandsSinceVerified)await this.hooks.killAndVerifyPayload(),this.unverified.clear(),this.commandsSinceVerified=!1;else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({own:!0}),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:n}),this.unverified.clear();this.servedRun=!0,r=!0;let{launchId:_,applied:u,readyData:y}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...g?{workspaceGrant:g.promise}:{}}),S=this.hooks.restatLayout();this.hooks.verifyMounts?.();let I=null,v=null;if(e.env){let A=e.claim?.owner??{},M=ye(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof A.device_id==="string"?A.device_id:"",rootId:e.claim?.root_id??""});this.commandsSinceVerified=!0,I=this.hooks.installEnvironment(e.bind_id,M),v=typeof M.snapshot_id==="string"&&M.snapshot_id?M.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,M)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:_,envInstalled:I!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:_,snapshot_revision:I,snapshot_id:v,layout:S,...y?{ready_data:y}:{},policy_digest:W("sha256").update(V({hands_confinement:u.hands_confinement??null,browser_egress:u.browser_egress??null})).digest("hex")}}catch(_){if(i)_e(i);if(r){let y=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:y,own:!0}).catch(()=>{this.unverified.add(e.bind_id)})}this.binding.delete(e.bind_id),this.grants.delete(e.bind_id);let u=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:"vm_hands_bind_failed";throw _ instanceof l?_:new l(u,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!ne.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let r=ye(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId});this.commandsSinceVerified=!0;let g=this.hooks.installEnvironment(n.bindId,r);if(n.envInstalled=!0,n.envDirectory)_e(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${g}`,r),{snapshot_id:e.snapshotId,installed_revision:g,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:W("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let r=[...this.bound.keys()].filter((_)=>_!==e),g=!r.length&&(i||!this.commandsSinceVerified);try{await this.hooks.killAndVerifyPayload(r.length?{bindId:e,keep:r}:g?{bindId:e,own:!0}:void 0)}catch(_){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw _}if(this.unverified.delete(e),!r.length&&!i)this.unverified.clear(),this.commandsSinceVerified=!1;if(n?.envDirectory)_e(n.envDirectory);return this.unverifiedTeardowns.delete(e),{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:r.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},r=await crypto.subtle.importKey("spki",F(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),g=await crypto.subtle.deriveKey({name:"ECDH",public:r},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),_=await crypto.subtle.decrypt({name:"AES-GCM",iv:F(e.iv),additionalData:new TextEncoder().encode(n)},g,F(e.ct)).catch(i),u=JSON.parse(new TextDecoder().decode(_));if(!u||typeof u!=="object"||Array.isArray(u))throw new l("vm_hands_env_invalid","env not an object");return u}writeJobEnvRootOnly(e,n){let i=ee(this.options.envRoot,`bind-${e}`);He(i,{mode:448});let r=Ie(i);if(!r.isDirectory()||(r.mode&63)!==0||r.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let g=n.variables&&typeof n.variables==="object"?n.variables:{},_=Object.entries(g).filter(([S,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(S)&&typeof I==="string").map(([S,I])=>`export ${S}='${String(I).replaceAll("'","'\\''")}'`).join(`
 `)+`
-`,u=ee(i,`.job.env.${le(8).toString("hex")}`),y=Se(u,q.O_WRONLY|q.O_CREAT|q.O_EXCL|q.O_NOFOLLOW,384);try{Ee(y,_),ke(y)}finally{be(y)}return He(u,ee(i,"job.env")),i}}function _e(e){try{let n=ee(e,"job.env"),i=Ie(n).size,r=Se(n,q.O_WRONLY|q.O_NOFOLLOW);try{Ee(r,Buffer.alloc(i)),ke(r)}finally{be(r)}}catch{}Le(e,{recursive:!0,force:!0})}function Qe(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let _=0;while(_<g.length-1&&g[_]===0)_++;let u=g.subarray(_),y=u[0]&128?Uint8Array.of(0,...u):u;return Uint8Array.of(2,y.length,...y)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as Ze}from"crypto";var en="/app/local-runtime/session?register=vm_hands_v1",nn="/app/local-runtime",Te=25000,Ae=20000,tn=1e4,Me=5000,Re=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),me=75000,rn=2000,sn=1e4,on=new Set(["vm_hands_no_register","vm_hands_register_failed"]),an=3,dn=20000,cn=250,ln=2000;function Ce(e){let n=Math.min(cn*2**(e-1),ln);return Math.round(n/2+Math.random()*n/2)}var _n=5000;function un(e){return e>=500||e===408||e===429}var te=20000;function xe(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class O extends Error{}var mn=64,De=[1000,2000,4000,8000,15000,30000,60000,120000];function Ne(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function hn(e,n,i,r,g){let _=i.turn.claim.attempt_id,u=e.healing??=new Set;if(u.has(_))return;u.add(_);let y=i.turn.claim.operation_id;(async()=>{for(let[S,I]of De.entries()){if(r.aborted)return;if(await new Promise((v)=>{let A=setTimeout(v,I);A.unref?.(),r.addEventListener("abort",()=>{clearTimeout(A),v()},{once:!0})}),r.aborted)return;try{let v=await n.retryUnbind(_);g("vm_hands.unbind_healed",{operation_id:y,attempt:S+1}),e.receipts.push({...i,unbound:v}),e.flushReceipts?.();return}catch(v){let A=Ne(v);if(g("vm_hands.unbind_unverified",{operation_id:y,code:A,attempt:S+1}),A==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:y,attempts:De.length})})().finally(()=>u.delete(_))}async function Be(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Me))])}async function gn(e){let n=[...e.personTerminals];for(let i of n)i.abort.abort();if(n.length)await Promise.race([Promise.all(n.map((i)=>i.settled)),new Promise((i)=>setTimeout(i,Me))]);return n.length}async function z(e,n,i){return await Be(e,i),n.unbind(i)}function ie(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Oe=15000,fn=1e4,pn=1000;async function yi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:0},r=e.log??(()=>{}),g=async(y)=>{for(let[S,I]of[...i.turns]){i.turns.delete(S),e.onTurn?.(S,null),ie(I);let v=await z(i,e.agent,S).catch(()=>null);if(v)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:v});r("vm_hands.bound_dropped",{reason:y})}},_=0,u=0;try{for(let y=0;!e.signal.aborted;y++){let S=await vn(e,i).catch((v)=>{if(v instanceof l&&i.deviceId===null&&v.code==="vm_hands_no_session"&&Date.now()-n<sn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(v instanceof l&&i.deviceId===null&&on.has(v.code)&&_<an&&Date.now()-n<dn)return _++,u=Ce(_),r("vm_hands.register_retry",{attempt:_,code:v.code,delay_ms:u}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(v instanceof l&&i.deviceId===null)throw v;return{closeCode:0,closeReason:v instanceof Error?v.message:String(v)}});if(r("vm_hands.session_closed",{close_code:S.closeCode,reason:S.closeReason.slice(0,120),registered:i.deviceId!==null}),S.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=me)await g("reconnect_deadline");if(i.served)i.served=!1,y=0;let I=S.closeReason==="drain_reconnect"?0:S.closeReason==="vm_hands_register_retry"?u:S.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(y,5),2000):i.turns.size?Math.min(250*2**Math.min(y,5),5000,Math.max(0,i.lostAt+me-Date.now())):Math.min(500*2**y,30000);if(await new Promise((v)=>setTimeout(v,I)),i.turns.size&&Date.now()-i.lostAt>=me)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function vn(e,n){let i=n.deviceId,r=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:en,_=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,u=new WebSocket(_),y=0,S="",I=new Map,v=[],A=null,M=new Promise((t)=>{u.onclose=(o)=>{y=o.code,S=o.reason;for(let s of I.values())s.reject(new O(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});u.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{u.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,pn));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{u.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!A?.(o))v.push(o)};let G=(t,o)=>new Promise((s,c)=>{let h=v.findIndex((p)=>t.includes(p.t));if(h>=0){s(v.splice(h,1)[0]);return}let f=setTimeout(()=>{A=null,c(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);A=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),A=null,s(p),!0}}),K=(t)=>u.send(JSON.stringify(t)),x=(t,o)=>new Promise((s,c)=>{if(u.readyState!==WebSocket.OPEN){c(new O("session closed"));return}let h=Ze(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(h))return;c(new O(`no answer to ${t.split("/").pop()} in ${f+Oe} ms`)),u.close(4000,"request_timeout")},f+Oe);I.set(h,{reject:(a)=>{clearTimeout(p),c(a)},resolve:({status:a,body:d})=>{clearTimeout(p);let m=null;try{m=d?JSON.parse(d):null}catch{}s({status:a,json:m})}}),K({t:"req",id:h,path:`${nn}${t}`,body:JSON.stringify(o)})}),he=()=>u.close(1001,"stopping");e.signal.addEventListener("abort",he,{once:!0});let re,H=new Map,L=new Map,se=!1,oe=new Set,ae=new Set,de=Promise.resolve(),ge=()=>{X().catch(()=>{return})},J=!1;try{await new Promise((a,d)=>{let m=setTimeout(()=>d(Error("session open timeout")),fn);u.onopen=()=>{clearTimeout(m),r("vm_hands.ws_open",{}),a()},u.onerror=()=>{clearTimeout(m),d(Error("session socket error"))}});let t=await G(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,c;if(i){K(await e.agent.helloFrame(t.challenge,n.connection));let a=await G(["ready"],1e4);if(typeof a.vm_hands_connection==="string")n.connection=a.vm_hands_connection;if(c={device_id:i,...a.cadence?{cadence:a.cadence}:{}},typeof a.vm_hands_probe_script==="string"){if(s=a.vm_hands_probe_script,J=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(a.vm_hands_binds)?a.vm_hands_binds:a.vm_hands_bind?[a.vm_hands_bind]:[];for(let[m,k]of[...n.turns]){if(d.some((P)=>P&&P.operation_id===k.claim.operation_id&&P.attempt_id===k.claim.attempt_id)){o.push(k),r("vm_hands.bound_resumed",{operation_id:k.claim.operation_id});continue}n.turns.delete(m),e.onTurn?.(m,null),ie(k);let E=await z(n,e.agent,m).catch((P)=>Y(P,k,"vm_hands_bind_lost"));if(E)n.receipts.push({turn:k,failure:"vm_hands_bind_lost",unbound:E});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{K(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let a=await Promise.race([G(["registered","register_refused"],1e4),M.then(()=>{throw new l(S==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(a.t==="register_refused")throw new l(a.code,"register refused");e.agent.registered();let d=a;if(c=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,J=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:c.device_id})}let h=async()=>{let a=await x("/heartbeat",await e.heartbeat());if(a.status>=300)throw Error(`heartbeat ${a.status}`)};await h();let f=c.cadence?.presence_interval_ms??30000;if(re=setInterval(()=>{h().catch(()=>u.close())},f),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)$e(s,t.challenge);let p=(a,d)=>{L.set(a,d().catch(async(m)=>{if(await fe(m,a),m instanceof O)u.close();else await X().catch(()=>{return})}).finally(()=>{L.delete(a)}))};n.flushReceipts=ge;try{await X();for(let a of o)a.flush=()=>pe(a),a.flush(),p(a.claim.attempt_id,()=>ve(a));while(!e.signal.aborted&&u.readyState===WebSocket.OPEN){let a=await x("/operations/claim",{wait_ms:Math.min(c.cadence?.claim_wait_ms??Te,Te)});if(a.status===204||!a.json)continue;if(a.status>=300)throw Error(`claim ${a.status}`);let d=a.json;if(d.capability==="hands.connect"){if(L.has(d.attempt_id)){R({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>je(d))}else We(d).catch(()=>{return})}}catch(a){await fe(a,null)}}finally{if(re)clearInterval(re);e.signal.removeEventListener("abort",he);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ge)n.flushReceipts=null;u.close(),await M,await Promise.all([...L.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=H.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,c=await z(n,e.agent,t).catch((h)=>s?Y(h,s,"vm_hands_bind_lost"):null);if(c&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:c});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let t of oe)t.abort()}return{closeCode:y,closeReason:S};async function fe(t,o){if(t instanceof O){if(!se&&n.turns.size)n.lostAt=Date.now();se=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)se=!0;for(let c of s){let h=n.turns.get(c);if(n.turns.delete(c),h)ie(h),e.onTurn?.(c,null);if(e.agent.liveBindIds.includes(c)){let f=H.get(c)??h,p=f?{...f,eventSeq:f.eventSeq+1}:null,a=await z(n,e.agent,c).catch((d)=>p?Y(d,p,"vm_hands_bind_lost"):null);if(a&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:a})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function R(t){let o=t.claim,s={attempt_id:o.attempt_id,attempt_token:o.attempt_token},c=encodeURIComponent(o.operation_id);return{fence:s,op:c,complete:(f,p={})=>x(`/operations/${c}/complete`,{...s,status:f,...p}),emit:(f,p)=>{let a=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>h(f,p));return t.chain=a,a}};async function h(f,p){let a=t.eventSeq,d=(P)=>x(`/operations/${c}/events`,{...s,event_seq_start:P,events:[{kind:f,payload:{sequence:P,capability:String(o.capability??"hands.connect"),data:p}}]}),m=a,k=await d(m),E=k.status===409?k.json?.expected_event_seq:void 0;if(typeof E==="number"&&E===a+1)k={status:200,json:{duplicate:!0}};else if(typeof E==="number"&&E>=0&&E!==a)m=E,k=await d(m);if(k.status<300)t.eventSeq=m+1;return k}}function qe(t){return(o,s)=>new Promise((c,h)=>{if(n.turns.get(t.claim.attempt_id)!==t){h(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=mn){h(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:c,reject:h}),t.flush?.()})}function pe(t){if(ae.has(t))return;ae.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&u.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await R(t).emit(o.kind,o.data)}catch(c){if(c instanceof O)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{ae.delete(t)}})()}async function $e(t,o){try{let s=await e.agent.attestFrame(t,o);if(u.readyState!==WebSocket.OPEN)return;K(s);let c=await G(["attested","attest_refused"],15000);n.attest=c.t==="attested"?"accepted":"refused";for(let h of n.attestWaiters.splice(0))h(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...c.t==="attest_refused"?{code:String(c.code??"")}:{}}),n.attest==="refused")u.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let c of n.attestWaiters.splice(0))c(!1);if(n.attest!=="accepted")u.close(4000,"attest_unanswered")}}async function je(t){let o=J&&n.attest==="pending",s=t.vm_hands_attest,c=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await R({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(c==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let w of n.attestWaiters.splice(0))w(!0)}}else if(c!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await R({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let w=Date.parse(t.lease_until)-Date.now()-5000,D=Math.max(0,Math.min(te,Number.isFinite(w)?w:te));if(!await new Promise((Z)=>{let ze=setTimeout(()=>Z(!1),D);n.attestWaiters.push((Ge)=>{clearTimeout(ze),Z(Ge)})})){await R({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let h={claim:t,eventSeq:0},{complete:f,emit:p}=R(h),a;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");a=!ue(t)}catch(w){r("vm_hands.bind_refused",{code:w instanceof l?w.code:"unexpected"}),await f("failed",{error_code:w instanceof l?w.code:"vm_hands_bind_invalid"});return}let d,m=null,k=!1;n.bindsStarting++;try{let w=await gn(n);if(w)r("vm_hands.person_terminals_closed",{count:w});let D=Pe(t),Q=e.agent.bind(D);if(D.workspace_deferred)k=!0,m=Ue(h,()=>k);d=await Q}catch(w){r("vm_hands.bind_refused",{code:w instanceof l?w.code:"unexpected"}),await f("failed",{error_code:w instanceof l?w.code:"vm_hands_bind_failed"});return}finally{k=!1,n.bindsStarting--}let E=m?await m:-1,P={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(a)delete P.environment_installed;let ce=!a&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};H.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:P,eventSeq:h.eventSeq,ackSeq:-1});let C={...P,...ce,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},U=Date.now()+_n,N=1,b=await p("hands.ready",C);while(un(b.status)&&!e.signal.aborted){let w=Ce(N);if(Date.now()+w>=U)break;await new Promise((D)=>setTimeout(D,w)),N++,b=await p("hands.ready",C)}if(N>1)r("vm_hands.ready_retried",{attempts:N,status_class:`${Math.floor(b.status/100)}xx`});if(H.delete(t.attempt_id),b.status>=300){await Be(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:xe(b.json?.error,"vm_hands_probe_failed")});return}let T={claim:t,launchId:d.launch_id,readyData:P,eventSeq:h.eventSeq,ackSeq:E};n.turns.set(t.attempt_id,T),T.flush=()=>pe(T),e.onTurn?.(t.attempt_id,qe(T)),await ve(T)}async function Ue(t,o){let{fence:s,op:c}=R(t),h=t.claim.attempt_id,f=-1;try{for(;;){let p=await x(`/operations/${c}/heartbeat`,{...s,control_ack_seq:f,wait_ms:Ae});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(h),f;let a=(p.json?.controls??[]).slice().sort((d,m)=>d.seq-m.seq);for(let d of a){if(d.seq<=f)continue;if(f=d.seq,d.kind===Fn)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(h),f;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(h),f}}}catch{return e.agent.abandonWorkspaceGrant(h),f}}async function ve(t){let{fence:o,op:s}=R(t),c=null,h=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(h=p,null));e:for(;;){let p=await Promise.race([f,x(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:Ae})]);if(!p){c="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:h});break}if(p.status>=300)break;let a=(p.json?.controls??[]).slice().sort((d,m)=>d.seq-m.seq);for(let d of a){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===ut)try{await Ve(t,d.payload??{})}catch(m){if(m instanceof O)throw m;c=m instanceof l?m.code:"environment_unavailable";let k=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(m.code)?m.code:null;r("vm_hands.environment_refused",{code:c,cause:k});break e}t.ackSeq=d.seq}}await Fe(t,c)}async function We(t){let o=t,s={claim:o,eventSeq:0},{complete:c,emit:h,fence:f,op:p}={...R(s)},a=t.vm_hands_origin==="person"?"person":"model",d=String(t.capability??"");if(!e.executeOp){await c("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(J&&n.attest==="pending")){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}if(n.attest!=="accepted"){let b=Date.parse(String(t.lease_until??""))-Date.now()-5000,T=n.attest==="refused"?0:Math.max(0,Math.min(te,Number.isFinite(b)?b:te));if(!(T>0&&await new Promise((D)=>{let Q=setTimeout(()=>D(!1),T);n.attestWaiters.push((Z)=>{clearTimeout(Q),D(Z)})}))){await c("failed",{error_code:"vm_hands_unattested"});return}}let m=e.agent.bindIdForRun(o.run_id);if(a==="model"&&m===null){await c("failed",{error_code:"vm_hands_not_bound"});return}let k=d==="pty.start"&&a==="person"&&!t.authority;if(k&&(e.agent.liveBindIds.length>0||n.bindsStarting>0)){await c("failed",{error_code:"vm_hands_bound"});return}if(Re.has(d)&&!k&&e.agent.liveBindIds.length===0){await c("failed",{error_code:"vm_hands_not_bound"});return}if(a==="model"&&m||Re.has(d)&&!k)e.agent.opServed();let E=new AbortController;oe.add(E);let P,ce=new Promise((b)=>{P=b}),C={abort:E,settled:ce};if(k)n.personTerminals.add(C);if(a==="model"&&m){let b=n.modelOps.get(m)??new Set;b.add(C),n.modelOps.set(m,b),await e.agent.environmentInstalled(m,rn,E.signal)}let U=-1,N=setInterval(()=>{x(`/operations/${p}/heartbeat`,{...f,control_ack_seq:U,wait_ms:0}).then((b)=>{if(b.status>=300){E.abort();return}let T=b.json?.controls??[];for(let w of T)if(U=Math.max(U,w.seq),w.kind==="operation.cancel"||w.kind==="cancel")E.abort()},()=>E.abort())},tn);try{let b=await e.executeOp({kind:a,claim:t,...a==="model"&&m?{bindId:m}:{},signal:E.signal,emit:async(w)=>{await h(w.kind,w.data??{})}}),T=await c(b.status,{...b.result?{result:b.result}:{},...b.error_code?{error_code:xe(b.error_code,"vm_hands_op_failed")}:{}});r("vm_hands.op",{capability:d,kind:a,status:b.status,code:b.error_code??null,...T.status>=300?{complete_status:T.status,complete_error:String(T.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval(N),oe.delete(E),m)n.modelOps.get(m)?.delete(C);n.personTerminals.delete(C),P()}}async function Fe(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),ie(t);let c=await z(n,e.agent,s).catch((h)=>Y(h,t,o));if(!c)return;n.receipts.push({turn:t,failure:o,unbound:c}),await X()}function Y(t,o,s){let c=Ne(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:c,attempt:0}),R(o).emit(jn,{code:c}).catch(()=>{return}),hn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function X(){return de=de.then(we,we),de}async function we(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:c,emit:h}=R(t);try{if(await h("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await c("failed",{error_code:o});else await c("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof O)return}n.receipts.shift()}}async function Ve(t,o){let{fence:s,op:c}=R(t),h=o.snapshot_id;if(o.version!==1||typeof h!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await x(`/operations/${c}/environment`,{...s,snapshot_id:h}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let a=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:h,deviceId:n.deviceId??"",sealed:p});if((await x(`/operations/${c}/environment-ack`,{...s,...a})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as yn}from"fs";var wn=performance.now();delete process.env.BUN_BE_BUN;var j=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function bn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:_}=await import("./vm-hands-op-runner-kh1myd15.js");await _();return}j("parsed",{t0:Math.round(wn)});let e="";try{e=yn(3,"utf8")}catch{}j("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))j(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-yacvv937.js"),g=i(n);if(!g)j("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(g,j)}catch(_){let u=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"error";throw j("failed",{code:u}),_}process.exit(0)}bn();export{_i,Jr,yi};
+`,u=ee(i,`.job.env.${le(8).toString("hex")}`),y=Se(u,q.O_WRONLY|q.O_CREAT|q.O_EXCL|q.O_NOFOLLOW,384);try{Ee(y,_),ke(y)}finally{be(y)}return Le(u,ee(i,"job.env")),i}}function _e(e){try{let n=ee(e,"job.env"),i=Ie(n).size,r=Se(n,q.O_WRONLY|q.O_NOFOLLOW);try{Ee(r,Buffer.alloc(i)),ke(r)}finally{be(r)}}catch{}Je(e,{recursive:!0,force:!0})}function Ze(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let _=0;while(_<g.length-1&&g[_]===0)_++;let u=g.subarray(_),y=u[0]&128?Uint8Array.of(0,...u):u;return Uint8Array.of(2,y.length,...y)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as en}from"crypto";var nn="/app/local-runtime/session?register=vm_hands_v1",tn="/app/local-runtime",Te=25000,Re=20000,rn=1e4,Ce=5000,xe=new Set(["pty.start","jobs.control","preview.serve.v1","display.stream.v1"]),me=75000,sn=2000,on=1e4,an=new Set(["vm_hands_no_register","vm_hands_register_failed"]),dn=3,cn=20000,ln=250,_n=2000;function Ne(e){let n=Math.min(ln*2**(e-1),_n);return Math.round(n/2+Math.random()*n/2)}var un=5000;function mn(e){return e>=500||e===408||e===429}var te=20000;function De(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class O extends Error{}var hn=64,Oe=[1000,2000,4000,8000,15000,30000,60000,120000];function Be(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function gn(e,n,i,r,g){let _=i.turn.claim.attempt_id,u=e.healing??=new Set;if(u.has(_))return;u.add(_);let y=i.turn.claim.operation_id;(async()=>{for(let[S,I]of Oe.entries()){if(r.aborted)return;if(await new Promise((v)=>{let A=setTimeout(v,I);A.unref?.(),r.addEventListener("abort",()=>{clearTimeout(A),v()},{once:!0})}),r.aborted)return;try{let v=await n.retryUnbind(_);g("vm_hands.unbind_healed",{operation_id:y,attempt:S+1}),e.receipts.push({...i,unbound:v}),e.flushReceipts?.();return}catch(v){let A=Be(v);if(g("vm_hands.unbind_unverified",{operation_id:y,code:A,attempt:S+1}),A==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:y,attempts:Oe.length})})().finally(()=>u.delete(_))}async function qe(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ce))])}async function fn(e){let n=[...e.personTerminals];for(let i of n)i.abort.abort();if(n.length)await Promise.race([Promise.all(n.map((i)=>i.settled)),new Promise((i)=>setTimeout(i,Ce))]);return n.length}async function z(e,n,i){return await qe(e,i),n.unbind(i)}function ie(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Me=15000,pn=1e4,vn=1000;async function bi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:0},r=e.log??(()=>{}),g=async(y)=>{for(let[S,I]of[...i.turns]){i.turns.delete(S),e.onTurn?.(S,null),ie(I);let v=await z(i,e.agent,S).catch(()=>null);if(v)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:v});r("vm_hands.bound_dropped",{reason:y})}},_=0,u=0;try{for(let y=0;!e.signal.aborted;y++){let S=await wn(e,i).catch((v)=>{if(v instanceof l&&i.deviceId===null&&v.code==="vm_hands_no_session"&&Date.now()-n<on)return{closeCode:0,closeReason:"vm_hands_no_session"};if(v instanceof l&&i.deviceId===null&&an.has(v.code)&&_<dn&&Date.now()-n<cn)return _++,u=Ne(_),r("vm_hands.register_retry",{attempt:_,code:v.code,delay_ms:u}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(v instanceof l&&i.deviceId===null)throw v;return{closeCode:0,closeReason:v instanceof Error?v.message:String(v)}});if(r("vm_hands.session_closed",{close_code:S.closeCode,reason:S.closeReason.slice(0,120),registered:i.deviceId!==null}),S.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=me)await g("reconnect_deadline");if(i.served)i.served=!1,y=0;let I=S.closeReason==="drain_reconnect"?0:S.closeReason==="vm_hands_register_retry"?u:S.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(y,5),2000):i.turns.size?Math.min(250*2**Math.min(y,5),5000,Math.max(0,i.lostAt+me-Date.now())):Math.min(500*2**y,30000);if(await new Promise((v)=>setTimeout(v,I)),i.turns.size&&Date.now()-i.lostAt>=me)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function wn(e,n){let i=n.deviceId,r=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:nn,_=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,u=new WebSocket(_),y=0,S="",I=new Map,v=[],A=null,M=new Promise((t)=>{u.onclose=(o)=>{y=o.code,S=o.reason;for(let s of I.values())s.reject(new O(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});u.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{u.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,vn));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{u.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!A?.(o))v.push(o)};let G=(t,o)=>new Promise((s,c)=>{let h=v.findIndex((p)=>t.includes(p.t));if(h>=0){s(v.splice(h,1)[0]);return}let f=setTimeout(()=>{A=null,c(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);A=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),A=null,s(p),!0}}),K=(t)=>u.send(JSON.stringify(t)),x=(t,o)=>new Promise((s,c)=>{if(u.readyState!==WebSocket.OPEN){c(new O("session closed"));return}let h=en(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(h))return;c(new O(`no answer to ${t.split("/").pop()} in ${f+Me} ms`)),u.close(4000,"request_timeout")},f+Me);I.set(h,{reject:(a)=>{clearTimeout(p),c(a)},resolve:({status:a,body:d})=>{clearTimeout(p);let m=null;try{m=d?JSON.parse(d):null}catch{}s({status:a,json:m})}}),K({t:"req",id:h,path:`${tn}${t}`,body:JSON.stringify(o)})}),he=()=>u.close(1001,"stopping");e.signal.addEventListener("abort",he,{once:!0});let re,H=new Map,L=new Map,se=!1,oe=new Set,ae=new Set,de=Promise.resolve(),ge=()=>{X().catch(()=>{return})},J=!1;try{await new Promise((a,d)=>{let m=setTimeout(()=>d(Error("session open timeout")),pn);u.onopen=()=>{clearTimeout(m),r("vm_hands.ws_open",{}),a()},u.onerror=()=>{clearTimeout(m),d(Error("session socket error"))}});let t=await G(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,c;if(i){K(await e.agent.helloFrame(t.challenge,n.connection));let a=await G(["ready"],1e4);if(typeof a.vm_hands_connection==="string")n.connection=a.vm_hands_connection;if(c={device_id:i,...a.cadence?{cadence:a.cadence}:{}},typeof a.vm_hands_probe_script==="string"){if(s=a.vm_hands_probe_script,J=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(a.vm_hands_binds)?a.vm_hands_binds:a.vm_hands_bind?[a.vm_hands_bind]:[];for(let[m,k]of[...n.turns]){if(d.some((P)=>P&&P.operation_id===k.claim.operation_id&&P.attempt_id===k.claim.attempt_id)){o.push(k),r("vm_hands.bound_resumed",{operation_id:k.claim.operation_id});continue}n.turns.delete(m),e.onTurn?.(m,null),ie(k);let E=await z(n,e.agent,m).catch((P)=>Y(P,k,"vm_hands_bind_lost"));if(E)n.receipts.push({turn:k,failure:"vm_hands_bind_lost",unbound:E});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{K(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let a=await Promise.race([G(["registered","register_refused"],1e4),M.then(()=>{throw new l(S==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(a.t==="register_refused")throw new l(a.code,"register refused");e.agent.registered();let d=a;if(c=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,J=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:c.device_id})}let h=async()=>{let a=await x("/heartbeat",await e.heartbeat());if(a.status>=300)throw Error(`heartbeat ${a.status}`)};await h();let f=c.cadence?.presence_interval_ms??30000;if(re=setInterval(()=>{h().catch(()=>u.close())},f),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)je(s,t.challenge);let p=(a,d)=>{L.set(a,d().catch(async(m)=>{if(await fe(m,a),m instanceof O)u.close();else await X().catch(()=>{return})}).finally(()=>{L.delete(a)}))};n.flushReceipts=ge;try{await X();for(let a of o)a.flush=()=>pe(a),a.flush(),p(a.claim.attempt_id,()=>ve(a));while(!e.signal.aborted&&u.readyState===WebSocket.OPEN){let a=await x("/operations/claim",{wait_ms:Math.min(c.cadence?.claim_wait_ms??Te,Te)});if(a.status===204||!a.json)continue;if(a.status>=300)throw Error(`claim ${a.status}`);let d=a.json;if(d.capability==="hands.connect"){if(L.has(d.attempt_id)){R({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Ue(d))}else Fe(d).catch(()=>{return})}}catch(a){await fe(a,null)}}finally{if(re)clearInterval(re);e.signal.removeEventListener("abort",he);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ge)n.flushReceipts=null;u.close(),await M,await Promise.all([...L.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=H.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,c=await z(n,e.agent,t).catch((h)=>s?Y(h,s,"vm_hands_bind_lost"):null);if(c&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:c});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let t of oe)t.abort()}return{closeCode:y,closeReason:S};async function fe(t,o){if(t instanceof O){if(!se&&n.turns.size)n.lostAt=Date.now();se=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)se=!0;for(let c of s){let h=n.turns.get(c);if(n.turns.delete(c),h)ie(h),e.onTurn?.(c,null);if(e.agent.liveBindIds.includes(c)){let f=H.get(c)??h,p=f?{...f,eventSeq:f.eventSeq+1}:null,a=await z(n,e.agent,c).catch((d)=>p?Y(d,p,"vm_hands_bind_lost"):null);if(a&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:a})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function R(t){let o=t.claim,s={attempt_id:o.attempt_id,attempt_token:o.attempt_token},c=encodeURIComponent(o.operation_id);return{fence:s,op:c,complete:(f,p={})=>x(`/operations/${c}/complete`,{...s,status:f,...p}),emit:(f,p)=>{let a=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>h(f,p));return t.chain=a,a}};async function h(f,p){let a=t.eventSeq,d=(P)=>x(`/operations/${c}/events`,{...s,event_seq_start:P,events:[{kind:f,payload:{sequence:P,capability:String(o.capability??"hands.connect"),data:p}}]}),m=a,k=await d(m),E=k.status===409?k.json?.expected_event_seq:void 0;if(typeof E==="number"&&E===a+1)k={status:200,json:{duplicate:!0}};else if(typeof E==="number"&&E>=0&&E!==a)m=E,k=await d(m);if(k.status<300)t.eventSeq=m+1;return k}}function $e(t){return(o,s)=>new Promise((c,h)=>{if(n.turns.get(t.claim.attempt_id)!==t){h(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=hn){h(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:c,reject:h}),t.flush?.()})}function pe(t){if(ae.has(t))return;ae.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&u.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await R(t).emit(o.kind,o.data)}catch(c){if(c instanceof O)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{ae.delete(t)}})()}async function je(t,o){try{let s=await e.agent.attestFrame(t,o);if(u.readyState!==WebSocket.OPEN)return;K(s);let c=await G(["attested","attest_refused"],15000);n.attest=c.t==="attested"?"accepted":"refused";for(let h of n.attestWaiters.splice(0))h(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...c.t==="attest_refused"?{code:String(c.code??"")}:{}}),n.attest==="refused")u.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let c of n.attestWaiters.splice(0))c(!1);if(n.attest!=="accepted")u.close(4000,"attest_unanswered")}}async function Ue(t){let o=J&&n.attest==="pending",s=t.vm_hands_attest,c=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await R({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(c==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let w of n.attestWaiters.splice(0))w(!0)}}else if(c!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await R({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let w=Date.parse(t.lease_until)-Date.now()-5000,D=Math.max(0,Math.min(te,Number.isFinite(w)?w:te));if(!await new Promise((Z)=>{let Ge=setTimeout(()=>Z(!1),D);n.attestWaiters.push((Ke)=>{clearTimeout(Ge),Z(Ke)})})){await R({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let h={claim:t,eventSeq:0},{complete:f,emit:p}=R(h),a;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");a=!ue(t)}catch(w){r("vm_hands.bind_refused",{code:w instanceof l?w.code:"unexpected"}),await f("failed",{error_code:w instanceof l?w.code:"vm_hands_bind_invalid"});return}let d,m=null,k=!1;n.bindsStarting++;try{let w=await fn(n);if(w)r("vm_hands.person_terminals_closed",{count:w});let D=Pe(t),Q=e.agent.bind(D);if(D.workspace_deferred)k=!0,m=We(h,()=>k);d=await Q}catch(w){r("vm_hands.bind_refused",{code:w instanceof l?w.code:"unexpected"}),await f("failed",{error_code:w instanceof l?w.code:"vm_hands_bind_failed"});return}finally{k=!1,n.bindsStarting--}let E=m?await m:-1,P={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(a)delete P.environment_installed;let ce=!a&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};H.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:P,eventSeq:h.eventSeq,ackSeq:-1});let C={...P,...ce,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},U=Date.now()+un,N=1,b=await p("hands.ready",C);while(mn(b.status)&&!e.signal.aborted){let w=Ne(N);if(Date.now()+w>=U)break;await new Promise((D)=>setTimeout(D,w)),N++,b=await p("hands.ready",C)}if(N>1)r("vm_hands.ready_retried",{attempts:N,status_class:`${Math.floor(b.status/100)}xx`});if(H.delete(t.attempt_id),b.status>=300){await qe(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:De(b.json?.error,"vm_hands_probe_failed")});return}let T={claim:t,launchId:d.launch_id,readyData:P,eventSeq:h.eventSeq,ackSeq:E};n.turns.set(t.attempt_id,T),T.flush=()=>pe(T),e.onTurn?.(t.attempt_id,$e(T)),await ve(T)}async function We(t,o){let{fence:s,op:c}=R(t),h=t.claim.attempt_id,f=-1;try{for(;;){let p=await x(`/operations/${c}/heartbeat`,{...s,control_ack_seq:f,wait_ms:Re});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(h),f;let a=(p.json?.controls??[]).slice().sort((d,m)=>d.seq-m.seq);for(let d of a){if(d.seq<=f)continue;if(f=d.seq,d.kind===pt)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(h),f;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(h),f}}}catch{return e.agent.abandonWorkspaceGrant(h),f}}async function ve(t){let{fence:o,op:s}=R(t),c=null,h=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(h=p,null));e:for(;;){let p=await Promise.race([f,x(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:Re})]);if(!p){c="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:h});break}if(p.status>=300)break;let a=(p.json?.controls??[]).slice().sort((d,m)=>d.seq-m.seq);for(let d of a){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===dt)try{await ze(t,d.payload??{})}catch(m){if(m instanceof O)throw m;c=m instanceof l?m.code:"environment_unavailable";let k=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(m.code)?m.code:null;r("vm_hands.environment_refused",{code:c,cause:k});break e}t.ackSeq=d.seq}}await Ve(t,c)}async function Fe(t){let o=t,s={claim:o,eventSeq:0},{complete:c,emit:h,fence:f,op:p}={...R(s)},a=t.vm_hands_origin==="person"?"person":"model",d=String(t.capability??"");if(!e.executeOp){await c("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(J&&n.attest==="pending")){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}if(n.attest!=="accepted"){let b=Date.parse(String(t.lease_until??""))-Date.now()-5000,T=n.attest==="refused"?0:Math.max(0,Math.min(te,Number.isFinite(b)?b:te));if(!(T>0&&await new Promise((D)=>{let Q=setTimeout(()=>D(!1),T);n.attestWaiters.push((Z)=>{clearTimeout(Q),D(Z)})}))){await c("failed",{error_code:"vm_hands_unattested"});return}}let m=e.agent.bindIdForRun(o.run_id);if(a==="model"&&m===null){await c("failed",{error_code:"vm_hands_not_bound"});return}let k=d==="pty.start"&&a==="person"&&!t.authority;if(k&&(e.agent.liveBindIds.length>0||n.bindsStarting>0)){await c("failed",{error_code:"vm_hands_bound"});return}if(xe.has(d)&&!k&&e.agent.liveBindIds.length===0){await c("failed",{error_code:"vm_hands_not_bound"});return}if(a==="model"&&m||xe.has(d)&&!k)e.agent.opServed();let E=new AbortController;oe.add(E);let P,ce=new Promise((b)=>{P=b}),C={abort:E,settled:ce};if(k)n.personTerminals.add(C);if(a==="model"&&m){let b=n.modelOps.get(m)??new Set;b.add(C),n.modelOps.set(m,b),await e.agent.environmentInstalled(m,sn,E.signal)}let U=-1,N=setInterval(()=>{x(`/operations/${p}/heartbeat`,{...f,control_ack_seq:U,wait_ms:0}).then((b)=>{if(b.status>=300){E.abort();return}let T=b.json?.controls??[];for(let w of T)if(U=Math.max(U,w.seq),w.kind==="operation.cancel"||w.kind==="cancel")E.abort()},()=>E.abort())},rn);try{let b=await e.executeOp({kind:a,claim:t,...a==="model"&&m?{bindId:m}:{},signal:E.signal,emit:async(w)=>{await h(w.kind,w.data??{})}}),T=await c(b.status,{...b.result?{result:b.result}:{},...b.error_code?{error_code:De(b.error_code,"vm_hands_op_failed")}:{}});r("vm_hands.op",{capability:d,kind:a,status:b.status,code:b.error_code??null,...T.status>=300?{complete_status:T.status,complete_error:String(T.json?.error??"").slice(0,64)}:{}})}finally{if(clearInterval(N),oe.delete(E),m)n.modelOps.get(m)?.delete(C);n.personTerminals.delete(C),P()}}async function Ve(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),ie(t);let c=await z(n,e.agent,s).catch((h)=>Y(h,t,o));if(!c)return;n.receipts.push({turn:t,failure:o,unbound:c}),await X()}function Y(t,o,s){let c=Be(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:c,attempt:0}),R(o).emit(jn,{code:c}).catch(()=>{return}),gn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function X(){return de=de.then(we,we),de}async function we(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:c,emit:h}=R(t);try{if(await h("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await c("failed",{error_code:o});else await c("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof O)return}n.receipts.shift()}}async function ze(t,o){let{fence:s,op:c}=R(t),h=o.snapshot_id;if(o.version!==1||typeof h!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await x(`/operations/${c}/environment`,{...s,snapshot_id:h}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let a=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:h,deviceId:n.deviceId??"",sealed:p});if((await x(`/operations/${c}/environment-ack`,{...s,...a})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as bn}from"fs";var yn=performance.now();delete process.env.BUN_BE_BUN;var j=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function kn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:_}=await import("./vm-hands-op-runner-f2bjvb7v.js");await _();return}j("parsed",{t0:Math.round(yn)});let e="";try{e=bn(3,"utf8")}catch{}j("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))j(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-aa4p4pqz.js"),g=i(n);if(!g)j("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(g,j)}catch(_){let u=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"error";throw j("failed",{code:u}),_}process.exit(0)}kn();export{wi,Xr,bi};