@reason-machines/cli-linux-x64 0.2.408 → 0.2.410

package/bin/vm-hands/{vm-hands-executor-79av9nam.js → vm-hands-executor-rdmj1wv4.js}

@@ -1,11 +1,11 @@
 // @bun
-import"./vm-hands-entry-lite-ym1djztp.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-g3ja0c3y.js";import"./vm-hands-entry-lite-hcw5tk5d.js";import{Ke,Ri,cr,wt}from"./vm-hands-entry-lite-et2bh990.js";import"./vm-hands-entry-lite-v3xznxcw.js";import"./vm-hands-entry-lite-wd576mgy.js";import"./vm-hands-entry-lite-8gtgr399.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-mw0gzbds.js";import"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-dq1m5ykp.js";import"./vm-hands-entry-lite-51qvfk93.js";import{Zt}from"./vm-hands-entry-lite-saqdrc2w.js";import"./vm-hands-entry-lite-wyh6dp1t.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-zg3b0c08.js";import{spawn as De}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as U,lstatSync as V,mkdirSync as ee,mkdtempSync as Ae,readdirSync as Z,readFileSync as P,realpathSync as Te,rmdirSync as ne,rmSync as ze,writeFileSync as K}from"fs";import{join as p}from"path";import{readFileSync as ae,readlinkSync as ce}from"fs";import{relative as $e}from"path";var le=16;function de(n){return n.replace(/\\([0-7]{3})/g,(r,i)=>String.fromCharCode(Number.parseInt(i,8)))}function Ie(n){let r=[];for(let i of n.split(`
-`)){let e=i.split(" ");if(e.length<10||!/^\d+:\d+$/.test(e[2]))continue;r.push({device:e[2],root:de(e[3]),mountPoint:de(e[4])})}return r}function Ne(n,r,i){let e=n.replace(/\/+$/,"")||"/",c=(m)=>e==="/"||m===e||m.startsWith(`${e}/`),a=(m)=>new Map(Ie(m).filter((b)=>c(b.mountPoint)).map((b)=>[`${b.mountPoint}\x00${b.device}\x00${b.root}`,b.mountPoint])),l=a(r),v=a(i),y=(m)=>$e(e,m)||".",O=[...l].filter(([m])=>!v.has(m)).map(([,m])=>y(m)),R=[...v].filter(([m])=>!l.has(m)).map(([,m])=>y(m));return{missing:O,extra:R,referenceCount:l.size,ownCount:v.size}}function ue(n,r,i,e="/proc"){let c,a,l=null;try{c=ae(`${e}/1/mountinfo`,"utf8"),a=ae(`${e}/self/mountinfo`,"utf8")}catch(b){let I=b&&typeof b==="object"&&"code"in b&&typeof b.code==="string"?b.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:I});return}try{l=ce(`${e}/1/ns/mnt`)===ce(`${e}/self/ns/mnt`)}catch{}let{missing:v,extra:y,referenceCount:O,ownCount:R}=Ne(n,c,a),m={reference_count:O,own_count:R,missing_count:v.length,extra_count:y.length,same_namespace:l};if(y.length)r("vm_hands.mount_extra",{...m,extra:y.slice(0,le)});if(v.length)throw r("vm_hands.mount_mismatch",{...m,missing:v.slice(0,le)}),i(`${v.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var we="/sys/fs/cgroup/reason-payload",M="vm-hands",We="/run/ara-srt/fallbacks.jsonl",B="/reason-person",te=5000,Be=1e4,pe="__VM_HANDS_PROOF_DIR__",je="__VM_HANDS_PROBE_NONCE__";class h extends Error{code;constructor(n,r){super(r);this.code=n}}function He(n,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new h("vm_hands_bind_invalid","bad bind id");return p(n,M,`b-${r.toLowerCase()}`)}var Ue=5000,ve=(n)=>`'${n.replaceAll("'","'\\''")}'`;function on(n){let r=n.cgroup??we,i=n.init.layout.payload_uid,e=n.log??(()=>{}),c=new Map,a=new Map,l=0,v=()=>{try{let t=P("/run/ara-srt/starts.jsonl","utf8"),o=t.slice(l>t.length?0:l).split(`
+import"./vm-hands-entry-lite-k278g9kj.js";import"./vm-hands-entry-lite-8t9xssf9.js";import"./vm-hands-entry-lite-22kfyvnk.js";import"./vm-hands-entry-lite-m11j0f9q.js";import{Je,Ii,ur,vt}from"./vm-hands-entry-lite-70ba2bqj.js";import"./vm-hands-entry-lite-f5e3dbgk.js";import"./vm-hands-entry-lite-9c95p6n9.js";import"./vm-hands-entry-lite-gvwdy3rf.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-88swf2qr.js";import"./vm-hands-entry-lite-ckv17tn8.js";import"./vm-hands-entry-lite-q0k6kx6d.js";import"./vm-hands-entry-lite-bdhjpv7g.js";import{Yt}from"./vm-hands-entry-lite-grm1tqs7.js";import"./vm-hands-entry-lite-09m2cdkw.js";import"./vm-hands-entry-lite-89z488gz.js";import"./vm-hands-entry-lite-9ay6f56v.js";import{spawn as De}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as U,lstatSync as V,mkdirSync as ee,mkdtempSync as Ae,readdirSync as Z,readFileSync as P,realpathSync as Te,rmdirSync as ne,rmSync as ze,writeFileSync as K}from"fs";import{join as p}from"path";import{readFileSync as ae,readlinkSync as ce}from"fs";import{relative as $e}from"path";var le=16;function de(n){return n.replace(/\\([0-7]{3})/g,(r,i)=>String.fromCharCode(Number.parseInt(i,8)))}function Ie(n){let r=[];for(let i of n.split(`
+`)){let e=i.split(" ");if(e.length<10||!/^\d+:\d+$/.test(e[2]))continue;r.push({device:e[2],root:de(e[3]),mountPoint:de(e[4])})}return r}function Ne(n,r,i){let e=n.replace(/\/+$/,"")||"/",c=(m)=>e==="/"||m===e||m.startsWith(`${e}/`),a=(m)=>new Map(Ie(m).filter((b)=>c(b.mountPoint)).map((b)=>[`${b.mountPoint}\x00${b.device}\x00${b.root}`,b.mountPoint])),l=a(r),v=a(i),y=(m)=>$e(e,m)||".",O=[...l].filter(([m])=>!v.has(m)).map(([,m])=>y(m)),R=[...v].filter(([m])=>!l.has(m)).map(([,m])=>y(m));return{missing:O,extra:R,referenceCount:l.size,ownCount:v.size}}function ue(n,r,i,e="/proc"){let c,a,l=null;try{c=ae(`${e}/1/mountinfo`,"utf8"),a=ae(`${e}/self/mountinfo`,"utf8")}catch(b){let I=b&&typeof b==="object"&&"code"in b&&typeof b.code==="string"?b.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:I});return}try{l=ce(`${e}/1/ns/mnt`)===ce(`${e}/self/ns/mnt`)}catch{}let{missing:v,extra:y,referenceCount:O,ownCount:R}=Ne(n,c,a),m={reference_count:O,own_count:R,missing_count:v.length,extra_count:y.length,same_namespace:l};if(y.length)r("vm_hands.mount_extra",{...m,extra:y.slice(0,le)});if(v.length)throw r("vm_hands.mount_mismatch",{...m,missing:v.slice(0,le)}),i(`${v.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var we="/sys/fs/cgroup/reason-payload",M="vm-hands",We="/run/ara-srt/fallbacks.jsonl",B="/reason-person",te=5000,Be=1e4,pe="__VM_HANDS_PROOF_DIR__",Ke="__VM_HANDS_PROBE_NONCE__";class h extends Error{code;constructor(n,r){super(r);this.code=n}}function je(n,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new h("vm_hands_bind_invalid","bad bind id");return p(n,M,`b-${r.toLowerCase()}`)}var He=5000,ve=(n)=>`'${n.replaceAll("'","'\\''")}'`;function on(n){let r=n.cgroup??we,i=n.init.layout.payload_uid,e=n.log??(()=>{}),c=new Map,a=new Map,l=0,v=()=>{try{let t=P("/run/ara-srt/starts.jsonl","utf8"),o=t.slice(l>t.length?0:l).split(`
 `).filter(Boolean);l=t.length;let d=o.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(d.length)e("vm_hands.srt_server_starts",{count:d.length,elapsed_ms:d.slice(0,8)})}catch{}},y=null,O=!1,R=n.srtCgroup??"/sys/fs/cgroup/reason-srt",m=()=>{y??=me()},b=0,I=()=>{try{let t=P(We,"utf8"),o=t.slice(b>t.length?0:b);b=t.length;let d=o.split(`
-`).filter(Boolean).slice(0,1000);if(!d.length)return null;let f={},g=0;for(let w of d)try{let _=JSON.parse(w),u=typeof _.code==="string"&&/^[a-z_]{1,40}$/.test(_.code)?_.code:"other";if(f[u]=(f[u]??0)+1,typeof _.elapsed_ms==="number")g=Math.max(g,_.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return e("vm_hands.srt_fallbacks",{count:d.length,codes:f,max_elapsed_ms:g}),{count:d.length,codes:f,max_elapsed_ms:g}}catch{return null}},S=!1,j=(t,o,d)=>{if(S)throw Error("vm_hands_pool_held");return Ce(t,o,d)},X=(t)=>(o,d,f)=>De("/bin/sh",["-c",`echo $$ > ${ve(p(t,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",o,...d],f),Ce=X(p(r,M)),H=p(r,M,"probe"),z=(t)=>He(r,t),Oe=(t)=>{let o=z(t);try{ee(o,{mode:493})}catch(d){if(!(d&&typeof d==="object"&&("code"in d)&&d.code==="EEXIST"))throw new h("vm_hands_bind_failed","bind cgroup")}return o},Re=(t)=>{try{ne(z(t))}catch{}},D=n.prespawn?Ri({spawnProcess:j,...n.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:n.relayDependencies.sourceEntrypoint}:{},log:(t,o)=>e(t,o??{})}):null;D?.arm();let Q=D?setInterval(()=>{D.arm()},Ue):null;Q?.unref?.();async function F(t){let o=c.get(t);if(c.delete(t),!o)return;o.abort.abort(),await o.done}return{bindCgroup:z,async startExecutor(t){if(m(),a.set(t.bindId,me()),O=!0,!t.claim)throw new h("vm_hands_bind_invalid","an executor needs the claim it serves");await F(t.bindId);let{claim:o,bindId:d}=t,f=Oe(d),g=o.owner;if(!g||typeof g.device_id!=="string"||typeof o.root_id!=="string")throw new h("vm_hands_bind_invalid","claim without its owner Device or root");let w=new AbortController,_,u,x=new Promise((s,k)=>{_=s,u=k}),L,C=new Promise((s)=>{L=s}),W=wt({headless:!0,hostExecution:!0,runtimeDirectory:n.runtimeDirectory,deviceIdentity:{deviceId:g.device_id,rootId:o.root_id,apiOrigin:n.apiOrigin},claimOwner:o.owner,root:n.root,runId:o.run_id,operationId:o.operation_id,attemptId:o.attempt_id,payload:Object.fromEntries(Object.entries(o.payload).filter(([s])=>!s.startsWith("vm_hands_"))),signal:w.signal,...t.workspaceGrant?{workspaceGrant:t.workspaceGrant}:{},emitEvent:async(s,k)=>{if(s==="hands.ready"){_(k);return}if(s==="hands.started"||s==="hands.stopped"||s==="hands.failed")return;await n.forward(d,s,k)}},{...n.relayDependencies,spawnWorker:(s)=>X(f)(s.command,s.args,s.options),...D?{takePrespawnedWorker:(s)=>{let k=D.take(s);if(!k?.pid)return k;try{return K(p(f,"cgroup.procs"),String(k.pid)),k}catch{try{k.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:D.adopt}:{}}).then(()=>{L("executor_stopped")},(s)=>{let k=s&&typeof s==="object"&&"code"in s?String(s.code):"executor_failed";u(new h(k,s instanceof Error?s.message:String(s))),L(k)}).finally(()=>u(new h("vm_hands_executor_exited","executor ended before it was ready")));c.set(d,{abort:w,done:W,exited:C,operationId:o.operation_id,runId:o.run_id,expiresAtMs:Date.parse(String(o.payload.expires_at??""))||0});let A=await x,G=A.executor_launch_id;if(typeof G!=="string")throw new h("vm_hands_bind_failed","executor ready without a launch id");return{launchId:G,readyData:A,applied:{hands_confinement:typeof o.payload.hands_confinement==="string"?o.payload.hands_confinement:null,browser_egress:o.payload.browser_egress??null}}},takeSrtFallbacks:I,executorExited(t){return c.get(t)?.exited??new Promise(()=>{})},freezeBind(t){let o=z(t);if(U(p(o,"cgroup.freeze")))K(p(o,"cgroup.freeze"),"1")},async killAndVerifyPayload(t){let o=new Set(t?.keep??[]);if(o.size||t?.own)return xe(t?.bindId??null,o,t?.own===!0);S=!0;let d=he();try{await ye();let f=Promise.all([...c.keys()].map((u)=>F(u).catch(()=>{return})));v();let g=Date.now()+te;await J(r,g,"payload"),await f;let w=(O||n.srtWarmLate?.()===!0)&&U(p(R,"cgroup.events"));if(w)await J(R,g,"srt");let _=se(i).filter((u)=>!N(u,B));if(y!==null){let u=re(y).filter((x)=>x!==process.pid&&!N(x,B));if(u.length)throw e("vm_hands.kill_strays",{strays:E(u)}),new h("vm_hands_kill_unverified",`${u.length} process(es) the run started survived it`);y=null}if(O=!1,w)n.onSrtReset?.();if(_.length)throw e("vm_hands.kill_survivors",{pids:_.slice(0,16)}),new h("vm_hands_kill_unverified",`${_.length} payload-uid process(es) outside the payload cgroup`);a.clear();for(let u of ie())try{ne(p(r,M,u))}catch{}}finally{S=!1,d()}if(D)setTimeout(()=>{if(!c.size)D.arm()},100).unref?.()},async killProbe(){let t=Date.now()+te;if(U(p(H,"cgroup.events"))){await J(H,t,"probe");try{ne(H)}catch{}}let o=oe(process.pid);if(o===null)throw new h("vm_hands_kill_unverified","agent start time unreadable");await Fe(r,o,t);let d=(g)=>{let w=oe(g);return w!==null&&w<=o},f=se(i).filter((g)=>d(g)&&!N(g,B));if(f.length)throw e("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest"}),new h("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(y!==null){let g=[r,p(r,M)].map((u)=>u.replace(/^\/sys\/fs\/cgroup/,"")),w=R.replace(/^\/sys\/fs\/cgroup/,""),_=re(y).filter((u)=>u!==process.pid&&!N(u,B)&&!N(u,"/reason-vm-hands")&&!N(u,w)&&!g.some((x)=>fe(u,x)));if(_.length&&O)throw e("vm_hands.kill_strays",{strays:E(_),at:"attest"}),new h("vm_hands_kill_unverified",`${_.length} process(es) the run started survived it`);if(_.length)e("vm_hands.attest_concurrent",{processes:E(_),count:_.length});y=null}},async runProbe({nonce:t,script:o}){if(m(),!o.includes(pe))throw new h("vm_hands_probe_failed","probe names no proof directory");let d=n.proofParent??"/tmp/reason-vm-hands-proof";ee(d,{mode:457,recursive:!0});let f=V(d);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new h("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Ae(p(d,"p-")),w=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(t))throw new h("vm_hands_probe_failed","proof directory path or nonce");Le(g,i,i),Me(g,448);let _=V(g).ino;try{ee(H,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new h("vm_hands_probe_failed","probe cgroup")}let u=X(H)("/bin/bash",["-c",o.replaceAll(pe,g).replaceAll(je,t)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),x="";u.stdout?.on("data",(C)=>{if(x.length<16384)x+=C.toString("utf8").slice(0,16384-x.length)});let L=await new Promise((C)=>{let W=setTimeout(()=>{w=!0,u.kill("SIGKILL"),C(124)},Be);u.once("error",()=>{clearTimeout(W),C(127)}),u.once("close",(A)=>{clearTimeout(W),C(A??1)})});return e("vm_hands.probe",{nonce_len:t.length,exit_code:L}),{exitCode:L,markers:x,proofDirInode:_}}finally{if(!w)ze(g,{recursive:!0,force:!0})}},restatLayout(){let{session_root:t,alias:o}=n.init.layout,d="invalid";try{cr(t),d="0:0:755"}catch{}let f=!1,g=-1;try{let w=V(o);g=w.uid,f=d==="0:0:755"&&o===p(t,"repo")&&!w.isSymbolicLink()&&w.isDirectory()&&Te(o)===o&&w.uid===i}catch{}return{root_mode:d,alias_ok:f,owner_uid:g}},verifyMounts(){ue(n.init.layout.session_root,e,(t)=>new h("vm_hands_mount_mismatch",t))},installEnvironment(t,o){let d=c.get(t);if(!d)throw new h("environment_unavailable","no executor owns an environment");return Ke({root:n.root,operationId:d.operationId,payload:o}).installed_revision},async stop(){if(Q)clearInterval(Q);D?.close(),await Promise.all([...c.keys()].map((t)=>F(t)))}};function ie(){try{return Z(p(r,M),{withFileTypes:!0}).filter((t)=>t.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(t.name)).map((t)=>t.name)}catch{return[]}}async function xe(t,o,d=!1){let f=new Set([...o].map((w)=>w.toLowerCase())),g=he();try{await ye();let w=Date.now()+te,_=new Set(ie().filter((s)=>!f.has(s.slice(2))).map((s)=>s.slice(2)));if(t)_.add(t.toLowerCase());let u=null;for(let s of _){let k=F(s).catch(()=>{return}),q=a.get(s);if(q!==void 0)u=u===null?q:Math.min(u,q);if(U(p(z(s),"cgroup.events")))await J(z(s),w,"bind");await k}let x=[...f].map((s)=>z(s).replace(/^\/sys\/fs\/cgroup/,"")),L=[r,p(r,M)].map((s)=>s.replace(/^\/sys\/fs\/cgroup/,"")),C=R.replace(/^\/sys\/fs\/cgroup/,""),W=(s)=>N(s,B)||x.some((k)=>N(s,k)),A=d?[]:se(i).filter((s)=>!W(s));if(A.length)throw e("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size}),new h("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let G=(s)=>!W(s)&&!N(s,"/reason-vm-hands")&&!N(s,C)&&!L.some((k)=>fe(s,k));if(u!==null){let s=re(u).filter((k)=>k!==process.pid&&G(k));if(s.length)throw e("vm_hands.kill_strays",{strays:E(s),beside:f.size}),new h("vm_hands_kill_unverified",`${s.length} process(es) the run started survived it`)}for(let s of _)a.delete(s),Re(s)}finally{g()}}}function oe(n,r="/proc"){try{let i=P(p(r,String(n),"stat"),"utf8"),e=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(e)?e:null}catch{return null}}function be(n,r="/proc"){try{let i=P(p(r,String(n),"stat"),"utf8"),e=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(e)?e:null}catch{return null}}async function Fe(n,r,i){try{K(p(n,"cgroup.freeze"),"1")}catch(e){throw new h("vm_hands_kill_unverified",`payload cgroup.freeze: ${e instanceof Error?e.message:String(e)}`)}try{for(;;){let e=Se(n).filter((a)=>ke(a,n)),c=new Set(e.filter((a)=>{let l=oe(a);return l!==null&&l<=r}));for(let a=!0;a;){a=!1;for(let l of e){if(c.has(l))continue;let v=be(l);if(v!==null&&c.has(v))c.add(l),a=!0}}if(c.size===0)return;if(Date.now()>i)throw new h("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let a of c)try{process.kill(a,"SIGKILL")}catch{}await new Promise((a)=>setTimeout(a,10))}}finally{try{K(p(n,"cgroup.freeze"),"0")}catch{}}}function fe(n,r,i="/proc"){try{return P(p(i,String(n),"cgroup"),"utf8").split(`
+`).filter(Boolean).slice(0,1000);if(!d.length)return null;let f={},g=0;for(let w of d)try{let _=JSON.parse(w),u=typeof _.code==="string"&&/^[a-z_]{1,40}$/.test(_.code)?_.code:"other";if(f[u]=(f[u]??0)+1,typeof _.elapsed_ms==="number")g=Math.max(g,_.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return e("vm_hands.srt_fallbacks",{count:d.length,codes:f,max_elapsed_ms:g}),{count:d.length,codes:f,max_elapsed_ms:g}}catch{return null}},S=!1,j=(t,o,d)=>{if(S)throw Error("vm_hands_pool_held");return Ce(t,o,d)},X=(t)=>(o,d,f)=>De("/bin/sh",["-c",`echo $$ > ${ve(p(t,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",o,...d],f),Ce=X(p(r,M)),H=p(r,M,"probe"),z=(t)=>je(r,t),Oe=(t)=>{let o=z(t);try{ee(o,{mode:493})}catch(d){if(!(d&&typeof d==="object"&&("code"in d)&&d.code==="EEXIST"))throw new h("vm_hands_bind_failed","bind cgroup")}return o},Re=(t)=>{try{ne(z(t))}catch{}},D=n.prespawn?Ii({spawnProcess:j,...n.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:n.relayDependencies.sourceEntrypoint}:{},log:(t,o)=>e(t,o??{})}):null;D?.arm();let Q=D?setInterval(()=>{D.arm()},He):null;Q?.unref?.();async function F(t){let o=c.get(t);if(c.delete(t),!o)return;o.abort.abort(),await o.done}return{bindCgroup:z,async startExecutor(t){if(m(),a.set(t.bindId,me()),O=!0,!t.claim)throw new h("vm_hands_bind_invalid","an executor needs the claim it serves");await F(t.bindId);let{claim:o,bindId:d}=t,f=Oe(d),g=o.owner;if(!g||typeof g.device_id!=="string"||typeof o.root_id!=="string")throw new h("vm_hands_bind_invalid","claim without its owner Device or root");let w=new AbortController,_,u,x=new Promise((s,k)=>{_=s,u=k}),L,C=new Promise((s)=>{L=s}),W=vt({headless:!0,hostExecution:!0,runtimeDirectory:n.runtimeDirectory,deviceIdentity:{deviceId:g.device_id,rootId:o.root_id,apiOrigin:n.apiOrigin},claimOwner:o.owner,root:n.root,runId:o.run_id,operationId:o.operation_id,attemptId:o.attempt_id,payload:Object.fromEntries(Object.entries(o.payload).filter(([s])=>!s.startsWith("vm_hands_"))),signal:w.signal,...t.workspaceGrant?{workspaceGrant:t.workspaceGrant}:{},emitEvent:async(s,k)=>{if(s==="hands.ready"){_(k);return}if(s==="hands.started"||s==="hands.stopped"||s==="hands.failed")return;await n.forward(d,s,k)}},{...n.relayDependencies,spawnWorker:(s)=>X(f)(s.command,s.args,s.options),...D?{takePrespawnedWorker:(s)=>{let k=D.take(s);if(!k?.pid)return k;try{return K(p(f,"cgroup.procs"),String(k.pid)),k}catch{try{k.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:D.adopt}:{}}).then(()=>{L("executor_stopped")},(s)=>{let k=s&&typeof s==="object"&&"code"in s?String(s.code):"executor_failed";u(new h(k,s instanceof Error?s.message:String(s))),L(k)}).finally(()=>u(new h("vm_hands_executor_exited","executor ended before it was ready")));c.set(d,{abort:w,done:W,exited:C,operationId:o.operation_id,runId:o.run_id,expiresAtMs:Date.parse(String(o.payload.expires_at??""))||0});let A=await x,G=A.executor_launch_id;if(typeof G!=="string")throw new h("vm_hands_bind_failed","executor ready without a launch id");return{launchId:G,readyData:A,applied:{hands_confinement:typeof o.payload.hands_confinement==="string"?o.payload.hands_confinement:null,browser_egress:o.payload.browser_egress??null}}},takeSrtFallbacks:I,executorExited(t){return c.get(t)?.exited??new Promise(()=>{})},freezeBind(t){let o=z(t);if(U(p(o,"cgroup.freeze")))K(p(o,"cgroup.freeze"),"1")},async killAndVerifyPayload(t){let o=new Set(t?.keep??[]);if(o.size||t?.own)return xe(t?.bindId??null,o,t?.own===!0);S=!0;let d=he();try{await ye();let f=Promise.all([...c.keys()].map((u)=>F(u).catch(()=>{return})));v();let g=Date.now()+te;await J(r,g,"payload"),await f;let w=(O||n.srtWarmLate?.()===!0)&&U(p(R,"cgroup.events"));if(w)await J(R,g,"srt");let _=se(i).filter((u)=>!N(u,B));if(y!==null){let u=re(y).filter((x)=>x!==process.pid&&!N(x,B));if(u.length)throw e("vm_hands.kill_strays",{strays:E(u)}),new h("vm_hands_kill_unverified",`${u.length} process(es) the run started survived it`);y=null}if(O=!1,w)n.onSrtReset?.();if(_.length)throw e("vm_hands.kill_survivors",{pids:_.slice(0,16)}),new h("vm_hands_kill_unverified",`${_.length} payload-uid process(es) outside the payload cgroup`);a.clear();for(let u of ie())try{ne(p(r,M,u))}catch{}}finally{S=!1,d()}if(D)setTimeout(()=>{if(!c.size)D.arm()},100).unref?.()},async killProbe(){let t=Date.now()+te;if(U(p(H,"cgroup.events"))){await J(H,t,"probe");try{ne(H)}catch{}}let o=oe(process.pid);if(o===null)throw new h("vm_hands_kill_unverified","agent start time unreadable");await Ue(r,o,t);let d=(g)=>{let w=oe(g);return w!==null&&w<=o},f=se(i).filter((g)=>d(g)&&!N(g,B));if(f.length)throw e("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest"}),new h("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(y!==null){let g=[r,p(r,M)].map((u)=>u.replace(/^\/sys\/fs\/cgroup/,"")),w=R.replace(/^\/sys\/fs\/cgroup/,""),_=re(y).filter((u)=>u!==process.pid&&!N(u,B)&&!N(u,"/reason-vm-hands")&&!N(u,w)&&!g.some((x)=>fe(u,x)));if(_.length&&O)throw e("vm_hands.kill_strays",{strays:E(_),at:"attest"}),new h("vm_hands_kill_unverified",`${_.length} process(es) the run started survived it`);if(_.length)e("vm_hands.attest_concurrent",{processes:E(_),count:_.length});y=null}},async runProbe({nonce:t,script:o}){if(m(),!o.includes(pe))throw new h("vm_hands_probe_failed","probe names no proof directory");let d=n.proofParent??"/tmp/reason-vm-hands-proof";ee(d,{mode:457,recursive:!0});let f=V(d);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new h("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Ae(p(d,"p-")),w=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(t))throw new h("vm_hands_probe_failed","proof directory path or nonce");Le(g,i,i),Me(g,448);let _=V(g).ino;try{ee(H,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new h("vm_hands_probe_failed","probe cgroup")}let u=X(H)("/bin/bash",["-c",o.replaceAll(pe,g).replaceAll(Ke,t)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),x="";u.stdout?.on("data",(C)=>{if(x.length<16384)x+=C.toString("utf8").slice(0,16384-x.length)});let L=await new Promise((C)=>{let W=setTimeout(()=>{w=!0,u.kill("SIGKILL"),C(124)},Be);u.once("error",()=>{clearTimeout(W),C(127)}),u.once("close",(A)=>{clearTimeout(W),C(A??1)})});return e("vm_hands.probe",{nonce_len:t.length,exit_code:L}),{exitCode:L,markers:x,proofDirInode:_}}finally{if(!w)ze(g,{recursive:!0,force:!0})}},restatLayout(){let{session_root:t,alias:o}=n.init.layout,d="invalid";try{ur(t),d="0:0:755"}catch{}let f=!1,g=-1;try{let w=V(o);g=w.uid,f=d==="0:0:755"&&o===p(t,"repo")&&!w.isSymbolicLink()&&w.isDirectory()&&Te(o)===o&&w.uid===i}catch{}return{root_mode:d,alias_ok:f,owner_uid:g}},verifyMounts(){ue(n.init.layout.session_root,e,(t)=>new h("vm_hands_mount_mismatch",t))},installEnvironment(t,o){let d=c.get(t);if(!d)throw new h("environment_unavailable","no executor owns an environment");return Je({root:n.root,operationId:d.operationId,payload:o}).installed_revision},async stop(){if(Q)clearInterval(Q);D?.close(),await Promise.all([...c.keys()].map((t)=>F(t)))}};function ie(){try{return Z(p(r,M),{withFileTypes:!0}).filter((t)=>t.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(t.name)).map((t)=>t.name)}catch{return[]}}async function xe(t,o,d=!1){let f=new Set([...o].map((w)=>w.toLowerCase())),g=he();try{await ye();let w=Date.now()+te,_=new Set(ie().filter((s)=>!f.has(s.slice(2))).map((s)=>s.slice(2)));if(t)_.add(t.toLowerCase());let u=null;for(let s of _){let k=F(s).catch(()=>{return}),q=a.get(s);if(q!==void 0)u=u===null?q:Math.min(u,q);if(U(p(z(s),"cgroup.events")))await J(z(s),w,"bind");await k}let x=[...f].map((s)=>z(s).replace(/^\/sys\/fs\/cgroup/,"")),L=[r,p(r,M)].map((s)=>s.replace(/^\/sys\/fs\/cgroup/,"")),C=R.replace(/^\/sys\/fs\/cgroup/,""),W=(s)=>N(s,B)||x.some((k)=>N(s,k)),A=d?[]:se(i).filter((s)=>!W(s));if(A.length)throw e("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size}),new h("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let G=(s)=>!W(s)&&!N(s,"/reason-vm-hands")&&!N(s,C)&&!L.some((k)=>fe(s,k));if(u!==null){let s=re(u).filter((k)=>k!==process.pid&&G(k));if(s.length)throw e("vm_hands.kill_strays",{strays:E(s),beside:f.size}),new h("vm_hands_kill_unverified",`${s.length} process(es) the run started survived it`)}for(let s of _)a.delete(s),Re(s)}finally{g()}}}function oe(n,r="/proc"){try{let i=P(p(r,String(n),"stat"),"utf8"),e=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(e)?e:null}catch{return null}}function be(n,r="/proc"){try{let i=P(p(r,String(n),"stat"),"utf8"),e=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(e)?e:null}catch{return null}}async function Ue(n,r,i){try{K(p(n,"cgroup.freeze"),"1")}catch(e){throw new h("vm_hands_kill_unverified",`payload cgroup.freeze: ${e instanceof Error?e.message:String(e)}`)}try{for(;;){let e=Se(n).filter((a)=>ke(a,n)),c=new Set(e.filter((a)=>{let l=oe(a);return l!==null&&l<=r}));for(let a=!0;a;){a=!1;for(let l of e){if(c.has(l))continue;let v=be(l);if(v!==null&&c.has(v))c.add(l),a=!0}}if(c.size===0)return;if(Date.now()>i)throw new h("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let a of c)try{process.kill(a,"SIGKILL")}catch{}await new Promise((a)=>setTimeout(a,10))}}finally{try{K(p(n,"cgroup.freeze"),"0")}catch{}}}function fe(n,r,i="/proc"){try{return P(p(i,String(n),"cgroup"),"utf8").split(`
 `).find((c)=>c.startsWith("0::"))?.slice(3)===r}catch{return!1}}function N(n,r,i="/proc"){try{let c=P(p(i,String(n),"cgroup"),"utf8").split(`
-`).find((a)=>a.startsWith("0::"))?.slice(3)??"";return c===r||c.startsWith(`${r}/`)}catch{return!1}}var Ge=100;function me(){try{return Math.floor(Number(P("/proc/uptime","utf8").split(" ")[0])*Ge)}catch{return 0}}async function J(n,r,i){try{K(p(n,"cgroup.freeze"),"1")}catch(e){throw new h("vm_hands_kill_unverified",`${i} cgroup.freeze: ${e instanceof Error?e.message:String(e)}`)}while(!/^populated 0$/m.test(P(p(n,"cgroup.events"),"utf8"))){if(Date.now()>r)throw new h("vm_hands_kill_unverified",`${i} cgroup still populated (left frozen)`);for(let e of Se(n)){if(!ke(e,n))continue;try{process.kill(e,"SIGKILL")}catch{}}await new Promise((e)=>setTimeout(e,10))}try{K(p(n,"cgroup.freeze"),"0")}catch(e){throw new h("vm_hands_kill_unverified",`${i} cgroup thaw: ${e instanceof Error?e.message:String(e)}`)}}function ke(n,r){let i=r.replace(/^\/sys\/fs\/cgroup/,"")||"/",e="";try{e=P(`/proc/${n}/cgroup`,"utf8").split(`
+`).find((a)=>a.startsWith("0::"))?.slice(3)??"";return c===r||c.startsWith(`${r}/`)}catch{return!1}}var Fe=100;function me(){try{return Math.floor(Number(P("/proc/uptime","utf8").split(" ")[0])*Fe)}catch{return 0}}async function J(n,r,i){try{K(p(n,"cgroup.freeze"),"1")}catch(e){throw new h("vm_hands_kill_unverified",`${i} cgroup.freeze: ${e instanceof Error?e.message:String(e)}`)}while(!/^populated 0$/m.test(P(p(n,"cgroup.events"),"utf8"))){if(Date.now()>r)throw new h("vm_hands_kill_unverified",`${i} cgroup still populated (left frozen)`);for(let e of Se(n)){if(!ke(e,n))continue;try{process.kill(e,"SIGKILL")}catch{}}await new Promise((e)=>setTimeout(e,10))}try{K(p(n,"cgroup.freeze"),"0")}catch(e){throw new h("vm_hands_kill_unverified",`${i} cgroup thaw: ${e instanceof Error?e.message:String(e)}`)}}function ke(n,r){let i=r.replace(/^\/sys\/fs\/cgroup/,"")||"/",e="";try{e=P(`/proc/${n}/cgroup`,"utf8").split(`
 `).find((a)=>a.startsWith("0::"))??""}catch{return!1}let c=e.slice(3);return c===i||c.startsWith(`${i}/`)}function Se(n){let r=[],i=(e)=>{try{for(let a of P(p(e,"cgroup.procs"),"utf8").split(`
 `))if(/^\d+$/.test(a))r.push(Number(a))}catch{}let c=[];try{c=Z(e,{withFileTypes:!0}).filter((a)=>a.isDirectory()).map((a)=>a.name)}catch{}for(let a of c)i(p(e,a))};return i(n),r}function E(n,r="/proc"){return n.slice(0,16).map((i)=>{let e="?",c="?";try{e=P(p(r,String(i),"comm"),"utf8").trim().slice(0,32)}catch{}try{c=(P(p(r,String(i),"cgroup"),"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:i,comm:e,ppid:be(i,r),cgroup:c}})}function re(n,r="/proc"){let i=[];for(let e of Z(r)){if(!/^\d+$/.test(e))continue;let c;try{c=P(p(r,e,"stat"),"utf8")}catch{continue}let a=c.slice(c.lastIndexOf(")")+2).split(" "),l=Number(a[1]),v=Number(a[6]),y=Number(a[19]);if(!((v&2097152)!==0||l===2||e==="2")&&a[0]!=="Z"&&y>=n)i.push(Number(e))}return i}function se(n,r="/proc"){let i=[];for(let e of Z(r)){if(!/^\d+$/.test(e))continue;let c;try{c=P(p(r,e,"status"),"utf8")}catch{continue}let a=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(c);if(a&&a.slice(1).some((l)=>Number(l)===n))i.push(Number(e))}return i}function ge(n="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(P(n,"utf8").trim())>=1}catch{return!1}}var T=0,Pe=[],Y=new Set;function he(){T++;let n=!1;return()=>{if(n)return;if(n=!0,--T===0)for(let r of Pe.splice(0))r()}}function Je(){return T===0?Promise.resolve():new Promise((n)=>{Pe.push(n)})}async function _e(){while(T>0)await Je()}async function ye(){let n=Date.now()+1000;while(Y.size&&Date.now()<n)await new Promise((r)=>setTimeout(r,2))}function Ee(n,r){let i=r.replace(/^\/sys\/fs\/cgroup/,"");Y.add(n);let e=()=>{let c="";try{c=P(`/proc/${n}/cgroup`,"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??""}catch{Y.delete(n);return}if(c.slice(3)===i){Y.delete(n);return}setTimeout(e,1)};e()}function an(n){let r={person:n.personCgroup??p("/sys/fs/cgroup",B,M),model:n.payloadCgroup??p(we,M)},i=n.entry??process.argv[1]??"",e={},c=(l)=>l.startsWith("model:")&&n.bindCgroup?n.bindCgroup(l.slice(6)):r[l.startsWith("model")?"model":"person"],a=(l)=>{let v=l.startsWith("model")?"model":"person",y=new Map,O=String(n.payloadUid),R=String(n.payloadGid),m=Bun.spawn(["/bin/sh","-c",`echo $$ > ${ve(p(c(l),"cgroup.procs"))} || exit 125; exec /usr/bin/setpriv --no-new-privs --reuid=${O} --regid=${R} --clear-groups -- "$@"`,"vm-hands-op-join",process.execPath,"--no-install",i,"--vm-hands-op-runner",...v==="person"?[Zt]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:"/home/runner",...U("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(I){let S=I,j=y.get(S.id);if(!j)return;if(S.t==="event"&&S.event)j.onEvent(S.event);if(S.t==="done")y.delete(S.id),j.done(S.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});m.exited.then((I)=>{if(e[l]?.child===m)delete e[l];for(let[,S]of y)S.done({status:"failed",error_code:"vm_hands_op_runner_exited"});y.clear(),n.log?.("vm_hands.op_runner_exited",{kind:v,code:I})}),Ee(m.pid,c(l));let b={child:m,pending:y};return e[l]=b,b};return{run(l,v,y,O,R){if(!ge())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=l==="model"&&R&&n.bindCgroup?`model:${R.toLowerCase()}`:l,b=async()=>{while(!e[m]&&T>0)await _e()};return b().then(async()=>{if(!e[m]&&T>0)await b()}).then(()=>new Promise((I)=>{if(!e[m]&&T>0){I({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let S=e[m]??a(m);S.pending.set(v.id,{onEvent:y,done:I}),O.addEventListener("abort",()=>{try{S.child.send({t:"cancel",id:v.id})}catch{}},{once:!0});try{S.child.send({t:"op",...v})}catch{S.pending.delete(v.id),I({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(l){if(!e[l]&&ge())_e().then(()=>{if(!e[l]&&T===0)a(l)})},stop(){for(let l of Object.keys(e))e[l]?.child.kill()}}}export{we as VM_HANDS_PAYLOAD_CGROUP,M as VM_HANDS_PAYLOAD_JOIN,B as VM_HANDS_PERSON_CGROUP,je as VM_HANDS_PROBE_NONCE_TOKEN,pe as VM_HANDS_PROOF_DIR_TOKEN,h as VmHandsExecutorError,on as createVmHandsExecutor,an as createVmHandsOpRunners,E as describeProcesses,N as inCgroup,se as payloadUidProcesses,re as processesStartedSince,ge as ptraceProtected,Se as subtreePids,He as vmHandsBindCgroup};
+`).find((a)=>a.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:i,comm:e,ppid:be(i,r),cgroup:c}})}function re(n,r="/proc"){let i=[];for(let e of Z(r)){if(!/^\d+$/.test(e))continue;let c;try{c=P(p(r,e,"stat"),"utf8")}catch{continue}let a=c.slice(c.lastIndexOf(")")+2).split(" "),l=Number(a[1]),v=Number(a[6]),y=Number(a[19]);if(!((v&2097152)!==0||l===2||e==="2")&&a[0]!=="Z"&&y>=n)i.push(Number(e))}return i}function se(n,r="/proc"){let i=[];for(let e of Z(r)){if(!/^\d+$/.test(e))continue;let c;try{c=P(p(r,e,"status"),"utf8")}catch{continue}let a=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(c);if(a&&a.slice(1).some((l)=>Number(l)===n))i.push(Number(e))}return i}function ge(n="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(P(n,"utf8").trim())>=1}catch{return!1}}var T=0,Pe=[],Y=new Set;function he(){T++;let n=!1;return()=>{if(n)return;if(n=!0,--T===0)for(let r of Pe.splice(0))r()}}function Ge(){return T===0?Promise.resolve():new Promise((n)=>{Pe.push(n)})}async function _e(){while(T>0)await Ge()}async function ye(){let n=Date.now()+1000;while(Y.size&&Date.now()<n)await new Promise((r)=>setTimeout(r,2))}function Ee(n,r){let i=r.replace(/^\/sys\/fs\/cgroup/,"");Y.add(n);let e=()=>{let c="";try{c=P(`/proc/${n}/cgroup`,"utf8").split(`
+`).find((a)=>a.startsWith("0::"))??""}catch{Y.delete(n);return}if(c.slice(3)===i){Y.delete(n);return}setTimeout(e,1)};e()}function an(n){let r={person:n.personCgroup??p("/sys/fs/cgroup",B,M),model:n.payloadCgroup??p(we,M)},i=n.entry??process.argv[1]??"",e={},c=(l)=>l.startsWith("model:")&&n.bindCgroup?n.bindCgroup(l.slice(6)):r[l.startsWith("model")?"model":"person"],a=(l)=>{let v=l.startsWith("model")?"model":"person",y=new Map,O=String(n.payloadUid),R=String(n.payloadGid),m=Bun.spawn(["/bin/sh","-c",`echo $$ > ${ve(p(c(l),"cgroup.procs"))} || exit 125; exec /usr/bin/setpriv --no-new-privs --reuid=${O} --regid=${R} --clear-groups -- "$@"`,"vm-hands-op-join",process.execPath,"--no-install",i,"--vm-hands-op-runner",...v==="person"?[Yt]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:"/home/runner",...U("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(I){let S=I,j=y.get(S.id);if(!j)return;if(S.t==="event"&&S.event)j.onEvent(S.event);if(S.t==="done")y.delete(S.id),j.done(S.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});m.exited.then((I)=>{if(e[l]?.child===m)delete e[l];for(let[,S]of y)S.done({status:"failed",error_code:"vm_hands_op_runner_exited"});y.clear(),n.log?.("vm_hands.op_runner_exited",{kind:v,code:I})}),Ee(m.pid,c(l));let b={child:m,pending:y};return e[l]=b,b};return{run(l,v,y,O,R){if(!ge())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=l==="model"&&R&&n.bindCgroup?`model:${R.toLowerCase()}`:l,b=async()=>{while(!e[m]&&T>0)await _e()};return b().then(async()=>{if(!e[m]&&T>0)await b()}).then(()=>new Promise((I)=>{if(!e[m]&&T>0){I({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let S=e[m]??a(m);S.pending.set(v.id,{onEvent:y,done:I}),O.addEventListener("abort",()=>{try{S.child.send({t:"cancel",id:v.id})}catch{}},{once:!0});try{S.child.send({t:"op",...v})}catch{S.pending.delete(v.id),I({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(l){if(!e[l]&&ge())_e().then(()=>{if(!e[l]&&T===0)a(l)})},stop(){for(let l of Object.keys(e))e[l]?.child.kill()}}}export{we as VM_HANDS_PAYLOAD_CGROUP,M as VM_HANDS_PAYLOAD_JOIN,B as VM_HANDS_PERSON_CGROUP,Ke as VM_HANDS_PROBE_NONCE_TOKEN,pe as VM_HANDS_PROOF_DIR_TOKEN,h as VmHandsExecutorError,on as createVmHandsExecutor,an as createVmHandsOpRunners,E as describeProcesses,N as inCgroup,se as payloadUidProcesses,re as processesStartedSince,ge as ptraceProtected,Se as subtreePids,je as vmHandsBindCgroup};

package/bin/vm-hands/vm-hands-op-runner-f2bjvb7v.js

@@ -0,0 +1,2 @@
+// @bun
+import{Yt,zo}from"./vm-hands-entry-lite-grm1tqs7.js";export{Yt as VM_HANDS_OP_RUNNER_PERSON_ARG,zo as runVmHandsOpRunner};

package/bin/vm-hands/{vm-hands-runtime-yacvv937.js → vm-hands-runtime-aa4p4pqz.js}

@@ -1,4 +1,4 @@
 // @bun
-import{Ve}from"./vm-hands-entry-lite-ym1djztp.js";import{_i,Jr,yi}from"./vm-hands-entry-lite.js";import{spawn as G}from"child_process";import{createHash as z}from"crypto";import{lstatSync as E,mkdirSync as K,readFileSync as W,statSync as X,writeFileSync as F}from"fs";var v="/run/reason-vm-hands",D="/run/reason-vm-hands/env",A="/home/runner/.reason/workspace",J=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,V="/sys/fs/cgroup/reason-srt",q=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],Q=65536,Z=21600000;function ee(r,e="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;K(e,{recursive:!0,mode:448});let n=E(e);if(!n.isDirectory()||n.uid!==0||(n.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}F(`${e}/base-keyed`,`1
-`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function C(r,e){let n=(c)=>(e("srt_warm_skipped",{reason:c}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return n("no_settings");let o=Buffer.from(r.srt_base_settings,"base64");if(o.length===0||o.length>Q||o.toString("base64")!==r.srt_base_settings)return n("settings_invalid");let a;try{let c=E(V);if(!c.isDirectory()||c.uid!==0||(c.mode&18)!==0)return n("cgroup_unsafe");let p=q.find((f)=>E(f,{throwIfNoEntry:!1})!==void 0);if(!p)return n("cgroup_or_exec_missing");a=p;for(let[f,w]of[[a,!1],["/usr/local/bin",!0]]){let u=E(f);if((w?!u.isDirectory():!u.isFile())||u.uid!==0||(u.mode&18)!==0)return n("srt_exec_unsafe")}}catch{return n("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return n("not_root");let i=performance.now(),R=z("sha256").update(o).digest("hex"),S=`${v}/srt-base-settings.json`;try{F(S,o,{mode:384,flag:"w"})}catch{return n("settings_write")}let g=G("/bin/sh",["-c",`echo $$ > ${V}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",S,"--idle-ms",String(Z),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((c)=>{g.once("error",()=>{e("srt_warm_failed",{reason:"spawn"}),c()}),g.once("close",(p)=>{e(p===0?"srt_warm_done":"srt_warm_failed",{exit_code:p,warm_ms:Math.round(performance.now()-i),settings_sha256:R}),c()})})}var M=3000;function pe(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let e=r,{layout:n,device_key:o,credential:a}=e;return typeof e.workspace_id==="string"&&Number.isSafeInteger(e.instance_generation)&&typeof e.api_origin==="string"&&J.test(e.api_origin)&&typeof e.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!n&&typeof n.session_root==="string"&&typeof n.alias==="string"&&Number.isSafeInteger(n.payload_uid)&&typeof n.kind==="string"&&!!o&&typeof o.pkcs8==="string"&&typeof o.spki==="string"?e:null}function L(r){K(r,{recursive:!0,mode:448});let e=X(r);if(!e.isDirectory()||(e.mode&63)!==0||e.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ne(r){let[{CLI_VERSION:e},n,o,a]=await Promise.all([import("./version-vdev7tyq.js"),import("./hands-worker-source-yxsap3qk.js"),import("./network-contract-qt2s82ap.js"),import("./device-workspace-n9tn4bzw.js")]),{REASON_HANDS_PROTOCOL_VERSION:i}=await import("./reason-hands-protocol-r356wr4t.js");return{reason_runtime_version:e,bridge_version:e,protocol_version:Ve,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:n.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:n.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:o.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:o.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:o.HANDS_SESSION_GROUP,worker_version:n.REASON_HANDS_WORKER_VERSION,protocol_version:i,worker_artifact_sha256:n.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:n.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:o.HANDS_ENVIRONMENT_DELIVERY,[o.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:o.HANDS_ENVIRONMENT_AT_CLAIM,[o.HANDS_CLOUD_ACCESS_KEY]:o.HANDS_CLOUD_ACCESS,[o.HANDS_LARGE_ENVIRONMENT_KEY]:o.HANDS_LARGE_ENVIRONMENT,[o.HANDS_CONFINEMENT_KEY]:o.HANDS_CONFINEMENT,[o.HANDS_JOBS_USER_KEY]:o.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var k=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],te=new Set(["pty.start","jobs.control"]);function re(r,e){let n=e([{id:"vm-hands",label:"workspace",path:A,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(k.map((i)=>[i,!0]))}}),o=r.capabilities,a={...o.operation_constraints};for(let i of k)a[i]={...n.operation_constraints?.[i]??{},ready:!0,execution_mode:n.operation_constraints?.[i]?.execution_mode??"host"};return{...r,capabilities:{...o,supported_operations:["hands.connect",...k],operation_constraints:a}}}function oe(r){for(let e of W("/etc/passwd","utf8").split(`
-`)){let n=e.split(":");if(n.length>=4&&Number(n[2])===r&&/^\d+$/.test(n[3]??"")&&Number(n[3])>0)return Number(n[3])}throw Error("vm_hands_payload_account_unavailable")}function se(r,e){let n=e.owner;if(!n||typeof n.organization_id!=="string"||typeof n.device_id!=="string"||typeof e.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:n.organization_id,deviceId:n.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:e.root_id,label:"workspace",path:A,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function ae(r=process.platform,e="/proc/self/oom_score_adj"){if(r!=="linux")return null;let n;try{n=W(e,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(n))return{value:"unreadable"};let o=Number(n);return o<0?{value:o}:null}async function fe(r,e){let n=ae();if(n)e("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:n.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});L(v),L(D),ee(e);let o=C(r,e),a=!1,i=async()=>{if(!await Promise.race([o.then(()=>!0),new Promise((s)=>setTimeout(()=>s(!1),M).unref?.())]))a=!0,e("srt_warm_late",{wait_ms:M})},[{configureDesktopAccount:R},{configureWorkerSandbox:S}]=await Promise.all([import("./desktop-account-rx4ajy2j.js"),import("./worker-sandbox-x8dsz324.js")]);S();try{R({value:String(r.layout.payload_uid)})}catch{e("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let g=new AbortController;for(let t of["SIGTERM","SIGINT"])process.on(t,()=>g.abort());let c=new Map,p,f=new Promise((t)=>{p=t}),w=f.then(()=>import("./vm-hands-executor-79av9nam.js")).then(({createVmHandsExecutor:t})=>{let s=t({init:r,root:A,runtimeDirectory:v,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,o=C(r,e)},srtWarmLate:()=>a,forward:(_,d,y)=>c.get(_)?.(d,y)??Promise.reject(Error("vm_hands_not_bound")),log:(_,d)=>e(_,d)});return e("executor_loaded"),s}),u=(t)=>async(...s)=>(await w)[t](...s),h=null;w.then((t)=>{h=(s)=>t.executorExited(s)});let m={startExecutor:async(...t)=>(await i(),u("startExecutor")(...t)),killAndVerifyPayload:u("killAndVerifyPayload"),killProbe:u("killProbe"),runProbe:async(...t)=>(await i(),u("runProbe")(...t)),restatLayout:()=>{throw Error("replaced below")},verifyMounts:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(t)=>h?h(t):new Promise(()=>{}),takeSrtFallbacks:()=>null};w.then((t)=>{m.restatLayout=()=>t.restatLayout(),m.verifyMounts=()=>t.verifyMounts(),m.installEnvironment=(s,_)=>t.installEnvironment(s,_),m.freezeBind=(s)=>t.freezeBind(s),m.takeSrtFallbacks=()=>t.takeSrtFallbacks?.()??null});let B=await _i(r),Y=new Jr(r,B,m,{envRoot:D}),x=ne(r),I=null,U=Promise.all([x,import("./local-capabilities-hchsc804.js")]).then(([t,s])=>{I=re(t,s.capabilityInventoryForRoots),e("device_ops_loaded")}).catch((t)=>e("device_ops_unavailable",{error:t instanceof Error?t.name:"error"})),N=f.then(()=>import("./vm-hands-executor-79av9nam.js")).then(({createVmHandsOpRunners:t,vmHandsBindCgroup:s,VM_HANDS_PAYLOAD_CGROUP:_})=>t({payloadUid:r.layout.payload_uid,payloadGid:oe(r.layout.payload_uid),bindCgroup:(d)=>s(_,d),log:(d,y)=>e(d,y)})).catch(()=>null);N.then((t)=>t?.warm("person")),e("agent_ready"),await yi({apiOrigin:r.api_origin,agent:Y,signal:g.signal,heartbeat:async()=>I??await x,executeOp:async({kind:t,claim:s,bindId:_,signal:d,emit:y})=>{let O=se(r,s);if(!O)return{status:"failed",error_code:"vm_hands_bind_invalid"};let H={executionMode:"unsandboxed",runtimeDirectory:v,readiness:Object.fromEntries(k.map((l)=>[l,!0]))},P=(l)=>{let b=typeof l.kind==="string"?l.kind:"";if(b)y({kind:b,...l.data&&typeof l.data==="object"?{data:l.data}:{}})};if(s.capability==="exec.full"&&t!=="person")return{status:"failed",error_code:"capability_not_granted"};if(s.capability==="automation.call.v1"&&t!=="model")return{status:"failed",error_code:"capability_not_granted"};let j=s.capability==="pty.start"&&t==="person"&&!s.authority;if(te.has(String(s.capability))&&!j){let{executeLocalOperation:l}=await import("./local-capabilities-hchsc804.js");return l(O,s,{worker:H,signal:d,emit:(b)=>P(b)})}let T=await N;if(!T)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return T.run(t,{id:String(s.attempt_id),claim:s,state:O,worker:H},P,d,_)},readyData:({launchId:t})=>({executor_launch_id:t}),log:(t,s)=>{if(t==="vm_hands.registered"||t==="vm_hands.reconnected")p();e(t,s)},onTurn:(t,s)=>{if(s)c.set(t,s);else c.delete(t)}}),await(await w).stop(),(await N)?.stop()}export{pe as parseVmHandsInit,fe as runVmHands};
+import{Ge}from"./vm-hands-entry-lite-k278g9kj.js";import{wi,Xr,bi}from"./vm-hands-entry-lite.js";import{spawn as G}from"child_process";import{createHash as z}from"crypto";import{lstatSync as E,mkdirSync as K,readFileSync as W,statSync as X,writeFileSync as F}from"fs";var v="/run/reason-vm-hands",D="/run/reason-vm-hands/env",A="/home/runner/.reason/workspace",J=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,V="/sys/fs/cgroup/reason-srt",q=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],Q=65536,Z=21600000;function ee(r,e="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;K(e,{recursive:!0,mode:448});let n=E(e);if(!n.isDirectory()||n.uid!==0||(n.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}F(`${e}/base-keyed`,`1
+`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function C(r,e){let n=(c)=>(e("srt_warm_skipped",{reason:c}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return n("no_settings");let o=Buffer.from(r.srt_base_settings,"base64");if(o.length===0||o.length>Q||o.toString("base64")!==r.srt_base_settings)return n("settings_invalid");let a;try{let c=E(V);if(!c.isDirectory()||c.uid!==0||(c.mode&18)!==0)return n("cgroup_unsafe");let p=q.find((f)=>E(f,{throwIfNoEntry:!1})!==void 0);if(!p)return n("cgroup_or_exec_missing");a=p;for(let[f,w]of[[a,!1],["/usr/local/bin",!0]]){let u=E(f);if((w?!u.isDirectory():!u.isFile())||u.uid!==0||(u.mode&18)!==0)return n("srt_exec_unsafe")}}catch{return n("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return n("not_root");let i=performance.now(),R=z("sha256").update(o).digest("hex"),S=`${v}/srt-base-settings.json`;try{F(S,o,{mode:384,flag:"w"})}catch{return n("settings_write")}let g=G("/bin/sh",["-c",`echo $$ > ${V}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",S,"--idle-ms",String(Z),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((c)=>{g.once("error",()=>{e("srt_warm_failed",{reason:"spawn"}),c()}),g.once("close",(p)=>{e(p===0?"srt_warm_done":"srt_warm_failed",{exit_code:p,warm_ms:Math.round(performance.now()-i),settings_sha256:R}),c()})})}var M=3000;function pe(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let e=r,{layout:n,device_key:o,credential:a}=e;return typeof e.workspace_id==="string"&&Number.isSafeInteger(e.instance_generation)&&typeof e.api_origin==="string"&&J.test(e.api_origin)&&typeof e.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!n&&typeof n.session_root==="string"&&typeof n.alias==="string"&&Number.isSafeInteger(n.payload_uid)&&typeof n.kind==="string"&&!!o&&typeof o.pkcs8==="string"&&typeof o.spki==="string"?e:null}function L(r){K(r,{recursive:!0,mode:448});let e=X(r);if(!e.isDirectory()||(e.mode&63)!==0||e.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ne(r){let[{CLI_VERSION:e},n,o,a]=await Promise.all([import("./version-5hrs2hvb.js"),import("./hands-worker-source-cgrpm21b.js"),import("./network-contract-9x9kc5vv.js"),import("./device-workspace-p9q9dckg.js")]),{REASON_HANDS_PROTOCOL_VERSION:i}=await import("./reason-hands-protocol-2tnghj3b.js");return{reason_runtime_version:e,bridge_version:e,protocol_version:Ge,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:n.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:n.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:o.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:o.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:o.HANDS_SESSION_GROUP,worker_version:n.REASON_HANDS_WORKER_VERSION,protocol_version:i,worker_artifact_sha256:n.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:n.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:o.HANDS_ENVIRONMENT_DELIVERY,[o.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:o.HANDS_ENVIRONMENT_AT_CLAIM,[o.HANDS_CLOUD_ACCESS_KEY]:o.HANDS_CLOUD_ACCESS,[o.HANDS_LARGE_ENVIRONMENT_KEY]:o.HANDS_LARGE_ENVIRONMENT,[o.HANDS_CONFINEMENT_KEY]:o.HANDS_CONFINEMENT,[o.HANDS_JOBS_USER_KEY]:o.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var k=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],te=new Set(["pty.start","jobs.control"]);function re(r,e){let n=e([{id:"vm-hands",label:"workspace",path:A,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(k.map((i)=>[i,!0]))}}),o=r.capabilities,a={...o.operation_constraints};for(let i of k)a[i]={...n.operation_constraints?.[i]??{},ready:!0,execution_mode:n.operation_constraints?.[i]?.execution_mode??"host"};return{...r,capabilities:{...o,supported_operations:["hands.connect",...k],operation_constraints:a}}}function oe(r){for(let e of W("/etc/passwd","utf8").split(`
+`)){let n=e.split(":");if(n.length>=4&&Number(n[2])===r&&/^\d+$/.test(n[3]??"")&&Number(n[3])>0)return Number(n[3])}throw Error("vm_hands_payload_account_unavailable")}function se(r,e){let n=e.owner;if(!n||typeof n.organization_id!=="string"||typeof n.device_id!=="string"||typeof e.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:n.organization_id,deviceId:n.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:e.root_id,label:"workspace",path:A,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function ae(r=process.platform,e="/proc/self/oom_score_adj"){if(r!=="linux")return null;let n;try{n=W(e,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(n))return{value:"unreadable"};let o=Number(n);return o<0?{value:o}:null}async function fe(r,e){let n=ae();if(n)e("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:n.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});L(v),L(D),ee(e);let o=C(r,e),a=!1,i=async()=>{if(!await Promise.race([o.then(()=>!0),new Promise((s)=>setTimeout(()=>s(!1),M).unref?.())]))a=!0,e("srt_warm_late",{wait_ms:M})},[{configureDesktopAccount:R},{configureWorkerSandbox:S}]=await Promise.all([import("./desktop-account-5v7x0ajx.js"),import("./worker-sandbox-smqj3mbe.js")]);S();try{R({value:String(r.layout.payload_uid)})}catch{e("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let g=new AbortController;for(let t of["SIGTERM","SIGINT"])process.on(t,()=>g.abort());let c=new Map,p,f=new Promise((t)=>{p=t}),w=f.then(()=>import("./vm-hands-executor-rdmj1wv4.js")).then(({createVmHandsExecutor:t})=>{let s=t({init:r,root:A,runtimeDirectory:v,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,o=C(r,e)},srtWarmLate:()=>a,forward:(_,d,y)=>c.get(_)?.(d,y)??Promise.reject(Error("vm_hands_not_bound")),log:(_,d)=>e(_,d)});return e("executor_loaded"),s}),u=(t)=>async(...s)=>(await w)[t](...s),h=null;w.then((t)=>{h=(s)=>t.executorExited(s)});let m={startExecutor:async(...t)=>(await i(),u("startExecutor")(...t)),killAndVerifyPayload:u("killAndVerifyPayload"),killProbe:u("killProbe"),runProbe:async(...t)=>(await i(),u("runProbe")(...t)),restatLayout:()=>{throw Error("replaced below")},verifyMounts:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(t)=>h?h(t):new Promise(()=>{}),takeSrtFallbacks:()=>null};w.then((t)=>{m.restatLayout=()=>t.restatLayout(),m.verifyMounts=()=>t.verifyMounts(),m.installEnvironment=(s,_)=>t.installEnvironment(s,_),m.freezeBind=(s)=>t.freezeBind(s),m.takeSrtFallbacks=()=>t.takeSrtFallbacks?.()??null});let B=await wi(r),Y=new Xr(r,B,m,{envRoot:D}),x=ne(r),I=null,U=Promise.all([x,import("./local-capabilities-j6h63m79.js")]).then(([t,s])=>{I=re(t,s.capabilityInventoryForRoots),e("device_ops_loaded")}).catch((t)=>e("device_ops_unavailable",{error:t instanceof Error?t.name:"error"})),N=f.then(()=>import("./vm-hands-executor-rdmj1wv4.js")).then(({createVmHandsOpRunners:t,vmHandsBindCgroup:s,VM_HANDS_PAYLOAD_CGROUP:_})=>t({payloadUid:r.layout.payload_uid,payloadGid:oe(r.layout.payload_uid),bindCgroup:(d)=>s(_,d),log:(d,y)=>e(d,y)})).catch(()=>null);N.then((t)=>t?.warm("person")),e("agent_ready"),await bi({apiOrigin:r.api_origin,agent:Y,signal:g.signal,heartbeat:async()=>I??await x,executeOp:async({kind:t,claim:s,bindId:_,signal:d,emit:y})=>{let O=se(r,s);if(!O)return{status:"failed",error_code:"vm_hands_bind_invalid"};let H={executionMode:"unsandboxed",runtimeDirectory:v,readiness:Object.fromEntries(k.map((l)=>[l,!0]))},P=(l)=>{let b=typeof l.kind==="string"?l.kind:"";if(b)y({kind:b,...l.data&&typeof l.data==="object"?{data:l.data}:{}})};if(s.capability==="exec.full"&&t!=="person")return{status:"failed",error_code:"capability_not_granted"};if(s.capability==="automation.call.v1"&&t!=="model")return{status:"failed",error_code:"capability_not_granted"};let j=s.capability==="pty.start"&&t==="person"&&!s.authority;if(te.has(String(s.capability))&&!j){let{executeLocalOperation:l}=await import("./local-capabilities-j6h63m79.js");return l(O,s,{worker:H,signal:d,emit:(b)=>P(b)})}let T=await N;if(!T)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return T.run(t,{id:String(s.attempt_id),claim:s,state:O,worker:H},P,d,_)},readyData:({launchId:t})=>({executor_launch_id:t}),log:(t,s)=>{if(t==="vm_hands.registered"||t==="vm_hands.reconnected")p();e(t,s)},onTurn:(t,s)=>{if(s)c.set(t,s);else c.delete(t)}}),await(await w).stop(),(await N)?.stop()}export{pe as parseVmHandsInit,fe as runVmHands};

package/bin/vm-hands/worker-sandbox-smqj3mbe.js

@@ -0,0 +1,2 @@
+// @bun
+import{qo}from"./vm-hands-entry-lite-vrqzr15t.js";import"./vm-hands-entry-lite-b885gwfh.js";import"./vm-hands-entry-lite-88swf2qr.js";import"./vm-hands-entry-lite-9ay6f56v.js";import"./vm-hands-entry-lite-m11j0f9q.js";export{qo as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-x64",
-  "version": "0.2.408",
+  "version": "0.2.410",
   "description": "Reason CLI native binary for linux-x64",
   "os": [
     "linux"

package/bin/vm-hands/api-8d760ppa.js

@@ -1,2 +0,0 @@
-// @bun
-import{R,zo,vo}from"./vm-hands-entry-lite-w9ckj5k4.js";import"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-zg3b0c08.js";import"./vm-hands-entry-lite-hcw5tk5d.js";export{R as ApiError,vo as ReasonApi,zo as createMachineEnrollmentTicketWithToken};

package/bin/vm-hands/api-credentials-eea1g4aw.js

@@ -1,2 +0,0 @@
-// @bun
-import{gi,wo,bo,qo}from"./vm-hands-entry-lite-fyjzrvj5.js";import"./vm-hands-entry-lite-w9ckj5k4.js";import"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-zg3b0c08.js";import"./vm-hands-entry-lite-hcw5tk5d.js";export{gi as apiOriginFromEnvironment,wo as environmentApiKey,qo as requireApiCredentials,bo as resolveApiCredentials};

package/bin/vm-hands/connect-cli-m8xafyn5.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ge,Bo,Fo,jo}from"./vm-hands-entry-lite-6whxyzz2.js";import"./vm-hands-entry-lite-w8kc4jtb.js";import"./vm-hands-entry-lite-fyjzrvj5.js";import"./vm-hands-entry-lite-w9ckj5k4.js";import"./vm-hands-entry-lite-4geps3jz.js";import"./vm-hands-entry-lite-qffs74x1.js";import"./vm-hands-entry-lite-et2bh990.js";import"./vm-hands-entry-lite-wd576mgy.js";import"./vm-hands-entry-lite-79s23abx.js";import"./vm-hands-entry-lite-mw0gzbds.js";import"./vm-hands-entry-lite-wyh6dp1t.js";import"./vm-hands-entry-lite-9ym3sx81.js";import"./vm-hands-entry-lite-hfmydph9.js";import"./vm-hands-entry-lite-e5hbehqn.js";import"./vm-hands-entry-lite-pn92kh7b.js";import"./vm-hands-entry-lite-dq1m5ykp.js";import"./vm-hands-entry-lite-51qvfk93.js";import"./vm-hands-entry-lite-g3ja0c3y.js";import"./vm-hands-entry-lite-v3xznxcw.js";import"./vm-hands-entry-lite-hee1h411.js";import"./vm-hands-entry-lite-gc7c22pq.js";import"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-762fbns7.js";import"./vm-hands-entry-lite-8evzzh7v.js";import"./vm-hands-entry-lite-wf7ksh4e.js";import"./vm-hands-entry-lite-8bzqc4xa.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-ym1djztp.js";import"./vm-hands-entry-lite-8gtgr399.js";import"./vm-hands-entry-lite-zg3b0c08.js";import"./vm-hands-entry-lite-hcw5tk5d.js";export{Bo as computerDisconnected,Ge as connectionDirectory,Fo as connectionReport,jo as restartConnection};

package/bin/vm-hands/custom-endpoint-device-nfjhs9fv.js

@@ -1,2 +0,0 @@
-// @bun
-import{Xe,St,fr,ln,mr,un,dn,pn}from"./vm-hands-entry-lite-9ym3sx81.js";export{Xe as CUSTOM_ENDPOINT_DEVICE_CHUNK_BYTES,fr as CUSTOM_ENDPOINT_DEVICE_MAX_CHUNKS,St as CUSTOM_ENDPOINT_DEVICE_MAX_RESPONSE_BYTES,ln as CUSTOM_ENDPOINT_DEVICE_TIMEOUT_MS,dn as CustomEndpointDeviceCredentialSchema,un as CustomEndpointDeviceRequestSchema,mr as customEndpointRequestMatchesConfig,pn as isCustomEndpointDeviceFailureCode};

package/bin/vm-hands/desktop-account-rx4ajy2j.js

@@ -1,2 +0,0 @@
-// @bun
-import{as,G,En}from"./vm-hands-entry-lite-v3xznxcw.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";export{as as configureDesktopAccount,G as desktopAccount,En as desktopHome};

package/bin/vm-hands/device-workspace-n9tn4bzw.js

@@ -1,2 +0,0 @@
-// @bun
-import{ue,Ee,J,xe,de,Ht,ze,Z,T,H,jr,Ur,Hr,qt,qr}from"./vm-hands-entry-lite-mvx29q2q.js";export{Hr as CLOUD_REPOSITORY_WORKSPACE_ID,jr as CLOUD_SESSION_CONTROL_BASE,qt as CLOUD_SESSION_ROOT,Ee as HANDS_WORKSPACE_BASE_KEY,xe as HANDS_WORKSPACE_LAYOUT_KEY,ue as REASON_WORKSPACE_BASE,J as SESSION_WORKSPACE_LAYOUT,de as SESSION_WORKTREES,Ht as SESSION_WORKTREE_ID,Ur as SIDECHAT_WORKSPACE_ID,qr as cloudSessionLayoutOfRoot,T as deviceWorkspaceRootRelative,Z as isDeviceWorkspacePath,ze as isSessionWorktreePath,H as parseDeviceWorkspace};

package/bin/vm-hands/hands-worker-source-yxsap3qk.js

@@ -1,2 +0,0 @@
-// @bun
-import{D,O,Ao,S}from"./vm-hands-entry-lite-wd576mgy.js";import"./vm-hands-entry-lite-51qvfk93.js";import"./vm-hands-entry-lite-g3ja0c3y.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-hcw5tk5d.js";export{S as REASON_HANDS_WORKER_ARTIFACT_SHA256,O as REASON_HANDS_WORKER_ENTRYPOINT,Ao as REASON_HANDS_WORKER_SOURCE,D as REASON_HANDS_WORKER_VERSION};

package/bin/vm-hands/install-receipt-rmsjtfqy.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ir,Cn,Dr,An}from"./vm-hands-entry-lite-gc7c22pq.js";import"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";export{Ir as installationReceiptPath,Dr as installerReasonAlias,Cn as installerReceiptLauncher,An as loadInstallationReceipt};

package/bin/vm-hands/local-automation-7qcnytj6.js

@@ -1,2 +0,0 @@
-// @bun
-import{hn,rs,ns,is,os,fn}from"./vm-hands-entry-lite-hfmydph9.js";import"./vm-hands-entry-lite-e5hbehqn.js";import"./vm-hands-entry-lite-pn92kh7b.js";import"./vm-hands-entry-lite-dq1m5ykp.js";import"./vm-hands-entry-lite-51qvfk93.js";import"./vm-hands-entry-lite-g3ja0c3y.js";import"./vm-hands-entry-lite-v3xznxcw.js";import"./vm-hands-entry-lite-hee1h411.js";import"./vm-hands-entry-lite-gc7c22pq.js";import"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-762fbns7.js";import"./vm-hands-entry-lite-8evzzh7v.js";import"./vm-hands-entry-lite-wf7ksh4e.js";import"./vm-hands-entry-lite-8bzqc4xa.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-ym1djztp.js";import"./vm-hands-entry-lite-8gtgr399.js";import"./vm-hands-entry-lite-zg3b0c08.js";import"./vm-hands-entry-lite-hcw5tk5d.js";export{ns as ensureLocalBrowser,hn as localAutomationAvailable,is as localBrowserProfile,rs as localUserChromeHost,os as runAutomationCallLocally,fn as runLocalAutomation};

package/bin/vm-hands/local-capabilities-hchsc804.js

@@ -1,2 +0,0 @@
-// @bun
-import{So,wi,Yr,Eo,xo,ko,Co,Yo,Qo,es,ts}from"./vm-hands-entry-lite-qffs74x1.js";import"./vm-hands-entry-lite-et2bh990.js";import"./vm-hands-entry-lite-wd576mgy.js";import"./vm-hands-entry-lite-79s23abx.js";import"./vm-hands-entry-lite-mw0gzbds.js";import"./vm-hands-entry-lite-wyh6dp1t.js";import"./vm-hands-entry-lite-9ym3sx81.js";import"./vm-hands-entry-lite-hfmydph9.js";import"./vm-hands-entry-lite-e5hbehqn.js";import"./vm-hands-entry-lite-pn92kh7b.js";import"./vm-hands-entry-lite-dq1m5ykp.js";import"./vm-hands-entry-lite-51qvfk93.js";import"./vm-hands-entry-lite-g3ja0c3y.js";import"./vm-hands-entry-lite-v3xznxcw.js";import"./vm-hands-entry-lite-hee1h411.js";import"./vm-hands-entry-lite-gc7c22pq.js";import"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-762fbns7.js";import"./vm-hands-entry-lite-8evzzh7v.js";import"./vm-hands-entry-lite-wf7ksh4e.js";import"./vm-hands-entry-lite-8bzqc4xa.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-ym1djztp.js";import"./vm-hands-entry-lite-8gtgr399.js";import"./vm-hands-entry-lite-zg3b0c08.js";import"./vm-hands-entry-lite-hcw5tk5d.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";export{r as LocalCapabilityError,So as SHORT_REQUEST_CAPABILITIES,Yo as capabilityInventoryForRoots,wi as confinedExecutionShell,Eo as defaultLocalCommandRunner,Qo as deliverLocalHandsEnvironment,Co as enrolledRootPaths,ts as executeLocalOperation,es as rebindLocalHandsControl,xo as runFileCapability,ko as runTransferCapability,Yr as spawnCaptured};

package/bin/vm-hands/local-desktop-users-c6858avg.js

@@ -1,2 +0,0 @@
-// @bun
-import{ft,$s,Bs,fi,mi}from"./vm-hands-entry-lite-8gtgr399.js";import"./vm-hands-entry-lite-zg3b0c08.js";import"./vm-hands-entry-lite-hcw5tk5d.js";export{$s as forgetLocalDesktopUse,mi as holdLocalDesktop,ft as noteLocalDesktopUse,Bs as releaseLocalDesktop,fi as trackDesktopRun};

package/bin/vm-hands/local-display-mac-zmbp9z4c.js

@@ -1,2 +0,0 @@
-// @bun
-import{qe,ot,On,In}from"./vm-hands-entry-lite-8evzzh7v.js";export{qe as macScreenStatus,In as openMacInput,On as openMacWindowBounds,ot as requestMacScreenAccess};

package/bin/vm-hands/local-display-session-7bgp7gvf.js

@@ -1,2 +0,0 @@
-// @bun
-import{kt,ss,V,$e,Ct}from"./vm-hands-entry-lite-e5hbehqn.js";import"./vm-hands-entry-lite-pn92kh7b.js";import"./vm-hands-entry-lite-dq1m5ykp.js";import"./vm-hands-entry-lite-51qvfk93.js";import"./vm-hands-entry-lite-g3ja0c3y.js";import"./vm-hands-entry-lite-v3xznxcw.js";import"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-762fbns7.js";import"./vm-hands-entry-lite-8evzzh7v.js";import"./vm-hands-entry-lite-wf7ksh4e.js";import"./vm-hands-entry-lite-8bzqc4xa.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-8gtgr399.js";import"./vm-hands-entry-lite-zg3b0c08.js";import"./vm-hands-entry-lite-hcw5tk5d.js";export{$e as ensureLinuxDesktop,kt as localDisplayAvailable,ss as localDisplayReady,V as privateDirectory,Ct as runLocalDisplayStream};

package/bin/vm-hands/local-pty-session-8m175hqx.js

@@ -1,2 +0,0 @@
-// @bun
-import{_r,At,yr,Po,mn,wr,gn}from"./vm-hands-entry-lite-pn92kh7b.js";import"./vm-hands-entry-lite-dq1m5ykp.js";import"./vm-hands-entry-lite-51qvfk93.js";import"./vm-hands-entry-lite-g3ja0c3y.js";import"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";export{At as LOCAL_PTY_MAX_BUFFERED_OUTPUT_BYTES,yr as LOCAL_PTY_MAX_SESSIONS,_r as LOCAL_PTY_MAX_SESSION_MS,wr as defaultConnect,Po as defaultLoginShell,mn as ptyRuntimeSupported,gn as runLocalPtySession};

package/bin/vm-hands/managed-runtime-nkmg5s5h.js

@@ -1,2 +0,0 @@
-// @bun
-import{Wo,Vo,Go,Ko,Jo,Zo,Xo}from"./vm-hands-entry-lite-4geps3jz.js";import"./vm-hands-entry-lite-wyh6dp1t.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-wf7ksh4e.js";import"./vm-hands-entry-lite-8bzqc4xa.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-zg3b0c08.js";import"./vm-hands-entry-lite-hcw5tk5d.js";export{Jo as acquireManagedRuntimeDirectoryLock,Go as currentManagedRuntimeVersion,Xo as flushManagedRuntimeLifecycleEvents,Ko as isManagedRuntimeVersionExecutable,Vo as legacyManagedRuntimePaths,Wo as managedRuntimePaths,Zo as recordManagedRuntimeLifecycle};

package/bin/vm-hands/network-contract-qt2s82ap.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ve,Ce,gs,_s,ys,Mn,bs,zr,$n,ut,Bn,Fn,jn,Un,Hn,qn,zn,Wn,Vn,Gn,Kn,Jn,Zn,Xn,Yn,Qn,pe,X,Ae,q,ei,ti,ri,Y,ni,ii,oi,si,ai,dt,ci,vs,Wt,li,Ss,Io,Es,xs,ks,Cs,As,Ps,Ts,Rs,Os,Is,Ds,Ns,Ls,Ms}from"./vm-hands-entry-lite-ym1djztp.js";export{ci as AUTOMATION_CLOUD_SESSIONS,dt as AUTOMATION_USER_CHROME,Kn as HANDS_CLOUD_ACCESS,Jn as HANDS_CLOUD_ACCESS_KEY,pe as HANDS_CONFINEMENT,X as HANDS_CONFINEMENT_KEY,Un as HANDS_ENVIRONMENT_AT_CLAIM,Hn as HANDS_ENVIRONMENT_AT_CLAIM_KEY,$n as HANDS_ENVIRONMENT_DELIVERY,ut as HANDS_ENVIRONMENT_DELIVER_CONTROL,Zn as HANDS_HEADLESS_BROWSER,Xn as HANDS_HEADLESS_BROWSER_KEY,ei as HANDS_JOBS_USER,ti as HANDS_JOBS_USER_KEY,Yn as HANDS_LARGE_ENVIRONMENT,Qn as HANDS_LARGE_ENVIRONMENT_KEY,Ae as HANDS_MODEL_JOBS_EGRESS,q as HANDS_MODEL_JOBS_EGRESS_KEY,Wn as HANDS_REBIND,Gn as HANDS_REBIND_CONTROL,Vn as HANDS_REBIND_KEY,ni as HANDS_SESSION_CAP_KEY,ii as HANDS_SESSION_CAP_NONE,ri as HANDS_SESSION_GROUP,Y as HANDS_SESSION_GROUP_KEY,qn as HANDS_WORKSPACE_CHECK,zn as HANDS_WORKSPACE_CHECK_KEY,si as JOBS_START_WAIT,ai as JOBS_START_WAIT_KEY,Ce as LOCAL_OPERATION_MAX_BYTES,Ve as LOCAL_RUNTIME_PROTOCOL_VERSION,ys as LOCAL_RUNTIME_ROUTES,zr as LOCAL_RUNTIME_SESSION_CLAIM_WAIT_MAX_MS,Mn as LOCAL_RUNTIME_SESSION_PATH,Wt as LOCAL_RUNTIME_WORKER_STARTUP_MAX_MS,gs as RELAY_HOST_ALIAS_HEADER,_s as RELAY_HOST_ALIAS_VERSION,jn as VM_HANDS_UNBIND_UNVERIFIED_EVENT,Bn as VM_HANDS_WORKSPACE_DEFERRED_KEY,Fn as VM_HANDS_WORKSPACE_GRANT_CONTROL,oi as WORKER_PREVIEW_CARRIED_JOBS,vs as WORKER_STARTUP_TIMING_STAGES,li as buildLocalRuntimeDeviceProofBytes,bs as localRuntimeSessionRoutable,Ts as parseLocalRuntimeDisconnectResponse,xs as parseLocalRuntimeEnrollmentResponse,Ss as parseLocalRuntimeErrorEnvelope,Cs as parseLocalRuntimeFirstHeartbeat,ks as parseLocalRuntimeHeartbeatResponse,Ps as parseLocalRuntimeIdentityResponse,Os as parseLocalRuntimeLifecycleResponse,Rs as parseLocalRuntimeLocalSubscriptionResponse,Is as parseLocalRuntimeOperationClaim,Ms as parseLocalRuntimeOperationCompletionResponse,Ls as parseLocalRuntimeOperationEnvironmentResponse,Ns as parseLocalRuntimeOperationEventsResponse,Ds as parseLocalRuntimeOperationHeartbeatResponse,Io as parseLocalRuntimeProofChallenge,Es as parseLocalRuntimeRegistrationResponse,As as parseLocalRuntimeRootsSyncResponse};

package/bin/vm-hands/package-11mkdcmn.js

@@ -1,2 +0,0 @@
-// @bun
-import{Zr}from"./vm-hands-entry-lite-hzn1hf0p.js";export default Zr();

package/bin/vm-hands/permissions-67xv16a5.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ro,Oo,fs,ms}from"./vm-hands-entry-lite-762fbns7.js";import"./vm-hands-entry-lite-8evzzh7v.js";import"./vm-hands-entry-lite-wf7ksh4e.js";import"./vm-hands-entry-lite-8bzqc4xa.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";export{ms as allowMacPermissions,fs as permissionsSummary,Oo as readMacPermissions,Ro as reasonIdentity};

package/bin/vm-hands/reason-hands-protocol-r356wr4t.js

@@ -1,2 +0,0 @@
-// @bun
-import{k,Er,xr,_n,et,yn,kr,Fe,ye,wn,je,It,te,Ue,bn,we,Dt,Cr,Nt,Ar,vn,ae,U,N,ce,Pr,Tr,Sn}from"./vm-hands-entry-lite-g3ja0c3y.js";import"./vm-hands-entry-lite-mvx29q2q.js";export{Ar as REASON_HANDS_CLOSE_CODES,je as REASON_HANDS_JOB_CONTROL_MAX_FRAME_BYTES,kr as REASON_HANDS_JOB_MAX_INPUT_CHARS,Fe as REASON_HANDS_JOB_MAX_OUTPUT_CHARS,ye as REASON_HANDS_JOB_MAX_OUTPUT_CHUNKS,wn as REASON_HANDS_JOB_MAX_RECORDS,yn as REASON_HANDS_MAX_ERROR_CHARS,Er as REASON_HANDS_MAX_FRAME_BYTES,xr as REASON_HANDS_MAX_INPUT_CHARS,et as REASON_HANDS_MAX_OUTPUT_CHARS,_n as REASON_HANDS_MAX_STRUCTURED_INPUT_CHARS,k as REASON_HANDS_PROTOCOL_VERSION,Cr as REASON_HANDS_PTY_ANCHOR_EXIT_MS,Nt as REASON_HANDS_PTY_CLEANUP_RECEIPT_MS,Dt as REASON_HANDS_PTY_CLEANUP_SWEEP_MS,we as REASON_HANDS_PTY_MAX_DIMENSION,te as REASON_HANDS_PTY_MAX_INPUT_BYTES,Ue as REASON_HANDS_PTY_MAX_OUTPUT_BYTES,bn as REASON_HANDS_PTY_MAX_PENDING_INPUT_BYTES,It as REASON_HANDS_PTY_PROTOCOL_VERSION,vn as REASON_HANDS_WORKSPACE_BEFORE_MAX_OUTPUT_CHARS,U as isReasonHandsGeneration,ce as isReasonHandsPtyJobId,ae as isReasonHandsRequestId,N as isReasonHandsUuid,Pr as parseReasonHandsJobRequest,Tr as parseReasonHandsJobResult,Sn as parseReasonHandsPtyReceipt};

package/bin/vm-hands/serve-service-4n7e0b08.js

@@ -1,2 +0,0 @@
-// @bun
-import{Rr,be,K,xn,cs,qi,ls,He,To,kn,us,ds,Or,ps,hs}from"./vm-hands-entry-lite-hee1h411.js";import"./vm-hands-entry-lite-gc7c22pq.js";import"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-wf7ksh4e.js";import"./vm-hands-entry-lite-8bzqc4xa.js";import"./vm-hands-entry-lite-dkcm3hyn.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-zg3b0c08.js";import"./vm-hands-entry-lite-hcw5tk5d.js";export{Rr as WORKER_SERVICE_ENV,K as WorkerServiceError,qi as connectServiceLabel,be as defaultWorkerServiceHost,ds as installWorkerService,He as installedWorkerService,ls as isConnectServiceLabel,hs as removeWorkerService,Or as restartWorkerService,ps as retargetWorkerServiceLogs,To as retireLegacyWorkerService,us as workerServiceDefinitionCurrent,xn as workerServiceLauncher,kn as workerServiceProcessRunning,cs as workerServiceRetargetPending};

package/bin/vm-hands/status-e7r62q4e.js

@@ -1,10 +0,0 @@
-// @bun
-import"./vm-hands-entry-lite-w9ckj5k4.js";import"./vm-hands-entry-lite-t7an5zg2.js";import{g}from"./vm-hands-entry-lite-5p5h1eng.js";import"./vm-hands-entry-lite-mvx29q2q.js";import"./vm-hands-entry-lite-hcw5tk5d.js";import"./vm-hands-entry-lite-fyjzrvj5.js";import{Tt,Qe}from"./vm-hands-entry-lite-dq1m5ykp.js";import{w,M,Jt,Ie,Ge}from"./vm-hands-entry-lite-6whxyzz2.js";import"./vm-hands-entry-lite-ym1djztp.js";import"./vm-hands-entry-lite-qffs74x1.js";import"./vm-hands-entry-lite-et2bh990.js";import"./vm-hands-entry-lite-8bzqc4xa.js";import"./vm-hands-entry-lite-mw0gzbds.js";import"./vm-hands-entry-lite-79s23abx.js";import"./vm-hands-entry-lite-w8kc4jtb.js";import"./vm-hands-entry-lite-e5hbehqn.js";import"./vm-hands-entry-lite-8evzzh7v.js";import"./vm-hands-entry-lite-wf7ksh4e.js";import"./vm-hands-entry-lite-762fbns7.js";import"./vm-hands-entry-lite-v3xznxcw.js";import"./vm-hands-entry-lite-4geps3jz.js";import"./vm-hands-entry-lite-gc7c22pq.js";import"./vm-hands-entry-lite-hee1h411.js";import"./vm-hands-entry-lite-9ym3sx81.js";import"./vm-hands-entry-lite-g3ja0c3y.js";import"./vm-hands-entry-lite-wd576mgy.js";import"./vm-hands-entry-lite-51qvfk93.js";import"./vm-hands-entry-lite-8gtgr399.js";import"./vm-hands-entry-lite-pn92kh7b.js";import"./vm-hands-entry-lite-hfmydph9.js";import"./vm-hands-entry-lite-wyh6dp1t.js";import{a}from"./vm-hands-entry-lite-dkcm3hyn.js";import{t,o,u,i,s,n}from"./vm-hands-entry-lite-zn0v259d.js";import"./vm-hands-entry-lite-zg3b0c08.js";import{readFileSync as me,realpathSync as k,renameSync as ge,unlinkSync as fe,writeFileSync as he}from"fs";import{dirname as ye,join as I}from"path";function h(e){return`claude mcp add --transport http reason ${e}`}function C(e){return`codex mcp add reason --url ${e}
-codex mcp login reason`}var F=h("https://mcp.reasonmachines.com/mcp"),z=C("https://mcp.reasonmachines.com/mcp"),B=`https://claude.ai/settings/connectors?add=custom&url=${encodeURIComponent("https://mcp.reasonmachines.com/mcp")}`,H=`https://cursor.com/install-mcp?name=reason&config=${encodeURIComponent(btoa(JSON.stringify({url:"https://mcp.reasonmachines.com/mcp"})))}`;var b="https://github.com/reason-machines/reason-plugins",X=`Connect a coding agent to Reason over MCP
-
-Usage:
-  reason mcp             Show how to connect Claude Code, Codex, or another MCP client
-  reason mcp uninstall   Remove only this machine's registrations of the earlier, retired server
-
-Plugins for Claude Code and Codex: ${b}
-`;var P=s(["granted","not_granted","unknown"]),y=i({status:P,checkedAt:o().finite(),executablePath:t().min(1)});var De=i({version:n(1),key:t(),at:o(),self:i({principal_type:t(),user_id:t().optional(),user_name:t().nullish(),email:t().nullish(),org_id:t(),organization_name:t().nullish(),organization_slug:t().nullish(),mcp_connections:u(i({client_id:t(),client_name:t(),last_used_at:t().nullable()})).optional()})});var x=30000;function L(e,c=Date.now(),R=null){let r=Qe(e),d=(()=>{if(r?.state!=="connected"&&r?.state!=="starting")return!1;try{return process.kill(r.pid,0),!0}catch{return!1}})(),S=d&&r?.state==="connected",p=(f)=>S&&c-f>=0&&c-f<x,l=y.safeParse(r?.fullDiskAccess),m=Tt(r,R,c);return{...m?{permission_recovery:m}:{},full_disk_access:l.success&&p(l.data.checkedAt)?l.data.status:"unknown",keep_awake:{enabled:Jt(e)==="battery_and_ac",holding:r?.idleSleepHold===!0&&p(Date.parse(r.lastHeartbeatAt??""))},executable:d&&l.success?l.data.executablePath:null}}function Ne(e=g()){if(process.platform!=="darwin")return null;let c=Ie(I(Ge(k(a()),e),"worker.json"));return c?L(w(c).daemon,Date.now(),M(c)):null}export{Ne as connectionMacState};

package/bin/vm-hands/version-vdev7tyq.js

@@ -1,2 +0,0 @@
-// @bun
-import{at}from"./vm-hands-entry-lite-8bzqc4xa.js";export{at as CLI_VERSION};

package/bin/vm-hands/vm-hands-entry-lite-8bzqc4xa.js

@@ -1,2 +0,0 @@
-// @bun
-import{jt}from"./vm-hands-entry-lite-snmxxhza.js";var at=jt.version;export{at};