@reason-machines/cli-linux-x64 0.2.416 → 0.2.418

package/bin/vm-hands/vm-hands-entry-lite-t7n6t3j9.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ht}from"./vm-hands-entry-lite-zybbbegw.js";var ct=Ht.version;export{ct};

package/bin/vm-hands/vm-hands-entry-lite-vq14wv7h.js

@@ -1,52 +0,0 @@
-// @bun
-import{g,Ki,ve}from"./vm-hands-entry-lite-ckv17tn8.js";import{l,Rt,Fe,Sr,Ot,xr,et}from"./vm-hands-entry-lite-q0k6kx6d.js";import{ut,Gt}from"./vm-hands-entry-lite-k278g9kj.js";import{Qr}from"./vm-hands-entry-lite-sm5nkxpw.js";import{B,m,ee,Le}from"./vm-hands-entry-lite-7n60veqy.js";import{F}from"./vm-hands-entry-lite-8vfd0kez.js";import{co}from"./vm-hands-entry-lite-qk4kexta.js";import{be,qe,An,Dr}from"./vm-hands-entry-lite-dqd4p5kw.js";import{f,b,h}from"./vm-hands-entry-lite-09m2cdkw.js";import{a}from"./vm-hands-entry-lite-89z488gz.js";import{go,Gr,y,t,A,mt,o,d,Te,u,i,c,_,$o,s,n,Kr}from"./vm-hands-entry-lite-907pa7f9.js";import{closeSync as Kh,existsSync as Vh,mkdirSync as Jh,openSync as Gh,readdirSync as Yh,realpathSync as pe,rmSync as Xh}from"fs";import{dirname as Qh,join as J,resolve as ew}from"path";import{createHash as At}from"crypto";import{platform as It}from"os";import{join as xt}from"path";var Lt=_("store",[c({version:n(1),store:n("keychain")}),c({version:n(1),store:n("file"),api_key:t().min(1).max(4096)})]),He=(e)=>xt(e,"api-key.json");function $e(e){let r=At("sha256").update(`reason-connect-api-key
-${e}`).digest("hex");return new Fe(Rt(),It(),r)}function ge(e,r=$e(e)){if(!f(He(e)))return null;let p=Lt.parse(JSON.parse(h(He(e))));if(p.store==="file")return p.api_key;try{let k=r.loadBinding();return k?new TextDecoder().decode(k):null}catch(k){if(!(k instanceof l))throw k;throw Error("worker_api_key_unreadable")}}import{readdirSync as Yt,renameSync as Kn,rmSync as Vn}from"fs";import{join as te}from"path";import{createHash as Dt}from"crypto";import{platform as Wt}from"os";import{join as N}from"path";function w(e){return{state:N(m(e),"device.json"),control:N(m(e),"control.json"),lock:N(m(e),"lifecycle.lock"),socket:N(m(e),"control.sock"),daemon:N(m(e),"daemon.json"),releaseCheck:N(m(e),"release-check.json"),updateDeferral:N(m(e),"update-deferral.json"),firstHeartbeat:N(m(e),"first-heartbeat.json")}}var ln=i({version:n(1),device_id:t().min(1).max(160),offer:Te().optional(),enrollment_ms:o().int().nonnegative().max(Gt).optional()});function z(e,r=!1){b(m(e),r);let p=["local-device.key","local-device.binding","device.json"].filter((k)=>{let S=N(m(e),k);if(!f(S))return!1;return h(S),!0});return e.lifetime==="persistent"&&p.join()==="device.json"?Nt(e):new Sr(m(e))}function Nt(e){return new Fe(Rt(),Wt(),Ht(e))}function Ht(e){let r=Ut(e);return Dt("sha256").update(`reason-worker
-${r?.directory??m(e)}`).digest("hex")}var $t="keychain-scope.json";var Bt=c({version:n(1),directory:t().min(1),devicePublicKey:t().min(1)});function Ut(e){let r=N(m(e),$t);if(!f(r))return null;let p=Bt.safeParse(JSON.parse(h(r))),k=w(e).state;if(!p.success||!f(k))return null;return JSON.parse(h(k))?.devicePublicKey===p.data.devicePublicKey?p.data:null}function M(e){if(!f(m(e)))return null;let r=xr(w(e).state,{proofStore:z(e),repair:!1}),p=r!==null&&Ki(e.apiOrigin,r.apiOrigin),k=p?[ee(e),ee({...e,apiOrigin:r.apiOrigin})]:[ee(e)];if(r&&(!k.includes(r.worker?.configDigest??"")||r.worker.lifetime!==e.lifetime||r.apiOrigin!==e.apiOrigin&&!p||r.roots.length>32||r.roots[0]?.path!==e.workspaceRoot||r.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return r}var Ft=c({version:n(1),drained:d(),revoked:d()});function H(e){let r=w(e).control;return f(r)?Ft.parse(JSON.parse(h(r))):{version:1,drained:!1,revoked:!1}}var qt=c({read:d(),write:d(),execute:d(),discover_environment:d(),expose_mcp:n(!1)}),zt=c({version:n(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:qt,execution_mode:s(["confined","host"]).default("confined")}),folders:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),vn=i({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:n("p256"),protocol_version:n(2),roots:u(i({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:i({lifecycle:s(["persistent","ephemeral"]),expires_at:y.datetime({offset:!0})}),first_heartbeat:Te().optional()});var Un=c({version:n(1),install_id:A(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),Fn=i({enrollment_ticket:t().min(1).max(4096),expires_at:y.datetime({offset:!0}),device_kind:n("headless"),lifecycle:s(["persistent","ephemeral"]),device_expires_at:y.datetime({offset:!0})});var jn=i({credentialKind:s(["oauth","api_key"]).optional(),apiOrigin:mt(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:y.datetime({offset:!0}),scopes:u(t().max(128)).max(128),orgId:t().min(1).max(160)});var ze=8;var Zt=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,_e=(e)=>te(m(e),"workspaces"),Qt="account.json",er=(e)=>f(te(e,Qt));function Re(e){let r;try{r=Yt(_e(e))}catch{return[]}return r.filter((p)=>Zt.test(p)).sort().map((p)=>{let k=te(_e(e),p),S=te(k,"worker.json"),v=null;try{let P=B.safeParse(JSON.parse(h(S)));if(P.success&&P.data.stateDirectory===k)v=P.data}catch{}return{organizationId:p,directory:k,configPath:S,config:v,account:er(k)}})}var tr=(e)=>te(_e(e),"listed.json");function rr(e){try{let r=JSON.parse(h(tr(e))),p=r.names&&typeof r.names==="object"&&!Array.isArray(r.names)?Object.fromEntries(Object.entries(r.names).filter((k)=>typeof k[1]==="string")):{};return{listed:r.listed===!0,reason:r.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(r.blocked)?r.blocked.filter((k)=>typeof k==="string"):[],names:p}}catch{return null}}function Ve(e,r){let p=Re(e),k=p.filter((E)=>E.account),S=p.filter((E)=>!E.account),v=rr(e),P=v&&!v.listed?v.reason:null,R=P||S.length===0&&v&&!v.listed?[]:S;if(k.length===0&&R.length===0&&(P||v&&!v.listed))return{workspaces:null,off:P};return{off:P,workspaces:[...k,...R].map(({organizationId:E,config:L,account:x})=>{let C=!1,T=null,D=!1,he=null;try{C=L?H(L).revoked:!1,T=L&&!C?M(L):null;let Ne=L?et(w(L).daemon):null;D=r&&!!T&&Ne?.state==="connected",he=D?Ot(Ne,T):null}catch{}return{...he?{permission_recovery:he}:{},organization_id:E,device_id:T?.deviceId??null,name:v?.names?.[E]??null,root:T?.roots[0]?{id:T.roots[0].id,permissions:T.roots[0].permissions}:null,state:C?"removed":D?"connected":"not_running",blocked:!x&&!C&&!D&&(v?.blocked.includes(E)??!1),...x?{account:!0}:{}}})}}import{readFileSync as nr}from"fs";function Xt(e){try{let r=JSON.parse(nr(`${e}.keep-awake.json`,"utf8"));return r!==null&&typeof r==="object"&&"version"in r&&r.version===1&&"enabled"in r&&r.enabled===!0?"battery_and_ac":void 0}catch(r){return r.code==="ENOENT"?"battery_and_ac":void 0}}import{chmodSync as Bi,lstatSync as Qe,mkdtempSync as Ui,realpathSync as ir,rmdirSync as Fi,rmSync as ji,unlinkSync as qi}from"fs";import{createConnection as ar,createServer as Vi}from"net";import{basename as Ye,dirname as Xe,join as oe}from"path";var sr=s(["status","drain","resume","stop","reload_roots"]),cr=c({version:n(1),instanceId:t(),deviceId:t(),phase:s(["starting","running","reconnecting","stopping"]),drained:d(),activeClaims:o().int().nonnegative(),activeSessions:o().int().nonnegative().optional(),executionEligible:d(),supportedOperations:u(s(ut)).max(ut.length).optional(),capabilityReadiness:$o(s(ut),d()).optional(),lastHeartbeat:t().nullable(),expiresAt:t()}),Qi=c({nonce:t(),action:sr}),lr=i({nonce:A()}),dr=c({version:n(1),nonce:A(),socketPath:t().max(100)});function ur(e){return oe(w(e).lock,"control.json")}function tt(e){return b(w(e).lock),lr.parse(JSON.parse(h(oe(w(e).lock,"owner.json"))))}function Ze(e){if(!f(e))return!1;let r=Qe(e);if(!r.isSocket()||r.uid!==process.getuid?.()||(r.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function rt(e,r){let p=ur(e);if(!f(p)){let v=w(e).socket;if(!f(v)||!Qe(v).isSocket())return null;return Ze(v)?v:null}let k=dr.parse(JSON.parse(h(p)));if(k.nonce!==r)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!fr.test(k.socketPath))throw Error("worker_control_endpoint_invalid");return k.socketPath}let S=Xe(k.socketPath);if(Xe(S)!==ir("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(Ye(S))||Ye(k.socketPath)!=="control.sock"||Buffer.byteLength(k.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!f(S))return null;return b(S),Ze(k.socketPath)?k.socketPath:null}var fr=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;function mr(e,r){try{let p=JSON.parse(h(oe(w(e).lock,"owner.json"))),k=p&&typeof p==="object"?p[r]:void 0;return typeof k==="string"?k:null}catch{return null}}function ot(e){return mr(e,"runtime_version")}function nt(e,r){if(r)return r.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!f(oe(w(e).lock,"owner.json")))return"no_lock";return rt(e,tt(e).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var ea=c({instance:t().nullable(),since:o().int().nonnegative()});async function G(e,r){let p=w(e);if(!f(oe(p.lock,"owner.json")))return null;let k=tt(e),S=rt(e,k.nonce);if(!S)return null;return new Promise((v,P)=>{let R=ar(S),E="",L=!1,x=(C,T)=>{if(L)return;if(L=!0,R.destroy(),T)P(T);else v(C)};R.setTimeout(2000,()=>R.destroy(Error("worker_control_timeout"))),R.on("connect",()=>R.write(JSON.stringify({nonce:k.nonce,action:r})+`
-`)),R.on("data",(C)=>{if(E+=C.toString(),Buffer.byteLength(E)>16384)R.destroy(Error("worker_control_oversize"))}),R.on("error",(C)=>{if("code"in C&&["ECONNREFUSED","ENOENT"].includes(String(C.code)))x(null);else x(null,C.message==="worker_control_timeout"?C:Error("worker_control_unavailable"))}),R.on("end",()=>{try{let C=cr.parse(JSON.parse(E));if(C.instanceId!==k.nonce)throw Error("worker_instance_changed");x(C)}catch{x(null,Error("worker_control_invalid_response"))}}),R.once("close",()=>x(null,Error("worker_control_unavailable")))})}import{realpathSync as gr}from"fs";import{constants as Pe}from"fs";import{open as pr}from"fs/promises";var sa={platform:process.platform,home:a,async openFile(e){let r=await pr(e,Pe.O_RDONLY|Pe.O_NOFOLLOW|Pe.O_NONBLOCK);return{isFile:async()=>(await r.stat()).isFile(),close:()=>r.close()}}};var Fa=co(gr(process.execPath));var Ps=Buffer.from([0,255,3,4]);import{execFile as to}from"child_process";import{promisify as ro}from"util";var vr=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var Rr=new Set(["png","jpg","jpeg","gif","webp"]),Pr=new Set(["webm","mp4"]);function Er(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function st(e,r){let p;try{p=new URL(e)}catch{return null}let k=Er(r),S=p.hostname==="ara.so"||p.hostname.endsWith(".ara.so")||p.hostname==="reasonmachines.ai"||p.hostname.endsWith(".reasonmachines.ai")||p.hostname==="reasonmachines.com"||p.hostname.endsWith(".reasonmachines.com");if(p.protocol!=="https:"||!S&&p.origin!==k||p.username||p.password||p.port||p.search||p.hash)return null;let v=vr.exec(p.pathname);if(!v)return null;let P=v[1]?.toLowerCase(),R=v[2]?.toLowerCase(),E=v[3]?.toLowerCase(),L=v[4]?.toLowerCase();if(!P||!R||!E||!L)return null;let x=Rr.has(L)?"image":Pr.has(L)?"video":null;if(!x)return null;let C=/^(before|after)[\s:_-]+/.exec(E),T=p.pathname.replace(/^\/media\//,"");return{url:p.toString(),storagePath:T,runId:P,artifactId:R,fileName:`${E}.${L}`,kind:x,phase:C?.[1]==="before"||C?.[1]==="after"?C[1]:null}}var Cr=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,ct=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),K=()=>{throw Error("cloud_browser_media_request_invalid")};function Ce(e){if(!ct(e)||Object.keys(e).some((v)=>!["runId","configuredMediaOrigin","media"].includes(v))||typeof e.runId!=="string"||!Cr.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return K();let r;try{r=new URL(e.configuredMediaOrigin)}catch{return K()}if(r.protocol!=="https:"||r.username||r.password||r.port||!Le(r.origin,{mode:"public_web"}).allowed)return K();let p=e.runId.toLowerCase(),k=new Set,S=e.media.map((v)=>{if(!ct(v)||Object.keys(v).some((R)=>!["url","sourceUrl","kind"].includes(R))||typeof v.url!=="string"||v.url.length>2048||typeof v.sourceUrl!=="string"||v.sourceUrl.length>8192||!["image","video"].includes(String(v.kind)))return K();let P=st(v.url,r.origin);if(!P||new URL(P.url).origin!==r.origin||P.runId!==p||P.kind!==v.kind||P.url!==v.url||k.has(v.url))return K();if(k.add(v.url),v.sourceUrl!==v.url){let R;try{R=new URL(v.sourceUrl)}catch{return K()}let E=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(R.pathname)?.[1];if(v.kind!=="image"||R.origin!=="https://camo.githubusercontent.com"||R.username||R.password||R.search||R.hash||!E||E.length%2!==0||Buffer.from(E,"hex").toString("utf8")!==v.url)return K()}return{url:v.url,sourceUrl:v.sourceUrl,kind:v.kind}});return{runId:e.runId,configuredMediaOrigin:r.origin,media:S}}var I=t().uuid(),X=t().regex(/^[a-f0-9]{64}$/),V=y.datetime({precision:3}),Ae=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),ft=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),U=i({kind:n("primary_mac"),version:n(1),organizationId:Ae,userId:Ae,sessionId:Ae,runId:I,deviceId:I,rootId:I,rootRevision:t().min(1).max(64),binding:s(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:I,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Ar=Kr().transform((e,r)=>{try{return Qr(e)}catch{return r.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),go}}),ue=i({version:n(1),owner:U,contextId:I,preparedAt:V,expiresAt:V,prUrl:ft,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:X,evidenceKind:s(["image","video"]),visualPlan:Ar.optional(),uploadOrigin:t().url().refine((e)=>{let r=new URL(e);return r.protocol==="https:"&&r.origin===e&&!r.username&&!r.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),Ir=i({version:n(1),producer:n("primary_mac"),context:ue,captureId:I,operationId:I,attemptId:I,tabId:o().int().positive(),startedAt:V,finishedAt:V,sha256:X,media:_("contentType",[i({contentType:n("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),i({contentType:n("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,r)=>{let p=Date.parse(e.startedAt),k=Date.parse(e.finishedAt);if(p<Date.parse(e.context.preparedAt)||k<p||k>Date.parse(e.context.expiresAt)||k-p>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((k-p)/1000-e.media.durationSeconds)>0.1))r.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),vc=_("action",[i({action:n("screenshot"),context_id:I,tab_id:o().int().positive()}).strict(),i({action:n("start_video"),context_id:I,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),i({action:n("stop_video"),recording_operation_id:I}).strict()]),fe=i({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),ce=t().regex(/^[1-9][0-9]{0,19}$/),le=i({version:n(1),owner:U,expectedActorId:ce.nullable(),repositoryId:ce,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),Or=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],Lr=_("status",[le.extend({status:n("ready"),observedActor:fe,checkedAt:V}),le.extend({status:n("not_ready"),reason:s(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:s(Or).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),Y=i({version:n(1),owner:U,expectedActorId:ce.nullable(),authenticatedActor:fe,attemptId:I,captureId:I,prUrl:ft,repositoryId:ce,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:X,sizeBytes:o().int().min(128).max(10485760),contentType:n("video/webm")}).strict(),pt=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),Mr=_("status",[Y.extend({status:n("not_attempted"),reason:s(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),Y.extend({status:n("uncertain"),reason:n("upload_outcome_unknown")}),Y.extend({status:n("uploaded"),observedActor:fe,nativeUrl:pt,uploadedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),de=Y.extend({nativeUrl:pt,observedActor:fe,bodySha256:X}),Tr=_("status",[de.extend({status:n("incomplete"),reason:s(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),de.extend({status:n("verified"),sourceSha256:X,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:n(!0),verifiedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Wr=Kr().transform((e,r)=>{try{let p=Ce(e);if(p.media.some((k)=>k.kind!=="image"))throw Error();return p}catch{return r.addIssue({code:"custom",message:"proof_media_request_invalid"}),go}}),Nr=_("action",[i({action:n("auth_check"),input:le}).strict(),i({action:n("prepare"),context:ue}).strict(),i({action:n("capture_png"),owner:U,contextId:I,tabId:o().int().positive()}).strict(),i({action:n("start_video"),owner:U,contextId:I,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),i({action:n("inspect_capture"),owner:U,captureId:I}).strict(),i({action:n("publish_video"),input:Y}).strict(),i({action:n("verify_png_media"),owner:U,media:Wr}).strict().refine((e)=>e.media.runId===e.owner.runId),i({action:n("verify_saved_media"),input:de}).strict(),i({action:n("publish_png"),owner:U,attemptId:I,captureId:I,sha256:X,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var Hr=i({requestId:I,command:Nr}).strict();var $r={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},lt={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},dt={type:"integer",minimum:1,description:"An already-owned tab's id."},Sc={...$r,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:lt,tab_id:dt}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:lt,tab_id:dt,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};var Ac=i({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict();var Br=String.raw`async (media) => {
-  const deadline = (promise) => {
-    let timer;
-    return Promise.race([promise, new Promise((_, reject) => {
-      timer = setTimeout(() => reject(new Error("media_decode_timeout")), 12000);
-    })]).finally(() => clearTimeout(timer));
-  };
-  const items = await Promise.all(media.map(async (item) => {
-    const element = document.createElement(item.kind === "image" ? "img" : "video");
-    document.body.append(element);
-    try {
-      if (item.kind === "image") {
-        element.src = item.sourceUrl;
-        await deadline(element.decode());
-        if (!element.complete || !element.naturalWidth || !element.naturalHeight) throw new Error("media_image_not_decoded");
-        return { ...item, width: element.naturalWidth, height: element.naturalHeight };
-      }
-      element.muted = true;
-      element.playsInline = true;
-      element.preload = "auto";
-      const loaded = new Promise((resolve, reject) => {
-        element.addEventListener("loadeddata", resolve, { once: true });
-        element.addEventListener("error", () => reject(new Error("media_video_not_decoded")), { once: true });
-      });
-      element.src = item.sourceUrl;
-      await deadline(loaded);
-      if (!element.videoWidth || !element.videoHeight || !Number.isFinite(element.duration) || element.duration <= 0) throw new Error("media_video_not_decoded");
-      const initial = element.currentTime;
-      await deadline(element.play());
-      await deadline(new Promise((resolve, reject) => {
-        let timer;
-        const check = () => {
-          if (element.error) { clearTimeout(timer); reject(new Error("media_video_not_decoded")); return; }
-          if (element.currentTime - initial >= 0.05) { clearTimeout(timer); resolve(); return; }
-          timer = setTimeout(check, 25);
-        };
-        element.addEventListener("pause", () => { clearTimeout(timer); reject(new Error("media_video_not_advancing")); }, { once: true });
-        check();
-      }));
-      return { ...item, width: element.videoWidth, height: element.videoHeight, advancedSeconds: element.currentTime - initial };
-    } finally {
-      if (item.kind === "video") element.pause();
-      element.removeAttribute("src");
-      element.remove();
-    }
-  }));
-  return { verified: true, items };
-}`;import{execFile as Ur}from"child_process";import{promisify as Fr}from"util";var Tc=Fr(Ur);var Xc=_("ok",[i({ok:n(!0),actor:i({login:t(),id:t().nullable()}).strict()}).strict(),i({ok:n(!1),reason:s(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),Zc=i({version:n("0.1.42"),metadata:i({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var tl=i({version:n(1),recording_operation_id:t().uuid(),proof_ready:n(!1),acknowledged_at:y.datetime()}).strict(),me=i({action:n("start"),request_id:t().uuid(),profile:t().regex(/^(Default|Profile [0-9]+)$/),tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),ht=i({action:n("inspect"),recording_operation_id:t().uuid()}).strict(),rl=_("action",[me,ht]),wt=i({recording_operation_id:t().uuid()}).strict(),xe={device_id:t().uuid(),root_id:t().uuid()},qr=_("action",[me.extend(xe),ht.extend(xe),wt.extend({...xe,action:n("stop")})]),ol=Gr(qr),nl=i({version:n(1),recordingId:t().uuid(),proofReady:n(!1),capture:i({captureId:t().uuid(),contentType:n("video/webm"),sha256:t().regex(/^[a-f0-9]{64}$/),sizeBytes:o().int().min(128).max(10485760),startedAt:y.datetime(),finishedAt:y.datetime(),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000),owner:i({runId:t().uuid(),deviceId:t().uuid(),rootId:t().uuid(),rootRevision:t().max(64),profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024),generation:t().uuid(),browserScope:t().max(128),tabId:o().int().positive()}).strict()}).strict().refine((e)=>e.receivedFrameCount>=e.frameCount&&Math.abs((Date.parse(e.finishedAt)-Date.parse(e.startedAt))/1000-e.durationSeconds)<=0.1)}).strict();var pl=me.extend({action:s(["start","inspect"]),recording_boot_generation:t().uuid(),recording_operation_id:t().uuid().optional(),recording_attempt_id:t().uuid().optional()}).strict();import{execFile as zr}from"child_process";import{promisify as Vr}from"util";var yl=Vr(zr);var Jr=s(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var j=t().min(1).max(1024),gt=i({path:j,sha256:t().regex(/^[a-f0-9]{64}$/)}).strict(),Yr=i({owner:i({runId:j,deviceId:j,rootId:j,rootRevision:j,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:j,generation:j,browserScope:j,tabId:o().int().positive()}).strict(),socketPath:j,extensionId:t().regex(/^[a-p]{32}$/),nativeHostName:j,seconds:o().int().min(1).max(15),encoder:i({ffmpeg:gt,ffprobe:gt}).strict()}).strict();var $l=i({version:n("0.1.42"),metadata:i({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var Xl=i({operationId:t().uuid()}).strict();var yd=ro(to);var _d=i({version:n("0.1.42"),metadata:i({extensionId:n(F),extensionInstanceId:t().min(1).max(1024)})});var Oe=1;var Uf=c({type:n("configure"),protocol:n(Oe),version:t(),config:B}),Ff=c({type:n("ticket"),organizationId:t().min(1).max(160),receipt:Te()}),jf=c({type:s(["ping","stop"])});var im=c({type:n("hello"),protocol:n(Oe),version:t(),platform:s(["linux","darwin"]),architecture:s(["arm64","x64"]),enrolled:d()}),am=c({type:n("ticket-request"),request:c({install_id:A(),code_challenge:t().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:s(["persistent","ephemeral"]),roots:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),execution_mode:s(["confined","host"]),permissions:c({read:n(!0),write:n(!0),execute:n(!0),discover_environment:n(!0),expose_mcp:n(!1)})})).length(1)})}),sm=_("type",[c({type:n("running"),deviceId:t().min(1).max(160),expiresAt:y.datetime({offset:!0}),lifetime:s(["persistent","ephemeral"]),supervision:n("ssh-foreground")}),c({type:n("pong")}),c({type:n("stopped")})]);var ko=1;var Z=A(),vo=c({kind:n("install_only"),authorityId:Z,organizationId:Z,userId:Z,connectionId:Z,attemptId:Z,purpose:n("install"),generation:o().int().positive(),transport:n("reverse_ssh"),expiresAt:y.datetime({offset:!0}),maxDurationMs:n(300000),maxChannels:n(1),allowTcpForwarding:n(!1),allowPty:n(!1)}),So=t().max(2048).superRefine((e,r)=>{let p;try{p=new URL(e)}catch{r.addIssue({code:"custom",message:"invalid relay url"});return}if(p.protocol!=="ws:"&&p.protocol!=="wss:"){r.addIssue({code:"custom",message:"invalid relay protocol"});return}if(p.username||p.password||p.search||p.hash){r.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let k=p.pathname.split("/");if(k.length!==4||k[1]!=="device"||!Z.safeParse(k[2]).success||!/^[a-f0-9]{64}$/.test(k[3]??""))r.addIssue({code:"custom",message:"invalid device relay path"});if(p.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(p.hostname))r.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var dm=c({protocol:n(ko),type:n("ssh_install_relay"),authorityToken:t().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:vo,relayUrl:So,endpoint:c({host:n("127.0.0.1"),port:n(22)})});class Et extends Error{}function De(e){if(!f(e))return null;let r=new Et(`${e} is not a valid worker config. Remove it to start over.`),p;try{p=JSON.parse(h(e))}catch(S){if(S instanceof SyntaxError)throw r;throw S}let k=B.safeParse(p);if(!k.success)throw r;return k.data}var Lo=200;var nh=c({version:n(1),session_ids:u(t().min(1).max(200)).max(Lo)});function Ke(e,r,p=!1){let k=Mo(e,r,p);return k.length===1?k[0]:J(ve(J(e,".config")),...Ct(r,p))}var Ct=(e,r)=>[...e==="production"?[]:[e],r?"connect-once":"connect"];function Mo(e,r,p=!1){let k=e;try{k=pe(e)}catch{}return["ara","reason"].map((S)=>J(k,".config",S,...Ct(r,p))).filter(To)}function To(e){try{if(pe(e)!==e)return!1;return De(J(e,"worker.json"))?.stateDirectory===e}catch{return!1}}var Do="disconnected.json";function jo(e,r){return f(J(Ke(e,r),Do))}function Wo(e,r){return r==="darwin"&&e.userChrome!==!1}var Mw=i({root:i({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});var Tw=Symbol("serve here");async function Uo(e={}){let r=pe(e.home??a()),p=De(J(Ke(r,e.channel??g()),"worker.json"));if(!p)return null;let k,S=await(e.controlWorker??G)(p,"status").catch((D)=>(k=D instanceof Error?D:Error(String(D)),null)),v=S?ot(p):null,P=e.serviceHost??be(r),R=qe(p,P,"connect"),E=H(p).revoked,L=!E&&!S,x=(()=>{try{return M(p)}catch{return null}})(),{workspaces:C,off:T}=E||ge(p.stateDirectory)!==null?{workspaces:null,off:null}:Ve(p,S?.phase==="running");return{workspaces:C,workspaces_off:T,workspaces_max:ze+(C?.filter((D)=>D.account).length??0),name:p.name,device_id:x?.deviceId??null,organization_id:x?.orgId??null,folder:p.workspaceRoot,mode:p.executionMode,sessions_max:null,user_chrome:Wo(p,P.platform),cloud_sessions:p.cloudSessions===!0,root:x?.roots[0]?{id:x.roots[0].id,permissions:x.roots[0].permissions}:null,roots:x?.roots.map((D)=>({id:D.id,folder:D.path,permissions:D.permissions}))??[],state:E?"removed":S?S.phase==="running"?"connected":S.phase:"not_running",not_running_reason:L?nt(p,k):null,worker_alive:L&&R?An(R,P):null,sessions_running:S?.activeSessions??null,version:v,service:R?{label:R.label,logs:R.logs}:null}}function Ho(e={}){let r=pe(e.home??a()),p=De(J(Ke(r,e.channel??g()),"worker.json"));if(!p)return null;return Dr(p,e.serviceHost??be(r),"connect")?.label??null}export{w,M,Xt,De,Ke,jo,Uo,Ho};

package/bin/vm-hands/vm-hands-entry-lite-vrqzr15t.js

@@ -1,3 +0,0 @@
-// @bun
-import{Ni,Li}from"./vm-hands-entry-lite-b885gwfh.js";function qo(o=process.platform){if(Ni(),o==="linux"||o==="win32")Li("strict")}
-export{qo};

package/bin/vm-hands/vm-hands-entry-lite-zjn2nsth.js

@@ -1,3 +0,0 @@
-// @bun
-import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{readdirSync as g,readFileSync as S}from"fs";import{userInfo as b}from"os";var Yt="--vm-hands-op-runner-kind=person";function P(n){let a=new Set([n]),i=[];try{i=g("/proc")}catch{}for(let t of i){if(!/^\d+$/.test(t))continue;try{let c=S(`/proc/${t}/stat`,"utf8");if(Number(c.slice(c.lastIndexOf(")")+2).split(" ")[3])===n)a.add(Number(t))}catch{}}for(let t of a)try{process.kill(t,"SIGKILL")}catch{}}var k=(n)=>{let a=globalThis.Bun;if(!a)throw new r("pty_unavailable","Reason terminals require the Bun runtime.");let i=a.spawn({cmd:[n.shell,...n.args],cwd:n.cwd,env:{...n.environment,TERM:"xterm-256color"},terminal:{cols:n.cols,rows:n.rows,data:(s,l)=>n.onData(l)}}),t=i.terminal,c=()=>{P(i.pid);try{t?.close()}catch{}};if(!t)throw c(),new r("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(s)=>t.write(s),resize:(s,l)=>t.resize(s,l),kill:c,exited:i.exited.then((s)=>typeof s==="number"?s:null,()=>null)}};function _(){let n=(()=>{try{return b().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...n?{USER:n,LOGNAME:n}:{}}}async function zo(){let[{executeLocalOperation:n,spawnCaptured:a},{runLocalPtySession:i},{configureDesktopAccount:t},{configureWorkerSandbox:c}]=await Promise.all([import("./local-capabilities-gkdh1z5z.js"),import("./local-pty-session-5f50sqq0.js"),import("./desktop-account-5v7x0ajx.js"),import("./worker-sandbox-smqj3mbe.js")]);c();let y=process.argv.includes(Yt),s=(p,e,m)=>a(p,e[0]==="-lic"?["-lc",...e.slice(1)]:e,m),l=(process.geteuid?.()??0)!==0,u=new Map,d=(p)=>{try{process.send?.(p)}catch{}};process.on("message",(p)=>{let e=p;if(e?.t==="cancel"){u.get(e.id)?.abort();return}if(e?.t!=="op")return;if(!l){d({t:"done",id:e.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let m=e.claim.capability;if(m==="pty.start"&&!y){d({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}let f=new AbortController;u.set(e.id,f);let w=m==="pty.start"?{runPtySession:(o)=>i(o,{spawnPty:k,environment:_(),loadProxy:()=>null})}:{worker:e.worker,...m==="exec.full"?{spawnFullControl:s}:{}};n(e.state,e.claim,{...w,signal:f.signal,emit:(o)=>{let{deliverySignal:h,...v}=o;d({t:"event",id:e.id,event:v})}}).then((o)=>d({t:"done",id:e.id,completion:o}),(o)=>d({t:"done",id:e.id,completion:{status:"failed",error_code:o&&typeof o==="object"&&"code"in o&&typeof o.code==="string"?o.code:"vm_hands_op_failed"}})).finally(()=>u.delete(e.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}
-export{Yt,zo};

package/bin/vm-hands/vm-hands-executor-a7aqej5n.js

@@ -1,11 +0,0 @@
-// @bun
-import"./vm-hands-entry-lite-k278g9kj.js";import"./vm-hands-entry-lite-8t9xssf9.js";import"./vm-hands-entry-lite-22kfyvnk.js";import"./vm-hands-entry-lite-m11j0f9q.js";import{Je,Ii,ur,vt}from"./vm-hands-entry-lite-7n60veqy.js";import"./vm-hands-entry-lite-f5e3dbgk.js";import"./vm-hands-entry-lite-9c95p6n9.js";import"./vm-hands-entry-lite-gvwdy3rf.js";import"./vm-hands-entry-lite-t7an5zg2.js";import"./vm-hands-entry-lite-88swf2qr.js";import"./vm-hands-entry-lite-ckv17tn8.js";import"./vm-hands-entry-lite-q0k6kx6d.js";import"./vm-hands-entry-lite-bdhjpv7g.js";import{Yt}from"./vm-hands-entry-lite-zjn2nsth.js";import"./vm-hands-entry-lite-09m2cdkw.js";import"./vm-hands-entry-lite-89z488gz.js";import"./vm-hands-entry-lite-9ay6f56v.js";import{spawn as De}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as U,lstatSync as V,mkdirSync as ee,mkdtempSync as Ae,readdirSync as Z,readFileSync as P,realpathSync as Te,rmdirSync as ne,rmSync as ze,writeFileSync as K}from"fs";import{join as p}from"path";import{readFileSync as ae,readlinkSync as ce}from"fs";import{relative as $e}from"path";var le=16;function de(n){return n.replace(/\\([0-7]{3})/g,(r,i)=>String.fromCharCode(Number.parseInt(i,8)))}function Ie(n){let r=[];for(let i of n.split(`
-`)){let e=i.split(" ");if(e.length<10||!/^\d+:\d+$/.test(e[2]))continue;r.push({device:e[2],root:de(e[3]),mountPoint:de(e[4])})}return r}function Ne(n,r,i){let e=n.replace(/\/+$/,"")||"/",c=(m)=>e==="/"||m===e||m.startsWith(`${e}/`),a=(m)=>new Map(Ie(m).filter((b)=>c(b.mountPoint)).map((b)=>[`${b.mountPoint}\x00${b.device}\x00${b.root}`,b.mountPoint])),l=a(r),v=a(i),y=(m)=>$e(e,m)||".",O=[...l].filter(([m])=>!v.has(m)).map(([,m])=>y(m)),R=[...v].filter(([m])=>!l.has(m)).map(([,m])=>y(m));return{missing:O,extra:R,referenceCount:l.size,ownCount:v.size}}function ue(n,r,i,e="/proc"){let c,a,l=null;try{c=ae(`${e}/1/mountinfo`,"utf8"),a=ae(`${e}/self/mountinfo`,"utf8")}catch(b){let I=b&&typeof b==="object"&&"code"in b&&typeof b.code==="string"?b.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:I});return}try{l=ce(`${e}/1/ns/mnt`)===ce(`${e}/self/ns/mnt`)}catch{}let{missing:v,extra:y,referenceCount:O,ownCount:R}=Ne(n,c,a),m={reference_count:O,own_count:R,missing_count:v.length,extra_count:y.length,same_namespace:l};if(y.length)r("vm_hands.mount_extra",{...m,extra:y.slice(0,le)});if(v.length)throw r("vm_hands.mount_mismatch",{...m,missing:v.slice(0,le)}),i(`${v.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var we="/sys/fs/cgroup/reason-payload",M="vm-hands",We="/run/ara-srt/fallbacks.jsonl",B="/reason-person",te=5000,Be=1e4,pe="__VM_HANDS_PROOF_DIR__",Ke="__VM_HANDS_PROBE_NONCE__";class h extends Error{code;constructor(n,r){super(r);this.code=n}}function je(n,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new h("vm_hands_bind_invalid","bad bind id");return p(n,M,`b-${r.toLowerCase()}`)}var He=5000,ve=(n)=>`'${n.replaceAll("'","'\\''")}'`;function on(n){let r=n.cgroup??we,i=n.init.layout.payload_uid,e=n.log??(()=>{}),c=new Map,a=new Map,l=0,v=()=>{try{let t=P("/run/ara-srt/starts.jsonl","utf8"),o=t.slice(l>t.length?0:l).split(`
-`).filter(Boolean);l=t.length;let d=o.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(d.length)e("vm_hands.srt_server_starts",{count:d.length,elapsed_ms:d.slice(0,8)})}catch{}},y=null,O=!1,R=n.srtCgroup??"/sys/fs/cgroup/reason-srt",m=()=>{y??=me()},b=0,I=()=>{try{let t=P(We,"utf8"),o=t.slice(b>t.length?0:b);b=t.length;let d=o.split(`
-`).filter(Boolean).slice(0,1000);if(!d.length)return null;let f={},g=0;for(let w of d)try{let _=JSON.parse(w),u=typeof _.code==="string"&&/^[a-z_]{1,40}$/.test(_.code)?_.code:"other";if(f[u]=(f[u]??0)+1,typeof _.elapsed_ms==="number")g=Math.max(g,_.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return e("vm_hands.srt_fallbacks",{count:d.length,codes:f,max_elapsed_ms:g}),{count:d.length,codes:f,max_elapsed_ms:g}}catch{return null}},S=!1,j=(t,o,d)=>{if(S)throw Error("vm_hands_pool_held");return Ce(t,o,d)},X=(t)=>(o,d,f)=>De("/bin/sh",["-c",`echo $$ > ${ve(p(t,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",o,...d],f),Ce=X(p(r,M)),H=p(r,M,"probe"),z=(t)=>je(r,t),Oe=(t)=>{let o=z(t);try{ee(o,{mode:493})}catch(d){if(!(d&&typeof d==="object"&&("code"in d)&&d.code==="EEXIST"))throw new h("vm_hands_bind_failed","bind cgroup")}return o},Re=(t)=>{try{ne(z(t))}catch{}},D=n.prespawn?Ii({spawnProcess:j,...n.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:n.relayDependencies.sourceEntrypoint}:{},log:(t,o)=>e(t,o??{})}):null;D?.arm();let Q=D?setInterval(()=>{D.arm()},He):null;Q?.unref?.();async function F(t){let o=c.get(t);if(c.delete(t),!o)return;o.abort.abort(),await o.done}return{bindCgroup:z,async startExecutor(t){if(m(),a.set(t.bindId,me()),O=!0,!t.claim)throw new h("vm_hands_bind_invalid","an executor needs the claim it serves");await F(t.bindId);let{claim:o,bindId:d}=t,f=Oe(d),g=o.owner;if(!g||typeof g.device_id!=="string"||typeof o.root_id!=="string")throw new h("vm_hands_bind_invalid","claim without its owner Device or root");let w=new AbortController,_,u,x=new Promise((s,k)=>{_=s,u=k}),L,C=new Promise((s)=>{L=s}),W=vt({headless:!0,hostExecution:!0,runtimeDirectory:n.runtimeDirectory,deviceIdentity:{deviceId:g.device_id,rootId:o.root_id,apiOrigin:n.apiOrigin},claimOwner:o.owner,root:n.root,runId:o.run_id,operationId:o.operation_id,attemptId:o.attempt_id,payload:Object.fromEntries(Object.entries(o.payload).filter(([s])=>!s.startsWith("vm_hands_"))),signal:w.signal,...t.workspaceGrant?{workspaceGrant:t.workspaceGrant}:{},emitEvent:async(s,k)=>{if(s==="hands.ready"){_(k);return}if(s==="hands.started"||s==="hands.stopped"||s==="hands.failed")return;await n.forward(d,s,k)}},{...n.relayDependencies,spawnWorker:(s)=>X(f)(s.command,s.args,s.options),...D?{takePrespawnedWorker:(s)=>{let k=D.take(s);if(!k?.pid)return k;try{return K(p(f,"cgroup.procs"),String(k.pid)),k}catch{try{k.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:D.adopt}:{}}).then(()=>{L("executor_stopped")},(s)=>{let k=s&&typeof s==="object"&&"code"in s?String(s.code):"executor_failed";u(new h(k,s instanceof Error?s.message:String(s))),L(k)}).finally(()=>u(new h("vm_hands_executor_exited","executor ended before it was ready")));c.set(d,{abort:w,done:W,exited:C,operationId:o.operation_id,runId:o.run_id,expiresAtMs:Date.parse(String(o.payload.expires_at??""))||0});let A=await x,G=A.executor_launch_id;if(typeof G!=="string")throw new h("vm_hands_bind_failed","executor ready without a launch id");return{launchId:G,readyData:A,applied:{hands_confinement:typeof o.payload.hands_confinement==="string"?o.payload.hands_confinement:null,browser_egress:o.payload.browser_egress??null}}},takeSrtFallbacks:I,executorExited(t){return c.get(t)?.exited??new Promise(()=>{})},freezeBind(t){let o=z(t);if(U(p(o,"cgroup.freeze")))K(p(o,"cgroup.freeze"),"1")},async killAndVerifyPayload(t){let o=new Set(t?.keep??[]);if(o.size||t?.own)return xe(t?.bindId??null,o,t?.own===!0);S=!0;let d=he();try{await ye();let f=Promise.all([...c.keys()].map((u)=>F(u).catch(()=>{return})));v();let g=Date.now()+te;await J(r,g,"payload"),await f;let w=(O||n.srtWarmLate?.()===!0)&&U(p(R,"cgroup.events"));if(w)await J(R,g,"srt");let _=se(i).filter((u)=>!N(u,B));if(y!==null){let u=re(y).filter((x)=>x!==process.pid&&!N(x,B));if(u.length)throw e("vm_hands.kill_strays",{strays:E(u)}),new h("vm_hands_kill_unverified",`${u.length} process(es) the run started survived it`);y=null}if(O=!1,w)n.onSrtReset?.();if(_.length)throw e("vm_hands.kill_survivors",{pids:_.slice(0,16)}),new h("vm_hands_kill_unverified",`${_.length} payload-uid process(es) outside the payload cgroup`);a.clear();for(let u of ie())try{ne(p(r,M,u))}catch{}}finally{S=!1,d()}if(D)setTimeout(()=>{if(!c.size)D.arm()},100).unref?.()},async killProbe(){let t=Date.now()+te;if(U(p(H,"cgroup.events"))){await J(H,t,"probe");try{ne(H)}catch{}}let o=oe(process.pid);if(o===null)throw new h("vm_hands_kill_unverified","agent start time unreadable");await Ue(r,o,t);let d=(g)=>{let w=oe(g);return w!==null&&w<=o},f=se(i).filter((g)=>d(g)&&!N(g,B));if(f.length)throw e("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest"}),new h("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(y!==null){let g=[r,p(r,M)].map((u)=>u.replace(/^\/sys\/fs\/cgroup/,"")),w=R.replace(/^\/sys\/fs\/cgroup/,""),_=re(y).filter((u)=>u!==process.pid&&!N(u,B)&&!N(u,"/reason-vm-hands")&&!N(u,w)&&!g.some((x)=>fe(u,x)));if(_.length&&O)throw e("vm_hands.kill_strays",{strays:E(_),at:"attest"}),new h("vm_hands_kill_unverified",`${_.length} process(es) the run started survived it`);if(_.length)e("vm_hands.attest_concurrent",{processes:E(_),count:_.length});y=null}},async runProbe({nonce:t,script:o}){if(m(),!o.includes(pe))throw new h("vm_hands_probe_failed","probe names no proof directory");let d=n.proofParent??"/tmp/reason-vm-hands-proof";ee(d,{mode:457,recursive:!0});let f=V(d);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new h("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Ae(p(d,"p-")),w=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(t))throw new h("vm_hands_probe_failed","proof directory path or nonce");Le(g,i,i),Me(g,448);let _=V(g).ino;try{ee(H,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new h("vm_hands_probe_failed","probe cgroup")}let u=X(H)("/bin/bash",["-c",o.replaceAll(pe,g).replaceAll(Ke,t)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),x="";u.stdout?.on("data",(C)=>{if(x.length<16384)x+=C.toString("utf8").slice(0,16384-x.length)});let L=await new Promise((C)=>{let W=setTimeout(()=>{w=!0,u.kill("SIGKILL"),C(124)},Be);u.once("error",()=>{clearTimeout(W),C(127)}),u.once("close",(A)=>{clearTimeout(W),C(A??1)})});return e("vm_hands.probe",{nonce_len:t.length,exit_code:L}),{exitCode:L,markers:x,proofDirInode:_}}finally{if(!w)ze(g,{recursive:!0,force:!0})}},restatLayout(){let{session_root:t,alias:o}=n.init.layout,d="invalid";try{ur(t),d="0:0:755"}catch{}let f=!1,g=-1;try{let w=V(o);g=w.uid,f=d==="0:0:755"&&o===p(t,"repo")&&!w.isSymbolicLink()&&w.isDirectory()&&Te(o)===o&&w.uid===i}catch{}return{root_mode:d,alias_ok:f,owner_uid:g}},verifyMounts(){ue(n.init.layout.session_root,e,(t)=>new h("vm_hands_mount_mismatch",t))},installEnvironment(t,o){let d=c.get(t);if(!d)throw new h("environment_unavailable","no executor owns an environment");return Je({root:n.root,operationId:d.operationId,payload:o}).installed_revision},async stop(){if(Q)clearInterval(Q);D?.close(),await Promise.all([...c.keys()].map((t)=>F(t)))}};function ie(){try{return Z(p(r,M),{withFileTypes:!0}).filter((t)=>t.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(t.name)).map((t)=>t.name)}catch{return[]}}async function xe(t,o,d=!1){let f=new Set([...o].map((w)=>w.toLowerCase())),g=he();try{await ye();let w=Date.now()+te,_=new Set(ie().filter((s)=>!f.has(s.slice(2))).map((s)=>s.slice(2)));if(t)_.add(t.toLowerCase());let u=null;for(let s of _){let k=F(s).catch(()=>{return}),q=a.get(s);if(q!==void 0)u=u===null?q:Math.min(u,q);if(U(p(z(s),"cgroup.events")))await J(z(s),w,"bind");await k}let x=[...f].map((s)=>z(s).replace(/^\/sys\/fs\/cgroup/,"")),L=[r,p(r,M)].map((s)=>s.replace(/^\/sys\/fs\/cgroup/,"")),C=R.replace(/^\/sys\/fs\/cgroup/,""),W=(s)=>N(s,B)||x.some((k)=>N(s,k)),A=d?[]:se(i).filter((s)=>!W(s));if(A.length)throw e("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size}),new h("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let G=(s)=>!W(s)&&!N(s,"/reason-vm-hands")&&!N(s,C)&&!L.some((k)=>fe(s,k));if(u!==null){let s=re(u).filter((k)=>k!==process.pid&&G(k));if(s.length)throw e("vm_hands.kill_strays",{strays:E(s),beside:f.size}),new h("vm_hands_kill_unverified",`${s.length} process(es) the run started survived it`)}for(let s of _)a.delete(s),Re(s)}finally{g()}}}function oe(n,r="/proc"){try{let i=P(p(r,String(n),"stat"),"utf8"),e=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(e)?e:null}catch{return null}}function be(n,r="/proc"){try{let i=P(p(r,String(n),"stat"),"utf8"),e=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(e)?e:null}catch{return null}}async function Ue(n,r,i){try{K(p(n,"cgroup.freeze"),"1")}catch(e){throw new h("vm_hands_kill_unverified",`payload cgroup.freeze: ${e instanceof Error?e.message:String(e)}`)}try{for(;;){let e=Se(n).filter((a)=>ke(a,n)),c=new Set(e.filter((a)=>{let l=oe(a);return l!==null&&l<=r}));for(let a=!0;a;){a=!1;for(let l of e){if(c.has(l))continue;let v=be(l);if(v!==null&&c.has(v))c.add(l),a=!0}}if(c.size===0)return;if(Date.now()>i)throw new h("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let a of c)try{process.kill(a,"SIGKILL")}catch{}await new Promise((a)=>setTimeout(a,10))}}finally{try{K(p(n,"cgroup.freeze"),"0")}catch{}}}function fe(n,r,i="/proc"){try{return P(p(i,String(n),"cgroup"),"utf8").split(`
-`).find((c)=>c.startsWith("0::"))?.slice(3)===r}catch{return!1}}function N(n,r,i="/proc"){try{let c=P(p(i,String(n),"cgroup"),"utf8").split(`
-`).find((a)=>a.startsWith("0::"))?.slice(3)??"";return c===r||c.startsWith(`${r}/`)}catch{return!1}}var Fe=100;function me(){try{return Math.floor(Number(P("/proc/uptime","utf8").split(" ")[0])*Fe)}catch{return 0}}async function J(n,r,i){try{K(p(n,"cgroup.freeze"),"1")}catch(e){throw new h("vm_hands_kill_unverified",`${i} cgroup.freeze: ${e instanceof Error?e.message:String(e)}`)}while(!/^populated 0$/m.test(P(p(n,"cgroup.events"),"utf8"))){if(Date.now()>r)throw new h("vm_hands_kill_unverified",`${i} cgroup still populated (left frozen)`);for(let e of Se(n)){if(!ke(e,n))continue;try{process.kill(e,"SIGKILL")}catch{}}await new Promise((e)=>setTimeout(e,10))}try{K(p(n,"cgroup.freeze"),"0")}catch(e){throw new h("vm_hands_kill_unverified",`${i} cgroup thaw: ${e instanceof Error?e.message:String(e)}`)}}function ke(n,r){let i=r.replace(/^\/sys\/fs\/cgroup/,"")||"/",e="";try{e=P(`/proc/${n}/cgroup`,"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??""}catch{return!1}let c=e.slice(3);return c===i||c.startsWith(`${i}/`)}function Se(n){let r=[],i=(e)=>{try{for(let a of P(p(e,"cgroup.procs"),"utf8").split(`
-`))if(/^\d+$/.test(a))r.push(Number(a))}catch{}let c=[];try{c=Z(e,{withFileTypes:!0}).filter((a)=>a.isDirectory()).map((a)=>a.name)}catch{}for(let a of c)i(p(e,a))};return i(n),r}function E(n,r="/proc"){return n.slice(0,16).map((i)=>{let e="?",c="?";try{e=P(p(r,String(i),"comm"),"utf8").trim().slice(0,32)}catch{}try{c=(P(p(r,String(i),"cgroup"),"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:i,comm:e,ppid:be(i,r),cgroup:c}})}function re(n,r="/proc"){let i=[];for(let e of Z(r)){if(!/^\d+$/.test(e))continue;let c;try{c=P(p(r,e,"stat"),"utf8")}catch{continue}let a=c.slice(c.lastIndexOf(")")+2).split(" "),l=Number(a[1]),v=Number(a[6]),y=Number(a[19]);if(!((v&2097152)!==0||l===2||e==="2")&&a[0]!=="Z"&&y>=n)i.push(Number(e))}return i}function se(n,r="/proc"){let i=[];for(let e of Z(r)){if(!/^\d+$/.test(e))continue;let c;try{c=P(p(r,e,"status"),"utf8")}catch{continue}let a=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(c);if(a&&a.slice(1).some((l)=>Number(l)===n))i.push(Number(e))}return i}function ge(n="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(P(n,"utf8").trim())>=1}catch{return!1}}var T=0,Pe=[],Y=new Set;function he(){T++;let n=!1;return()=>{if(n)return;if(n=!0,--T===0)for(let r of Pe.splice(0))r()}}function Ge(){return T===0?Promise.resolve():new Promise((n)=>{Pe.push(n)})}async function _e(){while(T>0)await Ge()}async function ye(){let n=Date.now()+1000;while(Y.size&&Date.now()<n)await new Promise((r)=>setTimeout(r,2))}function Ee(n,r){let i=r.replace(/^\/sys\/fs\/cgroup/,"");Y.add(n);let e=()=>{let c="";try{c=P(`/proc/${n}/cgroup`,"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??""}catch{Y.delete(n);return}if(c.slice(3)===i){Y.delete(n);return}setTimeout(e,1)};e()}function an(n){let r={person:n.personCgroup??p("/sys/fs/cgroup",B,M),model:n.payloadCgroup??p(we,M)},i=n.entry??process.argv[1]??"",e={},c=(l)=>l.startsWith("model:")&&n.bindCgroup?n.bindCgroup(l.slice(6)):r[l.startsWith("model")?"model":"person"],a=(l)=>{let v=l.startsWith("model")?"model":"person",y=new Map,O=String(n.payloadUid),R=String(n.payloadGid),m=Bun.spawn(["/bin/sh","-c",`echo $$ > ${ve(p(c(l),"cgroup.procs"))} || exit 125; exec /usr/bin/setpriv --no-new-privs --reuid=${O} --regid=${R} --clear-groups -- "$@"`,"vm-hands-op-join",process.execPath,"--no-install",i,"--vm-hands-op-runner",...v==="person"?[Yt]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:"/home/runner",...U("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(I){let S=I,j=y.get(S.id);if(!j)return;if(S.t==="event"&&S.event)j.onEvent(S.event);if(S.t==="done")y.delete(S.id),j.done(S.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});m.exited.then((I)=>{if(e[l]?.child===m)delete e[l];for(let[,S]of y)S.done({status:"failed",error_code:"vm_hands_op_runner_exited"});y.clear(),n.log?.("vm_hands.op_runner_exited",{kind:v,code:I})}),Ee(m.pid,c(l));let b={child:m,pending:y};return e[l]=b,b};return{run(l,v,y,O,R){if(!ge())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=l==="model"&&R&&n.bindCgroup?`model:${R.toLowerCase()}`:l,b=async()=>{while(!e[m]&&T>0)await _e()};return b().then(async()=>{if(!e[m]&&T>0)await b()}).then(()=>new Promise((I)=>{if(!e[m]&&T>0){I({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let S=e[m]??a(m);S.pending.set(v.id,{onEvent:y,done:I}),O.addEventListener("abort",()=>{try{S.child.send({t:"cancel",id:v.id})}catch{}},{once:!0});try{S.child.send({t:"op",...v})}catch{S.pending.delete(v.id),I({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(l){if(!e[l]&&ge())_e().then(()=>{if(!e[l]&&T===0)a(l)})},stop(){for(let l of Object.keys(e))e[l]?.child.kill()}}}export{we as VM_HANDS_PAYLOAD_CGROUP,M as VM_HANDS_PAYLOAD_JOIN,B as VM_HANDS_PERSON_CGROUP,Ke as VM_HANDS_PROBE_NONCE_TOKEN,pe as VM_HANDS_PROOF_DIR_TOKEN,h as VmHandsExecutorError,on as createVmHandsExecutor,an as createVmHandsOpRunners,E as describeProcesses,N as inCgroup,se as payloadUidProcesses,re as processesStartedSince,ge as ptraceProtected,Se as subtreePids,je as vmHandsBindCgroup};

package/bin/vm-hands/vm-hands-op-runner-k4n3zrqb.js

@@ -1,2 +0,0 @@
-// @bun
-import{Yt,zo}from"./vm-hands-entry-lite-zjn2nsth.js";export{Yt as VM_HANDS_OP_RUNNER_PERSON_ARG,zo as runVmHandsOpRunner};

package/bin/vm-hands/vm-hands-runtime-z6ydmvqc.js

@@ -1,4 +0,0 @@
-// @bun
-import{Ge}from"./vm-hands-entry-lite-k278g9kj.js";import{wi,Xr,bi}from"./vm-hands-entry-lite.js";import{spawn as G}from"child_process";import{createHash as z}from"crypto";import{lstatSync as E,mkdirSync as K,readFileSync as W,statSync as X,writeFileSync as F}from"fs";var v="/run/reason-vm-hands",D="/run/reason-vm-hands/env",A="/home/runner/.reason/workspace",J=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,V="/sys/fs/cgroup/reason-srt",q=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],Q=65536,Z=21600000;function ee(r,e="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;K(e,{recursive:!0,mode:448});let n=E(e);if(!n.isDirectory()||n.uid!==0||(n.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}F(`${e}/base-keyed`,`1
-`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function C(r,e){let n=(c)=>(e("srt_warm_skipped",{reason:c}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return n("no_settings");let o=Buffer.from(r.srt_base_settings,"base64");if(o.length===0||o.length>Q||o.toString("base64")!==r.srt_base_settings)return n("settings_invalid");let a;try{let c=E(V);if(!c.isDirectory()||c.uid!==0||(c.mode&18)!==0)return n("cgroup_unsafe");let p=q.find((f)=>E(f,{throwIfNoEntry:!1})!==void 0);if(!p)return n("cgroup_or_exec_missing");a=p;for(let[f,w]of[[a,!1],["/usr/local/bin",!0]]){let u=E(f);if((w?!u.isDirectory():!u.isFile())||u.uid!==0||(u.mode&18)!==0)return n("srt_exec_unsafe")}}catch{return n("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return n("not_root");let i=performance.now(),R=z("sha256").update(o).digest("hex"),S=`${v}/srt-base-settings.json`;try{F(S,o,{mode:384,flag:"w"})}catch{return n("settings_write")}let g=G("/bin/sh",["-c",`echo $$ > ${V}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",S,"--idle-ms",String(Z),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((c)=>{g.once("error",()=>{e("srt_warm_failed",{reason:"spawn"}),c()}),g.once("close",(p)=>{e(p===0?"srt_warm_done":"srt_warm_failed",{exit_code:p,warm_ms:Math.round(performance.now()-i),settings_sha256:R}),c()})})}var M=3000;function pe(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let e=r,{layout:n,device_key:o,credential:a}=e;return typeof e.workspace_id==="string"&&Number.isSafeInteger(e.instance_generation)&&typeof e.api_origin==="string"&&J.test(e.api_origin)&&typeof e.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!n&&typeof n.session_root==="string"&&typeof n.alias==="string"&&Number.isSafeInteger(n.payload_uid)&&typeof n.kind==="string"&&!!o&&typeof o.pkcs8==="string"&&typeof o.spki==="string"?e:null}function L(r){K(r,{recursive:!0,mode:448});let e=X(r);if(!e.isDirectory()||(e.mode&63)!==0||e.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ne(r){let[{CLI_VERSION:e},n,o,a]=await Promise.all([import("./version-4bsjs55h.js"),import("./hands-worker-source-cgrpm21b.js"),import("./network-contract-9x9kc5vv.js"),import("./device-workspace-p9q9dckg.js")]),{REASON_HANDS_PROTOCOL_VERSION:i}=await import("./reason-hands-protocol-2tnghj3b.js");return{reason_runtime_version:e,bridge_version:e,protocol_version:Ge,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:n.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:n.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:o.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:o.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:o.HANDS_SESSION_GROUP,worker_version:n.REASON_HANDS_WORKER_VERSION,protocol_version:i,worker_artifact_sha256:n.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:n.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:o.HANDS_ENVIRONMENT_DELIVERY,[o.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:o.HANDS_ENVIRONMENT_AT_CLAIM,[o.HANDS_CLOUD_ACCESS_KEY]:o.HANDS_CLOUD_ACCESS,[o.HANDS_LARGE_ENVIRONMENT_KEY]:o.HANDS_LARGE_ENVIRONMENT,[o.HANDS_CONFINEMENT_KEY]:o.HANDS_CONFINEMENT,[o.HANDS_JOBS_USER_KEY]:o.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var k=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],te=new Set(["pty.start","jobs.control"]);function re(r,e){let n=e([{id:"vm-hands",label:"workspace",path:A,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(k.map((i)=>[i,!0]))}}),o=r.capabilities,a={...o.operation_constraints};for(let i of k)a[i]={...n.operation_constraints?.[i]??{},ready:!0,execution_mode:n.operation_constraints?.[i]?.execution_mode??"host"};return{...r,capabilities:{...o,supported_operations:["hands.connect",...k],operation_constraints:a}}}function oe(r){for(let e of W("/etc/passwd","utf8").split(`
-`)){let n=e.split(":");if(n.length>=4&&Number(n[2])===r&&/^\d+$/.test(n[3]??"")&&Number(n[3])>0)return Number(n[3])}throw Error("vm_hands_payload_account_unavailable")}function se(r,e){let n=e.owner;if(!n||typeof n.organization_id!=="string"||typeof n.device_id!=="string"||typeof e.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:n.organization_id,deviceId:n.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:e.root_id,label:"workspace",path:A,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function ae(r=process.platform,e="/proc/self/oom_score_adj"){if(r!=="linux")return null;let n;try{n=W(e,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(n))return{value:"unreadable"};let o=Number(n);return o<0?{value:o}:null}async function fe(r,e){let n=ae();if(n)e("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:n.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});L(v),L(D),ee(e);let o=C(r,e),a=!1,i=async()=>{if(!await Promise.race([o.then(()=>!0),new Promise((s)=>setTimeout(()=>s(!1),M).unref?.())]))a=!0,e("srt_warm_late",{wait_ms:M})},[{configureDesktopAccount:R},{configureWorkerSandbox:S}]=await Promise.all([import("./desktop-account-5v7x0ajx.js"),import("./worker-sandbox-smqj3mbe.js")]);S();try{R({value:String(r.layout.payload_uid)})}catch{e("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let g=new AbortController;for(let t of["SIGTERM","SIGINT"])process.on(t,()=>g.abort());let c=new Map,p,f=new Promise((t)=>{p=t}),w=f.then(()=>import("./vm-hands-executor-a7aqej5n.js")).then(({createVmHandsExecutor:t})=>{let s=t({init:r,root:A,runtimeDirectory:v,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,o=C(r,e)},srtWarmLate:()=>a,forward:(_,d,y)=>c.get(_)?.(d,y)??Promise.reject(Error("vm_hands_not_bound")),log:(_,d)=>e(_,d)});return e("executor_loaded"),s}),u=(t)=>async(...s)=>(await w)[t](...s),h=null;w.then((t)=>{h=(s)=>t.executorExited(s)});let m={startExecutor:async(...t)=>(await i(),u("startExecutor")(...t)),killAndVerifyPayload:u("killAndVerifyPayload"),killProbe:u("killProbe"),runProbe:async(...t)=>(await i(),u("runProbe")(...t)),restatLayout:()=>{throw Error("replaced below")},verifyMounts:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(t)=>h?h(t):new Promise(()=>{}),takeSrtFallbacks:()=>null};w.then((t)=>{m.restatLayout=()=>t.restatLayout(),m.verifyMounts=()=>t.verifyMounts(),m.installEnvironment=(s,_)=>t.installEnvironment(s,_),m.freezeBind=(s)=>t.freezeBind(s),m.takeSrtFallbacks=()=>t.takeSrtFallbacks?.()??null});let B=await wi(r),Y=new Xr(r,B,m,{envRoot:D}),x=ne(r),I=null,U=Promise.all([x,import("./local-capabilities-gkdh1z5z.js")]).then(([t,s])=>{I=re(t,s.capabilityInventoryForRoots),e("device_ops_loaded")}).catch((t)=>e("device_ops_unavailable",{error:t instanceof Error?t.name:"error"})),N=f.then(()=>import("./vm-hands-executor-a7aqej5n.js")).then(({createVmHandsOpRunners:t,vmHandsBindCgroup:s,VM_HANDS_PAYLOAD_CGROUP:_})=>t({payloadUid:r.layout.payload_uid,payloadGid:oe(r.layout.payload_uid),bindCgroup:(d)=>s(_,d),log:(d,y)=>e(d,y)})).catch(()=>null);N.then((t)=>t?.warm("person")),e("agent_ready"),await bi({apiOrigin:r.api_origin,agent:Y,signal:g.signal,heartbeat:async()=>I??await x,executeOp:async({kind:t,claim:s,bindId:_,signal:d,emit:y})=>{let O=se(r,s);if(!O)return{status:"failed",error_code:"vm_hands_bind_invalid"};let H={executionMode:"unsandboxed",runtimeDirectory:v,readiness:Object.fromEntries(k.map((l)=>[l,!0]))},P=(l)=>{let b=typeof l.kind==="string"?l.kind:"";if(b)y({kind:b,...l.data&&typeof l.data==="object"?{data:l.data}:{}})};if(s.capability==="exec.full"&&t!=="person")return{status:"failed",error_code:"capability_not_granted"};if(s.capability==="automation.call.v1"&&t!=="model")return{status:"failed",error_code:"capability_not_granted"};let j=s.capability==="pty.start"&&t==="person"&&!s.authority;if(te.has(String(s.capability))&&!j){let{executeLocalOperation:l}=await import("./local-capabilities-gkdh1z5z.js");return l(O,s,{worker:H,signal:d,emit:(b)=>P(b)})}let T=await N;if(!T)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return T.run(t,{id:String(s.attempt_id),claim:s,state:O,worker:H},P,d,_)},readyData:({launchId:t})=>({executor_launch_id:t}),log:(t,s)=>{if(t==="vm_hands.registered"||t==="vm_hands.reconnected")p();e(t,s)},onTurn:(t,s)=>{if(s)c.set(t,s);else c.delete(t)}}),await(await w).stop(),(await N)?.stop()}export{pe as parseVmHandsInit,fe as runVmHands};

package/bin/vm-hands/worker-sandbox-smqj3mbe.js

@@ -1,2 +0,0 @@
-// @bun
-import{qo}from"./vm-hands-entry-lite-vrqzr15t.js";import"./vm-hands-entry-lite-b885gwfh.js";import"./vm-hands-entry-lite-88swf2qr.js";import"./vm-hands-entry-lite-9ay6f56v.js";import"./vm-hands-entry-lite-m11j0f9q.js";export{qo as configureWorkerSandbox};