@reason-machines/cli-linux-x64 0.2.419 → 0.2.420

package/bin/vm-hands/vm-hands-entry-lite-s823n1q9.js

@@ -1,3 +0,0 @@
-// @bun
-import{wh as d}from"./vm-hands-entry-lite-ntx8fdyq.js";import{yh as h}from"./vm-hands-entry-lite-agsp101y.js";import{Gh as p}from"./vm-hands-entry-lite-9qep7pka.js";import{Zj as s}from"./vm-hands-entry-lite-6nwbqg37.js";import{kk as i}from"./vm-hands-entry-lite-feybcq63.js";import{pl as P}from"./vm-hands-entry-lite-0k13wmzm.js";import{ql as V}from"./vm-hands-entry-lite-magmzx9c.js";import{existsSync as U,realpathSync as l,statSync as e}from"fs";import{platform as f}from"os";import{isAbsolute as r,sep as zz}from"path";import{existsSync as n}from"fs";import{createRequire as t}from"module";var E=P(h)(()=>t(import.meta.url)("bun:ffi"),n);function m(){return process.platform==="win32"&&typeof globalThis.Bun<"u"&&E.available()}function w(z=process.env){return E.defaultShell(z)}function k(z){return E.shellArgs(z)}function v(z){let H=E.spawn({...z,env:z.environment});return H.exited.then(()=>H.close()),{write:(Q)=>H.write(Q),resize:(Q,J)=>H.resize(Q,J),kill:()=>H.close(),exited:H.exited}}var Hz=43200000,y=p,Jz=4,Qz=/^[A-Za-z0-9._:-]{1,160}$/,Vz=1000;function u(z){return Boolean(z)&&typeof z==="object"&&!Array.isArray(z)}function g(z,H){if(typeof z!=="number"||!Number.isFinite(z)||z<=0)return H;return Math.min(Vz,Math.max(1,Math.floor(z)))}function Zz(z,H=Date.now()){let Q=["relay_url","session_id","expires_at"],J=new Set([...Q,"cols","rows","cwd","workspace"]);if(!u(z)||Q.some((C)=>!(C in z))||Object.keys(z).some((C)=>!J.has(C)))throw new V("invalid_pty_request","Reason terminal request is malformed.");let{relay_url:N,session_id:Y,expires_at:R}=z;if(typeof N!=="string")throw new V("invalid_pty_request","Reason terminal relay URL is missing.");let K;try{K=new URL(N)}catch{throw new V("invalid_pty_request","Reason terminal relay URL is invalid.")}if(K.protocol!=="wss:"&&K.protocol!=="ws:"||K.username||K.password)throw new V("invalid_pty_request","Reason terminal relay URL is invalid.");if(typeof Y!=="string"||!Qz.test(Y))throw new V("invalid_pty_request","Reason terminal session identity is invalid.");let D=typeof R==="string"?Date.parse(R):Number.NaN;if(!Number.isFinite(D)||D<=H)throw new V("invalid_pty_request","Reason terminal session has already expired.");if(z.cwd!==void 0&&typeof z.cwd!=="string")throw new V("invalid_pty_request","Reason terminal working directory is invalid.");let j=z.workspace===void 0?void 0:i(z.workspace);if(j===null||j&&z.cwd!==void 0)throw new V("invalid_pty_request","Reason terminal workspace is invalid.");return{relay_url:N,session_id:Y,expires_at:new Date(Math.min(D,H+Hz)).toISOString(),cols:g(z.cols,80),rows:g(z.rows,24),...z.cwd===void 0?{}:{cwd:z.cwd},...j?{workspace:j}:{}}}function $z(z,H){if(f()==="win32")[z,H]=[z.toLowerCase(),H.toLowerCase()];return H===z||H.startsWith(z+zz)}function c(z,H){if(H===void 0)return z;if(!r(H))throw new V("pty_cwd_invalid","Reason terminal working directory must be absolute.");let Q;try{Q=l(H)}catch{throw new V("pty_cwd_invalid","Reason terminal working directory does not exist.")}if(!$z(z,Q))throw new V("pty_cwd_outside_root","Reason terminal working directory escapes the granted root.");if(!e(Q).isDirectory())throw new V("pty_cwd_invalid","Reason terminal working directory is not a directory.");return Q}function jz(z=process.env){if(f()==="win32")return w(z);let H=z.SHELL;if(H&&r(H)&&U(H))return H;for(let Q of f()==="darwin"?["/bin/zsh","/bin/bash","/bin/sh"]:["/bin/bash","/bin/sh"])if(U(Q))return Q;return"/bin/sh"}function Gz(){let z=globalThis.Bun;if(!z)throw new V("pty_unavailable","Reason terminals require the Bun runtime.");return z.spawn}function Sz(){if(f()==="win32")return m();return typeof globalThis.Bun<"u"}var Nz=(z)=>{if(f()==="win32")try{return v({...z,file:z.shell,args:k(z.shell),environment:{...z.environment,TERM:"xterm-256color"}})}catch{throw new V("pty_unavailable","Reason could not allocate a pseudo-terminal.")}let H=Gz()({cmd:[z.shell,"-i","-l"],cwd:z.cwd,env:{...z.environment,TERM:"xterm-256color"},terminal:{cols:z.cols,rows:z.rows,data:(J,N)=>{z.onData(N)}}}),Q=H.terminal;if(!Q){try{H.kill()}catch{}throw new V("pty_unavailable","Reason could not allocate a pseudo-terminal.")}return{write:(J)=>Q.write(J),resize:(J,N)=>Q.resize(J,N),kill:()=>{try{H.kill()}catch{}},exited:H.exited.then((J)=>typeof J==="number"?J:null,()=>null)}},Wz=(z,H)=>{return H===void 0?new WebSocket(z):new WebSocket(z,{proxy:H})},M=new Set;function Kz(z){if(M.size>=Jz||M.has(z))return null;M.add(z);let H=!1;return()=>{if(H)return;H=!0,M.delete(z)}}async function Tz(z,H={}){let Q=H.now??Date.now,J=Zz(z.payload,Q()),N=Kz(z.operationId);if(!N)throw new V("pty_slot_busy","This Reason Device already runs the maximum number of terminals.");let Y=Q(),R,K,D;try{let j=J.workspace?s(z.root,J.workspace):void 0;R=j?c(U(j.boundary)?l(j.boundary):j.boundary,j.path):c(z.root,J.cwd),K=H.environment??process.env,D=H.shellPath??jz(K)}catch(j){throw N(),j}return await new Promise((j,C)=>{let F=null,$=null,I=!1,B=!1,X=!1,_=null,b=0,x=0,O=[],S=0,T=null,G=(Z)=>{if(X)return;if(X=!0,T)clearTimeout(T);z.signal.removeEventListener("abort",A);try{F?.kill()}catch{}try{$?.close(1000,"pty_session_over")}catch{}if(N(),Z.kind==="rejected"){C(Z.error);return}let W={reason:Z.reason,exit_code:_,output_bytes:b,input_bytes:x,duration_ms:Math.max(0,Q()-Y)};z.emitEvent("pty.stopped",{...W}).catch(()=>{return}),j({...W})},A=()=>{let Z=z.signal.reason;G({kind:"rejected",error:Z instanceof V?Z:new V("cancelled","Reason closed the terminal session.")})};if(z.signal.aborted){A();return}z.signal.addEventListener("abort",A,{once:!0}),T=setTimeout(()=>G({kind:"resolved",reason:"session_expired"}),Math.max(1,Date.parse(J.expires_at)-Q()));let a=(Z)=>{if(b+=Z.byteLength,!I||!$){if(O.push(Z),S+=Z.byteLength,S>y)G({kind:"resolved",reason:"output_backpressure"});return}try{$.send(Z)}catch{G({kind:"resolved",reason:"relay_closed"});return}if($.bufferedAmount>y)G({kind:"resolved",reason:"output_backpressure"})};try{F=(H.spawnPty??Nz)({shell:D,args:["-i","-l"],cwd:R,cols:J.cols,rows:J.rows,environment:K,onData:(Z)=>{if(!X)a(Z)}})}catch(Z){G({kind:"rejected",error:Z instanceof V?Z:new V("pty_spawn_failed","Reason could not start the terminal shell.")});return}F.exited.then((Z)=>{if(X)return;if(_=Z,I&&$)try{$.send(JSON.stringify({t:"exit",code:Z}))}catch{}G({kind:"resolved",reason:"shell_exited"})});let o=(H.loadProxy??d)()?.url;try{$=(H.connect??Wz)(J.relay_url,o)}catch{G({kind:"rejected",error:new V("pty_relay_unavailable","Reason could not reach the terminal relay.")});return}$.binaryType="arraybuffer",$.onopen=()=>{if(X||!$)return;I=!0;try{$.send(JSON.stringify({t:"open",cols:J.cols,rows:J.rows}));for(let Z of O.splice(0))$.send(Z);S=0}catch{G({kind:"resolved",reason:"relay_closed"});return}B=!0,z.emitEvent("pty.ready",{session_id:J.session_id,cols:J.cols,rows:J.rows}).catch(()=>{return})},$.onmessage=(Z)=>{if(X||!F)return;let W=Z.data;if(typeof W==="string"){let L;try{L=JSON.parse(W)}catch{return}if(!u(L))return;if(L.t==="resize"){try{F.resize(g(L.cols,J.cols),g(L.rows,J.rows))}catch{}return}if(L.t==="close")G({kind:"resolved",reason:"client_closed"});return}let q=W instanceof ArrayBuffer?new Uint8Array(W):ArrayBuffer.isView(W)?new Uint8Array(W.buffer,W.byteOffset,W.byteLength):null;if(!q||q.byteLength===0)return;x+=q.byteLength;try{F.write(q)}catch{}},$.onclose=()=>{if(X)return;if(!B){G({kind:"rejected",error:new V("pty_relay_unavailable","Reason could not reach the terminal relay.")});return}G({kind:"resolved",reason:"relay_closed"})},$.onerror=()=>{if(X||B)return;G({kind:"rejected",error:new V("pty_relay_unavailable","Reason could not reach the terminal relay.")})}})}
-export{m as Yg,Hz as Zg,y as _g,Jz as $g,Zz as ah,c as bh,jz as ch,Sz as dh,Nz as eh,Wz as fh,Tz as gh};

package/bin/vm-hands/vm-hands-entry-lite-s9xf5z69.js

@@ -1,7 +0,0 @@
-// @bun
-import{nd as r}from"./vm-hands-entry-lite-2m5dwrdf.js";import{ud as n}from"./vm-hands-entry-lite-d2w8tghq.js";import{dl as a,el as s,hl as i}from"./vm-hands-entry-lite-gxper06w.js";import{ql as B}from"./vm-hands-entry-lite-magmzx9c.js";import{spawn as f,spawnSync as v}from"child_process";import{existsSync as I,mkdtempSync as o,readFileSync as t,readdirSync as _j,realpathSync as Sj,rmSync as e,statSync as jj}from"fs";import{platform as h,tmpdir as qj}from"os";import{dirname as E,join as H,win32 as T}from"path";import{fileURLToPath as Mj,pathToFileURL as y}from"url";var kj=["bwrap","socat","rg"],Fj=2000,g=20000,Pj=3,w=4000,Ej=new Set([".git",".hg",".svn","node_modules"]),Rj=["runAsHostUid","sysrq-trigger"],zj=H(E(E(Mj(import.meta.url))),"packages","sandbox-runtime"),Dj=H(zj,"src","index.ts"),Gj=!1;function oj(){Gj=!0}function Jj(){return Gj?H(E(Sj(process.execPath)),"runtime","srt"):void 0}function Y(){let j=H(Jj()??zj,"vendor","srt-win");return H(j,process.arch,"srt-win.exe")}var tj="confined commands need the Windows sandbox: run `reason connect` and approve the Windows prompt.";function ej(j=Y()){let q=v(j,["status"],{encoding:"utf8",timeout:15000,windowsHide:!0});try{let G=JSON.parse(q.stdout??"");return q.status===0&&G.user?.user?.exists===!0&&G.user.cred_present===!0}catch{return!1}}function jq(j=Y()){let q=v(j,["install"],{stdio:["ignore","ignore","ignore"],timeout:120000,windowsHide:!0});return q.status===0?"installed":q.status===10?"cancelled":"failed"}async function Kj(){let j=Jj();if(j&&process.platform==="linux"&&!I(H(j,"vendor","seccomp",process.arch,"apply-seccomp")))throw Error("packaged_sandbox_runtime_vendor_missing");if(j&&process.platform==="win32"&&!I(Y()))throw Error("packaged_sandbox_runtime_vendor_missing");if(j){let J=t(H(j,"sandbox-runtime.mjs"),"utf8");for(let K of Rj)if(!J.includes(K))throw Error(`packaged_sandbox_runtime_fork_missing:${K}`)}let z=(await import(j?y(H(j,"sandbox-runtime.mjs")).href:y(Dj).href)).SandboxManager;if(!z||typeof z.initialize!=="function"||typeof z.wrapWithSandboxArgv!=="function")throw Error("sandbox-runtime does not expose the expected SandboxManager API.");return{SandboxManager:z}}function Wj(j={}){if((j.platformName??h())!=="linux")return!1;let G=j.fileExists??I,z=j.readFile??((J)=>t(J,"utf8"));for(let J of["/.dockerenv","/run/.containerenv"])try{if(G(J))return!0}catch{}try{return/docker|containerd|kubepods|lxc|libpod/.test(z("/proc/1/cgroup"))}catch{return!1}}function Qj(j){return["/bin/true","/usr/bin/true"].find((q)=>j(q))??null}function xj(j,q){return j==="strict"?["--ro-bind","/","/","--unshare-pid","--unshare-user","--cap-drop","ALL","--proc","/proc","--",q]:["--ro-bind","/","/","--unshare-pid","--unshare-user","--bind","/proc","/proc","--",q]}function Oj(j,q){try{let G=v("bwrap",xj(j,q),{stdio:"ignore",timeout:Fj});return!G.error&&G.status===0}catch{return!1}}function fj(j){let q=j.platformName??h(),G=j.fileExists??I;if(q==="win32")return(j.bash??a)()&&G(Y())?U??"strict":null;if(q!=="linux")return null;let z=j.hasExecutable??n;if(!kj.every((V)=>z(V)))return null;let J=Qj(G);if(!J)return null;let K=U??(j.containerized??Wj({platformName:q})?"weak":"strict");return(j.probeNamespaces??((V)=>Oj(V,J)))(K)?K:null}var _=null,R=!1,X=null,c=null,u=null,U=null,S=null,P=null,M=null,D=[],N=new Map;function W(){throw C("sandbox_mode_conflict"),new B("sandbox_unavailable","Sandbox process policy conflicts with an existing probe or session. Restart the worker.")}function qq(j){if(U!==null&&U!==j||R&&_!==null&&_!==j||S!==null&&S!==j)W();U=j}function C(j){if(!X)process.stderr.write(`Reason worker: confined commands are off (${j})
-`);X=j}function Vj(j){if(X)return!1;if(!R){if(_=fj(j??{}),R=!0,_&&!j)Yj()}return _!==null}function vj(){return Vj()?_:null}var k=null,A=0;function x(j,q){if(X)throw new B("sandbox_unavailable","Confined execution is unavailable in this worker process.");if(U&&j.sandboxMode&&U!==j.sandboxMode)W();let G=U??j.sandboxMode??vj();if(!G)throw new B("sandbox_unavailable","Confined command execution is unavailable on this operating system.");if(S&&S!==G)W();return S=G,k??=(async()=>{let{SandboxManager:z}=await(j.loadSandboxRuntime??Kj)();return await z.initialize(uj(G,q)),z})().catch((z)=>{if(k=null,q)P=null,process.stderr.write(`Reason worker: the Windows sandbox did not start for this folder (${String(z).slice(0,500)})
-`);else C(`initialize_failed: ${String(z)}`);throw z instanceof B?z:new B("sandbox_unavailable","The confined execution sandbox failed to start.")}),k.then((z)=>{if(X)throw new B("sandbox_unavailable","Confined execution became unavailable during sandbox initialization.");return z})}function O(){if(A-=1,A===0)for(let j of D.splice(0))j()}async function Zj(j,q=!0,G,z){let J=z===void 0?1/0:Date.now()+z;await Bj();let K=bj();if(q)await K;let Q=JSON.stringify(j),V=!1,$=()=>{if(!V)return;V=!1;let Z=(N.get(Q)??1)-1;if(Z>0)N.set(Q,Z);else N.delete(Q)};try{for(;;){if(G?.aborted)throw new B("cancelled","Operation was cancelled.");if(Date.now()>=J)return!1;if(M){await M;continue}let Z=N.keys().next().value;if(P??=Z??Q,P===Q&&(Z===void 0||Z===Q))break;if(!V){V=!0,N.set(Q,(N.get(Q)??0)+1);continue}if(A===0&&Z===Q){$j();continue}await new Promise((L)=>{if(D.push(L),G?.addEventListener("abort",()=>L(),{once:!0}),J!==1/0)setTimeout(L,Math.max(0,J-Date.now())).unref?.()})}return A+=1,!0}finally{if(V&&A===0)for(let Z of D.splice(0))Z();$()}}function $j(){return M??=Xj().finally(()=>{M=null}),M}function Hj(j,q,G=process.env){let z=G.USERPROFILE?T.resolve(G.USERPROFILE).toLowerCase():null,J=T.resolve(j).toLowerCase(),K=z!==null&&J.startsWith(`${z}\\`),Q=q?Lj(G).filter((V)=>V.toLowerCase()===J||V.toLowerCase().startsWith(`${J}\\`)):[];return{denyRead:[],allowRead:[j],allowWrite:q?[j]:[],denyWrite:q?Q:K?[]:[j]}}function Lj(j,q=process.execPath){let G=new Map;for(let z of[...(j.PATH??j.Path??"").split(";"),T.dirname(q)]){if(!z||!T.isAbsolute(z))continue;let J=T.resolve(z);if(!G.has(J.toLowerCase()))G.set(J.toLowerCase(),J)}return[...G.values()]}function hj(j=process.env,q=process.execPath){let G=[j.SystemRoot,j.ProgramFiles,j["ProgramFiles(x86)"],j.ProgramW6432,j.ProgramData,j.USERPROFILE].filter((z)=>!!z).map((z)=>T.resolve(z).toLowerCase());return Lj(j,q).filter((z)=>{let J=z.toLowerCase();return!G.some((K)=>J===K||J.startsWith(`${K}\\`))})}var l=null,m=null;function Bj(j=Y()){return m??=(async()=>{let q;try{q=JSON.parse((await Uj(j,["status"])).stdout).user?.user?.sid}catch{return null}if(typeof q!=="string"||!/^S-1-[0-9-]+$/.test(q))return null;if(!await new Promise((z)=>{let J=f(i("icacls"),[j,"/grant",`*${q}:(RX)`],{stdio:"ignore",windowsHide:!0,timeout:30000});J.on("error",()=>z(!1)),J.on("close",(K)=>z(K===0))}))process.stderr.write(`Reason worker: could not let the Windows sandbox user run srt-win.exe
-`);return q})(),m}function Uj(j,q,G){return new Promise((z)=>{let J=f(j,q,{stdio:["pipe","pipe","ignore"],windowsHide:!0,timeout:120000}),K="";J.stdout?.setEncoding("utf8").on("data",(Q)=>{K+=Q}),J.on("error",()=>z({status:null,stdout:K})),J.on("close",(Q)=>z({status:Q,stdout:K})),J.stdin?.end(G??"")})}function bj(j=Y()){return l??=(async()=>{let q=hj();if(q.length===0)return;let G=await Bj(j),z=G?await Uj(j,["acl","stamp","--holder-pid",String(process.ppid),"--sandbox-user-sid",G],JSON.stringify({denyRead:[],denyWrite:q})):null;if(!z||z.status!==0&&z.status!==2)C(`program_folder_deny_failed: ${z?`exit ${z.status}`:"no sandbox user"}`),process.stderr.write(`Reason worker: could not deny the Windows sandbox writes to PATH folders (${z?`exit ${z.status}`:"no sandbox user"}); confined commands are off
-`)})(),l}var yj=`h=$(mktemp -d) || exit 125; trap 'rm -rf "$h"' EXIT; mkdir -p "$h/AppData/Roaming" "$h/AppData/Local"; w=$(cygpath -w "$h"); export HOME="$h" USERPROFILE="$w" APPDATA="$w\\AppData\\Roaming" LOCALAPPDATA="$w\\AppData\\Local" TEMP="$w" TMP="$w"; `;async function Xj(){let j=k;if(k=null,P=null,!j)return;try{await(await j).reset()}catch{}}async function Yj(j={}){if(X)return!1;if(j.loadSandboxRuntime)return d(j.loadSandboxRuntime);if(!Vj())return!1;return c??=d(Kj),c}async function d(j){try{let{SandboxManager:q}=await j();if(process.platform==="win32"){if(!I(Y()))C("dependencies_missing: srt-win.exe");return!X}let G=q.checkDependencies().errors;if(G.length>0)return C(`dependencies_missing: ${G.join(", ")}`),!1;return!X}catch(q){return C(`load_failed: ${String(q)}`),!1}}async function zq(j={}){if(!j.loadSandboxRuntime&&!j.sandboxMode){if(!await Yj())return!1;return u??=p({}),u}return p(j)}async function p(j){let q=process.platform==="win32",G=o(H(qj(),"reason-device-probe-"));try{let z=q?Hj(G,!1):void 0;if(z)await Zj(z,!1);let J;try{J=await gj(await x(j,z),G)}catch{return!1}finally{if(q)O()}if(!J)C("confined_command_failed");if(A===0)await(q?$j():Xj());return J}finally{e(G,{recursive:!0,force:!0})}}async function gj(j,q){let G=process.platform==="win32",z=G?"true":Qj(I);if(!z)return!1;try{let{argv:J,env:K}=await j.wrapWithSandboxArgv(Aj([z]),Cj(),{filesystem:G?Nj([],q):Ij({root:q,allowWrite:!1,temporaryDirectory:q,protectedPaths:[]})},void 0,q),[Q,...V]=J;if(!Q)return!1;return await wj(Q,V,q,G?{env:K}:{})}catch{return!1}finally{try{j.cleanupAfterCommand()}catch{}}}function wj(j,q,G,z={}){return new Promise((J)=>{let K=!1,Q,V=(L)=>{if(K)return;K=!0,clearTimeout(Q),J(L)},$;try{$=(z.spawnChild??f)(j,q,{cwd:G,env:z.env??{PATH:r,HOME:G,TMPDIR:G},stdio:"ignore",windowsHide:!0})}catch{V(!1);return}$.once("error",()=>V(!1));let Z=(L,F)=>V(L===0&&F===null);if($.once("exit",Z),$.once("close",Z),$.exitCode!==null||$.signalCode!==null)Z($.exitCode,$.signalCode);if(K)return;Q=setTimeout(()=>{V(!1);try{$.kill("SIGKILL")}catch{}},Math.min(z.timeoutMs??g,g))})}function Cj(j=I,q=h()){if(q==="win32")return s("win32");return["/bin/bash","/bin/sh"].find((G)=>j(G))??"/bin/sh"}function Aj(j){return j.map((q)=>`'${q.replaceAll("'","'\\''")}'`).join(" ")}function cj(j,q,G=(z)=>_j(z,{withFileTypes:!0}).filter((J)=>J.isDirectory()||J.isFile()).map((J)=>J.name)){let z=[],J=[{path:j,depth:0}],K=0;while(J.length>0&&K<w){let Q=J.pop(),V;try{V=G(Q.path)}catch{continue}for(let $ of V){if(K+=1,K>w)break;let Z=H(Q.path,$);if(q(Z)){z.push(Z);continue}if(Q.depth+1<Pj&&!Ej.has($))J.push({path:Z,depth:Q.depth+1})}}return z}function Ij(j){let q=H(j.root,".git"),G=[];try{if(jj(q).isDirectory())G=[H(q,"config"),H(q,"hooks")]}catch{}return{denyRead:["/home","/root","/tmp","/tmp/.X11-unix",...j.protectedPaths],allowRead:[j.root,j.temporaryDirectory],allowWrite:[...j.allowWrite?[j.root]:[],j.temporaryDirectory],denyWrite:[...j.protectedPaths,...G]}}function Nj(j,q){let G=H(q,".git"),z=[];try{if(jj(G).isDirectory())z=[H(G,"config"),H(G,"hooks")]}catch{}return{denyRead:[...j],allowRead:[],allowWrite:[],denyWrite:[...j,...z]}}function uj(j,q){if(q)return{network:{allowedDomains:[],deniedDomains:[]},filesystem:q,windows:{srtWin:{path:Y()}}};return{network:{allowedDomains:[],deniedDomains:[]},filesystem:{denyRead:[],allowRead:[],allowWrite:[],denyWrite:[]},...j==="weak"?{enableWeakerNestedSandbox:!0}:{}}}function Gq(j){let q=j.createTemporaryDirectory??(()=>o(H(qj(),"reason-device-"))),G=j.removeTemporaryDirectory??((z)=>e(z,{recursive:!0,force:!0}));return async(z,J,K)=>{let Q=process.platform==="win32",V;if(Q){let Z=Hj(K.root,K.allowWrite);if(!await Zj(Z,!K.workerProbe,K.signal,K.timeoutMs))return{exitCode:null,signal:null,stdout:"",stderr:"",timedOut:!0,truncated:!1};try{V=await x(j,Z)}catch(L){throw O(),L}}else V=await x(j),A+=1;let $;try{$=q();let Z=cj(K.root,j.isProtectedPath),L;try{L=await V.wrapWithSandboxArgv((Q?yj:"")+Aj([z,...J]),j.shell??Cj(),{filesystem:Q?Nj(Z,K.root):Ij({root:K.root,allowWrite:K.allowWrite,temporaryDirectory:$,protectedPaths:Z})},K.signal,K.cwd)}catch(b){throw b instanceof B?b:new B("sandbox_unavailable","The confined execution sandbox could not wrap the command.")}let[F,...Tj]=L.argv;if(!F)throw new B("sandbox_unavailable","The confined execution sandbox produced no command.");return await j.spawnCaptured(F,Tj,{cwd:K.cwd,timeoutMs:K.timeoutMs,signal:K.signal,env:Q?L.env:j.scrubEnvironment(K.root,$)})}finally{O();try{V.cleanupAfterCommand()}catch{}if($!==void 0)G($)}}}
-export{oj as mb,Y as nb,tj as ob,ej as pb,jq as qb,qq as rb,Vj as sb,zq as tb,Cj as ub,Gq as vb};

package/bin/vm-hands/vm-hands-entry-lite-tchc7z17.js

@@ -1,128 +0,0 @@
-// @bun
-import{Kg as b8,Lg as p8,Mg as P8,Ng as X8,Og as Q8,Pg as y8,Rg as u,Ug as M}from"./vm-hands-entry-lite-jp9q2vsx.js";import{fh as q8}from"./vm-hands-entry-lite-s823n1q9.js";import{wh as o}from"./vm-hands-entry-lite-ntx8fdyq.js";import{Yj as K}from"./vm-hands-entry-lite-6nwbqg37.js";import{Ik as t,Lk as e,Mk as d}from"./vm-hands-entry-lite-3rqdzqhk.js";import{Wk as x8}from"./vm-hands-entry-lite-v4jtxgaj.js";import{ql as r}from"./vm-hands-entry-lite-magmzx9c.js";import{execFile as S8,spawn as J8}from"child_process";import{randomBytes as Z8}from"crypto";import{chmodSync as O8,existsSync as T8,lstatSync as u8,mkdirSync as V8,readFileSync as s8,rmSync as r8,writeFileSync as V}from"fs";import{connect as K8}from"net";import{join as J}from"path";var U=32,f=76;var z="./desktop-wallpaper-0pjhgyfk.jpg";var $="./dock-browser-afp005mt.png";var H="./dock-files-rywdm96b.png";var l="./dock-terminal-s41cj1jp.png";var k=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
-# The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
-# python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
-# Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE
-import ctypes, sys
-import gi
-gi.require_version("GdkPixbuf", "2.0")
-from gi.repository import GdkPixbuf
-x = ctypes.cdll.LoadLibrary("libX11.so.6")
-x.XOpenDisplay.restype = ctypes.c_void_p
-x.XOpenDisplay.argtypes = [ctypes.c_char_p]
-d = x.XOpenDisplay(None)
-if not d: sys.exit("no display")
-for name, res, args in [
-    ("XDefaultScreen", ctypes.c_int, [ctypes.c_void_p]),
-    ("XRootWindow", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDisplayWidth", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDisplayHeight", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultDepth", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultVisual", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultGC", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_int]),
-    ("XCreatePixmap", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_uint, ctypes.c_uint, ctypes.c_uint]),
-    ("XCreateImage", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_uint, ctypes.c_int, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint, ctypes.c_uint, ctypes.c_int, ctypes.c_int]),
-    ("XPutImage", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_int, ctypes.c_int, ctypes.c_int, ctypes.c_int, ctypes.c_uint, ctypes.c_uint]),
-    ("XInternAtom", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_char_p, ctypes.c_int]),
-    ("XChangeProperty", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_int, ctypes.c_int, ctypes.c_void_p, ctypes.c_int]),
-    ("XSetWindowBackgroundPixmap", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_ulong]),
-    ("XClearWindow", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong]),
-    ("XSetCloseDownMode", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XCloseDisplay", ctypes.c_int, [ctypes.c_void_p]),
-]:
-    f = getattr(x, name); f.restype = res; f.argtypes = args
-s = x.XDefaultScreen(d); root = x.XRootWindow(d, s)
-w, h = x.XDisplayWidth(d, s), x.XDisplayHeight(d, s)
-if x.XDefaultDepth(d, s) != 24: sys.exit("unsupported depth")
-# Scale to cover the screen, then crop the centre.
-src = GdkPixbuf.Pixbuf.new_from_file(sys.argv[1])
-k = max(w / src.get_width(), h / src.get_height())
-sw, sh = max(w, round(src.get_width() * k)), max(h, round(src.get_height() * k))
-pb = src.scale_simple(sw, sh, GdkPixbuf.InterpType.BILINEAR).new_subpixbuf((sw - w) // 2, (sh - h) // 2, w, h).copy()
-if pb.get_has_alpha(): pb = pb.composite_color_simple(w, h, GdkPixbuf.InterpType.NEAREST, 255, 1, 0, 0)
-rgb, stride = pb.get_pixels(), pb.get_rowstride()
-bgrx = bytearray(w * h * 4)
-for y in range(h):
-    row = rgb[y * stride:y * stride + w * 3]; o = y * w * 4
-    bgrx[o:o + w * 4:4] = row[2::3]; bgrx[o + 1:o + w * 4:4] = row[1::3]; bgrx[o + 2:o + w * 4:4] = row[0::3]
-buf = ctypes.create_string_buffer(bytes(bgrx), len(bgrx))
-pix = x.XCreatePixmap(d, root, w, h, 24)
-img = x.XCreateImage(d, x.XDefaultVisual(d, s), 24, 2, 0, buf, w, h, 32, 0)  # ZPixmap
-x.XPutImage(d, pix, x.XDefaultGC(d, s), img, 0, 0, 0, 0, w, h)
-ref = ctypes.c_ulong(pix)
-for atom in (b"_XROOTPMAP_ID", b"ESETROOT_PMAP_ID"):
-    x.XChangeProperty(d, root, x.XInternAtom(d, atom, 0), 20, 32, 0, ctypes.byref(ref), 1)  # XA_PIXMAP, PropModeReplace
-x.XSetWindowBackgroundPixmap(d, root, pix)
-x.XClearWindow(d, root)
-x.XSetCloseDownMode(d, 1)  # RetainPermanent: the pixmap outlives this process
-x.XCloseDisplay(d)
-`;function _8(x){return`<?xml version="1.0" encoding="UTF-8"?>
-<openbox_config xmlns="http://openbox.org/3.4/rc">
-  <theme><keepBorder>no</keepBorder></theme>
-  <applications>
-    <!-- Debian Chromium is "Chromium"; Chrome for Testing is "Chromium-browser". -->
-    <application class="Chromium*">
-      <decor>no</decor>
-      <position force="yes"><x>${U}</x><y>${U}</y></position>
-      <size><width>${x.width-U*2}</width><height>${x.height-U-f}</height></size>
-    </application>
-  </applications>
-</openbox_config>`}var f8=`# Remote sandbox dock \u2014 launcher icons only, centred, no panel fill
-panel_items = L
-panel_size = 100% 46
-panel_margin = 0 10
-panel_padding = 0 0 10
-panel_position = bottom center horizontal
-panel_shrink = 1
-panel_background_id = 0
-panel_layer = top
-mouse_effects = 1
-mouse_hover_icon_asb = 100 0 12
-mouse_pressed_icon_asb = 100 0 -12
-
-launcher_icon_size = 46
-launcher_padding = 0 0 10
-launcher_background_id = 0
-launcher_tooltip = 1
-
-launcher_item_app = /tmp/ara-chromium.desktop
-launcher_item_app = /tmp/ara-terminal.desktop
-launcher_item_app = /tmp/ara-files.desktop
-`,E8=`corner-radius = 12;
-rounded-corners-exclude = [
-  "class_g = 'tint2'",
-  "window_type = 'dock'",
-  "window_type = 'desktop'"
-];
-backend = "xrender";
-shadow = false;
-fading = false;
-vsync = false;
-inactive-opacity = 1.0;
-active-opacity = 1.0;
-`,h8="/tmp/ara-dock-browser.png",M8=`[Desktop Entry]
-Name=Chrome
-Exec=chromium --no-sandbox %U
-Icon=${h8}
-Type=Application
-Categories=Network;WebBrowser;
-`,w8=`[Desktop Entry]
-Name=Terminal
-Exec=bash -c "DISPLAY=:99 xterm -fa DejaVuSansMono -fs 11 -bg black -fg white"
-Icon=/tmp/ara-dock-terminal.png
-Type=Application
-Categories=System;TerminalEmulator;
-`,F8=`[Desktop Entry]
-Name=Files
-Exec=bash -c "DISPLAY=:99 pcmanfm --no-desktop"
-Icon=/tmp/ara-dock-files.png
-Type=Application
-Categories=System;FileManager;
-`;var v={"wallpaper.jpg":z,"dock-browser.png":$,"dock-terminal.png":l,"dock-files.png":H},c8=k,G8='set_wallpaper() { if command -v feh >/dev/null 2>&1; then feh --bg-fill "$1"; else python3 "$2" "$1"; fi; }';function n(x){let q=(Q)=>Q.replaceAll("DISPLAY=:99",`DISPLAY=${x.display}`).replaceAll("/tmp/ara-",`${x.root}/ara-`),P=new Set(x.absent??[]),p=f8.split(`
-`).filter((Q)=>!(P.has("terminal")&&Q.endsWith("/ara-terminal.desktop"))&&!(P.has("files")&&Q.endsWith("/ara-files.desktop"))).join(`
-`);return{files:{"openbox/rc.xml":_8(x.screen),"tint2/tint2rc":q(p),"picom/picom.conf":E8,...P.has("terminal")?{}:{"ara-terminal.desktop":q(w8)},...P.has("files")?{}:{"ara-files.desktop":q(F8)},"ara-chromium.desktop":q(M8).replace("chromium --no-sandbox %U",x.browserExec),"ara-set-root-wallpaper.py":c8},start:['ticks() { line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1; rest=${line##*) }; case $rest in Z*|X*) return 1;; esac; printf "%s" "$rest" | cut -d " " -f20; }','alive() { [ -f "$ROOT/$1.pid" ] || return 1; read -r pid start <"$ROOT/$1.pid"; current=$(ticks "$pid") || return 1; [ "$current" = "$start" ] && kill -0 "$pid" 2>/dev/null; }','launch() { name=$1; shift; "$@" 9>&- >"$ROOT/$name.log" 2>&1 & pid=$!; start=$(ticks "$pid"); printf "%s %s\\n" "$pid" "$start" >"$ROOT/$name.pid"; }',G8,'[ ! -f "$ROOT/ara-wallpaper.jpg" ] || set_wallpaper "$ROOT/ara-wallpaper.jpg" "$ROOT/ara-set-root-wallpaper.py" || true','if ! alive tint2 && command -v tint2 >/dev/null 2>&1; then launch tint2 tint2 -c "$ROOT/tint2/tint2rc"; fi','if ! alive picom && command -v picom >/dev/null 2>&1; then launch picom picom --config "$ROOT/picom/picom.conf"; fi']}}var a8=43200000,j=":99",g8=60000,_=15000,Z={width:1280,height:800},Y8=/^[A-Za-z0-9._:-]{1,160}$/;function z8(x){return Boolean(x)&&typeof x==="object"&&!Array.isArray(x)}var $8=["video","viewer","viewer_same_network","viewer_network"];function H8(x,q=Date.now()){let P=["relay_url","session_id","expires_at"];if(!z8(x)||P.some((y)=>!(y in x))||Object.keys(x).some((y)=>!P.includes(y)&&!$8.includes(y)))throw new r("invalid_display_request","Reason desktop request is malformed.");let p="video"in x?e(x.video):void 0,b="viewer"in x?t(x.viewer):null;if(p===null)throw new r("invalid_display_request","Reason desktop video request is invalid.");let X=null;try{X=typeof x.relay_url==="string"?new URL(x.relay_url):null}catch{}if(!X||X.protocol!=="wss:"&&X.protocol!=="ws:"||X.username||X.password)throw new r("invalid_display_request","Reason desktop relay URL is invalid.");if(typeof x.session_id!=="string"||!Y8.test(x.session_id))throw new r("invalid_display_request","Reason desktop session identity is invalid.");let Q=typeof x.expires_at==="string"?Date.parse(x.expires_at):Number.NaN;if(!Number.isFinite(Q)||Q<=q)throw new r("invalid_display_request","Reason desktop session has already expired.");return{relay_url:x.relay_url,session_id:x.session_id,expires_at:new Date(Math.min(Q,q+a8)).toISOString(),...p?{video:p}:{},...b?{viewer:b}:{},...p&&x.viewer_same_network===!0?{viewer_same_network:!0}:{}}}function i(x=process.platform){return(x==="linux"||x==="darwin"||x==="win32")&&M()?.features.display===!0}async function ux(){if(process.platform==="win32")return i()&&await u();if(process.platform!=="darwin")return i();return await u()}function E(x){V8(x,{recursive:!0,mode:448});let q=u8(x);if(!q.isDirectory()||q.isSymbolicLink()||process.getuid&&q.uid!==process.getuid())throw new r("display_unavailable","Reason desktop state directory is not private.");O8(x,448)}function l8(x,q){let P=(b)=>{let X=Buffer.alloc(2);return X.writeUInt16BE(b.length),Buffer.concat([X,b])},p=Buffer.from([255,255]);return Buffer.concat([p,P(Buffer.alloc(0)),P(Buffer.from(x)),P(Buffer.from("MIT-MAGIC-COOKIE-1")),P(q)])}function L(x,q,P=2000){return new Promise((p)=>{let b=K8(x),X="",Q=(y)=>{b.destroy(),p(y)};b.setTimeout(P,()=>Q(!1)),b.once("error",()=>Q(!1)),b.once("close",()=>Q(!1)),b.once("connect",()=>{if(!q)Q(!0)}),b.on("data",(y)=>{if(X+=y.toString("latin1"),X.length>=4)Q(X.startsWith("RFB "))})})}async function s(x,q){let P=Date.now()+q;while(Date.now()<P){if(await x())return!0;await new Promise((p)=>setTimeout(p,100))}return!1}function h(x,q,P){return new Promise((p)=>{let b=J8(x,q,{detached:!0,stdio:"ignore",env:P});b.once("error",()=>p(-1)),b.once("exit",(X)=>p(X)),b.unref(),setTimeout(()=>p(null),_).unref()})}var O=null;function k8(x=K()){return O??=v8(x).finally(()=>{O=null}),O}async function v8(x){let q=M({home:x});if(!q?.xvfb||!q.x11vnc||!q.openbox)throw new r("display_unavailable","Run `reason desktop install` on this machine to enable its desktop.");x8({root:q.root,automation:q.automation,extensionDir:q.extensionDir});let P=J(q.root,"display");E(P);let p=await i8(x,P,q.x11vnc);if(p)return p;let b={display:j,xauthority:J(P,"Xauthority"),rfbSocket:J(P,"rfb.sock")},X=J(P,"pulse"),Q=(async()=>{try{E(X)}catch{return null}return await P8(X,q.pulseaudio)})();E(J(P,"home"));let y=N8(P,b,q.pulseaudio),B=async()=>({...b,sound:await Q});if(await L({path:b.rfbSocket},!0))return await B();if(!T8(b.xauthority))V(b.xauthority,l8(j.slice(1),Z8(16)),{mode:384,flag:"wx"});let T=U8(J(P,"theme"),b.display,Z),R={path:`/tmp/.X11-unix/X${j.slice(1)}`};if(!await L(R,!1)){let N=`${Z.width}x${Z.height}`;if(q.xvnc)r8(b.rfbSocket,{force:!0}),h(q.xvnc,[b.display,"-geometry",N,"-depth","24","-nolisten","tcp","-auth",b.xauthority,"-rfbport","-1","-rfbunixpath",b.rfbSocket,"-SecurityTypes","None","-AlwaysShared","-desktop","Reason"],y);else h(q.xvfb,[b.display,"-screen","0",`${N}x24`,"-nolisten","tcp","-auth",b.xauthority],y);if(!await s(()=>L(R,!1),_)||q.xvnc&&!await s(()=>L({path:b.rfbSocket},!0),_))throw new r("display_unavailable","Reason could not start the virtual display.");h(q.openbox,["--config-file",T.openboxConfig],y)}if(await R8(T,y),!await A8(q.x11vnc,b,P,"x11vnc.log",y))throw new r("display_unavailable","Reason could not start the desktop server.");return await B()}function N8(x,q,P){let p={HOME:J(x,"home"),PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:q.display,XAUTHORITY:q.xauthority};if(P)p.PULSE_SERVER=p8(b8(J(x,"pulse")));return p}async function A8(x,q,P,p,b){if(await L({path:q.rfbSocket},!0))return!0;r8(q.rfbSocket,{force:!0});let X=await h(x,["-display",q.display,"-auth",q.xauthority,"-rfbport","0","-rfbportv6","-1","-unixsock",q.rfbSocket,"-nopw","-forever","-shared","-noxdamage","-sb","0","-rfbversion","3.7","-quiet","-bg","-o",J(P,p)],b);if(X!==null&&X!==0)return!1;return await s(()=>L({path:q.rfbSocket},!0),_)}async function n8(){let x=["DISPLAY","XAUTHORITY","WAYLAND_DISPLAY","XDG_SESSION_TYPE"],q=(P)=>Object.fromEntries(x.flatMap((p)=>P[p]?[[p,P[p]]]:[]));if(process.env.DISPLAY)return q(process.env);try{let P=await new Promise((p,b)=>S8("systemctl",["--user","show-environment"],{encoding:"utf8",timeout:2000},(X,Q)=>X?b(X):p(Q)));return q(Object.fromEntries(P.split(`
-`).flatMap((p)=>{let b=p.indexOf("=");return b>0?[[p.slice(0,b),p.slice(b+1)]]:[]})))}catch{return{}}}var I=new Set;async function i8(x,q,P){let p=await n8(),b=/^:(\d+)(?:\.\d+)?$/.exec(p.DISPLAY??"")?.[1];if(!b||`:${b}`===j||p.WAYLAND_DISPLAY||p.XDG_SESSION_TYPE==="wayland")return null;let X={display:`:${b}`,xauthority:p.XAUTHORITY??J(x,".Xauthority"),rfbSocket:J(q,`rfb-${b}.sock`)},Q=`${X.display} ${X.xauthority}`;if(I.has(Q)||!await L({path:`/tmp/.X11-unix/X${b}`},!1))return null;let y={HOME:x,PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:X.display,XAUTHORITY:X.xauthority};if(await A8(P,X,q,`x11vnc-${b}.log`,y))return{...X,sound:null};return I.add(Q),process.stderr.write(`Reason worker: your screen ${X.display} could not be served; using the virtual desktop
-`),null}function U8(x,q,P){let p=`chromium --no-first-run --no-default-browser-check${process.geteuid?.()===0?" --no-sandbox":""} %U`,b=[["terminal","xterm"],["files","pcmanfm"]].filter(([,Q])=>!T8(`/usr/bin/${Q}`)).map(([Q])=>Q),X=n({root:x,display:q,screen:P,browserExec:p,absent:b});for(let Q of["","openbox","tint2","picom"])E(J(x,Q));for(let[Q,y]of Object.entries(X.files))V(J(x,Q),y,{mode:384});for(let[Q,y]of Object.entries(v))V(J(x,`ara-${Q}`),s8(y),{mode:384});return{root:x,openboxConfig:J(x,"openbox","rc.xml"),start:X.start}}async function R8(x,q){let P=[`ROOT=${JSON.stringify(x.root)}`,...x.start,"openbox --reconfigure >/dev/null 2>&1 || true"].join(`
-`);await new Promise((p)=>{let b=J8("/bin/sh",["-c",P],{stdio:"ignore",env:{...q,PATH:"/usr/bin:/bin"}}),X=setTimeout(()=>{b.kill(),p()},_);b.once("error",()=>{clearTimeout(X),p()}),b.once("exit",()=>{clearTimeout(X),p()})})}var I8=2073600,m8=320;function t8(x,q){let P=Math.min(1,Math.sqrt(I8/(x.width*x.height))),p=(b,X)=>Math.min(Math.floor(X/8)*8,Math.max(m8,Math.round(b*P/8)*8));return{width:p(x.width,q.width),height:p(x.height,q.height)}}function C8(x,q,P){return new Promise((p)=>S8(x,q,{env:P,encoding:"utf8",timeout:5000},(b,X)=>p(b?null:X)))}function e8(x){let q=/current (\d+) x (\d+), maximum (\d+) x (\d+)/.exec(x),P=x.split(`
-`),p=P.findIndex((X)=>/^\S+ connected/.test(X));if(!q||p<0)return null;let b=[];for(let X of P.slice(p+1)){let Q=/^\s+(\d+x\d+)\s/.exec(X);if(!Q)break;b.push(Q[1])}return{current:{width:Number(q[1]),height:Number(q[2])},maximum:{width:Number(q[3]),height:Number(q[4])},output:P[p].split(" ")[0],modes:b}}async function d8(x,q,P){if(x.display!==j)return null;let p={PATH:"/usr/bin:/bin",DISPLAY:x.display,XAUTHORITY:x.xauthority},b=(B)=>C8("xrandr",B,p),X=e8(await b(["--query"])??"");if(!X||X.maximum.width<=X.current.width&&X.maximum.height<=X.current.height)return null;let Q=t8(q,X.maximum);if(Q.width===X.current.width&&Q.height===X.current.height)return{size:Q,changed:!1};let y=`${Q.width}x${Q.height}`;if(!X.modes.includes(y)){if(await b(["--newmode",y,"60",...[Q.width,Q.width,Q.width,Q.width,Q.height,Q.height,Q.height,Q.height].map(String)]),await b(["--addmode",X.output,y])===null)return null}return P(),await b(["--output",X.output,"--mode",y])===null?null:{size:Q,changed:!0}}async function o8(x,q){let P=M({home:K()});if(!P)return;let p=J(P.root,"display"),b=N8(p,x,P.pulseaudio);await R8(U8(J(p,"theme"),x.display,q),b);let X=q.width-U*2,Q=q.height-U-f;await C8("xdotool",["search","--onlyvisible","--class","Chromium","windowsize","%@",String(X),String(Q),"windowmove","%@",String(U),String(U)],{...b,PATH:"/usr/bin:/bin"})}var m=Promise.resolve();function xx(x,q,P=()=>{}){let p=m.then(()=>d8(x,q,P));return m=p.then((b)=>b?.changed?o8(x,b.size):void 0).catch(()=>{}),p.then((b)=>b?.size??null,()=>null)}async function Vx(x,q={}){let P=q.now??Date.now,p=H8(x.payload,P());if(x.signal.throwIfAborted(),!p.video)throw new r("display_video_required","Reason desktops stream as video now; this request came without it.");let b=q.platform??process.platform;if(b!=="linux"&&b!=="darwin"&&b!=="win32")throw new r("display_video_unsupported","This machine does not serve desktop video.");let X=p.video,Q=(q.video?.desktop??(b==="darwin"?async()=>X8:b==="win32"?async()=>Q8:k8))();return await qx(x.signal,p,q,P,(y)=>y8(y,{request:X,desktop:Q,...p.viewer?{viewer:p.viewer}:{},viewerSameNetwork:p.viewer_same_network===!0},{resizeDesktop:xx,...q.video}),(y)=>d({type:"error",code:y}))}function qx(x,q,P,p,b,X){let Q=p();return new Promise((y,B)=>{let T=null,R=!1,N=!1,a,w,D,g=!1,A=null,C=(S)=>{if(N)return;if(A)S=A;N=!0,clearTimeout(a),clearTimeout(w),x.removeEventListener("abort",c),D?.close();try{T?.close(1000,"display_session_over")}catch{}if("error"in S){B(S.error);return}y({reason:S.reason,...D?.summary(),duration_ms:Math.max(0,p()-Q)})},F=()=>C({error:new r("display_relay_unavailable","Reason could not reach the desktop relay.")}),c=()=>{let S=x.reason;C({error:S instanceof r?S:new r("cancelled","Reason closed the desktop session.")})},Y=()=>{if(!A||!T)return;let S=A.error;try{T.send(X(S instanceof r?S.code:"display_unavailable"))}catch{}C(A)};if(D=b({get done(){return N||A!==null},get open(){return R&&!N&&A===null},get bufferedAmount(){return T?.bufferedAmount??0},send(S){if(N||A||!R||!T)return;try{T.send(S)}catch{C({reason:"relay_closed"})}},end:(S)=>{if(N||A)return;if(!("error"in S)){C(S);return}if(A=S,g&&R)Y()}}),N){D.close();return}if(x.aborted){c();return}x.addEventListener("abort",c,{once:!0}),a=setTimeout(()=>C({reason:"session_expired"}),Math.max(1,Date.parse(q.expires_at)-p())),w=setTimeout(()=>C({reason:"viewer_absent"}),P.viewerWaitMs??g8);try{T=(P.connect??q8)(q.relay_url,(P.loadProxy??o)()?.url)}catch{F();return}T.binaryType="arraybuffer",T.onopen=()=>{if(N||!T)return;R=!0,D?.opened()},T.onmessage=(S)=>{if(N)return;let W=S.data,G=W instanceof ArrayBuffer?new Uint8Array(W):ArrayBuffer.isView(W)?new Uint8Array(W.buffer,W.byteOffset,W.byteLength):null;if(!G||G.byteLength===0)return;if(clearTimeout(w),g=!0,A){Y();return}D?.received(G)},T.onclose=()=>{if(N)return;if(!R){F();return}C({reason:"relay_closed"})},T.onerror=()=>{if(N||R)return;F()}})}
-export{a8 as xg,j as yg,H8 as zg,i as Ag,ux as Bg,E as Cg,k8 as Dg,xx as Eg,Vx as Fg};

package/bin/vm-hands/vm-hands-entry-lite-tytfs183.js

@@ -1,42 +0,0 @@
-// @bun
-import{Vk as W}from"./vm-hands-entry-lite-q8wkrzer.js";var T=W.string().max(201).regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/).refine((Q)=>Q.split("/").every((Z)=>Z!=="."&&Z!=="..")),G=W.string().min(1).max(255).regex(/^[A-Za-z0-9_][A-Za-z0-9_./-]*$/).refine((Q)=>!Q.includes("..")&&!Q.includes("//")&&!Q.endsWith("/")&&!Q.endsWith(".lock")),M=W.string().regex(/^[a-f0-9]{40}$/),q=W.number().int().positive(),C=W.string().min(1).max(256),A=W.string().max(60000),B={version:W.literal(1),repoFullName:T},J=W.array(W.string().max(1024).regex(/^(?:Co-authored-by: [^<>\r\n\x00]+ <[^<>\s]+@[^<>\s]+>|Reason-Contributor-ID: rc_[a-f0-9]{32})$/)).max(1000),c=W.strictObject({expectedTrailers:J,missingFromHead:J}),y=W.discriminatedUnion("action",[W.strictObject({action:W.literal("edit"),title:C.optional(),body:A.optional(),base:G.optional()}),W.strictObject({action:W.enum(["ready","draft","close"])}),W.strictObject({action:W.literal("metadata"),field:W.enum(["reviewer","assignee","label"]),change:W.enum(["add","remove"]),value:W.string().min(1).max(100).refine((Q)=>!/[\r\n\0]/.test(Q))})]),d=W.discriminatedUnion("kind",[W.strictObject({...B,kind:W.literal("read"),path:W.string().min(1).max(2048),accept:W.enum(["application/vnd.github+json","application/vnd.github.full+json","application/vnd.github.v3.diff"]).optional()}),W.strictObject({...B,kind:W.literal("pr_review_context"),number:q,after:W.string().min(1).max(1024).optional()}),W.strictObject({...B,kind:W.literal("prepare"),branch:G,baseSha:M,defaultBranch:G,diagnosticsVersion:W.literal(1).optional()}),W.strictObject({...B,kind:W.literal("publish"),branch:G,defaultBranch:G,baseSha:M,remoteHeadSha:M.nullable(),contributorTrailers:J.optional()}),W.strictObject({...B,kind:W.literal("pr_create"),head:G,base:G,title:C,body:A,draft:W.boolean()}),W.strictObject({...B,kind:W.literal("pr_mutation"),number:q,mutation:y}),W.strictObject({...B,kind:W.literal("pr_merge"),number:q,expectedHeadSha:M,expectedBaseRef:G,method:W.enum(["merge","squash","rebase"]),commitBody:W.string().max(65536).optional()})]),O=["local_device_gh_prepare_setup","local_device_gh_prepare_metadata","local_device_gh_prepare_private_init","local_device_gh_prepare_fetch","local_device_gh_prepare_base_mismatch","local_device_gh_prepare_checkout_validation","local_device_gh_prepare_checkout_init","local_device_gh_prepare_materialization"];function h(Q){return O.some((Z)=>Z===Q)}class R extends Error{code;constructor(Q){super(Q);this.code=Q}}function ZQ(Q,Z,$){let z=d.safeParse(Q);return Z==="failed"&&z.success&&z.data.kind==="prepare"&&z.data.diagnosticsVersion===1&&h($)}var x=245760,$Q=W.discriminatedUnion("kind",[W.strictObject({kind:W.literal("pr_review_context"),body:W.string().max(x)}),W.strictObject({kind:W.literal("prepare"),headSha:M}),W.strictObject({kind:W.literal("read"),status:W.number().int().min(200).max(599),headers:W.record(W.string(),W.string().max(8192)).refine((Q)=>Object.keys(Q).every((Z)=>Z==="link"||Z==="content-type")),body:W.string().max(x)}),W.strictObject({kind:W.literal("publish"),headSha:M,scannedObjectCount:W.number().int().min(0).max(5000),attribution:c.optional()}),W.strictObject({kind:W.literal("pr_create"),url:W.string().max(1024).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/)}),W.strictObject({kind:W.literal("pr_mutation"),number:q,applied:W.literal(!0)}),W.strictObject({kind:W.literal("pr_merge"),number:q,merged:W.literal(!0)})]).refine((Q)=>new TextEncoder().encode(JSON.stringify(Q)).byteLength<=x,"local_device_gh_result_too_large"),r=W.strictObject({source:W.enum(["agent","human"]),operationId:W.uuid()}),m=W.strictObject({version:W.literal(1),userId:W.guid(),deviceId:W.guid(),rootId:W.guid(),runId:W.guid(),merge:r.optional(),contributorRefresh:W.guid().optional(),repoFullName:T.nullable(),rootRevision:W.string().regex(/^[1-9][0-9]*$/),readOnly:W.boolean(),generation:W.number().int().positive().nullable(),fenceId:W.guid().nullable()}).refine((Q)=>Q.generation===null===(Q.fenceId===null));function P(Q){return/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(Q)&&Q.split("/").every((Z)=>Z!=="."&&Z!=="..")}function KQ(Q,Z,$={},z="read"){if(P(Q)&&(Z==="/search/issues"||Z.startsWith("/search/issues?")))return p(Q,Z,$);if(!P(Q)||!Z.startsWith(`/repos/${Q}/`)&&Z!==`/repos/${Q}`)throw Error("local_device_gh_repository_mismatch");if(/[\\#\u0000-\u001f]/.test(Z)||/%(?:2e|5c|00)/i.test(Z))throw Error("local_device_gh_path_denied");let V=new URL(Z,"https://api.github.com");if(V.pathname!==Z.split("?")[0]||V.username||V.password)throw Error("local_device_gh_path_denied");let Y;try{Y=decodeURIComponent(V.pathname.slice(`/repos/${Q}`.length))}catch{throw Error("local_device_gh_path_denied")}if(Y.includes("%")||Y.split("/").some((D)=>D==="."||D===".."))throw Error("local_device_gh_path_denied");if(($.method??"GET").toUpperCase()!=="GET"||$.body!=null)throw Error("local_device_gh_mutation_not_admitted");if(![/^$/,/^\/commits$/,/^\/pulls$/,/^\/pulls\/[1-9][0-9]*(?:\/(?:commits|files|reviews|comments))?$/,/^\/issues\/[1-9][0-9]*(?:\/comments)?$/,/^\/issues\/comments\/[1-9][0-9]*\/reactions$/,/^\/commits\/[A-Za-z0-9_./-]+(?:\/(?:check-runs|status))?$/,/^\/check-runs\/[1-9][0-9]*(?:\/annotations)?$/,/^\/branches\/[A-Za-z0-9_./-]+$/,/^\/git\/ref\/heads\/[A-Za-z0-9_./-]+$/,/^\/compare\/[A-Za-z0-9_./-]+\.\.\.[A-Za-z0-9_./-]+$/].some((D)=>D.test(Y)))throw Error("local_device_gh_path_denied");if(V.searchParams.forEach((D,X)=>{if(X==="per_page"&&/^[1-9][0-9]*$/.test(D)&&Number(D)<=100)return;if(X==="page"&&/^[1-9][0-9]*$/.test(D)&&Number(D)<=100)return;if(Y==="/pulls"&&X==="state"&&["open","closed","all"].includes(D))return;if(Y==="/pulls"&&X==="sort"&&D==="updated")return;if(Y==="/pulls"&&X==="direction"&&D==="desc")return;if(Y==="/pulls"&&["head","base"].includes(X)&&/^[A-Za-z0-9_./:-]{1,255}$/.test(D))return;throw Error("local_device_gh_query_denied")}),$.headers)new Headers($.headers).forEach((X,_)=>{if(_!=="accept"||!["application/vnd.github+json","application/vnd.github.full+json","application/vnd.github.v3.diff"].includes(X))throw Error("local_device_gh_header_denied")})}function p(Q,Z,$){if(/[\\#\u0000-\u001f]/.test(Z))throw Error("local_device_gh_path_denied");let z=new URL(Z,"https://api.github.com");if(z.pathname!=="/search/issues"||z.username||z.password)throw Error("local_device_gh_path_denied");if(($.method??"GET").toUpperCase()!=="GET"||$.body!=null)throw Error("local_device_gh_mutation_not_admitted");let V=null;z.searchParams.forEach((H,D)=>{if(D==="q"&&V===null){V=H;return}if(D==="per_page"&&/^[1-9][0-9]*$/.test(H)&&Number(H)<=100)return;if(D==="page"&&/^[1-9][0-9]*$/.test(H)&&Number(H)<=100)return;throw Error("local_device_gh_query_denied")});let Y=`repo:${Q.toLowerCase()} `,N=V?.toLowerCase()??"";if(N.length>512||!(N+" ").startsWith(Y)||/(?:^|\s)(?:repo|org|user):/.test(N.slice(Y.length)))throw Error("local_device_gh_query_denied");if($.headers)new Headers($.headers).forEach((H,D)=>{if(D!=="accept"||H!=="application/vnd.github+json")throw Error("local_device_gh_header_denied")})}var DQ=`query PullRequestReviewContext($owner: String!, $repo: String!, $number: Int!, $after: String) {
-      repository(owner: $owner, name: $repo) {
-        nameWithOwner
-        pullRequest(number: $number) {
-          number
-          reviewDecision
-          headRefOid
-          baseRefOid
-          baseRef {
-            branchProtectionRule {
-              requiresApprovingReviews
-              requiredApprovingReviewCount
-              requiresStatusChecks
-              requiredStatusCheckContexts
-              requiresConversationResolution
-              dismissesStaleReviews
-            }
-          }
-          reviewThreads(first: 100, after: $after) {
-            nodes {
-              id isResolved isOutdated viewerCanResolve viewerCanUnresolve
-              path line originalLine startLine originalStartLine diffSide startDiffSide
-              comments(first: 100) {
-                nodes {
-                  id databaseId body createdAt updatedAt url
-                  author { __typename login }
-                  replyTo { databaseId }
-                }
-                pageInfo { hasNextPage }
-              }
-            }
-            pageInfo { hasNextPage endCursor }
-          }
-        }
-      }
-    }`;function zQ(Q){return Q.kind==="read"||Q.kind==="pr_review_context"}var b=["inspect_project","fs.read","fs.write","fs.search","fs.watch","fs.upload","fs.export","fs.import","fs.download","exec.run","exec.full","process.run.v1","process.full.v1","pty.start","pty.input","pty.resize","pty.close","git.run","process.list","process.signal","ports.list","tunnel.open","tunnel.close","env.discover","setup.run","mcp.discover","mcp.start","mcp.proxy","browser.snapshot","browser.navigate","browser.act","computer.snapshot","computer.act","computer.use","browser.use","browser.recording.v1","browser.pr-proof.v1","hands.connect","jobs.control","environment.install","github.local.v1","inference.ollama.v1","inference.custom.v1","delegate.devin.copy.v1","delegate.cursor.copy.v1","display.stream.v1","automation.call.v1","preview.serve.v1","workspace.setup.v1","simulator.call.v1","simulator.stream.v1"];var j=2,I="/app/local-runtime",n=262144,HQ="x-reason-relay-host-alias",XQ="v1";function F(Q,Z){return{path:`${I}${Q}`,routerPath:Q,auth:Z}}function g(Q,Z){return{...F(Q,"device_proof"),forOperation($){return F(`/operations/${encodeURIComponent($)}${Z}`,"device_proof")}}}var GQ={register:F("/register","registration_bearer"),enroll:F("/enroll","none"),authChallenge:F("/auth/challenge","none"),identity:F("/identity","device_proof"),heartbeat:F("/heartbeat","device_proof"),rootsSync:F("/roots/sync","device_proof"),disconnect:F("/disconnect","device_proof"),lifecycle:F("/lifecycle","device_proof"),localSubscription:F("/local-subscription","device_proof"),ownerWorkspaces:F("/owner-workspaces","device_proof"),ownerWorkspaceEnrollment:F("/owner-workspaces/enrollment","device_proof"),sessionWorktrees:F("/session-worktrees","device_proof"),operationClaim:F("/operations/claim","device_proof"),operationHeartbeat:g("/operations/:operationId/heartbeat","/heartbeat"),operationEvents:g("/operations/:operationId/events","/events"),operationComplete:g("/operations/:operationId/complete","/complete"),operationEnvironment:g("/operations/:operationId/environment","/environment"),operationEnvironmentAck:g("/operations/:operationId/environment-ack","/environment-ack"),operationCustomEndpointCredential:g("/operations/:operationId/custom-endpoint-credential","/custom-endpoint-credential")},BQ=`${I}/session`,MQ=4096,gQ=5000,o=[/^\/app\/local-runtime\/heartbeat$/,/^\/app\/local-runtime\/operations\/claim$/,/^\/app\/local-runtime\/operations\/[0-9a-fA-F-]{36}\/(?:heartbeat|events|complete|environment|environment-ack)$/];function qQ(Q){return o.some((Z)=>Z.test(Q))}var NQ="vm_hands_v1",mQ=60000,UQ={unauthenticated:4401,unavailable:4404,overloaded:4429,serviceRestart:1012},jQ="hands_control_v1",xQ="environment.deliver",JQ="vm_hands_workspace_deferred",SQ="vm_hands.workspace_grant",IQ="hands.unbind_unverified",PQ="claim_v1",TQ="environment_at_claim",CQ="ready_v1",AQ="workspace_check",bQ="rebind_v1",EQ="grant_v1",kQ="workspace_grant",LQ="resident_rebind",fQ="hands.rebind",_Q="snapshot_v1",cQ="cloud_access",yQ="playwright_v1",dQ="headless_browser",OQ="v1",hQ="job_env_large_values",RQ="srt_root_v1",rQ="hands_confinement",pQ="gid_v1",nQ="model_jobs_egress",oQ="setpriv_v1",sQ="jobs_user",iQ="spawning_attempt_v1",tQ="hands_session_group",vQ="session_uid_v1",lQ="hands_session_account",uQ="session_cap",aQ="none",eQ="same_launch_v1",QW="exit_v1",WW="start_wait",ZW="user_chrome",$W="cloud_sessions";function S(Q){if(!K(Q)||Object.keys(Q).length!==5||Q.version!==1)return!1;let Z=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;return["boot_generation","recording_operation_id","recording_attempt_id"].every(($)=>typeof Q[$]==="string"&&Z.test(Q[$]))&&typeof Q.root_version==="string"&&/^[0-9]{1,20}(?:\.[0-9]{1,6})?$/.test(Q.root_version)}function U(Q){if(!K(Q)||Object.keys(Q).length!==6)return!1;let Z=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;return typeof Q.device_id==="string"&&Z.test(Q.device_id)&&(Q.binding==="workspace_source"||Q.binding==="mcp_control")&&Number.isSafeInteger(Q.target_revision)&&Number(Q.target_revision)>=0&&Number.isSafeInteger(Q.root_grant_revision)&&Number(Q.root_grant_revision)>0&&Number.isSafeInteger(Q.target_generation)&&Number(Q.target_generation)>0&&typeof Q.target_fence_id==="string"&&Z.test(Q.target_fence_id)}var KW=["lock_acquired","enrollment_started","enrollment_completed","readiness_started","readiness_completed","inventory_completed","control_ready"],DW=86400000,zW=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"],s=["production","staging"];function E(Q){if(!K(Q)||Object.keys(Q).length!==3)return!1;let Z=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;return["organization_id","user_id","device_id"].every(($)=>Object.hasOwn(Q,$)&&typeof Q[$]==="string"&&Z.test(Q[$])&&Q[$]!=="00000000-0000-0000-0000-000000000000")}var i="DEVICE-PROOF-V2",FW="ARA-DEVICE-V1";function wW(Q,Z=i){let $=Q.method.toUpperCase();if(!/^[A-Z]+$/.test($)||!Q.pathAndQuery.startsWith(`${I}/`)||Q.pathAndQuery.includes(`
-`)||!/^[0-9]{1,20}$/.test(Q.timestamp)||!/^[A-Za-z0-9_-]{22,43}$/.test(Q.nonce)||Q.challenge.length<16||Q.challenge.length>1024||Q.challenge.includes(`
-`)||!/^[a-f0-9]{64}$/.test(Q.bodySha256))throw Error("Invalid Reason Device proof input.");return Buffer.from([Z,$,Q.pathAndQuery,Q.timestamp,Q.nonce,Q.challenge,Q.bodySha256].join(`
-`),"utf8")}function K(Q){return Boolean(Q)&&typeof Q==="object"&&!Array.isArray(Q)}function t(Q,Z){return typeof Q==="string"&&Z.some(($)=>$===Q)}function k(Q){return K(Q)&&typeof Q.id==="string"&&typeof Q.label==="string"&&typeof Q.path_fingerprint==="string"}function v(Q){return K(Q)&&Number.isInteger(Q.seq)&&Number(Q.seq)>=0&&typeof Q.kind==="string"&&/^[A-Za-z0-9._:-]{1,64}$/.test(Q.kind)&&K(Q.payload)}function w(Q){throw Error(Q)}function VW(Q,Z){let $=K(Q)?Q:{},z=typeof $.error==="string"?$.error:`http_${Z}`,V=typeof $.detail==="string"?$.detail:typeof $.message==="string"?$.message:`Reason Device request failed (${Z})`;return{code:z,message:V}}function l(Q){if(!K(Q)||typeof Q.challenge!=="string"||Q.challenge.length<16||Q.challenge.length>1024||Q.challenge.includes(`
-`)||typeof Q.expires_at!=="string"||!Number.isFinite(Date.parse(Q.expires_at)))w("Reason returned an invalid Device proof challenge.");return{challenge:Q.challenge,expires_at:Q.expires_at}}function L(Q,Z){if(!K(Q)||typeof Q.device_id!=="string"||Q.auth_scheme!=="p256"||Q.organization_id!==void 0&&typeof Q.organization_id!=="string"||Q.protocol_version!==j||!Array.isArray(Q.roots)||!Q.roots.every(k)||Z&&typeof Q.organization_id!=="string"||Q.device_credential!==void 0)w(Z?"Reason returned an invalid Device enrollment.":"Reason returned an invalid Device registration.");return{...{device_id:Q.device_id,...typeof Q.organization_id==="string"?{organization_id:Q.organization_id}:{},protocol_version:j,roots:Q.roots},auth_scheme:"p256"}}function YW(Q){return L(Q,!1)}function HW(Q){let Z=L(Q,!0);if(typeof Z.organization_id!=="string")return w("Reason returned an invalid Device enrollment.");return{...Z,organization_id:Z.organization_id}}function XW(Q){if(!K(Q)||typeof Q.server_time!=="string"||typeof Q.drain!=="boolean")return w("Reason returned an invalid Device heartbeat.");return{server_time:Q.server_time,drain:Q.drain,...f(Q),...typeof Q.update_policy==="string"||Q.update_policy===null?{update_policy:Q.update_policy}:{},...typeof Q.supported_protocol_version==="number"?{supported_protocol_version:Q.supported_protocol_version}:{},...a(Q.latest_cli_versions),...Q.hands_prespawn===!0?{hands_prespawn:!0}:{}}}var u=["account_root_metadata_supported","workspace_root_metadata_supported","account_root_path_supported","home_contained_roots_supported","root_paths_supported","startup_supported"];function f(Q){return Object.fromEntries(u.filter((Z)=>Q[Z]===!0).map((Z)=>[Z,!0]))}function GW(Q){if(!K(Q))return;try{return{...l(Q),...f(Q)}}catch{return}}function a(Q){if(!K(Q))return{};let Z={};for(let $ of s){let z=Q[$];if(typeof z==="string"&&/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/.test(z))Z[$]=z}return Object.keys(Z).length>0?{latest_cli_versions:Z}:{}}function BW(Q){if(!K(Q)||!Array.isArray(Q.roots)||!Q.roots.every(k))return w("Reason returned an invalid Device root sync.");return{roots:Q.roots}}function MW(Q){if(!K(Q)||Q.user_id!==void 0&&typeof Q.user_id!=="string"||typeof Q.organization_id!=="string"||typeof Q.organization_name!=="string"||typeof Q.organization_slug!=="string")return w("Reason returned an invalid Device identity.");return{...typeof Q.user_id==="string"?{user_id:Q.user_id}:{},organization_id:Q.organization_id,organization_name:Q.organization_name,organization_slug:Q.organization_slug}}function gW(Q){if(!K(Q)||Q.disconnected!==!0)return w("Reason did not disconnect this Device.");let Z=Q.sessions_moved;return typeof Z==="number"&&Number.isSafeInteger(Z)&&Z>=0?{disconnected:!0,sessions_moved:Z}:{disconnected:!0}}function qW(Q){if(K(Q)&&Q.ok===!0&&typeof Q.expires==="number")return{ok:!0,expires:Q.expires};if(K(Q)&&Q.ok===!1&&typeof Q.error==="string")return{ok:!1,error:Q.error};return w("Reason did not answer the local login hand-over.")}function NW(Q){if(!K(Q)||Q.accepted!==!0)return w("Reason did not accept the Device lifecycle event.");return{accepted:!0}}function e(Q){return Buffer.byteLength(JSON.stringify(Q),"utf8")}function mW(Q,Z=b){if(!K(Q)||typeof Q.operation_id!=="string"||typeof Q.attempt_id!=="string"||typeof Q.attempt_token!=="string"||!/^(?:reason|ara)_attempt_/.test(Q.attempt_token)||typeof Q.lease_until!=="string"||typeof Q.run_id!=="string"||typeof Q.root_id!=="string"||Q.owner!==void 0&&!E(Q.owner)||!t(Q.capability,Z)||!K(Q.payload)||Q.protocol_version!==j||e(Q.payload)>n||Q.authority!==void 0&&!U(Q.authority)||Q.local_github_authority!==void 0&&!m.safeParse(Q.local_github_authority).success||Q.capability==="github.local.v1"&&!m.safeParse(Q.local_github_authority).success||Q.recording_authority!==void 0&&!S(Q.recording_authority)||Q.capability==="browser.recording.v1"&&(!S(Q.recording_authority)||!E(Q.owner))||Q.capability!=="browser.recording.v1"&&Q.recording_authority!==void 0)return w("Reason returned an invalid Device operation claim.");let $={operation_id:Q.operation_id,attempt_id:Q.attempt_id,attempt_token:Q.attempt_token,lease_until:Q.lease_until,run_id:Q.run_id,root_id:Q.root_id,capability:Q.capability,payload:Q.payload,...U(Q.authority)?{authority:Q.authority}:{},...S(Q.recording_authority)?{recording_authority:Object.freeze({...Q.recording_authority})}:{},...Q.local_github_authority!==void 0?{local_github_authority:m.parse(Q.local_github_authority)}:{},...Q.capability==="hands.connect"&&K(Q.environment)&&K(Q.environment.payload)&&U(Q.environment.authority)?{environment:{payload:Q.environment.payload,authority:Q.environment.authority}}:{},protocol_version:j};if(Q.owner!==void 0)$.owner=Object.freeze({...Q.owner});return $}function UW(Q){if(!K(Q)||typeof Q.lease_until!=="string"||!Array.isArray(Q.controls)||!Q.controls.every(v)||!Number.isInteger(Q.next_control_seq)||Number(Q.next_control_seq)<0)return w("Reason returned an invalid Device operation heartbeat.");return{lease_until:Q.lease_until,controls:Q.controls,next_control_seq:Number(Q.next_control_seq)}}function jW(Q){if(!K(Q)||!Number.isInteger(Q.next_event_seq)||Number(Q.next_event_seq)<0||typeof Q.duplicate!=="boolean"||!Number.isInteger(Q.accepted_count)||Number(Q.accepted_count)<0)return w("Reason returned an invalid Device operation event result.");return{next_event_seq:Number(Q.next_event_seq),duplicate:Q.duplicate,accepted_count:Number(Q.accepted_count)}}function xW(Q){if(!K(Q)||!K(Q.payload)||!U(Q.authority))return w("Reason returned an invalid Device environment delivery.");return{payload:Q.payload,authority:Q.authority}}function QQ(Q){return Q==="succeeded"||Q==="failed"||Q==="cancelled"||Q==="expired"}function JW(Q){if(!K(Q)||!QQ(Q.status)||typeof Q.idempotent!=="boolean")return w("Reason returned an invalid Device operation completion.");return{status:Q.status,idempotent:Q.idempotent}}
-export{d as Xe,R as Ye,ZQ as Ze,x as _e,$Q as $e,m as af,KQ as bf,DQ as cf,zQ as df,b as ef,j as ff,I as gf,n as hf,HQ as if,XQ as jf,GQ as kf,BQ as lf,MQ as mf,gQ as nf,qQ as of,NQ as pf,mQ as qf,UQ as rf,jQ as sf,xQ as tf,JQ as uf,SQ as vf,IQ as wf,PQ as xf,TQ as yf,CQ as zf,AQ as Af,bQ as Bf,EQ as Cf,kQ as Df,LQ as Ef,fQ as Ff,_Q as Gf,cQ as Hf,yQ as If,dQ as Jf,OQ as Kf,hQ as Lf,RQ as Mf,rQ as Nf,pQ as Of,nQ as Pf,oQ as Qf,sQ as Rf,iQ as Sf,tQ as Tf,vQ as Uf,lQ as Vf,uQ as Wf,aQ as Xf,eQ as Yf,QW as Zf,WW as _f,ZW as $f,$W as ag,KW as bg,DW as cg,zW as dg,i as eg,FW as fg,wW as gg,VW as hg,l as ig,YW as jg,HW as kg,XW as lg,GW as mg,BW as ng,MW as og,gW as pg,qW as qg,NW as rg,mW as sg,UW as tg,jW as ug,xW as vg,JW as wg};

package/bin/vm-hands/vm-hands-entry-lite-v4jtxgaj.js

@@ -1,4 +0,0 @@
-// @bun
-import{hl as b}from"./vm-hands-entry-lite-gxper06w.js";import{ql as W}from"./vm-hands-entry-lite-magmzx9c.js";import{execFileSync as C}from"child_process";import{mkdirSync as f,readdirSync as K,readFileSync as k,rmSync as G,statSync as A,writeFileSync as F}from"fs";import{join as $,sep as R}from"path";import{setTimeout as L}from"timers/promises";var O=3000,Y=null;function x(z){return $(z,"users")}function I(z){if(Y?.root===z.root)return;let H=x(z.root);f(H,{recursive:!0,mode:448}),F($(H,String(process.pid)),"",{mode:384}),Y=z}function w(){if(!Y)return;G($(x(Y.root),String(process.pid)),{force:!0}),Y=null}function B(z){try{return process.kill(z,0),!0}catch(H){return H instanceof Error&&"code"in H&&H.code==="EPERM"}}function j(){let z=process.getuid?.();if(process.platform==="linux")return K("/proc").flatMap((N)=>{if(!/^\d+$/.test(N))return[];try{if(A(`/proc/${N}`).uid!==z)return[];let Q=k(`/proc/${N}/cmdline`).toString("utf8").split("\x00").join(" ").trim();return Q?[{pid:Number(N),command:Q}]:[]}catch{return[]}});if(process.platform==="win32")return C(b("powershell.exe"),["-NoLogo","-NoProfile","-NonInteractive","-Command",'Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.CommandLine)" }'],{encoding:"utf8",maxBuffer:16777216,windowsHide:!0}).split(/\r?\n/).flatMap((Q)=>{let V=/^(\d+) (.+)$/.exec(Q.trim());return V?[{pid:Number(V[1]),command:V[2]}]:[]});return C("/bin/ps",["-axww","-o","pid=,uid=,command="],{encoding:"utf8",maxBuffer:16777216}).split(`
-`).flatMap((N)=>{let Q=/^\s*(\d+)\s+(\d+)\s+(.+)$/.exec(N);return Q&&Number(Q[2])===z?[{pid:Number(Q[1]),command:Q[3]}]:[]})}async function h(){let z=Y;if(!z)return{released:"unused",stopped:0};let H=x(z.root);G($(H,String(process.pid)),{force:!0}),Y=null;let N=!1;for(let J of K(H)){let U=Number(J);if(Number.isSafeInteger(U)&&U>0&&B(U))N=!0;else G($(H,J),{force:!0})}if(N)return{released:"shared",stopped:0};let Q=j().filter((J)=>J.pid!==process.pid&&(J.command.includes(`${z.root}${R}`)||J.command.includes(`${z.automation}${R}`)||J.command.includes(z.extensionDir))),V=(J,U)=>{try{process.kill(J,U)}catch{}};for(let J of Q)V(J.pid,"SIGTERM");for(let J=Date.now()+O;Date.now()<J&&Q.some((U)=>B(U.pid));)await new Promise((U)=>setTimeout(U,100));for(let J of Q)if(B(J.pid))V(J.pid,"SIGKILL");return{released:"stopped",stopped:Q.length}}var v=20000,M=30000,P=100,Z=new Map,X=null,q=[];function y(z){Z.set(z,(Z.get(z)??0)+1);let H=!1;return()=>{if(H)return;H=!0;let N=(Z.get(z)??1)-1;if(N>0){Z.set(z,N);return}if(Z.delete(z),X?.run===z)X.idleUntil=0}}function D(){return new W("automation_desktop_busy","Another Session, or another agent of this Session, is using this worker's desktop. Retry after it finishes.")}function E(z,H){return X!==null&&X.run!==z&&(X.calls>0||H<X.idleUntil)}async function u(z,H,N=Date.now){let Q=Symbol(z);q.push(Q);try{let U=N()+M;for(;;){if(!E(z,N())&&(X?.run===z||q[0]===Q))break;if(N()>=U)throw D();await L(P,void 0,{signal:H}).catch(()=>H.throwIfAborted())}}finally{q.splice(q.indexOf(Q),1)}if(X?.run!==z)X={run:z,calls:0,idleUntil:0};let V=X;V.calls+=1;let J=!1;return()=>{if(J)return;J=!0,V.calls-=1,V.idleUntil=N()+v}}
-export{I as Wk,w as Xk,h as Yk,v as Zk,M as _k,y as $k,u as al};

package/bin/vm-hands/vm-hands-entry-lite-vgpt2n1v.js

@@ -1,11 +0,0 @@
-// @bun
-import{vd as rq,wd as nq}from"./vm-hands-entry-lite-d2w8tghq.js";import{Fi as Aq,Gi as sq,Ki as Wq,Li as Xq,Mi as X,Pi as uq,Ri as Bq,Si as pq,Ui as c,Vi as P,Wi as Dq}from"./vm-hands-entry-lite-xp3qzxk5.js";import{mj as Kq}from"./vm-hands-entry-lite-4k4h9rcq.js";import{Hj as vq,Ij as dq,Kj as cq,Nj as hq,Oj as lq,Pj as oq,Qj as Nq}from"./vm-hands-entry-lite-0h4qmgm2.js";import{Yj as d}from"./vm-hands-entry-lite-6nwbqg37.js";import{ml as Gq}from"./vm-hands-entry-lite-gxper06w.js";import{randomUUID as T}from"crypto";import{chmodSync as Jq,closeSync as u,constants as m,existsSync as E,fstatSync as iq,lstatSync as A,mkdirSync as n,openSync as aq,readFileSync as g,readdirSync as Oq,readlinkSync as I,realpathSync as S,renameSync as k,rmSync as v,statSync as x,symlinkSync as Qq,unlinkSync as C,writeFileSync as h}from"fs";import{basename as r,dirname as D,isAbsolute as BG,join as K,relative as DG,resolve as O,sep as eq}from"path";import{spawnSync as Eq}from"child_process";import{createRequire as tq}from"module";var Zq=1,qG=1,GG=128,OG=65536,EG="https://reasonmachines.com/api/runtime-manifest-v2",IG=30000,CG=600000,Vq=1e4,TG=60000,SG=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var Pq=/^[a-z0-9_.-]{1,80}$/,FG=64,LG="so.ara.device-broker",JG=[LG,"com.reasonmachines.device-broker"],mJ=dq(JG),gq=["com.apple.security.cs.allow-jit","com.apple.security.cs.allow-unsigned-executable-memory"],wG=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function t(q){if(q?.aborted)throw new X("update_cancelled","Managed runtime update request was cancelled.")}function Iq(q){return Boolean(q)&&typeof q==="object"&&!Array.isArray(q)}function Cq(q,G,J=[]){let Q=new Set([...G,...J]);return G.every((R)=>(R in q))&&Object.keys(q).every((R)=>Q.has(R))}function B(q){return typeof q==="string"&&SG.test(q)}function QG(q){return typeof q==="string"&&!Number.isNaN(Date.parse(q))&&new Date(q).toISOString()===q}function kG(q){return Xq.includes(q)}function b(q){n(q,{recursive:!0,mode:448}),Jq(q,448)}function RG(q,G){b(D(q));let J=`${q}.${process.pid}.${T()}.tmp`;try{h(J,G,{mode:384,flag:"wx"}),Jq(J,384),k(J,q)}finally{if(E(J))C(J)}}function Tq(q={}){if((q.platform??process.platform)!=="darwin")throw new X("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let J=q.environment??process.env,Q=Kq(J,"REASON_CLI_CHANNEL")==="staging",R=Q?Kq(J,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,W=q.root!==void 0||Boolean(R&&BG(R))?null:K(q.home??d(),"Library","Application Support"),_=q.root??(W?K(W,Q?"Reason Staging":"Reason","CLI"):R);return{executableName:"reason",root:_,...W?{legacyRoot:K(W,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:K(_,"versions"),current:K(_,"current"),previous:K(_,"previous"),brokerLock:K(_,"broker.lock"),transitionLock:K(_,"transition.lock"),lifecycleEvents:K(_,"lifecycle-events")}}function vJ(q){let G=q.legacyRoot;if(!G)return null;return{root:G,versions:K(G,"versions"),current:K(G,"current"),previous:K(G,"previous"),brokerLock:K(G,"broker.lock"),transitionLock:K(G,"transition.lock"),lifecycleEvents:K(G,"lifecycle-events")}}function F(q,G){if(!B(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let J=K(q.versions,G,"ara");if(!q.executableName)return J;let Q=K(q.versions,G,q.executableName),R=(_)=>{try{return A(_),!0}catch(Z){if(Z.code==="ENOENT")return!1;throw Z}},U=R(J),W=R(Q);if(U&&W)throw new X("installed_artifact_mismatch","Ambiguous managed runtime executable layout.");return U?J:Q}function i(q,G){if(!B(G))throw new X("invalid_version","Invalid managed Reason runtime version.");return Sq(F(q,G))}function Sq(q){return K(D(q),r(q)==="reason"?sq:Aq)}function UG(q,G){if(!B(q)||!B(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let[J,Q]=q.split("-",2),[R,U]=G.split("-",2),W=J.split(".").map(Number),_=R.split(".").map(Number);for(let H=0;H<3;H+=1){let j=W[H]-_[H];if(j!==0)return j<0?-1:1}if(Q===void 0||U===void 0){if(Q===U)return 0;return Q===void 0?1:-1}let Z=Q.split("."),$=U.split("."),Y=Math.max(Z.length,$.length);for(let H=0;H<Y;H+=1){let j=Z[H],z=$[H];if(j===void 0||z===void 0){if(j===z)return 0;return j===void 0?-1:1}if(j===z)continue;let M=/^\d+$/.test(j),w=/^\d+$/.test(z);if(M&&w)return Number(j)<Number(z)?-1:1;if(M!==w)return M?-1:1;return j<z?-1:1}return 0}function xG(q=process.arch){let G=`darwin-${q}`;if(!kG(G))throw new X("unsupported_architecture","The managed Reason runtime supports only Apple Silicon and Intel Macs.");return G}function bq(q){return[...q.matchAll(/<key>\s*([^<]+?)\s*<\/key>/g)].map((G)=>G[1].trim())}function yq(q){let G=q.match(/^CodeDirectory .*$/gm)??[];return G.length>0&&G.every((J)=>{return(/ flags=0x[0-9a-f]+\(([^)]*)\)(?: |$)/.exec(J)?.[1]?.split(/[ ,]+/).filter(Boolean)??[]).includes("runtime")})}function VG(q){let G=`TeamIdentifier=${vq}`,J=JG.map((U)=>`Identifier=${U}`),Q=bq(q.brokerEntitlements),R=bq(q.credentialLibraryEntitlements);if(!q.brokerDetail.split(`
-`).includes(G)||!q.brokerDetail.split(`
-`).some((U)=>J.includes(U))||!yq(q.brokerDetail)||Q.length!==gq.length||gq.some((U)=>!new RegExp(`<key>\\s*${U.replaceAll(".","\\.")}\\s*</key>\\s*<true\\s*/>`).test(q.brokerEntitlements)))throw new X("invalid_code_signature","Managed runtime broker has an invalid Reason signature, identifier, or entitlement set.");if(!q.credentialLibraryDetail.split(`
-`).includes(G)||!yq(q.credentialLibraryDetail)||R.length!==0)throw new X("invalid_code_signature","Managed runtime credential library has an invalid signature or entitlement.")}function y(q,G){let J=Eq("/usr/bin/codesign",q,{stdio:["ignore","pipe","pipe"]});if(J.status!==0)throw new X("invalid_code_signature",G);return[new TextDecoder().decode(J.stdout??new Uint8Array),new TextDecoder().decode(J.stderr??new Uint8Array)].join("")}var Fq=(q,G)=>{y(["--verify","--strict","--verbose=2",q],"Managed runtime broker code signature is invalid."),y(["--verify","--strict","--verbose=2",G],"Managed runtime credential library code signature is invalid."),VG({brokerDetail:y(["-d","--verbose=4",q],"Managed runtime broker signer could not be inspected."),brokerEntitlements:y(["-d","--entitlements",":-",q],"Managed runtime broker entitlements could not be inspected."),credentialLibraryDetail:y(["-d","--verbose=4",G],"Managed runtime credential library signer could not be inspected."),credentialLibraryEntitlements:y(["-d","--entitlements",":-",G],"Managed runtime credential library entitlements could not be inspected.")})};async function PG(q,G,J){let Q=q.headers.get("content-length");if(Q!==null){let Y=Number(Q);if(!Number.isSafeInteger(Y)||Y<0||Y>G)throw new X("response_too_large","Managed runtime response exceeded its size limit.")}if(!q.body){let Y=new Uint8Array(await q.arrayBuffer());if(Y.byteLength>G)throw new X("response_too_large","Managed runtime response exceeded its size limit.");return Y}let R=q.body.getReader(),U=[],W=0,_=()=>{if(!J)return R.read();return new Promise((Y,H)=>{let j=()=>{J.removeEventListener("abort",j),R.cancel(J.reason).catch(()=>{}),H(J.reason??new DOMException("Aborted","AbortError"))};if(J.aborted){j();return}J.addEventListener("abort",j,{once:!0}),R.read().then((z)=>{J.removeEventListener("abort",j),Y(z)},(z)=>{J.removeEventListener("abort",j),H(z)})})};try{while(!0){let Y=await _();if(Y.done)break;if(W+=Y.value.byteLength,W>G)throw await R.cancel(),new X("response_too_large","Managed runtime response exceeded its size limit.");U.push(Y.value)}}finally{try{R.releaseLock()}catch{}}let Z=new Uint8Array(W),$=0;for(let Y of U)Z.set(Y,$),$+=Y.byteLength;return Z}async function p(q){let G;try{G=new URL(q.url)}catch{throw new X("invalid_update_url","Managed runtime update URL is invalid.")}if(G.protocol!=="https:"||G.username||G.password||G.hash)throw new X("invalid_update_url","Managed runtime update URL must use HTTPS.");let J=new AbortController,Q,R=()=>{Q??="caller",J.abort(q.signal?.reason)};if(q.signal?.aborted)R();else q.signal?.addEventListener("abort",R,{once:!0});let U=setTimeout(()=>{Q??="timeout",J.abort(Error("managed runtime fetch timed out"))},q.timeoutMs),W=(_,Z)=>{if(_ instanceof X)return _;if(Q==="caller")return new X("update_cancelled","Managed runtime update request was cancelled.");if(Q==="timeout")return new X("update_fetch_timeout","Managed runtime update request timed out.");return new X("update_fetch_failed",Z)};try{let _;try{if(_=await q.fetchImpl(G,{headers:{accept:q.accept},signal:J.signal}),J.signal.aborted)throw W(J.signal.reason,"Managed runtime update request was cancelled.")}catch(Z){throw W(Z,"Managed runtime update request failed.")}if(!_.ok)throw new X("update_http_error","Managed runtime update request was rejected.");if(_.url&&new URL(_.url).protocol!=="https:")throw new X("insecure_redirect","Managed runtime update redirected to an insecure URL.");try{let Z=await PG(_,q.maximumBytes,J.signal);if(J.signal.aborted)throw W(J.signal.reason,"Managed runtime update response was cancelled.");return Z}catch(Z){throw W(Z,"Managed runtime update response failed.")}}finally{clearTimeout(U),q.signal?.removeEventListener("abort",R)}}async function WG(q,G,J=Vq,Q){let R=typeof J==="number"?J:Vq,U=typeof J==="number"?Q:J;if(U?.aborted)return!1;let W=await rq([q,"--version"],{timeoutMs:R,...U?{signal:U}:{}});return W.exitCode===0&&W.stdout.trim().replace(/^v/,"")===G}async function gG(q){let G=!1,J=null,Q=null,R=(U)=>{try{N(q.paths,U,{now:q.now})}catch{}};try{let U=q.home??d();if(!oq(q.manifest.version,U))return{status:"current"};Q=lq(U);let W=await p({url:new URL(uq,q.manifest.artifacts[q.target].broker.url).toString(),maximumBytes:Wq,fetchImpl:async(j,z)=>{let M=await q.fetchImpl(j,z);return G=M.status===404,M},timeoutMs:q.timeoutMs,accept:"application/json",signal:q.signal}),{manifest:_}=pq(new TextDecoder().decode(W),q.trustedKeys);if(_.version!==q.manifest.version||_.published_at!==q.manifest.published_at)throw new X("identity_manifest_mismatch","Background identity manifest names another release.");let Z=_.artifacts[q.target],$=await p({url:Z.url,maximumBytes:Z.size_bytes,fetchImpl:q.fetchImpl,timeoutMs:q.timeoutMs,accept:"application/octet-stream",signal:q.signal});P($,Z),b(q.workDirectory),J=K(q.workDirectory,`.identity-${process.pid}-${T()}`),n(J,{mode:448});let Y=K(J,"identity.tgz");if(h(Y,$,{mode:384,flag:"wx"}),Eq("/usr/bin/tar",["-xzf",Y,"-C",J],{stdio:"ignore",timeout:60000}).status!==0)throw new X("identity_extract_failed","Background identity archive could not be extracted.");return Nq({sourceApp:K(J,"Reason.app"),home:U,releaseSigned:!0,...q.command?{command:q.command}:{}}),R({event:"identity.refresh_completed",runtime_version:q.manifest.version,...Q?{from_version:Q}:{},to_version:q.manifest.version}),{status:"installed"}}catch(U){if(G)return{status:"unpublished"};let W=U instanceof X||U instanceof cq?U.code:"identity_install_failed";return process.stderr.write(`Reason background identity: identity_update_failed (${W})
-`),R({event:"identity.refresh_failed",runtime_version:q.manifest.version,...Q?{from_version:Q}:{},to_version:q.manifest.version,reason_code:W}),{status:"failed",code:W}}finally{if(J)v(J,{recursive:!0,force:!0})}}async function dJ(q){if(!B(q.currentVersion))throw new X("invalid_version","Invalid current managed runtime version.");let G=q.paths??Tq(),J=q.target??xG(),Q=q.fetchImpl??fetch,R=q.timeoutMs??IG,U=q.timeoutMs??CG,W=q.healthCheck??((H,j,z)=>WG(H,j,TG,z)),_=q.verifyCodeSignatures??Fq,Z=q.now?.()??new Date,$,Y=!1;N(G,{event:"update.check_started",runtime_version:q.currentVersion,from_version:q.currentVersion},{now:()=>Z});try{await sG({paths:G,verifyCodeSignatures:_,healthCheck:W});let H=await p({url:q.manifestUrl??EG,maximumBytes:Wq,fetchImpl:Q,timeoutMs:R,accept:"application/json",signal:q.signal}),j=Bq(new TextDecoder().decode(H),q.trustedKeys);$=j.manifest.version;let z=()=>gG({paths:G,...q.now?{now:q.now}:{},manifest:j.manifest,target:J,trustedKeys:q.trustedKeys,fetchImpl:Q,timeoutMs:U,workDirectory:G.versions,...q.home?{home:q.home}:{},...q.identityCommand?{command:q.identityCommand}:{},...q.signal?{signal:q.signal}:{}});if(UG($,q.currentVersion)<=0)return N(G,{event:"update.not_available",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),Yq(G),{status:"not_available",currentVersion:q.currentVersion,offeredVersion:$,...$===q.currentVersion?{identity:await z()}:{}};let M=j.manifest.artifacts[J];N(G,{event:"update.download_started",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$},{now:q.now});let w=await p({url:M.broker.url,maximumBytes:M.broker.size_bytes,fetchImpl:Q,timeoutMs:U,accept:"application/octet-stream",signal:q.signal});P(w,M.broker),t(q.signal);let e=await p({url:M.credential_library.url,maximumBytes:M.credential_library.size_bytes,fetchImpl:Q,timeoutMs:U,accept:"application/octet-stream",signal:q.signal});P(e,M.credential_library),N(G,{event:"update.downloaded",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$},{now:q.now}),N(G,{event:"update.verified",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$},{now:q.now}),t(q.signal);let kq=XG({paths:G,version:$,artifact:M.broker,bytes:w,credentialLibraryArtifact:M.credential_library,credentialLibraryBytes:e,verifyCodeSignatures:_}),xq;try{xq=await W(kq.executablePath,$,q.signal)}catch(l){throw t(q.signal),l}if(t(q.signal),!xq)throw new X("pre_activation_health_failed","Managed runtime preflight failed.");let V=cG(G,$);if(!V.changed&&V.toVersion!==$)return N(G,{event:"update.not_available",runtime_version:V.toVersion,from_version:V.toVersion,to_version:$,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),{status:"not_available",currentVersion:V.toVersion,offeredVersion:$};if(Y=V.changed,!await W(G.current,$)){if(V.fromVersion){let l=jG(G,$);N(G,{event:"update.rollback",runtime_version:l.toVersion,from_version:l.fromVersion,to_version:l.toVersion,reason_code:"post_activation_health_failed"},{now:q.now})}else HG(G,$);throw f(G),Y=!1,new X("post_activation_health_failed","Managed runtime activation failed.")}return f(G),Yq(G),N(G,{event:"update.activated",runtime_version:$,from_version:q.currentVersion,to_version:$,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),{status:"activated",fromVersion:q.currentVersion,toVersion:$,installed:kq.installed,identity:await z()}}catch(H){throw N(G,{event:"update.failed",runtime_version:Y?$??q.currentVersion:q.currentVersion,from_version:q.currentVersion,...$?{to_version:$}:{},reason_code:H instanceof X?H.code:"update_failed",duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),H}}function fq(q,G,J){try{let Q=A(D(q));if(!Q.isDirectory()||Q.isSymbolicLink())return!1;let R=A(q);if(!R.isFile()||R.isSymbolicLink()||R.size!==G.size_bytes)return!1;let U=Sq(q),W=A(U);return W.isFile()&&!W.isSymbolicLink()&&W.size===J.size_bytes&&c(g(q))===G.sha256&&c(g(U))===J.sha256}catch{return!1}}function XG(q){let G=F(q.paths,q.version);P(q.bytes,q.artifact),P(q.credentialLibraryBytes,q.credentialLibraryArtifact);let J=q.verifyCodeSignatures??Fq;if(b(q.paths.root),b(q.paths.versions),E(D(G))){if(!fq(G,q.artifact,q.credentialLibraryArtifact))throw new X("installed_artifact_mismatch","The installed runtime version does not match the verified artifact.");return J(G,i(q.paths,q.version)),{installed:!1,executablePath:G}}let Q=K(q.paths.versions,`.install-${q.version}-${process.pid}-${T()}`),R=K(Q,r(G)),U=Sq(R);n(Q,{mode:448});try{h(R,q.bytes,{mode:448,flag:"wx"}),Jq(R,448),h(U,q.credentialLibraryBytes,{mode:448,flag:"wx"}),Jq(U,448),J(R,U);try{k(Q,D(G))}catch(W){if(!fq(G,q.artifact,q.credentialLibraryArtifact))throw W;return{installed:!1,executablePath:G}}return{installed:!0,executablePath:G}}finally{v(Q,{recursive:!0,force:!0})}}function bG(q,G){if(!B(G))throw new X("invalid_version","Invalid managed Reason runtime version.");return`versions/${G}/${r(F(q,G))}`}function Rq(q,G){b(D(q));let J=`${q}.${process.pid}.${T()}.tmp`;try{Qq(G,J),k(J,q)}finally{if(E(J))C(J)}}var yG=/^\.(?:ara|reason)-worker-(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)-(darwin-(?:arm64|x64))\.([0-9A-Za-z]{6})$/,fG=new Set(["reason","ara"]);function ZG(q,G){let J=D(q),Q=O(J,G),R=D(Q),U=yG.exec(r(R));if(!fG.has(r(Q))||D(R)!==J||!U||!B(U[1])||!Xq.includes(U[2]))return!1;try{return A(R).isDirectory()&&D(S(R))===S(J)&&A(Q).isFile()&&A(Dq(R)).isFile()}catch(W){if(W.code==="ENOENT")return!1;throw W}}function _G(q,G,J){try{if(I(q)!==G)return!1;C(q)}catch(Q){if(Q.code==="ENOENT")return!1;throw Q}try{return Qq(J,q),!0}catch(Q){if(Q.code==="EEXIST")return!1;try{Qq(G,q)}catch(R){if(R.code!=="EEXIST")throw R}throw Q}}function $G(q,G){if(!q.legacyRoot)return!1;let J;try{if(!A(G).isSymbolicLink())return!1;J=I(G)}catch(R){if(R.code==="ENOENT")return!1;throw R}if(O(D(G),J)!==K(q.legacyRoot,"current"))return!1;if(!_G(G,J,q.current))return!1;let Q=L(q);if(Q)N(q,{event:"service.launcher_adopted",runtime_version:Q,to_version:Q,reason_code:"legacy_runtime_root"});return!0}function mG(q,G){let J=K(q,".local","bin"),Q=K(J,"ara"),R=K(J,"reason"),U=A(Q,{throwIfNoEntry:!1});if(U?.isSymbolicLink()&&I(Q)==="reason")return R;if(U||!A(R,{throwIfNoEntry:!1})?.isSymbolicLink())return Q;let W=I(R);return W===G.current||ZG(R,W)?R:Q}function vG(q){let G=q.launcherPath??mG(q.home??d(),q.paths);try{if(A(G).isSymbolicLink()){let Q=I(G);if(Q===q.paths.current)return"managed";if(ZG(G,Q)&&_G(G,Q,q.paths.current)){let R=_q(q.paths.current,q.paths.executableName)??"unknown";return N(q.paths,{event:"service.launcher_adopted",runtime_version:R,to_version:R,reason_code:"legacy_curl_entrypoint"}),"adopted"}if($G(q.paths,G))return"adopted"}return"conflict"}catch(J){if(J.code!=="ENOENT")throw J}n(D(G),{recursive:!0,mode:448});for(let J=0;J<4;J+=1)try{return Qq(q.paths.current,G),"created"}catch(Q){if(Q.code!=="EEXIST")throw Q;try{return A(G).isSymbolicLink()&&I(G)===q.paths.current?"managed":"conflict"}catch(R){if(R.code!=="ENOENT")throw R}}return"conflict"}function _q(q,G){let J;try{if(!A(q).isSymbolicLink())return null;J=I(q)}catch{return null}let Q=J.match(/^versions\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\/(ara|Reason|reason)$/);return Q&&(Q[2]==="ara"||Q[2]===G)?Q[1]:null}function L(q){return _q(q.current,q.executableName)}function cJ(q,G=process.execPath){try{return S(q.current)===S(G)}catch{return!1}}function Uq(q,G,J){let R=DG(G,q).split(eq);return R.length===2&&B(R[0])&&(R[1]==="ara"||J!==void 0&&R[1]===J)?R[0]:null}function KG(q,G){try{return A(G).isSymbolicLink()&&O(D(G),I(G))===O(q.current)}catch{return!1}}function hJ(q,G=process.execPath){try{return Uq(S(G),S(q.versions),q.executableName)!==null}catch{let J=O(G);return J===O(q.current)||KG(q,J)||Uq(J,O(q.versions),q.executableName)!==null}}function lJ(q,G=process.execPath){try{return Uq(S(G),S(q.versions),q.executableName)}catch{let J=O(G);if(J===O(q.current)||KG(q,J))return L(q);return Uq(J,O(q.versions),q.executableName)}}function dG(q,G,J={}){let Q=F(q,G),R=i(q,G);if(!E(Q)||!x(Q).isFile()||!E(R)||!x(R).isFile())throw new X("runtime_not_installed","Managed Reason runtime version is not installed.");let U=Lq(q,G,J.allowDowngrade);if(U)return U;return a(q,G,()=>{return YG(q,G,void 0,J.allowDowngrade)})}function Lq(q,G,J=!1){let Q=L(q);if(!Q)return null;if(Q===G)return{changed:!1,fromVersion:Q,toVersion:Q};if(!J&&UG(G,Q)<=0&&!(/^\d+\.\d+\.\d+-desktop\.v1\.\d+\.\d+\.\d+$/.test(G)&&/^\d+\.\d+\.\d+-desktopdev\./.test(Q)))return{changed:!1,fromVersion:Q,toVersion:Q};return null}function YG(q,G,J,Q=!1){let R=Lq(q,G,Q);if(R)return R;let U=L(q);if(J?.(U),U)Rq(q.previous,I(q.current));else if(E(q.previous))C(q.previous);return Rq(q.current,bG(q,G)),{changed:!0,fromVersion:U,toVersion:G}}function cG(q,G){let J=F(q,G),Q=i(q,G);if(!E(J)||!x(J).isFile()||!E(Q)||!x(Q).isFile())throw new X("runtime_not_installed","Managed Reason runtime version is not installed.");return a(q,G,()=>YG(q,G,(R)=>{oG(q,{schema_version:Zq,from_version:R,to_version:G})}))}function jG(q,G){return a(q,G,()=>{if(L(q)!==G)throw new X("rollback_fence_failed","Managed runtime changed before rollback could be applied.");let J=_q(q.previous,q.executableName);if(!J||J===G)throw new X("rollback_unavailable","No previous managed runtime is available.");let Q=F(q,J),R=i(q,J);if(!E(Q)||!x(Q).isFile()||!E(R)||!x(R).isFile())throw new X("rollback_unavailable","Previous managed runtime is not installed.");let U=I(q.previous),W=I(q.current);if(O(D(q.previous),U)!==O(Q))throw new X("rollback_fence_failed","Previous runtime pointer does not match its installed layout.");return Rq(q.current,U),Rq(q.previous,W),{fromVersion:G,toVersion:J}})}function hG(){let q=Eq("/bin/ps",["-axww","-o","args="],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:5000,maxBuffer:16777216});return q.status===0&&typeof q.stdout==="string"?q.stdout:null}function Yq(q){let G=[];try{let J=L(q);if(!J||jq(q))return G;let Q=Oq(q.versions).filter((U)=>B(U));if(Q.length<=2)return G;let R=hG();if(R===null)return G;a(q,J,()=>{let U=new Set([L(q),_q(q.previous,q.executableName)]);if(jq(q))return;for(let W of Q){if(U.has(W))continue;let _=K(q.versions,W);if(R.includes(`${_}${eq}`))continue;try{v(_,{recursive:!0,force:!0}),G.push(W)}catch{}}})}catch{}return G}function HG(q,G){a(q,G,()=>{if(L(q)!==G)throw new X("rollback_fence_failed","Managed runtime changed before rollback could be applied.");C(q.current)})}function wq(q){return q.activationState??K(q.root,"activation.json")}function lG(q){return Iq(q)&&Cq(q,["schema_version","from_version","to_version"])&&q.schema_version===Zq&&(q.from_version===null||B(q.from_version))&&B(q.to_version)}function jq(q){try{let G=wq(q),J=A(G);if(!J.isFile()||J.isSymbolicLink()||J.nlink!==1||(J.mode&63)!==0||J.size>4096)throw new X("invalid_activation_state","Managed runtime activation state is invalid.");let Q=JSON.parse(g(G,"utf8"));if(!lG(Q))throw new X("invalid_activation_state","Managed runtime activation state is invalid.");return Q}catch(G){if(G instanceof X)throw G;if(G.code==="ENOENT")return null;throw new X("invalid_activation_state","Managed runtime activation state is invalid.")}}function oG(q,G){RG(wq(q),JSON.stringify(G)+`
-`)}function f(q){try{C(wq(q))}catch(G){if(G.code!=="ENOENT")throw G}}async function sG(q){let G=jq(q.paths);if(!G)return"none";let J=L(q.paths);if(J===G.from_version)return f(q.paths),"cleared";if(J!==G.to_version)throw new X("rollback_fence_failed","Managed runtime changed before activation recovery could be applied.");let Q=q.verifyCodeSignatures??Fq,R=q.healthCheck??WG,U=!1;try{let W=F(q.paths,G.to_version);Q(W,i(q.paths,G.to_version)),U=await R(W,G.to_version)}catch{U=!1}if(U)return f(q.paths),N(q.paths,{event:"update.activated",runtime_version:G.to_version,...G.from_version?{from_version:G.from_version}:{},to_version:G.to_version,reason_code:"restart_recovery"}),"committed";if(G.from_version){let W=jG(q.paths,G.to_version);return f(q.paths),N(q.paths,{event:"update.rollback",runtime_version:W.toVersion,from_version:W.fromVersion,to_version:W.toVersion,reason_code:"restart_recovery"}),"rolled_back"}return HG(q.paths,G.to_version),f(q.paths),N(q.paths,{event:"update.rollback",runtime_version:G.to_version,from_version:G.to_version,reason_code:"restart_recovery"}),"rolled_back"}function uG(q){return Iq(q)&&Cq(q,["schema_version","pid","nonce","started_at","runtime_version"])&&q.schema_version===Zq&&typeof q.pid==="number"&&Number.isSafeInteger(q.pid)&&q.pid>0&&typeof q.nonce==="string"&&/^[0-9a-f-]{36}$/.test(q.nonce)&&QG(q.started_at)&&B(q.runtime_version)}function zG(q,G){try{let J=A(q);if(!J.isDirectory()||!Gq(J))return null;let Q=aq(K(q,G),m.O_RDONLY|m.O_NOFOLLOW|m.O_NONBLOCK);try{let R=iq(Q);if(!R.isFile()||R.nlink!==1||!Gq(R)||R.size>4096)return null;return g(Q,"utf8")}finally{u(Q)}}catch{return null}}function Hq(q){try{let G=JSON.parse(zG(q,"owner.json")??"null");return uG(G)?G:null}catch{return null}}function MG(q){try{return process.kill(q,0),!0}catch(G){return!(G instanceof Error&&("code"in G)&&G.code==="ESRCH")}}var mq="lease",pG=2,rG=4,o;function nG(){if(o!==void 0)return o;if(o=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let q;try{q=tq(import.meta.url)("bun:ffi")}catch{return null}let G=process.platform==="darwin"?"__error":"__errno_location",J=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of J)try{let R=q.dlopen(Q,{flock:{args:[q.FFIType.i32,q.FFIType.i32],returns:q.FFIType.i32},[G]:{args:[],returns:q.FFIType.ptr}}),U=R.symbols[G]();if(U===null)continue;return o={flock:(W,_)=>R.symbols.flock(W,_),errno:()=>q.read.i32(U),wouldBlock:process.platform==="darwin"?35:11},o}catch{}return null}var s,iG=3221225472,aG=4,eG=128,tG=32;function qJ(q){if(s===void 0){s=null;try{let U=tq(import.meta.url)("bun:ffi"),{FFIType:W}=U;s={kernel:U.dlopen("kernel32.dll",{CreateFileW:{args:[W.ptr,W.u32,W.u32,W.ptr,W.u32,W.u32,W.ptr],returns:W.i64_fast},CloseHandle:{args:[W.i64_fast],returns:W.i32},GetLastError:{args:[],returns:W.u32}}).symbols,ptr:(Z)=>U.ptr(Z)}}catch{return null}}if(!s)return null;let{kernel:G,ptr:J}=s,Q=Buffer.from(`${q}\x00`,"utf16le"),R=G.CreateFileW(J(Q),iG,0,null,aG,eG,null);if(Number(R)===-1)return G.GetLastError()===tG?"busy":null;return{release:()=>{G.CloseHandle(R)}}}function GJ(q){if(process.platform==="win32")return qJ(`${q}.lease`);let G=nG();if(!G)return null;let J=aq(`${q}.lease`,m.O_RDWR|m.O_CREAT|m.O_NOFOLLOW,384);try{let Q=iq(J);if(!Q.isFile()||Q.nlink!==1||!Gq(Q))return u(J),"busy";if(G.flock(J,pG|rG)===0)return{release:()=>u(J)};let R=G.errno();return u(J),R===G.wouldBlock?"busy":null}catch(Q){throw u(J),Q}}function zq(q){b(D(q.path));let G=GJ(q.path);if(G==="busy")return{acquired:!1,owner:Hq(q.path),recoveredStaleOwner:!1};let J=G!==null;try{let Q=JJ(q,G);if(Q.acquired)J=!1;return Q}finally{if(J)G.release()}}function JJ(q,G){let J=q.alive??MG,Q=!1;for(let R=0;R<4;R+=1){let U={schema_version:Zq,pid:q.pid??process.pid,nonce:q.nonce?.()??T(),started_at:(q.now?.()??new Date).toISOString(),runtime_version:q.runtimeVersion},W=`${q.path}.init-${process.pid}-${T()}`,_=!1;try{if(n(W,{mode:448}),h(K(W,"owner.json"),`${JSON.stringify(U)}
-`,{mode:384,flag:"wx"}),G!==null)h(K(W,mq),`flock
-`,{mode:384,flag:"wx"});q.beforePublish?.();try{throw A(q.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch($){if($.code!=="ENOENT")throw $}k(W,q.path),_=!0;let Z=!1;return{acquired:!0,owner:U,recoveredStaleOwner:Q,release(){if(Z)return;if(Z=!0,Hq(q.path)?.nonce===U.nonce)v(q.path,{recursive:!0,force:!0});G?.release()}}}catch(Z){let $=Z.code;if(!["EEXIST","ENOTEMPTY"].includes($??""))throw Z;let Y=Hq(q.path),H=(q.now?.()??new Date).getTime(),j=Y&&q.staleAfterMs!==void 0?H-Date.parse(Y.started_at)<q.staleAfterMs:!1,z=Y!==null&&!(G!==null&&zG(q.path,mq)!==null)&&J(Y.pid);if(!Y||z||j)return{acquired:!1,owner:Y,recoveredStaleOwner:!1};let M=`${q.path}.stale-${process.pid}-${T()}`;try{k(q.path,M),v(M,{recursive:!0,force:!0}),Q=!0}catch(w){let e=w.code;if(!["ENOENT","EEXIST"].includes(e??""))throw w}}finally{if(!_)v(W,{recursive:!0,force:!0})}}throw new X("lock_unavailable","Could not acquire the managed Reason runtime lock.")}var QJ=20000;function a(q,G,J){if(!B(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let Q=Date.now()+QJ,R=zq({path:q.transitionLock,runtimeVersion:G,staleAfterMs:60000});while(!R.acquired&&Date.now()<Q)nq(100),R=zq({path:q.transitionLock,runtimeVersion:G,staleAfterMs:60000});if(!R.acquired)throw new X("transition_busy","Another managed Reason runtime transition is in progress.");try{return J()}finally{R.release()}}function oJ(q){if(!B(q.runtimeVersion))throw new X("invalid_version","Invalid managed Reason runtime version.");let G=q.paths??Tq();return zq({path:G.brokerLock,runtimeVersion:q.runtimeVersion,...q.pid===void 0?{}:{pid:q.pid},...q.now===void 0?{}:{now:q.now},...q.nonce===void 0?{}:{nonce:q.nonce},...q.alive===void 0?{}:{alive:q.alive},...q.beforePublish===void 0?{}:{beforePublish:q.beforePublish}})}function NG(q){return Iq(q)&&Cq(q,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&q.schema_version===qG&&typeof q.event_id==="string"&&/^[0-9a-f-]{36}$/.test(q.event_id)&&QG(q.occurred_at)&&typeof q.event==="string"&&wG.includes(q.event)&&B(q.runtime_version)&&(q.from_version===void 0||B(q.from_version))&&(q.to_version===void 0||B(q.to_version))&&(q.reason_code===void 0||typeof q.reason_code==="string"&&Pq.test(q.reason_code))&&(q.duration_ms===void 0||typeof q.duration_ms==="number"&&Number.isSafeInteger(q.duration_ms)&&q.duration_ms>=0&&q.duration_ms<=86400000)&&(q.attempt_count===void 0||typeof q.attempt_count==="number"&&Number.isSafeInteger(q.attempt_count)&&q.attempt_count>=1&&q.attempt_count<=1e5)&&(q.retry_in_ms===void 0||typeof q.retry_in_ms==="number"&&Number.isSafeInteger(q.retry_in_ms)&&q.retry_in_ms>=0&&q.retry_in_ms<=30000)&&(q.capabilities===void 0||Array.isArray(q.capabilities)&&q.capabilities.length<=FG&&q.capabilities.every((G)=>typeof G==="string"&&Pq.test(G)))}var RJ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,UJ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,WJ=300000,qq=0n;function XJ(q){let G=BigInt(new Date(q.occurred_at).getTime())*1000000n;return qq=G>qq?G:qq+1n,`${String(qq).padStart(22,"0")}-${q.event_id}.json`}function $q(q){try{return Oq(q.lifecycleEvents).filter((G)=>RJ.test(G)).sort()}catch{return[]}}function Mq(q){try{let G=JSON.parse(g(q,"utf8"));return NG(G)?G:null}catch{return null}}function AG(q,G=MG,J=Date.now()){let Q;try{Q=Oq(q.lifecycleEvents)}catch{return}for(let R of Q){let U=R.match(UJ);if(!U)continue;let W=K(q.lifecycleEvents,R),_=K(q.lifecycleEvents,U[1]),Z=!G(Number(U[2]));if(!Z)try{Z=J-x(W).mtimeMs>=WJ}catch{continue}if(!Z)continue;try{k(W,_)}catch($){let Y=$.code;if(Y==="EEXIST")C(W);else if(Y!=="ENOENT")throw $}}}function ZJ(q){let J=$q(q).flatMap((R)=>{try{return[{name:R,size:x(K(q.lifecycleEvents,R)).size}]}catch{return[]}}),Q=J.reduce((R,U)=>R+U.size,0);while(J.length>GG||Q>OG){let R=J.shift();if(!R)break;try{C(K(q.lifecycleEvents,R.name)),Q-=R.size}catch(U){if(U.code!=="ENOENT")throw U}}}function sJ(q){return AG(q),$q(q).map((G)=>Mq(K(q.lifecycleEvents,G))).filter((G)=>G!==null).slice(-GG)}function N(q,G,J={}){let Q={schema_version:qG,event_id:J.eventId?.()??T(),occurred_at:(J.now?.()??new Date).toISOString(),...G};if(!NG(Q))throw new X("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return b(q.lifecycleEvents),RG(K(q.lifecycleEvents,XJ(Q)),`${JSON.stringify(Q)}
-`),ZJ(q),Q}function uJ(q,G){if(G.length===0)return 0;let J=new Set(G),Q=0;for(let R of $q(q)){let U=R.slice(23,-5);if(!J.has(U))continue;try{C(K(q.lifecycleEvents,R)),Q+=1}catch(W){if(W.code!=="ENOENT")throw W}}return Q}async function pJ(q,G,J){AG(q);let Q=0;for(let R of $q(q)){let U=K(q.lifecycleEvents,R);if(J){let Z=Mq(U);if(!Z||!J(Z))continue}let W=`${U}.sending-${process.pid}-${T()}`;try{k(U,W)}catch(Z){if(Z.code==="ENOENT")continue;throw Z}let _=Mq(W);if(!_){C(W);continue}try{await G(_),C(W),Q+=1}catch{try{k(W,U)}catch(Z){if(Z.code!=="ENOENT")throw Z}break}}return Q}function rJ(q){let G=q.paths??Tq(),J=q.sourceExecutable??process.execPath,Q=q.sourceCredentialLibrary??Dq(D(S(J))),R=q.now?.()??new Date,U=E(F(G,q.version))&&Lq(G,q.version,q.allowDowngrade)!==null;if(!U)N(G,{event:"service.install_started",runtime_version:q.version,to_version:q.version},{now:()=>R});try{let W=g(J),_;try{_=g(Q)}catch{throw new X("credential_boundary_unavailable","Managed runtime credential boundary is unavailable.")}let Z={url:"https://bootstrap.invalid/ara",sha256:c(W),size_bytes:W.byteLength},$={url:`https://bootstrap.invalid/${Aq}`,sha256:c(_),size_bytes:_.byteLength},Y=XG({paths:G,version:q.version,artifact:Z,bytes:W,credentialLibraryArtifact:$,credentialLibraryBytes:_,...q.verifyCodeSignatures?{verifyCodeSignatures:q.verifyCodeSignatures}:{}}),H=hq(J);if(E(H))Nq({sourceApp:H,home:q.home??d()});let j=dG(G,q.version,{allowDowngrade:q.allowDowngrade});if(!U)Yq(G);let z=q.home??d(),M=q.installLauncher===!1?"skipped":vG({paths:G,...q.launcherPath?{launcherPath:q.launcherPath}:{home:z}});if(q.installLauncher!==!1&&!q.launcherPath)$G(G,K(z,".local","bin","reason"));if(M==="conflict")N(G,{event:"service.launcher_conflict",runtime_version:q.version,to_version:q.version,reason_code:"existing_entrypoint"},{now:q.now});if(!U)N(G,{event:"service.install_completed",runtime_version:q.version,to_version:q.version,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-R.getTime())},{now:q.now});return{installed:Y.installed,activated:j.changed,activeVersion:j.toVersion,executablePath:F(G,j.toVersion),launcher:M}}catch(W){throw N(G,{event:"service.install_failed",runtime_version:q.version,to_version:q.version,reason_code:W instanceof X?W.code:"install_failed",duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-R.getTime())},{now:q.now}),W}}
-export{Zq as Q,qG as R,GG as S,OG as T,EG as U,IG as V,CG as W,Vq as X,TG as Y,LG as Z,mJ as _,wG as $,Tq as aa,vJ as ba,F as ca,i as da,UG as ea,xG as fa,VG as ga,Fq as ha,p as ia,WG as ja,dJ as ka,XG as la,vG as ma,_q as na,L as oa,cJ as pa,hJ as qa,lJ as ra,dG as sa,jG as ta,sG as ua,zq as va,oJ as wa,sJ as xa,N as ya,uJ as za,pJ as Aa,rJ as Ba};

package/bin/vm-hands/vm-hands-entry-lite-xp3qzxk5.js

@@ -1,3 +0,0 @@
-// @bun
-import{createHash as f,createPublicKey as V,verify as G}from"crypto";var Y="libara_device_keychain.dylib",H="libreason_device_keychain.dylib",k=1,x=2,h=536870912,R=262144;var U=["darwin-arm64","darwin-x64"];class J extends Error{code;constructor(z,F){super(F);this.code=z;this.name="ManagedRuntimeError"}}var C=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/,N=/^[a-f0-9]{64}$/;function X(z){return Boolean(z)&&typeof z==="object"&&!Array.isArray(z)}function $(z,F,Q=[]){let Z=new Set([...F,...Q]);return F.every((W)=>(W in z))&&Object.keys(z).every((W)=>Z.has(W))}function B(z){return typeof z==="string"&&C.test(z)}function O(z){return typeof z==="string"&&!Number.isNaN(Date.parse(z))&&new Date(z).toISOString()===z}function I(z){return U.includes(z)}function c(z,F){if(!B(z)||!I(F))throw new J("invalid_release_asset","Invalid managed runtime release asset.")}function K(z,F){return c(z,F),`reason-runtime-v${z}-${F}`}function g(z,F){return`${K(z,F)}-${H}`}var o="managed-runtime-identity.json",D="reason-macos-background-identity-v1";function q(z){if(z===null)return"null";if(typeof z==="string"||typeof z==="boolean")return JSON.stringify(z);if(typeof z==="number"){if(!Number.isFinite(z))throw new J("invalid_manifest","Manifest numbers must be finite.");return JSON.stringify(z)}if(Array.isArray(z))return`[${z.map((F)=>q(F)).join(",")}]`;if(X(z))return`{${Object.keys(z).sort().map((F)=>`${JSON.stringify(F)}:${q(z[F])}`).join(",")}}`;throw new J("invalid_manifest","Manifest contains an unsupported value.")}function j(z){if(!X(z)||!$(z,["url","sha256","size_bytes"])||typeof z.url!=="string"||typeof z.sha256!=="string"||!N.test(z.sha256)||typeof z.size_bytes!=="number"||!Number.isSafeInteger(z.size_bytes)||z.size_bytes<=0||z.size_bytes>h)throw new J("invalid_manifest","Manifest contains an invalid runtime artifact.");let F;try{F=new URL(z.url)}catch{throw new J("invalid_manifest","Runtime artifact URL is invalid.")}if(F.protocol!=="https:"||F.username||F.password||F.hash)throw new J("invalid_manifest","Runtime artifact URL must be an HTTPS URL without credentials or a fragment.");return{url:F.toString(),sha256:z.sha256,size_bytes:z.size_bytes}}function b(z){if(!X(z)||!$(z,["broker","credential_library"]))throw new J("invalid_manifest","Manifest must bind the broker and credential library as one runtime.");return{broker:j(z.broker),credential_library:j(z.credential_library)}}function _(z){if(!X(z)||!$(z,["schema_version","version","published_at","artifacts"])||z.schema_version!==x||!B(z.version)||!O(z.published_at)||!X(z.artifacts)||!$(z.artifacts,[...U]))throw new J("invalid_manifest","Managed Reason runtime manifest is invalid.");return{schema_version:x,version:z.version,published_at:z.published_at,artifacts:{"darwin-arm64":b(z.artifacts["darwin-arm64"]),"darwin-x64":b(z.artifacts["darwin-x64"])}}}function M(z){if(!X(z)||!$(z,["schema_version","version","published_at","artifacts"])||z.schema_version!==k||!B(z.version)||!O(z.published_at)||!X(z.artifacts)||!$(z.artifacts,[...U]))throw new J("invalid_manifest","Legacy managed runtime manifest is invalid.");return{schema_version:k,version:z.version,published_at:z.published_at,artifacts:{"darwin-arm64":j(z.artifacts["darwin-arm64"]),"darwin-x64":j(z.artifacts["darwin-x64"])}}}function A(z){if(!X(z)||!$(z,["schema","version","published_at","artifacts"])||z.schema!==D||!B(z.version)||!O(z.published_at)||!X(z.artifacts)||!$(z.artifacts,[...U]))throw new J("invalid_manifest","Reason background identity manifest is invalid.");return{schema:D,version:z.version,published_at:z.published_at,artifacts:{"darwin-arm64":j(z.artifacts["darwin-arm64"]),"darwin-x64":j(z.artifacts["darwin-x64"])}}}function S(z){if(typeof z!=="string"||!/^[A-Za-z0-9+/]+={0,2}$/.test(z))throw new J("invalid_signature","Runtime manifest signature is invalid.");let F=Buffer.from(z,"base64");if(F.length!==64||F.toString("base64")!==z)throw new J("invalid_signature","Runtime manifest signature is invalid.");return F}function L(z){let F=z;if(typeof z==="string")try{F=JSON.parse(z)}catch{throw new J("invalid_manifest","Managed Reason runtime manifest is not valid JSON.")}if(!X(F)||!$(F,["key_id","manifest","signature"])||typeof F.key_id!=="string"||!/^[A-Za-z0-9._-]{1,80}$/.test(F.key_id)||typeof F.signature!=="string")throw new J("invalid_manifest","Signed managed Reason runtime manifest is invalid.");return F}function E(z,F){let Q=L(z),Z=F[Q.key_id];if(!Z)throw new J("untrusted_key","Runtime manifest was signed by an unknown key.");let W=_(Q.manifest),w=S(Q.signature),P=!1;try{P=G(null,Buffer.from(q(W)),V(Z),w)}catch{throw new J("invalid_signature","Runtime manifest signature could not be verified.")}if(!P)throw new J("invalid_signature","Runtime manifest signature did not match.");return{key_id:Q.key_id,manifest:W,signature:Q.signature}}function d(z,F){let Q=L(z),Z=F[Q.key_id];if(!Z)throw new J("untrusted_key","Background identity manifest was signed by an unknown key.");let W=A(Q.manifest),w=S(Q.signature),P=!1;try{P=G(null,Buffer.from(q(W)),V(Z),w)}catch{throw new J("invalid_signature","Background identity manifest signature could not be verified.")}if(!P)throw new J("invalid_signature","Background identity manifest signature did not match.");return{key_id:Q.key_id,manifest:W,signature:Q.signature}}function i(z,F){let Q=z;if(typeof z==="string")try{Q=JSON.parse(z)}catch{throw new J("invalid_manifest","Legacy managed runtime manifest is not valid JSON.")}if(!X(Q)||!$(Q,["key_id","manifest","signature"])||typeof Q.key_id!=="string"||!/^[A-Za-z0-9._-]{1,80}$/.test(Q.key_id)||typeof Q.signature!=="string")throw new J("invalid_manifest","Signed legacy managed runtime manifest is invalid.");let Z=F[Q.key_id];if(!Z)throw new J("untrusted_key","Legacy runtime manifest was signed by an unknown key.");let W=M(Q.manifest),w=S(Q.signature),P=!1;try{P=G(null,Buffer.from(q(W)),V(Z),w)}catch{throw new J("invalid_signature","Legacy runtime manifest signature could not be verified.")}if(!P)throw new J("invalid_signature","Legacy runtime manifest signature did not match.");return{key_id:Q.key_id,manifest:W,signature:Q.signature}}function y(z){return f("sha256").update(z).digest("hex")}function n(z,F){if(z.byteLength!==F.size_bytes)throw new J("artifact_size_mismatch","Runtime artifact size did not match its manifest.");if(y(z)!==F.sha256)throw new J("artifact_checksum_mismatch","Runtime artifact checksum did not match its manifest.")}import{existsSync as p}from"fs";import{join as T}from"path";function r(z){let F=T(z,H);return p(F)?F:T(z,Y)}
-export{Y as Fi,H as Gi,k as Hi,x as Ii,h as Ji,R as Ki,U as Li,J as Mi,K as Ni,g as Oi,o as Pi,q as Qi,E as Ri,d as Si,i as Ti,y as Ui,n as Vi,r as Wi};

package/bin/vm-hands/vm-hands-executor-epyhpjv3.js

@@ -1,11 +0,0 @@
-// @bun
-import{a as fq,b as Iq,c as Aq,d as Cq}from"./vm-hands-entry-lite-4gh5kfr4.js";import{$b as wq,Ic as Pq,Oc as Rq,oc as Nq}from"./vm-hands-entry-lite-fpp2bs9y.js";import"./vm-hands-entry-lite-vsa7t6m9.js";import"./vm-hands-entry-lite-j2ng164q.js";import"./vm-hands-entry-lite-2m5dwrdf.js";import"./vm-hands-entry-lite-f5xb489y.js";import"./vm-hands-entry-lite-tytfs183.js";import"./vm-hands-entry-lite-ntx8fdyq.js";import"./vm-hands-entry-lite-agsp101y.js";import"./vm-hands-entry-lite-9qep7pka.js";import"./vm-hands-entry-lite-28s7v15d.js";import"./vm-hands-entry-lite-xp3qzxk5.js";import"./vm-hands-entry-lite-26q3hbdc.js";import"./vm-hands-entry-lite-4k4h9rcq.js";import"./vm-hands-entry-lite-714wspqb.js";import"./vm-hands-entry-lite-6nwbqg37.js";import"./vm-hands-entry-lite-feybcq63.js";import"./vm-hands-entry-lite-d98m00b8.js";import"./vm-hands-entry-lite-q8wkrzer.js";import"./vm-hands-entry-lite-v4jtxgaj.js";import"./vm-hands-entry-lite-gxper06w.js";import"./vm-hands-entry-lite-6y6pz2yw.js";import"./vm-hands-entry-lite-0k13wmzm.js";import"./vm-hands-entry-lite-magmzx9c.js";import"./vm-hands-entry-lite-ejkba2nk.js";import{spawn as yq}from"child_process";import{chmodSync as mq,chownSync as uq,existsSync as p,lstatSync as qq,mkdirSync as i,mkdtempSync as lq,readdirSync as o,readFileSync as f,realpathSync as cq,rmdirSync as Xq,rmSync as pq,writeFileSync as c}from"fs";import{join as L}from"path";import{readFileSync as Gq,readlinkSync as Jq}from"fs";import{relative as gq}from"path";var Kq=16;function Yq(X){return X.replace(/\\([0-7]{3})/g,($,W)=>String.fromCharCode(Number.parseInt(W,8)))}function Eq(X){let $=[];for(let W of X.split(`
-`)){let q=W.split(" ");if(q.length<10||!/^\d+:\d+$/.test(q[2]))continue;$.push({device:q[2],root:Yq(q[3]),mountPoint:Yq(q[4])})}return $}function Sq(X,$,W){let q=X.replace(/\/+$/,"")||"/",J=(j)=>q==="/"||j===q||j.startsWith(`${q}/`),G=(j)=>new Map(Eq(j).filter((N)=>J(N.mountPoint)).map((N)=>[`${N.mountPoint}\x00${N.device}\x00${N.root}`,N.mountPoint])),K=G($),U=G(W),M=(j)=>gq(q,j)||".",I=[...K].filter(([j])=>!U.has(j)).map(([,j])=>M(j)),C=[...U].filter(([j])=>!K.has(j)).map(([,j])=>M(j));return{missing:I,extra:C,referenceCount:K.size,ownCount:U.size}}function Bq(X,$,W,q="/proc"){let J,G,K=null;try{J=Gq(`${q}/1/mountinfo`,"utf8"),G=Gq(`${q}/self/mountinfo`,"utf8")}catch(N){let V=N&&typeof N==="object"&&"code"in N&&typeof N.code==="string"?N.code:"unreadable";$("vm_hands.mount_check_unavailable",{code:V});return}try{K=Jq(`${q}/1/ns/mnt`)===Jq(`${q}/self/ns/mnt`)}catch{}let{missing:U,extra:M,referenceCount:I,ownCount:C}=Sq(X,J,G),j={reference_count:I,own_count:C,missing_count:U.length,extra_count:M.length,same_namespace:K};if(M.length)$("vm_hands.mount_extra",{...j,extra:M.slice(0,Kq)});if(U.length)throw $("vm_hands.mount_mismatch",{...j,missing:U.slice(0,Kq)}),W(`${U.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var bq="/sys/fs/cgroup/reason-payload",H="vm-hands",aq="/run/ara-srt/fallbacks.jsonl",u="/reason-person",tq="surface",Zq=5000,dq=1e4,Lq="__VM_HANDS_PROOF_DIR__",sq="__VM_HANDS_PROBE_NONCE__";class D extends Error{code;constructor(X,$){super($);this.code=X}}function iq(X,$){if(!/^[0-9a-f-]{36}$/i.test($))throw new D("vm_hands_bind_invalid","bad bind id");return L(X,H,`b-${$.toLowerCase()}`)}var nq=5000,Oq=(X)=>`'${X.replaceAll("'","'\\''")}'`;function LX(X){let $=X.cgroup??bq,W=X.init.layout.payload_uid,q=X.log??(()=>{}),J=new Map,G=new Map,K=0,U=()=>{try{let Z=f("/run/ara-srt/starts.jsonl","utf8"),z=Z.slice(K>Z.length?0:K).split(`
-`).filter(Boolean);K=Z.length;let Y=z.map((T)=>{try{return Number(JSON.parse(T).elapsed_ms)||0}catch{return 0}});if(Y.length)q("vm_hands.srt_server_starts",{count:Y.length,elapsed_ms:Y.slice(0,8)})}catch{}},M=null,I=!1,C=X.srtCgroup??"/sys/fs/cgroup/reason-srt",j=()=>{M??=Uq()},N=0,V=()=>{try{let Z=f(aq,"utf8"),z=Z.slice(N>Z.length?0:N);N=Z.length;let Y=z.split(`
-`).filter(Boolean).slice(0,1000);if(!Y.length)return null;let T={},F=0;for(let P of Y)try{let w=JSON.parse(P),B=typeof w.code==="string"&&/^[a-z_]{1,40}$/.test(w.code)?w.code:"other";if(T[B]=(T[B]??0)+1,typeof w.elapsed_ms==="number")F=Math.max(F,w.elapsed_ms)}catch{T.unparsed=(T.unparsed??0)+1}return q("vm_hands.srt_fallbacks",{count:Y.length,codes:T,max_elapsed_ms:F}),{count:Y.length,codes:T,max_elapsed_ms:F}}catch{return null}},b=!1,v=(Z,z,Y)=>{if(b)throw Error("vm_hands_pool_held");return l(Z,z,Y)},E=(Z)=>(z,Y,T)=>yq("/bin/sh",["-c",`echo $$ > ${Oq(L(Z,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",z,...Y],T),l=E(L($,H)),S=L($,H,"probe"),y=(Z)=>iq($,Z),hq=(Z)=>{let z=y(Z);try{i(z,{mode:493})}catch(Y){if(!(Y&&typeof Y==="object"&&("code"in Y)&&Y.code==="EEXIST"))throw new D("vm_hands_bind_failed","bind cgroup")}return z},_q=(Z)=>{try{Xq(y(Z))}catch{}},h=X.prespawn?Nq({spawnProcess:v,...X.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:X.relayDependencies.sourceEntrypoint}:{},log:(Z,z)=>q(Z,z??{})}):null;h?.arm();let e=h?setInterval(()=>{h.arm()},nq):null;e?.unref?.();async function a(Z){let z=J.get(Z);if(J.delete(Z),!z)return;z.abort.abort(),await z.done}return{bindCgroup:y,async startExecutor(Z){if(j(),G.set(Z.bindId,Uq()),I=!0,!Z.claim)throw new D("vm_hands_bind_invalid","an executor needs the claim it serves");await a(Z.bindId);let{claim:z,bindId:Y}=Z,T=hq(Y),F=z.owner;if(!F||typeof F.device_id!=="string"||typeof z.root_id!=="string")throw new D("vm_hands_bind_invalid","claim without its owner Device or root");let P=new AbortController,w,B,O=new Promise((Q,R)=>{w=Q,B=R}),_,A=new Promise((Q)=>{_=Q}),m=Rq({headless:!0,hostExecution:!0,runtimeDirectory:X.runtimeDirectory,deviceIdentity:{deviceId:F.device_id,rootId:z.root_id,apiOrigin:X.apiOrigin},claimOwner:z.owner,root:X.root,runId:z.run_id,operationId:z.operation_id,attemptId:z.attempt_id,payload:Object.fromEntries(Object.entries(z.payload).filter(([Q])=>!Q.startsWith("vm_hands_"))),signal:P.signal,...Z.workspaceGrant?{workspaceGrant:Z.workspaceGrant}:{},emitEvent:async(Q,R)=>{if(Q==="hands.ready"){w(R);return}if(Q==="hands.started"||Q==="hands.stopped"||Q==="hands.failed")return;await X.forward(Y,Q,R)}},{...X.relayDependencies,spawnWorker:(Q)=>E(T)(Q.command,Q.args,Q.options),...h?{takePrespawnedWorker:(Q)=>{let R=h.take(Q);if(!R?.pid)return R;try{return c(L(T,"cgroup.procs"),String(R.pid)),R}catch{try{R.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:h.adopt}:{}}).then(()=>{_("executor_stopped")},(Q)=>{let R=Q&&typeof Q==="object"&&"code"in Q?String(Q.code):"executor_failed";B(new D(R,Q instanceof Error?Q.message:String(Q))),_(R)}).finally(()=>B(new D("vm_hands_executor_exited","executor ended before it was ready")));J.set(Y,{abort:P,done:m,exited:A,operationId:z.operation_id,runId:z.run_id,expiresAtMs:Date.parse(String(z.payload.expires_at??""))||0});let k=await O,t=k.executor_launch_id;if(typeof t!=="string")throw new D("vm_hands_bind_failed","executor ready without a launch id");return{launchId:t,readyData:k,applied:{hands_confinement:typeof z.payload.hands_confinement==="string"?z.payload.hands_confinement:null,browser_egress:z.payload.browser_egress??null}}},takeSrtFallbacks:V,executorExited(Z){return J.get(Z)?.exited??new Promise(()=>{})},freezeBind(Z){let z=y(Z);if(p(L(z,"cgroup.freeze")))c(L(z,"cgroup.freeze"),"1")},async killAndVerifyPayload(Z){let z=new Set(Z?.keep??[]);if(z.size||Z?.own)return kq(Z?.bindId??null,z,Z?.own===!0);b=!0;let Y=jq();try{await Dq();let T=Promise.all([...J.keys()].map((B)=>a(B).catch(()=>{return})));U();let F=Date.now()+Zq;await d($,F,"payload"),await T;let P=(I||X.srtWarmLate?.()===!0)&&p(L(C,"cgroup.events"));if(P)await d(C,F,"srt");let w=Qq(W).filter((B)=>!x(B,u));if(M!==null){let B=$q(M).filter((O)=>O!==process.pid&&!x(O,u));if(B.length)throw q("vm_hands.kill_strays",{strays:s(B)}),new D("vm_hands_kill_unverified",`${B.length} process(es) the run started survived it`);M=null}if(I=!1,P)X.onSrtReset?.();if(w.length)throw q("vm_hands.kill_survivors",{pids:w.slice(0,16)}),new D("vm_hands_kill_unverified",`${w.length} payload-uid process(es) outside the payload cgroup`);G.clear();for(let B of Wq())try{Xq(L($,H,B))}catch{}}finally{b=!1,Y()}if(h)setTimeout(()=>{if(!J.size)h.arm()},100).unref?.()},async killProbe(){let Z=Date.now()+Zq;if(p(L(S,"cgroup.events"))){await d(S,Z,"probe");try{Xq(S)}catch{}}let z=zq(process.pid);if(z===null)throw new D("vm_hands_kill_unverified","agent start time unreadable");await oq($,z,Z);let Y=(F)=>{let P=zq(F);return P!==null&&P<=z},T=Qq(W).filter((F)=>Y(F)&&!x(F,u));if(T.length)throw q("vm_hands.kill_survivors",{pids:T.slice(0,16),at:"attest"}),new D("vm_hands_kill_unverified",`${T.length} payload-uid process(es) from before this agent`);if(M!==null){let F=[$,L($,H)].map((B)=>B.replace(/^\/sys\/fs\/cgroup/,"")),P=C.replace(/^\/sys\/fs\/cgroup/,""),w=$q(M).filter((B)=>B!==process.pid&&!x(B,u)&&!x(B,"/reason-vm-hands")&&!x(B,P)&&!F.some((O)=>Tq(B,O)));if(w.length&&I)throw q("vm_hands.kill_strays",{strays:s(w),at:"attest"}),new D("vm_hands_kill_unverified",`${w.length} process(es) the run started survived it`);if(w.length)q("vm_hands.attest_concurrent",{processes:s(w),count:w.length});M=null}},async runProbe({nonce:Z,script:z}){if(j(),!z.includes(Lq))throw new D("vm_hands_probe_failed","probe names no proof directory");let Y=X.proofParent??"/tmp/reason-vm-hands-proof";i(Y,{mode:457,recursive:!0});let T=qq(Y);if(T.isSymbolicLink()||!T.isDirectory()||T.uid!==(process.getuid?.()??-1)||(T.mode&4095)!==457)throw new D("vm_hands_probe_failed","proof parent is not root's 0711 directory");let F=lq(L(Y,"p-")),P=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(F)||!/^[A-Za-z0-9_-]{1,128}$/.test(Z))throw new D("vm_hands_probe_failed","proof directory path or nonce");uq(F,W,W),mq(F,448);let w=qq(F).ino;try{i(S,{mode:493})}catch(A){if(!(A&&typeof A==="object"&&("code"in A)&&A.code==="EEXIST"))throw new D("vm_hands_probe_failed","probe cgroup")}let B=E(S)("/bin/bash",["-c",z.replaceAll(Lq,F).replaceAll(sq,Z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),O="";B.stdout?.on("data",(A)=>{if(O.length<16384)O+=A.toString("utf8").slice(0,16384-O.length)});let _=await new Promise((A)=>{let m=setTimeout(()=>{P=!0,B.kill("SIGKILL"),A(124)},dq);B.once("error",()=>{clearTimeout(m),A(127)}),B.once("close",(k)=>{clearTimeout(m),A(k??1)})});return q("vm_hands.probe",{nonce_len:Z.length,exit_code:_}),{exitCode:_,markers:O,proofDirInode:w}}finally{if(!P)pq(F,{recursive:!0,force:!0})}},restatLayout(){let{session_root:Z,alias:z}=X.init.layout,Y="invalid";try{Pq(Z),Y="0:0:755"}catch{}let T=!1,F=-1;try{let P=qq(z);F=P.uid,T=Y==="0:0:755"&&z===L(Z,"repo")&&!P.isSymbolicLink()&&P.isDirectory()&&cq(z)===z&&P.uid===W}catch{}return{root_mode:Y,alias_ok:T,owner_uid:F}},verifyMounts(){Bq(X.init.layout.session_root,q,(Z)=>new D("vm_hands_mount_mismatch",Z))},installEnvironment(Z,z){let Y=J.get(Z);if(!Y)throw new D("environment_unavailable","no executor owns an environment");return wq({root:X.root,operationId:Y.operationId,payload:z}).installed_revision},async stop(){if(e)clearInterval(e);h?.close(),await Promise.all([...J.keys()].map((Z)=>a(Z)))}};function Wq(){try{return o(L($,H),{withFileTypes:!0}).filter((Z)=>Z.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(Z.name)).map((Z)=>Z.name)}catch{return[]}}async function kq(Z,z,Y=!1){let T=new Set([...z].map((P)=>P.toLowerCase())),F=jq();try{await Dq();let P=Date.now()+Zq,w=new Set(Wq().filter((Q)=>!T.has(Q.slice(2))).map((Q)=>Q.slice(2)));if(Z)w.add(Z.toLowerCase());let B=null;for(let Q of w){let R=a(Q).catch(()=>{return}),r=G.get(Q);if(r!==void 0)B=B===null?r:Math.min(B,r);if(p(L(y(Q),"cgroup.events")))await d(y(Q),P,"bind");await R}let O=[...T].map((Q)=>y(Q).replace(/^\/sys\/fs\/cgroup/,"")),_=[$,L($,H)].map((Q)=>Q.replace(/^\/sys\/fs\/cgroup/,"")),A=C.replace(/^\/sys\/fs\/cgroup/,""),m=(Q)=>x(Q,u)||O.some((R)=>x(Q,R)),k=Y?[]:Qq(W).filter((Q)=>!m(Q));if(k.length)throw q("vm_hands.kill_survivors",{pids:k.slice(0,16),beside:T.size}),new D("vm_hands_kill_unverified",`${k.length} payload-uid process(es) outside a live bind`);let t=(Q)=>!m(Q)&&!x(Q,"/reason-vm-hands")&&!x(Q,A)&&!_.some((R)=>Tq(Q,R));if(B!==null){let Q=$q(B).filter((R)=>R!==process.pid&&t(R));if(Q.length)throw q("vm_hands.kill_strays",{strays:s(Q),beside:T.size}),new D("vm_hands_kill_unverified",`${Q.length} process(es) the run started survived it`)}for(let Q of w)G.delete(Q),_q(Q)}finally{F()}}}function zq(X,$="/proc"){try{let W=f(L($,String(X),"stat"),"utf8"),q=Number(W.slice(W.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(q)?q:null}catch{return null}}function vq(X,$="/proc"){try{let W=f(L($,String(X),"stat"),"utf8"),q=Number(W.slice(W.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(q)?q:null}catch{return null}}async function oq(X,$,W){try{c(L(X,"cgroup.freeze"),"1")}catch(q){throw new D("vm_hands_kill_unverified",`payload cgroup.freeze: ${q instanceof Error?q.message:String(q)}`)}try{for(;;){let q=xq(X).filter((G)=>Vq(G,X)),J=new Set(q.filter((G)=>{let K=zq(G);return K!==null&&K<=$}));for(let G=!0;G;){G=!1;for(let K of q){if(J.has(K))continue;let U=vq(K);if(U!==null&&J.has(U))J.add(K),G=!0}}if(J.size===0)return;if(Date.now()>W)throw new D("vm_hands_kill_unverified",`${J.size} previous-boot process(es) survived`);for(let G of J)try{process.kill(G,"SIGKILL")}catch{}await new Promise((G)=>setTimeout(G,10))}}finally{try{c(L(X,"cgroup.freeze"),"0")}catch{}}}function Tq(X,$,W="/proc"){try{return f(L(W,String(X),"cgroup"),"utf8").split(`
-`).find((J)=>J.startsWith("0::"))?.slice(3)===$}catch{return!1}}function x(X,$,W="/proc"){try{let J=f(L(W,String(X),"cgroup"),"utf8").split(`
-`).find((G)=>G.startsWith("0::"))?.slice(3)??"";return J===$||J.startsWith(`${$}/`)}catch{return!1}}var eq=100;function Uq(){try{return Math.floor(Number(f("/proc/uptime","utf8").split(" ")[0])*eq)}catch{return 0}}async function d(X,$,W){try{c(L(X,"cgroup.freeze"),"1")}catch(q){throw new D("vm_hands_kill_unverified",`${W} cgroup.freeze: ${q instanceof Error?q.message:String(q)}`)}while(!/^populated 0$/m.test(f(L(X,"cgroup.events"),"utf8"))){if(Date.now()>$)throw new D("vm_hands_kill_unverified",`${W} cgroup still populated (left frozen)`);for(let q of xq(X)){if(!Vq(q,X))continue;try{process.kill(q,"SIGKILL")}catch{}}await new Promise((q)=>setTimeout(q,10))}try{c(L(X,"cgroup.freeze"),"0")}catch(q){throw new D("vm_hands_kill_unverified",`${W} cgroup thaw: ${q instanceof Error?q.message:String(q)}`)}}function Vq(X,$){let W=$.replace(/^\/sys\/fs\/cgroup/,"")||"/",q="";try{q=f(`/proc/${X}/cgroup`,"utf8").split(`
-`).find((G)=>G.startsWith("0::"))??""}catch{return!1}let J=q.slice(3);return J===W||J.startsWith(`${W}/`)}function xq(X){let $=[],W=(q)=>{try{for(let G of f(L(q,"cgroup.procs"),"utf8").split(`
-`))if(/^\d+$/.test(G))$.push(Number(G))}catch{}let J=[];try{J=o(q,{withFileTypes:!0}).filter((G)=>G.isDirectory()).map((G)=>G.name)}catch{}for(let G of J)W(L(q,G))};return W(X),$}function s(X,$="/proc"){return X.slice(0,16).map((W)=>{let q="?",J="?";try{q=f(L($,String(W),"comm"),"utf8").trim().slice(0,32)}catch{}try{J=(f(L($,String(W),"cgroup"),"utf8").split(`
-`).find((G)=>G.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:W,comm:q,ppid:vq(W,$),cgroup:J}})}function $q(X,$="/proc"){let W=[];for(let q of o($)){if(!/^\d+$/.test(q))continue;let J;try{J=f(L($,q,"stat"),"utf8")}catch{continue}let G=J.slice(J.lastIndexOf(")")+2).split(" "),K=Number(G[1]),U=Number(G[6]),M=Number(G[19]);if(!((U&2097152)!==0||K===2||q==="2")&&G[0]!=="Z"&&M>=X)W.push(Number(q))}return W}function Qq(X,$="/proc"){let W=[];for(let q of o($)){if(!/^\d+$/.test(q))continue;let J;try{J=f(L($,q,"status"),"utf8")}catch{continue}let G=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(J);if(G&&G.slice(1).some((K)=>Number(K)===X))W.push(Number(q))}return W}function Fq(X="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(f(X,"utf8").trim())>=1}catch{return!1}}var g=0,Hq=[],n=new Set;function jq(){g++;let X=!1;return()=>{if(X)return;if(X=!0,--g===0)for(let $ of Hq.splice(0))$()}}function rq(){return g===0?Promise.resolve():new Promise((X)=>{Hq.push(X)})}async function Mq(){while(g>0)await rq()}async function Dq(){let X=Date.now()+1000;while(n.size&&Date.now()<X)await new Promise(($)=>setTimeout($,2))}function qX(X,$){let W=$.replace(/^\/sys\/fs\/cgroup/,"");n.add(X);let q=()=>{let J="";try{J=f(`/proc/${X}/cgroup`,"utf8").split(`
-`).find((G)=>G.startsWith("0::"))??""}catch{n.delete(X);return}if(J.slice(3)===W){n.delete(X);return}setTimeout(q,1)};q()}function TX(X){let $={person:X.personCgroup??L("/sys/fs/cgroup",u,H),model:X.payloadCgroup??L(bq,H),surface:X.surfaceCgroup??L("/sys/fs/cgroup",u,H,tq)},W=X.entry??process.argv[1]??"",q={},J=(K)=>K.startsWith("model:")&&X.bindCgroup?X.bindCgroup(K.slice(6)):$[K.startsWith("model")?"model":K==="surface"?"surface":"person"],G=(K)=>{let U=K.startsWith("model")?"model":K==="surface"?"surface":"person",M=new Map,I=String(X.payloadUid),C=String(X.payloadGid);if(U==="surface")try{i(J(K),{mode:493})}catch{}let j=U==="surface"?'exec "$@"':`exec /usr/bin/setpriv --no-new-privs --reuid=${I} --regid=${C} --clear-groups -- "$@"`,N=Bun.spawn(["/bin/sh","-c",`echo $$ > ${Oq(L(J(K),"cgroup.procs"))} || exit 125; ${j}`,"vm-hands-op-join",process.execPath,"--no-install",W,"--vm-hands-op-runner",...U==="person"?[fq]:[],...U==="surface"?[Iq,`${Aq}${I}`,`${Cq}${X.surfaceDirectory??""}`]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:U==="surface"?process.env.HOME||"/root":"/home/runner",...p("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(b){let v=b;if(U==="surface"&&v.t==="readiness"){let l=b;X.log?.("vm_hands.surface_ready",{lanes:Object.keys(l.lanes??{}).filter((S)=>l.lanes[S]===!0),display_video:l.display_video===!0}),X.onSurfaceReadiness?.(l);return}let E=M.get(v.id);if(!E)return;if(v.t==="event"&&v.event)E.onEvent(v.event);if(v.t==="done")M.delete(v.id),E.done(v.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});N.exited.then((b)=>{if(q[K]?.child===N)delete q[K];for(let[,v]of M)v.done({status:"failed",error_code:"vm_hands_op_runner_exited"});if(M.clear(),X.log?.("vm_hands.op_runner_exited",{kind:U,code:b}),U==="surface")X.onSurfaceReadiness?.(null)}),qX(N.pid,J(K));let V={child:N,pending:M};return q[K]=V,V};return{run(K,U,M,I,C){if(!Fq())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let j=K==="model"&&C&&X.bindCgroup?`model:${C.toLowerCase()}`:K,N=async()=>{while(!q[j]&&g>0)await Mq()};return N().then(async()=>{if(!q[j]&&g>0)await N()}).then(()=>new Promise((V)=>{if(!q[j]&&g>0){V({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let b=q[j]??G(j);b.pending.set(U.id,{onEvent:M,done:V}),I.addEventListener("abort",()=>{try{b.child.send({t:"cancel",id:U.id})}catch{}},{once:!0});try{b.child.send({t:"op",...U})}catch{b.pending.delete(U.id),V({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(K){if(!q[K]&&Fq())Mq().then(()=>{if(!q[K]&&g===0)G(K)})},notify(K,U){let M=q[K];if(!M)return!1;try{return M.child.send(U),!0}catch{return!1}},stop(){for(let K of Object.keys(q))q[K]?.child.kill()}}}export{iq as vmHandsBindCgroup,xq as subtreePids,Fq as ptraceProtected,$q as processesStartedSince,Qq as payloadUidProcesses,x as inCgroup,s as describeProcesses,TX as createVmHandsOpRunners,LX as createVmHandsExecutor,D as VmHandsExecutorError,tq as VM_HANDS_SURFACE_JOIN,Lq as VM_HANDS_PROOF_DIR_TOKEN,sq as VM_HANDS_PROBE_NONCE_TOKEN,u as VM_HANDS_PERSON_CGROUP,H as VM_HANDS_PAYLOAD_JOIN,bq as VM_HANDS_PAYLOAD_CGROUP};

package/bin/vm-hands/vm-hands-op-runner-fn1qph82.js

@@ -1,2 +0,0 @@
-// @bun
-import{a,b,c,d,e,f,g}from"./vm-hands-entry-lite-4gh5kfr4.js";import"./vm-hands-entry-lite-magmzx9c.js";import"./vm-hands-entry-lite-ejkba2nk.js";export{f as spawnSessionPty,g as runVmHandsOpRunner,c as VM_HANDS_SURFACE_UID_ARG,e as VM_HANDS_SURFACE_OPS,d as VM_HANDS_SURFACE_DIRECTORY_ARG,b as VM_HANDS_OP_RUNNER_SURFACE_ARG,a as VM_HANDS_OP_RUNNER_PERSON_ARG};

package/bin/vm-hands/vm-hands-runtime-8vt9etvv.js

@@ -1,4 +0,0 @@
-// @bun
-import{e as y}from"./vm-hands-entry-lite-4gh5kfr4.js";import{Ea as n,Fa as i,Ga as t}from"./vm-hands-entry-lite-37hvds7z.js";import{ff as o}from"./vm-hands-entry-lite-tytfs183.js";import"./vm-hands-entry-lite-q8wkrzer.js";import"./vm-hands-entry-lite-magmzx9c.js";import{wl as F}from"./vm-hands-entry-lite-ejkba2nk.js";import{spawn as $j}from"child_process";import{createHash as Xj}from"crypto";import{lstatSync as x,mkdirSync as r,readFileSync as a,statSync as zj,writeFileSync as e}from"fs";var h="/run/reason-vm-hands",l="/run/reason-vm-hands/env",b="/run/reason-vm-hands/surface",p="/home/runner/.reason/workspace",Gj=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,d="/sys/fs/cgroup/reason-srt",Kj=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],Bj=65536,Yj=21600000;function Fj(Q,q="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;r(q,{recursive:!0,mode:448});let J=x(q);if(!J.isDirectory()||J.uid!==0||(J.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}e(`${q}/base-keyed`,`1
-`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function s(Q,q){let J=(B)=>{return q("srt_warm_skipped",{reason:B}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return J("no_settings");let $=Buffer.from(Q.srt_base_settings,"base64");if($.length===0||$.length>Bj||$.toString("base64")!==Q.srt_base_settings)return J("settings_invalid");let X;try{let B=x(d);if(!B.isDirectory()||B.uid!==0||(B.mode&18)!==0)return J("cgroup_unsafe");let L=Kj.find((N)=>x(N,{throwIfNoEntry:!1})!==void 0);if(!L)return J("cgroup_or_exec_missing");X=L;for(let[N,V]of[[X,!1],["/usr/local/bin",!0]]){let H=x(N);if((V?!H.isDirectory():!H.isFile())||H.uid!==0||(H.mode&18)!==0)return J("srt_exec_unsafe")}}catch{return J("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return J("not_root");let Y=performance.now(),W=Xj("sha256").update($).digest("hex"),G=`${h}/srt-base-settings.json`;try{e(G,$,{mode:384,flag:"w"})}catch{return J("settings_write")}let D=$j("/bin/sh",["-c",`echo $$ > ${d}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",X,"--settings",G,"--idle-ms",String(Yj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((B)=>{D.once("error",()=>{q("srt_warm_failed",{reason:"spawn"}),B()}),D.once("close",(L)=>{q(L===0?"srt_warm_done":"srt_warm_failed",{exit_code:L,warm_ms:Math.round(performance.now()-Y),settings_sha256:W}),B()})})}var c=3000;function hj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let q=Q,J=q.layout,$=q.device_key,X=q.credential;return typeof q.workspace_id==="string"&&Number.isSafeInteger(q.instance_generation)&&typeof q.api_origin==="string"&&Gj.test(q.api_origin)&&typeof q.manifest_digest==="string"&&!!X&&typeof X.key_id==="string"&&Number.isSafeInteger(X.expires_at_ms)&&typeof X.signature==="string"&&!!J&&typeof J.session_root==="string"&&typeof J.alias==="string"&&Number.isSafeInteger(J.payload_uid)&&typeof J.kind==="string"&&!!$&&typeof $.pkcs8==="string"&&typeof $.spki==="string"?q:null}function v(Q){r(Q,{recursive:!0,mode:448});let q=zj(Q);if(!q.isDirectory()||(q.mode&63)!==0||q.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Hj(Q){let[{CLI_VERSION:q},J,$,X]=await Promise.all([import("./version-g29vt13t.js"),import("./hands-worker-source-y64axsw3.js"),import("./network-contract-gprc37sw.js"),import("./device-workspace-3jxhs54b.js")]),{REASON_HANDS_PROTOCOL_VERSION:Y}=await import("./reason-hands-protocol-jsrkawe2.js");return{reason_runtime_version:q,bridge_version:q,protocol_version:o,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:$.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:$.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:$.HANDS_SESSION_GROUP,worker_version:J.REASON_HANDS_WORKER_VERSION,protocol_version:Y,worker_artifact_sha256:J.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:J.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:X.REASON_WORKSPACE_BASE,workspace_layout:X.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:$.HANDS_ENVIRONMENT_DELIVERY,[$.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:$.HANDS_ENVIRONMENT_AT_CLAIM,[$.HANDS_CLOUD_ACCESS_KEY]:$.HANDS_CLOUD_ACCESS,[$.HANDS_LARGE_ENVIRONMENT_KEY]:$.HANDS_LARGE_ENVIRONMENT,[$.HANDS_CONFINEMENT_KEY]:$.HANDS_CONFINEMENT,[$.HANDS_JOBS_USER_KEY]:$.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],jj=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],Mj=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),Lj=60000,Uj=30000;function qj(Q,q){return{executionMode:"unsandboxed",runtimeDirectory:q,readiness:{...Object.fromEntries(I.map((J)=>[J,!0])),...Q.lanes},...Q.probing?{probing:jj.filter((J)=>Q.lanes[J]!==!0)}:{},...Q.displayVideo?{displayVideo:!0}:{}}}function Wj(Q,q,J){let $=q([{id:"vm-hands",label:"workspace",path:p,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:qj(J,b)}),X=Q.capabilities,Y={...X.operation_constraints};for(let G of I)Y[G]={...$.operation_constraints?.[G]??{},ready:!0,execution_mode:$.operation_constraints?.[G]?.execution_mode??"host"};let W=jj.filter((G)=>$.operation_constraints?.[G]!==void 0);for(let G of W)Y[G]=$.operation_constraints[G];return{...Q,capabilities:{...X,supported_operations:["hands.connect",...I,...W],operation_constraints:Y}}}function Nj(Q){for(let q of a("/etc/passwd","utf8").split(`
-`)){let J=q.split(":");if(J.length>=4&&Number(J[2])===Q&&/^\d+$/.test(J[3]??"")&&Number(J[3])>0)return Number(J[3])}throw Error("vm_hands_payload_account_unavailable")}function Vj(Q,q){let J=q.owner;if(!J||typeof J.organization_id!=="string"||typeof J.device_id!=="string"||typeof q.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:J.organization_id,deviceId:J.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:q.root_id,label:"workspace",path:p,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function gj(Q=process.platform,q="/proc/self/oom_score_adj"){if(Q!=="linux")return null;let J;try{J=a(q,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(J))return{value:"unreadable"};let $=Number(J);return $<0?{value:$}:null}async function bj(Q,q){let J=gj();if(J)q("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:J.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});v(h),v(l),v(b),Fj(q);let $=s(Q,q),X=!1,Y=async()=>{if(!await Promise.race([$.then(()=>!0),new Promise((Z)=>setTimeout(()=>Z(!1),c).unref?.())]))X=!0,q("srt_warm_late",{wait_ms:c})},[{configureDesktopAccount:W},{configureWorkerSandbox:G}]=await Promise.all([import("./desktop-account-0q0arpzk.js"),import("./worker-sandbox-z0t69av8.js")]);G();try{W({value:String(Q.layout.payload_uid)})}catch{q("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let D=new AbortController;for(let j of["SIGTERM","SIGINT"])process.on(j,()=>D.abort());let B=new Map,L,N=new Promise((j)=>{L=j}),V=N.then(()=>import("./vm-hands-executor-epyhpjv3.js")).then(({createVmHandsExecutor:j})=>{let Z=j({init:Q,root:p,runtimeDirectory:h,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{X=!1,$=s(Q,q)},srtWarmLate:()=>X,forward:(K,z,w)=>B.get(K)?.(z,w)??Promise.reject(Error("vm_hands_not_bound")),log:(K,z)=>q(K,z)});return q("executor_loaded"),Z}),H=(j)=>async(...Z)=>(await V)[j](...Z),O=null;V.then((j)=>{O=(Z)=>j.executorExited(Z)});let g={startExecutor:async(...j)=>{return await Y(),H("startExecutor")(...j)},killAndVerifyPayload:H("killAndVerifyPayload"),killProbe:H("killProbe"),runProbe:async(...j)=>{return await Y(),H("runProbe")(...j)},restatLayout:()=>{throw Error("replaced below")},verifyMounts:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(j)=>O?O(j):new Promise(()=>{}),takeSrtFallbacks:()=>null};V.then((j)=>{g.restatLayout=()=>j.restatLayout(),g.verifyMounts=()=>j.verifyMounts(),g.installEnvironment=(Z,K)=>j.installEnvironment(Z,K),g.freezeBind=(Z)=>j.freezeBind(Z),g.takeSrtFallbacks=()=>j.takeSrtFallbacks?.()??null});let Jj=await n(Q),R=new i(Q,Jj,g,{envRoot:l}),S=Hj(Q),U={probing:!0,lanes:{},displayVideo:!1},k=null,u=null,Qj=Promise.all([S,import("./local-capabilities-tdzbqmrb.js")]).then(([j,Z])=>{u=()=>Wj(j,Z.capabilityInventoryForRoots,U),q("device_ops_loaded")}).catch((j)=>q("device_ops_unavailable",{error:j instanceof Error?j.name:"error"})),f,T=(j)=>{clearTimeout(f),U=j,k?.()},P=N.then(()=>import("./vm-hands-executor-epyhpjv3.js")).then(({createVmHandsOpRunners:j,vmHandsBindCgroup:Z,VM_HANDS_PAYLOAD_CGROUP:K})=>j({payloadUid:Q.layout.payload_uid,payloadGid:Nj(Q.layout.payload_uid),bindCgroup:(z)=>Z(K,z),surfaceDirectory:b,onSurfaceReadiness:(z)=>{if(z)T({probing:!1,lanes:z.lanes??{},displayVideo:z.display_video===!0});else if(U.probing)T({probing:!1,lanes:{},displayVideo:!1})},log:(z,w)=>q(z,w)})).catch(()=>null);P.then((j)=>j?.warm("person")),P.then(async(j)=>{if(!j){T({probing:!1,lanes:{},displayVideo:!1});return}let Z=Date.now()+Uj;while(R.settingUp&&Date.now()<Z)await new Promise((K)=>setTimeout(K,250));f=setTimeout(()=>{if(U.probing)T({probing:!1,lanes:{},displayVideo:!1})},Lj),f.unref?.(),j.warm("surface")}),q("agent_ready"),await t({apiOrigin:Q.api_origin,agent:R,signal:D.signal,heartbeat:async()=>u?.()??await S,onHeartbeatNow:(j)=>{k=j},executeOp:async({kind:j,claim:Z,bindId:K,signal:z,emit:w})=>{let A=Vj(Q,Z);if(!A)return{status:"failed",error_code:"vm_hands_bind_invalid"};let m={executionMode:"unsandboxed",runtimeDirectory:h,readiness:{...Object.fromEntries(I.map((M)=>[M,!0])),"tunnel.open":U.lanes["tunnel.open"]===!0,"tunnel.close":U.lanes["tunnel.close"]===!0}},E=(M)=>{let C=typeof M.kind==="string"?M.kind:"";if(C)w({kind:C,...M.data&&typeof M.data==="object"?{data:M.data}:{}})};if(Z.capability==="exec.full"&&j!=="person")return{status:"failed",error_code:"capability_not_granted"};if(Z.capability==="automation.call.v1"&&j!=="model")return{status:"failed",error_code:"capability_not_granted"};let Zj=Z.capability==="pty.start"&&j==="person"&&!Z.authority;if(Mj.has(String(Z.capability))&&!Zj){let{executeLocalOperation:M}=await import("./local-capabilities-tdzbqmrb.js");return M(A,Z,{worker:m,signal:z,emit:(C)=>E(C)})}let _=await P;if(!_)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(y.has(String(Z.capability))){if(U.lanes[String(Z.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return _.run("surface",{id:String(Z.attempt_id),claim:Z,state:A,worker:qj(U,b)},E,z)}return _.run(j,{id:String(Z.attempt_id),claim:Z,state:A,worker:m},E,z,K)},controlOp:async({claim:j,control:Z})=>y.has(String(j.capability))&&((await P)?.notify("surface",{t:"control",id:String(j.attempt_id),control:{kind:Z.kind,payload:Z.payload??{}}})??!1),opCompleted:({claim:j,status:Z,acknowledged:K})=>{if(K&&j.capability==="preview.serve.v1")P.then((z)=>z?.notify("surface",{t:"retire",operation_id:String(j.operation_id),status:Z}))},readyData:({launchId:j})=>({executor_launch_id:j}),log:(j,Z)=>{if(j==="vm_hands.registered"||j==="vm_hands.reconnected")L();q(j,Z)},onTurn:(j,Z)=>{if(Z)B.set(j,Z);else B.delete(j)}}),await(await V).stop(),(await P)?.stop()}export{gj as vmHandsOomProtection,s as startBaseSrtServer,bj as runVmHands,hj as parseVmHandsInit,Hj as heartbeatBody,Fj as enableBaseKeyedSrt};

package/bin/vm-hands/worker-preview-readiness-yfjgban2.js

@@ -1,2 +0,0 @@
-// @bun
-import{y as a}from"./vm-hands-entry-lite-f3wh0dza.js";import"./vm-hands-entry-lite-j2ng164q.js";import"./vm-hands-entry-lite-gxper06w.js";import"./vm-hands-entry-lite-6y6pz2yw.js";import"./vm-hands-entry-lite-0k13wmzm.js";import"./vm-hands-entry-lite-magmzx9c.js";import"./vm-hands-entry-lite-ejkba2nk.js";export{a as probeWorkerPreview};

package/bin/vm-hands/worker-sandbox-z0t69av8.js

@@ -1,2 +0,0 @@
-// @bun
-import{z as a}from"./vm-hands-entry-lite-pp7jfqzr.js";import"./vm-hands-entry-lite-s9xf5z69.js";import"./vm-hands-entry-lite-2m5dwrdf.js";import"./vm-hands-entry-lite-d2w8tghq.js";import"./vm-hands-entry-lite-714wspqb.js";import"./vm-hands-entry-lite-gxper06w.js";import"./vm-hands-entry-lite-6y6pz2yw.js";import"./vm-hands-entry-lite-0k13wmzm.js";import"./vm-hands-entry-lite-magmzx9c.js";import"./vm-hands-entry-lite-ejkba2nk.js";export{a as configureWorkerSandbox};