@reason-machines/cli-linux-x64 0.2.422 → 0.2.426

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,4 +1,4 @@
 // @bun
-import{ei,bt,Re,vt,ri,Ai}from"./vm-hands-entry-lite-4vks5phw.js";import{createHash as H,randomBytes as me}from"crypto";import{closeSync as Te,fsyncSync as Ae,mkdirSync as Ye,openSync as xe,renameSync as Xe,rmSync as Qe,statSync as Oe,writeSync as De,constants as F}from"fs";import{join as ie}from"path";var Ze=1;var re=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function he(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Pe(e,n){let{payload:i,authority:r}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!r||typeof r!=="object"||Array.isArray(r)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||r.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function fe(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&re.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:he(e)?e.environment_sealed:null,workspace_deferred:en(e)}}function en(e){let n=e.payload[Re];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}var z=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),V=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function L(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(L).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${L(e[n])}`).join(",")}}`}async function Li(e){let n=await crypto.subtle.importKey("pkcs8",V(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=V(e.device_key.spki),r=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),f=new Uint8Array(await crypto.subtle.exportKey("spki",r.publicKey)),_=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:r,signingSpki:i,agreementSpki:f,fingerprint:_}}var nn=16;class an{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,r){this.init=e;this.keys=n;this.hooks=i;this.options=r;if(!re.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let r=Date.now()+n;;){let f=this.bound.get(e);if(!f)return!1;if(f.envInstalled)return!0;if(Date.now()>=r||i?.aborted)return!1;await new Promise((_)=>setTimeout(_,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:Ze,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:z(this.keys.signingSpki),env_public_key:z(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:z(me(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(L(n)));return{...n,device_signature:z(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),r=z(me(32)),f=Ai({method:"GET",pathAndQuery:ei,timestamp:i,nonce:r,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),_=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(f)));return{t:"hello",timestamp:i,nonce:r,signature:z(tn(_)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let i of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!re.test(i))throw new l("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<=(this.lastBrainGeneration.get(e.run_id)??0))throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(L({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((i)=>i.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=nn)throw new l("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new l("vm_hands_busy","a bind waits for its workspace beside the setup");if(e.workspace_deferred&&this.liveBindIds.length)throw new l("vm_hands_prebind_unsafe","a pre-bind needs a VM with no other live bind");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let i,r,f=new Promise((_,m)=>{i=_,r=m});f.catch(()=>{return}),this.grants.set(e.bind_id,{promise:f,resolve:i,reject:r})}return this.exclusive(()=>this.setUp(e))}async setUp(e){let n=[...this.bound.keys()],i=null,r=!1,f=this.grants.get(e.bind_id);try{if(f&&n.length)throw new l("vm_hands_prebind_unsafe","a pre-bind needs a VM with no other live bind");if(n.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:n}),this.unverified.clear();this.servedRun=!0,r=!0;let{launchId:_,applied:m,readyData:y}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...f?{workspaceGrant:f.promise}:{}}),S=this.hooks.restatLayout();this.hooks.verifyMounts?.();let I=null,w=null;if(e.env){let x=e.claim?.owner??{},B=Pe(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof x.device_id==="string"?x.device_id:"",rootId:e.claim?.root_id??""});I=this.hooks.installEnvironment(e.bind_id,B),w=typeof B.snapshot_id==="string"&&B.snapshot_id?B.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,B)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:_,envInstalled:I!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:_,snapshot_revision:I,snapshot_id:w,layout:S,...y?{ready_data:y}:{},policy_digest:H("sha256").update(L({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(_){if(i)ge(i);if(r){let y=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:y,own:!0}).catch(()=>{this.unverified.add(e.bind_id)})}this.binding.delete(e.bind_id),this.grants.delete(e.bind_id);let m=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:"vm_hands_bind_failed";throw _ instanceof l?_:new l(m,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!re.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let r=Pe(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),f=this.hooks.installEnvironment(n.bindId,r);if(n.envInstalled=!0,n.envDirectory)ge(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${f}`,r),{snapshot_id:e.snapshotId,installed_revision:f,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let r=[...this.bound.keys()].filter((f)=>f!==e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:r})}catch(f){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw f}if(this.unverified.delete(e),!r.length&&!i)this.unverified.clear();if(n?.envDirectory)ge(n.envDirectory);return this.unverifiedTeardowns.delete(e),{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:r.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},r=await crypto.subtle.importKey("spki",V(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),f=await crypto.subtle.deriveKey({name:"ECDH",public:r},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),_=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(e.iv),additionalData:new TextEncoder().encode(n)},f,V(e.ct)).catch(i),m=JSON.parse(new TextDecoder().decode(_));if(!m||typeof m!=="object"||Array.isArray(m))throw new l("vm_hands_env_invalid","env not an object");return m}writeJobEnvRootOnly(e,n){let i=ie(this.options.envRoot,`bind-${e}`);Ye(i,{mode:448});let r=Oe(i);if(!r.isDirectory()||(r.mode&63)!==0||r.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let f=n.variables&&typeof n.variables==="object"?n.variables:{},_=Object.entries(f).filter(([S,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(S)&&typeof I==="string").map(([S,I])=>`export ${S}='${String(I).replaceAll("'","'\\''")}'`).join(`
+import{Yn,wt,ei,ti,ri,ki}from"./vm-hands-entry-lite-tqc2ezda.js";import{createHash as H,randomBytes as me}from"crypto";import{closeSync as Te,fsyncSync as Re,mkdirSync as Je,openSync as Ae,renameSync as Ye,rmSync as Xe,statSync as xe,writeSync as Oe,constants as F}from"fs";import{join as ie}from"path";var Qe=1;var re=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function he(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Pe(e,n){let{payload:i,authority:r}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!r||typeof r!=="object"||Array.isArray(r)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||r.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function fe(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&re.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:he(e)?e.environment_sealed:null,workspace_deferred:Ze(e)}}function Ze(e){let n=e.payload[ei];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}var z=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),V=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function L(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(L).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${L(e[n])}`).join(",")}}`}async function Di(e){let n=await crypto.subtle.importKey("pkcs8",V(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=V(e.device_key.spki),r=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),f=new Uint8Array(await crypto.subtle.exportKey("spki",r.publicKey)),_=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:r,signingSpki:i,agreementSpki:f,fingerprint:_}}var en=16;class on{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,r){this.init=e;this.keys=n;this.hooks=i;this.options=r;if(!re.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let r=Date.now()+n;;){let f=this.bound.get(e);if(!f)return!1;if(f.envInstalled)return!0;if(Date.now()>=r||i?.aborted)return!1;await new Promise((_)=>setTimeout(_,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:Qe,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:z(this.keys.signingSpki),env_public_key:z(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:z(me(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(L(n)));return{...n,device_signature:z(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),r=z(me(32)),f=ki({method:"GET",pathAndQuery:Yn,timestamp:i,nonce:r,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),_=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(f)));return{t:"hello",timestamp:i,nonce:r,signature:z(nn(_)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let i of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!re.test(i))throw new l("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<=(this.lastBrainGeneration.get(e.run_id)??0))throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(L({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((i)=>i.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=en)throw new l("vm_hands_busy","every bind slot is held");if(this.grants.size)throw new l("vm_hands_busy","a bind waits for its workspace beside the setup");if(e.workspace_deferred&&this.liveBindIds.length)throw new l("vm_hands_prebind_unsafe","a pre-bind needs a VM with no other live bind");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let i,r,f=new Promise((_,m)=>{i=_,r=m});f.catch(()=>{return}),this.grants.set(e.bind_id,{promise:f,resolve:i,reject:r})}return this.exclusive(()=>this.setUp(e))}async setUp(e){let n=[...this.bound.keys()],i=null,r=!1,f=this.grants.get(e.bind_id);try{if(f&&n.length)throw new l("vm_hands_prebind_unsafe","a pre-bind needs a VM with no other live bind");if(n.length===0){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(),this.unverified.clear()}else if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:n}),this.unverified.clear();this.servedRun=!0,r=!0;let{launchId:_,applied:m,readyData:y}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...f?{workspaceGrant:f.promise}:{}}),S=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let I=null,w=null;if(e.env){let x=e.claim?.owner??{},B=Pe(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof x.device_id==="string"?x.device_id:"",rootId:e.claim?.root_id??""});I=this.hooks.installEnvironment(e.bind_id,B),w=typeof B.snapshot_id==="string"&&B.snapshot_id?B.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,B)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:_,envInstalled:I!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:_,snapshot_revision:I,snapshot_id:w,layout:S,...y?{ready_data:y}:{},policy_digest:H("sha256").update(L({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(_){if(i)ge(i);if(r){let y=[...this.bound.keys()];await this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:y,own:!0}).catch(()=>{this.unverified.add(e.bind_id)})}this.binding.delete(e.bind_id),this.grants.delete(e.bind_id);let m=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:"vm_hands_bind_failed";throw _ instanceof l?_:new l(m,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!re.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let r=Pe(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),f=this.hooks.installEnvironment(n.bindId,r);if(n.envInstalled=!0,n.envDirectory)ge(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${f}`,r),{snapshot_id:e.snapshotId,installed_revision:f,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let r=[...this.bound.keys()].filter((f)=>f!==e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:r})}catch(f){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw f}if(this.unverified.delete(e),!r.length&&!i)this.unverified.clear();if(n?.envDirectory)ge(n.envDirectory);return this.unverifiedTeardowns.delete(e),{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:r.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},r=await crypto.subtle.importKey("spki",V(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),f=await crypto.subtle.deriveKey({name:"ECDH",public:r},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),_=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(e.iv),additionalData:new TextEncoder().encode(n)},f,V(e.ct)).catch(i),m=JSON.parse(new TextDecoder().decode(_));if(!m||typeof m!=="object"||Array.isArray(m))throw new l("vm_hands_env_invalid","env not an object");return m}writeJobEnvRootOnly(e,n){let i=ie(this.options.envRoot,`bind-${e}`);Je(i,{mode:448});let r=xe(i);if(!r.isDirectory()||(r.mode&63)!==0||r.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let f=n.variables&&typeof n.variables==="object"?n.variables:{},_=Object.entries(f).filter(([S,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(S)&&typeof I==="string").map(([S,I])=>`export ${S}='${String(I).replaceAll("'","'\\''")}'`).join(`
 `)+`
-`,m=ie(i,`.job.env.${me(8).toString("hex")}`),y=xe(m,F.O_WRONLY|F.O_CREAT|F.O_EXCL|F.O_NOFOLLOW,384);try{De(y,_),Ae(y)}finally{Te(y)}return Xe(m,ie(i,"job.env")),i}}function ge(e){try{let n=ie(e,"job.env"),i=Oe(n).size,r=xe(n,F.O_WRONLY|F.O_NOFOLLOW);try{De(r,Buffer.alloc(i)),Ae(r)}finally{Te(r)}}catch{}Qe(e,{recursive:!0,force:!0})}function tn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(f)=>{let _=0;while(_<f.length-1&&f[_]===0)_++;let m=f.subarray(_),y=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,y.length,...y)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as rn}from"crypto";var sn="/app/local-runtime/session?register=vm_hands_v1",on="/app/local-runtime",Me=25000,pe=20000,dn=1e4,Be=5000,cn=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ln="preview.serve.v1",un=60000,ve=75000,_n=2000,mn=1e4,gn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),hn=3,fn=20000,pn=250,vn=2000;function je(e){let n=Math.min(pn*2**(e-1),vn);return Math.round(n/2+Math.random()*n/2)}var wn=5000;function bn(e){return e>=500||e===408||e===429}var se=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class q extends Error{}var yn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function $e(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function kn(e,n,i,r,f){let _=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(_))return;m.add(_);let y=i.turn.claim.operation_id;(async()=>{for(let[S,I]of qe.entries()){if(r.aborted)return;if(await new Promise((w)=>{let x=setTimeout(w,I);x.unref?.(),r.addEventListener("abort",()=>{clearTimeout(x),w()},{once:!0})}),r.aborted)return;try{let w=await n.retryUnbind(_);f("vm_hands.unbind_healed",{operation_id:y,attempt:S+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let x=$e(w);if(f("vm_hands.unbind_unverified",{operation_id:y,code:x,attempt:S+1}),x==="vm_hands_unbind_unknown")return}}f("vm_hands.unbind_heal_exhausted",{operation_id:y,attempts:qe.length})})().finally(()=>m.delete(_))}async function Ue(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Be))])}async function Sn(e,n){let i=[...e.personTerminals].filter((r)=>r.session===null||r.session===n);for(let r of i)r.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Be))]);return i.length}function In(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ue(e,i),n.unbind(i)}function oe(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Pn=1000;async function Mi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},r=e.log??(()=>{}),f=async(y)=>{for(let[S,I]of[...i.turns]){i.turns.delete(S),e.onTurn?.(S,null),oe(I);let w=await J(i,e.agent,S).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});r("vm_hands.bound_dropped",{reason:y})}},_=0,m=0;try{for(let y=0;!e.signal.aborted;y++){let S=await Tn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<mn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&gn.has(w.code)&&_<hn&&Date.now()-n<fn)return _++,m=je(_),r("vm_hands.register_retry",{attempt:_,code:w.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(r("vm_hands.session_closed",{close_code:S.closeCode,reason:S.closeReason.slice(0,120),registered:i.deviceId!==null}),S.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ve)await f("reconnect_deadline");if(i.served)i.served=!1,y=0;let I=S.closeReason==="drain_reconnect"?0:S.closeReason==="vm_hands_register_retry"?m:S.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(y,5),2000):i.turns.size?Math.min(250*2**Math.min(y,5),5000,Math.max(0,i.lostAt+ve-Date.now())):Math.min(500*2**y,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ve)await f("reconnect_deadline")}}finally{await f("session_ended")}}async function Tn(e,n){let i=n.deviceId,r=e.log??(()=>{}),f=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:sn,_=`${e.apiOrigin.replace(/^http/,"ws")}${f}`,m=new WebSocket(_),y=0,S="",I=new Map,w=[],x=null,B=new Promise((t)=>{m.onclose=(o)=>{y=o.code,S=o.reason;for(let s of I.values())s.reject(new q(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});m.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{m.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,Pn));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!x?.(o))w.push(o)};let Y=(t,o)=>new Promise((s,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){s(w.splice(u,1)[0]);return}let h=setTimeout(()=>{x=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);x=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(h),x=null,s(p),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,o)=>new Promise((s,a)=>{if(m.readyState!==WebSocket.OPEN){a(new q("session closed"));return}let u=rn(),h=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new q(`no answer to ${t.split("/").pop()} in ${h+Ne} ms`)),m.close(4000,"request_timeout")},h+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}s({status:c,json:g})}}),X({t:"req",id:u,path:`${on}${t}`,body:JSON.stringify(o)})}),we=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",we,{once:!0});let ae,Q=new Map,Z=new Map,de=!1,ce=new Set,le=new Set,ue=Promise.resolve(),be=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);m.onopen=()=>{clearTimeout(g),r("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,a;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(s=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,k]of[...n.turns]){if(d.some((P)=>P&&P.operation_id===k.claim.operation_id&&P.attempt_id===k.claim.attempt_id)){o.push(k),r("vm_hands.bound_resumed",{operation_id:k.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),oe(k);let E=await J(n,e.agent,g).catch((P)=>ne(P,k,"vm_hands_bind_lost"));if(E)n.receipts.push({turn:k,failure:"vm_hands_bind_lost",unbound:E});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),B.then(()=>{throw new l(S==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let h=a.cadence?.presence_interval_ms??30000;if(ae=setInterval(()=>{u().catch(()=>m.close())},h),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,B.then(()=>{if(n.request===C)n.request=null}),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(s,t.challenge);let p=(c,d)=>{Z.set(c,d().catch(async(g)=>{if(await ye(g,c),g instanceof q)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=be;try{await te();for(let c of o)c.flush=()=>ke(c),c.flush(),p(c.claim.attempt_id,()=>Se(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Me,Me)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await ye(c,null)}}finally{if(ae)clearInterval(ae);e.signal.removeEventListener("abort",we);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===be)n.flushReceipts=null;m.close(),await B,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=Q.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,a=await J(n,e.agent,t).catch((u)=>s?ne(u,s,"vm_hands_bind_lost"):null);if(a&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:a});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let t of ce)t.abort()}return{closeCode:y,closeReason:S};async function ye(t,o){if(t instanceof q){if(!de&&n.turns.size)n.lostAt=Date.now();de=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)de=!0;for(let a of s){let u=n.turns.get(a);if(n.turns.delete(a),u)oe(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let h=Q.get(a)??u,p=h?{...h,eventSeq:h.eventSeq+1}:null,c=await J(n,e.agent,a).catch((d)=>p?ne(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=C){let s=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},h=encodeURIComponent(a.operation_id);return{fence:u,op:h,complete:(c,d={})=>s(`/operations/${h}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,k=(T)=>s(`/operations/${h}/events`,{...u,event_seq_start:T,events:[{kind:c,payload:{sequence:T,capability:String(a.capability??"hands.connect"),data:d}}]}),E=g,P=await k(E),D=P.status===409?P.json?.expected_event_seq:void 0;if(typeof D==="number"&&D===g+1)P={status:200,json:{duplicate:!0}};else if(typeof D==="number"&&D>=0&&D!==g)E=D,P=await k(E);if(P.status<300)t.eventSeq=E+1;return P}}function We(t){return(o,s)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=yn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:a,reject:u}),t.flush?.()})}function ke(t){if(le.has(t))return;le.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof q)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{le.delete(t)}})()}async function ze(t,o){try{let s=await e.agent.attestFrame(t,o);if(m.readyState!==WebSocket.OPEN)return;X(s);let a=await Y(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function Fe(t){let o=ee&&n.attest==="pending",s=t.vm_hands_attest,a=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,U=Math.max(0,Math.min(se,Number.isFinite(b)?b:se));if(!await new Promise((A)=>{let R=setTimeout(()=>A(!1),U);n.attestWaiters.push((W)=>{clearTimeout(R),A(W)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:h,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!he(t)}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await h("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,k=!1,E=(()=>{try{return fe(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(E,(n.bindsStarting.get(E)??0)+1);try{let b=await Sn(n,E);if(b)r("vm_hands.person_terminals_closed",{count:b});let U=fe(t),v=e.agent.bind(U);if(U.workspace_deferred)k=!0,g=Ge(u,()=>k);d=await v}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await h("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{k=!1;let b=(n.bindsStarting.get(E)??1)-1;if(b>0)n.bindsStarting.set(E,b);else n.bindsStarting.delete(E)}let P=g?await g:-1,D={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete D.environment_installed;let T=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:D,eventSeq:u.eventSeq,ackSeq:-1});let K={...D,...T,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},_e=Date.now()+wn,j=1,N=await p("hands.ready",K);while(bn(N.status)&&!e.signal.aborted){let b=je(j);if(Date.now()+b>=_e)break;await new Promise((U)=>setTimeout(U,b)),j++,N=await p("hands.ready",K)}if(j>1)r("vm_hands.ready_retried",{attempts:j,status_class:`${Math.floor(N.status/100)}xx`});if(Q.delete(t.attempt_id),N.status>=300){await Ue(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await h("failed",{error_code:Ce(N.json?.error,"vm_hands_probe_failed")});return}let M={claim:t,launchId:d.launch_id,readyData:D,eventSeq:u.eventSeq,ackSeq:P};n.turns.set(t.attempt_id,M),M.flush=()=>ke(M),e.onTurn?.(t.attempt_id,We(M)),await Se(M)}async function Ge(t,o){let{fence:s,op:a}=O(t),u=t.claim.attempt_id,h=-1;try{for(;;){let p=await C(`/operations/${a}/heartbeat`,{...s,control_ack_seq:h,wait_ms:pe});if(!o())return h;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),h;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=h)continue;if(h=d.seq,d.kind===vt)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),h;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),h}}}catch{return e.agent.abandonWorkspaceGrant(u),h}}async function Se(t){let{fence:o,op:s}=O(t),a=null,u=null,h=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([h,C(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:pe})]);if(!p){a="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===bt)try{await Ve(t,d.payload??{})}catch(g){if(g instanceof q)throw g;a=g instanceof l?g.code:"environment_unavailable";let k=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;r("vm_hands.environment_refused",{code:a,cause:k});break e}t.ackSeq=d.seq}}await He(t,a)}async function Ie(t,o){let s=Date.now()+un;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof q))throw u}if(Date.now()>=s||e.signal.aborted)throw new q("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,s={claim:o,eventSeq:0},a=String(t.capability??""),u=a===ln,{complete:h,emit:p,fence:c,op:d}={...O(s,u?Ie:C)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await h("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,A=n.attest==="refused"?0:Math.max(0,Math.min(se,Number.isFinite(v)?v:se));if(!(A>0&&await new Promise((W)=>{let Le=setTimeout(()=>W(!1),A);n.attestWaiters.push((Je)=>{clearTimeout(Le),W(Je)})}))){await h("failed",{error_code:"vm_hands_unattested"});return}}let k=e.agent.bindIdForRun(o.run_id);if(g==="model"&&k===null){await h("failed",{error_code:"vm_hands_not_bound"});return}let E=a==="pty.start"&&g==="person"&&!t.authority,P=E?In(t):null;if(E&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(P)){await h("failed",{error_code:"vm_hands_bound"});return}if(cn.has(a)&&!E&&e.agent.liveBindIds.length===0){await h("failed",{error_code:"vm_hands_not_bound"});return}let T=new AbortController;if(!u)ce.add(T);let K,_e=new Promise((v)=>{K=v}),j={abort:T,settled:_e},N=E?{...j,session:P}:null;if(N)n.personTerminals.add(N);if(g==="model"&&k&&a!=="preview.serve.v1"){let v=n.modelOps.get(k)??new Set;v.add(j),n.modelOps.set(k,v),await e.agent.environmentInstalled(k,_n,T.signal)}let M=-1,b=!1,U=u?void 0:setInterval(()=>{C(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){T.abort();return}let A=v.json?.controls??[];for(let R of A)if(M=Math.max(M,R.seq),R.kind==="operation.cancel"||R.kind==="cancel")T.abort()},()=>T.abort())},dn);if(u)(async()=>{while(!b&&!T.signal.aborted){let v;try{v=await Ie(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:pe})}catch{T.abort();return}if(b)return;if(v.status>=300){T.abort();return}let A=(v.json?.controls??[]).slice().sort((R,W)=>R.seq-W.seq);for(let R of A){if(R.seq<=M)continue;if(R.kind==="operation.cancel"||R.kind==="cancel")T.abort();else await e.controlOp?.({claim:t,control:R}).catch(()=>!1);M=R.seq}}})();try{let v=await e.executeOp({kind:g,claim:t,...g==="model"&&k?{bindId:k}:{},signal:T.signal,emit:async(R)=>{await p(R.kind,R.data??{})}}),A=await h(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:A.status<300}),r("vm_hands.op",{capability:a,kind:g,status:v.status,code:v.error_code??null,...A.status>=300?{complete_status:A.status,complete_error:String(A.json?.error??"").slice(0,64)}:{}})}finally{if(b=!0,clearInterval(U),ce.delete(T),k)n.modelOps.get(k)?.delete(j);if(N)n.personTerminals.delete(N);K()}}async function He(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),oe(t);let a=await J(n,e.agent,s).catch((u)=>ne(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await te()}function ne(t,o,s){let a=$e(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(ri,{code:a}).catch(()=>{return}),kn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function te(){return ue=ue.then(Ee,Ee),ue}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(h){if(h instanceof q)return}n.receipts.shift()}}async function Ve(t,o){let{fence:s,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let h=await C(`/operations/${a}/environment`,{...s,snapshot_id:u}),p=h.json?.environment_sealed;if(h.status!==200||!p||h.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await C(`/operations/${a}/environment-ack`,{...s,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as An}from"fs";var Rn=performance.now();delete process.env.BUN_BE_BUN;var G=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function xn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:_}=await import("./vm-hands-op-runner-34d38g9f.js");await _();return}G("parsed",{t0:Math.round(Rn)});let e="";try{e=An(3,"utf8")}catch{}G("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))G(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-h0trw0xr.js"),f=i(n);if(!f)G("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(f,G)}catch(_){let m=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"error";throw G("failed",{code:m}),_}process.exit(0)}xn();export{Li,an,Mi};
+`,m=ie(i,`.job.env.${me(8).toString("hex")}`),y=Ae(m,F.O_WRONLY|F.O_CREAT|F.O_EXCL|F.O_NOFOLLOW,384);try{Oe(y,_),Re(y)}finally{Te(y)}return Ye(m,ie(i,"job.env")),i}}function ge(e){try{let n=ie(e,"job.env"),i=xe(n).size,r=Ae(n,F.O_WRONLY|F.O_NOFOLLOW);try{Oe(r,Buffer.alloc(i)),Re(r)}finally{Te(r)}}catch{}Xe(e,{recursive:!0,force:!0})}function nn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(f)=>{let _=0;while(_<f.length-1&&f[_]===0)_++;let m=f.subarray(_),y=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,y.length,...y)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as tn}from"crypto";var rn="/app/local-runtime/session?register=vm_hands_v1",sn="/app/local-runtime",De=25000,pe=20000,an=1e4,Ne=5000,dn=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),cn="preview.serve.v1",ln=60000,ve=75000,un=2000,_n=1e4,mn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),gn=3,hn=20000,fn=250,pn=2000;function Be(e){let n=Math.min(fn*2**(e-1),pn);return Math.round(n/2+Math.random()*n/2)}var vn=5000;function wn(e){return e>=500||e===408||e===429}var se=20000;function Me(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class q extends Error{}var bn=64,Ce=[1000,2000,4000,8000,15000,30000,60000,120000];function je(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function yn(e,n,i,r,f){let _=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(_))return;m.add(_);let y=i.turn.claim.operation_id;(async()=>{for(let[S,I]of Ce.entries()){if(r.aborted)return;if(await new Promise((w)=>{let x=setTimeout(w,I);x.unref?.(),r.addEventListener("abort",()=>{clearTimeout(x),w()},{once:!0})}),r.aborted)return;try{let w=await n.retryUnbind(_);f("vm_hands.unbind_healed",{operation_id:y,attempt:S+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let x=je(w);if(f("vm_hands.unbind_unverified",{operation_id:y,code:x,attempt:S+1}),x==="vm_hands_unbind_unknown")return}}f("vm_hands.unbind_heal_exhausted",{operation_id:y,attempts:Ce.length})})().finally(()=>m.delete(_))}async function $e(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ne))])}async function kn(e,n){let i=[...e.personTerminals].filter((r)=>r.session===null||r.session===n);for(let r of i)r.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ne))]);return i.length}function Sn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await $e(e,i),n.unbind(i)}function oe(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var qe=15000,In=1e4,En=1000;async function Ni(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},r=e.log??(()=>{}),f=async(y)=>{for(let[S,I]of[...i.turns]){i.turns.delete(S),e.onTurn?.(S,null),oe(I);let w=await J(i,e.agent,S).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});r("vm_hands.bound_dropped",{reason:y})}},_=0,m=0;try{for(let y=0;!e.signal.aborted;y++){let S=await Pn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<_n)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&mn.has(w.code)&&_<gn&&Date.now()-n<hn)return _++,m=Be(_),r("vm_hands.register_retry",{attempt:_,code:w.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(r("vm_hands.session_closed",{close_code:S.closeCode,reason:S.closeReason.slice(0,120),registered:i.deviceId!==null}),S.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ve)await f("reconnect_deadline");if(i.served)i.served=!1,y=0;let I=S.closeReason==="drain_reconnect"?0:S.closeReason==="vm_hands_register_retry"?m:S.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(y,5),2000):i.turns.size?Math.min(250*2**Math.min(y,5),5000,Math.max(0,i.lostAt+ve-Date.now())):Math.min(500*2**y,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ve)await f("reconnect_deadline")}}finally{await f("session_ended")}}async function Pn(e,n){let i=n.deviceId,r=e.log??(()=>{}),f=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:rn,_=`${e.apiOrigin.replace(/^http/,"ws")}${f}`,m=new WebSocket(_),y=0,S="",I=new Map,w=[],x=null,B=new Promise((t)=>{m.onclose=(o)=>{y=o.code,S=o.reason;for(let s of I.values())s.reject(new q(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});m.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{m.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,En));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!x?.(o))w.push(o)};let Y=(t,o)=>new Promise((s,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){s(w.splice(u,1)[0]);return}let h=setTimeout(()=>{x=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);x=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(h),x=null,s(p),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,o)=>new Promise((s,a)=>{if(m.readyState!==WebSocket.OPEN){a(new q("session closed"));return}let u=tn(),h=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new q(`no answer to ${t.split("/").pop()} in ${h+qe} ms`)),m.close(4000,"request_timeout")},h+qe);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}s({status:c,json:g})}}),X({t:"req",id:u,path:`${sn}${t}`,body:JSON.stringify(o)})}),we=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",we,{once:!0});let ae,Q=new Map,Z=new Map,de=!1,ce=new Set,le=new Set,ue=Promise.resolve(),be=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),In);m.onopen=()=>{clearTimeout(g),r("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,a;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(s=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,k]of[...n.turns]){if(d.some((P)=>P&&P.operation_id===k.claim.operation_id&&P.attempt_id===k.claim.attempt_id)){o.push(k),r("vm_hands.bound_resumed",{operation_id:k.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),oe(k);let E=await J(n,e.agent,g).catch((P)=>ne(P,k,"vm_hands_bind_lost"));if(E)n.receipts.push({turn:k,failure:"vm_hands_bind_lost",unbound:E});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),B.then(()=>{throw new l(S==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let h=a.cadence?.presence_interval_ms??30000;if(ae=setInterval(()=>{u().catch(()=>m.close())},h),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,B.then(()=>{if(n.request===C)n.request=null}),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)We(s,t.challenge);let p=(c,d)=>{Z.set(c,d().catch(async(g)=>{if(await ye(g,c),g instanceof q)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=be;try{await te();for(let c of o)c.flush=()=>ke(c),c.flush(),p(c.claim.attempt_id,()=>Se(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??De,De)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>ze(d))}else Ge(d).catch(()=>{return})}}catch(c){await ye(c,null)}}finally{if(ae)clearInterval(ae);e.signal.removeEventListener("abort",we);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===be)n.flushReceipts=null;m.close(),await B,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=Q.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,a=await J(n,e.agent,t).catch((u)=>s?ne(u,s,"vm_hands_bind_lost"):null);if(a&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:a});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let t of ce)t.abort()}return{closeCode:y,closeReason:S};async function ye(t,o){if(t instanceof q){if(!de&&n.turns.size)n.lostAt=Date.now();de=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)de=!0;for(let a of s){let u=n.turns.get(a);if(n.turns.delete(a),u)oe(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let h=Q.get(a)??u,p=h?{...h,eventSeq:h.eventSeq+1}:null,c=await J(n,e.agent,a).catch((d)=>p?ne(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=C){let s=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},h=encodeURIComponent(a.operation_id);return{fence:u,op:h,complete:(c,d={})=>s(`/operations/${h}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,k=(T)=>s(`/operations/${h}/events`,{...u,event_seq_start:T,events:[{kind:c,payload:{sequence:T,capability:String(a.capability??"hands.connect"),data:d}}]}),E=g,P=await k(E),D=P.status===409?P.json?.expected_event_seq:void 0;if(typeof D==="number"&&D===g+1)P={status:200,json:{duplicate:!0}};else if(typeof D==="number"&&D>=0&&D!==g)E=D,P=await k(E);if(P.status<300)t.eventSeq=E+1;return P}}function Ue(t){return(o,s)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=bn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:a,reject:u}),t.flush?.()})}function ke(t){if(le.has(t))return;le.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof q)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{le.delete(t)}})()}async function We(t,o){try{let s=await e.agent.attestFrame(t,o);if(m.readyState!==WebSocket.OPEN)return;X(s);let a=await Y(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let o=ee&&n.attest==="pending",s=t.vm_hands_attest,a=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,U=Math.max(0,Math.min(se,Number.isFinite(b)?b:se));if(!await new Promise((A)=>{let R=setTimeout(()=>A(!1),U);n.attestWaiters.push((W)=>{clearTimeout(R),A(W)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:h,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!he(t)}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await h("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,k=!1,E=(()=>{try{return fe(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(E,(n.bindsStarting.get(E)??0)+1);try{let b=await kn(n,E);if(b)r("vm_hands.person_terminals_closed",{count:b});let U=fe(t),v=e.agent.bind(U);if(U.workspace_deferred)k=!0,g=Fe(u,()=>k);d=await v}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await h("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{k=!1;let b=(n.bindsStarting.get(E)??1)-1;if(b>0)n.bindsStarting.set(E,b);else n.bindsStarting.delete(E)}let P=g?await g:-1,D={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete D.environment_installed;let T=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:D,eventSeq:u.eventSeq,ackSeq:-1});let K={...D,...T,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},_e=Date.now()+vn,j=1,N=await p("hands.ready",K);while(wn(N.status)&&!e.signal.aborted){let b=Be(j);if(Date.now()+b>=_e)break;await new Promise((U)=>setTimeout(U,b)),j++,N=await p("hands.ready",K)}if(j>1)r("vm_hands.ready_retried",{attempts:j,status_class:`${Math.floor(N.status/100)}xx`});if(Q.delete(t.attempt_id),N.status>=300){await $e(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await h("failed",{error_code:Me(N.json?.error,"vm_hands_probe_failed")});return}let M={claim:t,launchId:d.launch_id,readyData:D,eventSeq:u.eventSeq,ackSeq:P};n.turns.set(t.attempt_id,M),M.flush=()=>ke(M),e.onTurn?.(t.attempt_id,Ue(M)),await Se(M)}async function Fe(t,o){let{fence:s,op:a}=O(t),u=t.claim.attempt_id,h=-1;try{for(;;){let p=await C(`/operations/${a}/heartbeat`,{...s,control_ack_seq:h,wait_ms:pe});if(!o())return h;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),h;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=h)continue;if(h=d.seq,d.kind===ti)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),h;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),h}}}catch{return e.agent.abandonWorkspaceGrant(u),h}}async function Se(t){let{fence:o,op:s}=O(t),a=null,u=null,h=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([h,C(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:pe})]);if(!p){a="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===wt)try{await He(t,d.payload??{})}catch(g){if(g instanceof q)throw g;a=g instanceof l?g.code:"environment_unavailable";let k=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;r("vm_hands.environment_refused",{code:a,cause:k});break e}t.ackSeq=d.seq}}await Ke(t,a)}async function Ie(t,o){let s=Date.now()+ln;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof q))throw u}if(Date.now()>=s||e.signal.aborted)throw new q("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ge(t){let o=t,s={claim:o,eventSeq:0},a=String(t.capability??""),u=a===cn,{complete:h,emit:p,fence:c,op:d}={...O(s,u?Ie:C)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await h("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,A=n.attest==="refused"?0:Math.max(0,Math.min(se,Number.isFinite(v)?v:se));if(!(A>0&&await new Promise((W)=>{let Ve=setTimeout(()=>W(!1),A);n.attestWaiters.push((Le)=>{clearTimeout(Ve),W(Le)})}))){await h("failed",{error_code:"vm_hands_unattested"});return}}let k=e.agent.bindIdForRun(o.run_id);if(g==="model"&&k===null){await h("failed",{error_code:"vm_hands_not_bound"});return}let E=a==="pty.start"&&g==="person"&&!t.authority,P=E?Sn(t):null;if(E&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(P)){await h("failed",{error_code:"vm_hands_bound"});return}if(dn.has(a)&&!E&&e.agent.liveBindIds.length===0){await h("failed",{error_code:"vm_hands_not_bound"});return}let T=new AbortController;if(!u)ce.add(T);let K,_e=new Promise((v)=>{K=v}),j={abort:T,settled:_e},N=E?{...j,session:P}:null;if(N)n.personTerminals.add(N);if(g==="model"&&k&&a!=="preview.serve.v1"){let v=n.modelOps.get(k)??new Set;v.add(j),n.modelOps.set(k,v),await e.agent.environmentInstalled(k,un,T.signal)}let M=-1,b=!1,U=u?void 0:setInterval(()=>{C(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){T.abort();return}let A=v.json?.controls??[];for(let R of A)if(M=Math.max(M,R.seq),R.kind==="operation.cancel"||R.kind==="cancel")T.abort()},()=>T.abort())},an);if(u)(async()=>{while(!b&&!T.signal.aborted){let v;try{v=await Ie(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:pe})}catch{T.abort();return}if(b)return;if(v.status>=300){T.abort();return}let A=(v.json?.controls??[]).slice().sort((R,W)=>R.seq-W.seq);for(let R of A){if(R.seq<=M)continue;if(R.kind==="operation.cancel"||R.kind==="cancel")T.abort();else await e.controlOp?.({claim:t,control:R}).catch(()=>!1);M=R.seq}}})();try{let v=await e.executeOp({kind:g,claim:t,...g==="model"&&k?{bindId:k}:{},signal:T.signal,emit:async(R)=>{await p(R.kind,R.data??{})}}),A=await h(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Me(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:A.status<300}),r("vm_hands.op",{capability:a,kind:g,status:v.status,code:v.error_code??null,...A.status>=300?{complete_status:A.status,complete_error:String(A.json?.error??"").slice(0,64)}:{}})}finally{if(b=!0,clearInterval(U),ce.delete(T),k)n.modelOps.get(k)?.delete(j);if(N)n.personTerminals.delete(N);K()}}async function Ke(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),oe(t);let a=await J(n,e.agent,s).catch((u)=>ne(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await te()}function ne(t,o,s){let a=je(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(ri,{code:a}).catch(()=>{return}),yn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function te(){return ue=ue.then(Ee,Ee),ue}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(h){if(h instanceof q)return}n.receipts.shift()}}async function He(t,o){let{fence:s,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let h=await C(`/operations/${a}/environment`,{...s,snapshot_id:u}),p=h.json?.environment_sealed;if(h.status!==200||!p||h.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await C(`/operations/${a}/environment-ack`,{...s,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as Rn}from"fs";var Tn=performance.now();delete process.env.BUN_BE_BUN;var G=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function An(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:_}=await import("./vm-hands-op-runner-tebkt2kz.js");await _();return}G("parsed",{t0:Math.round(Tn)});let e="";try{e=Rn(3,"utf8")}catch{}G("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))G(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-fpvqkg1k.js"),f=i(n);if(!f)G("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(f,G)}catch(_){let m=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"error";throw G("failed",{code:m}),_}process.exit(0)}An();export{Di,on,Ni};

package/bin/vm-hands/vm-hands-executor-epps6bxx.js

@@ -0,0 +1,11 @@
+// @bun
+import"./vm-hands-entry-lite-tqc2ezda.js";import"./vm-hands-entry-lite-r7zs4ce2.js";import"./vm-hands-entry-lite-3vmhs921.js";import"./vm-hands-entry-lite-em7mk9tn.js";import{nt,Ki,yr,Tt}from"./vm-hands-entry-lite-p1680dtx.js";import"./vm-hands-entry-lite-d9g1pzzx.js";import"./vm-hands-entry-lite-499mywh7.js";import"./vm-hands-entry-lite-g9z467dk.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-a3w8m8nb.js";import"./vm-hands-entry-lite-hw26gewc.js";import"./vm-hands-entry-lite-1f2cam25.js";import"./vm-hands-entry-lite-12rzrd95.js";import{or,sr,xt,kt}from"./vm-hands-entry-lite-ng993z5m.js";import"./vm-hands-entry-lite-dh8f2h2d.js";import"./vm-hands-entry-lite-t5q30ne0.js";import"./vm-hands-entry-lite-9sa1knn7.js";import"./vm-hands-entry-lite-8j7p91hr.js";import{spawn as Ne}from"child_process";import{chmodSync as Ie,chownSync as Ae,existsSync as j,lstatSync as q,mkdirSync as V,mkdtempSync as De,readdirSync as Y,readFileSync as k,realpathSync as Me,rmdirSync as ue,rmSync as Le,writeFileSync as K}from"fs";import{basename as Te,dirname as He,join as d}from"path";import{readFileSync as oe,readlinkSync as ie}from"fs";import{relative as Oe}from"path";var ae=16;function ce(e){return e.replace(/\\([0-7]{3})/g,(t,i)=>String.fromCharCode(Number.parseInt(i,8)))}function xe(e){let t=[];for(let i of e.split(`
+`)){let n=i.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;t.push({device:n[2],root:ce(n[3]),mountPoint:ce(n[4])})}return t}function $e(e,t,i){let n=e.replace(/\/+$/,"")||"/",l=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),a=(m)=>new Map(xe(m).filter((v)=>l(v.mountPoint)).map((v)=>[`${v.mountPoint}\x00${v.device}\x00${v.root}`,v.mountPoint])),c=a(t),p=a(i),b=(m)=>Oe(n,m)||".",P=[...c].filter(([m])=>!p.has(m)).map(([,m])=>b(m)),C=[...p].filter(([m])=>!c.has(m)).map(([,m])=>b(m));return{missing:P,extra:C,referenceCount:c.size,ownCount:p.size}}function le(e,t,i,n="/proc"){let l,a,c=null;try{l=oe(`${n}/1/mountinfo`,"utf8"),a=oe(`${n}/self/mountinfo`,"utf8")}catch(v){let O=v&&typeof v==="object"&&"code"in v&&typeof v.code==="string"?v.code:"unreadable";t("vm_hands.mount_check_unavailable",{code:O});return}try{c=ie(`${n}/1/ns/mnt`)===ie(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:b,referenceCount:P,ownCount:C}=$e(e,l,a),m={reference_count:P,own_count:C,missing_count:p.length,extra_count:b.length,same_namespace:c};if(b.length)t("vm_hands.mount_extra",{...m,extra:b.slice(0,ae)});if(p.length)throw t("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ae)}),i(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var he="/sys/fs/cgroup/reason-payload",D="vm-hands",We="/run/ara-srt/fallbacks.jsonl",G="/reason-person",ze="surface",ee=5000,Be=1e4,de="__VM_HANDS_PROOF_DIR__",Ue="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,t){super(t);this.code=e}}function Fe(e,t){if(!/^[0-9a-f-]{36}$/i.test(t))throw new w("vm_hands_bind_invalid","bad bind id");return d(e,D,`b-${t.toLowerCase()}`)}var Ke=5000,ye=(e)=>`'${e.replaceAll("'","'\\''")}'`;function je(e,t){if(!t||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(t))return e;let i=d(He(e),t.toLowerCase());return Te(e).toLowerCase()===t.toLowerCase()?e:i}function ln(e){let t=e.cgroup??he,i=e.init.layout.payload_uid,n=e.log??(()=>{}),l=(r)=>je(e.init.layout.session_root,r),a=new Map,c=new Map,p=0,b=()=>{try{let r=k("/run/ara-srt/starts.jsonl","utf8"),o=r.slice(p>r.length?0:p).split(`
+`).filter(Boolean);p=r.length;let u=o.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(u.length)n("vm_hands.srt_server_starts",{count:u.length,elapsed_ms:u.slice(0,8)})}catch{}},P=null,C=!1,m=e.srtCgroup??"/sys/fs/cgroup/reason-srt",v=()=>{P??=pe()},O=0,N=()=>{try{let r=k(We,"utf8"),o=r.slice(O>r.length?0:O);O=r.length;let u=o.split(`
+`).filter(Boolean).slice(0,1000);if(!u.length)return null;let f={},g=0;for(let S of u)try{let _=JSON.parse(S),h=typeof _.code==="string"&&/^[a-z_]{1,40}$/.test(_.code)?_.code:"other";if(f[h]=(f[h]??0)+1,typeof _.elapsed_ms==="number")g=Math.max(g,_.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return n("vm_hands.srt_fallbacks",{count:u.length,codes:f,max_elapsed_ms:g}),{count:u.length,codes:f,max_elapsed_ms:g}}catch{return null}},x=(r,o,u)=>F(r,o,u),H=(r)=>(o,u,f)=>Ne("/bin/sh",["-c",`echo $$ > ${ye(d(r,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",o,...u],f),F=H(d(t,D)),W=d(t,D,"probe"),z=(r)=>Fe(t,r),ke=(r)=>{let o=z(r);try{V(o,{mode:493})}catch(u){if(!(u&&typeof u==="object"&&("code"in u)&&u.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return o},Pe=(r)=>{try{ue(z(r))}catch{}},B=e.prespawn?Ki({spawnProcess:x,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(r,o)=>n(r,o??{})}):null;B?.arm();let Z=B?setInterval(()=>{B.arm()},Ke):null;Z?.unref?.();async function X(r){let o=a.get(r);if(a.delete(r),!o)return;o.abort.abort(),await o.done}return{bindCgroup:z,async startExecutor(r){if(v(),c.set(r.bindId,pe()),C=!0,!r.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await X(r.bindId);let{claim:o,bindId:u}=r,f=ke(u),g=o.owner;if(!g||typeof g.device_id!=="string"||typeof o.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,_,h,I=new Promise((s,y)=>{_=s,h=y}),A,R=new Promise((s)=>{A=s}),U=Tt({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,deviceIdentity:{deviceId:g.device_id,rootId:o.root_id,apiOrigin:e.apiOrigin},claimOwner:o.owner,root:e.root,runId:o.run_id,operationId:o.operation_id,attemptId:o.attempt_id,payload:Object.fromEntries(Object.entries(o.payload).filter(([s])=>!s.startsWith("vm_hands_"))),signal:S.signal,...r.workspaceGrant?{workspaceGrant:r.workspaceGrant}:{},emitEvent:async(s,y)=>{if(s==="hands.ready"){_(y);return}if(s==="hands.started"||s==="hands.stopped"||s==="hands.failed")return;await e.forward(u,s,y)}},{...e.relayDependencies,spawnWorker:(s)=>H(f)(s.command,s.args,s.options),...B?{takePrespawnedWorker:(s)=>{let y=B.take(s);if(!y?.pid)return y;try{return K(d(f,"cgroup.procs"),String(y.pid)),y}catch{try{y.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:B.adopt}:{}}).then(()=>{A("executor_stopped")},(s)=>{let y=s&&typeof s==="object"&&"code"in s?String(s.code):"executor_failed";h(new w(y,s instanceof Error?s.message:String(s))),A(y)}).finally(()=>h(new w("vm_hands_executor_exited","executor ended before it was ready")));a.set(u,{abort:S,done:U,exited:R,operationId:o.operation_id,runId:o.run_id,expiresAtMs:Date.parse(String(o.payload.expires_at??""))||0});let M=await I,E=M.executor_launch_id;if(typeof E!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:M,applied:{hands_confinement:typeof o.payload.hands_confinement==="string"?o.payload.hands_confinement:null,browser_egress:o.payload.browser_egress??null}}},takeSrtFallbacks:N,executorExited(r){return a.get(r)?.exited??new Promise(()=>{})},freezeBind(r){let o=z(r);if(j(d(o,"cgroup.freeze")))K(d(o,"cgroup.freeze"),"1")},async killAndVerifyPayload(r){let o=new Set(r?.keep??[]);if(await Ce(r?.bindId??null,o,r?.own===!0),o.size)return;if((C||e.srtWarmLate?.()===!0)&&j(d(m,"cgroup.events")))b(),await te(m,Date.now()+ee,"srt"),e.onSrtReset?.();C=!1},async killProbe(){let r=Date.now()+ee;if(j(d(W,"cgroup.events"))){await te(W,r,"probe");try{ue(W)}catch{}}let o=se(process.pid);if(o===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Ge(t,o,r);let u=(g)=>{let S=se(g);return S!==null&&S<=o},f=me(i).filter((g)=>u(g)&&!L(g,G));if(f.length)throw n("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest"}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(P!==null){let g=[t,d(t,D)].map((h)=>h.replace(/^\/sys\/fs\/cgroup/,"")),S=m.replace(/^\/sys\/fs\/cgroup/,""),_=fe(P).filter((h)=>h!==process.pid&&!L(h,G)&&!L(h,"/reason-vm-hands")&&!L(h,S)&&!g.some((I)=>ne(h,I)));if(_.length&&C)throw n("vm_hands.kill_strays",{strays:re(_),at:"attest"}),new w("vm_hands_kill_unverified",`${_.length} process(es) the run started survived it`);if(_.length)n("vm_hands.attest_concurrent",{processes:re(_),count:_.length});P=null}},async runProbe({nonce:r,script:o}){if(v(),!o.includes(de))throw new w("vm_hands_probe_failed","probe names no proof directory");let u=e.proofParent??"/tmp/reason-vm-hands-proof";V(u,{mode:457,recursive:!0});let f=q(u);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=De(d(u,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(r))throw new w("vm_hands_probe_failed","proof directory path or nonce");Ae(g,i,i),Ie(g,448);let _=q(g).ino;try{V(W,{mode:493})}catch(R){if(!(R&&typeof R==="object"&&("code"in R)&&R.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let h=H(W)("/bin/bash",["-c",o.replaceAll(de,g).replaceAll(Ue,r)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),I="";h.stdout?.on("data",(R)=>{if(I.length<16384)I+=R.toString("utf8").slice(0,16384-I.length)});let A=await new Promise((R)=>{let U=setTimeout(()=>{S=!0,h.kill("SIGKILL"),R(124)},Be);h.once("error",()=>{clearTimeout(U),R(127)}),h.once("close",(M)=>{clearTimeout(U),R(M??1)})});return n("vm_hands.probe",{nonce_len:r.length,exit_code:A}),{exitCode:A,markers:I,proofDirInode:_}}finally{if(!S)Le(g,{recursive:!0,force:!0})}},restatLayout(r){let o=l(r),u=o===e.init.layout.session_root?e.init.layout.alias:d(o,"repo"),f="invalid";try{yr(o),f="0:0:755"}catch{}let g=!1,S=-1;try{let _=q(u);S=_.uid,g=f==="0:0:755"&&u===d(o,"repo")&&!_.isSymbolicLink()&&_.isDirectory()&&Me(u)===u&&_.uid===i}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(r){le(l(r),n,(o)=>new w("vm_hands_mount_mismatch",o))},installEnvironment(r,o){let u=a.get(r);if(!u)throw new w("environment_unavailable","no executor owns an environment");return nt({root:e.root,operationId:u.operationId,payload:o}).installed_revision},async stop(){if(Z)clearInterval(Z);B?.close(),await Promise.all([...a.keys()].map((r)=>X(r)))}};function Re(){try{return Y(d(t,D),{withFileTypes:!0}).filter((r)=>r.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(r.name)).map((r)=>r.name)}catch{return[]}}async function Ce(r,o,u=!1){let f=new Set([...o].map((S)=>S.toLowerCase())),g=Ve();try{await Ye();let S=Date.now()+ee,_=new Set(Re().filter((s)=>!f.has(s.slice(2))).map((s)=>s.slice(2)));if(r)_.add(r.toLowerCase());let h=null;for(let s of _){let y=X(s).catch(()=>{return}),Q=c.get(s);if(Q!==void 0)h=h===null?Q:Math.min(h,Q);if(j(d(z(s),"cgroup.events")))await te(z(s),S,"bind");await y}let I=[...f].map((s)=>z(s).replace(/^\/sys\/fs\/cgroup/,"")),A=["/",...[t,d(t,D)].map((s)=>s.replace(/^\/sys\/fs\/cgroup/,""))],R=m.replace(/^\/sys\/fs\/cgroup/,""),U=(s)=>L(s,G)||I.some((y)=>L(s,y))||A.some((y)=>ne(s,y)),M=u?[]:me(i).filter((s)=>!U(s));if(M.length)throw n("vm_hands.kill_survivors",{pids:M.slice(0,16),beside:f.size}),new w("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside a live bind`);let E=(s)=>!U(s)&&!L(s,"/reason-vm-hands")&&!L(s,R)&&!A.some((y)=>ne(s,y));if(h!==null){let s=fe(h).filter((y)=>y!==process.pid&&E(y));if(s.length)throw n("vm_hands.kill_strays",{strays:re(s),beside:f.size}),new w("vm_hands_kill_unverified",`${s.length} process(es) the run started survived it`)}for(let s of _)c.delete(s),Pe(s)}finally{g()}}}function se(e,t="/proc"){try{let i=k(d(t,String(e),"stat"),"utf8"),n=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function we(e,t="/proc"){try{let i=k(d(t,String(e),"stat"),"utf8"),n=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ge(e,t,i){try{K(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=be(e).filter((a)=>ve(a,e)),l=new Set(n.filter((a)=>{let c=se(a);return c!==null&&c<=t}));for(let a=!0;a;){a=!1;for(let c of n){if(l.has(c))continue;let p=we(c);if(p!==null&&l.has(p))l.add(c),a=!0}}if(l.size===0)return;if(Date.now()>i)throw new w("vm_hands_kill_unverified",`${l.size} previous-boot process(es) survived`);for(let a of l)try{process.kill(a,"SIGKILL")}catch{}await new Promise((a)=>setTimeout(a,10))}}finally{try{K(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,t,i="/proc"){try{return k(d(i,String(e),"cgroup"),"utf8").split(`
+`).find((l)=>l.startsWith("0::"))?.slice(3)===t}catch{return!1}}function L(e,t,i="/proc"){try{let l=k(d(i,String(e),"cgroup"),"utf8").split(`
+`).find((a)=>a.startsWith("0::"))?.slice(3)??"";return l===t||l.startsWith(`${t}/`)}catch{return!1}}var Ee=100;function pe(){try{return Math.floor(Number(k("/proc/uptime","utf8").split(" ")[0])*Ee)}catch{return 0}}async function te(e,t,i){try{K(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`${i} cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}while(!/^populated 0$/m.test(k(d(e,"cgroup.events"),"utf8"))){if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${i} cgroup still populated (left frozen)`);for(let n of be(e)){if(!ve(n,e))continue;try{process.kill(n,"SIGKILL")}catch{}}await new Promise((n)=>setTimeout(n,10))}try{K(d(e,"cgroup.freeze"),"0")}catch(n){throw new w("vm_hands_kill_unverified",`${i} cgroup thaw: ${n instanceof Error?n.message:String(n)}`)}}function ve(e,t){let i=t.replace(/^\/sys\/fs\/cgroup/,"")||"/",n="";try{n=k(`/proc/${e}/cgroup`,"utf8").split(`
+`).find((a)=>a.startsWith("0::"))??""}catch{return!1}let l=n.slice(3);return l===i||l.startsWith(`${i}/`)}function be(e){let t=[],i=(n)=>{try{for(let a of k(d(n,"cgroup.procs"),"utf8").split(`
+`))if(/^\d+$/.test(a))t.push(Number(a))}catch{}let l=[];try{l=Y(n,{withFileTypes:!0}).filter((a)=>a.isDirectory()).map((a)=>a.name)}catch{}for(let a of l)i(d(n,a))};return i(e),t}function re(e,t="/proc"){return e.slice(0,16).map((i)=>{let n="?",l="?";try{n=k(d(t,String(i),"comm"),"utf8").trim().slice(0,32)}catch{}try{l=(k(d(t,String(i),"cgroup"),"utf8").split(`
+`).find((a)=>a.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:i,comm:n,ppid:we(i,t),cgroup:l}})}function fe(e,t="/proc"){let i=[];for(let n of Y(t)){if(!/^\d+$/.test(n))continue;let l;try{l=k(d(t,n,"stat"),"utf8")}catch{continue}let a=l.slice(l.lastIndexOf(")")+2).split(" "),c=Number(a[1]),p=Number(a[6]),b=Number(a[19]);if(!((p&2097152)!==0||c===2||n==="2")&&a[0]!=="Z"&&b>=e)i.push(Number(n))}return i}function me(e,t="/proc"){let i=[];for(let n of Y(t)){if(!/^\d+$/.test(n))continue;let l;try{l=k(d(t,n,"status"),"utf8")}catch{continue}let a=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(l);if(a&&a.slice(1).some((c)=>Number(c)===e))i.push(Number(n))}return i}function ge(e="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(k(e,"utf8").trim())>=1}catch{return!1}}var T=0,Se=[],J=new Set;function Ve(){T++;let e=!1;return()=>{if(e)return;if(e=!0,--T===0)for(let t of Se.splice(0))t()}}function Je(){return T===0?Promise.resolve():new Promise((e)=>{Se.push(e)})}async function _e(){while(T>0)await Je()}async function Ye(){let e=Date.now()+1000;while(J.size&&Date.now()<e)await new Promise((t)=>setTimeout(t,2))}function Ze(e,t){let i=t.replace(/^\/sys\/fs\/cgroup/,"");J.add(e);let n=()=>{let l="";try{l=k(`/proc/${e}/cgroup`,"utf8").split(`
+`).find((a)=>a.startsWith("0::"))??""}catch{J.delete(e);return}if(l.slice(3)===i){J.delete(e);return}setTimeout(n,1)};n()}function un(e){let t={person:e.personCgroup??d("/sys/fs/cgroup",G,D),model:e.payloadCgroup??d(he,D),surface:e.surfaceCgroup??d("/sys/fs/cgroup",G,D,ze)},i=e.entry??process.argv[1]??"",n={},l=(c)=>c.startsWith("model:")&&e.bindCgroup?e.bindCgroup(c.slice(6)):t[c.startsWith("model")?"model":c==="surface"?"surface":"person"],a=(c)=>{let p=c.startsWith("model")?"model":c==="surface"?"surface":"person",b=new Map,P=String(e.payloadUid),C=String(e.payloadGid);if(p==="surface")try{V(l(c),{mode:493})}catch{}let m=p==="surface"?'exec "$@"':`exec /usr/bin/setpriv --no-new-privs --reuid=${P} --regid=${C} --clear-groups -- "$@"`,v=Bun.spawn(["/bin/sh","-c",`echo $$ > ${ye(d(l(c),"cgroup.procs"))} || exit 125; ${m}`,"vm-hands-op-join",process.execPath,"--no-install",i,"--vm-hands-op-runner",...p==="person"?[or]:[],...p==="surface"?[sr,`${xt}${P}`,`${kt}${e.surfaceDirectory??""}`]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:p==="surface"?process.env.HOME||"/root":"/home/runner",...j("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(N){let x=N;if(p==="surface"&&x.t==="readiness"){let F=N;e.log?.("vm_hands.surface_ready",{lanes:Object.keys(F.lanes??{}).filter((W)=>F.lanes[W]===!0),display_video:F.display_video===!0}),e.onSurfaceReadiness?.(F);return}let H=b.get(x.id);if(!H)return;if(x.t==="event"&&x.event)H.onEvent(x.event);if(x.t==="done")b.delete(x.id),H.done(x.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});v.exited.then((N)=>{if(n[c]?.child===v)delete n[c];for(let[,x]of b)x.done({status:"failed",error_code:"vm_hands_op_runner_exited"});if(b.clear(),e.log?.("vm_hands.op_runner_exited",{kind:p,code:N}),p==="surface")e.onSurfaceReadiness?.(null)}),Ze(v.pid,l(c));let O={child:v,pending:b};return n[c]=O,O};return{run(c,p,b,P,C){if(!ge())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=c==="model"&&C&&e.bindCgroup?`model:${C.toLowerCase()}`:c,v=async()=>{while(!n[m]&&T>0)await _e()};return v().then(async()=>{if(!n[m]&&T>0)await v()}).then(()=>new Promise((O)=>{if(!n[m]&&T>0){O({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let N=n[m]??a(m);N.pending.set(p.id,{onEvent:b,done:O}),P.addEventListener("abort",()=>{try{N.child.send({t:"cancel",id:p.id})}catch{}},{once:!0});try{N.child.send({t:"op",...p})}catch{N.pending.delete(p.id),O({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(c){if(!n[c]&&ge())_e().then(()=>{if(!n[c]&&T===0)a(c)})},notify(c,p){let b=n[c];if(!b)return!1;try{return b.child.send(p),!0}catch{return!1}},stop(){for(let c of Object.keys(n))n[c]?.child.kill()}}}export{he as VM_HANDS_PAYLOAD_CGROUP,D as VM_HANDS_PAYLOAD_JOIN,G as VM_HANDS_PERSON_CGROUP,Ue as VM_HANDS_PROBE_NONCE_TOKEN,de as VM_HANDS_PROOF_DIR_TOKEN,ze as VM_HANDS_SURFACE_JOIN,w as VmHandsExecutorError,ln as createVmHandsExecutor,un as createVmHandsOpRunners,re as describeProcesses,L as inCgroup,me as payloadUidProcesses,fe as processesStartedSince,ge as ptraceProtected,be as subtreePids,Fe as vmHandsBindCgroup,je as vmHandsSessionRoot};

package/bin/vm-hands/vm-hands-op-runner-tebkt2kz.js

@@ -0,0 +1,2 @@
+// @bun
+import{or,sr,xt,kt,Ct,os}from"./vm-hands-entry-lite-ng993z5m.js";export{or as VM_HANDS_OP_RUNNER_PERSON_ARG,sr as VM_HANDS_OP_RUNNER_SURFACE_ARG,kt as VM_HANDS_SURFACE_DIRECTORY_ARG,Ct as VM_HANDS_SURFACE_OPS,xt as VM_HANDS_SURFACE_UID_ARG,os as runVmHandsOpRunner};

package/bin/vm-hands/{vm-hands-runtime-h0trw0xr.js → vm-hands-runtime-fpvqkg1k.js}

@@ -1,4 +1,4 @@
 // @bun
-import{tt}from"./vm-hands-entry-lite-4vks5phw.js";import{Pt}from"./vm-hands-entry-lite-bknthqy2.js";import{Li,an,Mi}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
-`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function B(r,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((y)=>N(y,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[y,m]of[[a,!1],["/usr/local/bin",!0]]){let _=N(y);if((m?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),g=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:g}),u()})})}var Y=3000;function Re(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(r){j(r,{recursive:!0,mode:448});let n=te(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ce(r){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-8z9rdrb0.js"),import("./hands-worker-source-kddz4y15.js"),import("./network-contract-trkxqc0w.js"),import("./device-workspace-s50q53sz.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-xn3ddz70.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:tt,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:X.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function _e(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=r.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let g=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of g)l[c]=s.operation_constraints[c];return{...r,capabilities:{...a,supported_operations:["hands.connect",...I,...g],operation_constraints:l}}}function pe(r){for(let n of G("/etc/passwd","utf8").split(`
-`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(r,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(r,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((o)=>setTimeout(()=>o(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:g},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-6sjrxy69.js"),import("./worker-sandbox-2r5nseff.js")]);c();try{g({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,y=new Promise((e)=>{f=e}),m=y.then(()=>import("./vm-hands-executor-z222kmvg.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:V,runtimeDirectory:O,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(r,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),o}),_=(e)=>async(...o)=>(await m)[e](...o),x=null;m.then((e)=>{x=(o)=>e.executorExited(o)});let S={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:()=>{throw Error("replaced below")},verifyMounts:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};m.then((e)=>{S.restatLayout=()=>e.restatLayout(),S.verifyMounts=()=>e.verifyMounts(),S.installEnvironment=(o,d)=>e.installEnvironment(o,d),S.freezeBind=(o)=>e.freezeBind(o),S.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await Li(r),C=new an(r,q,S,{envRoot:W}),M=ce(r),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-vfteeg61.js")]).then(([e,o])=>{K=()=>_e(e,o.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=y.then(()=>import("./vm-hands-executor-z222kmvg.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:r.layout.payload_uid,payloadGid:pe(r.layout.payload_uid),bindCgroup:(i)=>o(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+le;while(C.settingUp&&Date.now()<o)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await Mi({apiOrigin:r.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:o,bindId:d,signal:i,emit:E})=>{let k=fe(r,o);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=o.capability==="pty.start"&&e==="person"&&!o.authority;if(de.has(String(o.capability))&&!Z){let{executeLocalOperation:p}=await import("./local-capabilities-vfteeg61.js");return p(k,o,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Pt.has(String(o.capability))){if(w.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(o.attempt_id),claim:o,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(o.attempt_id),claim:o,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:o})=>Pt.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,o)},onTurn:(e,o)=>{if(o)u.set(e,o);else u.delete(e)}}),await(await m).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};
+import{et}from"./vm-hands-entry-lite-tqc2ezda.js";import{Ct}from"./vm-hands-entry-lite-ng993z5m.js";import{Di,on,Ni}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
+`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function B(r,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((y)=>N(y,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[y,m]of[[a,!1],["/usr/local/bin",!0]]){let _=N(y);if((m?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),g=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:g}),u()})})}var Y=3000;function Re(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(r){j(r,{recursive:!0,mode:448});let n=te(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ce(r){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-0pnbb3ga.js"),import("./hands-worker-source-wjsjw77t.js"),import("./network-contract-8fkzm0t0.js"),import("./device-workspace-6av4wa2e.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-45dm5s53.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:et,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:X.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function _e(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=r.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let g=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of g)l[c]=s.operation_constraints[c];return{...r,capabilities:{...a,supported_operations:["hands.connect",...I,...g],operation_constraints:l}}}function pe(r){for(let n of G("/etc/passwd","utf8").split(`
+`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(r,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(r,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((o)=>setTimeout(()=>o(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:g},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-nb7g2ek5.js"),import("./worker-sandbox-epre0fnv.js")]);c();try{g({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,y=new Promise((e)=>{f=e}),m=y.then(()=>import("./vm-hands-executor-epps6bxx.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:V,runtimeDirectory:O,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(r,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),o}),_=(e)=>async(...o)=>(await m)[e](...o),x=null;m.then((e)=>{x=(o)=>e.executorExited(o)});let S={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};m.then((e)=>{S.restatLayout=(o)=>e.restatLayout(o),S.verifyMounts=(o)=>e.verifyMounts(o),S.installEnvironment=(o,d)=>e.installEnvironment(o,d),S.freezeBind=(o)=>e.freezeBind(o),S.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await Di(r),C=new on(r,q,S,{envRoot:W}),M=ce(r),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-19ak31z6.js")]).then(([e,o])=>{K=()=>_e(e,o.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=y.then(()=>import("./vm-hands-executor-epps6bxx.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:r.layout.payload_uid,payloadGid:pe(r.layout.payload_uid),bindCgroup:(i)=>o(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+le;while(C.settingUp&&Date.now()<o)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await Ni({apiOrigin:r.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:o,bindId:d,signal:i,emit:E})=>{let k=fe(r,o);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=o.capability==="pty.start"&&e==="person"&&!o.authority;if(de.has(String(o.capability))&&!Z){let{executeLocalOperation:p}=await import("./local-capabilities-19ak31z6.js");return p(k,o,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Ct.has(String(o.capability))){if(w.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(o.attempt_id),claim:o,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(o.attempt_id),claim:o,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:o})=>Ct.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,o)},onTurn:(e,o)=>{if(o)u.set(e,o);else u.delete(e)}}),await(await m).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};

package/bin/vm-hands/worker-preview-readiness-kmwcrttt.js

@@ -0,0 +1,2 @@
+// @bun
+import{ls}from"./vm-hands-entry-lite-4fwf7wgb.js";import"./vm-hands-entry-lite-dh8f2h2d.js";import"./vm-hands-entry-lite-8j7p91hr.js";import"./vm-hands-entry-lite-em7mk9tn.js";export{ls as probeWorkerPreview};

package/bin/vm-hands/worker-sandbox-epre0fnv.js

@@ -0,0 +1,2 @@
+// @bun
+import{us}from"./vm-hands-entry-lite-cm497v4t.js";import"./vm-hands-entry-lite-njs8k65s.js";import"./vm-hands-entry-lite-a3w8m8nb.js";import"./vm-hands-entry-lite-8j7p91hr.js";import"./vm-hands-entry-lite-em7mk9tn.js";export{us as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-x64",
-  "version": "0.2.422",
+  "version": "0.2.426",
   "description": "Reason CLI native binary for linux-x64",
   "os": [
     "linux"

package/bin/vm-hands/api-18d75dfn.js

@@ -1,2 +0,0 @@
-// @bun
-import{I,fs,qo}from"./vm-hands-entry-lite-8r31b0ps.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{I as ApiError,qo as ReasonApi,fs as createMachineEnrollmentTicketWithToken};

package/bin/vm-hands/api-credentials-3vhge1ap.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ni,Ho,zo,hs}from"./vm-hands-entry-lite-50zbqwkv.js";import"./vm-hands-entry-lite-8r31b0ps.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{Ni as apiOriginFromEnvironment,Ho as environmentApiKey,hs as requireApiCredentials,zo as resolveApiCredentials};

package/bin/vm-hands/connect-cli-qtbe4v66.js

@@ -1,2 +0,0 @@
-// @bun
-import{rt,cs,ls,us}from"./vm-hands-entry-lite-6gv0d400.js";import"./vm-hands-entry-lite-ec9jemny.js";import"./vm-hands-entry-lite-z76nfb19.js";import"./vm-hands-entry-lite-50zbqwkv.js";import"./vm-hands-entry-lite-8r31b0ps.js";import"./vm-hands-entry-lite-94bm9vgk.js";import"./vm-hands-entry-lite-7m9dr2mg.js";import"./vm-hands-entry-lite-xvmeb9e8.js";import"./vm-hands-entry-lite-aapdds5x.js";import"./vm-hands-entry-lite-beyyy1gz.js";import"./vm-hands-entry-lite-s4bharcb.js";import"./vm-hands-entry-lite-vpz54vwj.js";import"./vm-hands-entry-lite-s5qkb1fk.js";import"./vm-hands-entry-lite-wx4ax7wg.js";import"./vm-hands-entry-lite-bx5zy5bd.js";import"./vm-hands-entry-lite-jjwcsywg.js";import"./vm-hands-entry-lite-dht2p1vj.js";import"./vm-hands-entry-lite-kz0b5h2f.js";import"./vm-hands-entry-lite-nzmkyezg.js";import"./vm-hands-entry-lite-pf5qtbj5.js";import"./vm-hands-entry-lite-21qpxvt8.js";import"./vm-hands-entry-lite-tdgtpx8e.js";import"./vm-hands-entry-lite-hk6trmwa.js";import"./vm-hands-entry-lite-1qpwpdcc.js";import"./vm-hands-entry-lite-g4zd2d5n.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-dzv12jpj.js";import"./vm-hands-entry-lite-jzz73e3f.js";import"./vm-hands-entry-lite-2e15739v.js";import"./vm-hands-entry-lite-1pabvq5q.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-4vks5phw.js";import"./vm-hands-entry-lite-fbhqfzbq.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{cs as computerDisconnected,rt as connectionDirectory,ls as connectionReport,us as restartConnection};

package/bin/vm-hands/custom-endpoint-device-17t4efc4.js

@@ -1,2 +0,0 @@
-// @bun
-import{ct,Lt,Cr,Sn,Ar,En,xn,kn}from"./vm-hands-entry-lite-bx5zy5bd.js";export{ct as CUSTOM_ENDPOINT_DEVICE_CHUNK_BYTES,Cr as CUSTOM_ENDPOINT_DEVICE_MAX_CHUNKS,Lt as CUSTOM_ENDPOINT_DEVICE_MAX_RESPONSE_BYTES,Sn as CUSTOM_ENDPOINT_DEVICE_TIMEOUT_MS,xn as CustomEndpointDeviceCredentialSchema,En as CustomEndpointDeviceRequestSchema,Ar as customEndpointRequestMatchesConfig,kn as isCustomEndpointDeviceFailureCode};

package/bin/vm-hands/desktop-account-6sjrxy69.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ms,K,Un}from"./vm-hands-entry-lite-hk6trmwa.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";export{Ms as configureDesktopAccount,K as desktopAccount,Un as desktopHome};

package/bin/vm-hands/device-workspace-s50q53sz.js

@@ -1,2 +0,0 @@
-// @bun
-import{ue,Ce,Z,Ae,de,rr,Qe,X,O,H,Yr,Qr,en,nr,tn}from"./vm-hands-entry-lite-3krzmhkk.js";export{en as CLOUD_REPOSITORY_WORKSPACE_ID,Yr as CLOUD_SESSION_CONTROL_BASE,nr as CLOUD_SESSION_ROOT,Ce as HANDS_WORKSPACE_BASE_KEY,Ae as HANDS_WORKSPACE_LAYOUT_KEY,ue as REASON_WORKSPACE_BASE,Z as SESSION_WORKSPACE_LAYOUT,de as SESSION_WORKTREES,rr as SESSION_WORKTREE_ID,Qr as SIDECHAT_WORKSPACE_ID,tn as cloudSessionLayoutOfRoot,O as deviceWorkspaceRootRelative,X as isDeviceWorkspacePath,Qe as isSessionWorktreePath,H as parseDeviceWorkspace};

package/bin/vm-hands/hands-worker-source-kddz4y15.js

@@ -1,2 +0,0 @@
-// @bun
-import{D,R,Zo,b}from"./vm-hands-entry-lite-beyyy1gz.js";import"./vm-hands-entry-lite-21qpxvt8.js";import"./vm-hands-entry-lite-tdgtpx8e.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{b as REASON_HANDS_WORKER_ARTIFACT_SHA256,R as REASON_HANDS_WORKER_ENTRYPOINT,Zo as REASON_HANDS_WORKER_SOURCE,D as REASON_HANDS_WORKER_VERSION};

package/bin/vm-hands/install-receipt-ysa70fvh.js

@@ -1,2 +0,0 @@
-// @bun
-import{Wr,qn,Vr,Wn}from"./vm-hands-entry-lite-g4zd2d5n.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";export{Wr as installationReceiptPath,Vr as installerReasonAlias,qn as installerReceiptLauncher,Wn as loadInstallationReceipt};

package/bin/vm-hands/local-automation-0gmnztwx.js

@@ -1,2 +0,0 @@
-// @bun
-import{Cn,Os,Is,Ds,Ns,An}from"./vm-hands-entry-lite-jjwcsywg.js";import"./vm-hands-entry-lite-dht2p1vj.js";import"./vm-hands-entry-lite-kz0b5h2f.js";import"./vm-hands-entry-lite-nzmkyezg.js";import"./vm-hands-entry-lite-pf5qtbj5.js";import"./vm-hands-entry-lite-21qpxvt8.js";import"./vm-hands-entry-lite-tdgtpx8e.js";import"./vm-hands-entry-lite-hk6trmwa.js";import"./vm-hands-entry-lite-1qpwpdcc.js";import"./vm-hands-entry-lite-g4zd2d5n.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-dzv12jpj.js";import"./vm-hands-entry-lite-jzz73e3f.js";import"./vm-hands-entry-lite-2e15739v.js";import"./vm-hands-entry-lite-1pabvq5q.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-4vks5phw.js";import"./vm-hands-entry-lite-fbhqfzbq.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{Is as ensureLocalBrowser,Cn as localAutomationAvailable,Ds as localBrowserProfile,Os as localUserChromeHost,Ns as runAutomationCallLocally,An as runLocalAutomation};

package/bin/vm-hands/local-capabilities-vfteeg61.js

@@ -1,2 +0,0 @@
-// @bun
-import{Wo,$i,un,Vo,Go,Es,xs,Ko,Jo,ks,Cs,As,Ps}from"./vm-hands-entry-lite-7m9dr2mg.js";import"./vm-hands-entry-lite-xvmeb9e8.js";import"./vm-hands-entry-lite-aapdds5x.js";import"./vm-hands-entry-lite-beyyy1gz.js";import"./vm-hands-entry-lite-s4bharcb.js";import"./vm-hands-entry-lite-vpz54vwj.js";import"./vm-hands-entry-lite-s5qkb1fk.js";import"./vm-hands-entry-lite-wx4ax7wg.js";import"./vm-hands-entry-lite-bx5zy5bd.js";import"./vm-hands-entry-lite-jjwcsywg.js";import"./vm-hands-entry-lite-dht2p1vj.js";import"./vm-hands-entry-lite-kz0b5h2f.js";import"./vm-hands-entry-lite-nzmkyezg.js";import"./vm-hands-entry-lite-pf5qtbj5.js";import"./vm-hands-entry-lite-21qpxvt8.js";import"./vm-hands-entry-lite-tdgtpx8e.js";import"./vm-hands-entry-lite-hk6trmwa.js";import"./vm-hands-entry-lite-1qpwpdcc.js";import"./vm-hands-entry-lite-g4zd2d5n.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-dzv12jpj.js";import"./vm-hands-entry-lite-jzz73e3f.js";import"./vm-hands-entry-lite-2e15739v.js";import"./vm-hands-entry-lite-1pabvq5q.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-4vks5phw.js";import"./vm-hands-entry-lite-fbhqfzbq.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";export{r as LocalCapabilityError,Wo as SHORT_REQUEST_CAPABILITIES,ks as capabilityInventoryForRoots,$i as confinedExecutionShell,Vo as defaultLocalCommandRunner,Cs as deliverLocalHandsEnvironment,Jo as enrolledRootPaths,Ps as executeLocalOperation,xs as grantLocalHandsWorkspaceControl,Es as openHandsWorkspaceGrant,As as rebindLocalHandsControl,Go as runFileCapability,Ko as runTransferCapability,un as spawnCaptured};

package/bin/vm-hands/local-desktop-users-cppjjr81.js

@@ -1,2 +0,0 @@
-// @bun
-import{kt,da,pa,Ii,Di}from"./vm-hands-entry-lite-fbhqfzbq.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{da as forgetLocalDesktopUse,Di as holdLocalDesktop,kt as noteLocalDesktopUse,pa as releaseLocalDesktop,Ii as trackDesktopRun};

package/bin/vm-hands/local-display-mac-0qz3b627.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ye,mt,Jn,Zn}from"./vm-hands-entry-lite-jzz73e3f.js";export{Ye as macScreenStatus,Zn as openMacInput,Jn as openMacWindowBounds,mt as requestMacScreenAccess};

package/bin/vm-hands/local-display-session-bnc6whgt.js

@@ -1,2 +0,0 @@
-// @bun
-import{$t,Ls,G,qe,Bt}from"./vm-hands-entry-lite-dht2p1vj.js";import"./vm-hands-entry-lite-kz0b5h2f.js";import"./vm-hands-entry-lite-nzmkyezg.js";import"./vm-hands-entry-lite-pf5qtbj5.js";import"./vm-hands-entry-lite-21qpxvt8.js";import"./vm-hands-entry-lite-tdgtpx8e.js";import"./vm-hands-entry-lite-hk6trmwa.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-dzv12jpj.js";import"./vm-hands-entry-lite-jzz73e3f.js";import"./vm-hands-entry-lite-2e15739v.js";import"./vm-hands-entry-lite-1pabvq5q.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-fbhqfzbq.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{qe as ensureLinuxDesktop,$t as localDisplayAvailable,Ls as localDisplayReady,G as privateDirectory,Bt as runLocalDisplayStream};

package/bin/vm-hands/local-display-video-mtd0gnyg.js

@@ -1,2 +0,0 @@
-// @bun
-import{Tn,Rn,On,In,Pr}from"./vm-hands-entry-lite-kz0b5h2f.js";import"./vm-hands-entry-lite-hk6trmwa.js";import"./vm-hands-entry-lite-dzv12jpj.js";import"./vm-hands-entry-lite-jzz73e3f.js";import"./vm-hands-entry-lite-2e15739v.js";import"./vm-hands-entry-lite-1pabvq5q.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";export{Tn as MAC_SCREEN,Rn as WINDOWS_SCREEN,On as createDisplayVideoLane,Pr as localDisplayVideoAvailable,In as simulatorVideoFfmpeg};

package/bin/vm-hands/local-managed-process-khhmd6pe.js

@@ -1,2 +0,0 @@
-// @bun
-import{nt,ur,Ts,Rs}from"./vm-hands-entry-lite-xvmeb9e8.js";import"./vm-hands-entry-lite-aapdds5x.js";import"./vm-hands-entry-lite-beyyy1gz.js";import"./vm-hands-entry-lite-s4bharcb.js";import"./vm-hands-entry-lite-s5qkb1fk.js";import"./vm-hands-entry-lite-wx4ax7wg.js";import"./vm-hands-entry-lite-pf5qtbj5.js";import"./vm-hands-entry-lite-21qpxvt8.js";import"./vm-hands-entry-lite-tdgtpx8e.js";import"./vm-hands-entry-lite-hk6trmwa.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-4vks5phw.js";import"./vm-hands-entry-lite-fbhqfzbq.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{nt as ManagedProcessStoppedError,Ts as controlManagedDeviceProcess,Rs as retireManagedDeviceProcess,ur as runManagedDeviceProcess};

package/bin/vm-hands/local-pty-session-rpk05ap5.js

@@ -1,2 +0,0 @@
-// @bun
-import{Rr,jt,Or,Xo,Dn,Ir,Nn}from"./vm-hands-entry-lite-nzmkyezg.js";import"./vm-hands-entry-lite-pf5qtbj5.js";import"./vm-hands-entry-lite-21qpxvt8.js";import"./vm-hands-entry-lite-tdgtpx8e.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";export{jt as LOCAL_PTY_MAX_BUFFERED_OUTPUT_BYTES,Or as LOCAL_PTY_MAX_SESSIONS,Rr as LOCAL_PTY_MAX_SESSION_MS,Ir as defaultConnect,Xo as defaultLoginShell,Dn as ptyRuntimeSupported,Nn as runLocalPtySession};

package/bin/vm-hands/managed-runtime-hv0hwf1j.js

@@ -1,2 +0,0 @@
-// @bun
-import{ms,gs,_s,ys,bs,vs,Ss}from"./vm-hands-entry-lite-94bm9vgk.js";import"./vm-hands-entry-lite-wx4ax7wg.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-2e15739v.js";import"./vm-hands-entry-lite-1pabvq5q.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{bs as acquireManagedRuntimeDirectoryLock,_s as currentManagedRuntimeVersion,Ss as flushManagedRuntimeLifecycleEvents,ys as isManagedRuntimeVersionExecutable,gs as legacyManagedRuntimePaths,ms as managedRuntimePaths,vs as recordManagedRuntimeLifecycle};

package/bin/vm-hands/network-contract-trkxqc0w.js

@@ -1,2 +0,0 @@
-// @bun
-import{tt,Te,Ws,Vs,Gs,ei,Ks,rn,ti,bt,Re,vt,ri,ni,ii,oi,si,ai,ci,li,ui,di,pi,hi,fi,mi,gi,_i,pe,Y,Oe,q,yi,wi,bi,Q,vi,Si,Ei,xi,ki,St,Ci,Js,or,Ai,Zs,ts,Xs,Ys,Qs,ea,ta,ra,na,ia,oa,sa,aa,ca,la,ua}from"./vm-hands-entry-lite-4vks5phw.js";export{Ci as AUTOMATION_CLOUD_SESSIONS,St as AUTOMATION_USER_CHROME,pi as HANDS_CLOUD_ACCESS,hi as HANDS_CLOUD_ACCESS_KEY,pe as HANDS_CONFINEMENT,Y as HANDS_CONFINEMENT_KEY,ni as HANDS_ENVIRONMENT_AT_CLAIM,ii as HANDS_ENVIRONMENT_AT_CLAIM_KEY,ti as HANDS_ENVIRONMENT_DELIVERY,bt as HANDS_ENVIRONMENT_DELIVER_CONTROL,fi as HANDS_HEADLESS_BROWSER,mi as HANDS_HEADLESS_BROWSER_KEY,yi as HANDS_JOBS_USER,wi as HANDS_JOBS_USER_KEY,gi as HANDS_LARGE_ENVIRONMENT,_i as HANDS_LARGE_ENVIRONMENT_KEY,Oe as HANDS_MODEL_JOBS_EGRESS,q as HANDS_MODEL_JOBS_EGRESS_KEY,ai as HANDS_REBIND,di as HANDS_REBIND_CONTROL,ui as HANDS_REBIND_KEY,vi as HANDS_SESSION_CAP_KEY,Si as HANDS_SESSION_CAP_NONE,bi as HANDS_SESSION_GROUP,Q as HANDS_SESSION_GROUP_KEY,oi as HANDS_WORKSPACE_CHECK,si as HANDS_WORKSPACE_CHECK_KEY,ci as HANDS_WORKSPACE_GRANT,li as HANDS_WORKSPACE_GRANT_KEY,xi as JOBS_START_WAIT,ki as JOBS_START_WAIT_KEY,Te as LOCAL_OPERATION_MAX_BYTES,tt as LOCAL_RUNTIME_PROTOCOL_VERSION,Gs as LOCAL_RUNTIME_ROUTES,rn as LOCAL_RUNTIME_SESSION_CLAIM_WAIT_MAX_MS,ei as LOCAL_RUNTIME_SESSION_PATH,or as LOCAL_RUNTIME_WORKER_STARTUP_MAX_MS,Ws as RELAY_HOST_ALIAS_HEADER,Vs as RELAY_HOST_ALIAS_VERSION,ri as VM_HANDS_UNBIND_UNVERIFIED_EVENT,Re as VM_HANDS_WORKSPACE_DEFERRED_KEY,vt as VM_HANDS_WORKSPACE_GRANT_CONTROL,Ei as WORKER_PREVIEW_CARRIED_JOBS,Js as WORKER_STARTUP_TIMING_STAGES,Ai as buildLocalRuntimeDeviceProofBytes,Ks as localRuntimeSessionRoutable,na as parseLocalRuntimeDisconnectResponse,Ys as parseLocalRuntimeEnrollmentResponse,Zs as parseLocalRuntimeErrorEnvelope,ea as parseLocalRuntimeFirstHeartbeat,Qs as parseLocalRuntimeHeartbeatResponse,ra as parseLocalRuntimeIdentityResponse,oa as parseLocalRuntimeLifecycleResponse,ia as parseLocalRuntimeLocalSubscriptionResponse,sa as parseLocalRuntimeOperationClaim,ua as parseLocalRuntimeOperationCompletionResponse,la as parseLocalRuntimeOperationEnvironmentResponse,ca as parseLocalRuntimeOperationEventsResponse,aa as parseLocalRuntimeOperationHeartbeatResponse,ts as parseLocalRuntimeProofChallenge,Xs as parseLocalRuntimeRegistrationResponse,ta as parseLocalRuntimeRootsSyncResponse};

package/bin/vm-hands/package-xqbhdf15.js

@@ -1,2 +0,0 @@
-// @bun
-import{cn}from"./vm-hands-entry-lite-60pg3wxj.js";export default cn();

package/bin/vm-hands/permissions-rr3e1yd5.js

@@ -1,2 +0,0 @@
-// @bun
-import{Qo,es,zs,qs}from"./vm-hands-entry-lite-dzv12jpj.js";import"./vm-hands-entry-lite-jzz73e3f.js";import"./vm-hands-entry-lite-2e15739v.js";import"./vm-hands-entry-lite-1pabvq5q.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";export{qs as allowMacPermissions,zs as permissionsSummary,es as readMacPermissions,Qo as reasonIdentity};

package/bin/vm-hands/reason-hands-protocol-xn3ddz70.js

@@ -1,2 +0,0 @@
-// @bun
-import{P,Mr,$r,Ln,ut,Mn,Br,Ke,ve,$n,Je,Wt,ne,Ze,Bn,Se,Vt,Fr,Gt,jr,Fn,ae,U,N,ce,Ur,Hr,jn}from"./vm-hands-entry-lite-tdgtpx8e.js";import"./vm-hands-entry-lite-3krzmhkk.js";export{jr as REASON_HANDS_CLOSE_CODES,Je as REASON_HANDS_JOB_CONTROL_MAX_FRAME_BYTES,Br as REASON_HANDS_JOB_MAX_INPUT_CHARS,Ke as REASON_HANDS_JOB_MAX_OUTPUT_CHARS,ve as REASON_HANDS_JOB_MAX_OUTPUT_CHUNKS,$n as REASON_HANDS_JOB_MAX_RECORDS,Mn as REASON_HANDS_MAX_ERROR_CHARS,Mr as REASON_HANDS_MAX_FRAME_BYTES,$r as REASON_HANDS_MAX_INPUT_CHARS,ut as REASON_HANDS_MAX_OUTPUT_CHARS,Ln as REASON_HANDS_MAX_STRUCTURED_INPUT_CHARS,P as REASON_HANDS_PROTOCOL_VERSION,Fr as REASON_HANDS_PTY_ANCHOR_EXIT_MS,Gt as REASON_HANDS_PTY_CLEANUP_RECEIPT_MS,Vt as REASON_HANDS_PTY_CLEANUP_SWEEP_MS,Se as REASON_HANDS_PTY_MAX_DIMENSION,ne as REASON_HANDS_PTY_MAX_INPUT_BYTES,Ze as REASON_HANDS_PTY_MAX_OUTPUT_BYTES,Bn as REASON_HANDS_PTY_MAX_PENDING_INPUT_BYTES,Wt as REASON_HANDS_PTY_PROTOCOL_VERSION,Fn as REASON_HANDS_WORKSPACE_BEFORE_MAX_OUTPUT_CHARS,U as isReasonHandsGeneration,ce as isReasonHandsPtyJobId,ae as isReasonHandsRequestId,N as isReasonHandsUuid,Ur as parseReasonHandsJobRequest,Hr as parseReasonHandsJobResult,jn as parseReasonHandsPtyReceipt};

package/bin/vm-hands/serve-service-pb0ch11d.js

@@ -1,2 +0,0 @@
-// @bun
-import{zr,Ee,J,Hn,$s,ho,Bs,Xe,Yo,zn,Fs,js,qr,Us,Hs}from"./vm-hands-entry-lite-1qpwpdcc.js";import"./vm-hands-entry-lite-g4zd2d5n.js";import"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-2e15739v.js";import"./vm-hands-entry-lite-1pabvq5q.js";import"./vm-hands-entry-lite-jev771b3.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-6c67a3jc.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{zr as WORKER_SERVICE_ENV,J as WorkerServiceError,ho as connectServiceLabel,Ee as defaultWorkerServiceHost,js as installWorkerService,Xe as installedWorkerService,Bs as isConnectServiceLabel,Hs as removeWorkerService,qr as restartWorkerService,Us as retargetWorkerServiceLogs,Yo as retireLegacyWorkerService,Fs as workerServiceDefinitionCurrent,Hn as workerServiceLauncher,zn as workerServiceProcessRunning,$s as workerServiceRetargetPending};

package/bin/vm-hands/status-4pmpra54.js

@@ -1,10 +0,0 @@
-// @bun
-import"./vm-hands-entry-lite-8r31b0ps.js";import"./vm-hands-entry-lite-fcvf8md1.js";import{g}from"./vm-hands-entry-lite-aj139v8j.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-rfz60hb3.js";import"./vm-hands-entry-lite-50zbqwkv.js";import{Ht,lt}from"./vm-hands-entry-lite-pf5qtbj5.js";import{w,M,lr,Fe,rt}from"./vm-hands-entry-lite-6gv0d400.js";import"./vm-hands-entry-lite-4vks5phw.js";import"./vm-hands-entry-lite-7m9dr2mg.js";import"./vm-hands-entry-lite-aapdds5x.js";import"./vm-hands-entry-lite-1pabvq5q.js";import"./vm-hands-entry-lite-s5qkb1fk.js";import"./vm-hands-entry-lite-vpz54vwj.js";import"./vm-hands-entry-lite-z76nfb19.js";import"./vm-hands-entry-lite-kz0b5h2f.js";import"./vm-hands-entry-lite-jzz73e3f.js";import"./vm-hands-entry-lite-2e15739v.js";import"./vm-hands-entry-lite-dzv12jpj.js";import"./vm-hands-entry-lite-hk6trmwa.js";import"./vm-hands-entry-lite-94bm9vgk.js";import"./vm-hands-entry-lite-g4zd2d5n.js";import"./vm-hands-entry-lite-1qpwpdcc.js";import"./vm-hands-entry-lite-bx5zy5bd.js";import"./vm-hands-entry-lite-tdgtpx8e.js";import"./vm-hands-entry-lite-beyyy1gz.js";import"./vm-hands-entry-lite-21qpxvt8.js";import"./vm-hands-entry-lite-xvmeb9e8.js";import"./vm-hands-entry-lite-fbhqfzbq.js";import"./vm-hands-entry-lite-nzmkyezg.js";import"./vm-hands-entry-lite-dht2p1vj.js";import"./vm-hands-entry-lite-jjwcsywg.js";import"./vm-hands-entry-lite-ec9jemny.js";import"./vm-hands-entry-lite-s4bharcb.js";import"./vm-hands-entry-lite-wx4ax7wg.js";import{a}from"./vm-hands-entry-lite-jev771b3.js";import{t,o,u,i,s,n}from"./vm-hands-entry-lite-avc65bd7.js";import"./vm-hands-entry-lite-6c67a3jc.js";import{readFileSync as me,realpathSync as k,renameSync as ge,unlinkSync as fe,writeFileSync as he}from"fs";import{dirname as ye,join as I}from"path";function h(e){return`claude mcp add --transport http reason ${e}`}function C(e){return`codex mcp add reason --url ${e}
-codex mcp login reason`}var F=h("https://mcp.reasonmachines.com/mcp"),z=C("https://mcp.reasonmachines.com/mcp"),B=`https://claude.ai/settings/connectors?add=custom&url=${encodeURIComponent("https://mcp.reasonmachines.com/mcp")}`,H=`https://cursor.com/install-mcp?name=reason&config=${encodeURIComponent(btoa(JSON.stringify({url:"https://mcp.reasonmachines.com/mcp"})))}`;var b="https://github.com/reason-machines/reason-plugins",X=`Connect a coding agent to Reason over MCP
-
-Usage:
-  reason mcp             Show how to connect Claude Code, Codex, or another MCP client
-  reason mcp uninstall   Remove only this machine's registrations of the earlier, retired server
-
-Plugins for Claude Code and Codex: ${b}
-`;var P=s(["granted","not_granted","unknown"]),y=i({status:P,checkedAt:o().finite(),executablePath:t().min(1)});var Oe=i({version:n(1),key:t(),at:o(),self:i({principal_type:t(),user_id:t().optional(),user_name:t().nullish(),email:t().nullish(),org_id:t(),organization_name:t().nullish(),organization_slug:t().nullish(),mcp_connections:u(i({client_id:t(),client_name:t(),last_used_at:t().nullable()})).optional()})});var x=30000;function L(e,c=Date.now(),R=null){let r=lt(e),d=(()=>{if(r?.state!=="connected"&&r?.state!=="starting")return!1;try{return process.kill(r.pid,0),!0}catch{return!1}})(),S=d&&r?.state==="connected",p=(f)=>S&&c-f>=0&&c-f<x,l=y.safeParse(r?.fullDiskAccess),m=Ht(r,R,c);return{...m?{permission_recovery:m}:{},full_disk_access:l.success&&p(l.data.checkedAt)?l.data.status:"unknown",keep_awake:{enabled:lr(e)==="battery_and_ac",holding:r?.idleSleepHold===!0&&p(Date.parse(r.lastHeartbeatAt??""))},executable:d&&l.success?l.data.executablePath:null}}function De(e=g()){if(process.platform!=="darwin")return null;let c=Fe(I(rt(k(a()),e),"worker.json"));return c?L(w(c).daemon,Date.now(),M(c)):null}export{De as connectionMacState};

package/bin/vm-hands/version-8z9rdrb0.js

@@ -1,2 +0,0 @@
-// @bun
-import{_t}from"./vm-hands-entry-lite-1pabvq5q.js";export{_t as CLI_VERSION};

package/bin/vm-hands/vm-hands-entry-lite-1pabvq5q.js

@@ -1,2 +0,0 @@
-// @bun
-import{er}from"./vm-hands-entry-lite-3tx0tkeq.js";var _t=er.version;export{_t};