@reason-machines/cli-linux-x64 0.2.424 → 0.2.426

package/bin/vm-hands/vm-hands-executor-epps6bxx.js

@@ -0,0 +1,11 @@
+// @bun
+import"./vm-hands-entry-lite-tqc2ezda.js";import"./vm-hands-entry-lite-r7zs4ce2.js";import"./vm-hands-entry-lite-3vmhs921.js";import"./vm-hands-entry-lite-em7mk9tn.js";import{nt,Ki,yr,Tt}from"./vm-hands-entry-lite-p1680dtx.js";import"./vm-hands-entry-lite-d9g1pzzx.js";import"./vm-hands-entry-lite-499mywh7.js";import"./vm-hands-entry-lite-g9z467dk.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-a3w8m8nb.js";import"./vm-hands-entry-lite-hw26gewc.js";import"./vm-hands-entry-lite-1f2cam25.js";import"./vm-hands-entry-lite-12rzrd95.js";import{or,sr,xt,kt}from"./vm-hands-entry-lite-ng993z5m.js";import"./vm-hands-entry-lite-dh8f2h2d.js";import"./vm-hands-entry-lite-t5q30ne0.js";import"./vm-hands-entry-lite-9sa1knn7.js";import"./vm-hands-entry-lite-8j7p91hr.js";import{spawn as Ne}from"child_process";import{chmodSync as Ie,chownSync as Ae,existsSync as j,lstatSync as q,mkdirSync as V,mkdtempSync as De,readdirSync as Y,readFileSync as k,realpathSync as Me,rmdirSync as ue,rmSync as Le,writeFileSync as K}from"fs";import{basename as Te,dirname as He,join as d}from"path";import{readFileSync as oe,readlinkSync as ie}from"fs";import{relative as Oe}from"path";var ae=16;function ce(e){return e.replace(/\\([0-7]{3})/g,(t,i)=>String.fromCharCode(Number.parseInt(i,8)))}function xe(e){let t=[];for(let i of e.split(`
+`)){let n=i.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;t.push({device:n[2],root:ce(n[3]),mountPoint:ce(n[4])})}return t}function $e(e,t,i){let n=e.replace(/\/+$/,"")||"/",l=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),a=(m)=>new Map(xe(m).filter((v)=>l(v.mountPoint)).map((v)=>[`${v.mountPoint}\x00${v.device}\x00${v.root}`,v.mountPoint])),c=a(t),p=a(i),b=(m)=>Oe(n,m)||".",P=[...c].filter(([m])=>!p.has(m)).map(([,m])=>b(m)),C=[...p].filter(([m])=>!c.has(m)).map(([,m])=>b(m));return{missing:P,extra:C,referenceCount:c.size,ownCount:p.size}}function le(e,t,i,n="/proc"){let l,a,c=null;try{l=oe(`${n}/1/mountinfo`,"utf8"),a=oe(`${n}/self/mountinfo`,"utf8")}catch(v){let O=v&&typeof v==="object"&&"code"in v&&typeof v.code==="string"?v.code:"unreadable";t("vm_hands.mount_check_unavailable",{code:O});return}try{c=ie(`${n}/1/ns/mnt`)===ie(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:b,referenceCount:P,ownCount:C}=$e(e,l,a),m={reference_count:P,own_count:C,missing_count:p.length,extra_count:b.length,same_namespace:c};if(b.length)t("vm_hands.mount_extra",{...m,extra:b.slice(0,ae)});if(p.length)throw t("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ae)}),i(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var he="/sys/fs/cgroup/reason-payload",D="vm-hands",We="/run/ara-srt/fallbacks.jsonl",G="/reason-person",ze="surface",ee=5000,Be=1e4,de="__VM_HANDS_PROOF_DIR__",Ue="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,t){super(t);this.code=e}}function Fe(e,t){if(!/^[0-9a-f-]{36}$/i.test(t))throw new w("vm_hands_bind_invalid","bad bind id");return d(e,D,`b-${t.toLowerCase()}`)}var Ke=5000,ye=(e)=>`'${e.replaceAll("'","'\\''")}'`;function je(e,t){if(!t||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(t))return e;let i=d(He(e),t.toLowerCase());return Te(e).toLowerCase()===t.toLowerCase()?e:i}function ln(e){let t=e.cgroup??he,i=e.init.layout.payload_uid,n=e.log??(()=>{}),l=(r)=>je(e.init.layout.session_root,r),a=new Map,c=new Map,p=0,b=()=>{try{let r=k("/run/ara-srt/starts.jsonl","utf8"),o=r.slice(p>r.length?0:p).split(`
+`).filter(Boolean);p=r.length;let u=o.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(u.length)n("vm_hands.srt_server_starts",{count:u.length,elapsed_ms:u.slice(0,8)})}catch{}},P=null,C=!1,m=e.srtCgroup??"/sys/fs/cgroup/reason-srt",v=()=>{P??=pe()},O=0,N=()=>{try{let r=k(We,"utf8"),o=r.slice(O>r.length?0:O);O=r.length;let u=o.split(`
+`).filter(Boolean).slice(0,1000);if(!u.length)return null;let f={},g=0;for(let S of u)try{let _=JSON.parse(S),h=typeof _.code==="string"&&/^[a-z_]{1,40}$/.test(_.code)?_.code:"other";if(f[h]=(f[h]??0)+1,typeof _.elapsed_ms==="number")g=Math.max(g,_.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return n("vm_hands.srt_fallbacks",{count:u.length,codes:f,max_elapsed_ms:g}),{count:u.length,codes:f,max_elapsed_ms:g}}catch{return null}},x=(r,o,u)=>F(r,o,u),H=(r)=>(o,u,f)=>Ne("/bin/sh",["-c",`echo $$ > ${ye(d(r,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",o,...u],f),F=H(d(t,D)),W=d(t,D,"probe"),z=(r)=>Fe(t,r),ke=(r)=>{let o=z(r);try{V(o,{mode:493})}catch(u){if(!(u&&typeof u==="object"&&("code"in u)&&u.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return o},Pe=(r)=>{try{ue(z(r))}catch{}},B=e.prespawn?Ki({spawnProcess:x,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(r,o)=>n(r,o??{})}):null;B?.arm();let Z=B?setInterval(()=>{B.arm()},Ke):null;Z?.unref?.();async function X(r){let o=a.get(r);if(a.delete(r),!o)return;o.abort.abort(),await o.done}return{bindCgroup:z,async startExecutor(r){if(v(),c.set(r.bindId,pe()),C=!0,!r.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await X(r.bindId);let{claim:o,bindId:u}=r,f=ke(u),g=o.owner;if(!g||typeof g.device_id!=="string"||typeof o.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,_,h,I=new Promise((s,y)=>{_=s,h=y}),A,R=new Promise((s)=>{A=s}),U=Tt({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,deviceIdentity:{deviceId:g.device_id,rootId:o.root_id,apiOrigin:e.apiOrigin},claimOwner:o.owner,root:e.root,runId:o.run_id,operationId:o.operation_id,attemptId:o.attempt_id,payload:Object.fromEntries(Object.entries(o.payload).filter(([s])=>!s.startsWith("vm_hands_"))),signal:S.signal,...r.workspaceGrant?{workspaceGrant:r.workspaceGrant}:{},emitEvent:async(s,y)=>{if(s==="hands.ready"){_(y);return}if(s==="hands.started"||s==="hands.stopped"||s==="hands.failed")return;await e.forward(u,s,y)}},{...e.relayDependencies,spawnWorker:(s)=>H(f)(s.command,s.args,s.options),...B?{takePrespawnedWorker:(s)=>{let y=B.take(s);if(!y?.pid)return y;try{return K(d(f,"cgroup.procs"),String(y.pid)),y}catch{try{y.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:B.adopt}:{}}).then(()=>{A("executor_stopped")},(s)=>{let y=s&&typeof s==="object"&&"code"in s?String(s.code):"executor_failed";h(new w(y,s instanceof Error?s.message:String(s))),A(y)}).finally(()=>h(new w("vm_hands_executor_exited","executor ended before it was ready")));a.set(u,{abort:S,done:U,exited:R,operationId:o.operation_id,runId:o.run_id,expiresAtMs:Date.parse(String(o.payload.expires_at??""))||0});let M=await I,E=M.executor_launch_id;if(typeof E!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:M,applied:{hands_confinement:typeof o.payload.hands_confinement==="string"?o.payload.hands_confinement:null,browser_egress:o.payload.browser_egress??null}}},takeSrtFallbacks:N,executorExited(r){return a.get(r)?.exited??new Promise(()=>{})},freezeBind(r){let o=z(r);if(j(d(o,"cgroup.freeze")))K(d(o,"cgroup.freeze"),"1")},async killAndVerifyPayload(r){let o=new Set(r?.keep??[]);if(await Ce(r?.bindId??null,o,r?.own===!0),o.size)return;if((C||e.srtWarmLate?.()===!0)&&j(d(m,"cgroup.events")))b(),await te(m,Date.now()+ee,"srt"),e.onSrtReset?.();C=!1},async killProbe(){let r=Date.now()+ee;if(j(d(W,"cgroup.events"))){await te(W,r,"probe");try{ue(W)}catch{}}let o=se(process.pid);if(o===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Ge(t,o,r);let u=(g)=>{let S=se(g);return S!==null&&S<=o},f=me(i).filter((g)=>u(g)&&!L(g,G));if(f.length)throw n("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest"}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(P!==null){let g=[t,d(t,D)].map((h)=>h.replace(/^\/sys\/fs\/cgroup/,"")),S=m.replace(/^\/sys\/fs\/cgroup/,""),_=fe(P).filter((h)=>h!==process.pid&&!L(h,G)&&!L(h,"/reason-vm-hands")&&!L(h,S)&&!g.some((I)=>ne(h,I)));if(_.length&&C)throw n("vm_hands.kill_strays",{strays:re(_),at:"attest"}),new w("vm_hands_kill_unverified",`${_.length} process(es) the run started survived it`);if(_.length)n("vm_hands.attest_concurrent",{processes:re(_),count:_.length});P=null}},async runProbe({nonce:r,script:o}){if(v(),!o.includes(de))throw new w("vm_hands_probe_failed","probe names no proof directory");let u=e.proofParent??"/tmp/reason-vm-hands-proof";V(u,{mode:457,recursive:!0});let f=q(u);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=De(d(u,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(r))throw new w("vm_hands_probe_failed","proof directory path or nonce");Ae(g,i,i),Ie(g,448);let _=q(g).ino;try{V(W,{mode:493})}catch(R){if(!(R&&typeof R==="object"&&("code"in R)&&R.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let h=H(W)("/bin/bash",["-c",o.replaceAll(de,g).replaceAll(Ue,r)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),I="";h.stdout?.on("data",(R)=>{if(I.length<16384)I+=R.toString("utf8").slice(0,16384-I.length)});let A=await new Promise((R)=>{let U=setTimeout(()=>{S=!0,h.kill("SIGKILL"),R(124)},Be);h.once("error",()=>{clearTimeout(U),R(127)}),h.once("close",(M)=>{clearTimeout(U),R(M??1)})});return n("vm_hands.probe",{nonce_len:r.length,exit_code:A}),{exitCode:A,markers:I,proofDirInode:_}}finally{if(!S)Le(g,{recursive:!0,force:!0})}},restatLayout(r){let o=l(r),u=o===e.init.layout.session_root?e.init.layout.alias:d(o,"repo"),f="invalid";try{yr(o),f="0:0:755"}catch{}let g=!1,S=-1;try{let _=q(u);S=_.uid,g=f==="0:0:755"&&u===d(o,"repo")&&!_.isSymbolicLink()&&_.isDirectory()&&Me(u)===u&&_.uid===i}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(r){le(l(r),n,(o)=>new w("vm_hands_mount_mismatch",o))},installEnvironment(r,o){let u=a.get(r);if(!u)throw new w("environment_unavailable","no executor owns an environment");return nt({root:e.root,operationId:u.operationId,payload:o}).installed_revision},async stop(){if(Z)clearInterval(Z);B?.close(),await Promise.all([...a.keys()].map((r)=>X(r)))}};function Re(){try{return Y(d(t,D),{withFileTypes:!0}).filter((r)=>r.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(r.name)).map((r)=>r.name)}catch{return[]}}async function Ce(r,o,u=!1){let f=new Set([...o].map((S)=>S.toLowerCase())),g=Ve();try{await Ye();let S=Date.now()+ee,_=new Set(Re().filter((s)=>!f.has(s.slice(2))).map((s)=>s.slice(2)));if(r)_.add(r.toLowerCase());let h=null;for(let s of _){let y=X(s).catch(()=>{return}),Q=c.get(s);if(Q!==void 0)h=h===null?Q:Math.min(h,Q);if(j(d(z(s),"cgroup.events")))await te(z(s),S,"bind");await y}let I=[...f].map((s)=>z(s).replace(/^\/sys\/fs\/cgroup/,"")),A=["/",...[t,d(t,D)].map((s)=>s.replace(/^\/sys\/fs\/cgroup/,""))],R=m.replace(/^\/sys\/fs\/cgroup/,""),U=(s)=>L(s,G)||I.some((y)=>L(s,y))||A.some((y)=>ne(s,y)),M=u?[]:me(i).filter((s)=>!U(s));if(M.length)throw n("vm_hands.kill_survivors",{pids:M.slice(0,16),beside:f.size}),new w("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside a live bind`);let E=(s)=>!U(s)&&!L(s,"/reason-vm-hands")&&!L(s,R)&&!A.some((y)=>ne(s,y));if(h!==null){let s=fe(h).filter((y)=>y!==process.pid&&E(y));if(s.length)throw n("vm_hands.kill_strays",{strays:re(s),beside:f.size}),new w("vm_hands_kill_unverified",`${s.length} process(es) the run started survived it`)}for(let s of _)c.delete(s),Pe(s)}finally{g()}}}function se(e,t="/proc"){try{let i=k(d(t,String(e),"stat"),"utf8"),n=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function we(e,t="/proc"){try{let i=k(d(t,String(e),"stat"),"utf8"),n=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ge(e,t,i){try{K(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=be(e).filter((a)=>ve(a,e)),l=new Set(n.filter((a)=>{let c=se(a);return c!==null&&c<=t}));for(let a=!0;a;){a=!1;for(let c of n){if(l.has(c))continue;let p=we(c);if(p!==null&&l.has(p))l.add(c),a=!0}}if(l.size===0)return;if(Date.now()>i)throw new w("vm_hands_kill_unverified",`${l.size} previous-boot process(es) survived`);for(let a of l)try{process.kill(a,"SIGKILL")}catch{}await new Promise((a)=>setTimeout(a,10))}}finally{try{K(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,t,i="/proc"){try{return k(d(i,String(e),"cgroup"),"utf8").split(`
+`).find((l)=>l.startsWith("0::"))?.slice(3)===t}catch{return!1}}function L(e,t,i="/proc"){try{let l=k(d(i,String(e),"cgroup"),"utf8").split(`
+`).find((a)=>a.startsWith("0::"))?.slice(3)??"";return l===t||l.startsWith(`${t}/`)}catch{return!1}}var Ee=100;function pe(){try{return Math.floor(Number(k("/proc/uptime","utf8").split(" ")[0])*Ee)}catch{return 0}}async function te(e,t,i){try{K(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`${i} cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}while(!/^populated 0$/m.test(k(d(e,"cgroup.events"),"utf8"))){if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${i} cgroup still populated (left frozen)`);for(let n of be(e)){if(!ve(n,e))continue;try{process.kill(n,"SIGKILL")}catch{}}await new Promise((n)=>setTimeout(n,10))}try{K(d(e,"cgroup.freeze"),"0")}catch(n){throw new w("vm_hands_kill_unverified",`${i} cgroup thaw: ${n instanceof Error?n.message:String(n)}`)}}function ve(e,t){let i=t.replace(/^\/sys\/fs\/cgroup/,"")||"/",n="";try{n=k(`/proc/${e}/cgroup`,"utf8").split(`
+`).find((a)=>a.startsWith("0::"))??""}catch{return!1}let l=n.slice(3);return l===i||l.startsWith(`${i}/`)}function be(e){let t=[],i=(n)=>{try{for(let a of k(d(n,"cgroup.procs"),"utf8").split(`
+`))if(/^\d+$/.test(a))t.push(Number(a))}catch{}let l=[];try{l=Y(n,{withFileTypes:!0}).filter((a)=>a.isDirectory()).map((a)=>a.name)}catch{}for(let a of l)i(d(n,a))};return i(e),t}function re(e,t="/proc"){return e.slice(0,16).map((i)=>{let n="?",l="?";try{n=k(d(t,String(i),"comm"),"utf8").trim().slice(0,32)}catch{}try{l=(k(d(t,String(i),"cgroup"),"utf8").split(`
+`).find((a)=>a.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:i,comm:n,ppid:we(i,t),cgroup:l}})}function fe(e,t="/proc"){let i=[];for(let n of Y(t)){if(!/^\d+$/.test(n))continue;let l;try{l=k(d(t,n,"stat"),"utf8")}catch{continue}let a=l.slice(l.lastIndexOf(")")+2).split(" "),c=Number(a[1]),p=Number(a[6]),b=Number(a[19]);if(!((p&2097152)!==0||c===2||n==="2")&&a[0]!=="Z"&&b>=e)i.push(Number(n))}return i}function me(e,t="/proc"){let i=[];for(let n of Y(t)){if(!/^\d+$/.test(n))continue;let l;try{l=k(d(t,n,"status"),"utf8")}catch{continue}let a=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(l);if(a&&a.slice(1).some((c)=>Number(c)===e))i.push(Number(n))}return i}function ge(e="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(k(e,"utf8").trim())>=1}catch{return!1}}var T=0,Se=[],J=new Set;function Ve(){T++;let e=!1;return()=>{if(e)return;if(e=!0,--T===0)for(let t of Se.splice(0))t()}}function Je(){return T===0?Promise.resolve():new Promise((e)=>{Se.push(e)})}async function _e(){while(T>0)await Je()}async function Ye(){let e=Date.now()+1000;while(J.size&&Date.now()<e)await new Promise((t)=>setTimeout(t,2))}function Ze(e,t){let i=t.replace(/^\/sys\/fs\/cgroup/,"");J.add(e);let n=()=>{let l="";try{l=k(`/proc/${e}/cgroup`,"utf8").split(`
+`).find((a)=>a.startsWith("0::"))??""}catch{J.delete(e);return}if(l.slice(3)===i){J.delete(e);return}setTimeout(n,1)};n()}function un(e){let t={person:e.personCgroup??d("/sys/fs/cgroup",G,D),model:e.payloadCgroup??d(he,D),surface:e.surfaceCgroup??d("/sys/fs/cgroup",G,D,ze)},i=e.entry??process.argv[1]??"",n={},l=(c)=>c.startsWith("model:")&&e.bindCgroup?e.bindCgroup(c.slice(6)):t[c.startsWith("model")?"model":c==="surface"?"surface":"person"],a=(c)=>{let p=c.startsWith("model")?"model":c==="surface"?"surface":"person",b=new Map,P=String(e.payloadUid),C=String(e.payloadGid);if(p==="surface")try{V(l(c),{mode:493})}catch{}let m=p==="surface"?'exec "$@"':`exec /usr/bin/setpriv --no-new-privs --reuid=${P} --regid=${C} --clear-groups -- "$@"`,v=Bun.spawn(["/bin/sh","-c",`echo $$ > ${ye(d(l(c),"cgroup.procs"))} || exit 125; ${m}`,"vm-hands-op-join",process.execPath,"--no-install",i,"--vm-hands-op-runner",...p==="person"?[or]:[],...p==="surface"?[sr,`${xt}${P}`,`${kt}${e.surfaceDirectory??""}`]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:p==="surface"?process.env.HOME||"/root":"/home/runner",...j("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(N){let x=N;if(p==="surface"&&x.t==="readiness"){let F=N;e.log?.("vm_hands.surface_ready",{lanes:Object.keys(F.lanes??{}).filter((W)=>F.lanes[W]===!0),display_video:F.display_video===!0}),e.onSurfaceReadiness?.(F);return}let H=b.get(x.id);if(!H)return;if(x.t==="event"&&x.event)H.onEvent(x.event);if(x.t==="done")b.delete(x.id),H.done(x.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});v.exited.then((N)=>{if(n[c]?.child===v)delete n[c];for(let[,x]of b)x.done({status:"failed",error_code:"vm_hands_op_runner_exited"});if(b.clear(),e.log?.("vm_hands.op_runner_exited",{kind:p,code:N}),p==="surface")e.onSurfaceReadiness?.(null)}),Ze(v.pid,l(c));let O={child:v,pending:b};return n[c]=O,O};return{run(c,p,b,P,C){if(!ge())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=c==="model"&&C&&e.bindCgroup?`model:${C.toLowerCase()}`:c,v=async()=>{while(!n[m]&&T>0)await _e()};return v().then(async()=>{if(!n[m]&&T>0)await v()}).then(()=>new Promise((O)=>{if(!n[m]&&T>0){O({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let N=n[m]??a(m);N.pending.set(p.id,{onEvent:b,done:O}),P.addEventListener("abort",()=>{try{N.child.send({t:"cancel",id:p.id})}catch{}},{once:!0});try{N.child.send({t:"op",...p})}catch{N.pending.delete(p.id),O({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(c){if(!n[c]&&ge())_e().then(()=>{if(!n[c]&&T===0)a(c)})},notify(c,p){let b=n[c];if(!b)return!1;try{return b.child.send(p),!0}catch{return!1}},stop(){for(let c of Object.keys(n))n[c]?.child.kill()}}}export{he as VM_HANDS_PAYLOAD_CGROUP,D as VM_HANDS_PAYLOAD_JOIN,G as VM_HANDS_PERSON_CGROUP,Ue as VM_HANDS_PROBE_NONCE_TOKEN,de as VM_HANDS_PROOF_DIR_TOKEN,ze as VM_HANDS_SURFACE_JOIN,w as VmHandsExecutorError,ln as createVmHandsExecutor,un as createVmHandsOpRunners,re as describeProcesses,L as inCgroup,me as payloadUidProcesses,fe as processesStartedSince,ge as ptraceProtected,be as subtreePids,Fe as vmHandsBindCgroup,je as vmHandsSessionRoot};

package/bin/vm-hands/{vm-hands-op-runner-ya32haj0.js → vm-hands-op-runner-tebkt2kz.js}

@@ -1,2 +1,2 @@
 // @bun
-import{or,sr,xt,kt,Ct,os}from"./vm-hands-entry-lite-tj1g1vn3.js";export{or as VM_HANDS_OP_RUNNER_PERSON_ARG,sr as VM_HANDS_OP_RUNNER_SURFACE_ARG,kt as VM_HANDS_SURFACE_DIRECTORY_ARG,Ct as VM_HANDS_SURFACE_OPS,xt as VM_HANDS_SURFACE_UID_ARG,os as runVmHandsOpRunner};
+import{or,sr,xt,kt,Ct,os}from"./vm-hands-entry-lite-ng993z5m.js";export{or as VM_HANDS_OP_RUNNER_PERSON_ARG,sr as VM_HANDS_OP_RUNNER_SURFACE_ARG,kt as VM_HANDS_SURFACE_DIRECTORY_ARG,Ct as VM_HANDS_SURFACE_OPS,xt as VM_HANDS_SURFACE_UID_ARG,os as runVmHandsOpRunner};

package/bin/vm-hands/{vm-hands-runtime-ec9x2kez.js → vm-hands-runtime-fpvqkg1k.js}

@@ -1,4 +1,4 @@
 // @bun
-import{et}from"./vm-hands-entry-lite-tqc2ezda.js";import{Ct}from"./vm-hands-entry-lite-tj1g1vn3.js";import{Di,on,Ni}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
-`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function B(r,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((y)=>N(y,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[y,m]of[[a,!1],["/usr/local/bin",!0]]){let _=N(y);if((m?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),g=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:g}),u()})})}var Y=3000;function Re(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(r){j(r,{recursive:!0,mode:448});let n=te(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ce(r){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-ghpq62s2.js"),import("./hands-worker-source-wjsjw77t.js"),import("./network-contract-8fkzm0t0.js"),import("./device-workspace-6av4wa2e.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-45dm5s53.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:et,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:X.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function _e(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=r.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let g=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of g)l[c]=s.operation_constraints[c];return{...r,capabilities:{...a,supported_operations:["hands.connect",...I,...g],operation_constraints:l}}}function pe(r){for(let n of G("/etc/passwd","utf8").split(`
-`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(r,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(r,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((o)=>setTimeout(()=>o(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:g},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-nb7g2ek5.js"),import("./worker-sandbox-epre0fnv.js")]);c();try{g({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,y=new Promise((e)=>{f=e}),m=y.then(()=>import("./vm-hands-executor-65vx1gt3.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:V,runtimeDirectory:O,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(r,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),o}),_=(e)=>async(...o)=>(await m)[e](...o),x=null;m.then((e)=>{x=(o)=>e.executorExited(o)});let S={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:()=>{throw Error("replaced below")},verifyMounts:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};m.then((e)=>{S.restatLayout=()=>e.restatLayout(),S.verifyMounts=()=>e.verifyMounts(),S.installEnvironment=(o,d)=>e.installEnvironment(o,d),S.freezeBind=(o)=>e.freezeBind(o),S.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await Di(r),C=new on(r,q,S,{envRoot:W}),M=ce(r),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-2y88qy9j.js")]).then(([e,o])=>{K=()=>_e(e,o.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=y.then(()=>import("./vm-hands-executor-65vx1gt3.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:r.layout.payload_uid,payloadGid:pe(r.layout.payload_uid),bindCgroup:(i)=>o(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+le;while(C.settingUp&&Date.now()<o)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await Ni({apiOrigin:r.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:o,bindId:d,signal:i,emit:E})=>{let k=fe(r,o);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=o.capability==="pty.start"&&e==="person"&&!o.authority;if(de.has(String(o.capability))&&!Z){let{executeLocalOperation:p}=await import("./local-capabilities-2y88qy9j.js");return p(k,o,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Ct.has(String(o.capability))){if(w.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(o.attempt_id),claim:o,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(o.attempt_id),claim:o,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:o})=>Ct.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,o)},onTurn:(e,o)=>{if(o)u.set(e,o);else u.delete(e)}}),await(await m).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};
+import{et}from"./vm-hands-entry-lite-tqc2ezda.js";import{Ct}from"./vm-hands-entry-lite-ng993z5m.js";import{Di,on,Ni}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
+`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function B(r,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((y)=>N(y,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[y,m]of[[a,!1],["/usr/local/bin",!0]]){let _=N(y);if((m?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),g=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:g}),u()})})}var Y=3000;function Re(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(r){j(r,{recursive:!0,mode:448});let n=te(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ce(r){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-0pnbb3ga.js"),import("./hands-worker-source-wjsjw77t.js"),import("./network-contract-8fkzm0t0.js"),import("./device-workspace-6av4wa2e.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-45dm5s53.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:et,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:X.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function _e(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=r.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let g=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of g)l[c]=s.operation_constraints[c];return{...r,capabilities:{...a,supported_operations:["hands.connect",...I,...g],operation_constraints:l}}}function pe(r){for(let n of G("/etc/passwd","utf8").split(`
+`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(r,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(r,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((o)=>setTimeout(()=>o(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:g},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-nb7g2ek5.js"),import("./worker-sandbox-epre0fnv.js")]);c();try{g({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,y=new Promise((e)=>{f=e}),m=y.then(()=>import("./vm-hands-executor-epps6bxx.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:V,runtimeDirectory:O,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(r,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),o}),_=(e)=>async(...o)=>(await m)[e](...o),x=null;m.then((e)=>{x=(o)=>e.executorExited(o)});let S={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};m.then((e)=>{S.restatLayout=(o)=>e.restatLayout(o),S.verifyMounts=(o)=>e.verifyMounts(o),S.installEnvironment=(o,d)=>e.installEnvironment(o,d),S.freezeBind=(o)=>e.freezeBind(o),S.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await Di(r),C=new on(r,q,S,{envRoot:W}),M=ce(r),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-19ak31z6.js")]).then(([e,o])=>{K=()=>_e(e,o.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=y.then(()=>import("./vm-hands-executor-epps6bxx.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:r.layout.payload_uid,payloadGid:pe(r.layout.payload_uid),bindCgroup:(i)=>o(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+le;while(C.settingUp&&Date.now()<o)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await Ni({apiOrigin:r.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:o,bindId:d,signal:i,emit:E})=>{let k=fe(r,o);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=o.capability==="pty.start"&&e==="person"&&!o.authority;if(de.has(String(o.capability))&&!Z){let{executeLocalOperation:p}=await import("./local-capabilities-19ak31z6.js");return p(k,o,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Ct.has(String(o.capability))){if(w.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(o.attempt_id),claim:o,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(o.attempt_id),claim:o,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:o})=>Ct.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,o)},onTurn:(e,o)=>{if(o)u.set(e,o);else u.delete(e)}}),await(await m).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-x64",
-  "version": "0.2.424",
+  "version": "0.2.426",
   "description": "Reason CLI native binary for linux-x64",
   "os": [
     "linux"

package/bin/vm-hands/local-display-video-bthyfqap.js

@@ -1,2 +0,0 @@
-// @bun
-import{An,Pn,Tn,Rn,Cr}from"./vm-hands-entry-lite-vgedszdd.js";import"./vm-hands-entry-lite-d9g1pzzx.js";import"./vm-hands-entry-lite-5e847nnc.js";import"./vm-hands-entry-lite-jcf61cb4.js";import"./vm-hands-entry-lite-99vdpqvp.js";import"./vm-hands-entry-lite-6y7wsj5e.js";import"./vm-hands-entry-lite-9sa1knn7.js";import"./vm-hands-entry-lite-r7zs4ce2.js";export{An as MAC_SCREEN,Pn as WINDOWS_SCREEN,Tn as createDisplayVideoLane,Cr as localDisplayVideoAvailable,Rn as simulatorVideoFfmpeg};

package/bin/vm-hands/version-ghpq62s2.js

@@ -1,2 +0,0 @@
-// @bun
-import{gt}from"./vm-hands-entry-lite-6y7wsj5e.js";export{gt as CLI_VERSION};

package/bin/vm-hands/vm-hands-entry-lite-6y7wsj5e.js

@@ -1,2 +0,0 @@
-// @bun
-import{Yt}from"./vm-hands-entry-lite-8v7t1q38.js";var gt=Yt.version;export{gt};

package/bin/vm-hands/vm-hands-executor-65vx1gt3.js

@@ -1,11 +0,0 @@
-// @bun
-import"./vm-hands-entry-lite-tqc2ezda.js";import"./vm-hands-entry-lite-r7zs4ce2.js";import"./vm-hands-entry-lite-3vmhs921.js";import"./vm-hands-entry-lite-em7mk9tn.js";import{nt,Ki,yr,Tt}from"./vm-hands-entry-lite-mpxyq14w.js";import"./vm-hands-entry-lite-d9g1pzzx.js";import"./vm-hands-entry-lite-499mywh7.js";import"./vm-hands-entry-lite-g9z467dk.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-a3w8m8nb.js";import"./vm-hands-entry-lite-hw26gewc.js";import"./vm-hands-entry-lite-1f2cam25.js";import"./vm-hands-entry-lite-12rzrd95.js";import{or,sr,xt,kt}from"./vm-hands-entry-lite-tj1g1vn3.js";import"./vm-hands-entry-lite-dh8f2h2d.js";import"./vm-hands-entry-lite-t5q30ne0.js";import"./vm-hands-entry-lite-9sa1knn7.js";import"./vm-hands-entry-lite-8j7p91hr.js";import{spawn as $e}from"child_process";import{chmodSync as Ie,chownSync as Ne,existsSync as K,lstatSync as Q,mkdirSync as E,mkdtempSync as Ae,readdirSync as J,readFileSync as k,realpathSync as De,rmdirSync as le,rmSync as Me,writeFileSync as U}from"fs";import{join as d}from"path";import{readFileSync as se,readlinkSync as oe}from"fs";import{relative as Ce}from"path";var ie=16;function ae(e){return e.replace(/\\([0-7]{3})/g,(r,i)=>String.fromCharCode(Number.parseInt(i,8)))}function Oe(e){let r=[];for(let i of e.split(`
-`)){let n=i.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:ae(n[3]),mountPoint:ae(n[4])})}return r}function xe(e,r,i){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),a=(m)=>new Map(Oe(m).filter((y)=>c(y.mountPoint)).map((y)=>[`${y.mountPoint}\x00${y.device}\x00${y.root}`,y.mountPoint])),l=a(r),p=a(i),h=(m)=>Ce(n,m)||".",P=[...l].filter(([m])=>!p.has(m)).map(([,m])=>h(m)),O=[...p].filter(([m])=>!l.has(m)).map(([,m])=>h(m));return{missing:P,extra:O,referenceCount:l.size,ownCount:p.size}}function ce(e,r,i,n="/proc"){let c,a,l=null;try{c=se(`${n}/1/mountinfo`,"utf8"),a=se(`${n}/self/mountinfo`,"utf8")}catch(y){let I=y&&typeof y==="object"&&"code"in y&&typeof y.code==="string"?y.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:I});return}try{l=oe(`${n}/1/ns/mnt`)===oe(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:h,referenceCount:P,ownCount:O}=xe(e,c,a),m={reference_count:P,own_count:O,missing_count:p.length,extra_count:h.length,same_namespace:l};if(h.length)r("vm_hands.mount_extra",{...m,extra:h.slice(0,ie)});if(p.length)throw r("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ie)}),i(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var _e="/sys/fs/cgroup/reason-payload",L="vm-hands",Le="/run/ara-srt/fallbacks.jsonl",j="/reason-person",Te="surface",q=5000,He=1e4,ue="__VM_HANDS_PROOF_DIR__",We="__VM_HANDS_PROBE_NONCE__";class v extends Error{code;constructor(e,r){super(r);this.code=e}}function ze(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new v("vm_hands_bind_invalid","bad bind id");return d(e,L,`b-${r.toLowerCase()}`)}var Be=5000,he=(e)=>`'${e.replaceAll("'","'\\''")}'`;function sn(e){let r=e.cgroup??_e,i=e.init.layout.payload_uid,n=e.log??(()=>{}),c=new Map,a=new Map,l=0,p=()=>{try{let t=k("/run/ara-srt/starts.jsonl","utf8"),o=t.slice(l>t.length?0:l).split(`
-`).filter(Boolean);l=t.length;let u=o.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(u.length)n("vm_hands.srt_server_starts",{count:u.length,elapsed_ms:u.slice(0,8)})}catch{}},h=null,P=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",m=()=>{h??=de()},y=0,I=()=>{try{let t=k(Le,"utf8"),o=t.slice(y>t.length?0:y);y=t.length;let u=o.split(`
-`).filter(Boolean).slice(0,1000);if(!u.length)return null;let f={},g=0;for(let b of u)try{let S=JSON.parse(b),_=typeof S.code==="string"&&/^[a-z_]{1,40}$/.test(S.code)?S.code:"other";if(f[_]=(f[_]??0)+1,typeof S.elapsed_ms==="number")g=Math.max(g,S.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return n("vm_hands.srt_fallbacks",{count:u.length,codes:f,max_elapsed_ms:g}),{count:u.length,codes:f,max_elapsed_ms:g}}catch{return null}},x=(t,o,u)=>F(t,o,u),R=(t)=>(o,u,f)=>$e("/bin/sh",["-c",`echo $$ > ${he(d(t,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",o,...u],f),F=R(d(r,L)),N=d(r,L,"probe"),D=(t)=>ze(r,t),Se=(t)=>{let o=D(t);try{E(o,{mode:493})}catch(u){if(!(u&&typeof u==="object"&&("code"in u)&&u.code==="EEXIST"))throw new v("vm_hands_bind_failed","bind cgroup")}return o},ke=(t)=>{try{le(D(t))}catch{}},z=e.prespawn?Ki({spawnProcess:x,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(t,o)=>n(t,o??{})}):null;z?.arm();let Y=z?setInterval(()=>{z.arm()},Be):null;Y?.unref?.();async function Z(t){let o=c.get(t);if(c.delete(t),!o)return;o.abort.abort(),await o.done}return{bindCgroup:D,async startExecutor(t){if(m(),a.set(t.bindId,de()),P=!0,!t.claim)throw new v("vm_hands_bind_invalid","an executor needs the claim it serves");await Z(t.bindId);let{claim:o,bindId:u}=t,f=Se(u),g=o.owner;if(!g||typeof g.device_id!=="string"||typeof o.root_id!=="string")throw new v("vm_hands_bind_invalid","claim without its owner Device or root");let b=new AbortController,S,_,A=new Promise((s,w)=>{S=s,_=w}),M,C=new Promise((s)=>{M=s}),B=Tt({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,deviceIdentity:{deviceId:g.device_id,rootId:o.root_id,apiOrigin:e.apiOrigin},claimOwner:o.owner,root:e.root,runId:o.run_id,operationId:o.operation_id,attemptId:o.attempt_id,payload:Object.fromEntries(Object.entries(o.payload).filter(([s])=>!s.startsWith("vm_hands_"))),signal:b.signal,...t.workspaceGrant?{workspaceGrant:t.workspaceGrant}:{},emitEvent:async(s,w)=>{if(s==="hands.ready"){S(w);return}if(s==="hands.started"||s==="hands.stopped"||s==="hands.failed")return;await e.forward(u,s,w)}},{...e.relayDependencies,spawnWorker:(s)=>R(f)(s.command,s.args,s.options),...z?{takePrespawnedWorker:(s)=>{let w=z.take(s);if(!w?.pid)return w;try{return U(d(f,"cgroup.procs"),String(w.pid)),w}catch{try{w.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:z.adopt}:{}}).then(()=>{M("executor_stopped")},(s)=>{let w=s&&typeof s==="object"&&"code"in s?String(s.code):"executor_failed";_(new v(w,s instanceof Error?s.message:String(s))),M(w)}).finally(()=>_(new v("vm_hands_executor_exited","executor ended before it was ready")));c.set(u,{abort:b,done:B,exited:C,operationId:o.operation_id,runId:o.run_id,expiresAtMs:Date.parse(String(o.payload.expires_at??""))||0});let T=await A,G=T.executor_launch_id;if(typeof G!=="string")throw new v("vm_hands_bind_failed","executor ready without a launch id");return{launchId:G,readyData:T,applied:{hands_confinement:typeof o.payload.hands_confinement==="string"?o.payload.hands_confinement:null,browser_egress:o.payload.browser_egress??null}}},takeSrtFallbacks:I,executorExited(t){return c.get(t)?.exited??new Promise(()=>{})},freezeBind(t){let o=D(t);if(K(d(o,"cgroup.freeze")))U(d(o,"cgroup.freeze"),"1")},async killAndVerifyPayload(t){let o=new Set(t?.keep??[]);if(await Re(t?.bindId??null,o,t?.own===!0),o.size)return;if((P||e.srtWarmLate?.()===!0)&&K(d(O,"cgroup.events")))p(),await ne(O,Date.now()+q,"srt"),e.onSrtReset?.();P=!1},async killProbe(){let t=Date.now()+q;if(K(d(N,"cgroup.events"))){await ne(N,t,"probe");try{le(N)}catch{}}let o=re(process.pid);if(o===null)throw new v("vm_hands_kill_unverified","agent start time unreadable");await Ue(r,o,t);let u=(g)=>{let b=re(g);return b!==null&&b<=o},f=fe(i).filter((g)=>u(g)&&!H(g,j));if(f.length)throw n("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest"}),new v("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(h!==null){let g=[r,d(r,L)].map((_)=>_.replace(/^\/sys\/fs\/cgroup/,"")),b=O.replace(/^\/sys\/fs\/cgroup/,""),S=pe(h).filter((_)=>_!==process.pid&&!H(_,j)&&!H(_,"/reason-vm-hands")&&!H(_,b)&&!g.some((A)=>ee(_,A)));if(S.length&&P)throw n("vm_hands.kill_strays",{strays:te(S),at:"attest"}),new v("vm_hands_kill_unverified",`${S.length} process(es) the run started survived it`);if(S.length)n("vm_hands.attest_concurrent",{processes:te(S),count:S.length});h=null}},async runProbe({nonce:t,script:o}){if(m(),!o.includes(ue))throw new v("vm_hands_probe_failed","probe names no proof directory");let u=e.proofParent??"/tmp/reason-vm-hands-proof";E(u,{mode:457,recursive:!0});let f=Q(u);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new v("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Ae(d(u,"p-")),b=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(t))throw new v("vm_hands_probe_failed","proof directory path or nonce");Ne(g,i,i),Ie(g,448);let S=Q(g).ino;try{E(N,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new v("vm_hands_probe_failed","probe cgroup")}let _=R(N)("/bin/bash",["-c",o.replaceAll(ue,g).replaceAll(We,t)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),A="";_.stdout?.on("data",(C)=>{if(A.length<16384)A+=C.toString("utf8").slice(0,16384-A.length)});let M=await new Promise((C)=>{let B=setTimeout(()=>{b=!0,_.kill("SIGKILL"),C(124)},He);_.once("error",()=>{clearTimeout(B),C(127)}),_.once("close",(T)=>{clearTimeout(B),C(T??1)})});return n("vm_hands.probe",{nonce_len:t.length,exit_code:M}),{exitCode:M,markers:A,proofDirInode:S}}finally{if(!b)Me(g,{recursive:!0,force:!0})}},restatLayout(){let{session_root:t,alias:o}=e.init.layout,u="invalid";try{yr(t),u="0:0:755"}catch{}let f=!1,g=-1;try{let b=Q(o);g=b.uid,f=u==="0:0:755"&&o===d(t,"repo")&&!b.isSymbolicLink()&&b.isDirectory()&&De(o)===o&&b.uid===i}catch{}return{root_mode:u,alias_ok:f,owner_uid:g}},verifyMounts(){ce(e.init.layout.session_root,n,(t)=>new v("vm_hands_mount_mismatch",t))},installEnvironment(t,o){let u=c.get(t);if(!u)throw new v("environment_unavailable","no executor owns an environment");return nt({root:e.root,operationId:u.operationId,payload:o}).installed_revision},async stop(){if(Y)clearInterval(Y);z?.close(),await Promise.all([...c.keys()].map((t)=>Z(t)))}};function Pe(){try{return J(d(r,L),{withFileTypes:!0}).filter((t)=>t.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(t.name)).map((t)=>t.name)}catch{return[]}}async function Re(t,o,u=!1){let f=new Set([...o].map((b)=>b.toLowerCase())),g=Ke();try{await Ge();let b=Date.now()+q,S=new Set(Pe().filter((s)=>!f.has(s.slice(2))).map((s)=>s.slice(2)));if(t)S.add(t.toLowerCase());let _=null;for(let s of S){let w=Z(s).catch(()=>{return}),X=a.get(s);if(X!==void 0)_=_===null?X:Math.min(_,X);if(K(d(D(s),"cgroup.events")))await ne(D(s),b,"bind");await w}let A=[...f].map((s)=>D(s).replace(/^\/sys\/fs\/cgroup/,"")),M=["/",...[r,d(r,L)].map((s)=>s.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),B=(s)=>H(s,j)||A.some((w)=>H(s,w))||M.some((w)=>ee(s,w)),T=u?[]:fe(i).filter((s)=>!B(s));if(T.length)throw n("vm_hands.kill_survivors",{pids:T.slice(0,16),beside:f.size}),new v("vm_hands_kill_unverified",`${T.length} payload-uid process(es) outside a live bind`);let G=(s)=>!B(s)&&!H(s,"/reason-vm-hands")&&!H(s,C)&&!M.some((w)=>ee(s,w));if(_!==null){let s=pe(_).filter((w)=>w!==process.pid&&G(w));if(s.length)throw n("vm_hands.kill_strays",{strays:te(s),beside:f.size}),new v("vm_hands_kill_unverified",`${s.length} process(es) the run started survived it`)}for(let s of S)a.delete(s),ke(s)}finally{g()}}}function re(e,r="/proc"){try{let i=k(d(r,String(e),"stat"),"utf8"),n=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function ye(e,r="/proc"){try{let i=k(d(r,String(e),"stat"),"utf8"),n=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ue(e,r,i){try{U(d(e,"cgroup.freeze"),"1")}catch(n){throw new v("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=ve(e).filter((a)=>we(a,e)),c=new Set(n.filter((a)=>{let l=re(a);return l!==null&&l<=r}));for(let a=!0;a;){a=!1;for(let l of n){if(c.has(l))continue;let p=ye(l);if(p!==null&&c.has(p))c.add(l),a=!0}}if(c.size===0)return;if(Date.now()>i)throw new v("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let a of c)try{process.kill(a,"SIGKILL")}catch{}await new Promise((a)=>setTimeout(a,10))}}finally{try{U(d(e,"cgroup.freeze"),"0")}catch{}}}function ee(e,r,i="/proc"){try{return k(d(i,String(e),"cgroup"),"utf8").split(`
-`).find((c)=>c.startsWith("0::"))?.slice(3)===r}catch{return!1}}function H(e,r,i="/proc"){try{let c=k(d(i,String(e),"cgroup"),"utf8").split(`
-`).find((a)=>a.startsWith("0::"))?.slice(3)??"";return c===r||c.startsWith(`${r}/`)}catch{return!1}}var Fe=100;function de(){try{return Math.floor(Number(k("/proc/uptime","utf8").split(" ")[0])*Fe)}catch{return 0}}async function ne(e,r,i){try{U(d(e,"cgroup.freeze"),"1")}catch(n){throw new v("vm_hands_kill_unverified",`${i} cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}while(!/^populated 0$/m.test(k(d(e,"cgroup.events"),"utf8"))){if(Date.now()>r)throw new v("vm_hands_kill_unverified",`${i} cgroup still populated (left frozen)`);for(let n of ve(e)){if(!we(n,e))continue;try{process.kill(n,"SIGKILL")}catch{}}await new Promise((n)=>setTimeout(n,10))}try{U(d(e,"cgroup.freeze"),"0")}catch(n){throw new v("vm_hands_kill_unverified",`${i} cgroup thaw: ${n instanceof Error?n.message:String(n)}`)}}function we(e,r){let i=r.replace(/^\/sys\/fs\/cgroup/,"")||"/",n="";try{n=k(`/proc/${e}/cgroup`,"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??""}catch{return!1}let c=n.slice(3);return c===i||c.startsWith(`${i}/`)}function ve(e){let r=[],i=(n)=>{try{for(let a of k(d(n,"cgroup.procs"),"utf8").split(`
-`))if(/^\d+$/.test(a))r.push(Number(a))}catch{}let c=[];try{c=J(n,{withFileTypes:!0}).filter((a)=>a.isDirectory()).map((a)=>a.name)}catch{}for(let a of c)i(d(n,a))};return i(e),r}function te(e,r="/proc"){return e.slice(0,16).map((i)=>{let n="?",c="?";try{n=k(d(r,String(i),"comm"),"utf8").trim().slice(0,32)}catch{}try{c=(k(d(r,String(i),"cgroup"),"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:i,comm:n,ppid:ye(i,r),cgroup:c}})}function pe(e,r="/proc"){let i=[];for(let n of J(r)){if(!/^\d+$/.test(n))continue;let c;try{c=k(d(r,n,"stat"),"utf8")}catch{continue}let a=c.slice(c.lastIndexOf(")")+2).split(" "),l=Number(a[1]),p=Number(a[6]),h=Number(a[19]);if(!((p&2097152)!==0||l===2||n==="2")&&a[0]!=="Z"&&h>=e)i.push(Number(n))}return i}function fe(e,r="/proc"){let i=[];for(let n of J(r)){if(!/^\d+$/.test(n))continue;let c;try{c=k(d(r,n,"status"),"utf8")}catch{continue}let a=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(c);if(a&&a.slice(1).some((l)=>Number(l)===e))i.push(Number(n))}return i}function me(e="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(k(e,"utf8").trim())>=1}catch{return!1}}var W=0,be=[],V=new Set;function Ke(){W++;let e=!1;return()=>{if(e)return;if(e=!0,--W===0)for(let r of be.splice(0))r()}}function je(){return W===0?Promise.resolve():new Promise((e)=>{be.push(e)})}async function ge(){while(W>0)await je()}async function Ge(){let e=Date.now()+1000;while(V.size&&Date.now()<e)await new Promise((r)=>setTimeout(r,2))}function Ee(e,r){let i=r.replace(/^\/sys\/fs\/cgroup/,"");V.add(e);let n=()=>{let c="";try{c=k(`/proc/${e}/cgroup`,"utf8").split(`
-`).find((a)=>a.startsWith("0::"))??""}catch{V.delete(e);return}if(c.slice(3)===i){V.delete(e);return}setTimeout(n,1)};n()}function on(e){let r={person:e.personCgroup??d("/sys/fs/cgroup",j,L),model:e.payloadCgroup??d(_e,L),surface:e.surfaceCgroup??d("/sys/fs/cgroup",j,L,Te)},i=e.entry??process.argv[1]??"",n={},c=(l)=>l.startsWith("model:")&&e.bindCgroup?e.bindCgroup(l.slice(6)):r[l.startsWith("model")?"model":l==="surface"?"surface":"person"],a=(l)=>{let p=l.startsWith("model")?"model":l==="surface"?"surface":"person",h=new Map,P=String(e.payloadUid),O=String(e.payloadGid);if(p==="surface")try{E(c(l),{mode:493})}catch{}let m=p==="surface"?'exec "$@"':`exec /usr/bin/setpriv --no-new-privs --reuid=${P} --regid=${O} --clear-groups -- "$@"`,y=Bun.spawn(["/bin/sh","-c",`echo $$ > ${he(d(c(l),"cgroup.procs"))} || exit 125; ${m}`,"vm-hands-op-join",process.execPath,"--no-install",i,"--vm-hands-op-runner",...p==="person"?[or]:[],...p==="surface"?[sr,`${xt}${P}`,`${kt}${e.surfaceDirectory??""}`]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:p==="surface"?process.env.HOME||"/root":"/home/runner",...K("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(x){let R=x;if(p==="surface"&&R.t==="readiness"){let N=x;e.log?.("vm_hands.surface_ready",{lanes:Object.keys(N.lanes??{}).filter((D)=>N.lanes[D]===!0),display_video:N.display_video===!0}),e.onSurfaceReadiness?.(N);return}let F=h.get(R.id);if(!F)return;if(R.t==="event"&&R.event)F.onEvent(R.event);if(R.t==="done")h.delete(R.id),F.done(R.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});y.exited.then((x)=>{if(n[l]?.child===y)delete n[l];for(let[,R]of h)R.done({status:"failed",error_code:"vm_hands_op_runner_exited"});if(h.clear(),e.log?.("vm_hands.op_runner_exited",{kind:p,code:x}),p==="surface")e.onSurfaceReadiness?.(null)}),Ee(y.pid,c(l));let I={child:y,pending:h};return n[l]=I,I};return{run(l,p,h,P,O){if(!me())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=l==="model"&&O&&e.bindCgroup?`model:${O.toLowerCase()}`:l,y=async()=>{while(!n[m]&&W>0)await ge()};return y().then(async()=>{if(!n[m]&&W>0)await y()}).then(()=>new Promise((I)=>{if(!n[m]&&W>0){I({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let x=n[m]??a(m);x.pending.set(p.id,{onEvent:h,done:I}),P.addEventListener("abort",()=>{try{x.child.send({t:"cancel",id:p.id})}catch{}},{once:!0});try{x.child.send({t:"op",...p})}catch{x.pending.delete(p.id),I({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(l){if(!n[l]&&me())ge().then(()=>{if(!n[l]&&W===0)a(l)})},notify(l,p){let h=n[l];if(!h)return!1;try{return h.child.send(p),!0}catch{return!1}},stop(){for(let l of Object.keys(n))n[l]?.child.kill()}}}export{_e as VM_HANDS_PAYLOAD_CGROUP,L as VM_HANDS_PAYLOAD_JOIN,j as VM_HANDS_PERSON_CGROUP,We as VM_HANDS_PROBE_NONCE_TOKEN,ue as VM_HANDS_PROOF_DIR_TOKEN,Te as VM_HANDS_SURFACE_JOIN,v as VmHandsExecutorError,sn as createVmHandsExecutor,on as createVmHandsOpRunners,te as describeProcesses,H as inCgroup,fe as payloadUidProcesses,pe as processesStartedSince,me as ptraceProtected,ve as subtreePids,ze as vmHandsBindCgroup};