@reason-machines/cli-linux-x64 0.2.428 → 0.2.430
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/reason +1 -1
- package/bin/vm-hands/{connect-cli-zwfayyq6.js → connect-cli-671qehvd.js} +1 -1
- package/bin/vm-hands/{local-automation-z0zd35xx.js → local-automation-bg0bwba0.js} +1 -1
- package/bin/vm-hands/{local-capabilities-2z2j4qtw.js → local-capabilities-dspyxqnq.js} +1 -1
- package/bin/vm-hands/{local-display-session-z1t6sx3e.js → local-display-session-d4zd1760.js} +1 -1
- package/bin/vm-hands/local-display-video-eenan2fs.js +2 -0
- package/bin/vm-hands/{local-managed-process-nf8phykm.js → local-managed-process-maj54q14.js} +1 -1
- package/bin/vm-hands/{managed-runtime-cxjtm2e2.js → managed-runtime-znhfh56y.js} +1 -1
- package/bin/vm-hands/{permissions-7pamjbm4.js → permissions-mcqsh1xm.js} +1 -1
- package/bin/vm-hands/{serve-service-r2rbrvyv.js → serve-service-adqrzdkr.js} +1 -1
- package/bin/vm-hands/{status-z3exn4we.js → status-5r3rs7s1.js} +1 -1
- package/bin/vm-hands/version-svs369ss.js +2 -0
- package/bin/vm-hands/{vm-hands-entry-lite-n9jcmnwy.js → vm-hands-entry-lite-0fwawqma.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-grb9t4m7.js → vm-hands-entry-lite-18zxefca.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-s8j6bb9e.js → vm-hands-entry-lite-4gadqypp.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-188vta3r.js → vm-hands-entry-lite-4nkd9xmp.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-8gjct3rr.js → vm-hands-entry-lite-557rnks7.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-kftc82y1.js → vm-hands-entry-lite-7j96jxh6.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-wkm92kwr.js → vm-hands-entry-lite-7xy7g88x.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-72wj76dq.js → vm-hands-entry-lite-9xhynk62.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-186rzmyd.js → vm-hands-entry-lite-cgnkxwvv.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-qqppdxax.js → vm-hands-entry-lite-ezadej92.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-fbsrk9ee.js → vm-hands-entry-lite-fwj2vk0q.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-33g2vjk9.js → vm-hands-entry-lite-gvmhjyhb.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-fazkabba.js → vm-hands-entry-lite-tvsjy4nb.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-wz90f9ha.js +2 -0
- package/bin/vm-hands/vm-hands-entry-lite.js +2 -2
- package/bin/vm-hands/{vm-hands-executor-5ap69pnt.js → vm-hands-executor-r5a5r5xx.js} +10 -10
- package/bin/vm-hands/{vm-hands-op-runner-3292r794.js → vm-hands-op-runner-b6rvv74d.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-fb4p1stm.js → vm-hands-runtime-k3e8mw0p.js} +3 -3
- package/package.json +1 -1
- package/bin/vm-hands/local-display-video-81c5bbw3.js +0 -2
- package/bin/vm-hands/version-w70t158x.js +0 -2
- package/bin/vm-hands/vm-hands-entry-lite-wh55tp3c.js +0 -2
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{gt}from"./vm-hands-entry-lite-
|
|
2
|
+
import{gt}from"./vm-hands-entry-lite-wz90f9ha.js";import{a}from"./vm-hands-entry-lite-9sa1knn7.js";import{randomUUID as L}from"crypto";import{spawnSync as b}from"child_process";import{chmodSync as ee,cpSync as te,existsSync as x,lstatSync as A,mkdirSync as Y,readdirSync as ne,readFileSync as w,readlinkSync as re,realpathSync as T,renameSync as E,rmdirSync as ie,rmSync as g,symlinkSync as M,writeFileSync as oe}from"fs";import{dirname as I,join as u,relative as se,resolve as ce}from"path";var Jn="so.ara.cli",k=[Jn,"com.reasonmachines.cli"],F="5LJFSBRY2F";function Kr(e){return`(${e.map((t)=>`identifier "${t}"`).join(" or ")}) and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${F}"`}var G="ReasonBackgroundIdentity",Co="Contents/Helpers/ReasonPermissionTile",ae="so.ara.cli.permission-tile",Ne=Kr([ae,"com.reasonmachines.cli.permission-tile"]),v="AraBackgroundIdentity",ue="Reason",Ce=Kr(k),de=`anchor apple generic and (${k.map((e)=>`identifier "${e}"`).join(" or ")}) and certificate leaf[subject.OU] = "${F}"`;class h extends Error{code;constructor(e,t){super(t);this.code=e;this.name="MacOSBackgroundIdentityError"}}var R="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function le(e=a()){return u(e,"Library","Application Support","Reason","Background","Reason.app")}function O(e=a()){return u(e,"Library","Application Support","Ara","Background","Ara.app")}function fe(e){try{return A(e).isFile()}catch{return!1}}function D(e){return[G,v].map((t)=>u(e,"Contents","MacOS",t)).find(fe)??null}function d(e){try{if(!A(e).isDirectory())return!1;let t=w(u(e,"Contents","Info.plist"),"utf8");return k.some((n)=>t.includes(`<string>${n}</string>`))&&(t.includes(`<string>${ue}</string>`)||t.includes("<string>Ara</string>"))&&D(e)!==null}catch{return!1}}function Jr(e=a()){let t=le(e);if(!d(t))return null;try{let n=w(u(t,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(n)?.[1]??null}catch{return null}}function pe(e,t=a()){let n=Jr(t);return n===null||j(N(n.split(".")),N(e.split(/[.-]/).slice(0,3)))}var ge=1e4;function K(e,t){return b(e,[...t],{stdio:"ignore",timeout:ge}).status??1}var W=new Set;function H(e){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let t=(n)=>{try{return T(n)}catch{return ce(n)}};if(e!==void 0&&t(e)!==t(a()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var V=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.(?:ara|reason)(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,J=new Set(["ara","ara.exe","reason","reason.exe"]);function N(e){return e.map((t)=>Number(t))}function j(e,t){for(let n=0;n<3;n+=1)if(e[n]!==t[n])return e[n]<t[n];return!1}var ye=[0,2,161];function me(e){if(e===null)return!0;let t=ye,n=null;try{n=T(process.execPath)}catch{}return e.some((r)=>{let i=V.exec(r);if(i){let f=i[1]===void 0?i.slice(4,7):i.slice(1,4);return j(N(f),t)}let o=r.slice(r.lastIndexOf("/")+1);return J.has(o)&&r!==n&&r!==process.execPath})}function Ee(){let e=b("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(e.status!==0)return null;let t=[];for(let n of e.stdout.split(`
|
|
3
3
|
`)){let r=/^\s*(\d+)\s+(\S.*)$/.exec(n);if(!r||Number(r[1])===process.pid)continue;let i=r[2].trimEnd(),o=i.slice(i.lastIndexOf("/")+1);if(!V.test(i)&&J.has(o)){let c=b("/usr/sbin/lsof",["-a","-p",r[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
|
|
4
4
|
`).find((l)=>l.startsWith("n/"));if(c)i=c.slice(1)}t.push(i)}return t}function _e(e){if(H(e.home),!d(e.sourceApp))throw new h("identity_invalid","The packaged Reason background identity is missing or invalid.");let t=e.command??K,n=le(e.home),r=I(n);Y(r,{recursive:!0,mode:448}),ee(r,448);let i=T(e.sourceApp),o=null;try{o=T(n)}catch{}if(i!==o){let f=`${process.pid}.${L()}`,c=u(r,`.Reason.app.${f}.tmp`),l=u(r,`.Reason.app.${f}.old`),y=!1;try{if(te(i,c,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!d(c))throw new h("identity_invalid","The copied Reason background identity is invalid.");let _=e.releaseSigned?["--test-requirement",`=${de}`]:[];if(t("/usr/bin/codesign",["--verify","--strict",..._,c])!==0)throw new h("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let S=!1;for(let p=0;p<4;p+=1){let m=!1;try{E(n,l),m=!0,y=!0}catch(s){if(s.code!=="ENOENT")throw s}if(p===0)e.beforePublish?.();try{E(c,n),S=!0}catch(s){let Z=s.code;if(!["EEXIST","ENOTEMPTY"].includes(Z??""))throw s;if(m)g(l,{recursive:!0,force:!0}),y=!1;if(p===3)throw s;continue}if(m)g(l,{recursive:!0,force:!0}),y=!1;break}if(!S)throw Error("Could not publish Reason's background identity.")}catch(_){if(y&&!x(n)&&x(l))E(l,n);throw _}finally{g(c,{recursive:!0,force:!0}),g(l,{recursive:!0,force:!0})}}return z(n,e,{verified:i!==o}),n}function X(e){return u(I(e),".Reason.app.registered")}function q(e){try{let t=A(e);return t.isDirectory()?`${t.ino}:${t.birthtimeMs}`:null}catch{return null}}function C(e){let t=q(e);try{return t!==null&&w(X(e),"utf8")===t}catch{return!1}}function Q(e){if(d(e))return"bundle";try{if(A(u(e,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return A(u(e,"Contents","MacOS",v)).isSymbolicLink()?"retired":null}catch{return null}}function z(e,t,n={}){let r=t.command??K;if(!n.verified&&r("/usr/bin/codesign",["--verify","--strict",e])!==0)throw new h("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if(r(R,["-f",e])!==0)throw new h("identity_register_failed","Could not register Reason's macOS background identity.");let i=q(e);try{if(i)oe(X(e),i,{mode:384})}catch{}try{Se(e,t.home,r,t.runningExecutables??Ee)}catch(o){let f=o.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${f})
|
|
5
5
|
`)}}function Se(e,t,n,r){let i=D(e);if(!i)return;let o=O(t),f=I(o),c=(s)=>u(s,"Contents","MacOS",v),l=se(I(c(o)),i),y=`${process.pid}.${L()}`,_=Q(o);if(_===null)return;let S=_==="bundle";if(S)n(R,["-u",o]);let p=u(f,`.Ara.app.${y}.old`);if(!W.has(o)&&!me(r())){if(!S)n(R,["-u",o]);try{E(o,p)}catch(s){if(s.code==="ENOENT")return;throw s}g(p,{recursive:!0,force:!0}),Ie(f);return}if(!S){if(re(c(o))===l)return;let s=`${c(o)}.${y}`;M(l,s);try{E(s,c(o))}finally{g(s,{force:!0})}return}let m=u(f,`.Ara.app.${y}.shim`);Y(I(c(m)),{recursive:!0}),M(l,c(m));try{try{E(o,p)}catch(s){if(s.code==="ENOENT")return;throw s}try{E(m,o)}catch(s){if(x(o))return;throw E(p,o),s}}finally{g(m,{recursive:!0,force:!0}),g(p,{recursive:!0,force:!0})}}function Ie(e){try{if(ne(e).some((n)=>n!==".DS_Store"))return;g(u(e,".DS_Store"),{force:!0}),ie(e)}catch{}}var B=new Map;function Zn(e=a()){let t=B.get(e);if(t)return t;if(process.platform!=="darwin")return[];let n=U(e);if(n===null&&x(I(le(e))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),n=U(e);if(n===null)return[];return B.set(e,n),n}function U(e){let t=le(e),n=O(e);if(!d(t)||!C(t))try{he({home:e,skipWhenSettled:!0})}catch{}let r=d(t)&&(C(t)||!d(n))?t:d(n)?n:null,i=r?D(r):null;if(!i)return null;if(r===n)W.add(n);let o=b(i,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return o.status===0&&o.stdout===`spawn
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{at,Dt,xr,bn,kr,vn,Sn,En}from"./vm-hands-entry-lite-t3qf6qrj.js";import{Pe,rr,Xn,_t,Io,oe,Do,No,Qe,Te,en,Qn,wt,ni,ii,oi,si,ai,ci,li,ui,di,pi,hi,fi,mi,pe,Y,Re,q,gi,_i,yi,wi,bi,vi,Si,Ei,bt,xi}from"./vm-hands-entry-lite-tqc2ezda.js";import{ue,Z,O}from"./vm-hands-entry-lite-r7zs4ce2.js";import{P,zt}from"./vm-hands-entry-lite-3vmhs921.js";import{lr,ji,Ui,nt,Hi,zi,qi,Wi,Vi,Gi,pr,hr,fr,dn,pn,mr,Ji,hn,gr,me,ge,Pt,_r,wr,Tt}from"./vm-hands-entry-lite-
|
|
2
|
+
import{at,Dt,xr,bn,kr,vn,Sn,En}from"./vm-hands-entry-lite-t3qf6qrj.js";import{Pe,rr,Xn,_t,Io,oe,Do,No,Qe,Te,en,Qn,wt,ni,ii,oi,si,ai,ci,li,ui,di,pi,hi,fi,mi,pe,Y,Re,q,gi,_i,yi,wi,bi,vi,Si,Ei,bt,xi}from"./vm-hands-entry-lite-tqc2ezda.js";import{ue,Z,O}from"./vm-hands-entry-lite-r7zs4ce2.js";import{P,zt}from"./vm-hands-entry-lite-3vmhs921.js";import{lr,ji,Ui,nt,Hi,zi,qi,Wi,Vi,Gi,pr,hr,fr,dn,pn,mr,Ji,hn,gr,me,ge,Pt,_r,wr,Tt}from"./vm-hands-entry-lite-0fwawqma.js";import{D,R,b}from"./vm-hands-entry-lite-499mywh7.js";import{Mi,$i,ln,Bi,un,Fi,rt,cr}from"./vm-hands-entry-lite-7j96jxh6.js";import{K}from"./vm-hands-entry-lite-d9g1pzzx.js";import{He}from"./vm-hands-entry-lite-a3w8m8nb.js";import{j}from"./vm-hands-entry-lite-1f2cam25.js";import{vr,_n,to}from"./vm-hands-entry-lite-njs8k65s.js";import{yo,wo,ht,bo,vo,So,Eo,xo}from"./vm-hands-entry-lite-jcf61cb4.js";import{Pr,Bt,Tr,On,In}from"./vm-hands-entry-lite-3adw9jw3.js";import{Lt,ze,Mt}from"./vm-hands-entry-lite-fwj2vk0q.js";import{Rn,x,so}from"./vm-hands-entry-lite-ezadej92.js";import{go,_o}from"./vm-hands-entry-lite-7xy7g88x.js";import{Nt,xn,kn}from"./vm-hands-entry-lite-4gadqypp.js";import{ye,Xi,Yi}from"./vm-hands-entry-lite-dh8f2h2d.js";import{be}from"./vm-hands-entry-lite-yretc2th.js";import{It}from"./vm-hands-entry-lite-2yz6b0n3.js";import{ke,Kt,Jt,Zt,E}from"./vm-hands-entry-lite-qyp2a4c3.js";import{a,ie}from"./vm-hands-entry-lite-9sa1knn7.js";import{t,k,o,d,u,i,W,_,ee,s,n,$o}from"./vm-hands-entry-lite-ba3qq0bs.js";import{fe,Ne,Le,Me,nn}from"./vm-hands-entry-lite-8j7p91hr.js";import{$e}from"./vm-hands-entry-lite-mcjca0ez.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{request as kl}from"http";import{request as Tl}from"https";import{lookup as Dl}from"dns/promises";import{isIP as Nl}from"net";async function Ml(e){let l=new URL(e.url);return await new Promise((c,p)=>{let m=(l.protocol==="https:"?Tl:kl)(l,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:bn},(f)=>c({response:f,close:()=>{f.destroy(),m.destroy(),f.socket?.destroy()}}));m.once("error",p),m.once("timeout",()=>m.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),m.end(e.body)})}var Qi=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),$l=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function es(e,l=0){if(!e||typeof e!=="object"||l>3)return null;let c=e.code;if(typeof c==="string"){if(Qi.has(c))return"custom_endpoint_host_not_found";if($l.has(c))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(c))return"custom_endpoint_tls_failed"}for(let p of[...e instanceof AggregateError?e.errors:[],e.cause]){let m=es(p,l+1);if(m)return m}return null}async function Bl(e,l){let c=es(e),p=new URL(l).hostname.replace(/^\[|\]$/g,"");if(c!==null&&c!=="custom_endpoint_connection_failed"||Nl(p)!==0)return c;let m;return await Promise.race([Dl(p).then(()=>!0,(h)=>!Qi.has(String(h?.code))),new Promise((h)=>{m=setTimeout(()=>h(!0),5000)})]).finally(()=>clearTimeout(m))?c:"custom_endpoint_host_not_found"}function Fl(e){for(let l=42;;l++){if(l===127)l=256;let c=String.fromCodePoint(l);if(!e.includes(c))return c}}function Ul(e,l){let c=Buffer.from(e),p=Buffer.from(l),m=new Uint32Array(c.length);for(let h=1,y=0;h<c.length;h++){while(y&&c[h]!==c[y])y=m[y-1];if(c[h]===c[y])y++;m[h]=y}let f=0;return(h,y=!1)=>{let S=Buffer.allocUnsafe(h.length*p.length+f),w=0;for(let g of h){while(f&&c[f]!==g){let v=m[f-1];w+=c.copy(S,w,0,f-v),f=v}if(c[f]===g){if(f++,f===c.length)w+=p.copy(S,w),f=0}else S[w++]=g}if(y)w+=c.copy(S,w,0,f),f=0;return S.subarray(0,w)}}async function ts(e){e.signal.throwIfAborted();let l=vn.safeParse(e.payload);if(!l.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let c=l.data,p=Sn.parse(await e.credential(e.signal));if(!kr(c,{baseUrl:c.baseUrl,api:p.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let m,f,h=0,y=0,S=0,w=Fl(p.apiKey),g=Ul(p.apiKey,w),v=async(I,A)=>{e.signal.throwIfAborted(),await new Promise((M,N)=>{let L=()=>{e.signal.removeEventListener("abort",L),N(e.signal.reason)};if(e.signal.addEventListener("abort",L,{once:!0}),e.signal.aborted){L();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(I,A))).then(()=>{e.signal.removeEventListener("abort",L),M()},(B)=>{e.signal.removeEventListener("abort",L),N(B)})})},C=async(I)=>{if(h+=I.length,h>Dt)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let A=0;A<I.length;A+=at){if(S>=xr)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await v(`custom_endpoint.chunk.${S++}`,{eof:!1,data:I.subarray(A,A+at).toString("base64")})}};try{let I=await Ml({url:c.url,body:c.body,signal:e.signal,headers:{...c.headers,...p.api==="anthropic-messages"?{"x-api-key":p.apiKey}:{authorization:`Bearer ${p.apiKey}`}}});m=I.response,f=I.close;let A=m.statusCode??500;if(A>=300&&A<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(m.headers["content-encoding"]&&m.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let M={};for(let N of["content-type","retry-after","x-request-id","request-id"]){let L=m.headers[N];if(typeof L==="string")M[N]=L.replaceAll(p.apiKey,w).slice(0,4096)}await v("custom_endpoint.headers",{status:A,statusText:(m.statusMessage??"").replaceAll(p.apiKey,w).slice(0,256),headers:M});for await(let N of m){e.signal.throwIfAborted();let L=Buffer.isBuffer(N)?N:Buffer.from(N);if(y+=L.length,y>Dt)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(g(L))}return await C(g(Buffer.alloc(0),!0)),await v(`custom_endpoint.chunk.${S}`,{eof:!0}),{bytes:h,chunks:S}}catch(I){if(e.signal.throwIfAborted(),I instanceof r)throw I;throw new r((m?null:await Bl(I,c.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{f?.()}}import{join as rs}from"path";function Hl(e,l){return e===rs(l,".ara","workspace")||e===rs(l,".reason","workspace")}function ns(e,l){let c=e.filter((p)=>Hl(p.path,l));return c.length===1?c[0].path:null}var jl=/^[a-f0-9]{64}$/;var on=32,ql=/^\/[^\x00-\x1f\x7f\\]*$/;function Er(e){if(typeof e!=="string"||e.length>4096||!ql.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((l)=>l!==""&&l!=="."&&l!=="..")}function Cr(e,l){let c=l==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!c)return e;let p=c[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${c[1].toUpperCase()}:${p?`/${p}`:""}`}function sn(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let l=e;if(!Er(l.home)||!Array.isArray(l.roots)||l.roots.length>on)return;let c=[];for(let p of l.roots){if(!p||typeof p!=="object"||Array.isArray(p))return;let{path_fingerprint:m,path:f}=p;if(typeof m!=="string"||!jl.test(m)||!Er(f))return;c.push({path_fingerprint:m,path:f})}return{home:l.home,roots:c}}function Wl(e){let l=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&l?l:void 0}function zl(e){return Wl(e)??e.email.toLowerCase()}function mn(e){let l=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return l?zl({name:l[1],email:l[2]}):e.trim().toLowerCase()}var jt=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(l)=>`[${l.toLowerCase()}${l.toUpperCase()}]`),Gl=[...ke.map((e)=>`/(${e.map(jt).join("/")})(/|$)`),...Kt.map((e)=>`/(${e.map(jt).join("/")})(/|$)`),...[...Jt].map((e)=>`/(${jt(e)})$`),`/${jt(".env.")}[^/]*$`,...Zt.map((e)=>`/[^/]*${jt(e)}$`)],os=`function localGithubSandboxProfile(root, temporary) {
|
|
3
3
|
return ['(version 1)','(deny default)','(import "system.sb")','(allow process-exec process-fork)',
|
|
4
4
|
'(allow file-read* (subpath "/bin") (subpath "/sbin") (subpath "/usr/bin") (subpath "/usr/sbin") (subpath "/usr/libexec") (subpath "/usr/share") (subpath "/private/var/select") (literal "/private/var/db/xcode_select_link"))',
|
|
5
5
|
'(allow file-read-metadata (path-ancestors "/opt/homebrew/bin") (path-ancestors "/usr/local/bin") (path-ancestors "/Library/Developer/CommandLineTools"))',
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{S,Gt,Vn,Xe,Gn,Kn}from"./vm-hands-entry-lite-jcf61cb4.js";import{Zn}from"./vm-hands-entry-lite-
|
|
2
|
+
import{S,Gt,Vn,Xe,Gn,Kn}from"./vm-hands-entry-lite-jcf61cb4.js";import{Zn}from"./vm-hands-entry-lite-9xhynk62.js";import{Fn}from"./vm-hands-entry-lite-d9g1pzzx.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ys,spawn as Ke}from"child_process";import{existsSync as ws}from"fs";import{connect as xs}from"net";function pn(){let e=new Set,t=null,n=(s)=>({holder:t?.viewer??null,you:t===s,same_user:Boolean(t?.viewer&&s.viewer&&t.viewer.user_id===s.viewer.user_id)}),o=()=>{for(let s of e)s.notify(n(s))};return{join(s){return e.add(s),s.notify(n(s)),()=>{if(!e.delete(s))return;if(t!==s)return;t=null,o()}},claim(s){if(t===s||!e.has(s))return;t=s,o()}}}var ut=pn();import{createHash as St}from"crypto";import{once as Sn}from"events";import{createWriteStream as vn,existsSync as mr,mkdirSync as gr,mkdtempSync as hr,readFileSync as le,readdirSync as br,renameSync as yr,realpathSync as En,rmSync as Dn,statSync as Ne,writeFileSync as wr}from"fs";import{delimiter as _r,dirname as vt,join as b}from"path";import{finished as In}from"stream/promises";var qe="omljlfpmafedpplnpkkahegadhkimdje",io="https://chromewebstore.google.com/detail/reason/omljlfpmafedpplnpkkahegadhkimdje";var O={ocu:{repository:"https://github.com/iFurySt/open-codex-computer-use.git",revision:"386a260d1ab8b690adbbb27f7471595cf0c2b752",version:"0.3.5"},obu:{repository:"https://github.com/iFurySt/open-browser-use.git",revision:"ac015846df75928fbcf0f3a0f3ba3a210ce1a507",version:"0.1.42"}},H={version:"155.0.8059.84",macArm64Sha256:"13b9e98ce56f5ce18e100a009f455c9285f399e7c9dc8a76fdf2f3a9755bb5f2",linux64Sha256:"cf0f049892dea22e6a6db26d47ed0d7776b7158edcbec4634086633df8bafcbc",win64Sha256:"507f2a031441d10c62b5e3d4e863f09ac1198a571c1419976cbd8387f639afde"};var J={ocu:{url:`https://registry.npmjs.org/open-computer-use/-/open-computer-use-${O.ocu.version}.tgz`,sha256:"7c16a87c8cd357787b02c0ebd040dd5f93880c1fb51c1901caa2e0c05d063130",size_bytes:5844280},obu:{url:`https://registry.npmjs.org/open-browser-use/-/open-browser-use-${O.obu.version}.tgz`,sha256:"9386d8ce0a147b3f55e1807b68edf736836378807541c457c9b5f6ca2cabaa4e",size_bytes:21372018},extension:{url:`https://github.com/iFurySt/open-browser-use/releases/download/v${O.obu.version}/open-browser-use-chrome-extension-${O.obu.version}.zip`,sha256:"c9c07bec1175e12ea6985b0e7784a5ef01fd03f014b958224a1e17dcd838a241",size_bytes:31070}},F="pnbmoicbkopffjjgfgfglopechaiemkp";import{spawn as Me}from"child_process";import{createRequire as fn}from"module";import{join as mn}from"path";var gn=30000,hn=1048576;function Te(){return process.env.SystemRoot??"C:\\Windows"}function bn(){return mn(Te(),"System32","WindowsPowerShell","v1.0","powershell.exe")}var yn=String.raw`
|
|
3
3
|
$ErrorActionPreference = "Stop"
|
|
4
4
|
Add-Type -TypeDefinition @"
|
|
5
5
|
using System;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Wn,ko,Gt}from"./vm-hands-entry-lite-jcf61cb4.js";import{Cn,We,oo,An,Pn,Tn,Cr,x}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Wn,ko,Gt}from"./vm-hands-entry-lite-jcf61cb4.js";import{Cn,We,oo,An,Pn,Tn,Cr,x}from"./vm-hands-entry-lite-ezadej92.js";import{Et}from"./vm-hands-entry-lite-g9z467dk.js";import{Rr}from"./vm-hands-entry-lite-3adw9jw3.js";import{j}from"./vm-hands-entry-lite-1f2cam25.js";import{a}from"./vm-hands-entry-lite-9sa1knn7.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as z,spawn as H}from"child_process";import{randomBytes as he}from"crypto";import{chmodSync as Qe,existsSync as I,lstatSync as _e,mkdirSync as De,readFileSync as we,rmSync as ee,writeFileSync as U}from"fs";import{connect as Re}from"net";import{join as y}from"path";var P=32,w=76;var B="./desktop-wallpaper-0pjhgyfk.jpg";var O="./dock-browser-afp005mt.png";var F="./dock-files-rywdm96b.png";var k="./dock-terminal-s41cj1jp.png";var K=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
|
|
3
3
|
# The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
|
|
4
4
|
# python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
|
|
5
5
|
# Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
var Yt={name:"github-native-engineer-device-worker-production",version:"0.2.
|
|
2
|
+
var Yt={name:"github-native-engineer-device-worker-production",version:"0.2.430",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@anthropic-ai/sandbox-runtime":"^0.0.73","@earendil-works/pi-tui":"1.0.0","@modelcontextprotocol/sdk":"^1.29.0","@reason/runtime-distribution":"workspace:*","playwright-core":"1.60.0",zod:"^4.4.3"},overrides:{"@hono/node-server":"^1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"^1.20.0","basic-ftp":"^6.2.1","@grpc/grpc-js":"^1.14.5",browserslist:"^4.28.8","engine.io":"^6.6.7","fast-uri":"^3.1.8",hono:"^4.13.7","ip-address":"^10.7.1",nanoid:"^3.3.18",dompurify:"^3.4.17",postcss:"^8.5.23",qs:"^6.16.0","shell-quote":"^1.11.0","socket.io-parser":"^4.2.7",tmp:"^0.2.7",toml:"^4.2.0",undici:"^8.10.2",ws:"^8.21.0","js-yaml":"^4.3.2","@modelcontextprotocol/sdk":"^1.31.0","proxy-addr":"^2.0.8","source-map-js":"^1.2.2"}};
|
|
3
3
|
export{Yt};
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{readdirSync as b,readFileSync as P}from"fs";import{userInfo as k}from"os";var or="--vm-hands-op-runner-kind=person",sr="--vm-hands-op-runner-kind=surface",xt="--vm-hands-surface-uid=",kt="--vm-hands-surface-dir=",Ct=new Set(["automation.call.v1","display.stream.v1","preview.serve.v1"]);function R(t){let c=new Set([t]),l=[];try{l=b("/proc")}catch{}for(let o of l){if(!/^\d+$/.test(o))continue;try{let d=P(`/proc/${o}/stat`,"utf8");if(Number(d.slice(d.lastIndexOf(")")+2).split(" ")[3])===t)c.add(Number(o))}catch{}}for(let o of c)try{process.kill(o,"SIGKILL")}catch{}}var A=(t)=>{let c=globalThis.Bun;if(!c)throw new r("pty_unavailable","Reason terminals require the Bun runtime.");let l=c.spawn({cmd:[t.shell,...t.args],cwd:t.cwd,env:{...t.environment,TERM:"xterm-256color"},terminal:{cols:t.cols,rows:t.rows,data:(i,s)=>t.onData(s)}}),o=l.terminal,d=()=>{R(l.pid);try{o?.close()}catch{}};if(!o)throw d(),new r("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(i)=>o.write(i),resize:(i,s)=>o.resize(i,s),kill:d,exited:l.exited.then((i)=>typeof i==="number"?i:null,()=>null)}};function x(){let t=(()=>{try{return k().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...t?{USER:t,LOGNAME:t}:{}}}async function E(t){let[{localAutomationAvailable:c},{localDisplayReady:l},{localDisplayVideoAvailable:o},{probeWorkerPreview:d},y]=await Promise.all([import("./local-automation-
|
|
2
|
+
import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{readdirSync as b,readFileSync as P}from"fs";import{userInfo as k}from"os";var or="--vm-hands-op-runner-kind=person",sr="--vm-hands-op-runner-kind=surface",xt="--vm-hands-surface-uid=",kt="--vm-hands-surface-dir=",Ct=new Set(["automation.call.v1","display.stream.v1","preview.serve.v1"]);function R(t){let c=new Set([t]),l=[];try{l=b("/proc")}catch{}for(let o of l){if(!/^\d+$/.test(o))continue;try{let d=P(`/proc/${o}/stat`,"utf8");if(Number(d.slice(d.lastIndexOf(")")+2).split(" ")[3])===t)c.add(Number(o))}catch{}}for(let o of c)try{process.kill(o,"SIGKILL")}catch{}}var A=(t)=>{let c=globalThis.Bun;if(!c)throw new r("pty_unavailable","Reason terminals require the Bun runtime.");let l=c.spawn({cmd:[t.shell,...t.args],cwd:t.cwd,env:{...t.environment,TERM:"xterm-256color"},terminal:{cols:t.cols,rows:t.rows,data:(i,s)=>t.onData(s)}}),o=l.terminal,d=()=>{R(l.pid);try{o?.close()}catch{}};if(!o)throw d(),new r("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(i)=>o.write(i),resize:(i,s)=>o.resize(i,s),kill:d,exited:l.exited.then((i)=>typeof i==="number"?i:null,()=>null)}};function x(){let t=(()=>{try{return k().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...t?{USER:t,LOGNAME:t}:{}}}async function E(t){let[{localAutomationAvailable:c},{localDisplayReady:l},{localDisplayVideoAvailable:o},{probeWorkerPreview:d},y]=await Promise.all([import("./local-automation-bg0bwba0.js"),import("./local-display-session-d4zd1760.js"),import("./local-display-video-eenan2fs.js"),import("./worker-preview-readiness-kmwcrttt.js"),import("fs")]),i=AbortSignal.timeout(15000),s=null;try{y.mkdirSync(t,{recursive:!0,mode:448}),s=y.mkdtempSync(`${t}/probe-`);let[g,p,m]=await Promise.all([Promise.resolve().then(()=>c()).catch(()=>!1),l().catch(()=>!1),d(s,i).catch(()=>!1)]);return{t:"readiness",display_video:p&&await o().catch(()=>!1),lanes:{"automation.call.v1":g,"display.stream.v1":p,"preview.serve.v1":m,"tunnel.open":m,"tunnel.close":m}}}finally{if(s)y.rmSync(s,{recursive:!0,force:!0})}}async function os(){let[{executeLocalOperation:t,spawnCaptured:c},{runLocalPtySession:l},{configureDesktopAccount:o,desktopAccount:d},{configureWorkerSandbox:y}]=await Promise.all([import("./local-capabilities-dspyxqnq.js"),import("./local-pty-session-7hps89vj.js"),import("./desktop-account-nb7g2ek5.js"),import("./worker-sandbox-epre0fnv.js")]);y();let i=process.argv.includes(or),s=process.argv.includes(sr),g=(a,e,u)=>c(a,e[0]==="-lic"?["-lc",...e.slice(1)]:e,u),p=(process.geteuid?.()??0)!==0;if(s){p=!1;let a=process.argv.find((e)=>e.startsWith(xt))?.slice(xt.length);if((process.geteuid?.()??-1)===0&&a)try{p=o({value:a})!==null&&d()!==null}catch{p=!1}}let m=new Map,v=new Map,f=(a)=>{try{process.send?.(a)}catch{}};if(process.on("message",(a)=>{let e=a;if(e?.t==="cancel"){m.get(e.id)?.abort();return}if(e?.t==="control"){let n=v.get(e.id);if(s&&n&&e.control&&typeof e.control.kind==="string")import("./local-managed-process-maj54q14.js").then(({controlManagedDeviceProcess:_})=>_(n,{kind:e.control.kind,payload:e.control.payload??{}})).catch(()=>!1);return}if(e?.t==="retire"){if(s&&typeof e.operation_id==="string"&&typeof e.status==="string")import("./local-managed-process-maj54q14.js").then(({retireManagedDeviceProcess:n})=>n(e.operation_id,e.status)).catch(()=>!1);return}if(e?.t!=="op")return;if(!p){f({t:"done",id:e.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let u=e.claim.capability;if(u==="pty.start"&&!i){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}if(Ct.has(u)!==s){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}let w=new AbortController;m.set(e.id,w),v.set(e.id,e.claim);let S=u==="pty.start"?{runPtySession:(n)=>l(n,{spawnPty:A,environment:x(),loadProxy:()=>null})}:{worker:e.worker,...u==="exec.full"?{spawnFullControl:g}:{}};t(e.state,e.claim,{...S,signal:w.signal,emit:(n)=>{let{deliverySignal:_,...h}=n;f({t:"event",id:e.id,event:h})}}).then((n)=>f({t:"done",id:e.id,completion:n}),(n)=>f({t:"done",id:e.id,completion:{status:"failed",error_code:n&&typeof n==="object"&&"code"in n&&typeof n.code==="string"?n.code:"vm_hands_op_failed"}})).finally(()=>{m.delete(e.id),v.delete(e.id)})}),process.on("disconnect",()=>process.exit(0)),s){let a=process.argv.find((u)=>u.startsWith(kt))?.slice(kt.length),e={t:"readiness",display_video:!1,lanes:{}};f(p&&a?await E(a).catch(()=>e):e)}await new Promise(()=>{})}
|
|
3
3
|
export{or,sr,xt,kt,Ct,os};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Yn,wt,ei,ti,ri,ki}from"./vm-hands-entry-lite-tqc2ezda.js";import{createHash as H,randomBytes as me}from"crypto";import{closeSync as Re,fsyncSync as Ae,mkdirSync as Ye,openSync as xe,renameSync as Xe,rmSync as Qe,statSync as Oe,writeSync as De,constants as G}from"fs";import{join as te}from"path";var Ze=1;var ie=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function he(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Ee(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function fe(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&ie.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:he(e)?e.environment_sealed:null,workspace_deferred:en(e)}}function en(e){let n=e.payload[ei];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Te(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var W=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),K=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function Di(e){let n=await crypto.subtle.importKey("pkcs8",K(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=K(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),h=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),m=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:h,fingerprint:m}}var nn=16;class on{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!ie.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let h=this.bound.get(e);if(!h)return!1;if(h.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((m)=>setTimeout(m,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:Ze,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:W(this.keys.signingSpki),env_public_key:W(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:W(me(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:W(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=W(me(32)),h=ki({method:"GET",pathAndQuery:Yn,timestamp:i,nonce:s,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),m=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(h)));return{t:"hello",timestamp:i,nonce:s,signature:W(tn(m)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let i of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!ie.test(i))throw new l("vm_hands_bind_invalid","bad id");if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<=(this.lastBrainGeneration.get(e.run_id)??0))throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((i)=>i.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=nn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((i)=>i.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let i,s,h=new Promise((m,_)=>{i=m,s=_});return h.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:h,resolve:i,reject:s}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(w){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),Te(w,"the bind's kill-verify failed")}let i,s=new Promise((w)=>{i=w}),h=!1,m=!1,_=()=>{m=!0,i()},k=n.promise.then(()=>new Promise((w,I)=>{this.exclusive(async()=>{if(m){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}h=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();w()}catch(y){I(y)}await s})}));k.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:k,inTurn:()=>h,leave:_})}finally{_()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);s=!0;let{launchId:h,applied:m,readyData:_}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),k=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let w=null,I=null;if(e.env){let y=e.claim?.owner??{},A=Ee(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof y.device_id==="string"?y.device_id:"",rootId:e.claim?.root_id??""});w=this.hooks.installEnvironment(e.bind_id,A),I=typeof A.snapshot_id==="string"&&A.snapshot_id?A.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,A)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:h,envInstalled:w!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:h,snapshot_revision:w,snapshot_id:I,layout:k,..._?{ready_data:_}:{},policy_digest:H("sha256").update(V({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(h){if(i)ge(i);if(s){let m=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(m);else await m()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),Te(h,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!ie.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Ee(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),h=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)ge(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${h}`,s),{snapshot_id:e.snapshotId,installed_revision:h,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(h){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw h}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)ge(n.envDirectory);return this.unverifiedTeardowns.delete(e),{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",K(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),h=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:K(e.iv),additionalData:new TextEncoder().encode(n)},h,K(e.ct)).catch(i),_=JSON.parse(new TextDecoder().decode(m));if(!_||typeof _!=="object"||Array.isArray(_))throw new l("vm_hands_env_invalid","env not an object");return _}writeJobEnvRootOnly(e,n){let i=te(this.options.envRoot,`bind-${e}`);Ye(i,{mode:448});let s=Oe(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let h=n.variables&&typeof n.variables==="object"?n.variables:{},m=Object.entries(h).filter(([w,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(w)&&typeof I==="string").map(([w,I])=>`export ${w}='${String(I).replaceAll("'","'\\''")}'`).join(`
|
|
2
|
+
import{Yn,wt,ei,ti,ri,ki}from"./vm-hands-entry-lite-tqc2ezda.js";import{createHash as H,randomBytes as he}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Xe,openSync as Oe,renameSync as Qe,rmSync as Ze,statSync as De,writeSync as Me,constants as W}from"fs";import{join as re}from"path";var en=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:nn(e)}}function nn(e){let n=e.payload[ei];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var G=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),K=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function Di(e){let n=await crypto.subtle.importKey("pkcs8",K(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=K(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),h=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),m=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:h,fingerprint:m}}var tn=16;class on{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;failedBindGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let h=this.bound.get(e);if(!h)return!1;if(h.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((m)=>setTimeout(m,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:en,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:G(this.keys.signingSpki),env_public_key:G(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:G(he(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:G(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=G(he(32)),h=ki({method:"GET",pathAndQuery:Yn,timestamp:i,nonce:s,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),m=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(h)));return{t:"hello",timestamp:i,nonce:s,signature:G(sn(m)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let s of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(s))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.failedBindGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((s)=>s.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=tn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((s)=>s.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.failedBindGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let s,h,m=new Promise((_,k)=>{s=_,h=k});return m.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:m,resolve:s,reject:h}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(v){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.failedBindGeneration.set(e.run_id,e.brain_generation),Re(v,"the bind's kill-verify failed")}let i,s=new Promise((v)=>{i=v}),h=!1,m=!1,_=()=>{m=!0,i()},k=n.promise.then(()=>new Promise((v,I)=>{this.exclusive(async()=>{if(m){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}h=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();v()}catch(w){I(w)}await s})}));k.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:k,inTurn:()=>h,leave:_})}finally{_()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);s=!0;let{launchId:h,applied:m,readyData:_}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),k=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let v=null,I=null;if(e.env){let w=e.claim?.owner??{},T=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:e.claim?.root_id??""});v=this.hooks.installEnvironment(e.bind_id,T),I=typeof T.snapshot_id==="string"&&T.snapshot_id?T.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,T)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:h,envInstalled:v!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:h,snapshot_revision:v,snapshot_id:I,layout:k,..._?{ready_data:_}:{},policy_digest:H("sha256").update(V({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(h){if(i)fe(i);if(s){let m=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(m);else await m()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.failedBindGeneration.set(e.run_id,e.brain_generation),Re(h,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),h=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${h}`,s),{snapshot_id:e.snapshotId,installed_revision:h,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(h){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw h}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);return this.unverifiedTeardowns.delete(e),{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",K(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),h=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:K(e.iv),additionalData:new TextEncoder().encode(n)},h,K(e.ct)).catch(i),_=JSON.parse(new TextDecoder().decode(m));if(!_||typeof _!=="object"||Array.isArray(_))throw new l("vm_hands_env_invalid","env not an object");return _}writeJobEnvRootOnly(e,n){let i=re(this.options.envRoot,`bind-${e}`);Xe(i,{mode:448});let s=De(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let h=n.variables&&typeof n.variables==="object"?n.variables:{},m=Object.entries(h).filter(([v,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(v)&&typeof I==="string").map(([v,I])=>`export ${v}='${String(I).replaceAll("'","'\\''")}'`).join(`
|
|
3
3
|
`)+`
|
|
4
|
-
`,_=te(i,`.job.env.${me(8).toString("hex")}`),k=xe(_,G.O_WRONLY|G.O_CREAT|G.O_EXCL|G.O_NOFOLLOW,384);try{De(k,m),Ae(k)}finally{Re(k)}return Xe(_,te(i,"job.env")),i}}function ge(e){try{let n=te(e,"job.env"),i=Oe(n).size,s=xe(n,G.O_WRONLY|G.O_NOFOLLOW);try{De(s,Buffer.alloc(i)),Ae(s)}finally{Re(s)}}catch{}Qe(e,{recursive:!0,force:!0})}function tn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as sn}from"crypto";var rn="/app/local-runtime/session?register=vm_hands_v1",an="/app/local-runtime",Me=25000,pe=20000,dn=1e4,Ne=5000,cn=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ln="preview.serve.v1",un=60000,ve=75000,_n=2000,mn=1e4,gn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),hn=3,fn=20000,pn=250,vn=2000;function je(e){let n=Math.min(pn*2**(e-1),vn);return Math.round(n/2+Math.random()*n/2)}var wn=5000;function yn(e){return e>=500||e===408||e===429}var se=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var bn=64,Be=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function kn(e,n,i,s,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[w,I]of Be.entries()){if(s.aborted)return;if(await new Promise((y)=>{let A=setTimeout(y,I);A.unref?.(),s.addEventListener("abort",()=>{clearTimeout(A),y()},{once:!0})}),s.aborted)return;try{let y=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:w+1}),e.receipts.push({...i,unbound:y}),e.flushReceipts?.();return}catch(y){let A=Ue(y);if(h("vm_hands.unbind_unverified",{operation_id:k,code:A,attempt:w+1}),A==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:Be.length})})().finally(()=>_.delete(m))}async function $e(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,Ne))])}async function Sn(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,Ne))]);return i.length}function In(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await $e(e,i),n.unbind(i)}function re(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var qe=15000,Pn=1e4,En=1000;async function Ni(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),h=async(k)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),re(I);let y=await L(i,e.agent,w).catch(()=>null);if(y)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:y});s("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let w=await Tn(e,i).catch((y)=>{if(y instanceof l&&i.deviceId===null&&y.code==="vm_hands_no_session"&&Date.now()-n<mn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(y instanceof l&&i.deviceId===null&&gn.has(y.code)&&m<hn&&Date.now()-n<fn)return m++,_=je(m),s("vm_hands.register_retry",{attempt:m,code:y.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(y instanceof l&&i.deviceId===null)throw y;return{closeCode:0,closeReason:y instanceof Error?y.message:String(y)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ve)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?_:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ve-Date.now())):Math.min(500*2**k,30000);if(await new Promise((y)=>setTimeout(y,I)),i.turns.size&&Date.now()-i.lostAt>=ve)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Tn(e,n){let i=n.deviceId,s=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:rn,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,w="",I=new Map,y=[],A=null,oe=new Promise((t)=>{_.onclose=(o)=>{k=o.code,w=o.reason;for(let r of I.values())r.reject(new B(`session closed ${o.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let r=o;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(o.t==="reconnect"){let r=Math.max(0,Math.min(Number(o.after_ms)||0,En));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!A?.(o))y.push(o)};let J=(t,o)=>new Promise((r,a)=>{let u=y.findIndex((p)=>t.includes(p.t));if(u>=0){r(y.splice(u,1)[0]);return}let f=setTimeout(()=>{A=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);A=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),A=null,r(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),C=(t,o)=>new Promise((r,a)=>{if(_.readyState!==WebSocket.OPEN){a(new B("session closed"));return}let u=sn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new B(`no answer to ${t.split("/").pop()} in ${f+qe} ms`)),_.close(4000,"request_timeout")},f+qe);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}r({status:c,json:g})}}),Y({t:"req",id:u,path:`${an}${t}`,body:JSON.stringify(o)})}),we=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",we,{once:!0});let ae,X=new Map,Q=new Map,de=!1,ce=new Set,le=new Set,ue=Promise.resolve(),ye=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),Pn);_.onopen=()=>{clearTimeout(g),s("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);s("vm_hands.challenge",{});let o=[],r=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((E)=>E&&E.operation_id===S.claim.operation_id&&E.attempt_id===S.claim.attempt_id)){o.push(S),s("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),re(S);let P=await L(n,e.agent,g).catch((E)=>ee(E,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),oe.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(ae=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=C,oe.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)Ge(r,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await be(g,c),g instanceof B)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ye;try{await ne();for(let c of o)c.flush=()=>ke(c),c.flush(),p(c.claim.attempt_id,()=>Se(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Me,Me)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>ze(d))}else He(d).catch(()=>{return})}}catch(c){await be(c,null)}}finally{if(ae)clearInterval(ae);e.signal.removeEventListener("abort",we);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ye)n.flushReceipts=null;_.close(),await oe,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),r=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>r?ee(u,r,"vm_hands_bind_lost"):null);if(a&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:a});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}for(let t of ce)t.abort()}return{closeCode:k,closeReason:w};async function be(t,o){if(t instanceof B){if(!de&&n.turns.size)n.lostAt=Date.now();de=!0}else{let r=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)de=!0;for(let a of r){let u=n.turns.get(a);if(n.turns.delete(a),u)re(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=C){let r=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>r(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(T)=>r(`/operations/${f}/events`,{...u,event_seq_start:T,events:[{kind:c,payload:{sequence:T,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,E=await S(P),D=E.status===409?E.json?.expected_event_seq:void 0;if(typeof D==="number"&&D===g+1)E={status:200,json:{duplicate:!0}};else if(typeof D==="number"&&D>=0&&D!==g)P=D,E=await S(P);if(E.status<300)t.eventSeq=P+1;return E}}function We(t){return(o,r)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=bn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:r,resolve:a,reject:u}),t.flush?.()})}function ke(t){if(le.has(t))return;le.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],r;try{r=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${r.status}`))}}finally{le.delete(t)}})()}async function Ge(t,o){try{let r=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(r);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function ze(t){let o=Z&&n.attest==="pending",r=t.vm_hands_attest,a=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(se,Number.isFinite(b)?b:se));if(!await new Promise((x)=>{let R=setTimeout(()=>x(!1),j);n.attestWaiters.push((U)=>{clearTimeout(R),x(U)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!he(t)}catch(b){s("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return fe(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await Sn(n,P);if(b)s("vm_hands.person_terminals_closed",{count:b});let j=fe(t),v=e.agent.bind(j);if(j.workspace_deferred)S=!0,g=Fe(u,()=>S);d=await v}catch(b){s("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let E=g?await g:-1,D={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete D.environment_installed;let T=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:D,eventSeq:u.eventSeq,ackSeq:-1});let F={...D,...T,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},_e=Date.now()+wn,N=1,q=await p("hands.ready",F);while(yn(q.status)&&!e.signal.aborted){let b=je(N);if(Date.now()+b>=_e)break;await new Promise((j)=>setTimeout(j,b)),N++,q=await p("hands.ready",F)}if(N>1)s("vm_hands.ready_retried",{attempts:N,status_class:`${Math.floor(q.status/100)}xx`});if(X.delete(t.attempt_id),q.status>=300){await $e(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Ce(q.json?.error,"vm_hands_probe_failed")});return}let M={claim:t,launchId:d.launch_id,readyData:D,eventSeq:u.eventSeq,ackSeq:E};n.turns.set(t.attempt_id,M),M.flush=()=>ke(M),e.onTurn?.(t.attempt_id,We(M)),await Se(M)}async function Fe(t,o){let{fence:r,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await C(`/operations/${a}/heartbeat`,{...r,control_ack_seq:f,wait_ms:pe});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===ti)return s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Se(t){let{fence:o,op:r}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,C(`/operations/${r}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:pe})]);if(!p){a="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===wt)try{await Ve(t,d.payload??{})}catch(g){if(g instanceof B)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;s("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ke(t,a)}async function Ie(t,o){let r=Date.now()+un;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function He(t){let o=t,r={claim:o,eventSeq:0},a=String(t.capability??""),u=a===ln,{complete:f,emit:p,fence:c,op:d}={...O(r,u?Ie:C)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(se,Number.isFinite(v)?v:se));if(!(x>0&&await new Promise((U)=>{let Le=setTimeout(()=>U(!1),x);n.attestWaiters.push((Je)=>{clearTimeout(Le),U(Je)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,E=P?In(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(E)){await f("failed",{error_code:"vm_hands_bound"});return}if(cn.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let T=new AbortController;if(!u)ce.add(T);let F,_e=new Promise((v)=>{F=v}),N={abort:T,settled:_e},q=P?{...N,session:E}:null;if(q)n.personTerminals.add(q);if(g==="model"&&S&&a!=="preview.serve.v1"){let v=n.modelOps.get(S)??new Set;v.add(N),n.modelOps.set(S,v),await e.agent.environmentInstalled(S,_n,T.signal)}let M=-1,b=!1,j=u?void 0:setInterval(()=>{C(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){T.abort();return}let x=v.json?.controls??[];for(let R of x)if(M=Math.max(M,R.seq),R.kind==="operation.cancel"||R.kind==="cancel")T.abort()},()=>T.abort())},dn);if(u)(async()=>{while(!b&&!T.signal.aborted){let v;try{v=await Ie(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:pe})}catch{T.abort();return}if(b)return;if(v.status>=300){T.abort();return}let x=(v.json?.controls??[]).slice().sort((R,U)=>R.seq-U.seq);for(let R of x){if(R.seq<=M)continue;if(R.kind==="operation.cancel"||R.kind==="cancel")T.abort();else await e.controlOp?.({claim:t,control:R}).catch(()=>!1);M=R.seq}}})();try{let v=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:T.signal,emit:async(R)=>{await p(R.kind,R.data??{})}}),x=await f(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:x.status<300}),s("vm_hands.op",{capability:a,kind:g,status:v.status,code:v.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(b=!0,clearInterval(j),ce.delete(T),S)n.modelOps.get(S)?.delete(N);if(q)n.personTerminals.delete(q);F()}}async function Ke(t,o){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),re(t);let a=await L(n,e.agent,r).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,r){let a=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(ri,{code:a}).catch(()=>{return}),kn(n,e.agent,{turn:o,failure:r},e.signal,s),null}function ne(){return ue=ue.then(Pe,Pe),ue}async function Pe(){while(n.receipts.length){let{turn:t,failure:o,unbound:r}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof B)return}n.receipts.shift()}}async function Ve(t,o){let{fence:r,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await C(`/operations/${a}/environment`,{...r,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await C(`/operations/${a}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as An}from"fs";var Rn=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function xn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-3292r794.js");await m();return}z("parsed",{t0:Math.round(Rn)});let e="";try{e=An(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-fb4p1stm.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}xn();export{Di,on,Ni};
|
|
4
|
+
`,_=re(i,`.job.env.${he(8).toString("hex")}`),k=Oe(_,W.O_WRONLY|W.O_CREAT|W.O_EXCL|W.O_NOFOLLOW,384);try{Me(k,m),xe(k)}finally{Ae(k)}return Qe(_,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,W.O_WRONLY|W.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}Ze(e,{recursive:!0,force:!0})}function sn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as rn}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=1e4,je=5000,ln=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),un="preview.serve.v1",_n=60000,ye=75000,mn=2000,gn=1e4,hn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),fn=3,pn=20000,vn=250,wn=2000;function Ue(e){let n=Math.min(vn*2**(e-1),wn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function bn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class M extends Error{}var kn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function $e(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Sn(e,n,i,s,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[v,I]of qe.entries()){if(s.aborted)return;if(await new Promise((w)=>{let T=setTimeout(w,I);T.unref?.(),s.addEventListener("abort",()=>{clearTimeout(T),w()},{once:!0})}),s.aborted)return;try{let w=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:v+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let T=$e(w);if(h("vm_hands.unbind_unverified",{operation_id:k,code:T,attempt:v+1}),T==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:qe.length})})().finally(()=>_.delete(m))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,je))])}async function In(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,je))]);return i.length}function Pn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Tn=1000;async function Ni(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),h=async(k)=>{for(let[v,I]of[...i.turns]){i.turns.delete(v),e.onTurn?.(v,null),de(I);let w=await L(i,e.agent,v).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});s("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let v=await Rn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&hn.has(w.code)&&m<fn&&Date.now()-n<pn)return m++,_=Ue(m),s("vm_hands.register_retry",{attempt:m,code:w.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(s("vm_hands.session_closed",{close_code:v.closeCode,reason:v.closeReason.slice(0,120),registered:i.deviceId!==null}),v.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=v.closeReason==="drain_reconnect"?0:v.closeReason==="vm_hands_register_retry"?_:v.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ye-Date.now())):Math.min(500*2**k,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Rn(e,n){let i=n.deviceId,s=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,v="",I=new Map,w=[],T=null,ce=new Promise((t)=>{_.onclose=(o)=>{k=o.code,v=o.reason;for(let r of I.values())r.reject(new M(`session closed ${o.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let r=o;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(o.t==="reconnect"){let r=Math.max(0,Math.min(Number(o.after_ms)||0,Tn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!T?.(o))w.push(o)};let J=(t,o)=>new Promise((r,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){r(w.splice(u,1)[0]);return}let f=setTimeout(()=>{T=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);T=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),T=null,r(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),q=(t,o)=>new Promise((r,a)=>{if(_.readyState!==WebSocket.OPEN){a(new M("session closed"));return}let u=rn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new M(`no answer to ${t.split("/").pop()} in ${f+Ne} ms`)),_.close(4000,"request_timeout")},f+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}r({status:c,json:g})}}),Y({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(o)})}),be=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",be,{once:!0});let le,X=new Map,Q=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);_.onopen=()=>{clearTimeout(g),s("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);s("vm_hands.challenge",{});let o=[],r=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((E)=>E&&E.operation_id===S.claim.operation_id&&E.attempt_id===S.claim.attempt_id)){o.push(S),s("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),de(S);let P=await L(n,e.agent,g).catch((E)=>ee(E,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),ce.then(()=>{throw new l(v==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await q("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=q,ce.then(()=>{if(n.request===q)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(r,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await Se(g,c),g instanceof M)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ke;try{await ne();for(let c of o)c.flush=()=>Ie(c),c.flush(),p(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await q("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",be);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;_.close(),await ce,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),r=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>r?ee(u,r,"vm_hands_bind_lost"):null);if(a&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:a});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:k,closeReason:v};async function Se(t,o){if(t instanceof M){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)ue=!0;for(let a of r){let u=n.turns.get(a);if(n.turns.delete(a),u)de(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=q){let r=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>r(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(R)=>r(`/operations/${f}/events`,{...u,event_seq_start:R,events:[{kind:c,payload:{sequence:R,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,E=await S(P),D=E.status===409?E.json?.expected_event_seq:void 0;if(typeof D==="number"&&D===g+1)E={status:200,json:{duplicate:!0}};else if(typeof D==="number"&&D>=0&&D!==g)P=D,E=await S(P);if(E.status<300)t.eventSeq=P+1;return E}}function We(t){return(o,r)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=kn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:r,resolve:a,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],r;try{r=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof M)return;r={status:500}}if(t.outbox.shift(),r.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function ze(t,o){try{let r=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(r);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function Fe(t){let o=Z&&n.attest==="pending",r=t.vm_hands_attest,a=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,C=Math.max(0,Math.min(ae,Number.isFinite(b)?b:ae));if(!await new Promise((ie)=>{let y=setTimeout(()=>ie(!1),C);n.attestWaiters.push((x)=>{clearTimeout(y),ie(x)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(b){s("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await In(n,P);if(b)s("vm_hands.person_terminals_closed",{count:b});let C=ve(t),U=e.agent.bind(C);if(C.workspace_deferred)S=!0,g=He(u,()=>S);d=await U}catch(b){s("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let E=g?await g:-1,D={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete D.environment_installed;let R=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:D,eventSeq:u.eventSeq,ackSeq:-1});let F={...D,...R,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},te=Date.now()+yn,j=1,N=await p("hands.ready",F);while(bn(N.status)&&!e.signal.aborted){let b=Ue(j);if(Date.now()+b>=te)break;await new Promise((C)=>setTimeout(C,b)),j++,N=await p("hands.ready",F)}if(j>1)s("vm_hands.ready_retried",{attempts:j,status_class:`${Math.floor(N.status/100)}xx`});if(X.delete(t.attempt_id),N.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Ce(N.json?.error,"vm_hands_probe_failed")});return}let B={claim:t,launchId:d.launch_id,readyData:D,eventSeq:u.eventSeq,ackSeq:E};n.turns.set(t.attempt_id,B),B.flush=()=>Ie(B),e.onTurn?.(t.attempt_id,We(B)),await Pe(B)}async function He(t,o){let{fence:r,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await q(`/operations/${a}/heartbeat`,{...r,control_ack_seq:f,wait_ms:we});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===ti)return s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Pe(t){let{fence:o,op:r}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,q(`/operations/${r}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!p){a="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===wt)try{await Le(t,d.payload??{})}catch(g){if(g instanceof M)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;s("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ve(t,a)}async function ge(t,o){let r=Date.now()+_n;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof M))throw u}if(Date.now()>=r||e.signal.aborted)throw new M("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,r={claim:o,eventSeq:0},a=String(t.capability??""),u=a===un,{complete:f,emit:p,fence:c,op:d}={...O(r,ge)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let y of n.attestWaiters.splice(0))y(!0)}if(n.attest!=="accepted"){let y=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(y)?y:ae));if(!(x>0&&await new Promise((se)=>{let Je=setTimeout(()=>se(!1),x);n.attestWaiters.push((Ye)=>{clearTimeout(Je),se(Ye)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,E=P?Pn(t):null;if(P&&((y)=>y===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(y)||n.bindsStarting.has(y))(E)){await f("failed",{error_code:"vm_hands_bound"});return}if(ln.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let R=new AbortController,F=()=>R.abort();e.signal.addEventListener("abort",F,{once:!0});let te,j=new Promise((y)=>{te=y}),N={abort:R,settled:j},B=P?{...N,session:E}:null;if(B)n.personTerminals.add(B);if(g==="model"&&S&&a!=="preview.serve.v1"){let y=n.modelOps.get(S)??new Set;y.add(N),n.modelOps.set(S,y),await e.agent.environmentInstalled(S,mn,R.signal)}let b=-1,C=!1,U=!1,ie=u?void 0:setInterval(()=>{if(U)return;U=!0,ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:0}).then((y)=>{if(y.status>=300){R.abort();return}let x=y.json?.controls??[];for(let A of x)if(b=Math.max(b,A.seq),A.kind==="operation.cancel"||A.kind==="cancel")R.abort()},()=>R.abort()).finally(()=>{U=!1})},cn);if(u)(async()=>{while(!C&&!R.signal.aborted){let y;try{y=await ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:we})}catch{R.abort();return}if(C)return;if(y.status>=300){R.abort();return}let x=(y.json?.controls??[]).slice().sort((A,se)=>A.seq-se.seq);for(let A of x){if(A.seq<=b)continue;if(A.kind==="operation.cancel"||A.kind==="cancel")R.abort();else await e.controlOp?.({claim:t,control:A}).catch(()=>!1);b=A.seq}}})();try{let y=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:R.signal,emit:async(A)=>{await p(A.kind,A.data??{})}}),x=await f(y.status,{...y.result?{result:y.result}:{},...y.error_code?{error_code:Ce(y.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:y.status,acknowledged:x.status<300}),s("vm_hands.op",{capability:a,kind:g,status:y.status,code:y.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(C=!0,clearInterval(ie),e.signal.removeEventListener("abort",F),S)n.modelOps.get(S)?.delete(N);if(B)n.personTerminals.delete(B);te()}}async function Ve(t,o){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let a=await L(n,e.agent,r).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,r){let a=$e(t);return s("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(ri,{code:a}).catch(()=>{return}),Sn(n,e.agent,{turn:o,failure:r},e.signal,s),null}function ne(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:r}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof M)return}n.receipts.shift()}}async function Le(t,o){let{fence:r,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await q(`/operations/${a}/environment`,{...r,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await q(`/operations/${a}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as xn}from"fs";var An=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function On(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-b6rvv74d.js");await m();return}z("parsed",{t0:Math.round(An)});let e="";try{e=xn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-k3e8mw0p.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}On();export{Di,on,Ni};
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import"./vm-hands-entry-lite-tqc2ezda.js";import"./vm-hands-entry-lite-r7zs4ce2.js";import"./vm-hands-entry-lite-3vmhs921.js";import"./vm-hands-entry-lite-em7mk9tn.js";import{nt,Ki,yr,Tt}from"./vm-hands-entry-lite-
|
|
3
|
-
`)){let n=i.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;t.push({device:n[2],root:ce(n[3]),mountPoint:ce(n[4])})}return t}function
|
|
4
|
-
`).filter(Boolean);p=r.length;let
|
|
5
|
-
`).filter(Boolean).slice(0,1000);if(!
|
|
6
|
-
`).find((
|
|
7
|
-
`).find((a)=>a.startsWith("0::"))?.slice(3)??"";return
|
|
8
|
-
`).find((a)=>a.startsWith("0::"))??""}catch{return!1}let
|
|
9
|
-
`))if(/^\d+$/.test(a))t.push(Number(a))}catch{}let
|
|
10
|
-
`).find((a)=>a.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:i,comm:n,ppid:we(i,t),cgroup:
|
|
11
|
-
`).find((a)=>a.startsWith("0::"))??""}catch{J.delete(e);return}if(
|
|
2
|
+
import"./vm-hands-entry-lite-tqc2ezda.js";import"./vm-hands-entry-lite-r7zs4ce2.js";import"./vm-hands-entry-lite-3vmhs921.js";import"./vm-hands-entry-lite-em7mk9tn.js";import{nt,Ki,yr,Tt}from"./vm-hands-entry-lite-0fwawqma.js";import"./vm-hands-entry-lite-d9g1pzzx.js";import"./vm-hands-entry-lite-499mywh7.js";import"./vm-hands-entry-lite-g9z467dk.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-a3w8m8nb.js";import"./vm-hands-entry-lite-hw26gewc.js";import"./vm-hands-entry-lite-1f2cam25.js";import"./vm-hands-entry-lite-12rzrd95.js";import{or,sr,xt,kt}from"./vm-hands-entry-lite-tvsjy4nb.js";import"./vm-hands-entry-lite-dh8f2h2d.js";import"./vm-hands-entry-lite-t5q30ne0.js";import"./vm-hands-entry-lite-9sa1knn7.js";import"./vm-hands-entry-lite-8j7p91hr.js";import{spawn as Ne}from"child_process";import{chmodSync as Ie,chownSync as Ae,existsSync as j,lstatSync as q,mkdirSync as V,mkdtempSync as De,readdirSync as Y,readFileSync as k,realpathSync as Me,rmdirSync as ue,rmSync as Le,writeFileSync as K}from"fs";import{basename as Te,dirname as He,join as d}from"path";import{readFileSync as oe,readlinkSync as ie}from"fs";import{relative as Oe}from"path";var ae=16;function ce(e){return e.replace(/\\([0-7]{3})/g,(t,i)=>String.fromCharCode(Number.parseInt(i,8)))}function $e(e){let t=[];for(let i of e.split(`
|
|
3
|
+
`)){let n=i.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;t.push({device:n[2],root:ce(n[3]),mountPoint:ce(n[4])})}return t}function xe(e,t,i){let n=e.replace(/\/+$/,"")||"/",u=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),a=(m)=>new Map($e(m).filter((v)=>u(v.mountPoint)).map((v)=>[`${v.mountPoint}\x00${v.device}\x00${v.root}`,v.mountPoint])),c=a(t),p=a(i),b=(m)=>Oe(n,m)||".",P=[...c].filter(([m])=>!p.has(m)).map(([,m])=>b(m)),C=[...p].filter(([m])=>!c.has(m)).map(([,m])=>b(m));return{missing:P,extra:C,referenceCount:c.size,ownCount:p.size}}function le(e,t,i,n="/proc"){let u,a,c=null;try{u=oe(`${n}/1/mountinfo`,"utf8"),a=oe(`${n}/self/mountinfo`,"utf8")}catch(v){let O=v&&typeof v==="object"&&"code"in v&&typeof v.code==="string"?v.code:"unreadable";t("vm_hands.mount_check_unavailable",{code:O});return}try{c=ie(`${n}/1/ns/mnt`)===ie(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:b,referenceCount:P,ownCount:C}=xe(e,u,a),m={reference_count:P,own_count:C,missing_count:p.length,extra_count:b.length,same_namespace:c};if(b.length)t("vm_hands.mount_extra",{...m,extra:b.slice(0,ae)});if(p.length)throw t("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ae)}),i(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var he="/sys/fs/cgroup/reason-payload",D="vm-hands",We="/run/ara-srt/fallbacks.jsonl",G="/reason-person",ze="surface",ee=5000,Be=1e4,de="__VM_HANDS_PROOF_DIR__",Ue="__VM_HANDS_PROBE_NONCE__";class y extends Error{code;constructor(e,t){super(t);this.code=e}}function Fe(e,t){if(!/^[0-9a-f-]{36}$/i.test(t))throw new y("vm_hands_bind_invalid","bad bind id");return d(e,D,`b-${t.toLowerCase()}`)}var Ke=5000,ye=(e)=>`'${e.replaceAll("'","'\\''")}'`;function je(e,t){if(!t||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(t))return e;let i=d(He(e),t.toLowerCase());return Te(e).toLowerCase()===t.toLowerCase()?e:i}function ln(e){let t=e.cgroup??he,i=e.init.layout.payload_uid,n=e.log??(()=>{}),u=(r)=>je(e.init.layout.session_root,r),a=new Map,c=new Map,p=0,b=()=>{try{let r=k("/run/ara-srt/starts.jsonl","utf8"),s=r.slice(p>r.length?0:p).split(`
|
|
4
|
+
`).filter(Boolean);p=r.length;let l=s.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(l.length)n("vm_hands.srt_server_starts",{count:l.length,elapsed_ms:l.slice(0,8)})}catch{}},P=null,C=!1,m=e.srtCgroup??"/sys/fs/cgroup/reason-srt",v=()=>{P??=pe()},O=0,N=()=>{try{let r=k(We,"utf8"),s=r.slice(O>r.length?0:O);O=r.length;let l=s.split(`
|
|
5
|
+
`).filter(Boolean).slice(0,1000);if(!l.length)return null;let f={},g=0;for(let S of l)try{let _=JSON.parse(S),h=typeof _.code==="string"&&/^[a-z_]{1,40}$/.test(_.code)?_.code:"other";if(f[h]=(f[h]??0)+1,typeof _.elapsed_ms==="number")g=Math.max(g,_.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return n("vm_hands.srt_fallbacks",{count:l.length,codes:f,max_elapsed_ms:g}),{count:l.length,codes:f,max_elapsed_ms:g}}catch{return null}},x=(r,s,l)=>F(r,s,l),H=(r)=>(s,l,f)=>Ne("/bin/sh",["-c",`echo $$ > ${ye(d(r,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",s,...l],f),F=H(d(t,D)),W=d(t,D,"probe"),z=(r)=>Fe(t,r),ke=(r)=>{let s=z(r);try{V(s,{mode:493})}catch(l){if(!(l&&typeof l==="object"&&("code"in l)&&l.code==="EEXIST"))throw new y("vm_hands_bind_failed","bind cgroup")}return s},Pe=(r)=>{try{ue(z(r))}catch{}},B=e.prespawn?Ki({spawnProcess:x,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(r,s)=>n(r,s??{})}):null;B?.arm();let Z=B?setInterval(()=>{B.arm()},Ke):null;Z?.unref?.();async function X(r){let s=a.get(r);if(a.delete(r),!s)return;s.abort.abort(),await s.done}return{bindCgroup:z,async startExecutor(r){if(v(),c.set(r.bindId,pe()),C=!0,!r.claim)throw new y("vm_hands_bind_invalid","an executor needs the claim it serves");await X(r.bindId);let{claim:s,bindId:l}=r,f=ke(l),g=s.owner;if(!g||typeof g.device_id!=="string"||typeof s.root_id!=="string")throw new y("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,_,h,I=new Promise((o,w)=>{_=o,h=w}),A,R=new Promise((o)=>{A=o}),U=Tt({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,deviceIdentity:{deviceId:g.device_id,rootId:s.root_id,apiOrigin:e.apiOrigin},claimOwner:s.owner,root:e.root,runId:s.run_id,operationId:s.operation_id,attemptId:s.attempt_id,payload:Object.fromEntries(Object.entries(s.payload).filter(([o])=>!o.startsWith("vm_hands_"))),signal:S.signal,...r.workspaceGrant?{workspaceGrant:r.workspaceGrant}:{},emitEvent:async(o,w)=>{if(o==="hands.ready"){_(w);return}if(o==="hands.started"||o==="hands.stopped"||o==="hands.failed")return;await e.forward(l,o,w)}},{...e.relayDependencies,spawnWorker:(o)=>H(f)(o.command,o.args,o.options),...B?{takePrespawnedWorker:(o)=>{let w=B.take(o);if(!w?.pid)return w;try{return K(d(f,"cgroup.procs"),String(w.pid)),w}catch{try{w.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:B.adopt}:{}}).then(()=>{A("executor_stopped")},(o)=>{let w=o&&typeof o==="object"&&"code"in o?String(o.code):"executor_failed";h(new y(w,o instanceof Error?o.message:String(o))),A(w)}).finally(()=>h(new y("vm_hands_executor_exited","executor ended before it was ready")));a.set(l,{abort:S,done:U,exited:R,operationId:s.operation_id,runId:s.run_id,expiresAtMs:Date.parse(String(s.payload.expires_at??""))||0});let M=await I,E=M.executor_launch_id;if(typeof E!=="string")throw new y("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:M,applied:{hands_confinement:typeof s.payload.hands_confinement==="string"?s.payload.hands_confinement:null,browser_egress:s.payload.browser_egress??null}}},takeSrtFallbacks:N,executorExited(r){return a.get(r)?.exited??new Promise(()=>{})},freezeBind(r){let s=z(r);if(j(d(s,"cgroup.freeze")))K(d(s,"cgroup.freeze"),"1")},async killAndVerifyPayload(r){let s=new Set(r?.keep??[]);if(await Ce(r?.bindId??null,s,r?.own===!0),s.size)return;if((C||e.srtWarmLate?.()===!0)&&j(d(m,"cgroup.events")))b(),await te(m,Date.now()+ee,"srt"),e.onSrtReset?.();C=!1},async killProbe(){let r=Date.now()+ee;if(j(d(W,"cgroup.events"))){await te(W,r,"probe");try{ue(W)}catch{}}let s=se(process.pid);if(s===null)throw new y("vm_hands_kill_unverified","agent start time unreadable");await Ge(t,s,r);let l=(g)=>{let S=se(g);return S!==null&&S<=s},f=me(i).filter((g)=>l(g)&&!L(g,G));if(f.length)throw n("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest"}),new y("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(P!==null){let g=[t,d(t,D)].map((h)=>h.replace(/^\/sys\/fs\/cgroup/,"")),S=m.replace(/^\/sys\/fs\/cgroup/,""),_=fe(P).filter((h)=>h!==process.pid&&!L(h,G)&&!L(h,"/reason-vm-hands")&&!L(h,S)&&!g.some((I)=>ne(h,I)));if(_.length&&C)throw n("vm_hands.kill_strays",{strays:re(_),at:"attest"}),new y("vm_hands_kill_unverified",`${_.length} process(es) the run started survived it`);if(_.length)n("vm_hands.attest_concurrent",{processes:re(_),count:_.length});P=null}},async runProbe({nonce:r,script:s}){if(v(),!s.includes(de))throw new y("vm_hands_probe_failed","probe names no proof directory");let l=e.proofParent??"/tmp/reason-vm-hands-proof";V(l,{mode:457,recursive:!0});let f=q(l);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new y("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=De(d(l,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(r))throw new y("vm_hands_probe_failed","proof directory path or nonce");Ae(g,i,i),Ie(g,448);let _=q(g).ino;try{V(W,{mode:493})}catch(R){if(!(R&&typeof R==="object"&&("code"in R)&&R.code==="EEXIST"))throw new y("vm_hands_probe_failed","probe cgroup")}let h=H(W)("/bin/bash",["-c",s.replaceAll(de,g).replaceAll(Ue,r)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),I="";h.stdout?.on("data",(R)=>{if(I.length<16384)I+=R.toString("utf8").slice(0,16384-I.length)});let A=await new Promise((R)=>{let U=setTimeout(()=>{S=!0,h.kill("SIGKILL"),R(124)},Be);h.once("error",()=>{clearTimeout(U),R(127)}),h.once("close",(M)=>{clearTimeout(U),R(M??1)})});return n("vm_hands.probe",{nonce_len:r.length,exit_code:A}),{exitCode:A,markers:I,proofDirInode:_}}finally{if(!S)Le(g,{recursive:!0,force:!0})}},restatLayout(r){let s=u(r),l=s===e.init.layout.session_root?e.init.layout.alias:d(s,"repo"),f="invalid";try{yr(s),f="0:0:755"}catch{}let g=!1,S=-1;try{let _=q(l);S=_.uid,g=f==="0:0:755"&&l===d(s,"repo")&&!_.isSymbolicLink()&&_.isDirectory()&&Me(l)===l&&_.uid===i}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(r){let s=u(r);try{le(s,n,(l)=>new y("vm_hands_mount_mismatch",l))}catch(l){if(s!==e.init.layout.session_root&&l instanceof y&&l.code==="vm_hands_mount_mismatch"){n("vm_hands.member_mount_mismatch_served",{});return}throw l}},installEnvironment(r,s){let l=a.get(r);if(!l)throw new y("environment_unavailable","no executor owns an environment");return nt({root:e.root,operationId:l.operationId,payload:s}).installed_revision},async stop(){if(Z)clearInterval(Z);B?.close(),await Promise.all([...a.keys()].map((r)=>X(r)))}};function Re(){try{return Y(d(t,D),{withFileTypes:!0}).filter((r)=>r.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(r.name)).map((r)=>r.name)}catch{return[]}}async function Ce(r,s,l=!1){let f=new Set([...s].map((S)=>S.toLowerCase())),g=Ve();try{await Ye();let S=Date.now()+ee,_=new Set(Re().filter((o)=>!f.has(o.slice(2))).map((o)=>o.slice(2)));if(r)_.add(r.toLowerCase());let h=null;for(let o of _){let w=X(o).catch(()=>{return}),Q=c.get(o);if(Q!==void 0)h=h===null?Q:Math.min(h,Q);if(j(d(z(o),"cgroup.events")))await te(z(o),S,"bind");await w}let I=[...f].map((o)=>z(o).replace(/^\/sys\/fs\/cgroup/,"")),A=["/",...[t,d(t,D)].map((o)=>o.replace(/^\/sys\/fs\/cgroup/,""))],R=m.replace(/^\/sys\/fs\/cgroup/,""),U=(o)=>L(o,G)||I.some((w)=>L(o,w))||A.some((w)=>ne(o,w)),M=l?[]:me(i).filter((o)=>!U(o));if(M.length)throw n("vm_hands.kill_survivors",{pids:M.slice(0,16),beside:f.size}),new y("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside a live bind`);let E=(o)=>!U(o)&&!L(o,"/reason-vm-hands")&&!L(o,R)&&!A.some((w)=>ne(o,w));if(h!==null){let o=fe(h).filter((w)=>w!==process.pid&&E(w));if(o.length)throw n("vm_hands.kill_strays",{strays:re(o),beside:f.size}),new y("vm_hands_kill_unverified",`${o.length} process(es) the run started survived it`)}for(let o of _)c.delete(o),Pe(o)}finally{g()}}}function se(e,t="/proc"){try{let i=k(d(t,String(e),"stat"),"utf8"),n=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function we(e,t="/proc"){try{let i=k(d(t,String(e),"stat"),"utf8"),n=Number(i.slice(i.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ge(e,t,i){try{K(d(e,"cgroup.freeze"),"1")}catch(n){throw new y("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=be(e).filter((a)=>ve(a,e)),u=new Set(n.filter((a)=>{let c=se(a);return c!==null&&c<=t}));for(let a=!0;a;){a=!1;for(let c of n){if(u.has(c))continue;let p=we(c);if(p!==null&&u.has(p))u.add(c),a=!0}}if(u.size===0)return;if(Date.now()>i)throw new y("vm_hands_kill_unverified",`${u.size} previous-boot process(es) survived`);for(let a of u)try{process.kill(a,"SIGKILL")}catch{}await new Promise((a)=>setTimeout(a,10))}}finally{try{K(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,t,i="/proc"){try{return k(d(i,String(e),"cgroup"),"utf8").split(`
|
|
6
|
+
`).find((u)=>u.startsWith("0::"))?.slice(3)===t}catch{return!1}}function L(e,t,i="/proc"){try{let u=k(d(i,String(e),"cgroup"),"utf8").split(`
|
|
7
|
+
`).find((a)=>a.startsWith("0::"))?.slice(3)??"";return u===t||u.startsWith(`${t}/`)}catch{return!1}}var Ee=100;function pe(){try{return Math.floor(Number(k("/proc/uptime","utf8").split(" ")[0])*Ee)}catch{return 0}}async function te(e,t,i){try{K(d(e,"cgroup.freeze"),"1")}catch(n){throw new y("vm_hands_kill_unverified",`${i} cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}while(!/^populated 0$/m.test(k(d(e,"cgroup.events"),"utf8"))){if(Date.now()>t)throw new y("vm_hands_kill_unverified",`${i} cgroup still populated (left frozen)`);for(let n of be(e)){if(!ve(n,e))continue;try{process.kill(n,"SIGKILL")}catch{}}await new Promise((n)=>setTimeout(n,10))}try{K(d(e,"cgroup.freeze"),"0")}catch(n){throw new y("vm_hands_kill_unverified",`${i} cgroup thaw: ${n instanceof Error?n.message:String(n)}`)}}function ve(e,t){let i=t.replace(/^\/sys\/fs\/cgroup/,"")||"/",n="";try{n=k(`/proc/${e}/cgroup`,"utf8").split(`
|
|
8
|
+
`).find((a)=>a.startsWith("0::"))??""}catch{return!1}let u=n.slice(3);return u===i||u.startsWith(`${i}/`)}function be(e){let t=[],i=(n)=>{try{for(let a of k(d(n,"cgroup.procs"),"utf8").split(`
|
|
9
|
+
`))if(/^\d+$/.test(a))t.push(Number(a))}catch{}let u=[];try{u=Y(n,{withFileTypes:!0}).filter((a)=>a.isDirectory()).map((a)=>a.name)}catch{}for(let a of u)i(d(n,a))};return i(e),t}function re(e,t="/proc"){return e.slice(0,16).map((i)=>{let n="?",u="?";try{n=k(d(t,String(i),"comm"),"utf8").trim().slice(0,32)}catch{}try{u=(k(d(t,String(i),"cgroup"),"utf8").split(`
|
|
10
|
+
`).find((a)=>a.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:i,comm:n,ppid:we(i,t),cgroup:u}})}function fe(e,t="/proc"){let i=[];for(let n of Y(t)){if(!/^\d+$/.test(n))continue;let u;try{u=k(d(t,n,"stat"),"utf8")}catch{continue}let a=u.slice(u.lastIndexOf(")")+2).split(" "),c=Number(a[1]),p=Number(a[6]),b=Number(a[19]);if(!((p&2097152)!==0||c===2||n==="2")&&a[0]!=="Z"&&b>=e)i.push(Number(n))}return i}function me(e,t="/proc"){let i=[];for(let n of Y(t)){if(!/^\d+$/.test(n))continue;let u;try{u=k(d(t,n,"status"),"utf8")}catch{continue}let a=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(u);if(a&&a.slice(1).some((c)=>Number(c)===e))i.push(Number(n))}return i}function ge(e="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(k(e,"utf8").trim())>=1}catch{return!1}}var T=0,Se=[],J=new Set;function Ve(){T++;let e=!1;return()=>{if(e)return;if(e=!0,--T===0)for(let t of Se.splice(0))t()}}function Je(){return T===0?Promise.resolve():new Promise((e)=>{Se.push(e)})}async function _e(){while(T>0)await Je()}async function Ye(){let e=Date.now()+1000;while(J.size&&Date.now()<e)await new Promise((t)=>setTimeout(t,2))}function Ze(e,t){let i=t.replace(/^\/sys\/fs\/cgroup/,"");J.add(e);let n=()=>{let u="";try{u=k(`/proc/${e}/cgroup`,"utf8").split(`
|
|
11
|
+
`).find((a)=>a.startsWith("0::"))??""}catch{J.delete(e);return}if(u.slice(3)===i){J.delete(e);return}setTimeout(n,1)};n()}function un(e){let t={person:e.personCgroup??d("/sys/fs/cgroup",G,D),model:e.payloadCgroup??d(he,D),surface:e.surfaceCgroup??d("/sys/fs/cgroup",G,D,ze)},i=e.entry??process.argv[1]??"",n={},u=(c)=>c.startsWith("model:")&&e.bindCgroup?e.bindCgroup(c.slice(6)):t[c.startsWith("model")?"model":c==="surface"?"surface":"person"],a=(c)=>{let p=c.startsWith("model")?"model":c==="surface"?"surface":"person",b=new Map,P=String(e.payloadUid),C=String(e.payloadGid);if(p==="surface")try{V(u(c),{mode:493})}catch{}let m=p==="surface"?'exec "$@"':`exec /usr/bin/setpriv --no-new-privs --reuid=${P} --regid=${C} --clear-groups -- "$@"`,v=Bun.spawn(["/bin/sh","-c",`echo $$ > ${ye(d(u(c),"cgroup.procs"))} || exit 125; ${m}`,"vm-hands-op-join",process.execPath,"--no-install",i,"--vm-hands-op-runner",...p==="person"?[or]:[],...p==="surface"?[sr,`${xt}${P}`,`${kt}${e.surfaceDirectory??""}`]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:p==="surface"?process.env.HOME||"/root":"/home/runner",...j("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(N){let x=N;if(p==="surface"&&x.t==="readiness"){let F=N;e.log?.("vm_hands.surface_ready",{lanes:Object.keys(F.lanes??{}).filter((W)=>F.lanes[W]===!0),display_video:F.display_video===!0}),e.onSurfaceReadiness?.(F);return}let H=b.get(x.id);if(!H)return;if(x.t==="event"&&x.event)H.onEvent(x.event);if(x.t==="done")b.delete(x.id),H.done(x.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});v.exited.then((N)=>{if(n[c]?.child===v)delete n[c];for(let[,x]of b)x.done({status:"failed",error_code:"vm_hands_op_runner_exited"});if(b.clear(),e.log?.("vm_hands.op_runner_exited",{kind:p,code:N}),p==="surface")e.onSurfaceReadiness?.(null)}),Ze(v.pid,u(c));let O={child:v,pending:b};return n[c]=O,O};return{run(c,p,b,P,C){if(!ge())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=c==="model"&&C&&e.bindCgroup?`model:${C.toLowerCase()}`:c,v=async()=>{while(!n[m]&&T>0)await _e()};return v().then(async()=>{if(!n[m]&&T>0)await v()}).then(()=>new Promise((O)=>{if(!n[m]&&T>0){O({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let N=n[m]??a(m);N.pending.set(p.id,{onEvent:b,done:O}),P.addEventListener("abort",()=>{try{N.child.send({t:"cancel",id:p.id})}catch{}},{once:!0});try{N.child.send({t:"op",...p})}catch{N.pending.delete(p.id),O({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(c){if(!n[c]&&ge())_e().then(()=>{if(!n[c]&&T===0)a(c)})},notify(c,p){let b=n[c];if(!b)return!1;try{return b.child.send(p),!0}catch{return!1}},stop(){for(let c of Object.keys(n))n[c]?.child.kill()}}}export{he as VM_HANDS_PAYLOAD_CGROUP,D as VM_HANDS_PAYLOAD_JOIN,G as VM_HANDS_PERSON_CGROUP,Ue as VM_HANDS_PROBE_NONCE_TOKEN,de as VM_HANDS_PROOF_DIR_TOKEN,ze as VM_HANDS_SURFACE_JOIN,y as VmHandsExecutorError,ln as createVmHandsExecutor,un as createVmHandsOpRunners,re as describeProcesses,L as inCgroup,me as payloadUidProcesses,fe as processesStartedSince,ge as ptraceProtected,be as subtreePids,Fe as vmHandsBindCgroup,je as vmHandsSessionRoot};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{or,sr,xt,kt,Ct,os}from"./vm-hands-entry-lite-
|
|
2
|
+
import{or,sr,xt,kt,Ct,os}from"./vm-hands-entry-lite-tvsjy4nb.js";export{or as VM_HANDS_OP_RUNNER_PERSON_ARG,sr as VM_HANDS_OP_RUNNER_SURFACE_ARG,kt as VM_HANDS_SURFACE_DIRECTORY_ARG,Ct as VM_HANDS_SURFACE_OPS,xt as VM_HANDS_SURFACE_UID_ARG,os as runVmHandsOpRunner};
|