@reason-machines/cli-linux-x64 0.2.434 → 0.2.437

package/bin/vm-hands/vm-hands-executor-ppyrw9vz.js

@@ -1,12 +0,0 @@
-// @bun
-import"./vm-hands-entry-lite-tqc2ezda.js";import"./vm-hands-entry-lite-r7zs4ce2.js";import"./vm-hands-entry-lite-3vmhs921.js";import"./vm-hands-entry-lite-em7mk9tn.js";import{nt,Ki,yr,Tt}from"./vm-hands-entry-lite-qnbc2bt1.js";import"./vm-hands-entry-lite-d9g1pzzx.js";import"./vm-hands-entry-lite-499mywh7.js";import"./vm-hands-entry-lite-g9z467dk.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-a3w8m8nb.js";import"./vm-hands-entry-lite-hw26gewc.js";import"./vm-hands-entry-lite-1f2cam25.js";import"./vm-hands-entry-lite-12rzrd95.js";import{or,sr,xt,kt}from"./vm-hands-entry-lite-5vwss606.js";import"./vm-hands-entry-lite-dh8f2h2d.js";import"./vm-hands-entry-lite-t5q30ne0.js";import"./vm-hands-entry-lite-9sa1knn7.js";import"./vm-hands-entry-lite-8j7p91hr.js";import{spawn as De}from"child_process";import{chmodSync as Ae,chownSync as Me,existsSync as j,lstatSync as Q,mkdirSync as E,mkdtempSync as Le,readdirSync as J,readFileSync as k,realpathSync as Te,rmdirSync as de,rmSync as We,writeFileSync as K}from"fs";import{basename as He,dirname as ze,join as d}from"path";import{readFileSync as ie,readlinkSync as ae}from"fs";import{relative as $e}from"path";var ce=16;function ue(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Ie(e){let r=[];for(let t of e.split(`
-`)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:ue(n[3]),mountPoint:ue(n[4])})}return r}function Ne(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(Ie(m).filter((v)=>c(v.mountPoint)).map((v)=>[`${v.mountPoint}\x00${v.device}\x00${v.root}`,v.mountPoint])),u=o(r),p=o(t),b=(m)=>$e(n,m)||".",P=[...u].filter(([m])=>!p.has(m)).map(([,m])=>b(m)),C=[...p].filter(([m])=>!u.has(m)).map(([,m])=>b(m));return{missing:P,extra:C,referenceCount:u.size,ownCount:p.size}}function le(e,r,t,n="/proc"){let c,o,u=null;try{c=ie(`${n}/1/mountinfo`,"utf8"),o=ie(`${n}/self/mountinfo`,"utf8")}catch(v){let O=v&&typeof v==="object"&&"code"in v&&typeof v.code==="string"?v.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{u=ae(`${n}/1/ns/mnt`)===ae(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:b,referenceCount:P,ownCount:C}=Ne(e,c,o),m={reference_count:P,own_count:C,missing_count:p.length,extra_count:b.length,same_namespace:u};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ce)});if(p.length)throw r("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ce)}),t(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var we="/sys/fs/cgroup/reason-payload",M="vm-hands",Ue="/run/ara-srt/fallbacks.jsonl",se="/reason-person",Be="/reason-workload",q=(e)=>B(e,se)||B(e,Be),Fe="surface",ee=5000,Ke=1e4,pe="__VM_HANDS_PROOF_DIR__",je="__VM_HANDS_PROBE_NONCE__";class y extends Error{code;constructor(e,r){super(r);this.code=e}}function Ge(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new y("vm_hands_bind_invalid","bad bind id");return d(e,M,`b-${r.toLowerCase()}`)}var Ee=5000,ve=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Ve(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=d(ze(e),r.toLowerCase());return He(e).toLowerCase()===r.toLowerCase()?e:t}function mn(e){let r=e.cgroup??we,t=e.init.layout.payload_uid,n=e.log??(()=>{}),c=(s)=>Ve(e.init.layout.session_root,s),o=new Map,u=new Map,p=0,b=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(p>s.length?0:p).split(`
-`).filter(Boolean);p=s.length;let l=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(l.length)n("vm_hands.srt_server_starts",{count:l.length,elapsed_ms:l.slice(0,8)})}catch{}},P=null,C=!1,m=e.srtCgroup??"/sys/fs/cgroup/reason-srt",v=()=>{P??=fe()},O=0,I=()=>{try{let s=k(Ue,"utf8"),i=s.slice(O>s.length?0:O);O=s.length;let l=i.split(`
-`).filter(Boolean).slice(0,1000);if(!l.length)return null;let f={},g=0;for(let S of l)try{let h=JSON.parse(S),_=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[_]=(f[_]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return n("vm_hands.srt_fallbacks",{count:l.length,codes:f,max_elapsed_ms:g}),{count:l.length,codes:f,max_elapsed_ms:g}}catch{return null}},x=(s,i,l)=>F(s,i,l),T=(s)=>(i,l,f)=>De("/bin/sh",["-c",`echo $$ > ${ve(d(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...l],f),F=T(d(r,M)),W=d(r,M,"probe"),H=(s)=>Ge(r,s),Re=(s)=>{let i=H(s);try{E(i,{mode:493})}catch(l){if(!(l&&typeof l==="object"&&("code"in l)&&l.code==="EEXIST"))throw new y("vm_hands_bind_failed","bind cgroup")}return i},Ce=(s)=>{try{de(H(s))}catch{}},z=e.prespawn?Ki({spawnProcess:x,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>n(s,i??{})}):null;z?.arm();let Y=z?setInterval(()=>{z.arm()},Ee):null;Y?.unref?.();async function Z(s){let i=o.get(s);if(o.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:H,async startExecutor(s){if(v(),u.set(s.bindId,fe()),C=!0,!s.claim)throw new y("vm_hands_bind_invalid","an executor needs the claim it serves");await Z(s.bindId);let{claim:i,bindId:l}=s,f=Re(l),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new y("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,_,N=new Promise((a,w)=>{h=a,_=w}),D,R=new Promise((a)=>{D=a}),U=Tt({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,w)=>{if(a==="hands.ready"){h(w);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(l,a,w)}},{...e.relayDependencies,spawnWorker:(a)=>T(f)(a.command,a.args,a.options),...z?{takePrespawnedWorker:(a)=>{let w=z.take(a);if(!w?.pid)return w;try{return K(d(f,"cgroup.procs"),String(w.pid)),w}catch{try{w.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:z.adopt}:{}}).then(()=>{D("executor_stopped")},(a)=>{let w=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";_(new y(w,a instanceof Error?a.message:String(a))),D(w)}).finally(()=>_(new y("vm_hands_executor_exited","executor ended before it was ready")));o.set(l,{abort:S,done:U,exited:R,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0});let A=await N,G=A.executor_launch_id;if(typeof G!=="string")throw new y("vm_hands_bind_failed","executor ready without a launch id");return{launchId:G,readyData:A,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:I,executorExited(s){return o.get(s)?.exited??new Promise(()=>{})},freezeBind(s){let i=H(s);if(j(d(i,"cgroup.freeze")))K(d(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){let i=new Set(s?.keep??[]);if(await xe(s?.bindId??null,i,s?.own===!0),i.size)return;if((C||e.srtWarmLate?.()===!0)&&j(d(m,"cgroup.events")))b(),await te(m,Date.now()+ee,"srt"),e.onSrtReset?.();C=!1},async killProbe(){let s=Date.now()+ee;if(j(d(W,"cgroup.events"))){await te(W,s,"probe");try{de(W)}catch{}}let i=oe(process.pid);if(i===null)throw new y("vm_hands_kill_unverified","agent start time unreadable");await Je(r,i,s);let l=(g)=>{let S=oe(g);return S!==null&&S<=i},f=he(t).filter((g)=>l(g)&&!q(g));if(f.length)throw n("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...me(f)}),new y("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(P!==null){let g=[r,d(r,M)].map((_)=>_.replace(/^\/sys\/fs\/cgroup/,"")),S=m.replace(/^\/sys\/fs\/cgroup/,""),h=ge(P).filter((_)=>_!==process.pid&&!q(_)&&!B(_,"/reason-vm-hands")&&!B(_,S)&&!g.some((N)=>ne(_,N)));if(h.length&&C)throw n("vm_hands.kill_strays",{strays:re(h),at:"attest"}),new y("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)n("vm_hands.attest_concurrent",{processes:re(h),count:h.length});P=null}},async runProbe({nonce:s,script:i}){if(v(),!i.includes(pe))throw new y("vm_hands_probe_failed","probe names no proof directory");let l=e.proofParent??"/tmp/reason-vm-hands-proof";E(l,{mode:457,recursive:!0});let f=Q(l);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new y("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Le(d(l,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new y("vm_hands_probe_failed","proof directory path or nonce");Me(g,t,t),Ae(g,448);let h=Q(g).ino;try{E(W,{mode:493})}catch(R){if(!(R&&typeof R==="object"&&("code"in R)&&R.code==="EEXIST"))throw new y("vm_hands_probe_failed","probe cgroup")}let _=T(W)("/bin/bash",["-c",i.replaceAll(pe,g).replaceAll(je,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),N="";_.stdout?.on("data",(R)=>{if(N.length<16384)N+=R.toString("utf8").slice(0,16384-N.length)});let D=await new Promise((R)=>{let U=setTimeout(()=>{S=!0,_.kill("SIGKILL"),R(124)},Ke);_.once("error",()=>{clearTimeout(U),R(127)}),_.once("close",(A)=>{clearTimeout(U),R(A??1)})});return n("vm_hands.probe",{nonce_len:s.length,exit_code:D}),{exitCode:D,markers:N,proofDirInode:h}}finally{if(!S)We(g,{recursive:!0,force:!0})}},restatLayout(s){let i=c(s),l=i===e.init.layout.session_root?e.init.layout.alias:d(i,"repo"),f="invalid";try{yr(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=Q(l);S=h.uid,g=f==="0:0:755"&&l===d(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&Te(l)===l&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=c(s);try{le(i,n,(l)=>new y("vm_hands_mount_mismatch",l))}catch(l){if(i!==e.init.layout.session_root&&l instanceof y&&l.code==="vm_hands_mount_mismatch"){n("vm_hands.member_mount_mismatch_served",{});return}throw l}},installEnvironment(s,i){let l=o.get(s);if(!l)throw new y("environment_unavailable","no executor owns an environment");return nt({root:e.root,operationId:l.operationId,payload:i}).installed_revision},async stop(){if(Y)clearInterval(Y);z?.close(),await Promise.all([...o.keys()].map((s)=>Z(s)))}};function Oe(){try{return J(d(r,M),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function xe(s,i,l=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=Qe();try{await en();let S=Date.now()+ee,h=new Set(Oe().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let _=null;for(let a of h){let w=Z(a).catch(()=>{return}),X=u.get(a);if(X!==void 0)_=_===null?X:Math.min(_,X);if(j(d(H(a),"cgroup.events")))await te(H(a),S,"bind");await w}let N=[...f].map((a)=>H(a).replace(/^\/sys\/fs\/cgroup/,"")),D=["/",...[r,d(r,M)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],R=m.replace(/^\/sys\/fs\/cgroup/,""),U=(a)=>q(a)||N.some((w)=>B(a,w))||D.some((w)=>ne(a,w)),A=l?[]:he(t).filter((a)=>!U(a));if(A.length)throw n("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size,...me(A)}),new y("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let G=(a)=>!U(a)&&!B(a,"/reason-vm-hands")&&!B(a,R)&&!D.some((w)=>ne(a,w));if(_!==null){let a=ge(_).filter((w)=>w!==process.pid&&G(w));if(a.length)throw n("vm_hands.kill_strays",{strays:re(a),beside:f.size}),new y("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)u.delete(a),Ce(a)}finally{g()}}}function oe(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function be(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Je(e,r,t){try{K(d(e,"cgroup.freeze"),"1")}catch(n){throw new y("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=ke(e).filter((o)=>Se(o,e)),c=new Set(n.filter((o)=>{let u=oe(o);return u!==null&&u<=r}));for(let o=!0;o;){o=!1;for(let u of n){if(c.has(u))continue;let p=be(u);if(p!==null&&c.has(p))c.add(u),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new y("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{K(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,r,t="/proc"){try{return k(d(t,String(e),"cgroup"),"utf8").split(`
-`).find((c)=>c.startsWith("0::"))?.slice(3)===r}catch{return!1}}function B(e,r,t="/proc"){try{let c=k(d(t,String(e),"cgroup"),"utf8").split(`
-`).find((o)=>o.startsWith("0::"))?.slice(3)??"";return c===r||c.startsWith(`${r}/`)}catch{return!1}}var Ye=100;function fe(){try{return Math.floor(Number(k("/proc/uptime","utf8").split(" ")[0])*Ye)}catch{return 0}}async function te(e,r,t){try{K(d(e,"cgroup.freeze"),"1")}catch(n){throw new y("vm_hands_kill_unverified",`${t} cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}while(!/^populated 0$/m.test(k(d(e,"cgroup.events"),"utf8"))){if(Date.now()>r)throw new y("vm_hands_kill_unverified",`${t} cgroup still populated (left frozen)`);for(let n of ke(e)){if(!Se(n,e))continue;try{process.kill(n,"SIGKILL")}catch{}}await new Promise((n)=>setTimeout(n,10))}try{K(d(e,"cgroup.freeze"),"0")}catch(n){throw new y("vm_hands_kill_unverified",`${t} cgroup thaw: ${n instanceof Error?n.message:String(n)}`)}}function Se(e,r){let t=r.replace(/^\/sys\/fs\/cgroup/,"")||"/",n="";try{n=k(`/proc/${e}/cgroup`,"utf8").split(`
-`).find((o)=>o.startsWith("0::"))??""}catch{return!1}let c=n.slice(3);return c===t||c.startsWith(`${t}/`)}function ke(e){let r=[],t=(n)=>{try{for(let o of k(d(n,"cgroup.procs"),"utf8").split(`
-`))if(/^\d+$/.test(o))r.push(Number(o))}catch{}let c=[];try{c=J(n,{withFileTypes:!0}).filter((o)=>o.isDirectory()).map((o)=>o.name)}catch{}for(let o of c)t(d(n,o))};return t(e),r}function me(e,r="/proc"){let t=new Map;for(let c of e.slice(0,64)){let o=`${Ze(c,r)}:${Xe(c,r)}`;t.set(o,(t.get(o)??0)+1)}let n=[...t.entries()].sort((c,o)=>o[1]-c[1])[0]?.[0]??"none";return{count:e.length,cause:n}}function Ze(e,r){let t;try{t=(k(d(r,String(e),"cgroup"),"utf8").split(`
-`).find((n)=>n.startsWith("0::"))??"").slice(3)}catch{return"gone"}if(t==="/")return"root";if(t==="/reason-payload")return"payload";if(t.startsWith("/reason-payload/vm-hands/b-"))return"payload_bind";if(t==="/reason-payload/vm-hands"||t.startsWith("/reason-payload/vm-hands/"))return"payload_vm_hands";if(t.startsWith("/reason-payload/"))return"payload_sub";if(t==="/reason-person"||t.startsWith("/reason-person/"))return"person";if(t==="/reason-srt"||t.startsWith("/reason-srt/"))return"srt";if(t==="/reason-vm-hands"||t.startsWith("/reason-vm-hands/"))return"vm_hands";if(t==="/reason-workload"||t.startsWith("/reason-workload/"))return"workload";return"other"}function Xe(e,r){let t;try{t=k(d(r,String(e),"stat"),"utf8")}catch{return"gone"}let n=t.slice(t.lastIndexOf(")")+2,t.lastIndexOf(")")+3);return{R:"running",S:"sleeping",D:"disk",Z:"zombie",T:"stopped",t:"stopped",I:"idle"}[n]??"other"}function re(e,r="/proc"){return e.slice(0,16).map((t)=>{let n="?",c="?";try{n=k(d(r,String(t),"comm"),"utf8").trim().slice(0,32)}catch{}try{c=(k(d(r,String(t),"cgroup"),"utf8").split(`
-`).find((o)=>o.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:t,comm:n,ppid:be(t,r),cgroup:c}})}function ge(e,r="/proc"){let t=[];for(let n of J(r)){if(!/^\d+$/.test(n))continue;let c;try{c=k(d(r,n,"stat"),"utf8")}catch{continue}let o=c.slice(c.lastIndexOf(")")+2).split(" "),u=Number(o[1]),p=Number(o[6]),b=Number(o[19]);if(!((p&2097152)!==0||u===2||n==="2")&&o[0]!=="Z"&&b>=e)t.push(Number(n))}return t}function he(e,r="/proc"){let t=[];for(let n of J(r)){if(!/^\d+$/.test(n))continue;let c;try{c=k(d(r,n,"status"),"utf8")}catch{continue}let o=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(c);if(o&&o.slice(1).some((u)=>Number(u)===e))t.push(Number(n))}return t}function _e(e="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(k(e,"utf8").trim())>=1}catch{return!1}}var L=0,Pe=[],V=new Set;function Qe(){L++;let e=!1;return()=>{if(e)return;if(e=!0,--L===0)for(let r of Pe.splice(0))r()}}function qe(){return L===0?Promise.resolve():new Promise((e)=>{Pe.push(e)})}async function ye(){while(L>0)await qe()}async function en(){let e=Date.now()+1000;while(V.size&&Date.now()<e)await new Promise((r)=>setTimeout(r,2))}function nn(e,r){let t=r.replace(/^\/sys\/fs\/cgroup/,"");V.add(e);let n=()=>{let c="";try{c=k(`/proc/${e}/cgroup`,"utf8").split(`
-`).find((o)=>o.startsWith("0::"))??""}catch{V.delete(e);return}if(c.slice(3)===t){V.delete(e);return}setTimeout(n,1)};n()}function gn(e){let r={person:e.personCgroup??d("/sys/fs/cgroup",se,M),model:e.payloadCgroup??d(we,M),surface:e.surfaceCgroup??d("/sys/fs/cgroup",se,M,Fe)},t=e.entry??process.argv[1]??"",n={},c=(u)=>u.startsWith("model:")&&e.bindCgroup?e.bindCgroup(u.slice(6)):r[u.startsWith("model")?"model":u==="surface"?"surface":"person"],o=(u)=>{let p=u.startsWith("model")?"model":u==="surface"?"surface":"person",b=new Map,P=String(e.payloadUid),C=String(e.payloadGid);if(p==="surface")try{E(c(u),{mode:493})}catch{}let m=p==="surface"?'exec "$@"':`exec /usr/bin/setpriv --no-new-privs --reuid=${P} --regid=${C} --clear-groups -- "$@"`,v=Bun.spawn(["/bin/sh","-c",`echo $$ > ${ve(d(c(u),"cgroup.procs"))} || exit 125; ${m}`,"vm-hands-op-join",process.execPath,"--no-install",t,"--vm-hands-op-runner",...p==="person"?[or]:[],...p==="surface"?[sr,`${xt}${P}`,`${kt}${e.surfaceDirectory??""}`]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:p==="surface"?process.env.HOME||"/root":"/home/runner",...j("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(I){let x=I;if(p==="surface"&&x.t==="readiness"){let F=I;e.log?.("vm_hands.surface_ready",{lanes:Object.keys(F.lanes??{}).filter((W)=>F.lanes[W]===!0),display_video:F.display_video===!0}),e.onSurfaceReadiness?.(F);return}let T=b.get(x.id);if(!T)return;if(x.t==="event"&&x.event)T.onEvent(x.event);if(x.t==="done")b.delete(x.id),T.done(x.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});v.exited.then((I)=>{if(n[u]?.child===v)delete n[u];for(let[,x]of b)x.done({status:"failed",error_code:"vm_hands_op_runner_exited"});if(b.clear(),e.log?.("vm_hands.op_runner_exited",{kind:p,code:I}),p==="surface")e.onSurfaceReadiness?.(null)}),nn(v.pid,c(u));let O={child:v,pending:b};return n[u]=O,O};return{run(u,p,b,P,C){if(!_e())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=u==="model"&&C&&e.bindCgroup?`model:${C.toLowerCase()}`:u,v=async()=>{while(!n[m]&&L>0)await ye()};return v().then(async()=>{if(!n[m]&&L>0)await v()}).then(()=>new Promise((O)=>{if(!n[m]&&L>0){O({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let I=n[m]??o(m);I.pending.set(p.id,{onEvent:b,done:O}),P.addEventListener("abort",()=>{try{I.child.send({t:"cancel",id:p.id})}catch{}},{once:!0});try{I.child.send({t:"op",...p})}catch{I.pending.delete(p.id),O({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(u){if(!n[u]&&_e())ye().then(()=>{if(!n[u]&&L===0)o(u)})},notify(u,p){let b=n[u];if(!b)return!1;try{return b.child.send(p),!0}catch{return!1}},stop(){for(let u of Object.keys(n))n[u]?.child.kill()}}}export{we as VM_HANDS_PAYLOAD_CGROUP,M as VM_HANDS_PAYLOAD_JOIN,se as VM_HANDS_PERSON_CGROUP,je as VM_HANDS_PROBE_NONCE_TOKEN,pe as VM_HANDS_PROOF_DIR_TOKEN,Fe as VM_HANDS_SURFACE_JOIN,Be as VM_HANDS_WORKLOAD_CGROUP,y as VmHandsExecutorError,mn as createVmHandsExecutor,gn as createVmHandsOpRunners,re as describeProcesses,B as inCgroup,he as payloadUidProcesses,ge as processesStartedSince,_e as ptraceProtected,ke as subtreePids,me as survivorSummary,Ge as vmHandsBindCgroup,Ve as vmHandsSessionRoot};