@reason-machines/cli-linux-x64 0.2.447 → 0.2.448
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/reason +1 -1
- package/bin/vm-hands/{connect-cli-ns7rhvzr.js → connect-cli-he6ybq3w.js} +1 -1
- package/bin/vm-hands/{local-automation-w7kbsrhy.js → local-automation-8wdfekgv.js} +1 -1
- package/bin/vm-hands/{local-capabilities-gf0fnnyp.js → local-capabilities-am3ndewc.js} +1 -1
- package/bin/vm-hands/{local-display-session-eyj004s7.js → local-display-session-n573mr21.js} +1 -1
- package/bin/vm-hands/local-display-video-d3a6ybj7.js +2 -0
- package/bin/vm-hands/{local-managed-process-gtwdd02v.js → local-managed-process-55hxkqaa.js} +1 -1
- package/bin/vm-hands/{managed-runtime-vr9ems2y.js → managed-runtime-nmdsks13.js} +1 -1
- package/bin/vm-hands/{permissions-6znbykm7.js → permissions-46ts409h.js} +1 -1
- package/bin/vm-hands/{serve-service-ryzrmwp2.js → serve-service-fq8n78d6.js} +1 -1
- package/bin/vm-hands/{status-f2h9bsn9.js → status-c4t3k5r4.js} +1 -1
- package/bin/vm-hands/version-ds7btj50.js +2 -0
- package/bin/vm-hands/{vm-hands-entry-lite-xyh7srqs.js → vm-hands-entry-lite-2r6e8x2h.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-ex7xfa7s.js → vm-hands-entry-lite-98brk95s.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-449qskjw.js → vm-hands-entry-lite-armsesy0.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-bbpxehj9.js +2 -0
- package/bin/vm-hands/{vm-hands-entry-lite-1essfbrs.js → vm-hands-entry-lite-hnaf9xw1.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-t24zht3x.js → vm-hands-entry-lite-mz2wmtjd.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-xvt4twzn.js → vm-hands-entry-lite-pcqknbvk.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-p2cq97x6.js → vm-hands-entry-lite-q2jzf199.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-18gk29nq.js → vm-hands-entry-lite-s6qjaj1a.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-n15pmxf5.js → vm-hands-entry-lite-v675k34c.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-w77kkpgk.js → vm-hands-entry-lite-w85nwgc0.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-x9e3e0wh.js → vm-hands-entry-lite-x9y992j0.js} +3 -3
- package/bin/vm-hands/{vm-hands-entry-lite-jkehpjrw.js → vm-hands-entry-lite-xjwep4mr.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-g5236sbr.js → vm-hands-entry-lite-zb7zz17c.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
- package/bin/vm-hands/{vm-hands-executor-sa9phrat.js → vm-hands-executor-mwvppn1g.js} +1 -1
- package/bin/vm-hands/{vm-hands-op-runner-d839gtw3.js → vm-hands-op-runner-3n8c1cn1.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-cj8wf5vy.js → vm-hands-runtime-a1w0mz6z.js} +3 -3
- package/package.json +1 -1
- package/bin/vm-hands/local-display-video-vbd8x2z3.js +0 -2
- package/bin/vm-hands/version-vcrzk0tn.js +0 -2
- package/bin/vm-hands/vm-hands-entry-lite-46jc1e5j.js +0 -2
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Xe,ft}from"./vm-hands-entry-lite-jcf61cb4.js";import{gt}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Xe,ft}from"./vm-hands-entry-lite-jcf61cb4.js";import{gt}from"./vm-hands-entry-lite-bbpxehj9.js";import{Co,le,Jr,mt,Ao}from"./vm-hands-entry-lite-xjwep4mr.js";import{E}from"./vm-hands-entry-lite-qyp2a4c3.js";import{a,Qt}from"./vm-hands-entry-lite-9sa1knn7.js";import{spawnSync as H}from"child_process";import{dirname as w}from"path";import{spawn as A}from"child_process";import{accessSync as _,constants as v}from"fs";import{basename as C,join as O}from"path";var l=null;function S(e){if(l===e)l=null;if(e.exitCode===null&&e.signalCode===null)e.kill("SIGTERM")}var Gr=(e,t)=>{if(l)S(l);let s=O(e,Co);try{_(s,v.X_OK)}catch{return()=>{}}let n;try{n=A(s,["--app",e,"--name",C(e,".app"),"--permission",t==="screen"?"screen_recording":"accessibility"],{detached:!0,stdio:"ignore"})}catch{return()=>{}}return n.on("error",()=>{if(l===n)l=null}),n.once("exit",()=>{if(l===n)l=null}),n.unref(),l=n,()=>S(n)};import{chmodSync as ne,existsSync as se,mkdirSync as re,readFileSync as D,realpathSync as ie,renameSync as oe,statSync as j,writeFileSync as ae}from"fs";import{dirname as de,isAbsolute as G,join as N,resolve as T,sep as b}from"path";function F(e=a()){return N(Qt(e),"reason","protected-path-grants.json")}var f=null;function L(e){let t=JSON.parse(e);if(!Array.isArray(t?.grants))return[];return t.grants.flatMap((s)=>{let n=s;return n&&typeof n.path==="string"&&G(n.path)&&(n.kind==="file"||n.kind==="folder")&&typeof n.grantedAt==="number"?[{path:n.path,kind:n.kind,grantedAt:n.grantedAt}]:[]})}function y(e=F()){try{let{mtimeMs:t}=j(e);if(f&&f.file===e&&f.mtimeMs===t)return f.grants;let s=L(D(e,"utf8"));return f={file:e,mtimeMs:t,grants:s},s}catch{return[]}}function W(e,t){return e.kind==="file"?t===e.path:t===e.path||t.startsWith(`${e.path}${b}`)}function U(e,t){let s=T(e);return y(t).some((n)=>W(n,s))}function go(e,t){return E(e)&&!U(e,t)}function _o(e,t,s){let n=t?"file-read* file-write*":"file-read*";return y(s).filter((r)=>r.path===e||r.path.startsWith(`${e}${b}`)).map((r)=>`(allow ${n} (${r.kind==="file"?"literal":"subpath"} ${JSON.stringify(r.path)}))`)}var P="x-apple.systempreferences:com.apple.preference.security",J="curl -fsSL https://reasonmachines.com/install.sh | bash",q=180000,B=2000;var k={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${P}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${P}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${P}?Privacy_AllFiles`}};function R(e){return e.executable}function K(e,t){if(e==="computer_use_identity_missing")return`Reason's background identity is not installed (${e}); reinstall Reason: ${J}`;if(e==="computer_use_identity_outdated")return`Reason's background identity is outdated (${Jr(t)??"unknown"}; this CLI is ${gt}) (${e}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${e}); run the installed \`reason\``}function Xo(e=a()){let t=mt(e);if(t.length>0)return{state:"ready",path:w(w(w(t[0]))),prefix:t};let s=Ao(t,e)??"computer_use_identity_unavailable";return{state:s,path:le(e),detail:K(s,e)}}function V(){return{identity:()=>Xo(),grants:(e)=>Xe(e),request:(e,t)=>ft(e,t),worker:async()=>(await import("./status-c4t3k5r4.js")).connectionMacState(),open:(e)=>{H("/usr/bin/open",e,{stdio:"ignore",timeout:1e4})},tile:Gr,restartConnection:async()=>(await import("./connect-cli-he6ybq3w.js")).restartConnection(),sleep:(e)=>new Promise((t)=>setTimeout(t,e)),now:()=>Date.now()}}function M(e,t,s){if(e.state!=="ready"||!t)return"unknown";return t[s]?"granted":"missing"}async function Yo(e){let t=e.identity(),s=t.state==="ready"?await e.grants(t.prefix):null,n=await e.worker(),r=n?R(n):null,i=!r||n?.full_disk_access==="unknown"?"unknown":n?.full_disk_access==="granted"?"granted":"missing",c=(u,d,o)=>{let{label:p,purpose:h,level:m}=k[u];return{id:u,label:p,purpose:h,level:m,state:d,holder:o}};return{identity:{state:t.state,path:t.path,detail:t.state==="ready"?null:t.detail},worker_detail:r?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[c("screen",M(t,s,"screen"),t.path),c("accessibility",M(t,s,"accessibility"),t.path),c("disk",i,r)]}}function Fs(e){let t=e.identity.state==="ready"?null:e.identity.state,s=e.permissions.filter((i)=>i.state==="granted").length,n=[...t?[t]:[],...e.permissions.filter((i)=>i.state!=="granted"&&!(t&&i.id!=="disk")).map((i)=>`${i.label} ${i.state}`)],r=!t&&e.permissions.some((i)=>i.state==="missing");return`Permissions: ${s} of ${e.permissions.length}${n.length>0?` (${n.join(", ")})`:""}`+(r?" \u2014 reason permissions allow":n.length>0?" \u2014 reason permissions":"")}async function x(e,t){let s=t.now()+q;for(;;){if(await e())return!0;if(t.now()>=s)return!1;await t.sleep(B)}}async function js(e,t){let s=t.host??V(),{io:n}=t,r=await Yo(s),i=r.permissions.filter((o)=>e.includes(o.id)&&o.state!=="granted");if(i.length===0)return n.stdout.write(`Reason permissions: ${e.map((o)=>k[o].label).join(", ")} already allowed.
|
|
3
3
|
`),0;let c=!1,u=!1,d=s.identity();for(let o of i){let{label:p,pane:h}=k[o.id];if(o.id!=="disk"){if(d.state!=="ready"){if(!c)n.stderr.write(`Reason permissions: ${d.detail}
|
|
4
4
|
`);c=!0;continue}let g=o.id;await s.request(d.prefix,g),s.open([h]);let I=s.tile(d.path,g);if(n.stdout.write(`Allow Reason in System Settings > Privacy & Security > ${p}.
|
|
5
5
|
`),!t.wait)continue;if(n.stdout.write(`Waiting for it (Ctrl-C to stop)\u2026
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{at,Dt,xr,bn,kr,vn,Sn,En}from"./vm-hands-entry-lite-t3qf6qrj.js";import{Pe,rr,Xn,_t,Io,oe,Do,No,Qe,Te,en,Qn,wt,ni,ii,oi,si,ai,ci,li,ui,di,pi,hi,fi,mi,pe,Y,Re,q,gi,_i,yi,wi,bi,vi,Si,Ei,bt,xi}from"./vm-hands-entry-lite-tqc2ezda.js";import{ue,Z,O}from"./vm-hands-entry-lite-r7zs4ce2.js";import{P,zt}from"./vm-hands-entry-lite-3vmhs921.js";import{lr,ji,Ui,nt,Hi,zi,qi,Wi,Vi,Gi,pr,hr,fr,dn,pn,mr,Ji,hn,gr,me,ge,Pt,_r,wr,Tt}from"./vm-hands-entry-lite-
|
|
2
|
+
import{at,Dt,xr,bn,kr,vn,Sn,En}from"./vm-hands-entry-lite-t3qf6qrj.js";import{Pe,rr,Xn,_t,Io,oe,Do,No,Qe,Te,en,Qn,wt,ni,ii,oi,si,ai,ci,li,ui,di,pi,hi,fi,mi,pe,Y,Re,q,gi,_i,yi,wi,bi,vi,Si,Ei,bt,xi}from"./vm-hands-entry-lite-tqc2ezda.js";import{ue,Z,O}from"./vm-hands-entry-lite-r7zs4ce2.js";import{P,zt}from"./vm-hands-entry-lite-3vmhs921.js";import{lr,ji,Ui,nt,Hi,zi,qi,Wi,Vi,Gi,pr,hr,fr,dn,pn,mr,Ji,hn,gr,me,ge,Pt,_r,wr,Tt}from"./vm-hands-entry-lite-q2jzf199.js";import{D,R,b}from"./vm-hands-entry-lite-499mywh7.js";import{Mi,$i,ln,Bi,un,Fi,rt,cr}from"./vm-hands-entry-lite-zb7zz17c.js";import{K}from"./vm-hands-entry-lite-d9g1pzzx.js";import{He}from"./vm-hands-entry-lite-a3w8m8nb.js";import{j}from"./vm-hands-entry-lite-1f2cam25.js";import{vr,_n,to}from"./vm-hands-entry-lite-njs8k65s.js";import{yo,wo,ht,bo,vo,So,Eo,xo}from"./vm-hands-entry-lite-jcf61cb4.js";import{Pr,Bt,Tr,On,In}from"./vm-hands-entry-lite-3adw9jw3.js";import{Lt,ze,Mt}from"./vm-hands-entry-lite-2r6e8x2h.js";import{Rn,x,so}from"./vm-hands-entry-lite-armsesy0.js";import{go,_o}from"./vm-hands-entry-lite-v675k34c.js";import{Nt,xn,kn}from"./vm-hands-entry-lite-x9y992j0.js";import{ye,Xi,Yi}from"./vm-hands-entry-lite-dh8f2h2d.js";import{be}from"./vm-hands-entry-lite-yretc2th.js";import{It}from"./vm-hands-entry-lite-2yz6b0n3.js";import{ke,Kt,Jt,Zt,E}from"./vm-hands-entry-lite-qyp2a4c3.js";import{a,ie}from"./vm-hands-entry-lite-9sa1knn7.js";import{t,k,o,d,u,i,W,_,ee,s,n,$o}from"./vm-hands-entry-lite-ba3qq0bs.js";import{fe,Ne,Le,Me,nn}from"./vm-hands-entry-lite-8j7p91hr.js";import{$e}from"./vm-hands-entry-lite-mcjca0ez.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{request as kl}from"http";import{request as Tl}from"https";import{lookup as Dl}from"dns/promises";import{isIP as Nl}from"net";async function Ml(e){let l=new URL(e.url);return await new Promise((c,p)=>{let m=(l.protocol==="https:"?Tl:kl)(l,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:bn},(f)=>c({response:f,close:()=>{f.destroy(),m.destroy(),f.socket?.destroy()}}));m.once("error",p),m.once("timeout",()=>m.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),m.end(e.body)})}var Qi=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),$l=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function es(e,l=0){if(!e||typeof e!=="object"||l>3)return null;let c=e.code;if(typeof c==="string"){if(Qi.has(c))return"custom_endpoint_host_not_found";if($l.has(c))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(c))return"custom_endpoint_tls_failed"}for(let p of[...e instanceof AggregateError?e.errors:[],e.cause]){let m=es(p,l+1);if(m)return m}return null}async function Bl(e,l){let c=es(e),p=new URL(l).hostname.replace(/^\[|\]$/g,"");if(c!==null&&c!=="custom_endpoint_connection_failed"||Nl(p)!==0)return c;let m;return await Promise.race([Dl(p).then(()=>!0,(h)=>!Qi.has(String(h?.code))),new Promise((h)=>{m=setTimeout(()=>h(!0),5000)})]).finally(()=>clearTimeout(m))?c:"custom_endpoint_host_not_found"}function Fl(e){for(let l=42;;l++){if(l===127)l=256;let c=String.fromCodePoint(l);if(!e.includes(c))return c}}function Ul(e,l){let c=Buffer.from(e),p=Buffer.from(l),m=new Uint32Array(c.length);for(let h=1,y=0;h<c.length;h++){while(y&&c[h]!==c[y])y=m[y-1];if(c[h]===c[y])y++;m[h]=y}let f=0;return(h,y=!1)=>{let S=Buffer.allocUnsafe(h.length*p.length+f),w=0;for(let g of h){while(f&&c[f]!==g){let v=m[f-1];w+=c.copy(S,w,0,f-v),f=v}if(c[f]===g){if(f++,f===c.length)w+=p.copy(S,w),f=0}else S[w++]=g}if(y)w+=c.copy(S,w,0,f),f=0;return S.subarray(0,w)}}async function ts(e){e.signal.throwIfAborted();let l=vn.safeParse(e.payload);if(!l.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let c=l.data,p=Sn.parse(await e.credential(e.signal));if(!kr(c,{baseUrl:c.baseUrl,api:p.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let m,f,h=0,y=0,S=0,w=Fl(p.apiKey),g=Ul(p.apiKey,w),v=async(I,A)=>{e.signal.throwIfAborted(),await new Promise((M,N)=>{let L=()=>{e.signal.removeEventListener("abort",L),N(e.signal.reason)};if(e.signal.addEventListener("abort",L,{once:!0}),e.signal.aborted){L();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(I,A))).then(()=>{e.signal.removeEventListener("abort",L),M()},(B)=>{e.signal.removeEventListener("abort",L),N(B)})})},C=async(I)=>{if(h+=I.length,h>Dt)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let A=0;A<I.length;A+=at){if(S>=xr)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await v(`custom_endpoint.chunk.${S++}`,{eof:!1,data:I.subarray(A,A+at).toString("base64")})}};try{let I=await Ml({url:c.url,body:c.body,signal:e.signal,headers:{...c.headers,...p.api==="anthropic-messages"?{"x-api-key":p.apiKey}:{authorization:`Bearer ${p.apiKey}`}}});m=I.response,f=I.close;let A=m.statusCode??500;if(A>=300&&A<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(m.headers["content-encoding"]&&m.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let M={};for(let N of["content-type","retry-after","x-request-id","request-id"]){let L=m.headers[N];if(typeof L==="string")M[N]=L.replaceAll(p.apiKey,w).slice(0,4096)}await v("custom_endpoint.headers",{status:A,statusText:(m.statusMessage??"").replaceAll(p.apiKey,w).slice(0,256),headers:M});for await(let N of m){e.signal.throwIfAborted();let L=Buffer.isBuffer(N)?N:Buffer.from(N);if(y+=L.length,y>Dt)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(g(L))}return await C(g(Buffer.alloc(0),!0)),await v(`custom_endpoint.chunk.${S}`,{eof:!0}),{bytes:h,chunks:S}}catch(I){if(e.signal.throwIfAborted(),I instanceof r)throw I;throw new r((m?null:await Bl(I,c.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{f?.()}}import{join as rs}from"path";function Hl(e,l){return e===rs(l,".ara","workspace")||e===rs(l,".reason","workspace")}function ns(e,l){let c=e.filter((p)=>Hl(p.path,l));return c.length===1?c[0].path:null}var jl=/^[a-f0-9]{64}$/;var on=32,ql=/^\/[^\x00-\x1f\x7f\\]*$/;function Er(e){if(typeof e!=="string"||e.length>4096||!ql.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((l)=>l!==""&&l!=="."&&l!=="..")}function Cr(e,l){let c=l==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!c)return e;let p=c[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${c[1].toUpperCase()}:${p?`/${p}`:""}`}function sn(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let l=e;if(!Er(l.home)||!Array.isArray(l.roots)||l.roots.length>on)return;let c=[];for(let p of l.roots){if(!p||typeof p!=="object"||Array.isArray(p))return;let{path_fingerprint:m,path:f}=p;if(typeof m!=="string"||!jl.test(m)||!Er(f))return;c.push({path_fingerprint:m,path:f})}return{home:l.home,roots:c}}function Wl(e){let l=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&l?l:void 0}function zl(e){return Wl(e)??e.email.toLowerCase()}function mn(e){let l=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return l?zl({name:l[1],email:l[2]}):e.trim().toLowerCase()}var jt=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(l)=>`[${l.toLowerCase()}${l.toUpperCase()}]`),Gl=[...ke.map((e)=>`/(${e.map(jt).join("/")})(/|$)`),...Kt.map((e)=>`/(${e.map(jt).join("/")})(/|$)`),...[...Jt].map((e)=>`/(${jt(e)})$`),`/${jt(".env.")}[^/]*$`,...Zt.map((e)=>`/[^/]*${jt(e)}$`)],os=`function localGithubSandboxProfile(root, temporary) {
|
|
3
3
|
return ['(version 1)','(deny default)','(import "system.sb")','(allow process-exec process-fork)',
|
|
4
4
|
'(allow file-read* (subpath "/bin") (subpath "/sbin") (subpath "/usr/bin") (subpath "/usr/sbin") (subpath "/usr/libexec") (subpath "/usr/share") (subpath "/private/var/select") (literal "/private/var/db/xcode_select_link"))',
|
|
5
5
|
'(allow file-read-metadata (path-ancestors "/opt/homebrew/bin") (path-ancestors "/usr/local/bin") (path-ancestors "/Library/Developer/CommandLineTools"))',
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{qe,io,F,We,$t,Ar,x}from"./vm-hands-entry-lite-
|
|
2
|
+
import{qe,io,F,We,$t,Ar,x}from"./vm-hands-entry-lite-armsesy0.js";import{K}from"./vm-hands-entry-lite-d9g1pzzx.js";import{ft}from"./vm-hands-entry-lite-jcf61cb4.js";import{mt}from"./vm-hands-entry-lite-xjwep4mr.js";import{Gr}from"./vm-hands-entry-lite-v675k34c.js";import{Et,Oi}from"./vm-hands-entry-lite-g9z467dk.js";import{G,ze}from"./vm-hands-entry-lite-2r6e8x2h.js";import{Ee,jn}from"./vm-hands-entry-lite-hnaf9xw1.js";import{bt}from"./vm-hands-entry-lite-tqc2ezda.js";import{a}from"./vm-hands-entry-lite-9sa1knn7.js";import{C}from"./vm-hands-entry-lite-8j7p91hr.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{spawn as R,spawnSync as it}from"child_process";import{createHash as st,randomUUID as ge}from"crypto";import{closeSync as at,copyFileSync as ae,existsSync as M,fstatSync as ct,mkdirSync as ce,openSync as lt,readdirSync as U,readFileSync as X,readlinkSync as ut,renameSync as he,rmSync as dt,statSync as pt,writeFileSync as gt}from"fs";import{connect as ht}from"net";import{tmpdir as L,userInfo as we}from"os";import{basename as le,delimiter as wt,dirname as B,join as f}from"path";var z=`import { spawn, execFileSync } from "node:child_process";
|
|
3
3
|
import { createHash, randomUUID } from "node:crypto";
|
|
4
4
|
import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
|
|
5
5
|
import { tmpdir } from "node:os";
|
|
@@ -849,7 +849,7 @@ if(process.env.REASON_CLOUD_GATEWAY_EXEC === "1") {
|
|
|
849
849
|
process.stdout.write(JSON.stringify(cloudAutomationFailure(error))+"\\n");process.exitCode=1;
|
|
850
850
|
}
|
|
851
851
|
}
|
|
852
|
-
`;import{spawn as
|
|
852
|
+
`;import{spawn as Te}from"child_process";import{lstatSync as V,readFileSync as Z,rmSync as Ne}from"fs";import{basename as Pe}from"path";var De="__desktop-call",Me="/usr/bin/setpriv",Ue=27262976,Le=8192,$e=2000;function q(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function Be(e){try{return JSON.parse(e)}catch{return null}}function Fe(){return[process.execPath,...Pe(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],De]}function Ge(e){let o=(s)=>{try{return V(s).uid}catch{return null}},t=V("/tmp/.X11-unix",{throwIfNoEntry:!1});if(!t?.isDirectory()||t.uid!==0)return;let n=["/tmp/.X99-lock","/tmp/.X11-unix/X99"].filter((s)=>{let u=o(s);return u!==null&&u!==e.uid});if(!n.length)return;let i="";try{let s=Z("/tmp/.X99-lock","utf8").trim();if(/^\d+$/.test(s))i=Z(`/proc/${s}/comm`,"utf8").trim()}catch{}if(/^X/.test(i))return;for(let s of n)Ne(s,{force:!0})}function Nt(e,o,t,n={}){if(t.throwIfAborted(),(o.op==="display"||o.op==="automation")&&process.platform==="linux"&&process.getuid?.()===0)try{Ge(e)}catch{}let i=n.command??Fe();return new Promise((s,u)=>{let c=(n.spawnProcess??Te)(Me,[`--reuid=${e.uid}`,`--regid=${e.gid}`,"--clear-groups","--no-new-privs","--",...i],{cwd:e.home,detached:!0,stdio:["pipe","pipe","pipe"],env:{HOME:e.home,USER:e.username,LOGNAME:e.username,PATH:"/usr/local/bin:/usr/bin:/bin"}}),d=[],m=0,l="",p=null,g=!1,h,y=(_)=>{try{process.kill(-c.pid,_)}catch{c.kill(_)}},I=(_)=>{p??=_,y("SIGTERM"),h??=setTimeout(()=>y("SIGKILL"),$e)},S=()=>I(new r("cancelled","Reason cancelled the desktop operation."));t.addEventListener("abort",S,{once:!0});let w=(_)=>{if(g)return;g=!0,clearTimeout(h),t.removeEventListener("abort",S),_()};if(c.stdout.on("data",(_)=>{if(m+=_.byteLength,m>Ue)I(new r("desktop_delegate_failed","Reason's desktop reply is too large."));else d.push(_)}),c.stderr.setEncoding("utf8").on("data",(_)=>{l=(l+_).slice(-Le)}),c.stdin.on("error",()=>{}),c.once("error",()=>w(()=>u(p??new r("desktop_delegate_unavailable","Reason could not start its desktop as the desktop account.")))),c.once("close",(_,Ae)=>w(()=>{if(p)return u(p);let b=Be(Buffer.concat(d).toString("utf8"));if(q(b)&&b.ok===!0&&q(b.result))return s(b.result);let O=q(b)&&b.ok===!1&&typeof b.code==="string"&&typeof b.message==="string"?new r(b.code.slice(0,120),b.message.slice(0,2000)):null,J=`exited ${_??Ae}${O?"":" with no reply"}`,Y=l.trim().split(`
|
|
853
853
|
`).at(-1)?.slice(-300)??"";if(!O||O.code==="desktop_delegate_failed")process.stderr.write(`Reason worker: desktop call ${J}${l?`: ${l.trim().slice(-500)}`:""}
|
|
854
|
-
`);if(O)return u(O);u(new r("desktop_delegate_failed",`Reason's desktop operation failed (${J}${Y?`: ${Y}`:""}).`))})),t.aborted)S();c.stdin.end(JSON.stringify(o))})}async function V(e,o,t,n={}){let s=await Nt(e,{op:"automation",call:o},t,n);if(!Number.isSafeInteger(s.code)||typeof s.stdout!=="string"||typeof s.stderr!=="string")throw new r("desktop_delegate_failed","Reason's desktop reply is malformed.");return{code:s.code,stdout:Buffer.from(s.stdout,"base64"),stderr:s.stderr}}import{execFile as $e,spawn as Be}from"child_process";import{closeSync as Fe,mkdirSync as Ge,openSync as He}from"fs";import{dirname as E,join as je}from"path";import{promisify as Ke}from"util";var Xe=Ke($e),Z="x-apple.systempreferences:com.apple.preference.security",Je={accessibility:`${Z}?Privacy_Accessibility`,screen:`${Z}?Privacy_ScreenCapture`},Ye=64,A=new Map;function T(e,o){let t=A.get(e);if(t?.has(o))return!1;if(!t){if(A.size>=Ye)A.delete(A.keys().next().value);t=new Set,A.set(e,t)}return t.add(o),!0}function Ve(){let e=a(),o=jn(Ee(e),process.env),t=je(e,".local","share","reason","desktop-install.log");Ge(E(t),{recursive:!0,mode:448});let n=He(t,"a",384);try{let s=Be(o,["desktop","install"],{detached:!0,stdio:["ignore",n,n],env:{...process.env,REASON_DESKTOP_BACKGROUND:"1"}});s.on("error",()=>{return}),s.unref()}finally{Fe(n)}}var N={open:async(e,o)=>{await Xe("/usr/bin/open",e,{signal:o,timeout:1e4,maxBuffer:8192})},request:(e,o)=>ft(e,o),tile:Gr,installDesktop:Ve},Q=!1;async function ee(e,o,t){try{await o.open(["-a","Google Chrome",e],t)}catch{t.throwIfAborted(),await o.open([e],t)}}async function oe(e,o,t,n){if(await t.open([Je[o]],n).catch(()=>{}),e[0]&&!n.aborted)t.tile(E(E(E(e[0]))),o)}async function Ze(e,o,t,n,s){for(let i of t){if(!T(e,`grant:${i}`))continue;s.throwIfAborted(),await n.request(o,i).catch(()=>null),await oe(o,i,n,s)}}var Qe={name:"open_tab",description:"Open a web page in the user's own Chrome on this Mac. Reason cannot read, screenshot or click in that tab, and no tab_id is returned: browser control needs Reason's Chrome extension. An actual browser call opens its setup page.",inputSchema:{type:"object",properties:{url:{type:"string",description:"An http or https URL."}},required:["url"],additionalProperties:!1}};function te(e){return{code:0,stderr:"",stdout:Buffer.from(JSON.stringify({ok:!0,...e}))}}function et(e){if(typeof e!=="string")return null;try{let o=new URL(e);return o.protocol==="https:"||o.protocol==="http:"?o.href:null}catch{return null}}async function re(e,o=N){let{call:t,runId:n,signal:s}=e;if(t.kind==="browser"){if(t.operation==="discover")return te({result:{tools:[Qe]}});if(t.operation!=="call")throw new r("automation_browser_setup_required","Browser control is not set up on this Mac yet. Request a browser operation or connect Chrome from Reason to set it up.")}if(e.desktopMissing&&!Q){Q=!0;try{o.installDesktop()}catch{}}if(t.kind==="computer"){if(e.identity.length>0&&T(n,"grant:probe")){let c=await o.request(e.identity).catch(()=>null),d=c?[...c.accessibility?[]:["accessibility"],...c.screen?[]:["screen"]]:[];for(let m of d)T(n,`grant:${m}`);for(let m of d)await oe(e.identity,m,o,s)}throw new r("automation_computer_setup_required","Computer use is not set up on this Mac yet; Reason asked macOS for any missing permission.")}if(T(n,"page:chrome-extension"))await ee(io,o,s).catch(()=>{});let i=t.arguments,u=t.operation==="call"&&t.tool==="open_tab"&&i&&typeof i==="object"&&!Array.isArray(i)?et(i.url):null;if(!u)throw new r("automation_browser_setup_required","Browser control is not set up on this Mac yet; Reason opened its Chrome Web Store page. open_tab still opens pages.");return await ee(u,o,s),te({result:{content:[{type:"text",text:JSON.stringify({opened:u,browser:"the user's Chrome",controllable:!1,note:"Opened for the user to see. Reason cannot read or act in this tab until Reason's Chrome extension is added (its Chrome Web Store page is open)."})}]}})}async function ne(e,o=N){if(e.call.kind!=="computer"||e.call.operation!=="permission_status"||e.output.code!==0||e.identity.length===0)return e.output;let t;try{t=JSON.parse(e.output.stdout.toString("utf8"))}catch{return e.output}if(!t||typeof t!=="object"||Array.isArray(t))return e.output;let n=t.permissions;if(!n||typeof n!=="object")return e.output;let s=n,i=[...s.accessibility==="missing"?["accessibility"]:[],...s.screenRecording==="missing"?["screen"]:[]];if(i.length===0)return e.output;return await Ze(e.runId,e.identity,i,o,e.signal),{...e.output,stdout:Buffer.from(JSON.stringify({...t,requested:i}))}}var j=172032,pt=18874368,gt=8192,ht=65536,wt=55000,_t=60000,yt=4,St=40000,xt=/^[0-9a-f-]{36}$/,ce=z,kt=me();function P(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function D(){throw new r("invalid_automation_request","Reason automation request is malformed.")}function he(e){let o=Object.keys(e).sort().join(",");if(o==="call"||o==="browser,call"){let t=e.call,n=o==="browser,call";if(!P(t)||t.version!==1||t.kind!=="computer"&&t.kind!=="browser"||n&&(e.browser!==bt||t.kind!=="browser")||JSON.stringify(t).length>ht)D();return{call:t,userChrome:n}}if(o==="offset,output_id"){if(typeof e.output_id!=="string"||!xt.test(e.output_id)||!Number.isSafeInteger(e.offset)||e.offset<0)D();return{output_id:e.output_id,offset:e.offset}}return D()}function xn(e=process.platform,o=x){if(e==="darwin")return!0;return(e==="linux"||e==="win32")&&o()?.features.computer===!0}var Rt="__computer-use";function As(e=x){return e()?.userChrome??{code:"user_chrome_browser_use_missing"}}function we(e,o,t,n){return new Promise((s)=>{let i=R(e,o,{env:t,stdio:"ignore",windowsHide:!0}),u=setTimeout(()=>{i.kill("SIGKILL"),s(-1)},n);i.once("error",()=>{clearTimeout(u),s(-1)}),i.once("exit",(c)=>{clearTimeout(u),s(c??-1)})})}function It(e,o,t,n){return new Promise((s)=>{let i=R(e,o,{env:t,stdio:["ignore","pipe","ignore"],windowsHide:!0}),u="";i.stdout.setEncoding("utf8").on("data",(d)=>{u+=d});let c=setTimeout(()=>{i.kill("SIGKILL"),s(null)},n);i.once("error",()=>{clearTimeout(c),s(null)}),i.once("close",(d)=>{clearTimeout(c),s(d===0?u:null)})})}function vt(e){return v(e)?f(L(),"open-browser-use"):"/tmp/open-browser-use"}function v(e){return e.platform==="win32-x64"||e.platform==="win32-arm64"}var Ot=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,At=33554432;function Ct(e,o){let t;try{t=e===null?null:JSON.parse(e)}catch{return null}let n=P(t)&&P(t.result)?t.result.metadata:null;if(!P(n)||n.extensionId!==o)return null;return typeof n.extensionInstanceId==="string"&&Ot.test(n.extensionInstanceId)?n.extensionInstanceId:null}async function _e(e,o,t){let n=t.storages.map((c)=>{try{return U(c).filter((d)=>d.endsWith(".log")||d.endsWith(".ldb")).map((d)=>f(c,d))}catch{return[]}}),s;try{s=n.some((c)=>c.length>0)?U(t.socketDir).filter((c)=>c.endsWith(".sock")):[]}catch{return[]}let i=[];for(let c of s){let d=f(t.socketDir,c),m=Ct(await It(e,["info","--socket",d,"--timeout","2s"],o,5000),t.extensionId);if(m)i.push({instance:m,socket:d})}let u=[];for(let[c,d]of(i.length>0?n:[]).entries())for(let m of d)try{if(ct(m).size>At)continue;let l=X(m),p=i.find((g)=>l.includes(g.instance));if(p){u.push({storage:t.storages[c],...p});break}}catch{}return u}async function Tt(e,o,t){return(await _e(e,o,t))[0]?.instance??null}function ye(e,o,t){return Tt(e.nativeHost,o,{socketDir:vt(e),extensionId:F,storages:[f(t,"browser-profile","Default","Local Extension Settings",F)]})}var le=/^(Default|Profile ([0-9]+))$/;async function Pt(e,o,t=a(),n=$t){let s=f(t,"Library","Application Support","Google","Chrome"),i=[];try{i=U(s)}catch(l){if(l.code==="EPERM")throw new r("browser_use_chrome_access_denied","macOS blocked Reason from reading Chrome's profiles. Allow Full Disk Access for Reason on this Mac and try again.")}let u=(l)=>Number(le.exec(l)?.[2]??-1),c=i.filter((l)=>le.test(l)&&M(f(s,l,"Extensions",qe))).sort((l,p)=>u(l)-u(p)),d=(l)=>f(s,l,"Local Extension Settings",qe);return(await _e(e,o,{socketDir:n,extensionId:qe,storages:c.map(d)})).map(({storage:l,instance:p,socket:g})=>({profile:c.find((h)=>d(h)===l),instance:p,socket:g}))}async function Dt(e,o,t=a(),n=$t){let s=(await Pt(e,o,t,n))[0]?.instance;if(!s)throw new r("automation_user_chrome_not_connected","No Chrome profile on this Mac is connected to Reason. Open Chrome with the Reason extension, then try again.");return s}function ue(e){return new Promise((o)=>{let t=ut({path:e}),n=(s)=>{t.destroy(),o(s)};t.setTimeout(1000,()=>n(!1)),t.once("error",()=>n(!1)),t.once("connect",()=>n(!0))})}async function be(e,o){let t=Date.now()+o;while(Date.now()<t){if(await e())return!0;await new Promise((n)=>setTimeout(n,200))}return!1}var W=new Map;function H(e,o){let t=W.get(e);if(!t)t=o().finally(()=>W.delete(e)),W.set(e,t);return t}async function Mt(e,o){if(await ue(e))return;if(at(e,{force:!0}),await we("dbus-daemon",["--session",`--address=unix:path=${e}`,"--fork"],o,1e4)!==0||!await be(()=>ue(e),5000))throw new r("automation_unavailable","Reason could not start the desktop session bus.")}async function de(e,o,t){let n=e.platform==="darwin-arm64"||v(e)?async()=>await ye(e,o,t)!==null:async()=>await we(e.nativeHost,["info"],o,5000)===0;if(await n())return;let s=["--profile-directory=Default",`--load-extension=${e.extensionDir}`,"--no-first-run","--no-default-browser-check","--window-size=1280,800","about:blank"],i,u=null,c=0;if(e.platform==="darwin-arm64"){let l=f(t,"browser-profile");G(l);let p=f(l,"NativeMessagingHosts");ie(p,{recursive:!0,mode:448});let g=Ar(e.platform).nativeHostManifests[0];se(g,f(p,ae(g)));let h=e.browser.slice(0,e.browser.indexOf(".app/")+4),y=s.filter((I)=>I!=="about:blank").concat("--no-startup-window","--use-mock-keychain");i=R("/usr/bin/open",["-g","-n","-a",h,"--args",`--user-data-dir=${l}`,...y],{env:o,stdio:"ignore"})}else if(v(e)){let l=f(t,"browser-profile");G(l),tt(C("icacls"),[B(e.browser),"/grant","*S-1-15-2-1:(OI)(CI)(RX)","*S-1-15-2-2:(OI)(CI)(RX)"],{stdio:"ignore",windowsHide:!0,timeout:60000});let p=s.filter((g)=>g!=="about:blank").concat("--no-startup-window","--keep-alive-for-test");i=R(e.browser,[`--user-data-dir=${l}`,...p],{detached:!0,stdio:"ignore",env:o})}else{let l=f(o.HOME,".config","google-chrome"),p=f(l,"NativeMessagingHosts");ie(p,{recursive:!0,mode:448});let g=Ar(e.platform).nativeHostManifests[0];se(g,f(p,ae(g)));let h=process.geteuid?.()===0?["--no-sandbox"]:[];u=f(t,"browser.log");let y=st(u,"a",384);c=nt(y).size,i=R(e.browser,[`--user-data-dir=${l}`,...s,...h,"--force-renderer-accessibility"],{detached:!0,stdio:["ignore",y,y],env:{...o,ACCESSIBILITY_ENABLED:"1"}}),rt(y)}let d=!1;i.once("error",()=>{d=!0}),i.once("exit",(l)=>{d||=l!==0}),i.unref();let m=!1;if(await be(async()=>d||(m=await n()),St),!m){if(u&&X(u).subarray(c).toString("utf8").includes("No usable sandbox"))throw new r("automation_browser_sandbox_unavailable","Chromium found no usable sandbox on this machine. Run the worker as a non-root user with unprivileged user namespaces enabled, or in a container with seccomp unconfined.");throw new r("automation_browser_unavailable","Reason could not connect the desktop browser.")}}async function Ps(e){await ke(e,!0)}function Ts(e){return Se(e,xe(e))}function Se(e,o){return e.platform==="darwin-arm64"||v(e)?f(o,"browser-profile"):f(o,"home",".config","google-chrome")}function xe(e){let o=f(e.root,"automation");if(!M(o)||!Ut(e.automation))return e.automation;if(!Lt(Se(e,o)))try{fe(o,e.automation)}catch{}return M(o)?o:e.automation}function Ut(e){try{return U(e).length===0}catch(o){return o.code==="ENOENT"}}function Lt(e){let o;try{o=it(f(e,"SingletonLock"))}catch{return!1}let t=Number(o.slice(o.lastIndexOf("-")+1));if(!Number.isSafeInteger(t)||t<=0)return!0;try{return process.kill(t,0),!0}catch(n){return n.code==="EPERM"}}async function ke(e,o){Et({root:e.root,automation:e.automation,extensionDir:e.extensionDir});let t=xe(e);G(t);let n=ge().username,s={USER:n,LOGNAME:n,REASON_AUTOMATION_OCU:e.ocu,REASON_AUTOMATION_OBU:e.nativeHost};if(e.platform==="darwin-arm64"||v(e)){let l=v(e)?{...s,...Bt(),HOME:a()}:{...s,HOME:a(),PATH:`${B(e.node)}:/usr/bin:/bin:/usr/sbin:/sbin`,REASON_AUTOMATION_OCU:process.execPath,REASON_AUTOMATION_OCU_SUBCOMMAND:Rt};if(!o)return l;await H("browser",()=>de(e,l,t));let p=await ye(e,l,t);if(!p)throw new r("automation_browser_unavailable","Reason could not connect the desktop browser.");return{...l,REASON_AUTOMATION_OBU_INSTANCE:p,REASON_AUTOMATION_BACKGROUND_TABS:"1"}}let i=await ze(),u=f(t,"home"),c=f(t,"runtime");G(u),G(c);let d=f(t,"bus"),m={...s,HOME:u,PATH:`${B(e.node)}:/usr/bin:/bin`,DISPLAY:i.display,XAUTHORITY:i.xauthority,XDG_RUNTIME_DIR:c,DBUS_SESSION_BUS_ADDRESS:`unix:path=${d}`,...i.sound?{PULSE_SERVER:We(i.sound)}:{}};if(await H("bus",()=>Mt(d,m)),o)await H("browser",()=>de(e,m,t));return m}function Bt(){let e=process.env.SystemRoot??"C:\\Windows",o=Object.fromEntries(["SystemDrive","USERPROFILE","LOCALAPPDATA","APPDATA","ProgramData","ProgramFiles","PATHEXT","ComSpec","USERNAME","USERDOMAIN","COMPUTERNAME","NUMBER_OF_PROCESSORS","PROCESSOR_ARCHITECTURE","PSModuleAnalysisCachePath"].flatMap((n)=>process.env[n]?[[n,process.env[n]]]:[])),t=f(e,"System32");return{...o,SystemRoot:e,windir:e,TEMP:L(),TMP:L(),PATH:[t,f(t,"WindowsPowerShell","v1.0"),e].join(dt)}}async function qt(e,o,t){let n=ge().username,s={USER:n,LOGNAME:n,HOME:a(),PATH:`${B(e.node)}:/usr/bin:/bin:/usr/sbin:/sbin`,REASON_AUTOMATION_OBU:o,REASON_AUTOMATION_BACKGROUND_TABS:"1"},i=await Dt(o,s);return t.throwIfAborted(),{...s,REASON_AUTOMATION_OBU_INSTANCE:i}}function Wt(e){if(process.platform!=="win32")return["--input-type=module","--eval",e];let o=f(L(),`reason-automation-${ot("sha256").update(e).digest("hex").slice(0,16)}.mjs`);if(!M(o)||X(o,"utf8")!==e){let t=`${o}.${process.pid}.tmp`;lt(t,e,{mode:384}),fe(t,o)}return[o]}function Re(e,o,t,n){if(typeof ce!=="string")return Promise.reject(new r("automation_unavailable","This Reason build has no automation runtime."));let s=ce;return new Promise((i,u)=>{let c=R(e,Wt(s),{env:{...o,REASON_CLOUD_GATEWAY_EXEC:"1",REASON_AUTOMATION_INLINE_RESULT:"1"},stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0}),d=[],m=0,l="",p=null,g=!1,h=(w)=>{if(p??=w,process.platform==="win32"&&c.pid){R(f(process.env.SystemRoot??"C:\\Windows","System32","taskkill.exe"),["/pid",String(c.pid),"/t","/f"],{stdio:"ignore",windowsHide:!0}).once("error",()=>c.kill("SIGKILL"));return}try{process.kill(-c.pid,"SIGKILL")}catch{c.kill("SIGKILL")}},y=(w)=>{if(g)return;g=!0,clearTimeout(I),n.removeEventListener("abort",S),w()},I=setTimeout(()=>h(new r("automation_timed_out","Reason automation did not finish in time.")),wt),S=()=>h(new r("cancelled","Reason cancelled the automation call."));if(n.addEventListener("abort",S,{once:!0}),c.stdout.on("data",(w)=>{if(m+=w.byteLength,m>pt)h(new r("automation_output_too_large","Reason automation output is too large."));else d.push(w)}),c.stderr.setEncoding("utf8").on("data",(w)=>{l=(l+w).slice(-gt)}),c.stdin.on("error",()=>{}),c.once("error",()=>y(()=>u(p??new r("automation_unavailable","Reason could not start the automation runtime.")))),c.once("close",(w)=>y(()=>{if(p)u(p);else i({code:w??1,stdout:Buffer.concat(d),stderr:l})})),n.aborted)S();c.stdin.end(t)})}var k=new Map;function Ft(e,o,t){for(let[s,i]of k)if(i.expiresAt<=t)k.delete(s);while(k.size>=yt)k.delete(k.keys().next().value);let n=me();return k.set(n,{runId:e,bytes:o,expiresAt:t+_t}),n}async function Ie(e,o,t,n={}){let s=await(n.environment??ke)(e,o.kind==="browser");return t.throwIfAborted(),await(n.runtime??Re)(e.node,s,JSON.stringify(o),t)}async function Rs(e,o){let t=he({call:e});if(!("call"in t))D();let n=x();if(!n?.features.computer||t.call.kind==="browser"&&!n.features.browser)throw new r("automation_unavailable","Run `reason desktop install` on this machine to enable computer and browser use.");return await Ie(n,t.call,o)}function pe(e,o,t){let n=e.stdout.byteLength>j?Ft(o,e.stdout,t):void 0;return{code:e.code,stderr:e.stderr,instance_id:kt,output_bytes:e.stdout.byteLength,chunk:e.stdout.subarray(0,j).toString("base64"),...n?{output_id:n}:{}}}async function kn(e,o={}){let t=he(e.payload),n=(o.now??Date.now)();if("output_id"in t){let h=k.get(t.output_id);if(!h||h.runId!==e.runId||h.expiresAt<=n||t.offset>h.bytes.byteLength)throw new r("automation_output_unavailable","Reason automation output expired.");return{chunk:h.bytes.subarray(t.offset,t.offset+j).toString("base64")}}let s=(o.components??x)(),i=(o.platform??process.platform)==="darwin",u=i?(o.macIdentity??mt)():[],c=o.macSetup??N,d=!s?.features.computer||t.call.kind==="browser"&&!t.userChrome&&!s.features.browser;if(i&&(d||u.length===0||t.call.kind==="browser"&&t.userChrome&&!e.userChrome))return pe(await re({runId:e.runId,call:t.call,identity:u,desktopMissing:d,signal:e.signal},c),e.runId,n);if(!s?.features.computer)throw new r("automation_unavailable","Run `reason desktop install` on this machine to enable computer and browser use.");let m=t.userChrome?e.userChrome:void 0;if(t.userChrome&&!m)throw new r("automation_user_chrome_unavailable","Your own Chrome is not enabled on this computer: run `reason desktop install` on this Mac (and `reason connect --user-chrome on` if you turned it off).");if(t.call.kind==="browser"&&!m&&!s.features.browser)throw new r("automation_browser_not_installed",!s.platform.startsWith("linux")?"Browser use is unavailable on this machine: re-run `reason desktop install`.":"Browser use is unavailable on this machine: install a non-snap Chromium at /usr/bin/chromium, then re-run `reason desktop install`.");e.signal.throwIfAborted();let l=await Oi(e.runId,e.signal,o.now),p="account"in o?o.account??null:K(),g;try{if(m){let h=await(o.userChromeEnvironment??qt)(s,m,e.signal);e.signal.throwIfAborted(),g=await(o.runtime??Re)(s.node,h,JSON.stringify(t.call),e.signal)}else if(p)g=await(o.delegate??V)(p,t.call,e.signal);else g=await Ie(s,t.call,e.signal,o)}finally{l()}if(i)g=await ne({runId:e.runId,call:t.call,identity:u,output:g,signal:e.signal},c);return pe(g,e.runId,n)}
|
|
854
|
+
`);if(O)return u(O);u(new r("desktop_delegate_failed",`Reason's desktop operation failed (${J}${Y?`: ${Y}`:""}).`))})),t.aborted)S();c.stdin.end(JSON.stringify(o))})}async function Q(e,o,t,n={}){let i=await Nt(e,{op:"automation",call:o},t,n);if(!Number.isSafeInteger(i.code)||typeof i.stdout!=="string"||typeof i.stderr!=="string")throw new r("desktop_delegate_failed","Reason's desktop reply is malformed.");return{code:i.code,stdout:Buffer.from(i.stdout,"base64"),stderr:i.stderr}}import{execFile as He,spawn as je}from"child_process";import{closeSync as Xe,mkdirSync as Ke,openSync as Je}from"fs";import{dirname as E,join as Ye}from"path";import{promisify as Ve}from"util";var Ze=Ve(He),ee="x-apple.systempreferences:com.apple.preference.security",Qe={accessibility:`${ee}?Privacy_Accessibility`,screen:`${ee}?Privacy_ScreenCapture`},et=64,A=new Map;function T(e,o){let t=A.get(e);if(t?.has(o))return!1;if(!t){if(A.size>=et)A.delete(A.keys().next().value);t=new Set,A.set(e,t)}return t.add(o),!0}function tt(){let e=a(),o=jn(Ee(e),process.env),t=Ye(e,".local","share","reason","desktop-install.log");Ke(E(t),{recursive:!0,mode:448});let n=Je(t,"a",384);try{let i=je(o,["desktop","install"],{detached:!0,stdio:["ignore",n,n],env:{...process.env,REASON_DESKTOP_BACKGROUND:"1"}});i.on("error",()=>{return}),i.unref()}finally{Xe(n)}}var N={open:async(e,o)=>{await Ze("/usr/bin/open",e,{signal:o,timeout:1e4,maxBuffer:8192})},request:(e,o)=>ft(e,o),tile:Gr,installDesktop:tt},te=!1;async function oe(e,o,t){try{await o.open(["-a","Google Chrome",e],t)}catch{t.throwIfAborted(),await o.open([e],t)}}async function ne(e,o,t,n){if(await t.open([Qe[o]],n).catch(()=>{}),e[0]&&!n.aborted)t.tile(E(E(E(e[0]))),o)}async function ot(e,o,t,n,i){for(let s of t){if(!T(e,`grant:${s}`))continue;i.throwIfAborted(),await n.request(o,s).catch(()=>null),await ne(o,s,n,i)}}var rt={name:"open_tab",description:"Open a web page in the user's own Chrome on this Mac. Reason cannot read, screenshot or click in that tab, and no tab_id is returned: browser control needs Reason's Chrome extension. An actual browser call opens its setup page.",inputSchema:{type:"object",properties:{url:{type:"string",description:"An http or https URL."}},required:["url"],additionalProperties:!1}};function re(e){return{code:0,stderr:"",stdout:Buffer.from(JSON.stringify({ok:!0,...e}))}}function nt(e){if(typeof e!=="string")return null;try{let o=new URL(e);return o.protocol==="https:"||o.protocol==="http:"?o.href:null}catch{return null}}async function ie(e,o=N){let{call:t,runId:n,signal:i}=e;if(t.kind==="browser"){if(t.operation==="discover")return re({result:{tools:[rt]}});if(t.operation!=="call")throw new r("automation_browser_setup_required","Browser control is not set up on this Mac yet. Request a browser operation or connect Chrome from Reason to set it up.")}if(e.desktopMissing&&!te){te=!0;try{o.installDesktop()}catch{}}if(t.kind==="computer"){if(e.identity.length>0&&T(n,"grant:probe")){let c=await o.request(e.identity).catch(()=>null),d=c?[...c.accessibility?[]:["accessibility"],...c.screen?[]:["screen"]]:[];for(let m of d)T(n,`grant:${m}`);for(let m of d)await ne(e.identity,m,o,i)}throw new r("automation_computer_setup_required","Computer use is not set up on this Mac yet; Reason asked macOS for any missing permission.")}if(T(n,"page:chrome-extension"))await oe(io,o,i).catch(()=>{});let s=t.arguments,u=t.operation==="call"&&t.tool==="open_tab"&&s&&typeof s==="object"&&!Array.isArray(s)?nt(s.url):null;if(!u)throw new r("automation_browser_setup_required","Browser control is not set up on this Mac yet; Reason opened its Chrome Web Store page. open_tab still opens pages.");return await oe(u,o,i),re({result:{content:[{type:"text",text:JSON.stringify({opened:u,browser:"the user's Chrome",controllable:!1,note:"Opened for the user to see. Reason cannot read or act in this tab until Reason's Chrome extension is added (its Chrome Web Store page is open)."})}]}})}async function se(e,o=N){if(e.call.kind!=="computer"||e.call.operation!=="permission_status"||e.output.code!==0||e.identity.length===0)return e.output;let t;try{t=JSON.parse(e.output.stdout.toString("utf8"))}catch{return e.output}if(!t||typeof t!=="object"||Array.isArray(t))return e.output;let n=t.permissions;if(!n||typeof n!=="object")return e.output;let i=n,s=[...i.accessibility==="missing"?["accessibility"]:[],...i.screenRecording==="missing"?["screen"]:[]];if(s.length===0)return e.output;return await ot(e.runId,e.identity,s,o,e.signal),{...e.output,stdout:Buffer.from(JSON.stringify({...t,requested:s}))}}var j=172032,_t=18874368,yt=8192,St=65536,xt=55000,kt=60000,Rt=4,It=40000,vt=/^[0-9a-f-]{36}$/,ue=z,Ot=ge();function P(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function D(){throw new r("invalid_automation_request","Reason automation request is malformed.")}function _e(e){let o=Object.keys(e).sort().join(",");if(o==="call"||o==="browser,call"){let t=e.call,n=o==="browser,call";if(!P(t)||t.version!==1||t.kind!=="computer"&&t.kind!=="browser"||n&&(e.browser!==bt||t.kind!=="browser")||JSON.stringify(t).length>St)D();return{call:t,userChrome:n}}if(o==="offset,output_id"){if(typeof e.output_id!=="string"||!vt.test(e.output_id)||!Number.isSafeInteger(e.offset)||e.offset<0)D();return{output_id:e.output_id,offset:e.offset}}return D()}function xn(e=process.platform,o=x){if(e==="darwin")return!0;return(e==="linux"||e==="win32")&&o()?.features.computer===!0}var At="__computer-use";function As(e=x){return e()?.userChrome??{code:"user_chrome_browser_use_missing"}}function ye(e,o,t,n){return new Promise((i)=>{let s=R(e,o,{env:t,stdio:"ignore",windowsHide:!0}),u=setTimeout(()=>{s.kill("SIGKILL"),i(-1)},n);s.once("error",()=>{clearTimeout(u),i(-1)}),s.once("exit",(c)=>{clearTimeout(u),i(c??-1)})})}function Ct(e,o,t,n){return new Promise((i)=>{let s=R(e,o,{env:t,stdio:["ignore","pipe","ignore"],windowsHide:!0}),u="";s.stdout.setEncoding("utf8").on("data",(d)=>{u+=d});let c=setTimeout(()=>{s.kill("SIGKILL"),i(null)},n);s.once("error",()=>{clearTimeout(c),i(null)}),s.once("close",(d)=>{clearTimeout(c),i(d===0?u:null)})})}function Tt(e){return v(e)?f(L(),"open-browser-use"):"/tmp/open-browser-use"}function v(e){return e.platform==="win32-x64"||e.platform==="win32-arm64"}var Pt=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,Dt=33554432;function Mt(e,o){let t;try{t=e===null?null:JSON.parse(e)}catch{return null}let n=P(t)&&P(t.result)?t.result.metadata:null;if(!P(n)||n.extensionId!==o)return null;return typeof n.extensionInstanceId==="string"&&Pt.test(n.extensionInstanceId)?n.extensionInstanceId:null}async function be(e,o,t){let n=t.storages.map((c)=>{try{return U(c).filter((d)=>d.endsWith(".log")||d.endsWith(".ldb")).map((d)=>f(c,d))}catch{return[]}}),i;try{i=n.some((c)=>c.length>0)?U(t.socketDir).filter((c)=>c.endsWith(".sock")):[]}catch{return[]}let s=[];for(let c of i){let d=f(t.socketDir,c),m=Mt(await Ct(e,["info","--socket",d,"--timeout","2s"],o,5000),t.extensionId);if(m)s.push({instance:m,socket:d})}let u=[];for(let[c,d]of(s.length>0?n:[]).entries())for(let m of d)try{if(pt(m).size>Dt)continue;let l=X(m),p=s.find((g)=>l.includes(g.instance));if(p){u.push({storage:t.storages[c],...p});break}}catch{}return u}async function Ut(e,o,t){return(await be(e,o,t))[0]?.instance??null}function Se(e,o,t){return Ut(e.nativeHost,o,{socketDir:Tt(e),extensionId:F,storages:[f(t,"browser-profile","Default","Local Extension Settings",F)]})}var de=/^(Default|Profile ([0-9]+))$/;async function Lt(e,o,t=a(),n=$t){let i=f(t,"Library","Application Support","Google","Chrome"),s=[];try{s=U(i)}catch(l){if(l.code==="EPERM")throw new r("browser_use_chrome_access_denied","macOS blocked Reason from reading Chrome's profiles. Allow Full Disk Access for Reason on this Mac and try again.")}let u=(l)=>Number(de.exec(l)?.[2]??-1),c=s.filter((l)=>de.test(l)&&M(f(i,l,"Extensions",qe))).sort((l,p)=>u(l)-u(p)),d=(l)=>f(i,l,"Local Extension Settings",qe);return(await be(e,o,{socketDir:n,extensionId:qe,storages:c.map(d)})).map(({storage:l,instance:p,socket:g})=>({profile:c.find((h)=>d(h)===l),instance:p,socket:g}))}async function Bt(e,o,t=a(),n=$t){let i=(await Lt(e,o,t,n))[0]?.instance;if(!i)throw new r("automation_user_chrome_not_connected","No Chrome profile on this Mac is connected to Reason. Open Chrome with the Reason extension, then try again.");return i}function pe(e){return new Promise((o)=>{let t=ht({path:e}),n=(i)=>{t.destroy(),o(i)};t.setTimeout(1000,()=>n(!1)),t.once("error",()=>n(!1)),t.once("connect",()=>n(!0))})}async function xe(e,o){let t=Date.now()+o;while(Date.now()<t){if(await e())return!0;await new Promise((n)=>setTimeout(n,200))}return!1}var W=new Map;function H(e,o){let t=W.get(e);if(!t)t=o().finally(()=>W.delete(e)),W.set(e,t);return t}async function qt(e,o){if(await pe(e))return;if(dt(e,{force:!0}),await ye("dbus-daemon",["--session",`--address=unix:path=${e}`,"--fork"],o,1e4)!==0||!await xe(()=>pe(e),5000))throw new r("automation_unavailable","Reason could not start the desktop session bus.")}async function me(e,o,t){let n=e.platform==="darwin-arm64"||v(e)?async()=>await Se(e,o,t)!==null:async()=>await ye(e.nativeHost,["info"],o,5000)===0;if(await n())return;let i=["--profile-directory=Default",`--load-extension=${e.extensionDir}`,"--no-first-run","--no-default-browser-check","--window-size=1280,800","about:blank"],s,u=null,c=0;if(e.platform==="darwin-arm64"){let l=f(t,"browser-profile");G(l);let p=f(l,"NativeMessagingHosts");ce(p,{recursive:!0,mode:448});let g=Ar(e.platform).nativeHostManifests[0];ae(g,f(p,le(g)));let h=e.browser.slice(0,e.browser.indexOf(".app/")+4),y=i.filter((I)=>I!=="about:blank").concat("--no-startup-window","--use-mock-keychain");s=R("/usr/bin/open",["-g","-n","-a",h,"--args",`--user-data-dir=${l}`,...y],{env:o,stdio:"ignore"})}else if(v(e)){let l=f(t,"browser-profile");G(l),it(C("icacls"),[B(e.browser),"/grant","*S-1-15-2-1:(OI)(CI)(RX)","*S-1-15-2-2:(OI)(CI)(RX)"],{stdio:"ignore",windowsHide:!0,timeout:60000});let p=i.filter((g)=>g!=="about:blank").concat("--no-startup-window","--keep-alive-for-test");s=R(e.browser,[`--user-data-dir=${l}`,...p],{detached:!0,stdio:"ignore",env:o})}else{let l=f(o.HOME,".config","google-chrome"),p=f(l,"NativeMessagingHosts");ce(p,{recursive:!0,mode:448});let g=Ar(e.platform).nativeHostManifests[0];ae(g,f(p,le(g)));let h=process.geteuid?.()===0?["--no-sandbox"]:[];u=f(t,"browser.log");let y=lt(u,"a",384);c=ct(y).size,s=R(e.browser,[`--user-data-dir=${l}`,...i,...h,"--force-renderer-accessibility"],{detached:!0,stdio:["ignore",y,y],env:{...o,ACCESSIBILITY_ENABLED:"1"}}),at(y)}let d=!1;s.once("error",()=>{d=!0}),s.once("exit",(l)=>{d||=l!==0}),s.unref();let m=!1;if(await xe(async()=>d||(m=await n()),It),!m){if(u&&X(u).subarray(c).toString("utf8").includes("No usable sandbox"))throw new r("automation_browser_sandbox_unavailable","Chromium found no usable sandbox on this machine. Run the worker as a non-root user with unprivileged user namespaces enabled, or in a container with seccomp unconfined.");throw new r("automation_browser_unavailable","Reason could not connect the desktop browser.")}}async function Ps(e){await Ie(e,!0)}function Ts(e){return ke(e,Re(e))}function ke(e,o){return e.platform==="darwin-arm64"||v(e)?f(o,"browser-profile"):f(o,"home",".config","google-chrome")}function Re(e){let o=f(e.root,"automation");if(!M(o)||!Wt(e.automation))return e.automation;if(!Ft(ke(e,o)))try{he(o,e.automation)}catch{}return M(o)?o:e.automation}function Wt(e){try{return U(e).length===0}catch(o){return o.code==="ENOENT"}}function Ft(e){let o;try{o=ut(f(e,"SingletonLock"))}catch{return!1}let t=Number(o.slice(o.lastIndexOf("-")+1));if(!Number.isSafeInteger(t)||t<=0)return!0;try{return process.kill(t,0),!0}catch(n){return n.code==="EPERM"}}async function Ie(e,o){Et({root:e.root,automation:e.automation,extensionDir:e.extensionDir});let t=Re(e);G(t);let n=we().username,i={USER:n,LOGNAME:n,REASON_AUTOMATION_OCU:e.ocu,REASON_AUTOMATION_OBU:e.nativeHost};if(e.platform==="darwin-arm64"||v(e)){let l=v(e)?{...i,...Gt(),HOME:a()}:{...i,HOME:a(),PATH:`${B(e.node)}:/usr/bin:/bin:/usr/sbin:/sbin`,REASON_AUTOMATION_OCU:process.execPath,REASON_AUTOMATION_OCU_SUBCOMMAND:At};if(!o)return l;await H("browser",()=>me(e,l,t));let p=await Se(e,l,t);if(!p)throw new r("automation_browser_unavailable","Reason could not connect the desktop browser.");return{...l,REASON_AUTOMATION_OBU_INSTANCE:p,REASON_AUTOMATION_BACKGROUND_TABS:"1"}}let s=await ze(),u=f(t,"home"),c=f(t,"runtime");G(u),G(c);let d=f(t,"bus"),m={...i,HOME:u,PATH:`${B(e.node)}:/usr/bin:/bin`,DISPLAY:s.display,XAUTHORITY:s.xauthority,XDG_RUNTIME_DIR:c,DBUS_SESSION_BUS_ADDRESS:`unix:path=${d}`,...s.sound?{PULSE_SERVER:We(s.sound)}:{}};if(await H("bus",()=>qt(d,m)),o)await H("browser",()=>me(e,m,t));return m}function Gt(){let e=process.env.SystemRoot??"C:\\Windows",o=Object.fromEntries(["SystemDrive","USERPROFILE","LOCALAPPDATA","APPDATA","ProgramData","ProgramFiles","PATHEXT","ComSpec","USERNAME","USERDOMAIN","COMPUTERNAME","NUMBER_OF_PROCESSORS","PROCESSOR_ARCHITECTURE","PSModuleAnalysisCachePath"].flatMap((n)=>process.env[n]?[[n,process.env[n]]]:[])),t=f(e,"System32");return{...o,SystemRoot:e,windir:e,TEMP:L(),TMP:L(),PATH:[t,f(t,"WindowsPowerShell","v1.0"),e].join(wt)}}async function Ht(e,o,t){let n=we().username,i={USER:n,LOGNAME:n,HOME:a(),PATH:`${B(e.node)}:/usr/bin:/bin:/usr/sbin:/sbin`,REASON_AUTOMATION_OBU:o,REASON_AUTOMATION_BACKGROUND_TABS:"1"},s=await Bt(o,i);return t.throwIfAborted(),{...i,REASON_AUTOMATION_OBU_INSTANCE:s}}function jt(e){if(process.platform!=="win32")return["--input-type=module","--eval",e];let o=f(L(),`reason-automation-${st("sha256").update(e).digest("hex").slice(0,16)}.mjs`);if(!M(o)||X(o,"utf8")!==e){let t=`${o}.${process.pid}.tmp`;gt(t,e,{mode:384}),he(t,o)}return[o]}function ve(e,o,t,n){if(typeof ue!=="string")return Promise.reject(new r("automation_unavailable","This Reason build has no automation runtime."));let i=ue;return new Promise((s,u)=>{let c=R(e,jt(i),{env:{...o,REASON_CLOUD_GATEWAY_EXEC:"1",REASON_AUTOMATION_INLINE_RESULT:"1"},stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0}),d=[],m=0,l="",p=null,g=!1,h=(w)=>{if(p??=w,process.platform==="win32"&&c.pid){R(f(process.env.SystemRoot??"C:\\Windows","System32","taskkill.exe"),["/pid",String(c.pid),"/t","/f"],{stdio:"ignore",windowsHide:!0}).once("error",()=>c.kill("SIGKILL"));return}try{process.kill(-c.pid,"SIGKILL")}catch{c.kill("SIGKILL")}},y=(w)=>{if(g)return;g=!0,clearTimeout(I),n.removeEventListener("abort",S),w()},I=setTimeout(()=>h(new r("automation_timed_out","Reason automation did not finish in time.")),xt),S=()=>h(new r("cancelled","Reason cancelled the automation call."));if(n.addEventListener("abort",S,{once:!0}),c.stdout.on("data",(w)=>{if(m+=w.byteLength,m>_t)h(new r("automation_output_too_large","Reason automation output is too large."));else d.push(w)}),c.stderr.setEncoding("utf8").on("data",(w)=>{l=(l+w).slice(-yt)}),c.stdin.on("error",()=>{}),c.once("error",()=>y(()=>u(p??new r("automation_unavailable","Reason could not start the automation runtime.")))),c.once("close",(w)=>y(()=>{if(p)u(p);else s({code:w??1,stdout:Buffer.concat(d),stderr:l})})),n.aborted)S();c.stdin.end(t)})}var k=new Map;function Xt(e,o,t){for(let[i,s]of k)if(s.expiresAt<=t)k.delete(i);while(k.size>=Rt)k.delete(k.keys().next().value);let n=ge();return k.set(n,{runId:e,bytes:o,expiresAt:t+kt}),n}async function Oe(e,o,t,n={}){let i=await(n.environment??Ie)(e,o.kind==="browser");return t.throwIfAborted(),await(n.runtime??ve)(e.node,i,JSON.stringify(o),t)}async function Rs(e,o){let t=_e({call:e});if(!("call"in t))D();let n=x();if(!n?.features.computer||t.call.kind==="browser"&&!n.features.browser)throw new r("automation_unavailable","Run `reason desktop install` on this machine to enable computer and browser use.");return await Oe(n,t.call,o)}function fe(e,o,t){let n=e.stdout.byteLength>j?Xt(o,e.stdout,t):void 0;return{code:e.code,stderr:e.stderr,instance_id:Ot,output_bytes:e.stdout.byteLength,chunk:e.stdout.subarray(0,j).toString("base64"),...n?{output_id:n}:{}}}async function kn(e,o={}){let t=_e(e.payload),n=(o.now??Date.now)();if("output_id"in t){let h=k.get(t.output_id);if(!h||h.runId!==e.runId||h.expiresAt<=n||t.offset>h.bytes.byteLength)throw new r("automation_output_unavailable","Reason automation output expired.");return{chunk:h.bytes.subarray(t.offset,t.offset+j).toString("base64")}}let i=(o.components??x)(),s=(o.platform??process.platform)==="darwin",u=s?(o.macIdentity??mt)():[],c=o.macSetup??N,d=!i?.features.computer||t.call.kind==="browser"&&!t.userChrome&&!i.features.browser;if(s&&(d||u.length===0||t.call.kind==="browser"&&t.userChrome&&!e.userChrome))return fe(await ie({runId:e.runId,call:t.call,identity:u,desktopMissing:d,signal:e.signal},c),e.runId,n);if(!i?.features.computer)throw new r("automation_unavailable","Run `reason desktop install` on this machine to enable computer and browser use.");let m=t.userChrome?e.userChrome:void 0;if(t.userChrome&&!m)throw new r("automation_user_chrome_unavailable","Your own Chrome is not enabled on this computer: run `reason desktop install` on this Mac (and `reason connect --user-chrome on` if you turned it off).");if(t.call.kind==="browser"&&!m&&!i.features.browser)throw new r("automation_browser_not_installed",!i.platform.startsWith("linux")?"Browser use is unavailable on this machine: re-run `reason desktop install`.":"Browser use is unavailable on this machine: install a non-snap Chromium at /usr/bin/chromium, then re-run `reason desktop install`.");e.signal.throwIfAborted();let l=await Oi(e.runId,e.signal,o.now),p="account"in o?o.account??null:K(),g;try{if(m){let h=await(o.userChromeEnvironment??Ht)(i,m,e.signal);e.signal.throwIfAborted(),g=await(o.runtime??ve)(i.node,h,JSON.stringify(t.call),e.signal)}else if(p)g=await(o.delegate??Q)(p,t.call,e.signal);else g=await Oe(i,t.call,e.signal,o)}finally{l()}if(s)g=await se({runId:e.runId,call:t.call,identity:u,output:g,signal:e.signal},c);return fe(g,e.runId,n)}
|
|
855
855
|
export{Nt,xn,As,Ps,Ts,Rs,kn};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{gt}from"./vm-hands-entry-lite-
|
|
2
|
+
import{gt}from"./vm-hands-entry-lite-bbpxehj9.js";import{a}from"./vm-hands-entry-lite-9sa1knn7.js";import{randomUUID as L}from"crypto";import{spawnSync as b}from"child_process";import{chmodSync as ee,cpSync as te,existsSync as x,lstatSync as A,mkdirSync as Y,readdirSync as ne,readFileSync as w,readlinkSync as re,realpathSync as T,renameSync as E,rmdirSync as ie,rmSync as g,symlinkSync as M,writeFileSync as oe}from"fs";import{dirname as I,join as u,relative as se,resolve as ce}from"path";var Jn="so.ara.cli",k=[Jn,"com.reasonmachines.cli"],F="5LJFSBRY2F";function Kr(e){return`(${e.map((t)=>`identifier "${t}"`).join(" or ")}) and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${F}"`}var G="ReasonBackgroundIdentity",Co="Contents/Helpers/ReasonPermissionTile",ae="so.ara.cli.permission-tile",Ne=Kr([ae,"com.reasonmachines.cli.permission-tile"]),v="AraBackgroundIdentity",ue="Reason",Ce=Kr(k),de=`anchor apple generic and (${k.map((e)=>`identifier "${e}"`).join(" or ")}) and certificate leaf[subject.OU] = "${F}"`;class h extends Error{code;constructor(e,t){super(t);this.code=e;this.name="MacOSBackgroundIdentityError"}}var R="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function le(e=a()){return u(e,"Library","Application Support","Reason","Background","Reason.app")}function O(e=a()){return u(e,"Library","Application Support","Ara","Background","Ara.app")}function fe(e){try{return A(e).isFile()}catch{return!1}}function D(e){return[G,v].map((t)=>u(e,"Contents","MacOS",t)).find(fe)??null}function d(e){try{if(!A(e).isDirectory())return!1;let t=w(u(e,"Contents","Info.plist"),"utf8");return k.some((n)=>t.includes(`<string>${n}</string>`))&&(t.includes(`<string>${ue}</string>`)||t.includes("<string>Ara</string>"))&&D(e)!==null}catch{return!1}}function Jr(e=a()){let t=le(e);if(!d(t))return null;try{let n=w(u(t,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(n)?.[1]??null}catch{return null}}function pe(e,t=a()){let n=Jr(t);return n===null||j(N(n.split(".")),N(e.split(/[.-]/).slice(0,3)))}var ge=1e4;function K(e,t){return b(e,[...t],{stdio:"ignore",timeout:ge}).status??1}var W=new Set;function H(e){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let t=(n)=>{try{return T(n)}catch{return ce(n)}};if(e!==void 0&&t(e)!==t(a()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var V=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.(?:ara|reason)(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,J=new Set(["ara","ara.exe","reason","reason.exe"]);function N(e){return e.map((t)=>Number(t))}function j(e,t){for(let n=0;n<3;n+=1)if(e[n]!==t[n])return e[n]<t[n];return!1}var ye=[0,2,161];function me(e){if(e===null)return!0;let t=ye,n=null;try{n=T(process.execPath)}catch{}return e.some((r)=>{let i=V.exec(r);if(i){let f=i[1]===void 0?i.slice(4,7):i.slice(1,4);return j(N(f),t)}let o=r.slice(r.lastIndexOf("/")+1);return J.has(o)&&r!==n&&r!==process.execPath})}function Ee(){let e=b("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(e.status!==0)return null;let t=[];for(let n of e.stdout.split(`
|
|
3
3
|
`)){let r=/^\s*(\d+)\s+(\S.*)$/.exec(n);if(!r||Number(r[1])===process.pid)continue;let i=r[2].trimEnd(),o=i.slice(i.lastIndexOf("/")+1);if(!V.test(i)&&J.has(o)){let c=b("/usr/sbin/lsof",["-a","-p",r[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
|
|
4
4
|
`).find((l)=>l.startsWith("n/"));if(c)i=c.slice(1)}t.push(i)}return t}function _e(e){if(H(e.home),!d(e.sourceApp))throw new h("identity_invalid","The packaged Reason background identity is missing or invalid.");let t=e.command??K,n=le(e.home),r=I(n);Y(r,{recursive:!0,mode:448}),ee(r,448);let i=T(e.sourceApp),o=null;try{o=T(n)}catch{}if(i!==o){let f=`${process.pid}.${L()}`,c=u(r,`.Reason.app.${f}.tmp`),l=u(r,`.Reason.app.${f}.old`),y=!1;try{if(te(i,c,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!d(c))throw new h("identity_invalid","The copied Reason background identity is invalid.");let _=e.releaseSigned?["--test-requirement",`=${de}`]:[];if(t("/usr/bin/codesign",["--verify","--strict",..._,c])!==0)throw new h("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let S=!1;for(let p=0;p<4;p+=1){let m=!1;try{E(n,l),m=!0,y=!0}catch(s){if(s.code!=="ENOENT")throw s}if(p===0)e.beforePublish?.();try{E(c,n),S=!0}catch(s){let Z=s.code;if(!["EEXIST","ENOTEMPTY"].includes(Z??""))throw s;if(m)g(l,{recursive:!0,force:!0}),y=!1;if(p===3)throw s;continue}if(m)g(l,{recursive:!0,force:!0}),y=!1;break}if(!S)throw Error("Could not publish Reason's background identity.")}catch(_){if(y&&!x(n)&&x(l))E(l,n);throw _}finally{g(c,{recursive:!0,force:!0}),g(l,{recursive:!0,force:!0})}}return z(n,e,{verified:i!==o}),n}function X(e){return u(I(e),".Reason.app.registered")}function q(e){try{let t=A(e);return t.isDirectory()?`${t.ino}:${t.birthtimeMs}`:null}catch{return null}}function C(e){let t=q(e);try{return t!==null&&w(X(e),"utf8")===t}catch{return!1}}function Q(e){if(d(e))return"bundle";try{if(A(u(e,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return A(u(e,"Contents","MacOS",v)).isSymbolicLink()?"retired":null}catch{return null}}function z(e,t,n={}){let r=t.command??K;if(!n.verified&&r("/usr/bin/codesign",["--verify","--strict",e])!==0)throw new h("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if(r(R,["-f",e])!==0)throw new h("identity_register_failed","Could not register Reason's macOS background identity.");let i=q(e);try{if(i)oe(X(e),i,{mode:384})}catch{}try{Se(e,t.home,r,t.runningExecutables??Ee)}catch(o){let f=o.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${f})
|
|
5
5
|
`)}}function Se(e,t,n,r){let i=D(e);if(!i)return;let o=O(t),f=I(o),c=(s)=>u(s,"Contents","MacOS",v),l=se(I(c(o)),i),y=`${process.pid}.${L()}`,_=Q(o);if(_===null)return;let S=_==="bundle";if(S)n(R,["-u",o]);let p=u(f,`.Ara.app.${y}.old`);if(!W.has(o)&&!me(r())){if(!S)n(R,["-u",o]);try{E(o,p)}catch(s){if(s.code==="ENOENT")return;throw s}g(p,{recursive:!0,force:!0}),Ie(f);return}if(!S){if(re(c(o))===l)return;let s=`${c(o)}.${y}`;M(l,s);try{E(s,c(o))}finally{g(s,{force:!0})}return}let m=u(f,`.Ara.app.${y}.shim`);Y(I(c(m)),{recursive:!0}),M(l,c(m));try{try{E(o,p)}catch(s){if(s.code==="ENOENT")return;throw s}try{E(m,o)}catch(s){if(x(o))return;throw E(p,o),s}}finally{g(m,{recursive:!0,force:!0}),g(p,{recursive:!0,force:!0})}}function Ie(e){try{if(ne(e).some((n)=>n!==".DS_Store"))return;g(u(e,".DS_Store"),{force:!0}),ie(e)}catch{}}var B=new Map;function Zn(e=a()){let t=B.get(e);if(t)return t;if(process.platform!=="darwin")return[];let n=U(e);if(n===null&&x(I(le(e))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),n=U(e);if(n===null)return[];return B.set(e,n),n}function U(e){let t=le(e),n=O(e);if(!d(t)||!C(t))try{he({home:e,skipWhenSettled:!0})}catch{}let r=d(t)&&(C(t)||!d(n))?t:d(n)?n:null,i=r?D(r):null;if(!i)return null;if(r===n)W.add(n);let o=b(i,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return o.status===0&&o.stdout===`spawn
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{H}from"./vm-hands-entry-lite-r7zs4ce2.js";import{D,R,b}from"./vm-hands-entry-lite-499mywh7.js";import{Fe,ur,dr,fn,mn,it}from"./vm-hands-entry-lite-
|
|
2
|
+
import{H}from"./vm-hands-entry-lite-r7zs4ce2.js";import{D,R,b}from"./vm-hands-entry-lite-499mywh7.js";import{Fe,ur,dr,fn,mn,it}from"./vm-hands-entry-lite-q2jzf199.js";import{Ir}from"./vm-hands-entry-lite-1f2cam25.js";import{p,st,gn,_e,we}from"./vm-hands-entry-lite-dh8f2h2d.js";import{v,h}from"./vm-hands-entry-lite-t5q30ne0.js";import{a,Qt,Ro}from"./vm-hands-entry-lite-9sa1knn7.js";import{tn,y,t,k,o,d,es,Oe,Pi,u,i,W,_,ee,s,n,rn}from"./vm-hands-entry-lite-ba3qq0bs.js";import{se,A}from"./vm-hands-entry-lite-8j7p91hr.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{randomUUID as Q}from"crypto";import{spawn as je}from"child_process";import{existsSync as Z,lstatSync as me,mkdirSync as Le,readFileSync as We,realpathSync as G,rmSync as Ne,writeFileSync as Ve}from"fs";import{dirname as He,join as j,relative as Ue,sep as qe}from"path";var Se=["process.run.v1","process.full.v1"],xe=600000,Pe=1800000,Ee=20000,ne="process.cancel.v1",ie=i({action:n("start"),request_id:t().uuid(),command:t().min(1).max(16000).refine((e)=>!e.includes("\x00")),cwd:t().min(1).max(4096).refine((e)=>!e.includes("\x00")&&!e.startsWith("/")&&!e.split(/[\\/]/).includes("..")).describe("Path relative to the granted device root; omit to use that root. Must not start with /, contain a .. path segment, or contain a NUL character.").optional(),mode:s(["host","confined"]).default("host"),timeout_ms:o().int().min(1000).max(Pe).default(xe).describe("Absolute process budget including queue and startup time. Defaults to ten minutes; longer explicit requests require the selected root's advertised max_timeout_ms. Retrying never renews the deadline.")}).strict(),K={device_id:t().uuid(),root_id:t().uuid()},Re=_("action",[ie.extend(K),i({...K,action:n("inspect"),process_id:t().uuid(),after:o().int().min(0).default(0),wait_ms:o().int().min(0).max(Ee).default(0).describe("Wait for new output or a state change, bounded by this call's wait budget. Expiring this wait does not cancel the process or extend its deadline.")}).strict(),i({...K,action:n("cancel"),process_id:t().uuid()}).strict()]),Be=tn(Re,{io:"input"}),Ke=ie.extend({process_brain_fence:t().uuid(),process_expires_at:y.datetime()}).strict(),J=i({version:n(1),process_id:t().uuid(),state:s(["starting","running","exited","cancelled","expired","uncertain"]),exit_code:o().int().nullable(),first_cursor:o().int().min(0),next_cursor:o().int().min(0),truncated:d(),observed_at:y.datetime(),output:u(i({cursor:o().int().min(1),stream:s(["stdout","stderr"]),text:t().max(32768)}).strict()).max(128)}).strict().refine((e)=>{if(Buffer.byteLength(JSON.stringify(e))>1e5||e.next_cursor<e.first_cursor-1)return!1;if((e.state==="starting"||e.state==="running"||e.state==="uncertain")&&e.exit_code!==null)return!1;if(e.state==="exited"&&(e.exit_code===null||e.exit_code<0||e.exit_code>255))return!1;if(e.state==="cancelled"&&e.exit_code!==130||e.state==="expired"&&e.exit_code!==124)return!1;let f=e.first_cursor-1;for(let l of e.output){if(l.cursor<=f||l.cursor>e.next_cursor)return!1;f=l.cursor}return!0});function ae(e){return Se.includes(e)}var Xe=i({operation_constraints:ee(t(),Oe())}),Ye=i({ready:n(!0),version:n(1),execution_mode:s(["host","confined"]),max_timeout_ms:o().int().min(1000).optional()});var Ie=i({version:n(1),process_id:t().uuid(),state:s(["queued","cancelled_before_start","not_started"]),exit_code:es(),output:u(Pi()).length(0),first_cursor:n(0),next_cursor:n(0),truncated:n(!1),cancellation_requested:n(!1),reason_code:s(["cancelled_before_start","process_journal_capacity","path_not_found","process_timeout_unsupported"]).optional(),expires_at:y.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it.")}).strict(),De=i({...J.shape,state:s(["queued","starting","running","exited","cancelled","expired","uncertain","cancelled_before_start","not_started"]),observed_at:y.datetime().optional(),expires_at:y.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it."),cancellation_requested:d(),reason_code:t().nullable().optional(),execution_authority:n("lost").optional().describe("Historical receipt only; the current Brain cannot control this older-generation process."),recovery:i({cause:n("brain_generation_changed"),terminal_confirmed:d(),next_step:s(["inspect_until_terminal","reconcile_effects_before_new_intent"])}).strict().optional().describe("Historical process recovery only. An unconfirmed outcome forbids replay. A confirmed terminal observation proves the old process stopped, not that its command had no effects. Reconcile the result; only restart still-needed, safely repeatable work with a new request_id and current authority. Respect user cancellation."),last_observed_state:J.shape.state.or(n("cancelled_before_start")).nullable().optional().describe("Last saved observation before authority was lost; a running observation does not establish current child liveness.")}).strict(),$e=tn(De),Qe=W([J,Ie.refine((e)=>e.state==="cancelled_before_start")]),X=i({version:n(1),process_id:t().uuid(),state:s(["exited","cancelled","expired"]),exit_code:o().int().min(0).max(255),observed_at:y.datetime()}).strict().refine((e)=>(e.state!=="cancelled"||e.exit_code===130)&&(e.state!=="expired"||e.exit_code===124)),Ze=i({process_terminal_observation:X}).strict();var Mi="preview.serve.v1",$i=43200000;var ce="preview.open.v1",de=1,ln="gid_proxy_v1",Bi="egress",un=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::[1-9][0-9]{0,4})?$/,Ce=i({version:n(ln),allowed_domains:u(t().max(260).regex(un)).max(1024)}).strict(),Ae=rn((e)=>H(e)!==null,"invalid workspace"),ke=i({version:n(1),request_id:k(),session_id:k(),command:t().min(1).max(16000).refine((e)=>!e.includes("\x00")),port:o().int().min(1024).max(65535),workspace:Ae,egress:Ce.optional()}).strict(),Fi=ke.extend({expires_at:y.datetime()}).strict();var Me=4,Te=5000;function Y(e,c,f){let l=null;try{l=st(e)}catch{}gn({deviceRelayUrl:l?.deviceRelayUrl??"",binding:l?.binding??null,jobId:c,port:l?.binding.port??0,reason:l?f:"binding_invalid"})}function le(e){let c=new Map;return{open(f){let l=(x)=>Y(f,e.claim.operation_id,x),C;try{C=st(f)}catch{return l("binding_invalid")}let{binding:w,deviceRelayUrl:z}=C,E=e.claim.owner;if(!E||w.organizationId!==E.organization_id||w.userId!==E.user_id||w.deviceId!==E.device_id||w.rootId!==e.claim.root_id||w.jobId!==e.claim.operation_id||w.fenceId!==e.claim.operation_id||w.generation!==de||w.expiresAtMs>Math.min(Date.now()+p.lifetimeMs+Te,e.expiresAtMs))return l("binding_mismatch");if(w.expiresAtMs<=Date.now())return l("binding_expired");if(c.get(w.port)?.abort(),c.delete(w.port),c.size>=Me)return l("preview_capacity");let L=new AbortController;c.set(w.port,L);let P=we({binding:w,deniedPorts:e.deniedPorts,readCurrentJob:async()=>{if(L.signal.aborted)return null;let x=await e.inspect();return x?{binding:w,executorLaunchId:e.executorLaunchId,job:x}:null}});_e({binding:w,deviceRelayUrl:z,port:P,signal:L.signal}).then((x)=>x.closed,(x)=>{let I=x instanceof Error?x.message:"preview_failed";if(I!=="preview_not_authorized")process.stderr.write(`${JSON.stringify({event:"worker_preview.open_failed",job_id:w.jobId,port:w.port,reason_code:I})}
|
|
3
3
|
`)}).finally(()=>{if(c.get(w.port)===L)c.delete(w.port)})},dispose(){for(let f of c.values())f.abort();c.clear()}}}class rt extends r{observation;constructor(e){super("process_authority_lost","Process authority was lost; the owned process group has stopped.");this.observation=e}}var fe=256,B=new Map,he="preview.serve.v1",V=new Map;function be(e){let c=V.get(e.operation_id);if(c){if(c.claim!==e)throw M("process_authority_lost");return c}if(V.size>=fe)throw M("process_journal_capacity");let f={claim:e,executing:!1,cancelRequested:!1,phase:"pending"};return V.set(e.operation_id,f),f}function pe(e){return{version:1,process_id:e,state:"cancelled_before_start",exit_code:null,output:[],first_cursor:0,next_cursor:0,truncated:!1,cancellation_requested:!1,reason_code:"cancelled_before_start"}}var ue=(e)=>new Promise((c)=>setTimeout(c,e)),M=(e="process_outcome_uncertain")=>new r(e,"The managed process outcome could not be confirmed; inspect its saved receipt before starting another intent.");function Je(e=a(),c=ze()){let f=He(Ir({},e)),l=Ue(Qt(e),f),[C,...w]=l.split(qe);return{directory:j(c,l,"processes"),previous:[j(f,"processes"),...C==="reason"?[j(c,"ara",...w,"processes")]:[]]}}function ze(){if(process.platform!=="darwin")throw new r("process_unavailable","Managed Mac process execution is unavailable.");let e=Ro();if(!e)throw new r("process_unavailable","The private per-user process directory is unavailable.");return e}async function cr(e){if(!e.claim.owner||e.signal.aborted||e.expiresAtMs<=Date.now())throw M("process_authority_lost");let c=be(e.claim);if(c.executing)throw M("process_busy");if(c.executing=!0,c.cancelRequested)return c.phase="settling",pe(e.claim.operation_id);c.phase="starting";let f=e.journals??Je();Le(f.directory,{recursive:!0,mode:448});let l=ur({runtimeDirectory:G(f.directory),previousRuntimeDirectories:(f.previous??[]).filter((m)=>Z(m)).map((m)=>G(m)),root:e.root,runId:JSON.stringify([e.claim.owner,e.claim.run_id,e.claim.root_id,e.claim.operation_id]),maxScopes:fe});try{for(let m of[e.root,e.cwd])if(!Fe(G(m),l.journalDirectory))throw new r("process_journal_inside_workspace","The selected root contains the private process journal. Select an existing narrower granted workspace root outside the journal; no command was dispatched.")}catch(m){throw l.disposeSocket(),m}let C=me(l.journalDirectory),w=e.claim.capability===he,z=()=>B.set(e.claim.operation_id,{path:l.journalDirectory,ino:C.ino,dev:C.dev,anyCompletion:w}),E=l.launchDirectory,L=j(E,"config.json"),P={url:"",transport:"local_job_ipc",directShell:{mode:e.mode,executable:e.shell,jobId:e.claim.operation_id},workerVersion:D,protocolVersion:2,workerArtifactSha256:b,workerEntrypoint:R,targetGeneration:1,fenceId:Q(),...process.platform==="win32"?{bashExecutable:se()}:{},workRoot:e.root,workspaceAliasPath:e.root,repoPath:e.cwd,jobEnvPath:j(E,"unused.env"),replSocketPath:j(E,"unused.sock"),readyPath:j(E,"ready.json"),directTerminalReceiptPath:j(E,"terminal.json"),launchId:Q(),expiresAtMs:e.expiresAtMs+5000,bashTimeoutMs:60000,replTimeoutMs:1000,allowedTools:["bash"],managedJobs:{journalDirectory:l.journalDirectory,scopeId:l.scopeId},jobControlSocketPath:l.socketPath,...e.prefix?{bashCommandPrefix:e.prefix}:{},...e.jobsUser?{jobsUser:e.jobsUser}:{}},x;try{Ve(L,JSON.stringify(P),{mode:384});let m=fn({configPath:L,root:e.cwd,grantedRoot:e.root,workRoot:e.root,temporaryDirectory:E});x=e.spawnWorker?.(L,P)??je(m.command,m.args,{...m.options,env:e.environment,stdio:[mn,"ignore","ignore"]})}catch(m){throw l.disposeSocket(),m}let I=!1,F=new Promise((m,S)=>{x.once("exit",(g)=>{I=!0,m(g)}),x.once("error",(g)=>{I=!0,S(g)})});F.catch(()=>{});let ge={root:e.root,runId:e.claim.run_id,scopeId:l.scopeId,socketPath:l.socketPath,generation:1,fenceId:P.fenceId,executorLaunchId:P.launchId,expiresAtMs:P.expiresAtMs},N=async(m)=>{let S=await dr(ge,{type:"job",version:2,generation:1,id:Q(),jobId:e.claim.operation_id,...m==="start"?{action:m,input:{script:e.command,leaseExpiresAtMs:e.expiresAtMs}}:m==="inspect"?{action:m,input:{after:0}}:m==="probe"?{action:"inspect",input:{after:Number.MAX_SAFE_INTEGER}}:{action:m,input:{}}},new AbortController().signal);if(!S.ok)throw M(S.error);return S.job},U=!1,q=!1,te,re=()=>{U=!0,it(x,"SIGTERM")};e.signal.addEventListener("abort",re,{once:!0});let T,oe=0,ve=async(m)=>{let S=[...m.output],g={version:1,process_id:e.claim.operation_id,state:m.state,exit_code:m.exitCode,first_cursor:m.firstCursor,next_cursor:m.nextCursor,truncated:m.truncated,output:S,observed_at:new Date().toISOString()};while(Buffer.byteLength(JSON.stringify(g))>90000&&S.length)S.shift(),g.truncated=!0,g.first_cursor=S[0]?.cursor??g.next_cursor+1;T=J.parse(g),await e.emit(T),oe=Date.now()};try{let m=Math.min(Date.now()+1e4,e.expiresAtMs);while(!Z(P.readyPath)){if(I)throw new r("process_start_failed","The managed process supervisor exited before accepting a command; no command was dispatched.");if(e.signal.aborted||Date.now()>=m)throw M("process_start_unconfirmed");await ue(25)}let S=JSON.parse(We(P.readyPath,"utf8"));if(S.launchId!==P.launchId||S.fenceId!==P.fenceId||S.workerArtifactSha256!==b)throw M();if(e.signal.throwIfAborted(),c.cancelRequested)return pe(e.claim.operation_id);let g;try{q=!0,g=await N("start")}catch(O){if(!(O instanceof r)||O.code!=="hands_job_result_unknown")throw O;g=await N("inspect")}if(c.phase="running",c.cancel=async()=>{await N("cancel")},w&&e.preview)c.tunnels=le({claim:e.claim,executorLaunchId:P.launchId,expiresAtMs:e.expiresAtMs,deniedPorts:e.preview.deniedPorts,inspect:async()=>c.phase==="running"&&!I?await N("probe"):null});if(c.cancelRequested)await c.cancel(),g=await N("inspect");for(;;){if(!["starting","running"].includes(g.state))c.phase="settling",c.cancel=void 0;if(!T||T.state!==g.state||T.next_cursor!==g.nextCursor&&Date.now()-oe>=5000)await ve(g);if(!["starting","running"].includes(g.state))break;if(e.signal.aborted||I)throw M();await ue(1000);try{g=await N("inspect"),te=void 0}catch(O){if(!(O instanceof r)||O.code!=="hands_job_result_unknown"||e.signal.aborted||I||Date.now()-(te??=Date.now())>120000)throw O}}if(!T||T.state==="uncertain")throw M();return T}finally{if(c.phase="settling",c.cancel=void 0,c.tunnels?.dispose(),c.tunnels=void 0,await c.cancelInFlight?.catch(()=>{}),e.signal.removeEventListener("abort",re),!I&&!U)it(x,"SIGTERM");let m,S=await Promise.race([F.then((g)=>({code:g})),new Promise((g)=>{m=setTimeout(()=>g(null),6000)})]).finally(()=>{clearTimeout(m)});if(!S){try{it(x,"SIGKILL")}catch{}try{await F}finally{if(I)l.disposeSocket()}throw M("process_cleanup_unconfirmed")}try{if((U||e.signal.aborted)&&S.code===0&&q){v(E);let g=JSON.parse(h(P.directTerminalReceiptPath)),O=X.safeParse(g.observation);if(Object.keys(g).length===4&&g.launch_id===P.launchId&&g.fence_id===P.fenceId&&g.scope_id===l.scopeId&&O.success&&O.data.process_id===e.claim.operation_id){if(w)z();throw new rt(O.data)}}}catch(g){if(g instanceof rt)throw g}finally{if(I)l.disposeSocket()}if(S.code!==0&&!U&&q)throw M("process_cleanup_unconfirmed");if(!U&&S.code===0&&(T&&["exited","cancelled","expired"].includes(T.state)||!q&&c.cancelRequested)||w&&S.code===0&&!q)z()}}async function ks(e,c){if(c.kind===ce&&e.capability===he){let C=V.get(e.operation_id);if(C?.claim===e&&C.tunnels)C.tunnels.open(c.payload);else Y(c.payload,e.operation_id,"server_not_running");return!0}if(c.kind!==ne||!ae(e.capability)||!e.owner||c.payload.process_id!==e.operation_id)return!1;let f=V.get(e.operation_id);if(f&&f.claim!==e)return!1;let l=be(e);if(l.cancelRequested=!0,l.phase==="running"&&l.cancel)l.cancelInFlight??=l.cancel(),await l.cancelInFlight;return!0}function Cs(e,c){V.delete(e);let f=B.get(e);if(!f||c!=="succeeded"&&!f.anyCompletion)return B.delete(e),!1;try{let l=me(f.path);if(!l.isDirectory()||l.isSymbolicLink()||l.ino!==f.ino||l.dev!==f.dev||!A(l)||G(f.path)!==f.path||Z(j(f.path,"owner.lock")))return!1;return Ne(f.path,{recursive:!0}),B.delete(e),!0}catch{return!1}}
|
|
4
4
|
export{Mi,$i,ln,Bi,un,Fi,rt,cr,ks,Cs};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
2
|
import{Yn,wt,ei,ti,ri,ki}from"./vm-hands-entry-lite-tqc2ezda.js";import{createHash as H,randomBytes as he}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Xe,openSync as Oe,renameSync as Qe,rmSync as Ze,statSync as De,writeSync as Me,constants as W}from"fs";import{join as re}from"path";var en=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:nn(e)}}function nn(e){let n=e.payload[ei];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var G=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),K=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function Di(e){let n=await crypto.subtle.importKey("pkcs8",K(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=K(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),h=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),m=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:h,fingerprint:m}}var tn=16;class on{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;failedBindGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let h=this.bound.get(e);if(!h)return!1;if(h.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((m)=>setTimeout(m,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:en,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:G(this.keys.signingSpki),env_public_key:G(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:G(he(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:G(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=G(he(32)),h=ki({method:"GET",pathAndQuery:Yn,timestamp:i,nonce:s,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),m=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(h)));return{t:"hello",timestamp:i,nonce:s,signature:G(sn(m)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let s of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(s))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.failedBindGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((s)=>s.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=tn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((s)=>s.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.failedBindGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let s,h,m=new Promise((_,k)=>{s=_,h=k});return m.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:m,resolve:s,reject:h}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(v){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.failedBindGeneration.set(e.run_id,e.brain_generation),Re(v,"the bind's kill-verify failed")}let i,s=new Promise((v)=>{i=v}),h=!1,m=!1,_=()=>{m=!0,i()},k=n.promise.then(()=>new Promise((v,I)=>{this.exclusive(async()=>{if(m){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}h=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();v()}catch(w){I(w)}await s})}));k.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:k,inTurn:()=>h,leave:_})}finally{_()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);s=!0;let{launchId:h,applied:m,readyData:_}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),k=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let v=null,I=null;if(e.env){let w=e.claim?.owner??{},E=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:e.claim?.root_id??""});v=this.hooks.installEnvironment(e.bind_id,E),I=typeof E.snapshot_id==="string"&&E.snapshot_id?E.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,E)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:h,envInstalled:v!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:h,snapshot_revision:v,snapshot_id:I,layout:k,..._?{ready_data:_}:{},policy_digest:H("sha256").update(V({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(h){if(i)fe(i);if(s){let m=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(m);else await m()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.failedBindGeneration.set(e.run_id,e.brain_generation),Re(h,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),h=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${h}`,s),{snapshot_id:e.snapshotId,installed_revision:h,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(h){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw h}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);return this.unverifiedTeardowns.delete(e),{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",K(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),h=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:K(e.iv),additionalData:new TextEncoder().encode(n)},h,K(e.ct)).catch(i),_=JSON.parse(new TextDecoder().decode(m));if(!_||typeof _!=="object"||Array.isArray(_))throw new l("vm_hands_env_invalid","env not an object");return _}writeJobEnvRootOnly(e,n){let i=re(this.options.envRoot,`bind-${e}`);Xe(i,{mode:448});let s=De(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let h=n.variables&&typeof n.variables==="object"?n.variables:{},m=Object.entries(h).filter(([v,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(v)&&typeof I==="string").map(([v,I])=>`export ${v}='${String(I).replaceAll("'","'\\''")}'`).join(`
|
|
3
3
|
`)+`
|
|
4
|
-
`,_=re(i,`.job.env.${he(8).toString("hex")}`),k=Oe(_,W.O_WRONLY|W.O_CREAT|W.O_EXCL|W.O_NOFOLLOW,384);try{Me(k,m),xe(k)}finally{Ae(k)}return Qe(_,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,W.O_WRONLY|W.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}Ze(e,{recursive:!0,force:!0})}function sn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as rn}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=1e4,Ue=5000,ln=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),un="preview.serve.v1",_n=60000,ye=75000,mn=2000,gn=1e4,hn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),fn=3,pn=20000,vn=250,wn=2000;function $e(e){let n=Math.min(vn*2**(e-1),wn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function bn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class D extends Error{}var kn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function je(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Sn(e,n,i,s,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[v,I]of qe.entries()){if(s.aborted)return;if(await new Promise((w)=>{let E=setTimeout(w,I);E.unref?.(),s.addEventListener("abort",()=>{clearTimeout(E),w()},{once:!0})}),s.aborted)return;try{let w=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:v+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let E=je(w);if(h("vm_hands.unbind_unverified",{operation_id:k,code:E,attempt:v+1}),E==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:qe.length})})().finally(()=>_.delete(m))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,Ue))])}async function In(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,Ue))]);return i.length}function Pn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Tn=1000;async function Ni(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),h=async(k)=>{for(let[v,I]of[...i.turns]){i.turns.delete(v),e.onTurn?.(v,null),de(I);let w=await L(i,e.agent,v).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});s("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let v=await Rn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&hn.has(w.code)&&m<fn&&Date.now()-n<pn)return m++,_=$e(m),s("vm_hands.register_retry",{attempt:m,code:w.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(s("vm_hands.session_closed",{close_code:v.closeCode,reason:v.closeReason.slice(0,120),registered:i.deviceId!==null}),v.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=v.closeReason==="drain_reconnect"?0:v.closeReason==="vm_hands_register_retry"?_:v.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ye-Date.now())):Math.min(500*2**k,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Rn(e,n){let i=n.deviceId,s=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,v="",I=new Map,w=[],E=null,ce=new Promise((t)=>{_.onclose=(o)=>{k=o.code,v=o.reason;for(let r of I.values())r.reject(new D(`session closed ${o.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let r=o;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(o.t==="reconnect"){let r=Math.max(0,Math.min(Number(o.after_ms)||0,Tn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!E?.(o))w.push(o)};let J=(t,o)=>new Promise((r,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){r(w.splice(u,1)[0]);return}let f=setTimeout(()=>{E=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);E=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),E=null,r(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),q=(t,o)=>new Promise((r,a)=>{if(_.readyState!==WebSocket.OPEN){a(new D("session closed"));return}let u=rn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new D(`no answer to ${t.split("/").pop()} in ${f+Ne} ms`)),_.close(4000,"request_timeout")},f+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}r({status:c,json:g})}}),Y({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(o)})}),be=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",be,{once:!0});let le,X=new Map,Q=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);_.onopen=()=>{clearTimeout(g),s("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);s("vm_hands.challenge",{});let o=[],r=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((T)=>T&&T.operation_id===S.claim.operation_id&&T.attempt_id===S.claim.attempt_id)){o.push(S),s("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),de(S);let P=await L(n,e.agent,g).catch((T)=>ee(T,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),ce.then(()=>{throw new l(v==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await q("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=q,ce.then(()=>{if(n.request===q)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(r,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await Se(g,c),g instanceof D)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ke;try{await ne();for(let c of o)c.flush=()=>Ie(c),c.flush(),p(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await q("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",be);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;_.close(),await ce,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),r=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>r?ee(u,r,"vm_hands_bind_lost"):null);if(a&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:a});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:k,closeReason:v};async function Se(t,o){if(t instanceof D){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)ue=!0;for(let a of r){let u=n.turns.get(a);if(n.turns.delete(a),u)de(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=q){let r=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>r(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(R)=>r(`/operations/${f}/events`,{...u,event_seq_start:R,events:[{kind:c,payload:{sequence:R,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,T=await S(P),M=T.status===409?T.json?.expected_event_seq:void 0;if(typeof M==="number"&&M>=0&&M!==g)P=M,T=await S(P);if(T.status<300)t.eventSeq=P+1;return T}}function We(t){return(o,r)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=kn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:r,resolve:a,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],r;try{r=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof D)return;r={status:500}}if(t.outbox.shift(),r.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function ze(t,o){try{let r=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(r);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function Fe(t){let o=Z&&n.attest==="pending",r=t.vm_hands_attest,a=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,C=Math.max(0,Math.min(ae,Number.isFinite(b)?b:ae));if(!await new Promise((ie)=>{let y=setTimeout(()=>ie(!1),C);n.attestWaiters.push((x)=>{clearTimeout(y),ie(x)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(b){s("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await In(n,P);if(b)s("vm_hands.person_terminals_closed",{count:b});let C=ve(t),j=e.agent.bind(C);if(C.workspace_deferred)S=!0,g=He(u,()=>S);d=await j}catch(b){s("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let T=g?await g:-1,M={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete M.environment_installed;let R=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:-1});let F={...M,...R,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},te=Date.now()+yn,U=1,N=await p("hands.ready",F);while(bn(N.status)&&!e.signal.aborted){let b=$e(U);if(Date.now()+b>=te)break;await new Promise((C)=>setTimeout(C,b)),U++,N=await p("hands.ready",F)}if(U>1)s("vm_hands.ready_retried",{attempts:U,status_class:`${Math.floor(N.status/100)}xx`});if(X.delete(t.attempt_id),N.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Ce(N.json?.error,"vm_hands_probe_failed")});return}let B={claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:T};n.turns.set(t.attempt_id,B),B.flush=()=>Ie(B),e.onTurn?.(t.attempt_id,We(B)),await Pe(B)}async function He(t,o){let{fence:r,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await q(`/operations/${a}/heartbeat`,{...r,control_ack_seq:f,wait_ms:we});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===ti)return s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Pe(t){let{fence:o,op:r}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,q(`/operations/${r}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!p){a="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===wt)try{await Le(t,d.payload??{})}catch(g){if(g instanceof D)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;s("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ve(t,a)}async function ge(t,o){let r=Date.now()+_n;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof D))throw u}if(Date.now()>=r||e.signal.aborted)throw new D("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,r={claim:o,eventSeq:0},a=String(t.capability??""),u=a===un,{complete:f,emit:p,fence:c,op:d}={...O(r,ge)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let y of n.attestWaiters.splice(0))y(!0)}if(n.attest!=="accepted"){let y=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(y)?y:ae));if(!(x>0&&await new Promise((se)=>{let Je=setTimeout(()=>se(!1),x);n.attestWaiters.push((Ye)=>{clearTimeout(Je),se(Ye)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,T=P?Pn(t):null;if(P&&((y)=>y===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(y)||n.bindsStarting.has(y))(T)){await f("failed",{error_code:"vm_hands_bound"});return}if(ln.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let R=new AbortController,F=()=>R.abort();e.signal.addEventListener("abort",F,{once:!0});let te,U=new Promise((y)=>{te=y}),N={abort:R,settled:U},B=P?{...N,session:T}:null;if(B)n.personTerminals.add(B);if(g==="model"&&S&&a!=="preview.serve.v1"){let y=n.modelOps.get(S)??new Set;y.add(N),n.modelOps.set(S,y),await e.agent.environmentInstalled(S,mn,R.signal)}let b=-1,C=!1,j=!1,ie=u?void 0:setInterval(()=>{if(j)return;j=!0,ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:0}).then((y)=>{if(y.status>=300){R.abort();return}let x=y.json?.controls??[];for(let A of x)if(b=Math.max(b,A.seq),A.kind==="operation.cancel"||A.kind==="cancel")R.abort()},()=>R.abort()).finally(()=>{j=!1})},cn);if(u)(async()=>{while(!C&&!R.signal.aborted){let y;try{y=await ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:we})}catch{R.abort();return}if(C)return;if(y.status>=300){R.abort();return}let x=(y.json?.controls??[]).slice().sort((A,se)=>A.seq-se.seq);for(let A of x){if(A.seq<=b)continue;if(A.kind==="operation.cancel"||A.kind==="cancel")R.abort();else await e.controlOp?.({claim:t,control:A}).catch(()=>!1);b=A.seq}}})();try{let y=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:R.signal,emit:async(A)=>{await p(A.kind,A.data??{})}}),x=await f(y.status,{...y.result?{result:y.result}:{},...y.error_code?{error_code:Ce(y.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:y.status,acknowledged:x.status<300}),s("vm_hands.op",{capability:a,kind:g,status:y.status,code:y.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(C=!0,clearInterval(ie),e.signal.removeEventListener("abort",F),S)n.modelOps.get(S)?.delete(N);if(B)n.personTerminals.delete(B);te()}}async function Ve(t,o){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let a=await L(n,e.agent,r).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,r){let a=je(t);return s("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(ri,{code:a}).catch(()=>{return}),Sn(n,e.agent,{turn:o,failure:r},e.signal,s),null}function ne(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:r}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof D)return}n.receipts.shift()}}async function Le(t,o){let{fence:r,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await q(`/operations/${a}/environment`,{...r,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await q(`/operations/${a}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as xn}from"fs";var An=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function On(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-d839gtw3.js");await m();return}z("parsed",{t0:Math.round(An)});let e="";try{e=xn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-cj8wf5vy.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}On();export{Di,on,Ni};
|
|
4
|
+
`,_=re(i,`.job.env.${he(8).toString("hex")}`),k=Oe(_,W.O_WRONLY|W.O_CREAT|W.O_EXCL|W.O_NOFOLLOW,384);try{Me(k,m),xe(k)}finally{Ae(k)}return Qe(_,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,W.O_WRONLY|W.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}Ze(e,{recursive:!0,force:!0})}function sn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as rn}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=1e4,Ue=5000,ln=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),un="preview.serve.v1",_n=60000,ye=75000,mn=2000,gn=1e4,hn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),fn=3,pn=20000,vn=250,wn=2000;function $e(e){let n=Math.min(vn*2**(e-1),wn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function bn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class D extends Error{}var kn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function je(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Sn(e,n,i,s,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[v,I]of qe.entries()){if(s.aborted)return;if(await new Promise((w)=>{let E=setTimeout(w,I);E.unref?.(),s.addEventListener("abort",()=>{clearTimeout(E),w()},{once:!0})}),s.aborted)return;try{let w=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:v+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let E=je(w);if(h("vm_hands.unbind_unverified",{operation_id:k,code:E,attempt:v+1}),E==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:qe.length})})().finally(()=>_.delete(m))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,Ue))])}async function In(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,Ue))]);return i.length}function Pn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Tn=1000;async function Ni(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),h=async(k)=>{for(let[v,I]of[...i.turns]){i.turns.delete(v),e.onTurn?.(v,null),de(I);let w=await L(i,e.agent,v).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});s("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let v=await Rn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&hn.has(w.code)&&m<fn&&Date.now()-n<pn)return m++,_=$e(m),s("vm_hands.register_retry",{attempt:m,code:w.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(s("vm_hands.session_closed",{close_code:v.closeCode,reason:v.closeReason.slice(0,120),registered:i.deviceId!==null}),v.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=v.closeReason==="drain_reconnect"?0:v.closeReason==="vm_hands_register_retry"?_:v.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ye-Date.now())):Math.min(500*2**k,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Rn(e,n){let i=n.deviceId,s=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,v="",I=new Map,w=[],E=null,ce=new Promise((t)=>{_.onclose=(o)=>{k=o.code,v=o.reason;for(let r of I.values())r.reject(new D(`session closed ${o.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let r=o;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(o.t==="reconnect"){let r=Math.max(0,Math.min(Number(o.after_ms)||0,Tn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!E?.(o))w.push(o)};let J=(t,o)=>new Promise((r,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){r(w.splice(u,1)[0]);return}let f=setTimeout(()=>{E=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);E=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),E=null,r(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),q=(t,o)=>new Promise((r,a)=>{if(_.readyState!==WebSocket.OPEN){a(new D("session closed"));return}let u=rn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new D(`no answer to ${t.split("/").pop()} in ${f+Ne} ms`)),_.close(4000,"request_timeout")},f+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}r({status:c,json:g})}}),Y({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(o)})}),be=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",be,{once:!0});let le,X=new Map,Q=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);_.onopen=()=>{clearTimeout(g),s("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);s("vm_hands.challenge",{});let o=[],r=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((T)=>T&&T.operation_id===S.claim.operation_id&&T.attempt_id===S.claim.attempt_id)){o.push(S),s("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),de(S);let P=await L(n,e.agent,g).catch((T)=>ee(T,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),ce.then(()=>{throw new l(v==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await q("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=q,ce.then(()=>{if(n.request===q)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(r,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await Se(g,c),g instanceof D)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ke;try{await ne();for(let c of o)c.flush=()=>Ie(c),c.flush(),p(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await q("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",be);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;_.close(),await ce,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),r=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>r?ee(u,r,"vm_hands_bind_lost"):null);if(a&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:a});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:k,closeReason:v};async function Se(t,o){if(t instanceof D){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)ue=!0;for(let a of r){let u=n.turns.get(a);if(n.turns.delete(a),u)de(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=q){let r=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>r(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(R)=>r(`/operations/${f}/events`,{...u,event_seq_start:R,events:[{kind:c,payload:{sequence:R,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,T=await S(P),M=T.status===409?T.json?.expected_event_seq:void 0;if(typeof M==="number"&&M>=0&&M!==g)P=M,T=await S(P);if(T.status<300)t.eventSeq=P+1;return T}}function We(t){return(o,r)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=kn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:r,resolve:a,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],r;try{r=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof D)return;r={status:500}}if(t.outbox.shift(),r.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function ze(t,o){try{let r=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(r);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function Fe(t){let o=Z&&n.attest==="pending",r=t.vm_hands_attest,a=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,C=Math.max(0,Math.min(ae,Number.isFinite(b)?b:ae));if(!await new Promise((ie)=>{let y=setTimeout(()=>ie(!1),C);n.attestWaiters.push((x)=>{clearTimeout(y),ie(x)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(b){s("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await In(n,P);if(b)s("vm_hands.person_terminals_closed",{count:b});let C=ve(t),j=e.agent.bind(C);if(C.workspace_deferred)S=!0,g=He(u,()=>S);d=await j}catch(b){s("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let T=g?await g:-1,M={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete M.environment_installed;let R=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:-1});let F={...M,...R,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},te=Date.now()+yn,U=1,N=await p("hands.ready",F);while(bn(N.status)&&!e.signal.aborted){let b=$e(U);if(Date.now()+b>=te)break;await new Promise((C)=>setTimeout(C,b)),U++,N=await p("hands.ready",F)}if(U>1)s("vm_hands.ready_retried",{attempts:U,status_class:`${Math.floor(N.status/100)}xx`});if(X.delete(t.attempt_id),N.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Ce(N.json?.error,"vm_hands_probe_failed")});return}let B={claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:T};n.turns.set(t.attempt_id,B),B.flush=()=>Ie(B),e.onTurn?.(t.attempt_id,We(B)),await Pe(B)}async function He(t,o){let{fence:r,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await q(`/operations/${a}/heartbeat`,{...r,control_ack_seq:f,wait_ms:we});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===ti)return s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Pe(t){let{fence:o,op:r}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,q(`/operations/${r}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!p){a="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===wt)try{await Le(t,d.payload??{})}catch(g){if(g instanceof D)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;s("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ve(t,a)}async function ge(t,o){let r=Date.now()+_n;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof D))throw u}if(Date.now()>=r||e.signal.aborted)throw new D("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,r={claim:o,eventSeq:0},a=String(t.capability??""),u=a===un,{complete:f,emit:p,fence:c,op:d}={...O(r,ge)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let y of n.attestWaiters.splice(0))y(!0)}if(n.attest!=="accepted"){let y=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(y)?y:ae));if(!(x>0&&await new Promise((se)=>{let Je=setTimeout(()=>se(!1),x);n.attestWaiters.push((Ye)=>{clearTimeout(Je),se(Ye)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,T=P?Pn(t):null;if(P&&((y)=>y===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(y)||n.bindsStarting.has(y))(T)){await f("failed",{error_code:"vm_hands_bound"});return}if(ln.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let R=new AbortController,F=()=>R.abort();e.signal.addEventListener("abort",F,{once:!0});let te,U=new Promise((y)=>{te=y}),N={abort:R,settled:U},B=P?{...N,session:T}:null;if(B)n.personTerminals.add(B);if(g==="model"&&S&&a!=="preview.serve.v1"){let y=n.modelOps.get(S)??new Set;y.add(N),n.modelOps.set(S,y),await e.agent.environmentInstalled(S,mn,R.signal)}let b=-1,C=!1,j=!1,ie=u?void 0:setInterval(()=>{if(j)return;j=!0,ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:0}).then((y)=>{if(y.status>=300){R.abort();return}let x=y.json?.controls??[];for(let A of x)if(b=Math.max(b,A.seq),A.kind==="operation.cancel"||A.kind==="cancel")R.abort()},()=>R.abort()).finally(()=>{j=!1})},cn);if(u)(async()=>{while(!C&&!R.signal.aborted){let y;try{y=await ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:we})}catch{R.abort();return}if(C)return;if(y.status>=300){R.abort();return}let x=(y.json?.controls??[]).slice().sort((A,se)=>A.seq-se.seq);for(let A of x){if(A.seq<=b)continue;if(A.kind==="operation.cancel"||A.kind==="cancel")R.abort();else await e.controlOp?.({claim:t,control:A}).catch(()=>!1);b=A.seq}}})();try{let y=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:R.signal,emit:async(A)=>{await p(A.kind,A.data??{})}}),x=await f(y.status,{...y.result?{result:y.result}:{},...y.error_code?{error_code:Ce(y.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:y.status,acknowledged:x.status<300}),s("vm_hands.op",{capability:a,kind:g,status:y.status,code:y.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(C=!0,clearInterval(ie),e.signal.removeEventListener("abort",F),S)n.modelOps.get(S)?.delete(N);if(B)n.personTerminals.delete(B);te()}}async function Ve(t,o){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let a=await L(n,e.agent,r).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,r){let a=je(t);return s("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(ri,{code:a}).catch(()=>{return}),Sn(n,e.agent,{turn:o,failure:r},e.signal,s),null}function ne(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:r}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof D)return}n.receipts.shift()}}async function Le(t,o){let{fence:r,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await q(`/operations/${a}/environment`,{...r,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await q(`/operations/${a}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as xn}from"fs";var An=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function On(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-3n8c1cn1.js");await m();return}z("parsed",{t0:Math.round(An)});let e="";try{e=xn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-a1w0mz6z.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}On();export{Di,on,Ni};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import"./vm-hands-entry-lite-tqc2ezda.js";import"./vm-hands-entry-lite-r7zs4ce2.js";import"./vm-hands-entry-lite-3vmhs921.js";import"./vm-hands-entry-lite-em7mk9tn.js";import{nt,Ki,yr,Tt}from"./vm-hands-entry-lite-
|
|
2
|
+
import"./vm-hands-entry-lite-tqc2ezda.js";import"./vm-hands-entry-lite-r7zs4ce2.js";import"./vm-hands-entry-lite-3vmhs921.js";import"./vm-hands-entry-lite-em7mk9tn.js";import{nt,Ki,yr,Tt}from"./vm-hands-entry-lite-q2jzf199.js";import"./vm-hands-entry-lite-d9g1pzzx.js";import"./vm-hands-entry-lite-499mywh7.js";import"./vm-hands-entry-lite-g9z467dk.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-a3w8m8nb.js";import"./vm-hands-entry-lite-hw26gewc.js";import"./vm-hands-entry-lite-1f2cam25.js";import"./vm-hands-entry-lite-12rzrd95.js";import{or,sr,xt,kt}from"./vm-hands-entry-lite-pcqknbvk.js";import"./vm-hands-entry-lite-dh8f2h2d.js";import"./vm-hands-entry-lite-t5q30ne0.js";import"./vm-hands-entry-lite-9sa1knn7.js";import"./vm-hands-entry-lite-8j7p91hr.js";import{spawn as Ae}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as G,lstatSync as q,mkdirSync as V,mkdtempSync as Te,readdirSync as Z,readFileSync as k,realpathSync as We,rmdirSync as de,rmSync as He,writeFileSync as B}from"fs";import{basename as ze,dirname as Ue,join as d}from"path";import{readFileSync as ie,readlinkSync as ae}from"fs";import{relative as Ie}from"path";var ce=16;function ue(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Ne(e){let r=[];for(let t of e.split(`
|
|
3
3
|
`)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:ue(n[3]),mountPoint:ue(n[4])})}return r}function De(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(Ne(m).filter((_)=>c(_.mountPoint)).map((_)=>[`${_.mountPoint}\x00${_.device}\x00${_.root}`,_.mountPoint])),u=o(r),p=o(t),b=(m)=>Ie(n,m)||".",P=[...u].filter(([m])=>!p.has(m)).map(([,m])=>b(m)),x=[...p].filter(([m])=>!u.has(m)).map(([,m])=>b(m));return{missing:P,extra:x,referenceCount:u.size,ownCount:p.size}}function le(e,r,t,n="/proc"){let c,o,u=null;try{c=ie(`${n}/1/mountinfo`,"utf8"),o=ie(`${n}/self/mountinfo`,"utf8")}catch(_){let O=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{u=ae(`${n}/1/ns/mnt`)===ae(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:b,referenceCount:P,ownCount:x}=De(e,c,o),m={reference_count:P,own_count:x,missing_count:p.length,extra_count:b.length,same_namespace:u};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ce)});if(p.length)throw r("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ce)}),t(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var we="/sys/fs/cgroup/reason-payload",M="vm-hands",Be="/run/ara-srt/fallbacks.jsonl",se="/reason-person",Fe="/reason-workload",Ke="surface",ee=5000,je=1e4,pe="__VM_HANDS_PROOF_DIR__",Ge="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,r){super(r);this.code=e}}function Ee(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new w("vm_hands_bind_invalid","bad bind id");return d(e,M,`b-${r.toLowerCase()}`)}var Ve=5000,ve=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Je(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=d(Ue(e),r.toLowerCase());return ze(e).toLowerCase()===r.toLowerCase()?e:t}function gn(e){let r=e.cgroup??we,t=e.init.layout.payload_uid,n=e.init.workload_ended!==!0,c=(s)=>z(s,se)||n&&z(s,Fe),o=e.log??(()=>{}),u=(s)=>Je(e.init.layout.session_root,s),p=new Map,b=new Map,P=0,x=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(P>s.length?0:P).split(`
|
|
4
4
|
`).filter(Boolean);P=s.length;let l=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(l.length)o("vm_hands.srt_server_starts",{count:l.length,elapsed_ms:l.slice(0,8)})}catch{}},m=null,_=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",I=()=>{m??=fe()},R=0,F=()=>{try{let s=k(Be,"utf8"),i=s.slice(R>s.length?0:R);R=s.length;let l=i.split(`
|
|
5
5
|
`).filter(Boolean).slice(0,1000);if(!l.length)return null;let f={},g=0;for(let S of l)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:l.length,codes:f,max_elapsed_ms:g}),{count:l.length,codes:f,max_elapsed_ms:g}}catch{return null}},U=(s,i,l)=>Re(s,i,l),K=(s)=>(i,l,f)=>Ae("/bin/sh",["-c",`echo $$ > ${ve(d(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...l],f),Re=K(d(r,M)),j=d(r,M,"probe"),T=(s)=>Ee(r,s),Ce=(s)=>{let i=T(s);try{V(i,{mode:493})}catch(l){if(!(l&&typeof l==="object"&&("code"in l)&&l.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},Oe=(s)=>{try{de(T(s))}catch{}},W=e.prespawn?Ki({spawnProcess:U,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;W?.arm();let X=W?setInterval(()=>{W.arm()},Ve):null;X?.unref?.();async function Y(s){let i=p.get(s);if(p.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:T,async startExecutor(s){if(I(),b.set(s.bindId,fe()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await Y(s.bindId);let{claim:i,bindId:l}=s,f=Ce(l),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,N=new Promise((a,v)=>{h=a,y=v}),D,C=new Promise((a)=>{D=a}),H=Tt({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(l,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...W?{takePrespawnedWorker:(a)=>{let v=W.take(a);if(!v?.pid)return v;try{return B(d(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:W.adopt}:{}}).then(()=>{D("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),D(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));p.set(l,{abort:S,done:H,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0});let A=await N,E=A.executor_launch_id;if(typeof E!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:A,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return p.get(s)?.exited??new Promise(()=>{})},freezeBind(s){let i=T(s);if(G(d(i,"cgroup.freeze")))B(d(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){let i=new Set(s?.keep??[]);if(await $e(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&G(d(O,"cgroup.events")))x(),await te(O,Date.now()+ee,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ee;if(G(d(j,"cgroup.events"))){await te(j,s,"probe");try{de(j)}catch{}}let i=oe(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Ze(r,i,s);let l=(g)=>{let S=oe(g);return S!==null&&S<=i},f=he(t).filter((g)=>l(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...me(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,d(r,M)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=ge(m).filter((y)=>y!==process.pid&&!c(y)&&!z(y,"/reason-vm-hands")&&!z(y,S)&&!g.some((N)=>ne(y,N)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:re(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:re(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(I(),!i.includes(pe))throw new w("vm_hands_probe_failed","probe names no proof directory");let l=e.proofParent??"/tmp/reason-vm-hands-proof";V(l,{mode:457,recursive:!0});let f=q(l);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Te(d(l,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Le(g,t,t),Me(g,448);let h=q(g).ino;try{V(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(pe,g).replaceAll(Ge,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),N="";y.stdout?.on("data",(C)=>{if(N.length<16384)N+=C.toString("utf8").slice(0,16384-N.length)});let D=await new Promise((C)=>{let H=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},je);y.once("error",()=>{clearTimeout(H),C(127)}),y.once("close",(A)=>{clearTimeout(H),C(A??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:D}),{exitCode:D,markers:N,proofDirInode:h}}finally{if(!S)He(g,{recursive:!0,force:!0})}},restatLayout(s){let i=u(s),l=i===e.init.layout.session_root?e.init.layout.alias:d(i,"repo"),f="invalid";try{yr(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=q(l);S=h.uid,g=f==="0:0:755"&&l===d(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&We(l)===l&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=u(s);try{le(i,o,(l)=>new w("vm_hands_mount_mismatch",l))}catch(l){if(i!==e.init.layout.session_root&&l instanceof w&&l.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw l}},installEnvironment(s,i){let l=p.get(s);if(!l)throw new w("environment_unavailable","no executor owns an environment");return nt({root:e.root,operationId:l.operationId,payload:i}).installed_revision},async stop(){if(X)clearInterval(X);W?.close(),await Promise.all([...p.keys()].map((s)=>Y(s)))}};function xe(){try{return Z(d(r,M),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function $e(s,i,l=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=qe();try{await nn();let S=Date.now()+ee,h=new Set(xe().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=Y(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(G(d(T(a),"cgroup.events")))await te(T(a),S,"bind");await v}let N=[...f].map((a)=>T(a).replace(/^\/sys\/fs\/cgroup/,"")),D=["/",...[r,d(r,M)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),H=(a)=>c(a)||N.some((v)=>z(a,v))||D.some((v)=>ne(a,v)),A=l?[]:he(t).filter((a)=>!H(a));if(A.length)throw o("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size,...me(A)}),new w("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let E=(a)=>!H(a)&&!z(a,"/reason-vm-hands")&&!z(a,C)&&!D.some((v)=>ne(a,v));if(y!==null){let a=ge(y).filter((v)=>v!==process.pid&&E(v));if(a.length)throw o("vm_hands.kill_strays",{strays:re(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),Oe(a)}finally{g()}}}function oe(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function be(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ze(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=ke(e).filter((o)=>Se(o,e)),c=new Set(n.filter((o)=>{let u=oe(o);return u!==null&&u<=r}));for(let o=!0;o;){o=!1;for(let u of n){if(c.has(u))continue;let p=be(u);if(p!==null&&c.has(p))c.add(u),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,r,t="/proc"){try{return k(d(t,String(e),"cgroup"),"utf8").split(`
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{or,sr,xt,kt,Ct,os}from"./vm-hands-entry-lite-
|
|
2
|
+
import{or,sr,xt,kt,Ct,os}from"./vm-hands-entry-lite-pcqknbvk.js";export{or as VM_HANDS_OP_RUNNER_PERSON_ARG,sr as VM_HANDS_OP_RUNNER_SURFACE_ARG,kt as VM_HANDS_SURFACE_DIRECTORY_ARG,Ct as VM_HANDS_SURFACE_OPS,xt as VM_HANDS_SURFACE_UID_ARG,os as runVmHandsOpRunner};
|