@reason-machines/cli-linux-x64 0.2.480 → 0.2.482
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/reason +2 -2
- package/bin/vm-hands/{connect-cli-vszbx3gr.js → connect-cli-3ake1wsv.js} +1 -1
- package/bin/vm-hands/{local-automation-eqnr6b8m.js → local-automation-ax3q4jg8.js} +1 -1
- package/bin/vm-hands/{local-capabilities-53rbycb0.js → local-capabilities-jq56swjg.js} +1 -1
- package/bin/vm-hands/{local-display-session-nb32f9hh.js → local-display-session-871xzv6a.js} +1 -1
- package/bin/vm-hands/local-display-video-4gdgkdpz.js +2 -0
- package/bin/vm-hands/{local-managed-process-yq14r7e7.js → local-managed-process-hb69zrtq.js} +1 -1
- package/bin/vm-hands/{managed-runtime-4f7nmbzk.js → managed-runtime-p2j120vj.js} +1 -1
- package/bin/vm-hands/{permissions-389qmqcv.js → permissions-8n1gge23.js} +1 -1
- package/bin/vm-hands/{serve-service-19mzms3v.js → serve-service-khd65y94.js} +1 -1
- package/bin/vm-hands/{status-vqkxrfr8.js → status-hqqs6r3p.js} +1 -1
- package/bin/vm-hands/version-w2x11v8t.js +2 -0
- package/bin/vm-hands/{vm-hands-entry-lite-3q885ynr.js → vm-hands-entry-lite-1wqascar.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-fapx7y70.js → vm-hands-entry-lite-8t10rxfx.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-9qxvy1kz.js +2 -0
- package/bin/vm-hands/{vm-hands-entry-lite-dyrea0zp.js → vm-hands-entry-lite-b3my57wp.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-n53t84sv.js → vm-hands-entry-lite-d4hba9jc.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-pk94gtvb.js → vm-hands-entry-lite-daywc3a6.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-qg182rwf.js → vm-hands-entry-lite-egpszzay.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-chxzwdrc.js → vm-hands-entry-lite-jy5t9h08.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-w9mrm109.js → vm-hands-entry-lite-kxv5aapg.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-e18prw2s.js → vm-hands-entry-lite-rsmxxwgs.js} +5 -5
- package/bin/vm-hands/{vm-hands-entry-lite-xb6ks2r6.js → vm-hands-entry-lite-sw3yb0bt.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-s44e0508.js → vm-hands-entry-lite-sztyker7.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-xhxxgn3b.js → vm-hands-entry-lite-tcv5fb0a.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-p287w6qe.js → vm-hands-entry-lite-y5pfe77y.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
- package/bin/vm-hands/{vm-hands-executor-vxy5v66j.js → vm-hands-executor-jcfxexd5.js} +1 -1
- package/bin/vm-hands/{vm-hands-op-runner-wg8xt2hn.js → vm-hands-op-runner-rxxmdqdj.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-e3kscgb2.js → vm-hands-runtime-qyykmd4w.js} +3 -3
- package/package.json +1 -1
- package/bin/vm-hands/local-display-video-fz4nxwqc.js +0 -2
- package/bin/vm-hands/version-5yvg26q1.js +0 -2
- package/bin/vm-hands/vm-hands-entry-lite-9zjqe34s.js +0 -2
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{_,Io,ke}from"./vm-hands-entry-lite-k83rkcys.js";import{l,Wt,Ke,Nr,Vt,Mr,dt}from"./vm-hands-entry-lite-tmart4k9.js";import{wt,or}from"./vm-hands-entry-lite-mb6atrr0.js";import{dn}from"./vm-hands-entry-lite-
|
|
3
|
-
${e}`).digest("hex");return new Ke(Wt(),At(),r)}function we(e,r=Ne(e)){if(!f(We(e)))return null;let p=
|
|
4
|
-
${r?.directory??m(e)}`).digest("hex")}var Ht="keychain-scope.json";var $t=c({version:n(1),directory:t().min(1),devicePublicKey:t().min(1)});function
|
|
5
|
-
`)),E.on("data",(A)=>{if(C+=A.toString(),Buffer.byteLength(C)>16384)E.destroy(Error("worker_control_oversize"))}),E.on("error",(A)=>{if("code"in A&&["ECONNREFUSED","ENOENT"].includes(String(A.code)))x(null);else x(null,A.message==="worker_control_timeout"?A:Error("worker_control_unavailable"))}),E.on("end",()=>{try{let A=sr.parse(JSON.parse(C));if(A.instanceId!==b.nonce)throw Error("worker_instance_changed");x(A)}catch{x(null,Error("worker_control_invalid_response"))}}),E.once("close",()=>x(null,Error("worker_control_unavailable")))})}import{realpathSync as wr}from"fs";import{constants as Re}from"fs";import{open as pr}from"fs/promises";var oa={platform:process.platform,home:a,async openFile(e){let r=await pr(e,Re.O_RDONLY|Re.O_NOFOLLOW|Re.O_NONBLOCK);return{isFile:async()=>(await r.stat()).isFile(),close:()=>r.close()}}};var Ha=To(wr(process.execPath));var ms=Buffer.from([0,255,3,4]);import{execFile as Zr}from"child_process";import{promisify as Qr}from"util";var vr=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var Sr=new Set(["png","jpg","jpeg","gif","webp"]),Rr=new Set(["webm","mp4"]);function Er(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function at(e,r){let p;try{p=new URL(e)}catch{return null}let b=Er(r),R=p.hostname==="ara.so"||p.hostname.endsWith(".ara.so")||p.hostname==="reasonmachines.ai"||p.hostname.endsWith(".reasonmachines.ai")||p.hostname==="reasonmachines.com"||p.hostname.endsWith(".reasonmachines.com");if(p.protocol!=="https:"||!R&&p.origin!==b||p.username||p.password||p.port||p.search||p.hash)return null;let S=vr.exec(p.pathname);if(!S)return null;let P=S[1]?.toLowerCase(),E=S[2]?.toLowerCase(),C=S[3]?.toLowerCase(),L=S[4]?.toLowerCase();if(!P||!E||!C||!L)return null;let x=Sr.has(L)?"image":Rr.has(L)?"video":null;if(!x)return null;let A=/^(before|after)[\s:_-]+/.exec(C),D=p.pathname.replace(/^\/media\//,"");return{url:p.toString(),storagePath:D,runId:P,artifactId:E,fileName:`${C}.${L}`,kind:x,phase:A?.[1]==="before"||A?.[1]==="after"?A[1]:null}}var Pr=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,st=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),K=()=>{throw Error("cloud_browser_media_request_invalid")};function Pe(e){if(!st(e)||Object.keys(e).some((S)=>!["runId","configuredMediaOrigin","media"].includes(S))||typeof e.runId!=="string"||!Pr.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return K();let r;try{r=new URL(e.configuredMediaOrigin)}catch{return K()}if(r.protocol!=="https:"||r.username||r.password||r.port||!Ue(r.origin,{mode:"public_web"}).allowed)return K();let p=e.runId.toLowerCase(),b=new Set,R=e.media.map((S)=>{if(!st(S)||Object.keys(S).some((E)=>!["url","sourceUrl","kind"].includes(E))||typeof S.url!=="string"||S.url.length>2048||typeof S.sourceUrl!=="string"||S.sourceUrl.length>8192||!["image","video"].includes(String(S.kind)))return K();let P=at(S.url,r.origin);if(!P||new URL(P.url).origin!==r.origin||P.runId!==p||P.kind!==S.kind||P.url!==S.url||b.has(S.url))return K();if(b.add(S.url),S.sourceUrl!==S.url){let E;try{E=new URL(S.sourceUrl)}catch{return K()}let C=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(E.pathname)?.[1];if(S.kind!=="image"||E.origin!=="https://camo.githubusercontent.com"||E.username||E.password||E.search||E.hash||!C||C.length%2!==0||Buffer.from(C,"hex").toString("utf8")!==S.url)return K()}return{url:S.url,sourceUrl:S.sourceUrl,kind:S.kind}});return{runId:e.runId,configuredMediaOrigin:r.origin,media:R}}var I=t().uuid(),X=t().regex(/^[a-f0-9]{64}$/),V=y.datetime({precision:3}),Ce=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),ut=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),U=i({kind:n("primary_mac"),version:n(1),organizationId:Ce,userId:Ce,sessionId:Ce,runId:I,deviceId:I,rootId:I,rootRevision:t().min(1).max(64),binding:s(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:I,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Cr=on().transform((e,r)=>{try{return dn(e)}catch{return r.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),Fo}}),ue=i({version:n(1),owner:U,contextId:I,preparedAt:V,expiresAt:V,prUrl:ut,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:X,evidenceKind:s(["image","video"]),visualPlan:Cr.optional(),uploadOrigin:t().url().refine((e)=>{let r=new URL(e);return r.protocol==="https:"&&r.origin===e&&!r.username&&!r.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),Ar=i({version:n(1),producer:n("primary_mac"),context:ue,captureId:I,operationId:I,attemptId:I,tabId:o().int().positive(),startedAt:V,finishedAt:V,sha256:X,media:g("contentType",[i({contentType:n("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),i({contentType:n("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,r)=>{let p=Date.parse(e.startedAt),b=Date.parse(e.finishedAt);if(p<Date.parse(e.context.preparedAt)||b<p||b>Date.parse(e.context.expiresAt)||b-p>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((b-p)/1000-e.media.durationSeconds)>0.1))r.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),dc=g("action",[i({action:n("screenshot"),context_id:I,tab_id:o().int().positive()}).strict(),i({action:n("start_video"),context_id:I,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),i({action:n("stop_video"),recording_operation_id:I}).strict()]),fe=i({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),ce=t().regex(/^[1-9][0-9]{0,19}$/),le=i({version:n(1),owner:U,expectedActorId:ce.nullable(),repositoryId:ce,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),Ir=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],xr=g("status",[le.extend({status:n("ready"),observedActor:fe,checkedAt:V}),le.extend({status:n("not_ready"),reason:s(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:s(Ir).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),Y=i({version:n(1),owner:U,expectedActorId:ce.nullable(),authenticatedActor:fe,attemptId:I,captureId:I,prUrl:ut,repositoryId:ce,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:X,sizeBytes:o().int().min(128).max(10485760),contentType:n("video/webm")}).strict(),ft=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),Or=g("status",[Y.extend({status:n("not_attempted"),reason:s(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),Y.extend({status:n("uncertain"),reason:n("upload_outcome_unknown")}),Y.extend({status:n("uploaded"),observedActor:fe,nativeUrl:ft,uploadedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),de=Y.extend({nativeUrl:ft,observedActor:fe,bodySha256:X}),Lr=g("status",[de.extend({status:n("incomplete"),reason:s(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),de.extend({status:n("verified"),sourceSha256:X,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:n(!0),verifiedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Dr=on().transform((e,r)=>{try{let p=Pe(e);if(p.media.some((b)=>b.kind!=="image"))throw Error();return p}catch{return r.addIssue({code:"custom",message:"proof_media_request_invalid"}),Fo}}),Tr=g("action",[i({action:n("auth_check"),input:le}).strict(),i({action:n("prepare"),context:ue}).strict(),i({action:n("capture_png"),owner:U,contextId:I,tabId:o().int().positive()}).strict(),i({action:n("start_video"),owner:U,contextId:I,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),i({action:n("inspect_capture"),owner:U,captureId:I}).strict(),i({action:n("publish_video"),input:Y}).strict(),i({action:n("verify_png_media"),owner:U,media:Dr}).strict().refine((e)=>e.media.runId===e.owner.runId),i({action:n("verify_saved_media"),input:de}).strict(),i({action:n("publish_png"),owner:U,attemptId:I,captureId:I,sha256:X,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var Hr=i({requestId:I,command:Tr}).strict();var $r={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},ct={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},lt={type:"integer",minimum:1,description:"An already-owned tab's id."},uc={...$r,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:ct,tab_id:lt}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:ct,tab_id:lt,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};var gc=i({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict();var Br=String.raw`async (media) => {
|
|
2
|
+
import{_,Io,ke}from"./vm-hands-entry-lite-k83rkcys.js";import{l,Wt,Ke,Nr,Vt,Mr,dt}from"./vm-hands-entry-lite-tmart4k9.js";import{wt,or}from"./vm-hands-entry-lite-mb6atrr0.js";import{dn}from"./vm-hands-entry-lite-sztyker7.js";import{B,m,te,Ue}from"./vm-hands-entry-lite-b3my57wp.js";import{F}from"./vm-hands-entry-lite-1wqascar.js";import{To}from"./vm-hands-entry-lite-8t10rxfx.js";import{xe,Ye,Jn,Wr}from"./vm-hands-entry-lite-jy5t9h08.js";import{f,v,h}from"./vm-hands-entry-lite-52x189kf.js";import{a}from"./vm-hands-entry-lite-cf1x5cbr.js";import{Fo,nn,y,t,k,Et,o,d,Oe,u,i,c,g,os,s,n,on}from"./vm-hands-entry-lite-vmnxnr7y.js";import{closeSync as Mh,existsSync as Lh,mkdirSync as Wh,openSync as Nh,readdirSync as Hh,realpathSync as pe,rmSync as $h}from"fs";import{dirname as Bh,join as J,resolve as Fh}from"path";import{createHash as Ct}from"crypto";import{platform as At}from"os";import{join as xt}from"path";var It=g("store",[c({version:n(1),store:n("keychain")}),c({version:n(1),store:n("file"),api_key:t().min(1).max(4096)})]),We=(e)=>xt(e,"api-key.json");function Ne(e){let r=Ct("sha256").update(`reason-connect-api-key
|
|
3
|
+
${e}`).digest("hex");return new Ke(Wt(),At(),r)}function we(e,r=Ne(e)){if(!f(We(e)))return null;let p=It.parse(JSON.parse(h(We(e))));if(p.store==="file")return p.api_key;try{let b=r.loadBinding();return b?new TextDecoder().decode(b):null}catch(b){if(!(b instanceof l))throw b;throw Error("worker_api_key_unreadable")}}import{readdirSync as Gt,renameSync as jn,rmSync as qn}from"fs";import{join as ee}from"path";import{createHash as Dt}from"crypto";import{platform as Mt}from"os";import{join as N}from"path";function w(e){return{state:N(m(e),"device.json"),control:N(m(e),"control.json"),lock:N(m(e),"lifecycle.lock"),socket:N(m(e),"control.sock"),daemon:N(m(e),"daemon.json"),releaseCheck:N(m(e),"release-check.json"),updateDeferral:N(m(e),"update-deferral.json"),firstHeartbeat:N(m(e),"first-heartbeat.json")}}var an=i({version:n(1),device_id:t().min(1).max(160),offer:Oe().optional(),enrollment_ms:o().int().nonnegative().max(or).optional()});function z(e,r=!1){v(m(e),r);let p=["local-device.key","local-device.binding","device.json"].filter((b)=>{let R=N(m(e),b);if(!f(R))return!1;return h(R),!0});return e.lifetime==="persistent"&&p.join()==="device.json"?Lt(e):new Nr(m(e))}function Lt(e){return new Ke(Wt(),Mt(),Nt(e))}function Nt(e){let r=Ut(e);return Dt("sha256").update(`reason-worker
|
|
4
|
+
${r?.directory??m(e)}`).digest("hex")}var Ht="keychain-scope.json";var $t=c({version:n(1),directory:t().min(1),devicePublicKey:t().min(1)});function Ut(e){let r=N(m(e),Ht);if(!f(r))return null;let p=$t.safeParse(JSON.parse(h(r))),b=w(e).state;if(!p.success||!f(b))return null;return JSON.parse(h(b))?.devicePublicKey===p.data.devicePublicKey?p.data:null}function M(e){if(!f(m(e)))return null;let r=Mr(w(e).state,{proofStore:z(e),repair:!1}),p=r!==null&&Io(e.apiOrigin,r.apiOrigin),b=p?[te(e),te({...e,apiOrigin:r.apiOrigin})]:[te(e)];if(r&&(!b.includes(r.worker?.configDigest??"")||r.worker.lifetime!==e.lifetime||r.apiOrigin!==e.apiOrigin&&!p||r.roots.length>32||r.roots[0]?.path!==e.workspaceRoot||r.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return r}var Bt=c({version:n(1),drained:d(),revoked:d()});function H(e){let r=w(e).control;return f(r)?Bt.parse(JSON.parse(h(r))):{version:1,drained:!1,revoked:!1}}var jt=c({read:d(),write:d(),execute:d(),discover_environment:d(),expose_mcp:n(!1)}),qt=c({version:n(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:jt,execution_mode:s(["confined","host"]).default("confined")}),folders:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),bn=i({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:n("p256"),protocol_version:n(2),roots:u(i({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:i({lifecycle:s(["persistent","ephemeral"]),expires_at:y.datetime({offset:!0})}),first_heartbeat:Oe().optional()});var Hn=c({version:n(1),install_id:k(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),$n=i({enrollment_ticket:t().min(1).max(4096),expires_at:y.datetime({offset:!0}),device_kind:n("headless"),lifecycle:s(["persistent","ephemeral"]),device_expires_at:y.datetime({offset:!0})});var Un=i({credentialKind:s(["oauth","api_key"]).optional(),apiOrigin:Et(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:y.datetime({offset:!0}),scopes:u(t().max(128)).max(128),orgId:t().min(1).max(160)});var je=8;var Yt=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,_e=(e)=>ee(m(e),"workspaces"),Xt="account.json",Zt=(e)=>f(ee(e,Xt));function Se(e){let r;try{r=Gt(_e(e))}catch{return[]}return r.filter((p)=>Yt.test(p)).sort().map((p)=>{let b=ee(_e(e),p),R=ee(b,"worker.json"),S=null;try{let P=B.safeParse(JSON.parse(h(R)));if(P.success&&P.data.stateDirectory===b)S=P.data}catch{}return{organizationId:p,directory:b,configPath:R,config:S,account:Zt(b)}})}var Qt=(e)=>ee(_e(e),"listed.json");function er(e){try{let r=JSON.parse(h(Qt(e))),p=r.names&&typeof r.names==="object"&&!Array.isArray(r.names)?Object.fromEntries(Object.entries(r.names).filter((R)=>typeof R[1]==="string")):{},b=r.refused&&typeof r.refused==="object"?r.refused:null;return{listed:r.listed===!0,reason:r.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(r.blocked)?r.blocked.filter((R)=>typeof R==="string"):[],names:p,...b&&typeof b.device==="string"&&typeof b.roots==="string"&&typeof b.at==="number"&&Number.isFinite(b.at)&&typeof b.count==="number"&&Number.isInteger(b.count)&&b.count>=1?{refused:{device:b.device,roots:b.roots,at:b.at,count:b.count}}:{}}}catch{return null}}function qe(e,r){let p=Se(e),b=p.filter((C)=>C.account),R=p.filter((C)=>!C.account),S=er(e),P=S&&!S.listed?S.reason:null,E=P||R.length===0&&S&&!S.listed?[]:R;if(b.length===0&&E.length===0&&(P||S&&!S.listed))return{workspaces:null,off:P};return{off:P,workspaces:[...b,...E].map(({organizationId:C,config:T,account:I})=>{let A=!1,D=null,L=!1,he=null;try{A=T?H(T).revoked:!1,D=T&&!A?M(T):null;let Le=T?dt(w(T).daemon):null;L=r&&!!D&&Le?.state==="connected",he=L?Vt(Le,D):null}catch{}return{...he?{permission_recovery:he}:{},organization_id:C,device_id:D?.deviceId??null,name:S?.names?.[C]??null,root:D?.roots[0]?{id:D.roots[0].id,permissions:D.roots[0].permissions}:null,state:A?"removed":L?"connected":"not_running",blocked:!I&&!A&&!L&&(S?.blocked.includes(C)??!1),...I?{account:!0}:{}}})}}import{readFileSync as rr}from"fs";function lr(e){try{let r=JSON.parse(rr(`${e}.keep-awake.json`,"utf8"));return r!==null&&typeof r==="object"&&"version"in r&&r.version===1&&"enabled"in r&&r.enabled===!0?"battery_and_ac":void 0}catch(r){return r.code==="ENOENT"?"battery_and_ac":void 0}}import{chmodSync as Hi,lstatSync as Ze,mkdtempSync as $i,realpathSync as nr,rmdirSync as Ui,rmSync as Bi,unlinkSync as Fi}from"fs";import{createConnection as ir,createServer as qi}from"net";import{basename as Je,dirname as Ge,join as oe}from"path";var ar=s(["status","drain","resume","stop","reload_roots"]),sr=c({version:n(1),instanceId:t(),deviceId:t(),phase:s(["starting","running","reconnecting","stopping"]),drained:d(),activeClaims:o().int().nonnegative(),activeSessions:o().int().nonnegative().optional(),executionEligible:d(),supportedOperations:u(s(wt)).max(wt.length).optional(),capabilityReadiness:os(s(wt),d()).optional(),lastHeartbeat:t().nullable(),expiresAt:t()}),Yi=c({nonce:t(),action:ar}),cr=i({nonce:k()}),dr=c({version:n(1),nonce:k(),socketPath:t().max(100)});function ur(e){return oe(w(e).lock,"control.json")}function Qe(e){return v(w(e).lock),cr.parse(JSON.parse(h(oe(w(e).lock,"owner.json"))))}function Xe(e){if(!f(e))return!1;let r=Ze(e);if(!r.isSocket()||r.uid!==process.getuid?.()||(r.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function et(e,r){let p=ur(e);if(!f(p)){let S=w(e).socket;if(!f(S)||!Ze(S).isSocket())return null;return Xe(S)?S:null}let b=dr.parse(JSON.parse(h(p)));if(b.nonce!==r)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!fr.test(b.socketPath))throw Error("worker_control_endpoint_invalid");return b.socketPath}let R=Ge(b.socketPath);if(Ge(R)!==nr("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(Je(R))||Je(b.socketPath)!=="control.sock"||Buffer.byteLength(b.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!f(R))return null;return v(R),Xe(b.socketPath)?b.socketPath:null}var fr=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;function mr(e,r){try{let p=JSON.parse(h(oe(w(e).lock,"owner.json"))),b=p&&typeof p==="object"?p[r]:void 0;return typeof b==="string"?b:null}catch{return null}}function tt(e){return mr(e,"runtime_version")}function ot(e,r){if(r)return r.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!f(oe(w(e).lock,"owner.json")))return"no_lock";return et(e,Qe(e).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var Xi=c({instance:t().nullable(),since:o().int().nonnegative()});async function G(e,r){let p=w(e);if(!f(oe(p.lock,"owner.json")))return null;let b=Qe(e),R=et(e,b.nonce);if(!R)return null;return new Promise((S,P)=>{let E=ir(R),C="",T=!1,I=(A,D)=>{if(T)return;if(T=!0,E.destroy(),D)P(D);else S(A)};E.setTimeout(2000,()=>E.destroy(Error("worker_control_timeout"))),E.on("connect",()=>E.write(JSON.stringify({nonce:b.nonce,action:r})+`
|
|
5
|
+
`)),E.on("data",(A)=>{if(C+=A.toString(),Buffer.byteLength(C)>16384)E.destroy(Error("worker_control_oversize"))}),E.on("error",(A)=>{if("code"in A&&["ECONNREFUSED","ENOENT"].includes(String(A.code)))I(null);else I(null,A.message==="worker_control_timeout"?A:Error("worker_control_unavailable"))}),E.on("end",()=>{try{let A=sr.parse(JSON.parse(C));if(A.instanceId!==b.nonce)throw Error("worker_instance_changed");I(A)}catch{I(null,Error("worker_control_invalid_response"))}}),E.once("close",()=>I(null,Error("worker_control_unavailable")))})}import{realpathSync as wr}from"fs";import{constants as Re}from"fs";import{open as pr}from"fs/promises";var na={platform:process.platform,home:a,async openFile(e){let r=await pr(e,Re.O_RDONLY|Re.O_NOFOLLOW|Re.O_NONBLOCK);return{isFile:async()=>(await r.stat()).isFile(),close:()=>r.close()}}};var $a=To(wr(process.execPath));var ps=Buffer.from([0,255,3,4]);import{execFile as Zr}from"child_process";import{promisify as Qr}from"util";var vr=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var Sr=new Set(["png","jpg","jpeg","gif","webp"]),Rr=new Set(["webm","mp4"]);function Er(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function at(e,r){let p;try{p=new URL(e)}catch{return null}let b=Er(r),R=p.hostname==="ara.so"||p.hostname.endsWith(".ara.so")||p.hostname==="reasonmachines.ai"||p.hostname.endsWith(".reasonmachines.ai")||p.hostname==="reasonmachines.com"||p.hostname.endsWith(".reasonmachines.com");if(p.protocol!=="https:"||!R&&p.origin!==b||p.username||p.password||p.port||p.search||p.hash)return null;let S=vr.exec(p.pathname);if(!S)return null;let P=S[1]?.toLowerCase(),E=S[2]?.toLowerCase(),C=S[3]?.toLowerCase(),T=S[4]?.toLowerCase();if(!P||!E||!C||!T)return null;let I=Sr.has(T)?"image":Rr.has(T)?"video":null;if(!I)return null;let A=/^(before|after)[\s:_-]+/.exec(C),D=p.pathname.replace(/^\/media\//,"");return{url:p.toString(),storagePath:D,runId:P,artifactId:E,fileName:`${C}.${T}`,kind:I,phase:A?.[1]==="before"||A?.[1]==="after"?A[1]:null}}var Pr=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,st=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),K=()=>{throw Error("cloud_browser_media_request_invalid")};function Pe(e){if(!st(e)||Object.keys(e).some((S)=>!["runId","configuredMediaOrigin","media"].includes(S))||typeof e.runId!=="string"||!Pr.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return K();let r;try{r=new URL(e.configuredMediaOrigin)}catch{return K()}if(r.protocol!=="https:"||r.username||r.password||r.port||!Ue(r.origin,{mode:"public_web"}).allowed)return K();let p=e.runId.toLowerCase(),b=new Set,R=e.media.map((S)=>{if(!st(S)||Object.keys(S).some((E)=>!["url","sourceUrl","kind"].includes(E))||typeof S.url!=="string"||S.url.length>2048||typeof S.sourceUrl!=="string"||S.sourceUrl.length>8192||!["image","video"].includes(String(S.kind)))return K();let P=at(S.url,r.origin);if(!P||new URL(P.url).origin!==r.origin||P.runId!==p||P.kind!==S.kind||P.url!==S.url||b.has(S.url))return K();if(b.add(S.url),S.sourceUrl!==S.url){let E;try{E=new URL(S.sourceUrl)}catch{return K()}let C=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(E.pathname)?.[1];if(S.kind!=="image"||E.origin!=="https://camo.githubusercontent.com"||E.username||E.password||E.search||E.hash||!C||C.length%2!==0||Buffer.from(C,"hex").toString("utf8")!==S.url)return K()}return{url:S.url,sourceUrl:S.sourceUrl,kind:S.kind}});return{runId:e.runId,configuredMediaOrigin:r.origin,media:R}}var x=t().uuid(),X=t().regex(/^[a-f0-9]{64}$/),V=y.datetime({precision:3}),Ce=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),ut=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),U=i({kind:n("primary_mac"),version:n(1),organizationId:Ce,userId:Ce,sessionId:Ce,runId:x,deviceId:x,rootId:x,rootRevision:t().min(1).max(64),binding:s(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:x,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Cr=on().transform((e,r)=>{try{return dn(e)}catch{return r.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),Fo}}),ue=i({version:n(1),owner:U,contextId:x,preparedAt:V,expiresAt:V,prUrl:ut,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:X,evidenceKind:s(["image","video"]),visualPlan:Cr.optional(),uploadOrigin:t().url().refine((e)=>{let r=new URL(e);return r.protocol==="https:"&&r.origin===e&&!r.username&&!r.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),Ar=i({version:n(1),producer:n("primary_mac"),context:ue,captureId:x,operationId:x,attemptId:x,tabId:o().int().positive(),startedAt:V,finishedAt:V,sha256:X,media:g("contentType",[i({contentType:n("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),i({contentType:n("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,r)=>{let p=Date.parse(e.startedAt),b=Date.parse(e.finishedAt);if(p<Date.parse(e.context.preparedAt)||b<p||b>Date.parse(e.context.expiresAt)||b-p>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((b-p)/1000-e.media.durationSeconds)>0.1))r.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),uc=g("action",[i({action:n("screenshot"),context_id:x,tab_id:o().int().positive()}).strict(),i({action:n("start_video"),context_id:x,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),i({action:n("stop_video"),recording_operation_id:x}).strict()]),fe=i({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),ce=t().regex(/^[1-9][0-9]{0,19}$/),le=i({version:n(1),owner:U,expectedActorId:ce.nullable(),repositoryId:ce,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),xr=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],Ir=g("status",[le.extend({status:n("ready"),observedActor:fe,checkedAt:V}),le.extend({status:n("not_ready"),reason:s(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:s(xr).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),Y=i({version:n(1),owner:U,expectedActorId:ce.nullable(),authenticatedActor:fe,attemptId:x,captureId:x,prUrl:ut,repositoryId:ce,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:X,sizeBytes:o().int().min(128).max(10485760),contentType:n("video/webm")}).strict(),ft=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),Or=g("status",[Y.extend({status:n("not_attempted"),reason:s(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),Y.extend({status:n("uncertain"),reason:n("upload_outcome_unknown")}),Y.extend({status:n("uploaded"),observedActor:fe,nativeUrl:ft,uploadedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),de=Y.extend({nativeUrl:ft,observedActor:fe,bodySha256:X}),Tr=g("status",[de.extend({status:n("incomplete"),reason:s(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),de.extend({status:n("verified"),sourceSha256:X,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:n(!0),verifiedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Dr=on().transform((e,r)=>{try{let p=Pe(e);if(p.media.some((b)=>b.kind!=="image"))throw Error();return p}catch{return r.addIssue({code:"custom",message:"proof_media_request_invalid"}),Fo}}),Lr=g("action",[i({action:n("auth_check"),input:le}).strict(),i({action:n("prepare"),context:ue}).strict(),i({action:n("capture_png"),owner:U,contextId:x,tabId:o().int().positive()}).strict(),i({action:n("start_video"),owner:U,contextId:x,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),i({action:n("inspect_capture"),owner:U,captureId:x}).strict(),i({action:n("publish_video"),input:Y}).strict(),i({action:n("verify_png_media"),owner:U,media:Dr}).strict().refine((e)=>e.media.runId===e.owner.runId),i({action:n("verify_saved_media"),input:de}).strict(),i({action:n("publish_png"),owner:U,attemptId:x,captureId:x,sha256:X,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var Hr=i({requestId:x,command:Lr}).strict();var $r={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},ct={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},lt={type:"integer",minimum:1,description:"An already-owned tab's id."},fc={...$r,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:ct,tab_id:lt}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:ct,tab_id:lt,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};var wc=i({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict();var Ur=String.raw`async (media) => {
|
|
6
6
|
const deadline = (promise) => {
|
|
7
7
|
let timer;
|
|
8
8
|
return Promise.race([promise, new Promise((_, reject) => {
|
|
@@ -49,4 +49,4 @@ ${r?.directory??m(e)}`).digest("hex")}var Ht="keychain-scope.json";var $t=c({ver
|
|
|
49
49
|
}
|
|
50
50
|
}));
|
|
51
51
|
return { verified: true, items };
|
|
52
|
-
}`;import{execFile as
|
|
52
|
+
}`;import{execFile as Br}from"child_process";import{promisify as Fr}from"util";var Sc=Fr(Br);var Uc=g("ok",[i({ok:n(!0),actor:i({login:t(),id:t().nullable()}).strict()}).strict(),i({ok:n(!1),reason:s(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),Bc=i({version:n("0.1.42"),metadata:i({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var qc=i({version:n(1),recording_operation_id:t().uuid(),proof_ready:n(!1),acknowledged_at:y.datetime()}).strict(),me=i({action:n("start"),request_id:t().uuid(),profile:t().regex(/^(Default|Profile [0-9]+)$/),tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),mt=i({action:n("inspect"),recording_operation_id:t().uuid()}).strict(),zc=g("action",[me,mt]),pt=i({recording_operation_id:t().uuid()}).strict(),Ie={device_id:t().uuid(),root_id:t().uuid()},qr=g("action",[me.extend(Ie),mt.extend(Ie),pt.extend({...Ie,action:n("stop")})]),Kc=nn(qr),Vc=i({version:n(1),recordingId:t().uuid(),proofReady:n(!1),capture:i({captureId:t().uuid(),contentType:n("video/webm"),sha256:t().regex(/^[a-f0-9]{64}$/),sizeBytes:o().int().min(128).max(10485760),startedAt:y.datetime(),finishedAt:y.datetime(),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000),owner:i({runId:t().uuid(),deviceId:t().uuid(),rootId:t().uuid(),rootRevision:t().max(64),profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024),generation:t().uuid(),browserScope:t().max(128),tabId:o().int().positive()}).strict()}).strict().refine((e)=>e.receivedFrameCount>=e.frameCount&&Math.abs((Date.parse(e.finishedAt)-Date.parse(e.startedAt))/1000-e.durationSeconds)<=0.1)}).strict();var ol=me.extend({action:s(["start","inspect"]),recording_boot_generation:t().uuid(),recording_operation_id:t().uuid().optional(),recording_attempt_id:t().uuid().optional()}).strict();import{execFile as zr}from"child_process";import{promisify as Kr}from"util";var sl=Kr(zr);var Vr=s(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var j=t().min(1).max(1024),ht=i({path:j,sha256:t().regex(/^[a-f0-9]{64}$/)}).strict(),Jr=i({owner:i({runId:j,deviceId:j,rootId:j,rootRevision:j,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:j,generation:j,browserScope:j,tabId:o().int().positive()}).strict(),socketPath:j,extensionId:t().regex(/^[a-p]{32}$/),nativeHostName:j,seconds:o().int().min(1).max(15),encoder:i({ffmpeg:ht,ffprobe:ht}).strict()}).strict();var Al=i({version:n("0.1.42"),metadata:i({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var Ul=i({operationId:t().uuid()}).strict();var id=Qr(Zr);var ad=i({version:n("0.1.42"),metadata:i({extensionId:n(F),extensionInstanceId:t().min(1).max(1024)})});var Te=1;var Af=c({type:n("configure"),protocol:n(Te),version:t(),config:B}),xf=c({type:n("ticket"),organizationId:t().min(1).max(160),receipt:Oe()}),If=c({type:s(["ping","stop"])});var Kf=c({type:n("hello"),protocol:n(Te),version:t(),platform:s(["linux","darwin"]),architecture:s(["arm64","x64"]),enrolled:d()}),Vf=c({type:n("ticket-request"),request:c({install_id:k(),code_challenge:t().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:s(["persistent","ephemeral"]),roots:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),execution_mode:s(["confined","host"]),permissions:c({read:n(!0),write:n(!0),execute:n(!0),discover_environment:n(!0),expose_mcp:n(!1)})})).length(1)})}),Jf=g("type",[c({type:n("running"),deviceId:t().min(1).max(160),expiresAt:y.datetime({offset:!0}),lifetime:s(["persistent","ephemeral"]),supervision:n("ssh-foreground")}),c({type:n("pong")}),c({type:n("stopped")})]);var go=1;var Z=k(),wo=c({kind:n("install_only"),authorityId:Z,organizationId:Z,userId:Z,connectionId:Z,attemptId:Z,purpose:n("install"),generation:o().int().positive(),transport:n("reverse_ssh"),expiresAt:y.datetime({offset:!0}),maxDurationMs:n(300000),maxChannels:n(1),allowTcpForwarding:n(!1),allowPty:n(!1)}),yo=t().max(2048).superRefine((e,r)=>{let p;try{p=new URL(e)}catch{r.addIssue({code:"custom",message:"invalid relay url"});return}if(p.protocol!=="ws:"&&p.protocol!=="wss:"){r.addIssue({code:"custom",message:"invalid relay protocol"});return}if(p.username||p.password||p.search||p.hash){r.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let b=p.pathname.split("/");if(b.length!==4||b[1]!=="device"||!Z.safeParse(b[2]).success||!/^[a-f0-9]{64}$/.test(b[3]??""))r.addIssue({code:"custom",message:"invalid device relay path"});if(p.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(p.hostname))r.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var Xf=c({protocol:n(go),type:n("ssh_install_relay"),authorityToken:t().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:wo,relayUrl:yo,endpoint:c({host:n("127.0.0.1"),port:n(22)})});class Rt extends Error{}function Be(e){if(!f(e))return null;let r=new Rt(`${e} is not a valid worker config. Remove it to start over.`),p;try{p=JSON.parse(h(e))}catch(R){if(R instanceof SyntaxError)throw r;throw R}let b=B.safeParse(p);if(!b.success)throw r;return b.data}var Co=200;var zp=c({version:n(1),session_ids:u(t().min(1).max(200)).max(Co)});function rt(e,r,p=!1){let b=Ao(e,r,p);return b.length===1?b[0]:J(ke(J(e,".config")),...Pt(r,p))}var Pt=(e,r)=>[...e==="production"?[]:[e],r?"connect-once":"connect"];function Ao(e,r,p=!1){let b=e;try{b=pe(e)}catch{}return["ara","reason"].map((R)=>J(b,".config",R,...Pt(r,p))).filter(xo)}function xo(e){try{if(pe(e)!==e)return!1;return Be(J(e,"worker.json"))?.stateDirectory===e}catch{return!1}}var Oo="disconnected.json";function ls(e,r){return f(J(rt(e,r),Oo))}function Do(e,r){return r==="darwin"&&e.userChrome!==!1}var vg=i({root:i({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});var Sg=Symbol("serve here");async function us(e={}){let r=pe(e.home??a()),p=Be(J(rt(r,e.channel??_()),"worker.json"));if(!p)return null;let b,R=await(e.controlWorker??G)(p,"status").catch((L)=>(b=L instanceof Error?L:Error(String(L)),null)),S=R?tt(p):null,P=e.serviceHost??xe(r),E=Ye(p,P,"connect"),C=H(p).revoked,T=!C&&!R,I=(()=>{try{return M(p)}catch{return null}})(),{workspaces:A,off:D}=C||we(p.stateDirectory)!==null?{workspaces:null,off:null}:qe(p,R?.phase==="running");return{workspaces:A,workspaces_off:D,workspaces_max:je+(A?.filter((L)=>L.account).length??0),name:p.name,device_id:I?.deviceId??null,organization_id:I?.orgId??null,folder:p.workspaceRoot,mode:p.executionMode,sessions_max:null,user_chrome:Do(p,P.platform),cloud_sessions:p.cloudSessions===!0,root:I?.roots[0]?{id:I.roots[0].id,permissions:I.roots[0].permissions}:null,roots:I?.roots.map((L)=>({id:L.id,folder:L.path,permissions:L.permissions}))??[],state:C?"removed":R?R.phase==="running"?"connected":R.phase:"not_running",not_running_reason:T?ot(p,b):null,worker_alive:T&&E?Jn(E,P):null,sessions_running:R?.activeSessions??null,version:S,service:E?{label:E.label,logs:E.logs}:null}}function ds(e={}){let r=pe(e.home??a()),p=Be(J(rt(r,e.channel??_()),"worker.json"));if(!p)return null;return Wr(p,e.serviceHost??xe(r),"connect")?.label??null}export{w,M,lr,Be,rt,ls,us,ds};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{T}from"./vm-hands-entry-lite-fcvf8md1.js";import{Vr}from"./vm-hands-entry-lite-
|
|
2
|
+
import{T}from"./vm-hands-entry-lite-fcvf8md1.js";import{Vr}from"./vm-hands-entry-lite-8t10rxfx.js";import{ht}from"./vm-hands-entry-lite-arrmd8qx.js";import{a}from"./vm-hands-entry-lite-cf1x5cbr.js";import{A}from"./vm-hands-entry-lite-vdhgwmmp.js";import{randomUUID as f}from"crypto";import{chmodSync as U,closeSync as h,constants as g,existsSync as me,fstatSync as F,lstatSync as R,mkdirSync as B,openSync as G,readFileSync as Y,readdirSync as z,readlinkSync as J,realpathSync as P,renameSync as _,rmSync as p,statSync as K,symlinkSync as gt,unlinkSync as M,writeFileSync as L}from"fs";import{basename as yt,dirname as S,isAbsolute as fe,join as c,relative as ge,resolve as b,sep as _e}from"path";import{createRequire as H}from"module";var q=1,j=1,ye=128,ve=65536;var he=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var D=/^[a-z0-9_.-]{1,80}$/,be=64,Ee="so.ara.device-broker",Me=[Ee,"com.reasonmachines.device-broker"],Pt=Vr(Me);var we=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function W(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function X(e,t,n=[]){let r=new Set([...t,...n]);return t.every((i)=>(i in e))&&Object.keys(e).every((i)=>r.has(i))}function E(e){return typeof e==="string"&&he.test(e)}function Z(e){return typeof e==="string"&&!Number.isNaN(Date.parse(e))&&new Date(e).toISOString()===e}function k(e){B(e,{recursive:!0,mode:448}),U(e,448)}function Re(e,t){k(S(e));let n=`${e}.${process.pid}.${f()}.tmp`;try{L(n,t,{mode:384,flag:"wx"}),U(n,384),_(n,e)}finally{if(me(n))M(n)}}function gs(e={}){if((e.platform??process.platform)!=="darwin")throw new ht("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let n=e.environment??process.env,r=T(n,"REASON_CLI_CHANNEL")==="staging",i=r?T(n,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,o=e.root!==void 0||Boolean(i&&fe(i))?null:c(e.home??a(),"Library","Application Support"),d=e.root??(o?c(o,r?"Reason Staging":"Reason","CLI"):i);return{executableName:"reason",root:d,...o?{legacyRoot:c(o,"Ara",...r?["staging","runtime"]:["runtime"])}:{},versions:c(d,"versions"),current:c(d,"current"),previous:c(d,"previous"),brokerLock:c(d,"broker.lock"),transitionLock:c(d,"transition.lock"),lifecycleEvents:c(d,"lifecycle-events")}}function _s(e){let t=e.legacyRoot;if(!t)return null;return{root:t,versions:c(t,"versions"),current:c(t,"current"),previous:c(t,"previous"),brokerLock:c(t,"broker.lock"),transitionLock:c(t,"transition.lock"),lifecycleEvents:c(t,"lifecycle-events")}}function pe(e,t){let n;try{if(!R(e).isSymbolicLink())return null;n=J(e)}catch{return null}let r=n.match(/^versions\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\/(ara|Reason|reason)$/);return r&&(r[2]==="ara"||r[2]===t)?r[1]:null}function ys(e){return pe(e.current,e.executableName)}function O(e,t,n){let i=ge(t,e).split(_e);return i.length===2&&E(i[0])&&(i[1]==="ara"||n!==void 0&&i[1]===n)?i[0]:null}function Le(e,t){try{return R(t).isSymbolicLink()&&b(S(t),J(t))===b(e.current)}catch{return!1}}function bs(e,t=process.execPath){try{return O(P(t),P(e.versions),e.executableName)!==null}catch{let n=b(t);return n===b(e.current)||Le(e,n)||O(n,b(e.versions),e.executableName)!==null}}function Ae(e){return W(e)&&X(e,["schema_version","pid","nonce","started_at","runtime_version"])&&e.schema_version===q&&typeof e.pid==="number"&&Number.isSafeInteger(e.pid)&&e.pid>0&&typeof e.nonce==="string"&&/^[0-9a-f-]{36}$/.test(e.nonce)&&Z(e.started_at)&&E(e.runtime_version)}function Q(e,t){try{let n=R(e);if(!n.isDirectory()||!A(n))return null;let r=G(c(e,t),g.O_RDONLY|g.O_NOFOLLOW|g.O_NONBLOCK);try{let i=F(r);if(!i.isFile()||i.nlink!==1||!A(i)||i.size>4096)return null;return Y(r,"utf8")}finally{h(r)}}catch{return null}}function N(e){try{let t=JSON.parse(Q(e,"owner.json")??"null");return Ae(t)?t:null}catch{return null}}function ee(e){try{return process.kill(e,0),!0}catch(t){return!(t instanceof Error&&("code"in t)&&t.code==="ESRCH")}}var C="lease",Ne=2,Se=4,y;function ke(){if(y!==void 0)return y;if(y=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let e;try{e=H(import.meta.url)("bun:ffi")}catch{return null}let t=process.platform==="darwin"?"__error":"__errno_location",n=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let r of n)try{let i=e.dlopen(r,{flock:{args:[e.FFIType.i32,e.FFIType.i32],returns:e.FFIType.i32},[t]:{args:[],returns:e.FFIType.ptr}}),s=i.symbols[t]();if(s===null)continue;return y={flock:(o,d)=>i.symbols.flock(o,d),errno:()=>e.read.i32(s),wouldBlock:process.platform==="darwin"?35:11},y}catch{}return null}var v,Ie=3221225472,Te=4,xe=128,Pe=32;function De(e){if(v===void 0){v=null;try{let s=H(import.meta.url)("bun:ffi"),{FFIType:o}=s;v={kernel:s.dlopen("kernel32.dll",{CreateFileW:{args:[o.ptr,o.u32,o.u32,o.ptr,o.u32,o.u32,o.ptr],returns:o.i64_fast},CloseHandle:{args:[o.i64_fast],returns:o.i32},GetLastError:{args:[],returns:o.u32}}).symbols,ptr:(l)=>s.ptr(l)}}catch{return null}}if(!v)return null;let{kernel:t,ptr:n}=v,r=Buffer.from(`${e}\x00`,"utf16le"),i=t.CreateFileW(n(r),Ie,0,null,Te,xe,null);if(Number(i)===-1)return t.GetLastError()===Pe?"busy":null;return{release:()=>{t.CloseHandle(i)}}}function Oe(e){if(process.platform==="win32")return De(`${e}.lease`);let t=ke();if(!t)return null;let n=G(`${e}.lease`,g.O_RDWR|g.O_CREAT|g.O_NOFOLLOW,384);try{let r=F(n);if(!r.isFile()||r.nlink!==1||!A(r))return h(n),"busy";if(t.flock(n,Ne|Se)===0)return{release:()=>h(n)};let i=t.errno();return h(n),i===t.wouldBlock?"busy":null}catch(r){throw h(n),r}}function vs(e){k(S(e.path));let t=Oe(e.path);if(t==="busy")return{acquired:!1,owner:N(e.path),recoveredStaleOwner:!1};let n=t!==null;try{let r=Ce(e,t);if(r.acquired)n=!1;return r}finally{if(n)t.release()}}function Ce(e,t){let n=e.alive??ee,r=!1;for(let i=0;i<4;i+=1){let s={schema_version:q,pid:e.pid??process.pid,nonce:e.nonce?.()??f(),started_at:(e.now?.()??new Date).toISOString(),runtime_version:e.runtimeVersion},o=`${e.path}.init-${process.pid}-${f()}`,d=!1;try{if(B(o,{mode:448}),L(c(o,"owner.json"),`${JSON.stringify(s)}
|
|
3
3
|
`,{mode:384,flag:"wx"}),t!==null)L(c(o,C),`flock
|
|
4
4
|
`,{mode:384,flag:"wx"});e.beforePublish?.();try{throw R(e.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(m){if(m.code!=="ENOENT")throw m}_(o,e.path),d=!0;let l=!1;return{acquired:!0,owner:s,recoveredStaleOwner:r,release(){if(l)return;if(l=!0,N(e.path)?.nonce===s.nonce)p(e.path,{recursive:!0,force:!0});t?.release()}}}catch(l){let m=l.code;if(!["EEXIST","ENOTEMPTY"].includes(m??""))throw l;let u=N(e.path),re=(e.now?.()??new Date).getTime(),ie=u&&e.staleAfterMs!==void 0?re-Date.parse(u.started_at)<e.staleAfterMs:!1,ae=u!==null&&!(t!==null&&Q(e.path,C)!==null)&&n(u.pid);if(!u||ae||ie)return{acquired:!1,owner:u,recoveredStaleOwner:!1};let I=`${e.path}.stale-${process.pid}-${f()}`;try{_(e.path,I),p(I,{recursive:!0,force:!0}),r=!0}catch(x){let oe=x.code;if(!["ENOENT","EEXIST"].includes(oe??""))throw x}}finally{if(!d)p(o,{recursive:!0,force:!0})}}throw new ht("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function te(e){return W(e)&&X(e,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&e.schema_version===j&&typeof e.event_id==="string"&&/^[0-9a-f-]{36}$/.test(e.event_id)&&Z(e.occurred_at)&&typeof e.event==="string"&&we.includes(e.event)&&E(e.runtime_version)&&(e.from_version===void 0||E(e.from_version))&&(e.to_version===void 0||E(e.to_version))&&(e.reason_code===void 0||typeof e.reason_code==="string"&&D.test(e.reason_code))&&(e.duration_ms===void 0||typeof e.duration_ms==="number"&&Number.isSafeInteger(e.duration_ms)&&e.duration_ms>=0&&e.duration_ms<=86400000)&&(e.attempt_count===void 0||typeof e.attempt_count==="number"&&Number.isSafeInteger(e.attempt_count)&&e.attempt_count>=1&&e.attempt_count<=1e5)&&(e.retry_in_ms===void 0||typeof e.retry_in_ms==="number"&&Number.isSafeInteger(e.retry_in_ms)&&e.retry_in_ms>=0&&e.retry_in_ms<=30000)&&(e.capabilities===void 0||Array.isArray(e.capabilities)&&e.capabilities.length<=be&&e.capabilities.every((t)=>typeof t==="string"&&D.test(t)))}var Ve=/^(\d{22}-[0-9a-f-]{36}\.json)$/,Ue=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,Fe=300000,w=0n;function Be(e){let t=BigInt(new Date(e.occurred_at).getTime())*1000000n;return w=t>w?t:w+1n,`${String(w).padStart(22,"0")}-${e.event_id}.json`}function ne(e){try{return z(e.lifecycleEvents).filter((t)=>Ve.test(t)).sort()}catch{return[]}}function V(e){try{let t=JSON.parse(Y(e,"utf8"));return te(t)?t:null}catch{return null}}function $e(e,t=ee,n=Date.now()){let r;try{r=z(e.lifecycleEvents)}catch{return}for(let i of r){let s=i.match(Ue);if(!s)continue;let o=c(e.lifecycleEvents,i),d=c(e.lifecycleEvents,s[1]),l=!t(Number(s[2]));if(!l)try{l=n-K(o).mtimeMs>=Fe}catch{continue}if(!l)continue;try{_(o,d)}catch(m){let u=m.code;if(u==="EEXIST")M(o);else if(u!=="ENOENT")throw m}}}function Ge(e){let n=ne(e).flatMap((i)=>{try{return[{name:i,size:K(c(e.lifecycleEvents,i)).size}]}catch{return[]}}),r=n.reduce((i,s)=>i+s.size,0);while(n.length>ye||r>ve){let i=n.shift();if(!i)break;try{M(c(e.lifecycleEvents,i.name)),r-=i.size}catch(s){if(s.code!=="ENOENT")throw s}}}function Ss(e,t,n={}){let r={schema_version:j,event_id:n.eventId?.()??f(),occurred_at:(n.now?.()??new Date).toISOString(),...t};if(!te(r))throw new ht("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return k(e.lifecycleEvents),Re(c(e.lifecycleEvents,Be(r)),`${JSON.stringify(r)}
|
|
5
5
|
`),Ge(e),r}async function Es(e,t,n){$e(e);let r=0;for(let i of ne(e)){let s=c(e.lifecycleEvents,i);if(n){let l=V(s);if(!l||!n(l))continue}let o=`${s}.sending-${process.pid}-${f()}`;try{_(s,o)}catch(l){if(l.code==="ENOENT")continue;throw l}let d=V(o);if(!d){M(o);continue}try{await t(d),M(o),r+=1}catch{try{_(o,s)}catch(l){if(l.code!=="ENOENT")throw l}break}}return r}export{gs,_s,ys,bs,vs,Ss,Es};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{ct,Lt,Cr,xn,Ar,kn,Cn,An}from"./vm-hands-entry-lite-ey2hbfs8.js";import{Pe,ir,ti,yt,Mo,oe,$o,Bo,et,Te,rn,ni,bt,ai,ci,li,ui,di,pi,hi,fi,mi,gi,_i,yi,wi,pe,Y,Re,q,bi,vi,Si,Ei,xi,ki,Ci,Ai,vt,Pi}from"./vm-hands-entry-lite-mb6atrr0.js";import{ue,Z,O}from"./vm-hands-entry-lite-3krzmhkk.js";import{P,Jt}from"./vm-hands-entry-lite-5zdybh8s.js";import{pr,Gi,Ki,it,Ji,Zi,Xi,Yi,Qi,eo,mr,gr,_r,gn,_n,yr,ro,yn,wr,me,ge,Rt,br,Sr,Ot}from"./vm-hands-entry-lite-
|
|
2
|
+
import{ct,Lt,Cr,xn,Ar,kn,Cn,An}from"./vm-hands-entry-lite-ey2hbfs8.js";import{Pe,ir,ti,yt,Mo,oe,$o,Bo,et,Te,rn,ni,bt,ai,ci,li,ui,di,pi,hi,fi,mi,gi,_i,yi,wi,pe,Y,Re,q,bi,vi,Si,Ei,xi,ki,Ci,Ai,vt,Pi}from"./vm-hands-entry-lite-mb6atrr0.js";import{ue,Z,O}from"./vm-hands-entry-lite-3krzmhkk.js";import{P,Jt}from"./vm-hands-entry-lite-5zdybh8s.js";import{pr,Gi,Ki,it,Ji,Zi,Xi,Yi,Qi,eo,mr,gr,_r,gn,_n,yr,ro,yn,wr,me,ge,Rt,br,Sr,Ot}from"./vm-hands-entry-lite-b3my57wp.js";import{D,R,b}from"./vm-hands-entry-lite-wwp36b4m.js";import{zi,qi,fn,Wi,mn,Vi,nt,dr}from"./vm-hands-entry-lite-kxv5aapg.js";import{K}from"./vm-hands-entry-lite-fykfnzjg.js";import{He}from"./vm-hands-entry-lite-hzh8fdxx.js";import{j}from"./vm-hands-entry-lite-tmart4k9.js";import{ur,hn,Hi}from"./vm-hands-entry-lite-1f0v3jb4.js";import{fo,mo,lt,go,_o,yo,wo,bo}from"./vm-hands-entry-lite-jyvmw8b7.js";import{Or,qt,Ir,Fn,jn}from"./vm-hands-entry-lite-wxz5n6tc.js";import{$t,qe,Bt}from"./vm-hands-entry-lite-d4hba9jc.js";import{Nn,x,uo}from"./vm-hands-entry-lite-1wqascar.js";import{po,ho}from"./vm-hands-entry-lite-daywc3a6.js";import{Mt,Pn,Tn}from"./vm-hands-entry-lite-y5pfe77y.js";import{ye,oo,so}from"./vm-hands-entry-lite-h6rhk6h1.js";import{be}from"./vm-hands-entry-lite-yretc2th.js";import{Nt}from"./vm-hands-entry-lite-np07qyeq.js";import{ve,jt,Ut,Ht,E}from"./vm-hands-entry-lite-txd50spx.js";import{a,ie}from"./vm-hands-entry-lite-cf1x5cbr.js";import{t,k,o,d,u,i,W,g,ee,s,n,Uo}from"./vm-hands-entry-lite-vmnxnr7y.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{fe,Ne,Le,Me,sn}from"./vm-hands-entry-lite-vdhgwmmp.js";import{$e}from"./vm-hands-entry-lite-mcjca0ez.js";import{request as kl}from"http";import{request as Tl}from"https";import{lookup as Dl}from"dns/promises";import{isIP as Nl}from"net";async function Ml(e){let l=new URL(e.url);return await new Promise((c,p)=>{let m=(l.protocol==="https:"?Tl:kl)(l,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:xn},(f)=>c({response:f,close:()=>{f.destroy(),m.destroy(),f.socket?.destroy()}}));m.once("error",p),m.once("timeout",()=>m.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),m.end(e.body)})}var ji=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),$l=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function es(e,l=0){if(!e||typeof e!=="object"||l>3)return null;let c=e.code;if(typeof c==="string"){if(ji.has(c))return"custom_endpoint_host_not_found";if($l.has(c))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(c))return"custom_endpoint_tls_failed"}for(let p of[...e instanceof AggregateError?e.errors:[],e.cause]){let m=es(p,l+1);if(m)return m}return null}async function Bl(e,l){let c=es(e),p=new URL(l).hostname.replace(/^\[|\]$/g,"");if(c!==null&&c!=="custom_endpoint_connection_failed"||Nl(p)!==0)return c;let m;return await Promise.race([Dl(p).then(()=>!0,(h)=>!ji.has(String(h?.code))),new Promise((h)=>{m=setTimeout(()=>h(!0),5000)})]).finally(()=>clearTimeout(m))?c:"custom_endpoint_host_not_found"}function Fl(e){for(let l=42;;l++){if(l===127)l=256;let c=String.fromCodePoint(l);if(!e.includes(c))return c}}function Ul(e,l){let c=Buffer.from(e),p=Buffer.from(l),m=new Uint32Array(c.length);for(let h=1,y=0;h<c.length;h++){while(y&&c[h]!==c[y])y=m[y-1];if(c[h]===c[y])y++;m[h]=y}let f=0;return(h,y=!1)=>{let S=Buffer.allocUnsafe(h.length*p.length+f),w=0;for(let _ of h){while(f&&c[f]!==_){let v=m[f-1];w+=c.copy(S,w,0,f-v),f=v}if(c[f]===_){if(f++,f===c.length)w+=p.copy(S,w),f=0}else S[w++]=_}if(y)w+=c.copy(S,w,0,f),f=0;return S.subarray(0,w)}}async function ts(e){e.signal.throwIfAborted();let l=kn.safeParse(e.payload);if(!l.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let c=l.data,p=Cn.parse(await e.credential(e.signal));if(!Ar(c,{baseUrl:c.baseUrl,api:p.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let m,f,h=0,y=0,S=0,w=Fl(p.apiKey),_=Ul(p.apiKey,w),v=async(I,A)=>{e.signal.throwIfAborted(),await new Promise((M,N)=>{let L=()=>{e.signal.removeEventListener("abort",L),N(e.signal.reason)};if(e.signal.addEventListener("abort",L,{once:!0}),e.signal.aborted){L();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(I,A))).then(()=>{e.signal.removeEventListener("abort",L),M()},(B)=>{e.signal.removeEventListener("abort",L),N(B)})})},C=async(I)=>{if(h+=I.length,h>Lt)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let A=0;A<I.length;A+=ct){if(S>=Cr)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await v(`custom_endpoint.chunk.${S++}`,{eof:!1,data:I.subarray(A,A+ct).toString("base64")})}};try{let I=await Ml({url:c.url,body:c.body,signal:e.signal,headers:{...c.headers,...p.api==="anthropic-messages"?{"x-api-key":p.apiKey}:{authorization:`Bearer ${p.apiKey}`}}});m=I.response,f=I.close;let A=m.statusCode??500;if(A>=300&&A<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(m.headers["content-encoding"]&&m.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let M={};for(let N of["content-type","retry-after","x-request-id","request-id"]){let L=m.headers[N];if(typeof L==="string")M[N]=L.replaceAll(p.apiKey,w).slice(0,4096)}await v("custom_endpoint.headers",{status:A,statusText:(m.statusMessage??"").replaceAll(p.apiKey,w).slice(0,256),headers:M});for await(let N of m){e.signal.throwIfAborted();let L=Buffer.isBuffer(N)?N:Buffer.from(N);if(y+=L.length,y>Lt)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(_(L))}return await C(_(Buffer.alloc(0),!0)),await v(`custom_endpoint.chunk.${S}`,{eof:!0}),{bytes:h,chunks:S}}catch(I){if(e.signal.throwIfAborted(),I instanceof r)throw I;throw new r((m?null:await Bl(I,c.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{f?.()}}import{join as rs}from"path";function Hl(e,l){return e===rs(l,".ara","workspace")||e===rs(l,".reason","workspace")}function ns(e,l){let c=e.filter((p)=>Hl(p.path,l));return c.length===1?c[0].path:null}var jl=/^[a-f0-9]{64}$/;var nn=32,ql=/^\/[^\x00-\x1f\x7f\\]*$/;function xr(e){if(typeof e!=="string"||e.length>4096||!ql.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((l)=>l!==""&&l!=="."&&l!=="..")}function Er(e,l){let c=l==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!c)return e;let p=c[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${c[1].toUpperCase()}:${p?`/${p}`:""}`}function on(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let l=e;if(!xr(l.home)||!Array.isArray(l.roots)||l.roots.length>nn)return;let c=[];for(let p of l.roots){if(!p||typeof p!=="object"||Array.isArray(p))return;let{path_fingerprint:m,path:f}=p;if(typeof m!=="string"||!jl.test(m)||!xr(f))return;c.push({path_fingerprint:m,path:f})}return{home:l.home,roots:c}}function Wl(e){let l=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&l?l:void 0}function zl(e){return Wl(e)??e.email.toLowerCase()}function an(e){let l=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return l?zl({name:l[1],email:l[2]}):e.trim().toLowerCase()}var zt=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(l)=>`[${l.toLowerCase()}${l.toUpperCase()}]`),Gl=[...ve.map((e)=>`/(${e.map(zt).join("/")})(/|$)`),...jt.map((e)=>`/(${e.map(zt).join("/")})(/|$)`),...[...Ut].map((e)=>`/(${zt(e)})$`),`/${zt(".env.")}[^/]*$`,...Ht.map((e)=>`/[^/]*${zt(e)}$`)],os=`function localGithubSandboxProfile(root, temporary) {
|
|
3
3
|
return ['(version 1)','(deny default)','(import "system.sb")','(allow process-exec process-fork)',
|
|
4
4
|
'(allow file-read* (subpath "/bin") (subpath "/sbin") (subpath "/usr/bin") (subpath "/usr/sbin") (subpath "/usr/libexec") (subpath "/usr/share") (subpath "/private/var/select") (literal "/private/var/db/xcode_select_link"))',
|
|
5
5
|
'(allow file-read-metadata (path-ancestors "/opt/homebrew/bin") (path-ancestors "/usr/local/bin") (path-ancestors "/Library/Developer/CommandLineTools"))',
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
var Qt={name:"github-native-engineer-device-worker-production",version:"0.2.
|
|
2
|
+
var Qt={name:"github-native-engineer-device-worker-production",version:"0.2.482",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@agentclientprotocol/sdk":"1.9.0","@anthropic-ai/sandbox-runtime":"^0.0.80","@earendil-works/pi-tui":"1.0.0","@reason/runtime-distribution":"workspace:*",diff:"8.0.4","open-browser-use-sdk":"0.1.42","playwright-core":"1.60.0",toml:"4.2.0",zod:"^4.4.3"},overrides:{"@hono/node-server":"^1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"^1.20.0","basic-ftp":"^6.2.1","@grpc/grpc-js":"^1.14.5",browserslist:"^4.28.8","engine.io":"^6.6.7","fast-uri":"^3.1.8",hono:"^4.13.7","ip-address":"^10.7.1",nanoid:"^3.3.18",dompurify:"^3.4.17",postcss:"^8.5.23",qs:"^6.16.0","shell-quote":"^1.11.0","socket.io-parser":"^4.2.7",tmp:"^0.2.7",toml:"^4.2.0",undici:"^8.10.2",ws:"^8.21.0","js-yaml":"^4.3.2","@modelcontextprotocol/sdk":"^1.31.0","proxy-addr":"^2.0.8","source-map-js":"^1.2.2"}};
|
|
3
3
|
export{Qt};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{We,co,F,Ve,Ft,Tr,x}from"./vm-hands-entry-lite-
|
|
2
|
+
import{We,co,F,Ve,Ft,Tr,x}from"./vm-hands-entry-lite-1wqascar.js";import{K}from"./vm-hands-entry-lite-fykfnzjg.js";import{ut}from"./vm-hands-entry-lite-jyvmw8b7.js";import{ft}from"./vm-hands-entry-lite-8t10rxfx.js";import{Rr}from"./vm-hands-entry-lite-daywc3a6.js";import{xt,Li}from"./vm-hands-entry-lite-jwgheerx.js";import{G,qe}from"./vm-hands-entry-lite-d4hba9jc.js";import{xe,Kn}from"./vm-hands-entry-lite-jy5t9h08.js";import{vt}from"./vm-hands-entry-lite-mb6atrr0.js";import{a}from"./vm-hands-entry-lite-cf1x5cbr.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{C}from"./vm-hands-entry-lite-vdhgwmmp.js";import{spawn as R,spawnSync as st}from"child_process";import{createHash as it,randomUUID as ge}from"crypto";import{closeSync as at,copyFileSync as ae,existsSync as M,fstatSync as ct,mkdirSync as ce,openSync as lt,readdirSync as U,readFileSync as X,readlinkSync as dt,renameSync as he,rmSync as pt,statSync as mt,writeFileSync as gt}from"fs";import{connect as ht}from"net";import{tmpdir as L,userInfo as we}from"os";import{basename as le,delimiter as wt,dirname as B,join as f}from"path";var z=`import { spawn, execFileSync } from "node:child_process";
|
|
3
3
|
import { createHash, randomUUID } from "node:crypto";
|
|
4
4
|
import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
|
|
5
5
|
import { tmpdir } from "node:os";
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
2
|
import{ri,bt,ii,oi,si,Ti}from"./vm-hands-entry-lite-mb6atrr0.js";import{createHash as H,randomBytes as he}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Xe,openSync as Oe,renameSync as Qe,rmSync as Ze,statSync as De,writeSync as Me,constants as W}from"fs";import{join as se}from"path";var en=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:r}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!r||typeof r!=="object"||Array.isArray(r)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||r.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:nn(e)}}function nn(e){let n=e.payload[ii];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var G=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),K=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function $i(e){let n=await crypto.subtle.importKey("pkcs8",K(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=K(e.device_key.spki),r=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),h=new Uint8Array(await crypto.subtle.exportKey("spki",r.publicKey)),m=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:r,signingSpki:i,agreementSpki:h,fingerprint:m}}var tn=16;class ln{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,r){this.init=e;this.keys=n;this.hooks=i;this.options=r;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let r=Date.now()+n;;){let h=this.bound.get(e);if(!h)return!1;if(h.envInstalled)return!0;if(Date.now()>=r||i?.aborted)return!1;await new Promise((m)=>setTimeout(m,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:en,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:G(this.keys.signingSpki),env_public_key:G(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:G(he(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:G(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),r=G(he(32)),h=Ti({method:"GET",pathAndQuery:ri,timestamp:i,nonce:r,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),m=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(h)));return{t:"hello",timestamp:i,nonce:r,signature:G(rn(m)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let r of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(r))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((r)=>r.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=tn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((r)=>r.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let r,h,m=new Promise((_,k)=>{r=_,h=k});return m.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:m,resolve:r,reject:h}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(v){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(v,"the bind's kill-verify failed")}let i,r=new Promise((v)=>{i=v}),h=!1,m=!1,_=()=>{m=!0,i()},k=n.promise.then(()=>new Promise((v,I)=>{this.exclusive(async()=>{if(m){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}h=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();v()}catch(w){I(w)}await r})}));k.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:k,inTurn:()=>h,leave:_})}finally{_()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,r=!1;try{if(!n)await this.prepareBind(e);r=!0;let{launchId:h,applied:m,readyData:_}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),k=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let v=null,I=null;if(e.env){let w=e.claim?.owner??{},E=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:e.claim?.root_id??""});v=this.hooks.installEnvironment(e.bind_id,E),I=typeof E.snapshot_id==="string"&&E.snapshot_id?E.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,E)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:h,envInstalled:v!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:h,snapshot_revision:v,snapshot_id:I,layout:k,..._?{ready_data:_}:{},policy_digest:H("sha256").update(V({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(h){if(i)fe(i);if(r){let m=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(m);else await m()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(h,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let r=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),h=this.hooks.installEnvironment(n.bindId,r);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${h}`,r),{snapshot_id:e.snapshotId,installed_revision:h,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let r=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:r})}catch(h){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw h}if(this.unverified.delete(e),!r.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:r.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},r=await crypto.subtle.importKey("spki",K(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),h=await crypto.subtle.deriveKey({name:"ECDH",public:r},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:K(e.iv),additionalData:new TextEncoder().encode(n)},h,K(e.ct)).catch(i),_=JSON.parse(new TextDecoder().decode(m));if(!_||typeof _!=="object"||Array.isArray(_))throw new l("vm_hands_env_invalid","env not an object");return _}writeJobEnvRootOnly(e,n){let i=se(this.options.envRoot,`bind-${e}`);Xe(i,{mode:448});let r=De(i);if(!r.isDirectory()||(r.mode&63)!==0||r.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let h=n.variables&&typeof n.variables==="object"?n.variables:{},m=Object.entries(h).filter(([v,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(v)&&typeof I==="string").map(([v,I])=>`export ${v}='${String(I).replaceAll("'","'\\''")}'`).join(`
|
|
3
3
|
`)+`
|
|
4
|
-
`,_=se(i,`.job.env.${he(8).toString("hex")}`),k=Oe(_,W.O_WRONLY|W.O_CREAT|W.O_EXCL|W.O_NOFOLLOW,384);try{Me(k,m),xe(k)}finally{Ae(k)}return Qe(_,se(i,"job.env")),i}}function fe(e){try{let n=se(e,"job.env"),i=De(n).size,r=Oe(n,W.O_WRONLY|W.O_NOFOLLOW);try{Me(r,Buffer.alloc(i)),xe(r)}finally{Ae(r)}}catch{}Ze(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as sn}from"crypto";var on="/app/local-runtime/session?register=vm_hands_v1",an="/app/local-runtime",Ce=25000,we=20000,dn=1e4,Ue=5000,cn=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),un="preview.serve.v1",_n=60000,ye=75000,mn=2000,gn=1e4,hn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),fn=3,pn=20000,vn=250,wn=2000;function $e(e){let n=Math.min(vn*2**(e-1),wn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function bn(e){return e>=500||e===408||e===429}var ae=20000;function Be(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class D extends Error{}var kn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function je(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Sn(e,n,i,r,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[v,I]of qe.entries()){if(r.aborted)return;if(await new Promise((w)=>{let E=setTimeout(w,I);E.unref?.(),r.addEventListener("abort",()=>{clearTimeout(E),w()},{once:!0})}),r.aborted)return;try{let w=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:v+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let E=je(w);if(h("vm_hands.unbind_unverified",{operation_id:k,code:E,attempt:v+1}),E==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:qe.length})})().finally(()=>_.delete(m))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))])}async function In(e,n){let i=[...e.personTerminals].filter((r)=>r.session===null||r.session===n);for(let r of i)r.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))]);return i.length}function Pn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Tn=1000;async function Bi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},r=e.log??(()=>{}),h=async(k)=>{for(let[v,I]of[...i.turns]){i.turns.delete(v),e.onTurn?.(v,null),de(I);let w=await L(i,e.agent,v).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});r("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let v=await Rn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&hn.has(w.code)&&m<fn&&Date.now()-n<pn)return m++,_=$e(m),r("vm_hands.register_retry",{attempt:m,code:w.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(r("vm_hands.session_closed",{close_code:v.closeCode,reason:v.closeReason.slice(0,120),registered:i.deviceId!==null}),v.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=v.closeReason==="drain_reconnect"?0:v.closeReason==="vm_hands_register_retry"?_:v.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ye-Date.now())):Math.min(500*2**k,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Rn(e,n){let i=n.deviceId,r=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:on,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,v="",I=new Map,w=[],E=null,ce=new Promise((t)=>{_.onclose=(o)=>{k=o.code,v=o.reason;for(let s of I.values())s.reject(new D(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,Tn));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!E?.(o))w.push(o)};let J=(t,o)=>new Promise((s,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){s(w.splice(u,1)[0]);return}let f=setTimeout(()=>{E=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);E=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),E=null,s(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),q=(t,o)=>new Promise((s,a)=>{if(_.readyState!==WebSocket.OPEN){a(new D("session closed"));return}let u=sn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new D(`no answer to ${t.split("/").pop()} in ${f+Ne} ms`)),_.close(4000,"request_timeout")},f+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}s({status:c,json:g})}}),Y({t:"req",id:u,path:`${an}${t}`,body:JSON.stringify(o)})}),be=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",be,{once:!0});let le,X=new Map,Q=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);_.onopen=()=>{clearTimeout(g),r("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(s=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((T)=>T&&T.operation_id===S.claim.operation_id&&T.attempt_id===S.claim.attempt_id)){o.push(S),r("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),de(S);let P=await L(n,e.agent,g).catch((T)=>ee(T,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),ce.then(()=>{throw new l(v==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await q("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=q,ce.then(()=>{if(n.request===q)n.request=null}),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(s,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await Se(g,c),g instanceof D)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ke;try{await ne();for(let c of o)c.flush=()=>Ie(c),c.flush(),p(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await q("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Ce,Ce)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",be);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;_.close(),await ce,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>s?ee(u,s,"vm_hands_bind_lost"):null);if(a&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:a});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:k,closeReason:v};async function Se(t,o){if(t instanceof D){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)ue=!0;for(let a of s){let u=n.turns.get(a);if(n.turns.delete(a),u)de(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=q){let s=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>s(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(R)=>s(`/operations/${f}/events`,{...u,event_seq_start:R,events:[{kind:c,payload:{sequence:R,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,T=await S(P),M=T.status===409?T.json?.expected_event_seq:void 0;if(typeof M==="number"&&M>=0&&M!==g)P=M,T=await S(P);if(T.status<300)t.eventSeq=P+1;return T}}function We(t){return(o,s)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=kn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:a,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof D)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{_e.delete(t)}})()}async function ze(t,o){try{let s=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(s);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function Fe(t){let o=Z&&n.attest==="pending",s=t.vm_hands_attest,a=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,B=Math.max(0,Math.min(ae,Number.isFinite(b)?b:ae));if(!await new Promise((ie)=>{let y=setTimeout(()=>ie(!1),B);n.attestWaiters.push((x)=>{clearTimeout(y),ie(x)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await In(n,P);if(b)r("vm_hands.person_terminals_closed",{count:b});let B=ve(t),j=e.agent.bind(B);if(B.workspace_deferred)S=!0,g=He(u,()=>S);d=await j}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let T=g?await g:-1,M={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete M.environment_installed;let R=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:-1});let F={...M,...R,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},te=Date.now()+yn,U=1,N=await p("hands.ready",F);while(bn(N.status)&&!e.signal.aborted){let b=$e(U);if(Date.now()+b>=te)break;await new Promise((B)=>setTimeout(B,b)),U++,N=await p("hands.ready",F)}if(U>1)r("vm_hands.ready_retried",{attempts:U,status_class:`${Math.floor(N.status/100)}xx`});if(X.delete(t.attempt_id),N.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Be(N.json?.error,"vm_hands_probe_failed")});return}let C={claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:T};n.turns.set(t.attempt_id,C),C.flush=()=>Ie(C),e.onTurn?.(t.attempt_id,We(C)),await Pe(C)}async function He(t,o){let{fence:s,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await q(`/operations/${a}/heartbeat`,{...s,control_ack_seq:f,wait_ms:we});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===oi)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Pe(t){let{fence:o,op:s}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,q(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!p){a="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===bt)try{await Le(t,d.payload??{})}catch(g){if(g instanceof D)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;r("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ve(t,a)}async function ge(t,o){let s=Date.now()+_n;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof D))throw u}if(Date.now()>=s||e.signal.aborted)throw new D("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,s={claim:o,eventSeq:0},a=String(t.capability??""),u=a===un,{complete:f,emit:p,fence:c,op:d}={...O(s,ge)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let y of n.attestWaiters.splice(0))y(!0)}if(n.attest!=="accepted"){let y=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(y)?y:ae));if(!(x>0&&await new Promise((re)=>{let Je=setTimeout(()=>re(!1),x);n.attestWaiters.push((Ye)=>{clearTimeout(Je),re(Ye)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,T=P?Pn(t):null;if(P&&((y)=>y===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(y)||n.bindsStarting.has(y))(T)){await f("failed",{error_code:"vm_hands_bound"});return}if(cn.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let R=new AbortController,F=()=>R.abort();e.signal.addEventListener("abort",F,{once:!0});let te,U=new Promise((y)=>{te=y}),N={abort:R,settled:U},C=P?{...N,session:T}:null;if(C)n.personTerminals.add(C);if(g==="model"&&S&&a!=="preview.serve.v1"){let y=n.modelOps.get(S)??new Set;y.add(N),n.modelOps.set(S,y),await e.agent.environmentInstalled(S,mn,R.signal)}let b=-1,B=!1,j=!1,ie=u?void 0:setInterval(()=>{if(j)return;j=!0,ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:0}).then((y)=>{if(y.status>=300){R.abort();return}let x=y.json?.controls??[];for(let A of x)if(b=Math.max(b,A.seq),A.kind==="operation.cancel"||A.kind==="cancel")R.abort()},()=>R.abort()).finally(()=>{j=!1})},dn);if(u)(async()=>{while(!B&&!R.signal.aborted){let y;try{y=await ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:we})}catch{R.abort();return}if(B)return;if(y.status>=300){R.abort();return}let x=(y.json?.controls??[]).slice().sort((A,re)=>A.seq-re.seq);for(let A of x){if(A.seq<=b)continue;if(A.kind==="operation.cancel"||A.kind==="cancel")R.abort();else await e.controlOp?.({claim:t,control:A}).catch(()=>!1);b=A.seq}}})();try{let y=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:R.signal,emit:async(A)=>{await p(A.kind,A.data??{})}}),x=await f(y.status,{...y.result?{result:y.result}:{},...y.error_code?{error_code:Be(y.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:y.status,acknowledged:x.status<300}),r("vm_hands.op",{capability:a,kind:g,status:y.status,code:y.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(B=!0,clearInterval(ie),e.signal.removeEventListener("abort",F),S)n.modelOps.get(S)?.delete(N);if(C)n.personTerminals.delete(C);te()}}async function Ve(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),de(t);let a=await L(n,e.agent,s).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,s){let a=je(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(si,{code:a}).catch(()=>{return}),Sn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function ne(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof D)return}n.receipts.shift()}}async function Le(t,o){let{fence:s,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await q(`/operations/${a}/environment`,{...s,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await q(`/operations/${a}/environment-ack`,{...s,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as xn}from"fs";var An=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function On(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-wg8xt2hn.js");await m();return}z("parsed",{t0:Math.round(An)});let e="";try{e=xn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-e3kscgb2.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}On();export{$i,ln,Bi};
|
|
4
|
+
`,_=se(i,`.job.env.${he(8).toString("hex")}`),k=Oe(_,W.O_WRONLY|W.O_CREAT|W.O_EXCL|W.O_NOFOLLOW,384);try{Me(k,m),xe(k)}finally{Ae(k)}return Qe(_,se(i,"job.env")),i}}function fe(e){try{let n=se(e,"job.env"),i=De(n).size,r=Oe(n,W.O_WRONLY|W.O_NOFOLLOW);try{Me(r,Buffer.alloc(i)),xe(r)}finally{Ae(r)}}catch{}Ze(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as sn}from"crypto";var on="/app/local-runtime/session?register=vm_hands_v1",an="/app/local-runtime",Ce=25000,we=20000,dn=1e4,Ue=5000,cn=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),un="preview.serve.v1",_n=60000,ye=75000,mn=2000,gn=1e4,hn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),fn=3,pn=20000,vn=250,wn=2000;function $e(e){let n=Math.min(vn*2**(e-1),wn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function bn(e){return e>=500||e===408||e===429}var ae=20000;function Be(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class D extends Error{}var kn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function je(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Sn(e,n,i,r,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[v,I]of qe.entries()){if(r.aborted)return;if(await new Promise((w)=>{let E=setTimeout(w,I);E.unref?.(),r.addEventListener("abort",()=>{clearTimeout(E),w()},{once:!0})}),r.aborted)return;try{let w=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:v+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let E=je(w);if(h("vm_hands.unbind_unverified",{operation_id:k,code:E,attempt:v+1}),E==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:qe.length})})().finally(()=>_.delete(m))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))])}async function In(e,n){let i=[...e.personTerminals].filter((r)=>r.session===null||r.session===n);for(let r of i)r.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))]);return i.length}function Pn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Tn=1000;async function Bi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},r=e.log??(()=>{}),h=async(k)=>{for(let[v,I]of[...i.turns]){i.turns.delete(v),e.onTurn?.(v,null),de(I);let w=await L(i,e.agent,v).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});r("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let v=await Rn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&hn.has(w.code)&&m<fn&&Date.now()-n<pn)return m++,_=$e(m),r("vm_hands.register_retry",{attempt:m,code:w.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(r("vm_hands.session_closed",{close_code:v.closeCode,reason:v.closeReason.slice(0,120),registered:i.deviceId!==null}),v.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=v.closeReason==="drain_reconnect"?0:v.closeReason==="vm_hands_register_retry"?_:v.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ye-Date.now())):Math.min(500*2**k,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Rn(e,n){let i=n.deviceId,r=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:on,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,v="",I=new Map,w=[],E=null,ce=new Promise((t)=>{_.onclose=(o)=>{k=o.code,v=o.reason;for(let s of I.values())s.reject(new D(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,Tn));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!E?.(o))w.push(o)};let J=(t,o)=>new Promise((s,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){s(w.splice(u,1)[0]);return}let f=setTimeout(()=>{E=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);E=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),E=null,s(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),q=(t,o)=>new Promise((s,a)=>{if(_.readyState!==WebSocket.OPEN){a(new D("session closed"));return}let u=sn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new D(`no answer to ${t.split("/").pop()} in ${f+Ne} ms`)),_.close(4000,"request_timeout")},f+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}s({status:c,json:g})}}),Y({t:"req",id:u,path:`${an}${t}`,body:JSON.stringify(o)})}),be=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",be,{once:!0});let le,X=new Map,Q=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);_.onopen=()=>{clearTimeout(g),r("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(s=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((T)=>T&&T.operation_id===S.claim.operation_id&&T.attempt_id===S.claim.attempt_id)){o.push(S),r("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),de(S);let P=await L(n,e.agent,g).catch((T)=>ee(T,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),ce.then(()=>{throw new l(v==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await q("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=q,ce.then(()=>{if(n.request===q)n.request=null}),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(s,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await Se(g,c),g instanceof D)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ke;try{await ne();for(let c of o)c.flush=()=>Ie(c),c.flush(),p(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await q("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Ce,Ce)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",be);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;_.close(),await ce,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>s?ee(u,s,"vm_hands_bind_lost"):null);if(a&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:a});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:k,closeReason:v};async function Se(t,o){if(t instanceof D){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)ue=!0;for(let a of s){let u=n.turns.get(a);if(n.turns.delete(a),u)de(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=q){let s=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>s(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(R)=>s(`/operations/${f}/events`,{...u,event_seq_start:R,events:[{kind:c,payload:{sequence:R,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,T=await S(P),M=T.status===409?T.json?.expected_event_seq:void 0;if(typeof M==="number"&&M>=0&&M!==g)P=M,T=await S(P);if(T.status<300)t.eventSeq=P+1;return T}}function We(t){return(o,s)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=kn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:a,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof D)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{_e.delete(t)}})()}async function ze(t,o){try{let s=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(s);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function Fe(t){let o=Z&&n.attest==="pending",s=t.vm_hands_attest,a=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,B=Math.max(0,Math.min(ae,Number.isFinite(b)?b:ae));if(!await new Promise((ie)=>{let y=setTimeout(()=>ie(!1),B);n.attestWaiters.push((x)=>{clearTimeout(y),ie(x)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await In(n,P);if(b)r("vm_hands.person_terminals_closed",{count:b});let B=ve(t),j=e.agent.bind(B);if(B.workspace_deferred)S=!0,g=He(u,()=>S);d=await j}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let T=g?await g:-1,M={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete M.environment_installed;let R=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:-1});let F={...M,...R,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},te=Date.now()+yn,U=1,N=await p("hands.ready",F);while(bn(N.status)&&!e.signal.aborted){let b=$e(U);if(Date.now()+b>=te)break;await new Promise((B)=>setTimeout(B,b)),U++,N=await p("hands.ready",F)}if(U>1)r("vm_hands.ready_retried",{attempts:U,status_class:`${Math.floor(N.status/100)}xx`});if(X.delete(t.attempt_id),N.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Be(N.json?.error,"vm_hands_probe_failed")});return}let C={claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:T};n.turns.set(t.attempt_id,C),C.flush=()=>Ie(C),e.onTurn?.(t.attempt_id,We(C)),await Pe(C)}async function He(t,o){let{fence:s,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await q(`/operations/${a}/heartbeat`,{...s,control_ack_seq:f,wait_ms:we});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===oi)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Pe(t){let{fence:o,op:s}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,q(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!p){a="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===bt)try{await Le(t,d.payload??{})}catch(g){if(g instanceof D)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;r("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ve(t,a)}async function ge(t,o){let s=Date.now()+_n;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof D))throw u}if(Date.now()>=s||e.signal.aborted)throw new D("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,s={claim:o,eventSeq:0},a=String(t.capability??""),u=a===un,{complete:f,emit:p,fence:c,op:d}={...O(s,ge)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let y of n.attestWaiters.splice(0))y(!0)}if(n.attest!=="accepted"){let y=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(y)?y:ae));if(!(x>0&&await new Promise((re)=>{let Je=setTimeout(()=>re(!1),x);n.attestWaiters.push((Ye)=>{clearTimeout(Je),re(Ye)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,T=P?Pn(t):null;if(P&&((y)=>y===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(y)||n.bindsStarting.has(y))(T)){await f("failed",{error_code:"vm_hands_bound"});return}if(cn.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let R=new AbortController,F=()=>R.abort();e.signal.addEventListener("abort",F,{once:!0});let te,U=new Promise((y)=>{te=y}),N={abort:R,settled:U},C=P?{...N,session:T}:null;if(C)n.personTerminals.add(C);if(g==="model"&&S&&a!=="preview.serve.v1"){let y=n.modelOps.get(S)??new Set;y.add(N),n.modelOps.set(S,y),await e.agent.environmentInstalled(S,mn,R.signal)}let b=-1,B=!1,j=!1,ie=u?void 0:setInterval(()=>{if(j)return;j=!0,ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:0}).then((y)=>{if(y.status>=300){R.abort();return}let x=y.json?.controls??[];for(let A of x)if(b=Math.max(b,A.seq),A.kind==="operation.cancel"||A.kind==="cancel")R.abort()},()=>R.abort()).finally(()=>{j=!1})},dn);if(u)(async()=>{while(!B&&!R.signal.aborted){let y;try{y=await ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:we})}catch{R.abort();return}if(B)return;if(y.status>=300){R.abort();return}let x=(y.json?.controls??[]).slice().sort((A,re)=>A.seq-re.seq);for(let A of x){if(A.seq<=b)continue;if(A.kind==="operation.cancel"||A.kind==="cancel")R.abort();else await e.controlOp?.({claim:t,control:A}).catch(()=>!1);b=A.seq}}})();try{let y=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:R.signal,emit:async(A)=>{await p(A.kind,A.data??{})}}),x=await f(y.status,{...y.result?{result:y.result}:{},...y.error_code?{error_code:Be(y.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:y.status,acknowledged:x.status<300}),r("vm_hands.op",{capability:a,kind:g,status:y.status,code:y.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(B=!0,clearInterval(ie),e.signal.removeEventListener("abort",F),S)n.modelOps.get(S)?.delete(N);if(C)n.personTerminals.delete(C);te()}}async function Ve(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),de(t);let a=await L(n,e.agent,s).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,s){let a=je(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(si,{code:a}).catch(()=>{return}),Sn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function ne(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof D)return}n.receipts.shift()}}async function Le(t,o){let{fence:s,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await q(`/operations/${a}/environment`,{...s,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await q(`/operations/${a}/environment-ack`,{...s,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as xn}from"fs";var An=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function On(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-rxxmdqdj.js");await m();return}z("parsed",{t0:Math.round(An)});let e="";try{e=xn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-qyykmd4w.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}On();export{$i,ln,Bi};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import"./vm-hands-entry-lite-mb6atrr0.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-5zdybh8s.js";import"./vm-hands-entry-lite-rfz60hb3.js";import{it,to,vr,Ot}from"./vm-hands-entry-lite-
|
|
2
|
+
import"./vm-hands-entry-lite-mb6atrr0.js";import"./vm-hands-entry-lite-3krzmhkk.js";import"./vm-hands-entry-lite-5zdybh8s.js";import"./vm-hands-entry-lite-rfz60hb3.js";import{it,to,vr,Ot}from"./vm-hands-entry-lite-b3my57wp.js";import"./vm-hands-entry-lite-fykfnzjg.js";import"./vm-hands-entry-lite-wwp36b4m.js";import"./vm-hands-entry-lite-jwgheerx.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-hzh8fdxx.js";import"./vm-hands-entry-lite-k83rkcys.js";import"./vm-hands-entry-lite-tmart4k9.js";import"./vm-hands-entry-lite-wrvz9jxy.js";import{ar,cr,kt,Ct}from"./vm-hands-entry-lite-egpszzay.js";import"./vm-hands-entry-lite-h6rhk6h1.js";import"./vm-hands-entry-lite-52x189kf.js";import"./vm-hands-entry-lite-cf1x5cbr.js";import"./vm-hands-entry-lite-vdhgwmmp.js";import{spawn as Ae}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as G,lstatSync as q,mkdirSync as V,mkdtempSync as Te,readdirSync as Z,readFileSync as k,realpathSync as We,rmdirSync as de,rmSync as He,writeFileSync as B}from"fs";import{basename as ze,dirname as Ue,join as d}from"path";import{readFileSync as ie,readlinkSync as ae}from"fs";import{relative as Ie}from"path";var ce=16;function ue(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Ne(e){let r=[];for(let t of e.split(`
|
|
3
3
|
`)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:ue(n[3]),mountPoint:ue(n[4])})}return r}function De(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(Ne(m).filter((_)=>c(_.mountPoint)).map((_)=>[`${_.mountPoint}\x00${_.device}\x00${_.root}`,_.mountPoint])),u=o(r),p=o(t),b=(m)=>Ie(n,m)||".",P=[...u].filter(([m])=>!p.has(m)).map(([,m])=>b(m)),x=[...p].filter(([m])=>!u.has(m)).map(([,m])=>b(m));return{missing:P,extra:x,referenceCount:u.size,ownCount:p.size}}function le(e,r,t,n="/proc"){let c,o,u=null;try{c=ie(`${n}/1/mountinfo`,"utf8"),o=ie(`${n}/self/mountinfo`,"utf8")}catch(_){let O=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{u=ae(`${n}/1/ns/mnt`)===ae(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:b,referenceCount:P,ownCount:x}=De(e,c,o),m={reference_count:P,own_count:x,missing_count:p.length,extra_count:b.length,same_namespace:u};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ce)});if(p.length)throw r("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ce)}),t(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var we="/sys/fs/cgroup/reason-payload",M="vm-hands",Be="/run/ara-srt/fallbacks.jsonl",se="/reason-person",Fe="/reason-workload",Ke="surface",ee=5000,je=1e4,pe="__VM_HANDS_PROOF_DIR__",Ge="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,r){super(r);this.code=e}}function Ee(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new w("vm_hands_bind_invalid","bad bind id");return d(e,M,`b-${r.toLowerCase()}`)}var Ve=5000,ve=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Je(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=d(Ue(e),r.toLowerCase());return ze(e).toLowerCase()===r.toLowerCase()?e:t}function gn(e){let r=e.cgroup??we,t=e.init.layout.payload_uid,n=e.init.workload_ended!==!0,c=(s)=>z(s,se)||n&&z(s,Fe),o=e.log??(()=>{}),u=(s)=>Je(e.init.layout.session_root,s),p=new Map,b=new Map,P=0,x=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(P>s.length?0:P).split(`
|
|
4
4
|
`).filter(Boolean);P=s.length;let l=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(l.length)o("vm_hands.srt_server_starts",{count:l.length,elapsed_ms:l.slice(0,8)})}catch{}},m=null,_=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",I=()=>{m??=fe()},R=0,F=()=>{try{let s=k(Be,"utf8"),i=s.slice(R>s.length?0:R);R=s.length;let l=i.split(`
|
|
5
5
|
`).filter(Boolean).slice(0,1000);if(!l.length)return null;let f={},g=0;for(let S of l)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:l.length,codes:f,max_elapsed_ms:g}),{count:l.length,codes:f,max_elapsed_ms:g}}catch{return null}},U=(s,i,l)=>Re(s,i,l),K=(s)=>(i,l,f)=>Ae("/bin/sh",["-c",`echo $$ > ${ve(d(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...l],f),Re=K(d(r,M)),j=d(r,M,"probe"),T=(s)=>Ee(r,s),Ce=(s)=>{let i=T(s);try{V(i,{mode:493})}catch(l){if(!(l&&typeof l==="object"&&("code"in l)&&l.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},Oe=(s)=>{try{de(T(s))}catch{}},W=e.prespawn?to({spawnProcess:U,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;W?.arm();let X=W?setInterval(()=>{W.arm()},Ve):null;X?.unref?.();async function Y(s){let i=p.get(s);if(p.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:T,async startExecutor(s){if(I(),b.set(s.bindId,fe()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await Y(s.bindId);let{claim:i,bindId:l}=s,f=Ce(l),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,N=new Promise((a,v)=>{h=a,y=v}),D,C=new Promise((a)=>{D=a}),H=Ot({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(l,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...W?{takePrespawnedWorker:(a)=>{let v=W.take(a);if(!v?.pid)return v;try{return B(d(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:W.adopt}:{}}).then(()=>{D("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),D(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));p.set(l,{abort:S,done:H,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0});let A=await N,E=A.executor_launch_id;if(typeof E!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:A,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return p.get(s)?.exited??new Promise(()=>{})},freezeBind(s){let i=T(s);if(G(d(i,"cgroup.freeze")))B(d(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){let i=new Set(s?.keep??[]);if(await $e(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&G(d(O,"cgroup.events")))x(),await te(O,Date.now()+ee,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ee;if(G(d(j,"cgroup.events"))){await te(j,s,"probe");try{de(j)}catch{}}let i=oe(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Ze(r,i,s);let l=(g)=>{let S=oe(g);return S!==null&&S<=i},f=he(t).filter((g)=>l(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...me(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,d(r,M)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=ge(m).filter((y)=>y!==process.pid&&!c(y)&&!z(y,"/reason-vm-hands")&&!z(y,S)&&!g.some((N)=>ne(y,N)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:re(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:re(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(I(),!i.includes(pe))throw new w("vm_hands_probe_failed","probe names no proof directory");let l=e.proofParent??"/tmp/reason-vm-hands-proof";V(l,{mode:457,recursive:!0});let f=q(l);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Te(d(l,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Le(g,t,t),Me(g,448);let h=q(g).ino;try{V(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(pe,g).replaceAll(Ge,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),N="";y.stdout?.on("data",(C)=>{if(N.length<16384)N+=C.toString("utf8").slice(0,16384-N.length)});let D=await new Promise((C)=>{let H=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},je);y.once("error",()=>{clearTimeout(H),C(127)}),y.once("close",(A)=>{clearTimeout(H),C(A??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:D}),{exitCode:D,markers:N,proofDirInode:h}}finally{if(!S)He(g,{recursive:!0,force:!0})}},restatLayout(s){let i=u(s),l=i===e.init.layout.session_root?e.init.layout.alias:d(i,"repo"),f="invalid";try{vr(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=q(l);S=h.uid,g=f==="0:0:755"&&l===d(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&We(l)===l&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=u(s);try{le(i,o,(l)=>new w("vm_hands_mount_mismatch",l))}catch(l){if(i!==e.init.layout.session_root&&l instanceof w&&l.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw l}},installEnvironment(s,i){let l=p.get(s);if(!l)throw new w("environment_unavailable","no executor owns an environment");return it({root:e.root,operationId:l.operationId,payload:i}).installed_revision},async stop(){if(X)clearInterval(X);W?.close(),await Promise.all([...p.keys()].map((s)=>Y(s)))}};function xe(){try{return Z(d(r,M),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function $e(s,i,l=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=qe();try{await nn();let S=Date.now()+ee,h=new Set(xe().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=Y(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(G(d(T(a),"cgroup.events")))await te(T(a),S,"bind");await v}let N=[...f].map((a)=>T(a).replace(/^\/sys\/fs\/cgroup/,"")),D=["/",...[r,d(r,M)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),H=(a)=>c(a)||N.some((v)=>z(a,v))||D.some((v)=>ne(a,v)),A=l?[]:he(t).filter((a)=>!H(a));if(A.length)throw o("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size,...me(A)}),new w("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let E=(a)=>!H(a)&&!z(a,"/reason-vm-hands")&&!z(a,C)&&!D.some((v)=>ne(a,v));if(y!==null){let a=ge(y).filter((v)=>v!==process.pid&&E(v));if(a.length)throw o("vm_hands.kill_strays",{strays:re(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),Oe(a)}finally{g()}}}function oe(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function be(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ze(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=ke(e).filter((o)=>Se(o,e)),c=new Set(n.filter((o)=>{let u=oe(o);return u!==null&&u<=r}));for(let o=!0;o;){o=!1;for(let u of n){if(c.has(u))continue;let p=be(u);if(p!==null&&c.has(p))c.add(u),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,r,t="/proc"){try{return k(d(t,String(e),"cgroup"),"utf8").split(`
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{ar,cr,kt,Ct,At,cs}from"./vm-hands-entry-lite-
|
|
2
|
+
import{ar,cr,kt,Ct,At,cs}from"./vm-hands-entry-lite-egpszzay.js";export{ar as VM_HANDS_OP_RUNNER_PERSON_ARG,cr as VM_HANDS_OP_RUNNER_SURFACE_ARG,Ct as VM_HANDS_SURFACE_DIRECTORY_ARG,At as VM_HANDS_SURFACE_OPS,kt as VM_HANDS_SURFACE_UID_ARG,cs as runVmHandsOpRunner};
|