@reason-machines/cli-linux-x64 0.2.480 → 0.2.483

package/bin/vm-hands/{vm-hands-entry-lite-dyrea0zp.js → vm-hands-entry-lite-akppm39y.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Gt,j}from"./vm-hands-entry-lite-tmart4k9.js";import{ue,Ce,Z,Ae,de,rr,Qe,X,O,H,tn}from"./vm-hands-entry-lite-3krzmhkk.js";import{Do,ei}from"./vm-hands-entry-lite-k83rkcys.js";import{So,P,Je,Se,Ze,ne,Xe,qn,Ee,Xt,ae,U,N,ce,Hr,zr,Vn}from"./vm-hands-entry-lite-5zdybh8s.js";import{Pe,oe,pe,Y,Re,q,Q}from"./vm-hands-entry-lite-mb6atrr0.js";import{It,kr,st,V,D,R,b}from"./vm-hands-entry-lite-wwp36b4m.js";import{Er,xr,vn,no,He,Sn}from"./vm-hands-entry-lite-hzh8fdxx.js";import{K}from"./vm-hands-entry-lite-fykfnzjg.js";import{Ni}from"./vm-hands-entry-lite-jwgheerx.js";import{p,ze,Dt,at,io,_e,we}from"./vm-hands-entry-lite-h6rhk6h1.js";import{v,h,ao}from"./vm-hands-entry-lite-52x189kf.js";import{E}from"./vm-hands-entry-lite-txd50spx.js";import{Qt}from"./vm-hands-entry-lite-xhxxgn3b.js";import{a,ie,Lo}from"./vm-hands-entry-lite-cf1x5cbr.js";import{L,Ri,Oi,jo,y,t,k,Et,o,d,u,i,c,g,ee,s,n}from"./vm-hands-entry-lite-vmnxnr7y.js";import{Di}from"./vm-hands-entry-lite-k3ksgb4t.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{Ho,se,zo,C,De,Me,A}from"./vm-hands-entry-lite-vdhgwmmp.js";var _i=()=>{let e={string:{unit:"characters",verb:"to have"},file:{unit:"bytes",verb:"to have"},array:{unit:"items",verb:"to have"},set:{unit:"items",verb:"to have"},map:{unit:"entries",verb:"to have"}};function l(w){return e[w]??null}let f={regex:"input",email:"email address",url:"URL",emoji:"emoji",uuid:"UUID",uuidv4:"UUIDv4",uuidv6:"UUIDv6",nanoid:"nanoid",guid:"GUID",cuid:"cuid",cuid2:"cuid2",ulid:"ULID",xid:"XID",ksuid:"KSUID",datetime:"ISO datetime",date:"ISO date",time:"ISO time",duration:"ISO duration",ipv4:"IPv4 address",ipv6:"IPv6 address",mac:"MAC address",cidrv4:"IPv4 range",cidrv6:"IPv6 range",base64:"base64-encoded string",base64url:"base64url-encoded string",json_string:"JSON string",e164:"E.164 number",jwt:"JWT",template_literal:"input"},_={nan:"NaN"};return(w)=>{switch(w.code){case"invalid_type":{let S=_[w.expected]??w.expected,I=jo(w.input),W=_[I]??I;return`Invalid input: expected ${S}, received ${W}`}case"invalid_value":if(w.values.length===1)return`Invalid input: expected ${Oi(w.values[0])}`;return`Invalid option: expected one of ${Ri(w.values,"|")}`;case"too_big":{let S=w.inclusive?"<=":"<",I=l(w.origin);if(I)return`Too big: expected ${w.origin??"value"} to have ${S}${w.maximum.toString()} ${I.unit??"elements"}`;return`Too big: expected ${w.origin??"value"} to be ${S}${w.maximum.toString()}`}case"too_small":{let S=w.inclusive?">=":">",I=l(w.origin);if(I)return`Too small: expected ${w.origin} to have ${S}${w.minimum.toString()} ${I.unit}`;return`Too small: expected ${w.origin} to be ${S}${w.minimum.toString()}`}case"invalid_format":{let S=w;if(S.format==="starts_with")return`Invalid string: must start with "${S.prefix}"`;if(S.format==="ends_with")return`Invalid string: must end with "${S.suffix}"`;if(S.format==="includes")return`Invalid string: must include "${S.includes}"`;if(S.format==="regex")return`Invalid string: must match pattern ${S.pattern}`;return`Invalid ${f[S.format]??w.format}`}case"not_multiple_of":return`Invalid number: must be a multiple of ${w.divisor}`;case"unrecognized_keys":return`Unrecognized key${w.keys.length>1?"s":""}: ${Ri(w.keys,", ")}`;case"invalid_key":return`Invalid key in ${w.origin}`;case"invalid_union":if(w.options&&Array.isArray(w.options)&&w.options.length>0)return`Invalid discriminator value. Expected ${w.options.map((I)=>`'${I}'`).join(" | ")}`;return"Invalid input";case"invalid_element":return`Invalid value in ${w.origin}`;default:return"Invalid input"}}};function En(){return{localeError:_i()}}L(En());class pt extends Error{}function xo(e){let l;try{l=new URL(e)}catch{throw new pt("The proxy must be a URL like https://proxy.example.com:3128.")}if(l.protocol!=="https:"&&l.protocol!=="http:")throw new pt("The proxy URL must use the https or http scheme.");if(!l.hostname)throw new pt("The proxy URL must name a host.");if(l.port!==""&&Number(l.port)<1)throw new pt("The proxy URL must use a port between 1 and 65535.");if(l.pathname!==""&&l.pathname!=="/"||l.search||l.hash)throw new pt("The proxy URL must not carry a path, query, or fragment.");return l.toString()}import{createHash as mi}from"crypto";import{isAbsolute as Po,join as Io,relative as Ao,resolve as Vt,sep as To}from"path";var Jt=t().min(1).refine(Po,"absolute path required"),On=c({version:n(1),apiOrigin:Et(),channel:s(["staging","production"]),stateDirectory:Jt,workspaceRoot:Jt,lifetime:s(["persistent","ephemeral"]),executionMode:s(["confined","host"]).default("confined"),name:t().min(1).max(160).default("Reason headless worker"),slots:o().int().min(1).max(4).default(1),shutdownGraceMs:o().int().min(0).max(300000).default(30000),proxy:c({version:n(Gt),url:t().refine((e)=>{try{return xo(e)===e}catch{return!1}},"invalid proxy URL"),caFile:Jt.optional()}).optional(),userChrome:d().optional(),cloudSessions:n(!0).optional(),localLogins:d().optional(),folders:u(Jt).min(1).max(31).optional()}),hi=/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/,B=g("channel",[On,On.extend({channel:n("pr"),apiOrigin:t(),prEnvironment:t()}),On.extend({channel:n("local-qa"),apiOrigin:t()})]).superRefine((e,l)=>{if(e.channel==="local-qa"){if(!hi.test(e.apiOrigin))l.addIssue({code:"custom",message:"local QA worker requires an exact HTTPS trycloudflare.com quick-tunnel origin"})}else if(e.channel==="pr"){let _=e.prEnvironment,w=/^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.up\.railway\.app$/.exec(e.apiOrigin),S=w?.[1]?.match(/(?:^|-)pr-[0-9]+(?=-|$)/g)?.map((I)=>I.replace(/^-/,""));if(!_||/^pr-[1-9][0-9]*$/.exec(_)?.[0]!==_||w?.[0]!==e.apiOrigin||S?.length!==1||S[0]!==_)l.addIssue({code:"custom",message:"PR worker requires explicit prEnvironment and an exact same-PR HTTPS Railway origin"})}else{let _=new URL(e.apiOrigin);if(_.origin!==e.apiOrigin||_.username||_.password||_.protocol!=="https:"&&!(_.protocol==="http:"&&ei(_.origin))||!ei(_.origin)&&!Do(e.channel,_.origin))l.addIssue({code:"custom",message:"API origin must match channel (or loopback)"})}if(!je(e.workspaceRoot,e.stateDirectory))l.addIssue({code:"custom",message:"state and workspace must be disjoint"});let f=e.folders??[];if(new Set([e.workspaceRoot,...f]).size!==f.length+1||f.some((_)=>!je(_,e.stateDirectory)))l.addIssue({code:"custom",message:"folders must be distinct and disjoint from state"})});function m(e){return Io(e.stateDirectory,`headless-${e.channel==="pr"?e.prEnvironment:e.channel}`)}function je(e,l){if(Ur(l,e))return!1;return!Ur(e,l)||E(Io(To,Ao(Vt(e),Vt(l))))}function Ur(e,l){let f=Ao(Vt(e),Vt(l));return f===""||f!==".."&&!f.startsWith(`..${To}`)&&!Po(f)}function te(e){let{proxy:l,userChrome:f,cloudSessions:_,localLogins:w,folders:S,...I}=e;return mi("sha256").update(JSON.stringify(I)).digest("hex")}var gi=4,bi=[2375,2376,9222,9229];function pr(e){let l=new Set(bi);for(let f of e){let _=new URL(f);l.add(Number(_.port||(["https:","wss:"].includes(_.protocol)?443:80)))}return l}function Jr(){throw new r("preview_unavailable","The live Hands preview binding is unavailable or stale.")}var wi=60000;function Co(e){let l=new AbortController,f=new Map,_=(x)=>JSON.stringify([x.jobId,x.port]);function w(x){let M=e.authority.owner;if(l.signal.aborted||!e.isCurrent()||e.expiresAtMs<=Date.now()||x.organization_id!==M.organization_id||x.user_id!==M.user_id||x.device_id!==M.device_id)Jr()}function S(x){let M;try{M=e.environment.current()}catch{return null}return M.binding.target_generation===x.generation&&M.binding.target_fence_id===x.fenceId&&M.run_id===e.runId&&M.device_id===e.authority.owner.device_id&&M.root_id===e.authority.rootId?M:null}async function I(x,M,G){let F=await W(x,M,G);if(F!=="moved")return F;let T=await W(x,M,G);return T==="moved"?null:T}async function W(x,M,G){try{w(e.authority.owner);let F=e.identity();if(!F||G.aborted||x.expiresAtMs<=Date.now()||x.expiresAtMs>e.expiresAtMs)return null;let T=M.opened,re=T!==void 0&&F.generation>T.generation,J=S(F);if(re){if(J){if(J.revision<=T.revision||x.expiresAtMs>Date.parse(J.expires_at)||J.binding.target_revision!==T.attachmentRevision||J.binding.root_grant_revision!==T.grantRevision)return null;M.recoveringSinceMs=void 0}else if(Date.now()-(M.recoveringSinceMs??=Date.now())>wi)return null}else if(!J||x.expiresAtMs>Date.parse(J.expires_at)||T&&(F.generation!==T.generation||F.fenceId!==T.fenceId))return null;let z=await e.inspect(x.jobId,G),fe=e.identity(),ve=fe&&S(fe);w(e.authority.owner);let be=J&&{generation:F.generation,fenceId:F.fenceId,snapshotId:J.snapshot_id,revision:J.revision,attachmentRevision:J.binding.target_revision,grantRevision:J.binding.root_grant_revision},Oe=re?T:be;if(G.aborted||!fe)return null;if(fe.generation!==F.generation||fe.fenceId!==F.fenceId||ve?.snapshot_id!==J?.snapshot_id||ve?.revision!==J?.revision)return"moved";let $e=z.ok&&z.job.environmentSnapshotId!==void 0&&z.job.environmentRevision!==void 0?{snapshotId:z.job.environmentSnapshotId,revision:z.job.environmentRevision}:null;if(!z.ok||z.generation!==F.generation||!Oe||!$e)return null;if(($e.snapshotId!==Oe.snapshotId||$e.revision!==Oe.revision)&&(re||!e.environment.carried($e.snapshotId,$e.revision)))return null;if(!T&&F.generation===x.generation&&F.fenceId===x.fenceId)M.opened={...Oe,...$e};return{executorLaunchId:e.executorLaunchId,job:z.job,binding:{organizationId:e.authority.owner.organization_id,userId:e.authority.owner.user_id,deviceId:e.authority.owner.device_id,rootId:e.authority.rootId,runId:e.runId,attachmentRevision:Oe.attachmentRevision,grantRevision:Oe.grantRevision,generation:Oe.generation,fenceId:Oe.fenceId,jobId:z.job.jobId,port:x.port,expiresAtMs:x.expiresAtMs}}}catch{return null}}return{async open(x,M,G){w(M);let{binding:F,deviceRelayUrl:T}=at(x);if(G.aborted||F.expiresAtMs<=Date.now()||F.expiresAtMs>Date.now()+p.lifetimeMs||new URL(T).origin!==e.authority.relayOrigin)Jr();let re=_(F),J=f.get(re);if(J){if(!ze(J.binding,F)||J.relay!==T)Jr();if(await J.opened,!await Dt(()=>J.port.check())||G.aborted||J.abort.signal.aborted)Jr();return{opened:!0,binding:F}}if(f.size>=gi)Jr();let z=new AbortController,fe={},ve=we({binding:F,deniedPorts:e.authority.deniedPorts,readCurrentJob:()=>I(F,fe,z.signal)}),be=()=>z.abort();if(G.addEventListener("abort",be,{once:!0}),l.signal.addEventListener("abort",be,{once:!0}),G.aborted||l.signal.aborted)be();let Oe=_e({binding:F,deviceRelayUrl:T,port:ve,signal:z.signal}),$e={binding:F,relay:T,abort:z,port:ve,opened:Oe};f.set(re,$e);let qe=()=>{if(G.removeEventListener("abort",be),l.signal.removeEventListener("abort",be),f.get(re)===$e)f.delete(re)};try{if((await Oe).closed.then(qe),G.removeEventListener("abort",be),w(M),z.signal.aborted||!await Dt(()=>ve.check()))Jr();return{opened:!0,binding:F}}catch{z.abort(),qe(),Jr()}},async close(x,M){w(M);let{binding:G}=io(x),F=f.get(_(G));if(!F||!ze(F.binding,G))Jr();return F.abort.abort(),await F.opened.then((T)=>T.closed,()=>{return}),{closed:!0,binding:G}},dispose(){l.abort();for(let x of f.values())x.abort.abort();f.clear()}}}import{WebSocket as xn}from"ws";var No=(e)=>("data"in e)?e.data.length:e.bytes,Bo=2*Xe;function ar(e){throw new r(e,"The bound Hands terminal is unavailable or its outcome is unconfirmed.")}var _t=(e)=>!["starting","running"].includes(e.state);function Gi(e,l,f=Date.now()){let _=["relay_url","session_id","expires_at","cols","rows","pty","workspace"];if(Object.keys(e).length!==_.length||Object.keys(e).some((M)=>!_.includes(M))||!ae(l)||!ae(e.session_id)||typeof e.expires_at!=="string"||typeof e.relay_url!=="string"||e.relay_url.length>4096||![e.cols,e.rows].every((M)=>Number.isSafeInteger(M)&&Number(M)>=1&&Number(M)<=Ee))ar("invalid_pty_request");let w=e.pty;if(!w||typeof w!=="object"||Array.isArray(w))ar("invalid_pty_request");let S=w;if(Object.keys(S).length!==2||S.version!==1||!ce(S.jobId))ar("invalid_pty_request");let I;try{I=new URL(e.relay_url)}catch{return ar("invalid_pty_request")}if(!["ws:","wss:"].includes(I.protocol)||I.username||I.password||I.hash||I.protocol==="ws:"&&!["127.0.0.1","[::1]","localhost"].includes(I.hostname))ar("invalid_pty_request");let W=Date.parse(e.expires_at);if(!Number.isSafeInteger(W)||W<=f)ar("invalid_pty_request");return{workspace:H(e.workspace)??ar("invalid_pty_request"),session:{jobId:S.jobId,sessionId:e.session_id,operationId:l,relayUrl:I.href,cols:Number(e.cols),rows:Number(e.rows),leaseExpiresAtMs:Math.min(W,f+43200000)}}}async function Mo(e){let{session:l,binding:f}=e;if(f.assertCurrent(),e.signal.aborted||Date.now()>=l.leaseExpiresAtMs)ar("cancelled");let _=new xn(l.relayUrl,{followRedirects:!1,perMessageDeflate:!1,maxPayload:ne}),w=new AbortController,S=()=>{},I=()=>{w.abort(),S()};e.signal.addEventListener("abort",I,{once:!0});let W=setTimeout(I,Math.max(1,l.leaseExpiresAtMs-Date.now())),x=[],M=0,G=0,F=0,T=!1,re=!1,J=!1,z,fe,ve,be=(le)=>{ve=new r(le,"Bound terminal input was refused."),I()};_.on("error",()=>be("pty_relay_unavailable")),_.on("close",I),_.on("message",(le,he)=>{if(w.signal.aborted)return;if(!re){be("pty_not_ready");return}let xe=Array.isArray(le)?Buffer.concat(le):le instanceof ArrayBuffer?Buffer.from(le):le;if(xe.length===0)return;let Ke=x.at(-1),Le=he&&Ke!==void 0&&"data"in Ke&&Ke.data.length+xe.length<=ne;if(xe.length>ne||M+xe.length>qn){be("pty_input_backpressure");return}if(Le)Ke.data=Buffer.concat([Ke.data,xe]);else if(he)x.push({data:Buffer.from(xe)});else try{let Be=JSON.parse(xe.toString("utf8"));if(Be&&Be.t==="close"&&Object.keys(Be).length===1){J=!0,I();return}if(!Be||Be.t!=="resize"||Object.keys(Be).length!==3||![Be.cols,Be.rows].every((ke)=>Number.isSafeInteger(ke)&&ke>=1&&ke<=Ee))throw Error("invalid_control");x.push({cols:Be.cols,rows:Be.rows,bytes:xe.length})}catch{be("invalid_pty_control");return}M+=xe.length,S()});function Oe(le){return Vn(JSON.stringify({...f.scope,version:1,sessionId:l.sessionId,operationId:l.operationId,job:{...le,output:[],pty:le.pty?{...le.pty,output:[]}:void 0}}))}function $e(le){if(!le.ok)ar(le.error);let he=le.job;if(le.generation!==f.scope.generation||he.jobId!==l.jobId||!he.pty||he.leaseExpiresAtMs>l.leaseExpiresAtMs||he.process&&he.process.executorLaunchId!==f.scope.executorLaunchId||he.process&&fe&&(he.process.pid!==fe.pid||he.process.processGroupId!==fe.processGroupId)||he.state!=="starting"&&(he.environmentRevision!==f.environment.revision||he.environmentSnapshotId!==f.environment.snapshotId))ar("pty_binding_changed");if(Oe(he),he.process)fe??={...he.process};return he}async function qe(le){f.assertCurrent();let he=await f.request(le,w.signal);if(f.assertCurrent(),w.signal.aborted)ar("cancelled");let xe=$e(he);if(xe.inputSequence!==G)ar("job_input_sequence");if(!_t(xe)&&xe.leaseExpiresAtMs<=Date.now())ar("pty_binding_changed");return xe}function ye(le){if(f.assertCurrent(),w.signal.aborted||_.readyState!==xn.OPEN||_.bufferedAmount+Buffer.byteLength(le)>Bo)ar("pty_output_backpressure");_.send(le)}function Fe(le){if(le.firstCursor>F+1)F=le.firstCursor-1;for(let he of le.pty.output){if(he.cursor<=F)continue;if(he.cursor!==F+1)ar("pty_output_gap");let xe=Buffer.from(he.dataBase64,"base64");if(_.bufferedAmount+xe.length>Bo)return!1;ye(xe),F=he.cursor}if(F!==le.nextCursor)ar("pty_output_gap");return!0}async function Ve(le,he){let xe;try{await Promise.race([e.emit(le,he),new Promise((Ke,Le)=>{xe=setTimeout(()=>Le(new r("pty_event_unavailable","Terminal metadata delivery timed out.")),2000)})])}finally{clearTimeout(xe)}}async function Te(){let le=AbortSignal.timeout(Xt),he=f.request({jobId:l.jobId,action:"cancel",input:{}},le),xe,Ke=new Promise((Le,Be)=>{if(xe=()=>Be(new r("pty_cleanup_unconfirmed","Terminal cleanup acknowledgement was not observed within authority.")),le.addEventListener("abort",xe,{once:!0}),le.aborted)xe()});try{let Le=await Promise.race([he,Ke]);if(le.aborted)ar("pty_cleanup_unconfirmed");return $e(Le)}finally{le.removeEventListener("abort",xe)}}try{await new Promise((Le,Be)=>{let ke=setTimeout(()=>{I(),Be(new r("pty_relay_unavailable","Terminal pairing timed out."))},5000),We=()=>{clearTimeout(ke),Be(new r("cancelled","Terminal pairing was cancelled."))};if(w.signal.addEventListener("abort",We,{once:!0}),_.once("open",()=>{clearTimeout(ke),w.signal.removeEventListener("abort",We),Le()}),w.signal.aborted)We()}),f.assertCurrent(),T=!0,z=await qe({jobId:l.jobId,action:"start",input:{mode:"pty",cols:l.cols,rows:l.rows,leaseExpiresAtMs:l.leaseExpiresAtMs}});let le=Date.now()+5000;while(z.state==="starting"){if(Date.now()>=le)ar("pty_not_ready");await new Promise((Le)=>setTimeout(Le,25)),z=await qe({jobId:l.jobId,action:"inspect",input:{after:F}})}if(z.state!=="running"||z.inputSequence!==0||z.leaseExpiresAtMs<=Date.now())ar("pty_not_ready");await Ve("pty.ready",Oe(z)),re=!0,ye(JSON.stringify({t:"open",cols:z.pty.cols,rows:z.pty.rows,receipt:Oe(z)}));let he=!1,xe=0,Ke=!1;while(!w.signal.aborted){let Le=z.firstCursor>F+1,Be=Fe(z);if(_t(z)){if(Be)break}else if(Le)he=!0;else if(he&&Be&&Date.now()>=xe){he=!1,xe=Date.now()+1000;let{cols:We,rows:nr}=z.pty;for(let or of[{cols:We,rows:nr>1?nr-1:2},{cols:We,rows:nr}]){if(_t(z))break;let Pr=++G;if(z=await qe({jobId:l.jobId,action:"resize",input:{sequence:Pr,...or}}),z.inputSequence!==Pr)ar("job_input_sequence")}continue}let ke=_t(z)||Ke?void 0:x.shift();if(ke){M-=No(ke);let We=++G;try{z=await qe("data"in ke?{jobId:l.jobId,action:"input",input:{sequence:We,dataBase64:ke.data.toString("base64")}}:{jobId:l.jobId,action:"resize",input:{sequence:We,cols:ke.cols,rows:ke.rows}})}catch(nr){if(!(nr instanceof r)||nr.code!=="job_input_backpressure")throw nr;G-=1,x.unshift(ke),M+=No(ke),Ke=!0;continue}if(z.inputSequence!==We)ar("job_input_sequence")}else if(await new Promise((We)=>{let nr=setTimeout(We,Ke||!Be?10:50);if(S=()=>{clearTimeout(nr),We()},w.signal.aborted||!Ke&&x.length)S()}),Ke=!1,S=()=>{},!w.signal.aborted&&Be)try{z=await qe({jobId:l.jobId,action:"inspect",input:{after:F}})}catch(We){if(!J||!(We instanceof r)||We.code!=="cancelled")throw We}}}catch(le){ve??=le}finally{if(re=!1,x.length=0,clearTimeout(W),e.signal.removeEventListener("abort",I),I(),T&&(!z||!_t(z)))try{z=await Te()}catch{z=void 0}try{if(!z||!_t(z)||z.pty?.cleanup!=="confirmed")ar("pty_cleanup_unconfirmed");let le=Oe(z);if(_.readyState===xn.OPEN)await new Promise((he)=>{let xe=setTimeout(he,500);_.send(JSON.stringify({t:"exit",code:z.exitCode,receipt:le}),()=>{clearTimeout(xe),he()})});await Ve("pty.stopped",le)}catch(le){ve??=le}_.terminate()}if(ve)throw ve;if(e.signal.aborted)ar("cancelled");if(!z)ar("pty_cleanup_unconfirmed");return{receipt:Oe(z)}}import{createHash as yi,randomUUID as An}from"crypto";import{spawnSync as $o}from"child_process";import{closeSync as Wo,constants as Pn,fstatSync as vi,fsyncSync as ki,lstatSync as Lt,mkdirSync as Si,mkdtempSync as Ko,openSync as Fo,readFileSync as Ei,readdirSync as Go,realpathSync as Nt,rmSync as In,unlinkSync as xi}from"fs";import{createConnection as Pi}from"net";import{dirname as Ii,join as tt,sep as Ai}from"path";import{tmpdir as Ti}from"os";var Or=new Map,Vr=new Map;function $r(e,l){return yi("sha256").update(JSON.stringify([e,l])).digest("hex")}function mt(e){try{Si(e,{mode:448})}catch(f){if(!(f instanceof Error&&("code"in f)&&f.code==="EEXIST"))throw f}let l=Lt(e);if(!l.isDirectory()||l.isSymbolicLink()||!A(l)||Nt(e)!==e)throw new r("hands_jobs_unavailable","Hands job state must be a private canonical directory.")}function Ci(e){let l;try{l=Lt(e)}catch(f){if(f instanceof Error&&"code"in f&&f.code==="ENOENT")return!1;throw f}return!l.isDirectory()||l.isSymbolicLink()||Go(e).length>0}function hr(e){let l=$r(e.root,e.runId),f=e.previousRuntimeDirectories?.find((I)=>Ci(tt(I,"jobs",l.slice(0,16))))??e.runtimeDirectory;mt(f);let _=tt(f,"jobs");mt(_);let w=tt(_,l.slice(0,16));if(e.maxScopes!==void 0){let I=Go(_);if(!Number.isSafeInteger(e.maxScopes)||e.maxScopes<1||I.length>e.maxScopes||!I.includes(l.slice(0,16))&&I.length>=e.maxScopes)throw new r("process_journal_capacity","Managed process receipt capacity is full; preserve uncertain jobs and reconcile their existing receipts before starting more work.")}mt(w);let S=Ko(tt(zo(),"reason-j-"));try{return mt(S),{journalDirectory:w,scopeId:l,launchDirectory:S,socketPath:process.platform==="win32"?`\\\\.\\pipe\\reason-jobs-${An()}`:tt(S,"control.sock"),disposeSocket:()=>In(S,{recursive:!0,force:!0})}}catch(I){throw In(S,{recursive:!0,force:!0}),I}}var Hi=60000,Li=5000;function Bi(e){if(process.platform==="win32")return ji(e);let l=$o("ps",["-o","lstart=","-p",String(e)],{encoding:"utf8",timeout:2000,env:{...process.env,LC_ALL:"C",LANG:"C"}}),f=l.status===0?/^\w{3} (\w{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(l.stdout.trim()):null,_=f?"JanFebMarAprMayJunJulAugSepOctNovDec".indexOf(f[1]):-1;if(!f||_<0||_%3!==0)return null;let w=new Date(Number(f[6]),_/3,Number(f[2]),Number(f[3]),Number(f[4]),Number(f[5])).getTime();return Number.isFinite(w)?w:null}function ji(e){let l=$o(C("powershell"),["-NoProfile","-NonInteractive","-Command",`(Get-Process -Id ${e}).StartTime.ToUniversalTime().ToString('o')`],{encoding:"utf8",timeout:5000,windowsHide:!0,env:De()}),f=l.status===0?Date.parse(l.stdout.trim()):Number.NaN;return Number.isFinite(f)?f:null}function Jo(e,l={}){let f=tt(e.journalDirectory,"owner.lock"),_;try{_=Fo(f,Pn.O_RDONLY|Pn.O_NOFOLLOW)}catch{return null}try{let w=vi(_);if(!w.isFile()||w.nlink!==1||!A(w)||w.size>4096)return null;let S=null;try{S=JSON.parse(Ei(_,"utf8"))}catch{}let I;if(S===null){if((l.now??Date.now)()-w.mtimeMs<Hi)return null;I={reason:"never_written",executorLaunchId:null}}else{let{version:M,scopeId:G,pid:F,createdAtMs:T,executorLaunchId:re}=S;if(M!==1||G!==e.scopeId||typeof re!=="string"||typeof F!=="number"||!Number.isSafeInteger(F)||F<1||F===process.pid||typeof T!=="number"||!Number.isSafeInteger(T))return null;if(!(l.exists??((z)=>{try{return process.kill(z,0),!0}catch(fe){return!(fe instanceof Error&&("code"in fe)&&fe.code==="ESRCH")}}))(F))I={reason:"owner_exited",executorLaunchId:re};else{let z=(l.startedAtMs??Bi)(F);if(z===null||z<=T+Li)return null;I={reason:"pid_reused",executorLaunchId:re}}}let W=Lt(f);if(W.dev!==w.dev||W.ino!==w.ino)return null;xi(f);let x=Fo(e.journalDirectory,Pn.O_RDONLY);try{ki(x)}finally{Wo(x)}return I}catch{return null}finally{Wo(_)}}function Vo(e){let l={...e,workspace:e.workspace&&Object.freeze({...e.workspace}),previewAuthority:e.previewAuthority&&Object.freeze({...e.previewAuthority,owner:Object.freeze({...e.previewAuthority.owner}),deniedPorts:new Set(e.previewAuthority.deniedPorts)})},f=$r(l.root,l.runId);if(Or.has(f)||l.operationId!==void 0&&Vr.has(l.operationId))throw new r("hands_jobs_busy","The Session already has a live Hands job supervisor.");let _={binding:l,key:f,terminals:new Map};if(l.previewAuthority&&l.environment)_.previews=Co({authority:l.previewAuthority,runId:l.runId,expiresAtMs:l.expiresAtMs,executorLaunchId:l.executorLaunchId,environment:l.environment,isCurrent:()=>Or.get(_.key)===_,identity:()=>{try{return ht(l)}catch{return null}},inspect:(w,S)=>{if(Or.get(_.key)!==_)throw new r("preview_unavailable","The Hands supervisor is no longer current.");return qo(l,{jobId:w,action:"inspect",input:{after:0}},S)}});if(Or.set(f,_),l.operationId!==void 0)Vr.set(l.operationId,_);return()=>{if(Or.get(_.key)===_)Or.delete(_.key);if(l.operationId!==void 0&&Vr.get(l.operationId)===_)Vr.delete(l.operationId);_.previews?.dispose();for(let w of _.terminals.values())w.abort()}}var Mi=5000,Wi=20;async function Ki(e){let l=(w)=>{throw new r("hands_rebind_unavailable",w)};if(!N(e.operationId)||!N(e.runId)||!N(e.fenceId)||!U(e.targetGeneration))l("Reason sent an invalid Hands rebind.");let f=Vr.get(e.operationId);if(!f||f.binding.root!==e.root)return l("No live Hands supervisor owns this operation.");for(let w=Date.now()+Mi;;){if(e.signal?.aborted)l("The Hands rebind was cancelled.");if(Vr.get(e.operationId)!==f)l("The Hands supervisor is no longer current.");let S=null;try{S=ht(f.binding)}catch{}if(S&&S.generation===e.targetGeneration&&S.fenceId===e.fenceId)break;if(S&&S.generation>e.targetGeneration||Date.now()>=w)l("The executor did not adopt this take.");await new Promise((I)=>setTimeout(I,Wi))}if(Vr.get(e.operationId)!==f||Or.get(f.key)!==f)l("The Hands supervisor is no longer current.");let _=$r(e.root,e.runId);if(f.key===_)return;if(Or.has(_))l("The taking run already has a live Hands job supervisor.");Or.delete(f.key);for(let w of f.terminals.values())w.abort();f.key=_,Or.set(_,f)}function it(e){let l="operationId"in e?Vr.get(e.operationId):Or.get($r(e.root,e.runId)),f=l&&l.binding.root===e.root?l.binding:void 0;if(!f?.environment||f.expiresAtMs<=Date.now())throw new r("environment_unavailable","No live Hands supervisor owns this environment.");return f.environment.install(e.payload)}async function Ji(e){let l=Or.get($r(e.root,e.runId));if(!l?.previews||!e.owner)throw new r("preview_unavailable","No authenticated Hands supervisor owns this preview.");return l.previews.open(e.payload,e.owner,e.signal)}async function Zi(e){let l=Or.get($r(e.root,e.runId));if(!l?.previews||!e.owner||e.signal.aborted)throw new r("preview_unavailable","No authenticated Hands supervisor owns this preview.");return l.previews.close(e.payload,e.owner)}async function Xi(e){let l=$r(e.root,e.runId),f=Or.get(l),_=f?.binding,w=_?.runId,S=_?.previewAuthority,I=_?.environment,W=e.owner&&{...e.owner},x=e.authority&&{...e.authority},M=()=>{throw new r("pty_binding_unavailable","No current authenticated Hands scope owns this terminal.")};if(!f||!_||!S||!I||!W||!x||!_.workspace)return M();let G=Object.freeze({..._.workspace}),F=ht(_),T=I.current(),re=()=>{if(Or.get(l)!==f||W.organization_id!==S.owner.organization_id||W.user_id!==S.owner.user_id||W.device_id!==S.owner.device_id||e.deviceId!==S.owner.device_id||e.rootId!==S.rootId||O(e.workspace)!==O(G))M();let z=ht(_),fe=I.current();if(z.generation!==F.generation||z.fenceId!==F.fenceId||fe.run_id!==w||fe.device_id!==e.deviceId||fe.root_id!==e.rootId||fe.snapshot_id!==T.snapshot_id||fe.revision!==T.revision||fe.binding.target_generation!==F.generation||fe.binding.target_fence_id!==F.fenceId||x.device_id!==e.deviceId||x.binding!==fe.binding.kind||x.target_revision!==fe.binding.target_revision||x.root_grant_revision!==fe.binding.root_grant_revision||x.target_generation!==F.generation||x.target_fence_id!==F.fenceId)M()};if(re(),new URL(e.session.relayUrl).origin!==S.relayOrigin||f.terminals.has(e.session.jobId)||f.terminals.size>=4)return M();let J=new AbortController;f.terminals.set(e.session.jobId,J);try{return await Mo({session:{...e.session,leaseExpiresAtMs:Math.min(e.session.leaseExpiresAtMs,F.expiresAtMs,Date.parse(T.expires_at))},signal:AbortSignal.any([e.signal,J.signal]),emit:e.emit,binding:{assertCurrent:re,environment:{revision:T.revision,snapshotId:T.snapshot_id},scope:{runId:e.runId,deviceId:e.deviceId,rootId:e.rootId,workspace:G,binding:T.binding.kind,targetRevision:T.binding.target_revision,rootGrantRevision:T.binding.root_grant_revision,generation:F.generation,fenceId:F.fenceId,executorLaunchId:F.executorLaunchId},request:(z,fe)=>fr(F,Hr(JSON.stringify({...z,type:"job",version:2,generation:F.generation,id:An()})),fe)}})}finally{if(f.terminals.get(e.session.jobId)===J)f.terminals.delete(e.session.jobId)}}async function Yi(e){if(ce(e.payload.jobId))throw new r("pty_binding_required","PTY jobs require the bound terminal capability.");let l=Or.get($r(e.root,e.runId))?.binding;if(!l||l.expiresAtMs<=Date.now())throw new r("hands_jobs_unavailable","No live Hands supervisor owns this Session and root.");return qo(l,e.payload,e.signal)}var Fi=1e4,Ui=20,zi=Se/2,$i=Je/2,Vi=(e)=>e.output.reduce((l,f)=>l+f.text.length,0);async function qo(e,l,f){if(Object.keys(l).some((M)=>!["jobId","action","input","waitForExitMs"].includes(M)))throw new r("invalid_payload","Unexpected job control field.");let{waitForExitMs:_,...w}=l;if(_!==void 0&&(w.action!=="start"||typeof w.input!=="object"||w.input===null||!("script"in w.input)||typeof _!=="number"||!Number.isSafeInteger(_)||_<1||_>Fi))throw new r("invalid_payload","Only a script start may wait for its job, within its bound.");let S=(M)=>{let G=ht(e);return fr(G,Hr(JSON.stringify({...M,type:"job",version:2,generation:G.generation,id:An()})),f)},I=await S(w);if(_===void 0)return I;let W=Date.now()+_,x=I;while(x.ok&&["starting","running"].includes(x.job.state)&&x.job.output.length<zi&&Vi(x.job)<$i&&!f.aborted&&Date.now()<W){if(await new Promise((M)=>setTimeout(M,Math.min(Ui,W-Date.now()))),f.aborted)break;try{let M=await S({jobId:w.jobId,action:"inspect",input:{after:0}});if(!M.ok)break;x=M}catch{break}}return x}function ht(e){if(e.expiresAtMs<=Date.now())throw new r("hands_jobs_unavailable","Hands authority expired.");let l=e.readIdentity?e.readIdentity():e;if(!l||!U(l.generation)||!N(l.fenceId)||l.generation<e.generation||l.generation===e.generation&&l.fenceId!==e.fenceId)throw new r("hands_jobs_unavailable","The live Hands fencing identity could not be verified.");return e.generation=l.generation,e.fenceId=l.fenceId,{...e}}function fr(e,l,f){if(f.aborted)return Promise.reject(new r("cancelled","Job control was cancelled."));return new Promise((_,w)=>{let S=Pi(e.socketPath),I="",W=!1,x,M=(F,T)=>{if(W)return;if(W=!0,clearTimeout(x),f.removeEventListener("abort",G),S.destroy(),F)w(F);else _(T)},G=()=>M(new r("cancelled","Job control waiter cancelled; inspect before retrying mutations."));f.addEventListener("abort",G,{once:!0}),S.setEncoding("utf8"),x=setTimeout(()=>M(new r("hands_job_result_unknown","Job control timed out; inspect before retrying mutations.")),Math.min(1e4,Math.max(1,e.expiresAtMs-Date.now()))),S.on("error",()=>M(new r("hands_job_result_unknown","Hands job control connection failed."))),S.once("connect",()=>S.write(JSON.stringify({version:1,scopeId:e.scopeId,fenceId:e.fenceId,executorLaunchId:e.executorLaunchId,request:l})+`
+import{Gt,j}from"./vm-hands-entry-lite-tmart4k9.js";import{ue,Ce,Z,Ae,de,rr,Qe,X,O,H,tn}from"./vm-hands-entry-lite-3krzmhkk.js";import{Do,ei}from"./vm-hands-entry-lite-k83rkcys.js";import{So,P,Je,Se,Ze,ne,Xe,qn,Ee,Xt,ae,U,N,ce,Hr,zr,Vn}from"./vm-hands-entry-lite-5zdybh8s.js";import{Pe,oe,pe,Y,Re,q,Q}from"./vm-hands-entry-lite-mb6atrr0.js";import{It,kr,st,V,D,R,b}from"./vm-hands-entry-lite-wwp36b4m.js";import{Er,xr,vn,no,He,Sn}from"./vm-hands-entry-lite-hzh8fdxx.js";import{K}from"./vm-hands-entry-lite-fykfnzjg.js";import{Ni}from"./vm-hands-entry-lite-jwgheerx.js";import{p,ze,Dt,at,io,_e,we}from"./vm-hands-entry-lite-h6rhk6h1.js";import{v,h,ao}from"./vm-hands-entry-lite-52x189kf.js";import{E}from"./vm-hands-entry-lite-txd50spx.js";import{Qt}from"./vm-hands-entry-lite-j7gv6vvr.js";import{a,ie,Lo}from"./vm-hands-entry-lite-cf1x5cbr.js";import{L,Ri,Oi,jo,y,t,k,Et,o,d,u,i,c,g,ee,s,n}from"./vm-hands-entry-lite-vmnxnr7y.js";import{Di}from"./vm-hands-entry-lite-k3ksgb4t.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{Ho,se,zo,C,De,Me,A}from"./vm-hands-entry-lite-vdhgwmmp.js";var _i=()=>{let e={string:{unit:"characters",verb:"to have"},file:{unit:"bytes",verb:"to have"},array:{unit:"items",verb:"to have"},set:{unit:"items",verb:"to have"},map:{unit:"entries",verb:"to have"}};function l(w){return e[w]??null}let f={regex:"input",email:"email address",url:"URL",emoji:"emoji",uuid:"UUID",uuidv4:"UUIDv4",uuidv6:"UUIDv6",nanoid:"nanoid",guid:"GUID",cuid:"cuid",cuid2:"cuid2",ulid:"ULID",xid:"XID",ksuid:"KSUID",datetime:"ISO datetime",date:"ISO date",time:"ISO time",duration:"ISO duration",ipv4:"IPv4 address",ipv6:"IPv6 address",mac:"MAC address",cidrv4:"IPv4 range",cidrv6:"IPv6 range",base64:"base64-encoded string",base64url:"base64url-encoded string",json_string:"JSON string",e164:"E.164 number",jwt:"JWT",template_literal:"input"},_={nan:"NaN"};return(w)=>{switch(w.code){case"invalid_type":{let S=_[w.expected]??w.expected,I=jo(w.input),W=_[I]??I;return`Invalid input: expected ${S}, received ${W}`}case"invalid_value":if(w.values.length===1)return`Invalid input: expected ${Oi(w.values[0])}`;return`Invalid option: expected one of ${Ri(w.values,"|")}`;case"too_big":{let S=w.inclusive?"<=":"<",I=l(w.origin);if(I)return`Too big: expected ${w.origin??"value"} to have ${S}${w.maximum.toString()} ${I.unit??"elements"}`;return`Too big: expected ${w.origin??"value"} to be ${S}${w.maximum.toString()}`}case"too_small":{let S=w.inclusive?">=":">",I=l(w.origin);if(I)return`Too small: expected ${w.origin} to have ${S}${w.minimum.toString()} ${I.unit}`;return`Too small: expected ${w.origin} to be ${S}${w.minimum.toString()}`}case"invalid_format":{let S=w;if(S.format==="starts_with")return`Invalid string: must start with "${S.prefix}"`;if(S.format==="ends_with")return`Invalid string: must end with "${S.suffix}"`;if(S.format==="includes")return`Invalid string: must include "${S.includes}"`;if(S.format==="regex")return`Invalid string: must match pattern ${S.pattern}`;return`Invalid ${f[S.format]??w.format}`}case"not_multiple_of":return`Invalid number: must be a multiple of ${w.divisor}`;case"unrecognized_keys":return`Unrecognized key${w.keys.length>1?"s":""}: ${Ri(w.keys,", ")}`;case"invalid_key":return`Invalid key in ${w.origin}`;case"invalid_union":if(w.options&&Array.isArray(w.options)&&w.options.length>0)return`Invalid discriminator value. Expected ${w.options.map((I)=>`'${I}'`).join(" | ")}`;return"Invalid input";case"invalid_element":return`Invalid value in ${w.origin}`;default:return"Invalid input"}}};function En(){return{localeError:_i()}}L(En());class pt extends Error{}function xo(e){let l;try{l=new URL(e)}catch{throw new pt("The proxy must be a URL like https://proxy.example.com:3128.")}if(l.protocol!=="https:"&&l.protocol!=="http:")throw new pt("The proxy URL must use the https or http scheme.");if(!l.hostname)throw new pt("The proxy URL must name a host.");if(l.port!==""&&Number(l.port)<1)throw new pt("The proxy URL must use a port between 1 and 65535.");if(l.pathname!==""&&l.pathname!=="/"||l.search||l.hash)throw new pt("The proxy URL must not carry a path, query, or fragment.");return l.toString()}import{createHash as mi}from"crypto";import{isAbsolute as Po,join as Io,relative as Ao,resolve as Vt,sep as To}from"path";var Jt=t().min(1).refine(Po,"absolute path required"),On=c({version:n(1),apiOrigin:Et(),channel:s(["staging","production"]),stateDirectory:Jt,workspaceRoot:Jt,lifetime:s(["persistent","ephemeral"]),executionMode:s(["confined","host"]).default("confined"),name:t().min(1).max(160).default("Reason headless worker"),slots:o().int().min(1).max(4).default(1),shutdownGraceMs:o().int().min(0).max(300000).default(30000),proxy:c({version:n(Gt),url:t().refine((e)=>{try{return xo(e)===e}catch{return!1}},"invalid proxy URL"),caFile:Jt.optional()}).optional(),userChrome:d().optional(),cloudSessions:n(!0).optional(),localLogins:d().optional(),folders:u(Jt).min(1).max(31).optional()}),hi=/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/,B=g("channel",[On,On.extend({channel:n("pr"),apiOrigin:t(),prEnvironment:t()}),On.extend({channel:n("local-qa"),apiOrigin:t()})]).superRefine((e,l)=>{if(e.channel==="local-qa"){if(!hi.test(e.apiOrigin))l.addIssue({code:"custom",message:"local QA worker requires an exact HTTPS trycloudflare.com quick-tunnel origin"})}else if(e.channel==="pr"){let _=e.prEnvironment,w=/^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.up\.railway\.app$/.exec(e.apiOrigin),S=w?.[1]?.match(/(?:^|-)pr-[0-9]+(?=-|$)/g)?.map((I)=>I.replace(/^-/,""));if(!_||/^pr-[1-9][0-9]*$/.exec(_)?.[0]!==_||w?.[0]!==e.apiOrigin||S?.length!==1||S[0]!==_)l.addIssue({code:"custom",message:"PR worker requires explicit prEnvironment and an exact same-PR HTTPS Railway origin"})}else{let _=new URL(e.apiOrigin);if(_.origin!==e.apiOrigin||_.username||_.password||_.protocol!=="https:"&&!(_.protocol==="http:"&&ei(_.origin))||!ei(_.origin)&&!Do(e.channel,_.origin))l.addIssue({code:"custom",message:"API origin must match channel (or loopback)"})}if(!je(e.workspaceRoot,e.stateDirectory))l.addIssue({code:"custom",message:"state and workspace must be disjoint"});let f=e.folders??[];if(new Set([e.workspaceRoot,...f]).size!==f.length+1||f.some((_)=>!je(_,e.stateDirectory)))l.addIssue({code:"custom",message:"folders must be distinct and disjoint from state"})});function m(e){return Io(e.stateDirectory,`headless-${e.channel==="pr"?e.prEnvironment:e.channel}`)}function je(e,l){if(Ur(l,e))return!1;return!Ur(e,l)||E(Io(To,Ao(Vt(e),Vt(l))))}function Ur(e,l){let f=Ao(Vt(e),Vt(l));return f===""||f!==".."&&!f.startsWith(`..${To}`)&&!Po(f)}function te(e){let{proxy:l,userChrome:f,cloudSessions:_,localLogins:w,folders:S,...I}=e;return mi("sha256").update(JSON.stringify(I)).digest("hex")}var gi=4,bi=[2375,2376,9222,9229];function pr(e){let l=new Set(bi);for(let f of e){let _=new URL(f);l.add(Number(_.port||(["https:","wss:"].includes(_.protocol)?443:80)))}return l}function Jr(){throw new r("preview_unavailable","The live Hands preview binding is unavailable or stale.")}var wi=60000;function Co(e){let l=new AbortController,f=new Map,_=(x)=>JSON.stringify([x.jobId,x.port]);function w(x){let M=e.authority.owner;if(l.signal.aborted||!e.isCurrent()||e.expiresAtMs<=Date.now()||x.organization_id!==M.organization_id||x.user_id!==M.user_id||x.device_id!==M.device_id)Jr()}function S(x){let M;try{M=e.environment.current()}catch{return null}return M.binding.target_generation===x.generation&&M.binding.target_fence_id===x.fenceId&&M.run_id===e.runId&&M.device_id===e.authority.owner.device_id&&M.root_id===e.authority.rootId?M:null}async function I(x,M,G){let F=await W(x,M,G);if(F!=="moved")return F;let T=await W(x,M,G);return T==="moved"?null:T}async function W(x,M,G){try{w(e.authority.owner);let F=e.identity();if(!F||G.aborted||x.expiresAtMs<=Date.now()||x.expiresAtMs>e.expiresAtMs)return null;let T=M.opened,re=T!==void 0&&F.generation>T.generation,J=S(F);if(re){if(J){if(J.revision<=T.revision||x.expiresAtMs>Date.parse(J.expires_at)||J.binding.target_revision!==T.attachmentRevision||J.binding.root_grant_revision!==T.grantRevision)return null;M.recoveringSinceMs=void 0}else if(Date.now()-(M.recoveringSinceMs??=Date.now())>wi)return null}else if(!J||x.expiresAtMs>Date.parse(J.expires_at)||T&&(F.generation!==T.generation||F.fenceId!==T.fenceId))return null;let z=await e.inspect(x.jobId,G),fe=e.identity(),ve=fe&&S(fe);w(e.authority.owner);let be=J&&{generation:F.generation,fenceId:F.fenceId,snapshotId:J.snapshot_id,revision:J.revision,attachmentRevision:J.binding.target_revision,grantRevision:J.binding.root_grant_revision},Oe=re?T:be;if(G.aborted||!fe)return null;if(fe.generation!==F.generation||fe.fenceId!==F.fenceId||ve?.snapshot_id!==J?.snapshot_id||ve?.revision!==J?.revision)return"moved";let $e=z.ok&&z.job.environmentSnapshotId!==void 0&&z.job.environmentRevision!==void 0?{snapshotId:z.job.environmentSnapshotId,revision:z.job.environmentRevision}:null;if(!z.ok||z.generation!==F.generation||!Oe||!$e)return null;if(($e.snapshotId!==Oe.snapshotId||$e.revision!==Oe.revision)&&(re||!e.environment.carried($e.snapshotId,$e.revision)))return null;if(!T&&F.generation===x.generation&&F.fenceId===x.fenceId)M.opened={...Oe,...$e};return{executorLaunchId:e.executorLaunchId,job:z.job,binding:{organizationId:e.authority.owner.organization_id,userId:e.authority.owner.user_id,deviceId:e.authority.owner.device_id,rootId:e.authority.rootId,runId:e.runId,attachmentRevision:Oe.attachmentRevision,grantRevision:Oe.grantRevision,generation:Oe.generation,fenceId:Oe.fenceId,jobId:z.job.jobId,port:x.port,expiresAtMs:x.expiresAtMs}}}catch{return null}}return{async open(x,M,G){w(M);let{binding:F,deviceRelayUrl:T}=at(x);if(G.aborted||F.expiresAtMs<=Date.now()||F.expiresAtMs>Date.now()+p.lifetimeMs||new URL(T).origin!==e.authority.relayOrigin)Jr();let re=_(F),J=f.get(re);if(J){if(!ze(J.binding,F)||J.relay!==T)Jr();if(await J.opened,!await Dt(()=>J.port.check())||G.aborted||J.abort.signal.aborted)Jr();return{opened:!0,binding:F}}if(f.size>=gi)Jr();let z=new AbortController,fe={},ve=we({binding:F,deniedPorts:e.authority.deniedPorts,readCurrentJob:()=>I(F,fe,z.signal)}),be=()=>z.abort();if(G.addEventListener("abort",be,{once:!0}),l.signal.addEventListener("abort",be,{once:!0}),G.aborted||l.signal.aborted)be();let Oe=_e({binding:F,deviceRelayUrl:T,port:ve,signal:z.signal}),$e={binding:F,relay:T,abort:z,port:ve,opened:Oe};f.set(re,$e);let qe=()=>{if(G.removeEventListener("abort",be),l.signal.removeEventListener("abort",be),f.get(re)===$e)f.delete(re)};try{if((await Oe).closed.then(qe),G.removeEventListener("abort",be),w(M),z.signal.aborted||!await Dt(()=>ve.check()))Jr();return{opened:!0,binding:F}}catch{z.abort(),qe(),Jr()}},async close(x,M){w(M);let{binding:G}=io(x),F=f.get(_(G));if(!F||!ze(F.binding,G))Jr();return F.abort.abort(),await F.opened.then((T)=>T.closed,()=>{return}),{closed:!0,binding:G}},dispose(){l.abort();for(let x of f.values())x.abort.abort();f.clear()}}}import{WebSocket as xn}from"ws";var No=(e)=>("data"in e)?e.data.length:e.bytes,Bo=2*Xe;function ar(e){throw new r(e,"The bound Hands terminal is unavailable or its outcome is unconfirmed.")}var _t=(e)=>!["starting","running"].includes(e.state);function Gi(e,l,f=Date.now()){let _=["relay_url","session_id","expires_at","cols","rows","pty","workspace"];if(Object.keys(e).length!==_.length||Object.keys(e).some((M)=>!_.includes(M))||!ae(l)||!ae(e.session_id)||typeof e.expires_at!=="string"||typeof e.relay_url!=="string"||e.relay_url.length>4096||![e.cols,e.rows].every((M)=>Number.isSafeInteger(M)&&Number(M)>=1&&Number(M)<=Ee))ar("invalid_pty_request");let w=e.pty;if(!w||typeof w!=="object"||Array.isArray(w))ar("invalid_pty_request");let S=w;if(Object.keys(S).length!==2||S.version!==1||!ce(S.jobId))ar("invalid_pty_request");let I;try{I=new URL(e.relay_url)}catch{return ar("invalid_pty_request")}if(!["ws:","wss:"].includes(I.protocol)||I.username||I.password||I.hash||I.protocol==="ws:"&&!["127.0.0.1","[::1]","localhost"].includes(I.hostname))ar("invalid_pty_request");let W=Date.parse(e.expires_at);if(!Number.isSafeInteger(W)||W<=f)ar("invalid_pty_request");return{workspace:H(e.workspace)??ar("invalid_pty_request"),session:{jobId:S.jobId,sessionId:e.session_id,operationId:l,relayUrl:I.href,cols:Number(e.cols),rows:Number(e.rows),leaseExpiresAtMs:Math.min(W,f+43200000)}}}async function Mo(e){let{session:l,binding:f}=e;if(f.assertCurrent(),e.signal.aborted||Date.now()>=l.leaseExpiresAtMs)ar("cancelled");let _=new xn(l.relayUrl,{followRedirects:!1,perMessageDeflate:!1,maxPayload:ne}),w=new AbortController,S=()=>{},I=()=>{w.abort(),S()};e.signal.addEventListener("abort",I,{once:!0});let W=setTimeout(I,Math.max(1,l.leaseExpiresAtMs-Date.now())),x=[],M=0,G=0,F=0,T=!1,re=!1,J=!1,z,fe,ve,be=(le)=>{ve=new r(le,"Bound terminal input was refused."),I()};_.on("error",()=>be("pty_relay_unavailable")),_.on("close",I),_.on("message",(le,he)=>{if(w.signal.aborted)return;if(!re){be("pty_not_ready");return}let xe=Array.isArray(le)?Buffer.concat(le):le instanceof ArrayBuffer?Buffer.from(le):le;if(xe.length===0)return;let Ke=x.at(-1),Le=he&&Ke!==void 0&&"data"in Ke&&Ke.data.length+xe.length<=ne;if(xe.length>ne||M+xe.length>qn){be("pty_input_backpressure");return}if(Le)Ke.data=Buffer.concat([Ke.data,xe]);else if(he)x.push({data:Buffer.from(xe)});else try{let Be=JSON.parse(xe.toString("utf8"));if(Be&&Be.t==="close"&&Object.keys(Be).length===1){J=!0,I();return}if(!Be||Be.t!=="resize"||Object.keys(Be).length!==3||![Be.cols,Be.rows].every((ke)=>Number.isSafeInteger(ke)&&ke>=1&&ke<=Ee))throw Error("invalid_control");x.push({cols:Be.cols,rows:Be.rows,bytes:xe.length})}catch{be("invalid_pty_control");return}M+=xe.length,S()});function Oe(le){return Vn(JSON.stringify({...f.scope,version:1,sessionId:l.sessionId,operationId:l.operationId,job:{...le,output:[],pty:le.pty?{...le.pty,output:[]}:void 0}}))}function $e(le){if(!le.ok)ar(le.error);let he=le.job;if(le.generation!==f.scope.generation||he.jobId!==l.jobId||!he.pty||he.leaseExpiresAtMs>l.leaseExpiresAtMs||he.process&&he.process.executorLaunchId!==f.scope.executorLaunchId||he.process&&fe&&(he.process.pid!==fe.pid||he.process.processGroupId!==fe.processGroupId)||he.state!=="starting"&&(he.environmentRevision!==f.environment.revision||he.environmentSnapshotId!==f.environment.snapshotId))ar("pty_binding_changed");if(Oe(he),he.process)fe??={...he.process};return he}async function qe(le){f.assertCurrent();let he=await f.request(le,w.signal);if(f.assertCurrent(),w.signal.aborted)ar("cancelled");let xe=$e(he);if(xe.inputSequence!==G)ar("job_input_sequence");if(!_t(xe)&&xe.leaseExpiresAtMs<=Date.now())ar("pty_binding_changed");return xe}function ye(le){if(f.assertCurrent(),w.signal.aborted||_.readyState!==xn.OPEN||_.bufferedAmount+Buffer.byteLength(le)>Bo)ar("pty_output_backpressure");_.send(le)}function Fe(le){if(le.firstCursor>F+1)F=le.firstCursor-1;for(let he of le.pty.output){if(he.cursor<=F)continue;if(he.cursor!==F+1)ar("pty_output_gap");let xe=Buffer.from(he.dataBase64,"base64");if(_.bufferedAmount+xe.length>Bo)return!1;ye(xe),F=he.cursor}if(F!==le.nextCursor)ar("pty_output_gap");return!0}async function Ve(le,he){let xe;try{await Promise.race([e.emit(le,he),new Promise((Ke,Le)=>{xe=setTimeout(()=>Le(new r("pty_event_unavailable","Terminal metadata delivery timed out.")),2000)})])}finally{clearTimeout(xe)}}async function Te(){let le=AbortSignal.timeout(Xt),he=f.request({jobId:l.jobId,action:"cancel",input:{}},le),xe,Ke=new Promise((Le,Be)=>{if(xe=()=>Be(new r("pty_cleanup_unconfirmed","Terminal cleanup acknowledgement was not observed within authority.")),le.addEventListener("abort",xe,{once:!0}),le.aborted)xe()});try{let Le=await Promise.race([he,Ke]);if(le.aborted)ar("pty_cleanup_unconfirmed");return $e(Le)}finally{le.removeEventListener("abort",xe)}}try{await new Promise((Le,Be)=>{let ke=setTimeout(()=>{I(),Be(new r("pty_relay_unavailable","Terminal pairing timed out."))},5000),We=()=>{clearTimeout(ke),Be(new r("cancelled","Terminal pairing was cancelled."))};if(w.signal.addEventListener("abort",We,{once:!0}),_.once("open",()=>{clearTimeout(ke),w.signal.removeEventListener("abort",We),Le()}),w.signal.aborted)We()}),f.assertCurrent(),T=!0,z=await qe({jobId:l.jobId,action:"start",input:{mode:"pty",cols:l.cols,rows:l.rows,leaseExpiresAtMs:l.leaseExpiresAtMs}});let le=Date.now()+5000;while(z.state==="starting"){if(Date.now()>=le)ar("pty_not_ready");await new Promise((Le)=>setTimeout(Le,25)),z=await qe({jobId:l.jobId,action:"inspect",input:{after:F}})}if(z.state!=="running"||z.inputSequence!==0||z.leaseExpiresAtMs<=Date.now())ar("pty_not_ready");await Ve("pty.ready",Oe(z)),re=!0,ye(JSON.stringify({t:"open",cols:z.pty.cols,rows:z.pty.rows,receipt:Oe(z)}));let he=!1,xe=0,Ke=!1;while(!w.signal.aborted){let Le=z.firstCursor>F+1,Be=Fe(z);if(_t(z)){if(Be)break}else if(Le)he=!0;else if(he&&Be&&Date.now()>=xe){he=!1,xe=Date.now()+1000;let{cols:We,rows:nr}=z.pty;for(let or of[{cols:We,rows:nr>1?nr-1:2},{cols:We,rows:nr}]){if(_t(z))break;let Pr=++G;if(z=await qe({jobId:l.jobId,action:"resize",input:{sequence:Pr,...or}}),z.inputSequence!==Pr)ar("job_input_sequence")}continue}let ke=_t(z)||Ke?void 0:x.shift();if(ke){M-=No(ke);let We=++G;try{z=await qe("data"in ke?{jobId:l.jobId,action:"input",input:{sequence:We,dataBase64:ke.data.toString("base64")}}:{jobId:l.jobId,action:"resize",input:{sequence:We,cols:ke.cols,rows:ke.rows}})}catch(nr){if(!(nr instanceof r)||nr.code!=="job_input_backpressure")throw nr;G-=1,x.unshift(ke),M+=No(ke),Ke=!0;continue}if(z.inputSequence!==We)ar("job_input_sequence")}else if(await new Promise((We)=>{let nr=setTimeout(We,Ke||!Be?10:50);if(S=()=>{clearTimeout(nr),We()},w.signal.aborted||!Ke&&x.length)S()}),Ke=!1,S=()=>{},!w.signal.aborted&&Be)try{z=await qe({jobId:l.jobId,action:"inspect",input:{after:F}})}catch(We){if(!J||!(We instanceof r)||We.code!=="cancelled")throw We}}}catch(le){ve??=le}finally{if(re=!1,x.length=0,clearTimeout(W),e.signal.removeEventListener("abort",I),I(),T&&(!z||!_t(z)))try{z=await Te()}catch{z=void 0}try{if(!z||!_t(z)||z.pty?.cleanup!=="confirmed")ar("pty_cleanup_unconfirmed");let le=Oe(z);if(_.readyState===xn.OPEN)await new Promise((he)=>{let xe=setTimeout(he,500);_.send(JSON.stringify({t:"exit",code:z.exitCode,receipt:le}),()=>{clearTimeout(xe),he()})});await Ve("pty.stopped",le)}catch(le){ve??=le}_.terminate()}if(ve)throw ve;if(e.signal.aborted)ar("cancelled");if(!z)ar("pty_cleanup_unconfirmed");return{receipt:Oe(z)}}import{createHash as yi,randomUUID as An}from"crypto";import{spawnSync as $o}from"child_process";import{closeSync as Wo,constants as Pn,fstatSync as vi,fsyncSync as ki,lstatSync as Lt,mkdirSync as Si,mkdtempSync as Ko,openSync as Fo,readFileSync as Ei,readdirSync as Go,realpathSync as Nt,rmSync as In,unlinkSync as xi}from"fs";import{createConnection as Pi}from"net";import{dirname as Ii,join as tt,sep as Ai}from"path";import{tmpdir as Ti}from"os";var Or=new Map,Vr=new Map;function $r(e,l){return yi("sha256").update(JSON.stringify([e,l])).digest("hex")}function mt(e){try{Si(e,{mode:448})}catch(f){if(!(f instanceof Error&&("code"in f)&&f.code==="EEXIST"))throw f}let l=Lt(e);if(!l.isDirectory()||l.isSymbolicLink()||!A(l)||Nt(e)!==e)throw new r("hands_jobs_unavailable","Hands job state must be a private canonical directory.")}function Ci(e){let l;try{l=Lt(e)}catch(f){if(f instanceof Error&&"code"in f&&f.code==="ENOENT")return!1;throw f}return!l.isDirectory()||l.isSymbolicLink()||Go(e).length>0}function hr(e){let l=$r(e.root,e.runId),f=e.previousRuntimeDirectories?.find((I)=>Ci(tt(I,"jobs",l.slice(0,16))))??e.runtimeDirectory;mt(f);let _=tt(f,"jobs");mt(_);let w=tt(_,l.slice(0,16));if(e.maxScopes!==void 0){let I=Go(_);if(!Number.isSafeInteger(e.maxScopes)||e.maxScopes<1||I.length>e.maxScopes||!I.includes(l.slice(0,16))&&I.length>=e.maxScopes)throw new r("process_journal_capacity","Managed process receipt capacity is full; preserve uncertain jobs and reconcile their existing receipts before starting more work.")}mt(w);let S=Ko(tt(zo(),"reason-j-"));try{return mt(S),{journalDirectory:w,scopeId:l,launchDirectory:S,socketPath:process.platform==="win32"?`\\\\.\\pipe\\reason-jobs-${An()}`:tt(S,"control.sock"),disposeSocket:()=>In(S,{recursive:!0,force:!0})}}catch(I){throw In(S,{recursive:!0,force:!0}),I}}var Hi=60000,Li=5000;function Bi(e){if(process.platform==="win32")return ji(e);let l=$o("ps",["-o","lstart=","-p",String(e)],{encoding:"utf8",timeout:2000,env:{...process.env,LC_ALL:"C",LANG:"C"}}),f=l.status===0?/^\w{3} (\w{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(l.stdout.trim()):null,_=f?"JanFebMarAprMayJunJulAugSepOctNovDec".indexOf(f[1]):-1;if(!f||_<0||_%3!==0)return null;let w=new Date(Number(f[6]),_/3,Number(f[2]),Number(f[3]),Number(f[4]),Number(f[5])).getTime();return Number.isFinite(w)?w:null}function ji(e){let l=$o(C("powershell"),["-NoProfile","-NonInteractive","-Command",`(Get-Process -Id ${e}).StartTime.ToUniversalTime().ToString('o')`],{encoding:"utf8",timeout:5000,windowsHide:!0,env:De()}),f=l.status===0?Date.parse(l.stdout.trim()):Number.NaN;return Number.isFinite(f)?f:null}function Jo(e,l={}){let f=tt(e.journalDirectory,"owner.lock"),_;try{_=Fo(f,Pn.O_RDONLY|Pn.O_NOFOLLOW)}catch{return null}try{let w=vi(_);if(!w.isFile()||w.nlink!==1||!A(w)||w.size>4096)return null;let S=null;try{S=JSON.parse(Ei(_,"utf8"))}catch{}let I;if(S===null){if((l.now??Date.now)()-w.mtimeMs<Hi)return null;I={reason:"never_written",executorLaunchId:null}}else{let{version:M,scopeId:G,pid:F,createdAtMs:T,executorLaunchId:re}=S;if(M!==1||G!==e.scopeId||typeof re!=="string"||typeof F!=="number"||!Number.isSafeInteger(F)||F<1||F===process.pid||typeof T!=="number"||!Number.isSafeInteger(T))return null;if(!(l.exists??((z)=>{try{return process.kill(z,0),!0}catch(fe){return!(fe instanceof Error&&("code"in fe)&&fe.code==="ESRCH")}}))(F))I={reason:"owner_exited",executorLaunchId:re};else{let z=(l.startedAtMs??Bi)(F);if(z===null||z<=T+Li)return null;I={reason:"pid_reused",executorLaunchId:re}}}let W=Lt(f);if(W.dev!==w.dev||W.ino!==w.ino)return null;xi(f);let x=Fo(e.journalDirectory,Pn.O_RDONLY);try{ki(x)}finally{Wo(x)}return I}catch{return null}finally{Wo(_)}}function Vo(e){let l={...e,workspace:e.workspace&&Object.freeze({...e.workspace}),previewAuthority:e.previewAuthority&&Object.freeze({...e.previewAuthority,owner:Object.freeze({...e.previewAuthority.owner}),deniedPorts:new Set(e.previewAuthority.deniedPorts)})},f=$r(l.root,l.runId);if(Or.has(f)||l.operationId!==void 0&&Vr.has(l.operationId))throw new r("hands_jobs_busy","The Session already has a live Hands job supervisor.");let _={binding:l,key:f,terminals:new Map};if(l.previewAuthority&&l.environment)_.previews=Co({authority:l.previewAuthority,runId:l.runId,expiresAtMs:l.expiresAtMs,executorLaunchId:l.executorLaunchId,environment:l.environment,isCurrent:()=>Or.get(_.key)===_,identity:()=>{try{return ht(l)}catch{return null}},inspect:(w,S)=>{if(Or.get(_.key)!==_)throw new r("preview_unavailable","The Hands supervisor is no longer current.");return qo(l,{jobId:w,action:"inspect",input:{after:0}},S)}});if(Or.set(f,_),l.operationId!==void 0)Vr.set(l.operationId,_);return()=>{if(Or.get(_.key)===_)Or.delete(_.key);if(l.operationId!==void 0&&Vr.get(l.operationId)===_)Vr.delete(l.operationId);_.previews?.dispose();for(let w of _.terminals.values())w.abort()}}var Mi=5000,Wi=20;async function Ki(e){let l=(w)=>{throw new r("hands_rebind_unavailable",w)};if(!N(e.operationId)||!N(e.runId)||!N(e.fenceId)||!U(e.targetGeneration))l("Reason sent an invalid Hands rebind.");let f=Vr.get(e.operationId);if(!f||f.binding.root!==e.root)return l("No live Hands supervisor owns this operation.");for(let w=Date.now()+Mi;;){if(e.signal?.aborted)l("The Hands rebind was cancelled.");if(Vr.get(e.operationId)!==f)l("The Hands supervisor is no longer current.");let S=null;try{S=ht(f.binding)}catch{}if(S&&S.generation===e.targetGeneration&&S.fenceId===e.fenceId)break;if(S&&S.generation>e.targetGeneration||Date.now()>=w)l("The executor did not adopt this take.");await new Promise((I)=>setTimeout(I,Wi))}if(Vr.get(e.operationId)!==f||Or.get(f.key)!==f)l("The Hands supervisor is no longer current.");let _=$r(e.root,e.runId);if(f.key===_)return;if(Or.has(_))l("The taking run already has a live Hands job supervisor.");Or.delete(f.key);for(let w of f.terminals.values())w.abort();f.key=_,Or.set(_,f)}function it(e){let l="operationId"in e?Vr.get(e.operationId):Or.get($r(e.root,e.runId)),f=l&&l.binding.root===e.root?l.binding:void 0;if(!f?.environment||f.expiresAtMs<=Date.now())throw new r("environment_unavailable","No live Hands supervisor owns this environment.");return f.environment.install(e.payload)}async function Ji(e){let l=Or.get($r(e.root,e.runId));if(!l?.previews||!e.owner)throw new r("preview_unavailable","No authenticated Hands supervisor owns this preview.");return l.previews.open(e.payload,e.owner,e.signal)}async function Zi(e){let l=Or.get($r(e.root,e.runId));if(!l?.previews||!e.owner||e.signal.aborted)throw new r("preview_unavailable","No authenticated Hands supervisor owns this preview.");return l.previews.close(e.payload,e.owner)}async function Xi(e){let l=$r(e.root,e.runId),f=Or.get(l),_=f?.binding,w=_?.runId,S=_?.previewAuthority,I=_?.environment,W=e.owner&&{...e.owner},x=e.authority&&{...e.authority},M=()=>{throw new r("pty_binding_unavailable","No current authenticated Hands scope owns this terminal.")};if(!f||!_||!S||!I||!W||!x||!_.workspace)return M();let G=Object.freeze({..._.workspace}),F=ht(_),T=I.current(),re=()=>{if(Or.get(l)!==f||W.organization_id!==S.owner.organization_id||W.user_id!==S.owner.user_id||W.device_id!==S.owner.device_id||e.deviceId!==S.owner.device_id||e.rootId!==S.rootId||O(e.workspace)!==O(G))M();let z=ht(_),fe=I.current();if(z.generation!==F.generation||z.fenceId!==F.fenceId||fe.run_id!==w||fe.device_id!==e.deviceId||fe.root_id!==e.rootId||fe.snapshot_id!==T.snapshot_id||fe.revision!==T.revision||fe.binding.target_generation!==F.generation||fe.binding.target_fence_id!==F.fenceId||x.device_id!==e.deviceId||x.binding!==fe.binding.kind||x.target_revision!==fe.binding.target_revision||x.root_grant_revision!==fe.binding.root_grant_revision||x.target_generation!==F.generation||x.target_fence_id!==F.fenceId)M()};if(re(),new URL(e.session.relayUrl).origin!==S.relayOrigin||f.terminals.has(e.session.jobId)||f.terminals.size>=4)return M();let J=new AbortController;f.terminals.set(e.session.jobId,J);try{return await Mo({session:{...e.session,leaseExpiresAtMs:Math.min(e.session.leaseExpiresAtMs,F.expiresAtMs,Date.parse(T.expires_at))},signal:AbortSignal.any([e.signal,J.signal]),emit:e.emit,binding:{assertCurrent:re,environment:{revision:T.revision,snapshotId:T.snapshot_id},scope:{runId:e.runId,deviceId:e.deviceId,rootId:e.rootId,workspace:G,binding:T.binding.kind,targetRevision:T.binding.target_revision,rootGrantRevision:T.binding.root_grant_revision,generation:F.generation,fenceId:F.fenceId,executorLaunchId:F.executorLaunchId},request:(z,fe)=>fr(F,Hr(JSON.stringify({...z,type:"job",version:2,generation:F.generation,id:An()})),fe)}})}finally{if(f.terminals.get(e.session.jobId)===J)f.terminals.delete(e.session.jobId)}}async function Yi(e){if(ce(e.payload.jobId))throw new r("pty_binding_required","PTY jobs require the bound terminal capability.");let l=Or.get($r(e.root,e.runId))?.binding;if(!l||l.expiresAtMs<=Date.now())throw new r("hands_jobs_unavailable","No live Hands supervisor owns this Session and root.");return qo(l,e.payload,e.signal)}var Fi=1e4,Ui=20,zi=Se/2,$i=Je/2,Vi=(e)=>e.output.reduce((l,f)=>l+f.text.length,0);async function qo(e,l,f){if(Object.keys(l).some((M)=>!["jobId","action","input","waitForExitMs"].includes(M)))throw new r("invalid_payload","Unexpected job control field.");let{waitForExitMs:_,...w}=l;if(_!==void 0&&(w.action!=="start"||typeof w.input!=="object"||w.input===null||!("script"in w.input)||typeof _!=="number"||!Number.isSafeInteger(_)||_<1||_>Fi))throw new r("invalid_payload","Only a script start may wait for its job, within its bound.");let S=(M)=>{let G=ht(e);return fr(G,Hr(JSON.stringify({...M,type:"job",version:2,generation:G.generation,id:An()})),f)},I=await S(w);if(_===void 0)return I;let W=Date.now()+_,x=I;while(x.ok&&["starting","running"].includes(x.job.state)&&x.job.output.length<zi&&Vi(x.job)<$i&&!f.aborted&&Date.now()<W){if(await new Promise((M)=>setTimeout(M,Math.min(Ui,W-Date.now()))),f.aborted)break;try{let M=await S({jobId:w.jobId,action:"inspect",input:{after:0}});if(!M.ok)break;x=M}catch{break}}return x}function ht(e){if(e.expiresAtMs<=Date.now())throw new r("hands_jobs_unavailable","Hands authority expired.");let l=e.readIdentity?e.readIdentity():e;if(!l||!U(l.generation)||!N(l.fenceId)||l.generation<e.generation||l.generation===e.generation&&l.fenceId!==e.fenceId)throw new r("hands_jobs_unavailable","The live Hands fencing identity could not be verified.");return e.generation=l.generation,e.fenceId=l.fenceId,{...e}}function fr(e,l,f){if(f.aborted)return Promise.reject(new r("cancelled","Job control was cancelled."));return new Promise((_,w)=>{let S=Pi(e.socketPath),I="",W=!1,x,M=(F,T)=>{if(W)return;if(W=!0,clearTimeout(x),f.removeEventListener("abort",G),S.destroy(),F)w(F);else _(T)},G=()=>M(new r("cancelled","Job control waiter cancelled; inspect before retrying mutations."));f.addEventListener("abort",G,{once:!0}),S.setEncoding("utf8"),x=setTimeout(()=>M(new r("hands_job_result_unknown","Job control timed out; inspect before retrying mutations.")),Math.min(1e4,Math.max(1,e.expiresAtMs-Date.now()))),S.on("error",()=>M(new r("hands_job_result_unknown","Hands job control connection failed."))),S.once("connect",()=>S.write(JSON.stringify({version:1,scopeId:e.scopeId,fenceId:e.fenceId,executorLaunchId:e.executorLaunchId,request:l})+`
 `)),S.on("data",(F)=>{if(I+=F,Buffer.byteLength(I)>Ze)M(new r("hands_job_result_unknown","Hands job result exceeded its bound."))}),S.once("end",()=>{if(Date.now()>=e.expiresAtMs){M(new r("hands_job_result_unknown","Hands authority expired before the result was acknowledged."));return}try{let F=zr(I.trim());if(F.id!==l.id||F.generation!==e.generation||F.ok&&F.job.jobId!==l.jobId)throw Error("identity");M(void 0,F)}catch{M(new r("hands_job_result_unknown","Hands job response identity or shape was invalid."))}}),S.once("close",()=>{if(!W)M(new r("hands_job_result_unknown","Hands job control closed before an acknowledged result."))})})}function Uo(e){let l=Nt(e.root),f=e.authority,_=Date.parse(e.leaseUntil),w=()=>{if(e.signal.throwIfAborted(),!Number.isFinite(_)||_<=Date.now())throw Error("local_device_gh_lease_expired")};if(w(),f.readOnly&&f.generation===null)return{root:l,readOnly:!0,signal:e.signal,deadlineMs:_,assertCurrent:w};let S=$r(l,e.runId),I=Or.get(S),W=I?.binding;if(!W?.environment||!W.workspace||W.localGithubConfinement!==!0)throw Error("local_device_gh_confinement_unavailable");let x=W.environment.current(),M=()=>{w();let F=W.environment.current(),T=ht(W);if(Or.get(S)!==I||F.github_auth!=="local_gh"||F.run_id!==W.runId||f.runId!==e.runId||F.device_id!==f.deviceId||F.root_id!==f.rootId||String(F.binding.root_grant_revision)!==f.rootRevision||F.binding.target_generation!==f.generation||F.binding.target_fence_id!==f.fenceId||T.generation!==f.generation||T.fenceId!==f.fenceId||F.snapshot_id!==x.snapshot_id||F.revision!==x.revision)throw Error("local_device_gh_authority_changed")};M();let G=ie(l,W.workspace);return{root:G.boundary,signal:e.signal,deadlineMs:_,privateDirectory:Ii(W.environment.path),repoPath:G.path,readOnly:f.readOnly,forbiddenSecretValues:Object.values(x.variables),secretNames:(F)=>Object.entries(x.variables).filter(([,T])=>T.trim()===F.trim()).map(([T])=>`variable ${T}`),assertCurrent:M}}async function Qi(e,l){let f=Pe.parse(e.request),_=oe.parse(e.authority);if(_.contributorRefresh&&f.kind==="read"&&_.readOnly)return l(Uo(e));let w=Boolean(_.contributorRefresh);if(w&&(_.merge||f.kind!=="pr_mutation"||f.mutation.action!=="edit"||typeof f.mutation.body!=="string"||f.mutation.title!==void 0||f.mutation.base!==void 0||_.readOnly||_.runId!==e.runId||_.repoFullName!==f.repoFullName))throw Error("local_device_gh_contributor_refresh_authority_invalid");if(f.kind!=="pr_merge"&&!w){if(_.merge)throw Error("local_device_gh_merge_authority_invalid");return l(Uo(e))}if(!w&&(!_.merge||_.readOnly||_.runId!==e.runId||_.repoFullName!==f.repoFullName||_.merge.source==="agent"&&(_.generation===null||_.fenceId===null)))throw Error("local_device_gh_merge_authority_invalid");let S=Nt(e.root),I=Lt(S),W=Date.parse(e.leaseUntil);if(!Number.isFinite(W)||W<=Date.now())throw Error("local_device_gh_lease_expired");let x=Nt(Ti());if(x===S||x.startsWith(S+Ai))throw Error("local_device_gh_private_scope_unavailable");let M=Ko(tt(x,"reason-gh-merge-"));try{mt(M);let G=()=>{if(e.signal.throwIfAborted(),Date.now()>=W)throw Error("local_device_gh_lease_expired");let F=Lt(e.root);if(F.isSymbolicLink()||F.dev!==I.dev||F.ino!==I.ino||Nt(e.root)!==S)throw Error("local_device_gh_authority_changed");mt(M)};return G(),await l({root:S,readOnly:!1,privateDirectory:M,forbiddenSecretValues:[],signal:e.signal,deadlineMs:W,assertCurrent:G})}finally{In(M,{recursive:!0,force:!0})}}var Zo=43200000;function gt(e){return Number.isSafeInteger(e)&&Math.abs(e)<=8640000000000000?e:null}function Yo(e){return e!==null&&typeof e==="object"&&!Array.isArray(e)}function Xo(e,l){return Object.keys(e).length===l.length&&l.every((f)=>Object.hasOwn(e,f))}function eo(e){if(!Yo(e)||!Xo(e,["version","outcome","clock_source","validation_now_ms","expiry_ms","remaining_ms","maximum_lifetime_ms","cli_artifact"])||e.version!==1||e.maximum_lifetime_ms!==43200000||typeof e.outcome!=="string"||!["accepted","parse","noncanonical","expired","over_cap"].includes(e.outcome)||typeof e.clock_source!=="string"||!["date_now","injected"].includes(e.clock_source))return null;for(let _ of["validation_now_ms","expiry_ms"]){let w=e[_];if(w!==null&&(typeof w!=="number"||gt(w)===null))return null}if(e.remaining_ms!==null&&(typeof e.remaining_ms!=="number"||!Number.isSafeInteger(e.remaining_ms)))return null;let l=typeof e.expiry_ms==="number"&&typeof e.validation_now_ms==="number"?e.expiry_ms-e.validation_now_ms:null;if(e.remaining_ms!==(l!==null&&Number.isSafeInteger(l)?l:null))return null;if(e.outcome==="parse"&&e.expiry_ms!==null)return null;if(e.outcome!=="parse"&&e.expiry_ms===null)return null;if(e.outcome==="expired"&&!(typeof l==="number"&&l<=0))return null;if(e.outcome==="over_cap"&&!(typeof l==="number"&&l>43200000))return null;if(e.outcome==="accepted"&&!(typeof l==="number"&&l>0&&l<=43200000))return null;let f=e.cli_artifact;if(!Yo(f)||!Xo(f,["kind","status","sha256","observed_at_ms"])||f.observed_at_ms!==null&&(typeof f.observed_at_ms!=="number"||gt(f.observed_at_ms)===null))return null;if(f.kind==="entrypoint_file"){if(f.status!=="observed"||typeof f.sha256!=="string"||!/^[a-f0-9]{64}$/.test(f.sha256)||f.observed_at_ms===null)return null}else if(f.kind!=="unavailable"||f.sha256!==null||typeof f.status!=="string"||!["unsupported_entrypoint","read_failed","file_changed","size_limit","time_limit"].includes(f.status))return null;return e}var Tn=c({kind:s(["workspace_source","mcp_control"]),target_revision:o().int().nonnegative(),root_grant_revision:o().int().positive()}),Qo=new RegExp(st.tokenPattern),qi=c({token_url:Et().max(2048),request_token:t().min(1).max(8192).regex(Qo),aws_credentials_url:Et().max(2048).nullable()});function es(e,l){let f=(_,w)=>{try{let S=new URL(_);return S.origin===new URL(l).origin&&S.pathname===w&&!S.username&&!S.password&&!S.search&&!S.hash}catch{return!1}};if(!Qo.test(e.request_token)||!f(e.token_url,st.tokenPath)||e.aws_credentials_url!==null&&!f(e.aws_credentials_url,st.awsPath))return null;return{REASON_OIDC_TOKEN_URL:e.token_url,REASON_OIDC_REQUEST_TOKEN:e.request_token,...e.aws_credentials_url!==null?{AWS_CONTAINER_CREDENTIALS_FULL_URI:e.aws_credentials_url,AWS_CONTAINER_AUTHORIZATION_TOKEN:e.request_token}:{}}}function rs(e){return new TextEncoder().encode(e).byteLength}function ea(e){return rs(JSON.stringify(e)+`
 `)}var mr=c({version:n(1),snapshot_id:k(),revision:o().int().positive(),run_id:t().min(1).max(160),device_id:k(),root_id:k(),binding:Tn.extend({target_generation:o().int().positive(),target_fence_id:k()}),expires_at:y.datetime({offset:!0}),variables:ee(t().max(128).regex(It),t().refine((e)=>!e.includes("\x00")&&rs(e)<=V.valueBytes)).refine((e)=>Object.keys(e).length<=V.variables),github_auth:n("local_gh").optional(),git:c({base_url:Et().max(2048),token:t().min(1).max(4096).regex(/^[A-Za-z0-9._~-]+$/),expires_at:y.datetime({offset:!0})}).nullable(),cloud_access:qi.optional()}).refine((e)=>e.github_auth!=="local_gh"||e.git===null,"conflicting git authority").refine((e)=>ea(e)<=V.snapshotBytes,"snapshot too large");import{spawn as ra}from"child_process";import{basename as ta,isAbsolute as Eu}from"path";var na=0,ts=120000,ns=15000,oa=65536;function Dn(e=process.execPath,l=process.argv[1]){let f=ta(e),_=(f.startsWith("bun")||f.startsWith("node"))&&typeof l==="string"&&l.length>0;return{command:e,prefix:_?[l]:[]}}function to(e={}){let{command:l,prefix:f}=Dn(e.executablePath,e.sourceEntrypoint),_=e.spawnProcess??ra,w=e.now??Date.now,S=null,I=0,W=!1,x=(G)=>{try{G.kill("SIGKILL")}catch{}},M=()=>{if(W)return;if(S&&w()-I<ts-ns)return;if(S){let F=S;S=null,x(F)}let G;try{G=_(l,[...f,"__device","__hands-worker","--handoff-fd",String(na)],{cwd:"/",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin"},shell:!1,stdio:["pipe","ignore","pipe"]})}catch{return}S=G,I=w(),G.on("error",()=>{if(S===G)S=null}),G.once("exit",(F,T)=>{if(S!==G)return;S=null,e.log?.("hands.worker_prespawn_exited",{exit_code:F,exit_signal:T})}),e.log?.("hands.worker_prespawned",{pid:G.pid??null})};return{arm:M,take(G){let F=S;if(!F||W)return null;let T=G.args.at(-1),re=G.options.env,J=G.options.cwd,z=[...f,"__device","__hands-worker","--config"];if(G.command!==l||G.args.length!==z.length+1||z.some((Oe,$e)=>G.args[$e]!==Oe)||typeof T!=="string"||!re||typeof J!=="string"||G.options.shell||JSON.stringify(G.options.stdio)!==JSON.stringify(["ignore","ignore","pipe"]))return null;S=null;let fe=F.stdin,ve={configPath:T,cwd:J,env:Object.fromEntries(Object.entries(re).filter((Oe)=>typeof Oe[1]==="string"))},be=JSON.stringify(ve);if(F.exitCode!==null||F.signalCode!==null||!fe||fe.destroyed||w()-I>=ts-ns||Buffer.byteLength(be,"utf8")>oa)return x(F),null;return fe.on("error",()=>{return}),fe.end(be),F.once("exit",()=>{M()}),e.log?.("hands.worker_prespawn_taken",{pid:F.pid??null}),F},adopt(G){G.once("exit",()=>{M()})},close(){if(W=!0,S)x(S);S=null}}}import{accessSync as la,constants as ua,statSync as fa}from"fs";import{homedir as pa,tmpdir as _a,userInfo as ma}from"os";import{delimiter as ha,win32 as ga}from"path";var sa=new Set(["ALL_PROXY","BUN_BE_BUN","BUN_OPTIONS","CURL_CA_BUNDLE","GIT_SSL_CAINFO","GRPC_DEFAULT_SSL_ROOTS_FILE_PATH","HTTPS_PROXY","HTTP_PROXY","NO_PROXY","NODE_EXTRA_CA_CERTS","NODE_OPTIONS","NODE_TLS_REJECT_UNAUTHORIZED","REQUESTS_CA_BUNDLE","SSLKEYLOGFILE","SSL_CERT_DIR","SSL_CERT_FILE","all_proxy","http_proxy","https_proxy","no_proxy"]);var ia=["BUN_CONFIG_","BUN_INSPECT","DYLD_","NODE_DEBUG"],aa=new Set(["BUN_INSTALL"]);var ca=/^--(?:max-old-space-size|max-semi-space-size|stack-size)=\d{1,9}$/;function da(e){return(e??"").split(/\s+/).filter(Boolean).every((l)=>ca.test(l.replaceAll("_","-")))}function os(e){return Object.keys(e).filter((l)=>sa.has(l)&&!(l==="NODE_OPTIONS"&&da(e[l]))||ia.some((f)=>l.startsWith(f))||l.startsWith("BUN_")&&!aa.has(l)).sort()}var ba=new Set(["HOME","PATH","PWD","OLDPWD","SHLVL","_","TMPDIR","TMP","TEMP","SHELL","BASH_ENV","ENV","ZDOTDIR","PROMPT_COMMAND","IFS","CDPATH","GLOBIGNORE","SHELLOPTS","BASHOPTS","NODE_PATH"]),wa=/^(?:ARA_|REASON_|PI_|GIT_|GH_|GITHUB_|LD_|DYLD_|BUN_|BASH_FUNC_|SSH_)/,ya=/TOKEN|SECRET|PASSW|PASSPHRASE|CREDENTIAL|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|AUTH/i,va=/^[A-Za-z_][A-Za-z0-9_]*$/;function gr(e=process.env){let l=(w)=>{if(!(process.platform==="win32"?ga.isAbsolute(w):w.startsWith("/"))||/[\0\r\n]/.test(w)||w.length>32768)throw Error("invalid_host_execution_environment");return w};if(e.PATH!==void 0&&(/[\0\r\n]/.test(e.PATH)||e.PATH.length>32768))throw Error("invalid_host_execution_environment");let f=new Set(os(e)),_=Object.fromEntries(Object.entries(e).filter((w)=>{let[S,I]=w;return typeof I==="string"&&I.length<=32768&&!I.includes("\x00")&&S.length<=128&&va.test(S)&&!f.has(S)&&!ba.has(S)&&!wa.test(S)&&!ya.test(S)}).sort(([w],[S])=>w.localeCompare(S)).slice(0,512));return{home:l(e.HOME||(process.platform==="win32"?e.USERPROFILE:void 0)||pa()),path:((w)=>process.platform==="win32"?Sn(w):w)(xr(e.PATH??"").join(ha)||Er),temporaryDirectory:l(e.TMPDIR||e.TMP||e.TEMP||_a()),variables:_}}function _r(e=process.env,l=()=>ma().shell){if(process.platform==="win32")return se();let f=(w)=>{if(!w||!/^\/[A-Za-z0-9._/-]*\/(?:bash|zsh)$/.test(w))return!1;try{return la(w,ua.X_OK),fa(w).isFile()}catch{return!1}};if(f(e.SHELL))return e.SHELL;let _;try{_=l()}catch{_=void 0}return f(_)?_:"/bin/zsh"}import{readdir as ka}from"fs/promises";var Sa=15000;function gn(e){let l=e instanceof Error&&"code"in e?e.code:null;return l==="EPERM"||l==="EACCES"}function _n(e){return new r("folder_access_denied",`macOS blocked Reason from opening ${e}. Allow Reason in System Settings \u203A Privacy & Security \u203A Files and Folders `+"(or Full Disk Access), then try again.")}async function ss(e,{timeoutMs:l=Sa,open:f=(_)=>ka(_)}={}){let _,w=new Promise((S)=>{_=setTimeout(()=>S("pending"),l)});try{if(await Promise.race([f(e).then(()=>"open"),w])==="pending")throw new r("folder_access_pending",`macOS is asking whether Reason may open ${e}. Answer the prompt on this Mac, then try again.`)}catch(S){if(gn(S))throw _n(e);if(S instanceof r)throw S}finally{clearTimeout(_)}}import{chmodSync as rc,closeSync as tc,constants as Un,fstatSync as nc,lstatSync as Es,openSync as oc,readSync as sc,realpathSync as zn,unlinkSync as ic}from"fs";import{lookup as ac}from"dns/promises";import{createRequire as cc}from"module";import{request as dc}from"http";import{request as lc}from"https";import ct from"net";import{platform as Is}from"os";import{basename as uc,extname as fc,isAbsolute as Rs,relative as $n,resolve as yt,sep as Kn}from"path";var is=String.raw`
 async (roots) => {
@@ -447,6 +447,6 @@ lines.on("line", (line) => {
 `);dd(f,w,{mode:384});let S=!1;return{command:"/usr/bin/sandbox-exec",args:["-f",f,e.nodeExecutable,...e.nodeArgs],cwd:e.workRoot,env:{...e.environment,TMPDIR:l},async cleanup(){if(S)return;S=!0,ad(l,{recursive:!0,force:!0})}}}async function gd(e){let l=id(e.workRoot),f=e.nodeExecutable??md(),_=["--max-old-space-size=512","--permission",`--allow-fs-read=${l}`,`--allow-fs-write=${l}`,"-e",_d],w=He({home:l,temporaryDirectory:l}),S=e.platformName??ud();if(S==="linux")return{command:f,args:_,cwd:l,env:w,async cleanup(){}};if(S==="darwin")return hd({nodeExecutable:f,nodeArgs:_,workRoot:l,environment:w});throw Error("hands_node_repl_platform_unsupported")}async function Mt(e){let l;try{await Promise.race([e,new Promise((f,_)=>{l=setTimeout(()=>_(Error("hands_node_repl_child_cleanup_timeout")),pd)})])}finally{clearTimeout(l)}}async function Zs(e){if(e.executionMode!=="single-evaluation")throw Error(Ls);let l=await gd(e),f;try{f=nd(l.command,l.args,{cwd:l.cwd,env:l.env,stdio:["pipe","pipe","pipe"]})}catch(be){throw await l.cleanup(),be}let _=new Promise((be)=>f.once("close",()=>be())),w;f.once("error",(be)=>{w=be});let S=!1,I=!1,W="";f.stderr.setEncoding("utf8"),f.stderr.on("data",(be)=>{W=`${W}${be}`.slice(-16384)});let x=f.stdout,M,G=(be,Oe,$e)=>{if($e)be.failure??=$e;if(be.finishing)return;be.finishing=!0,I=!0,f.kill("SIGKILL"),Mt(_).then(()=>{if(be.failure)be.reject(be.failure);else be.resolve(Oe??{})},(qe)=>be.reject(qe))},F=()=>{if(I=!0,M)G(M,void 0,Error("hands_node_repl_state_lost"));else f.kill("SIGKILL")},T="";x?.setEncoding("utf8"),x?.on("data",(be)=>{if(M?.finishing||I)return;if(T+=be,T.length>Xs){F();return}while(!0){let Oe=T.indexOf(`
 `);if(Oe===-1)return;let $e=T.slice(0,Oe);T=T.slice(Oe+1);let qe=M;if(!qe){F();return}try{let ye=JSON.parse($e);if(qe.action==="probe")qe.resolve(ye);else{G(qe,ye);return}}catch{G(qe,void 0,Error("invalid_hands_node_repl_child_response"));return}}});let re=(be)=>{let Oe=W.trim(),$e=be??Error(Oe?`hands_node_repl_child_exited:${Oe}`:"hands_node_repl_child_exited");if(I=!0,M&&!M.finishing)G(M,void 0,$e)};f.once("error",re),f.once("close",()=>re()),f.stdin.on("error",re);let J=(be)=>new Promise((Oe,$e)=>{if(S||I||f.exitCode!==null||f.signalCode!==null){$e(Error(I?"hands_node_repl_state_lost":"hands_node_repl_stopped"));return}let qe=setTimeout(F,be.action==="probe"?1e4:Math.max(1,Math.min(e.evaluationTimeoutMs??oo-1000,oo-1000))),ye={action:be.action,finishing:!1,resolve(Fe){if(M===ye)M=void 0;clearTimeout(qe),Oe(Fe)},reject(Fe){if(M===ye)M=void 0;clearTimeout(qe),$e(Fe)}};M=ye,f.stdin.write(`${JSON.stringify(be)}
 `,(Fe)=>{if(!Fe)return;G(ye,void 0,Fe)})});try{if(!x){if(f.pid===void 0)await Mt(_);throw w??Error("hands_node_repl_control_pipe_missing")}let be=await J({action:"probe"});if(be.ok!==!0||be.output!=="ARA_HANDS_REPL_READY")throw Error("hands_node_repl_probe_failed")}catch(be){S=!0,f.kill("SIGKILL");try{await Mt(_)}finally{await l.cleanup()}throw be}let z=Promise.resolve(),fe=new Set;Zn(e.socketPath);let ve=ld.createServer((be)=>{fe.add(be),be.once("close",()=>fe.delete(be)),be.setEncoding("utf8");let Oe="",$e=!1,qe=!1;be.once("close",()=>{if(qe)F()}),be.on("error",()=>be.destroy()),be.on("data",(ye)=>{if($e)return;if(Oe+=ye,Oe.length>Xs){$e=!0,sn(be,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let Fe=Oe.indexOf(`
-`);if(Fe===-1)return;$e=!0;let Ve=Oe.slice(0,Fe);z=z.then(async()=>{if(be.destroyed)return;try{let Te=JSON.parse(Ve);if(Te.action!=="evaluate"||typeof Te.code!=="string")throw Error("Invalid REPL request");qe=!0;let le=await J({action:"evaluate",code:Te.code});if(qe=!1,le.ok!==!0||typeof le.output!=="string")throw Error(typeof le.error==="string"?le.error:"hands_node_repl_failed");sn(be,{ok:!0,output:le.output})}catch(Te){qe=!1,sn(be,{ok:!1,error:Te instanceof Error?Te.message:String(Te),stack:Te instanceof Error?Te.stack:void 0})}}).catch((Te)=>{sn(be,{ok:!1,error:Te instanceof Error?Te.message:String(Te)})})})});try{await new Promise((be,Oe)=>{ve.once("error",Oe),ve.listen(e.socketPath,()=>{ve.off("error",Oe);try{od(e.socketPath,384),be()}catch($e){ve.close(()=>Oe($e))}})})}catch(be){S=!0,f.kill("SIGKILL");try{await Mt(_)}finally{await l.cleanup(),Zn(e.socketPath)}throw be}return{socketPath:e.socketPath,async stop(){if(S)return;S=!0;let be=new Promise((Oe)=>ve.close(()=>Oe()));for(let Oe of fe)Oe.destroy();await be,z.catch(()=>{return}),F();try{await Mt(_)}finally{await l.cleanup(),Zn(e.socketPath)}}}}var so=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var Qs="/workspace",ri="/var/lib/reason/sessions",bd="/var/lib/reason/session-controls";function wr(e){let l=`${ri}/`;if(!e.startsWith(l))return null;let f=e.slice(l.length);if(!so.test(f)||f!==f.toLowerCase())throw Error("personal_computer_invalid_runtime_root");return`${bd}/${f}/job.env`}function wd(e){if(!so.test(e))throw Error("personal_computer_invalid_identity");return e.toLowerCase()}function an(e){let l=wd(e);return{runtimeRoot:`${ri}/${l}`,workspaceRoot:`${Qs}/sessions/${l}`,sharedRoot:Qs}}var ti="/root/.ara/cloud-browser/repl.sock";function co(e){return e==="compute"}function ni(e,l,f="linux"){if(e)an(e);if(f!=="linux")throw Error("cloud_browser_os_invalid");if(l!==void 0&&(!e||!/^[1-9][0-9]{0,18}$/.test(l)))throw Error("cloud_browser_generation_invalid");let _=e?`/var/lib/reason/browsers/${e.toLowerCase()}`:"/root/.ara/cloud-browser",w=e?`${_}/${l?`g${l}`:"current"}`:_,S=e?`/root/.b/${e.toLowerCase().replaceAll("-","")}`:_;return{temporarySessionDirectory:S,temporaryDirectory:e?`${S}/${l??"current"}`:`${w}/tmp`,directory:w,sessionDirectory:_,config:`${w}/config.json`,status:`${w}/status.json`,socket:`${w}/repl.sock`,bundle:`${w}/driver.mjs`,processName:e?`ara-browser-${e.toLowerCase()}${l?`-${l}`:""}`:"ara-cloud-browser"}}var lo="browser_egress",oi=Zo,Hd=45000,Nd=Xt+1500,Xr=/^[A-Za-z0-9._:-]{1,160}$/,Ld="/run/ara-hands";function Bd(e,l,f=ii()){if(e==="darwin")return{temporaryRoot:f,prepareRoot:!1,sessionMode:448};return{temporaryRoot:l??Ld,prepareRoot:!0,sessionMode:457}}function me(e,l=process.platform,f=process.geteuid?.()){return e===!0&&l==="linux"&&f===0}function ge(e=K(),l=process.platform,f=process.geteuid?.()){return e&&l==="linux"&&f===0?{uid:e.uid,gid:e.gid,home:e.home,username:e.username}:null}function Rt(e=ge(),l=Cs){return e&&l()?Gn:null}function jd(e,l){if(!l&&(e??"linux")==="linux")return ti;return ni(l,void 0,e??"linux").socket}function Pt(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function ci(e){let l=e.toLowerCase().replace(/^\[|\]$/g,"");return l==="localhost"||l.endsWith(".localhost")||l==="::1"||l==="0:0:0:0:0:0:0:1"||l==="0.0.0.0"||l.startsWith("127.")}class br extends r{expiryDiagnostic;constructor(e){super("invalid_hands_expiry","Reason Hands connection expiry is invalid.");this.expiryDiagnostic=e}}function Md(e){return Pt(e)&&Object.keys(e).every((l)=>l==="source_path"||l==="branch")&&(e.source_path===void 0||X(e.source_path))&&typeof e.branch==="string"&&Jn.test(e.branch)}function Wd(e,l,f){let _=l===void 0?Date.now():l,w=["relay_url","session_id","environment_id","expires_at","policy_mode","policy_version","hands_protocol_version","hands_worker_version","hands_worker_artifact_sha256","hands_worker_entrypoint","target_generation","target_fence_id"],S=new Set([...w,"workspace_id","legacy_workspace_id",Ce,Ae,"environment_binding","cloud_browser","sandbox_provider","sandbox_os","personal_workspace","workspace_path","workspace_worktree",Ye,lo,St,Q,Y,q]),I=Pt(e)?e:null,W=I?.[lo],x=I?.[St],M=I?.[Y],G=W===void 0||(I?.[Ye]===Yr||M===pe&&I?.[Ye]===void 0)&&Pt(W)&&Object.keys(W).every((ve)=>ve==="mode"||ve==="allowed_domains")&&W.mode==="enforce"&&Array.isArray(W.allowed_domains)&&W.allowed_domains.length<=256&&W.allowed_domains.every((ve)=>typeof ve==="string"&&Nn(ve));if(!Pt(e)||w.some((ve)=>!(ve in e))||Object.keys(e).some((ve)=>!S.has(ve))||!G||M!==void 0&&M!==pe||I?.[q]!==void 0&&I[q]!==Re||I?.personal_workspace!==void 0&&(I.personal_workspace!==!0||I[Ye]!==Yr)||I?.cloud_browser!==void 0&&(I.cloud_browser!==!0||I[Ye]!==Yr)||I?.sandbox_provider!==void 0&&!co(I.sandbox_provider)||I?.sandbox_os!==void 0&&I.sandbox_os!=="linux"||x!==void 0&&(I?.[Ye]!==kt||!js(x))||Ye in e&&e[Ye]!==Yr&&e[Ye]!==kt&&e[Ye]!==jr||e.workspace_path!==void 0&&(!X(e.workspace_path)||e[Ye]!==jr)||e.workspace_worktree!==void 0&&(e.workspace_path===void 0||!Md(e.workspace_worktree))||typeof e.relay_url!=="string"||typeof e.session_id!=="string"||!Xr.test(e.session_id)||e.workspace_id!==void 0&&(typeof e.workspace_id!=="string"||!Xr.test(e.workspace_id))||e.legacy_workspace_id!==void 0&&(typeof e.legacy_workspace_id!=="string"||!Xr.test(e.legacy_workspace_id))||e[Ce]!==void 0&&(e[Ce]!==ue||(Ye in e))||e[Ae]!==void 0&&(e[Ae]!==Z||(Ye in e))||e[Q]!==void 0&&(typeof e[Q]!=="string"||!Xr.test(e[Q]))||typeof e.environment_id!=="string"||!Xr.test(e.environment_id)||typeof e.expires_at!=="string"||e.policy_mode!=="full_access"||e.policy_version!==1||e.hands_protocol_version!==P||e.hands_worker_version!==D||e.hands_worker_artifact_sha256!==b||!Ks(e.hands_worker_entrypoint)||!U(e.target_generation)||!N(e.target_fence_id))throw new r("invalid_hands_payload","Reason Hands connection payload is invalid.");let F;try{F=new URL(e.relay_url)}catch{throw new r("invalid_hands_relay","Reason Hands relay URL is invalid.")}if((ci(F.hostname)?F.protocol!=="ws:":F.protocol!=="wss:")||F.username||F.password||F.hash||!/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(F.pathname))throw new r("invalid_hands_relay","Reason Hands relay URL is not allowed.");let re=Date.parse(e.expires_at),J=Number.isNaN(re)?"parse":new Date(re).toISOString()!==e.expires_at?"noncanonical":re<=_?"expired":re-_>oi?"over_cap":"accepted",z={version:1,outcome:J,clock_source:l===void 0?"date_now":"injected",validation_now_ms:gt(_),expiry_ms:gt(re),remaining_ms:Number.isSafeInteger(re-_)?re-_:null,maximum_lifetime_ms:oi,cli_artifact:Gs()};if(J!=="accepted")throw new br(z);try{f?.(z)}catch{}let fe=e.environment_binding===void 0?void 0:Tn.safeParse(e.environment_binding);if(fe&&!fe.success)throw new r("invalid_hands_request","Reason Hands environment binding is invalid.");return{...e.cloud_browser===!0?{cloud_browser:!0}:{},...co(e.sandbox_provider)?{sandbox_provider:e.sandbox_provider}:{},...e.sandbox_os==="linux"?{sandbox_os:e.sandbox_os}:{},...e.personal_workspace===!0?{personal_workspace:!0}:{},relay_url:F.toString(),...fe?.success?{environment_binding:fe.data}:{},session_id:e.session_id,...e.workspace_id===void 0?{}:{workspace_id:e.workspace_id},...e.legacy_workspace_id===void 0?{}:{legacy_workspace_id:e.legacy_workspace_id},...e[Ce]===ue?{[Ce]:ue}:{},...e[Ae]===Z?{[Ae]:Z}:{},...typeof e[Q]==="string"?{[Q]:e[Q]}:{},...e[Y]===pe?{[Y]:pe}:{},...e[q]===Re?{[q]:Re}:{},...typeof e.workspace_path==="string"?{workspace_path:e.workspace_path}:{},...Pt(e.workspace_worktree)?{workspace_worktree:{...typeof e.workspace_worktree.source_path==="string"?{source_path:e.workspace_worktree.source_path}:{},branch:String(e.workspace_worktree.branch)}}:{},environment_id:e.environment_id,expires_at:e.expires_at,policy_mode:"full_access",policy_version:1,hands_protocol_version:P,hands_worker_version:D,hands_worker_artifact_sha256:b,hands_worker_entrypoint:R,target_generation:e.target_generation,target_fence_id:e.target_fence_id,...Ye in e?{[Ye]:e[Ye]}:{},...x===void 0?{}:{[St]:x},...W===void 0?{}:{[lo]:{mode:"enforce",allowed_domains:[...new Set(W.allowed_domains)].sort()}}}}function Fd(){let e=new Map;return{acquire(l,f){if(e.has(l))return null;let _=[...e.values()],w=(I)=>f.group!==void 0&&I.group===f.group;if(f.exclusive?!_.every(w):_.some((I)=>I.exclusive))return null;if(f.limit!==void 0&&!_.some(w)&&new Set(_.map((I,W)=>I.group??W)).size>=f.limit)return null;e.set(l,f);let S=!1;return()=>{if(S)return;S=!0,e.delete(l)}},activeOwners:()=>[...e.keys()]}}var Ud=Fd();function zd(e,l){Tt(e,{recursive:!0,mode:448});let f=tr(e),_=()=>new r("invalid_hands_workspace","Reason Hands managed workspace ancestor must be a real directory, not a link.");for(let I of l.split("/")){let W=cr(f,I);try{let M=dr(W);if(M.isSymbolicLink()||!M.isDirectory())throw _()}catch(M){if(!(M&&typeof M==="object"&&("code"in M)&&M.code==="ENOENT"))throw M;try{Tt(W,{mode:448})}catch(G){if(!(G&&typeof G==="object"&&("code"in G)&&G.code==="EEXIST"))throw G}}let x=dr(W);if(x.isSymbolicLink()||!x.isDirectory()||tr(W)!==W)throw _();f=W}if(process.platform==="win32"){let I=dr(f);if(I.isSymbolicLink()||!I.isDirectory()||tr(f)!==f||!Ur(tr(e),f))throw _();return f}let w=dr(f),S=xd(f,At.O_RDONLY|At.O_DIRECTORY|At.O_NOFOLLOW);try{let I=Od(S);if(!I.isDirectory()||I.dev!==w.dev||I.ino!==w.ino||tr(f)!==f)throw _();Rd(S,448)}finally{Ed(S)}return f}function $d(e,l=Lo(),f,_,w){if(!Xr.test(e)||f!==void 0&&!Xr.test(f))throw new r("invalid_hands_workspace","Reason Hands run identity is invalid.");let S=Tr(O({kind:"managed",workspaceId:e,..._?{base:_}:{},...w?{layout:w}:{}})),I=zd(l,Tr(S)),W=cr(I,Dd(S)),x=!1;try{let T=dr(W);if(x=!0,T.isSymbolicLink())throw new r("invalid_hands_workspace","Reason Hands workspace cannot be a symbolic link.");if(!T.isDirectory())throw new r("invalid_hands_workspace","Reason Hands workspace must be a managed directory.")}catch(T){if(T instanceof r||!(T&&typeof T==="object"&&("code"in T)&&T.code==="ENOENT"))throw T}if(w&&!x)try{let T=cr(tr(l),Tr(O({kind:"managed",workspaceId:e,..._?{base:_}:{}}))),re=dr(T);if(!re.isSymbolicLink()&&re.isDirectory()&&tr(T)===T)cn(T,W),x=!0}catch{}if(f&&f!==e){let T=cr(I,f);try{let re=dr(T);if(re.isSymbolicLink()||!re.isDirectory())throw new r("invalid_hands_workspace","Reason Hands legacy workspace must be a managed directory.");let J=tr(T);if(Tr(J)!==I)throw new r("invalid_hands_workspace","Reason Hands legacy workspace escaped its managed parent.");let z=null;if(x){z=cr(I,`.${e}.previous`);try{throw dr(z),new r("invalid_hands_workspace","Reason Hands previous workspace backup already exists.")}catch(fe){if(fe instanceof r||!(fe&&typeof fe==="object"&&("code"in fe)&&fe.code==="ENOENT"))throw fe}cn(W,z)}try{cn(J,W)}catch(fe){if(z)cn(z,W);throw fe}x=!0}catch(re){if(re instanceof r||!(re&&typeof re==="object"&&("code"in re)&&re.code==="ENOENT"))throw re}}Tt(W,{recursive:!0,mode:448}),Wt(W,448);let M=tr(W);if(Tr(M)!==I)throw new r("invalid_hands_workspace","Reason Hands workspace escaped its managed parent.");let G=cr(M,"repo");try{let T=dr(G);if(T.isSymbolicLink()||!T.isDirectory())throw new r("invalid_hands_workspace","Reason Hands repository must be a managed directory.")}catch(T){if(T instanceof r||!(T&&typeof T==="object"&&("code"in T)&&T.code==="ENOENT"))throw T}Tt(G,{recursive:!0,mode:448}),Wt(G,448);let F=tr(G);if(Tr(F)!==M)throw new r("invalid_hands_workspace","Reason Hands repository escaped its managed run workspace.");return{workRoot:M,repoPath:F}}function vr(e){let l=null;try{l=dr(e)}catch{}if(!l||l.isSymbolicLink()||!l.isDirectory()||l.uid!==0||l.gid!==0||(l.mode&4095)!==493)throw new r("cloud_workspace_root_invalid","This cloud Session's workspace root is not root's 0755 directory, so Reason Hands cannot use it.")}function Kd(e,l,f=process.geteuid?.(),_=process.platform){if(_==="win32")return"unknown";let w;try{if(w=dt(e),!w.isDirectory())return"unready";Sd(e,At.R_OK|At.W_OK|At.X_OK)}catch{return"unready"}try{if(dr(e).isSymbolicLink()||tr(e)!==e)return"unknown"}catch{return"unknown"}if(f!==0)return"checked";if(l===null||w.uid!==l.uid||(w.mode&448)!==448)return"unknown";for(let S=Tr(e);;S=Tr(S)){let I;try{I=dt(S)}catch{return"unknown"}if(!(I.uid===l.uid?(I.mode&64)!==0:I.gid===l.gid?(I.mode&8)!==0:(I.mode&1)!==0))return"unknown";if(S===Tr(S))return"checked"}}function Gd(e,l){let f="/";for(let _ of["",...e.split("/"),...l.split("/")].filter((w,S)=>S===0||w)){if(_)f=cr(f,_);let w;try{w=dr(f)}catch{return null}if(w.uid!==0)return w.uid;if((w.mode&2)!==0&&(w.mode&512)===0&&!w.isSymbolicLink())return-1;if(w.isSymbolicLink()||!w.isDirectory())return null}return null}function Jd(e,l,f,_=process.geteuid?.(),w){if(!Xr.test(l))return null;let S,I;try{S=tr(e),I=Tr(O({kind:"managed",workspaceId:l,...f?{base:f}:{},...w?{layout:w}:{}}))}catch{return null}let W=cr(S,I),x=tn(W)!==null,M=(J)=>new r("cloud_workspace_root_invalid",J),G;if(_===0){let J=Gd(S,I);if(J===null)return null;if(!x)throw new r("invalid_hands_workspace","As root, Reason Hands never prepares a workspace in folders another user owns.");G=J}else{if(!x)return null;let J,z;try{J=dr(Tr(W)),z=dr(W)}catch{return null}if(J.isSymbolicLink()||!J.isDirectory()||J.uid===0||z.uid!==0)return null;G=J.uid}let F=S;for(let J of I.split("/")){let z=cr(F,J),fe=!1;try{let ve=dr(z);fe=!ve.isSymbolicLink()&&ve.isDirectory()&&tr(z)===z}catch{}if(!fe)throw M("This cloud Session's workspace root is missing or is not a real directory.");F=z}vr(W);let T;try{T=Sr(W)}catch(J){if(J instanceof r)throw J;throw M("This cloud Session's workspace root changed while Reason Hands checked it.")}let re=null;try{re=dt(T.repoPath).uid}catch{}if(re!==G)throw new r("invalid_hands_workspace","Reason Hands repository must belong to the cloud Session's user.");return T}function Sr(e,l=!1){let f=tr(e),_=cr(f,"repo"),w;try{w=dr(_)}catch{throw new r("invalid_hands_workspace","Reason Hands repository is missing from the granted root.")}if(l){if(!/^\/var\/lib\/reason\/sessions\/[0-9a-f-]{36}$/.test(f))throw new r("invalid_hands_workspace","Personal runtime identity is invalid.");if(an(f.slice(f.lastIndexOf("/")+1)).runtimeRoot!==f)throw new r("invalid_hands_workspace","Personal runtime identity is invalid.");let W=tr("/workspace"),x=tr(_);if(W!=="/workspace"||!dt(x).isDirectory()||!x.startsWith("/workspace/"))throw new r("invalid_hands_workspace","Personal files escaped the personal computer.");return{workRoot:f,repoPath:x}}let S=Hs(f);if(S&&w.isSymbolicLink()){let W=tr(_);if(W!==tr(S)||!dt(W).isDirectory())throw new r("invalid_hands_workspace","Side chat repository must be its parent's checkout.");return{workRoot:f,repoPath:W}}if(w.isSymbolicLink()||!w.isDirectory())throw new r("invalid_hands_workspace","Reason Hands repository must be a managed directory.");let I=tr(_);if(Tr(I)!==f)throw new r("invalid_hands_workspace","Reason Hands repository escaped its granted root.");return{workRoot:f,repoPath:I}}function fo(e,l,f){if(l!==void 0&&!X(l))throw new r("invalid_hands_workspace",`Reason Hands ${f} is invalid.`);let _=ai(e,l??".");if(!Ur(e,_))throw new r("invalid_hands_workspace",`Reason Hands ${f} escapes its granted root.`);return _}function di(e,l,f){if(Qe(l)){let _=tr(f);return{anchor:_,target:ai(_,l),boundary:cr(_,de)}}return{anchor:e,target:fo(e,l,"folder"),boundary:e}}function Vd(e,l){if(!Ur(e,l))throw new r("invalid_hands_workspace","Reason Hands folder escapes its granted root.");let f=e;for(let _ of l.slice(e.length).split(Cd).filter(Boolean)){f=cr(f,_);let w=null;try{w=dr(f)}catch(S){if(S.code!=="ENOENT")throw S}if(!w)Tt(f,{mode:448});else if(w.isSymbolicLink()||!w.isDirectory())throw new r("invalid_hands_workspace","Reason Hands folder must be made of real directories.")}}function li(e,l){let f=tr(fo(e,l.source_path,"repository"));if(!Ur(e,f)||!dt(f).isDirectory())throw new r("invalid_hands_workspace","Reason Hands repository must be a folder in its granted root.");return f}async function qd(e,l,f,_=a()){try{let w=tr(e);if(uo(di(w,l,_).target))return;return await Ws(li(w,f))??void 0}catch{return}}function Yd(e,l,f,_,w=Xd,S=a()){let I=tr(e),{target:W,boundary:x,anchor:M}=di(I,l,S);if(f&&!uo(W)){let T=li(I,f);Vd(M,Tr(W));let re=["-c","core.hooksPath=/dev/null","-C",T];if(_)w([...re,"update-ref","--create-reflog","-m",_.note,`refs/heads/${f.branch}`,_.commit,""]);let J=_?w([...re,"worktree","add",W,f.branch]):w([...re,"worktree","add","-b",f.branch,W]);if(!_&&J.status!==0&&/already exists/.test(J.stderr)&&!uo(W))J=w([...re,"worktree","add",W,f.branch]);if(J.status!==0)throw new r(/not a git repository/i.test(J.stderr)?"workspace_not_git_repository":"workspace_worktree_failed","Reason could not create this Session's git worktree.")}let G;try{G=dr(W)}catch{throw new r("workspace_folder_missing","This Session's folder no longer exists.")}let F=tr(W);if(G.isSymbolicLink()&&!Ur(x,F))throw new r("invalid_hands_workspace","Reason Hands folder resolves outside its granted root.");if(!dt(F).isDirectory()||!Ur(x,F))throw new r("invalid_hands_workspace","Reason Hands folder must be a directory in its granted root.");if(E(F))throw new r("protected_path","Credential and secret folders are unavailable to Sessions.");return F}function Xd(e){let l=Ho();if(!l)return{status:null,stderr:"git was not found. Install Git for Windows (https://git-scm.com/download/win)."};let f=kd(l,e,{encoding:"utf8",timeout:60000,env:{...process.env,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});return{status:f.status,stderr:f.stderr??""}}function ui(e){return wr(e)??tn(e)?.jobEnv??cr(e,"job.env")}function Zd(e,l){let f=ui(e),_=dr(f);if(_.isSymbolicLink()||!_.isFile())throw new r("invalid_hands_workspace","Reason Hands job environment must be a managed regular file.");Pd(f,l),Wt(l,384)}function Qd(e){if(e.workspaceMode===jr&&e.workspacePath!==void 0){let I=e.home??a(),W=Yd(e.grantedRoot,e.workspacePath,e.workspaceWorktree,e.workspaceWorktreeStart,void 0,I);if(e.workspaceWorktree&&e.deviceId)Us(I,e.workspacePath,e.deviceId);return{workRoot:W,repoPath:W,workspace:{kind:"root",path:e.workspacePath},jobEnvPath:cr(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}if(e.workspaceMode===Yr)return{...Sr(e.grantedRoot,e.personalWorkspace),workspace:{kind:"root"},jobEnvPath:cr(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1};if(e.workspaceMode===kt||e.workspaceMode===jr){let I=dr(e.grantedRoot);if(I.isSymbolicLink()||!I.isDirectory())throw new r("invalid_hands_workspace","Reason Hands root must be a real directory.");let W=tr(e.grantedRoot);return{workRoot:W,repoPath:W,workspace:{kind:"root"},jobEnvPath:cr(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}let l=e.workspaceId??e.runId,f={kind:"managed",workspaceId:l,...e.workspaceBase?{base:e.workspaceBase}:{},...e.workspaceLayout?{layout:e.workspaceLayout}:{}},_=ie(e.grantedRoot,f,e.home).anchor,w=Jd(_,l,e.workspaceBase,void 0,e.workspaceLayout);if(w)return{...w,workspace:f,jobEnvPath:cr(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1,cloudSessionRoot:!0};let S=$d(l,_,e.legacyWorkspaceId,e.workspaceBase,e.workspaceLayout);return{...S,workspace:f,jobEnvPath:cr(e.temporaryDirectory,"job.env"),workspacePoolPath:Tr(S.workRoot),managedWorkspace:!0}}function wn(e){let{command:l,prefix:f}=Dn(e.executablePath,e.sourceEntrypoint),_=He({home:Td(),temporaryDirectory:e.temporaryDirectory,path:e.path});if(_.REASON_DEVICE_ROOT=_.ARA_DEVICE_ROOT=e.grantedRoot,_.REASON_HANDS_WORKSPACE=_.ARA_HANDS_WORKSPACE=e.workRoot,_.REASON_HANDS_REPO=_.ARA_HANDS_REPO=e.root,e.workspacePoolPath)_.REASON_HANDS_WORKSPACE_POOL=_.ARA_HANDS_WORKSPACE_POOL=e.workspacePoolPath;return{command:l,args:[...f,"__device","__hands-worker","--config",e.configPath],options:{cwd:e.root,env:_,shell:!1,stdio:[bn,"ignore","pipe"]}}}var bn=process.platform==="win32"?"pipe":"ignore";function ot(e,l){if(process.platform!=="win32")return e.kill(l);if(l==="SIGTERM")e.stdin?.end();else if(e.pid)Me(e.pid);return!0}function el(e,l){let f="",_=!1,w=Date.now(),S=0,I=new Set(["connecting","open","dial_pending","socket_error","close","claim_accepted","claim_rejected","stopping","stopped","request_cancelled","permission_denied"].map((F)=>`hands.worker.${F}`)),W=new Set([null,"open_not_received","current_connection","obsolete_connection","request_aborted","request_timeout","client_closed","driver_stopped","driver_handoff","run_cancelled","run_finished","other","frame_too_large","invalid_json","invalid_claim","executor_mismatch","stale_generation","fence_conflict","SIGTERM","SIGINT","SIGHUP","expired","cleanup_complete","cleanup_failed","cancelled","settled","unsupported","unconfirmed",...["sandbox_policy","os_permission_unknown"].flatMap((F)=>["bash","read","write","edit"].map((T)=>`${F}:${T}`))]),x=["timestampMs","connectionAttempt","connectionGeneration","targetGeneration","activeRequestCount","remainingLifetimeMs","suppressedDiagnostics"],M=["peerGeneration","socketState","closeCode"],G=new Set(["event","reason","launchId",...x,...M]);return(F)=>{for(let T of F.toString().split(/(?<=\n)/)){let re=T.endsWith(`
+`);if(Fe===-1)return;$e=!0;let Ve=Oe.slice(0,Fe);z=z.then(async()=>{if(be.destroyed)return;try{let Te=JSON.parse(Ve);if(Te.action!=="evaluate"||typeof Te.code!=="string")throw Error("Invalid REPL request");qe=!0;let le=await J({action:"evaluate",code:Te.code});if(qe=!1,le.ok!==!0||typeof le.output!=="string")throw Error(typeof le.error==="string"?le.error:"hands_node_repl_failed");sn(be,{ok:!0,output:le.output})}catch(Te){qe=!1,sn(be,{ok:!1,error:Te instanceof Error?Te.message:String(Te),stack:Te instanceof Error?Te.stack:void 0})}}).catch((Te)=>{sn(be,{ok:!1,error:Te instanceof Error?Te.message:String(Te)})})})});try{await new Promise((be,Oe)=>{ve.once("error",Oe),ve.listen(e.socketPath,()=>{ve.off("error",Oe);try{od(e.socketPath,384),be()}catch($e){ve.close(()=>Oe($e))}})})}catch(be){S=!0,f.kill("SIGKILL");try{await Mt(_)}finally{await l.cleanup(),Zn(e.socketPath)}throw be}return{socketPath:e.socketPath,async stop(){if(S)return;S=!0;let be=new Promise((Oe)=>ve.close(()=>Oe()));for(let Oe of fe)Oe.destroy();await be,z.catch(()=>{return}),F();try{await Mt(_)}finally{await l.cleanup(),Zn(e.socketPath)}}}}var so=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var Qs="/workspace",ri="/var/lib/reason/sessions",bd="/var/lib/reason/session-controls";function wr(e){let l=`${ri}/`;if(!e.startsWith(l))return null;let f=e.slice(l.length);if(!so.test(f)||f!==f.toLowerCase())throw Error("personal_computer_invalid_runtime_root");return`${bd}/${f}/job.env`}function wd(e){if(!so.test(e))throw Error("personal_computer_invalid_identity");return e.toLowerCase()}function an(e){let l=wd(e);return{runtimeRoot:`${ri}/${l}`,workspaceRoot:`${Qs}/sessions/${l}`,sharedRoot:Qs}}var ti="/root/.ara/cloud-browser/repl.sock";function co(e){return e==="compute"}function ni(e,l,f="linux"){if(e)an(e);if(f!=="linux")throw Error("cloud_browser_os_invalid");if(l!==void 0&&(!e||!/^[1-9][0-9]{0,18}$/.test(l)))throw Error("cloud_browser_generation_invalid");let _=e?`/var/lib/reason/browsers/${e.toLowerCase()}`:"/root/.ara/cloud-browser",w=e?`${_}/${l?`g${l}`:"current"}`:_,S=e?`/root/.b/${e.toLowerCase().replaceAll("-","")}`:_;return{temporarySessionDirectory:S,temporaryDirectory:e?`${S}/${l??"current"}`:`${w}/tmp`,directory:w,sessionDirectory:_,config:`${w}/config.json`,status:`${w}/status.json`,socket:`${w}/repl.sock`,bundle:`${w}/driver.mjs`,processName:e?`ara-browser-${e.toLowerCase()}${l?`-${l}`:""}`:"ara-cloud-browser"}}var lo="browser_egress",oi=Zo,Hd=45000,Nd=Xt+1500,Xr=/^[A-Za-z0-9._:-]{1,160}$/,Ld="/run/ara-hands";function Bd(e,l,f=ii()){if(e==="darwin")return{temporaryRoot:f,prepareRoot:!1,sessionMode:448};return{temporaryRoot:l??Ld,prepareRoot:!0,sessionMode:457}}function me(e,l=process.platform,f=process.geteuid?.()){return e===!0&&l==="linux"&&f===0}function ge(e=K(),l=process.platform,f=process.geteuid?.()){return e&&l==="linux"&&f===0?{uid:e.uid,gid:e.gid,home:e.home,username:e.username}:null}function Rt(e=ge(),l=Cs){return e&&l()?Gn:null}function jd(e,l){if(!l&&(e??"linux")==="linux")return ti;return ni(l,void 0,e??"linux").socket}function Pt(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function ci(e){let l=e.toLowerCase().replace(/^\[|\]$/g,"");return l==="localhost"||l.endsWith(".localhost")||l==="::1"||l==="0:0:0:0:0:0:0:1"||l==="0.0.0.0"||l.startsWith("127.")}class br extends r{expiryDiagnostic;constructor(e){super("invalid_hands_expiry","Reason Hands connection expiry is invalid.");this.expiryDiagnostic=e}}function Md(e){return Pt(e)&&Object.keys(e).every((l)=>l==="source_path"||l==="branch")&&(e.source_path===void 0||X(e.source_path))&&typeof e.branch==="string"&&Jn.test(e.branch)}function Wd(e,l,f){let _=l===void 0?Date.now():l,w=["relay_url","session_id","environment_id","expires_at","policy_mode","policy_version","hands_protocol_version","hands_worker_version","hands_worker_artifact_sha256","hands_worker_entrypoint","target_generation","target_fence_id"],S=new Set([...w,"workspace_id","legacy_workspace_id",Ce,Ae,"environment_binding","cloud_browser","sandbox_provider","sandbox_os","personal_workspace","workspace_path","workspace_worktree",Ye,lo,St,Q,Y,q]),I=Pt(e)?e:null,W=I?.[lo],x=I?.[St],M=I?.[Y],G=W===void 0||(I?.[Ye]===Yr||M===pe&&I?.[Ye]===void 0)&&Pt(W)&&Object.keys(W).every((ve)=>ve==="mode"||ve==="allowed_domains")&&W.mode==="enforce"&&Array.isArray(W.allowed_domains)&&W.allowed_domains.length<=256&&W.allowed_domains.every((ve)=>typeof ve==="string"&&Nn(ve));if(!Pt(e)||w.some((ve)=>!(ve in e))||Object.keys(e).some((ve)=>!S.has(ve))||!G||M!==void 0&&M!==pe||I?.[q]!==void 0&&I[q]!==Re||I?.personal_workspace!==void 0&&(I.personal_workspace!==!0||I[Ye]!==Yr)||I?.cloud_browser!==void 0&&(I.cloud_browser!==!0||I[Ye]!==Yr)||I?.sandbox_provider!==void 0&&!co(I.sandbox_provider)||I?.sandbox_os!==void 0&&I.sandbox_os!=="linux"||x!==void 0&&(I?.[Ye]!==kt||!js(x))||Ye in e&&e[Ye]!==Yr&&e[Ye]!==kt&&e[Ye]!==jr||e.workspace_path!==void 0&&(!X(e.workspace_path)||e[Ye]!==jr)||e.workspace_worktree!==void 0&&(e.workspace_path===void 0||!Md(e.workspace_worktree))||typeof e.relay_url!=="string"||typeof e.session_id!=="string"||!Xr.test(e.session_id)||e.workspace_id!==void 0&&(typeof e.workspace_id!=="string"||!Xr.test(e.workspace_id))||e.legacy_workspace_id!==void 0&&(typeof e.legacy_workspace_id!=="string"||!Xr.test(e.legacy_workspace_id))||e[Ce]!==void 0&&(e[Ce]!==ue||(Ye in e))||e[Ae]!==void 0&&(e[Ae]!==Z||(Ye in e))||e[Q]!==void 0&&(typeof e[Q]!=="string"||!Xr.test(e[Q]))||typeof e.environment_id!=="string"||!Xr.test(e.environment_id)||typeof e.expires_at!=="string"||e.policy_mode!=="full_access"||e.policy_version!==1||e.hands_protocol_version!==P||e.hands_worker_version!==D||e.hands_worker_artifact_sha256!==b||!Ks(e.hands_worker_entrypoint)||!U(e.target_generation)||!N(e.target_fence_id))throw new r("invalid_hands_payload","Reason Hands connection payload is invalid.");let F;try{F=new URL(e.relay_url)}catch{throw new r("invalid_hands_relay","Reason Hands relay URL is invalid.")}if((ci(F.hostname)?F.protocol!=="ws:":F.protocol!=="wss:")||F.username||F.password||F.hash||!/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(F.pathname))throw new r("invalid_hands_relay","Reason Hands relay URL is not allowed.");let re=Date.parse(e.expires_at),J=Number.isNaN(re)?"parse":new Date(re).toISOString()!==e.expires_at?"noncanonical":re<=_?"expired":re-_>oi?"over_cap":"accepted",z={version:1,outcome:J,clock_source:l===void 0?"date_now":"injected",validation_now_ms:gt(_),expiry_ms:gt(re),remaining_ms:Number.isSafeInteger(re-_)?re-_:null,maximum_lifetime_ms:oi,cli_artifact:Gs()};if(J!=="accepted")throw new br(z);try{f?.(z)}catch{}let fe=e.environment_binding===void 0?void 0:Tn.safeParse(e.environment_binding);if(fe&&!fe.success)throw new r("invalid_hands_request","Reason Hands environment binding is invalid.");return{...e.cloud_browser===!0?{cloud_browser:!0}:{},...co(e.sandbox_provider)?{sandbox_provider:e.sandbox_provider}:{},...e.sandbox_os==="linux"?{sandbox_os:e.sandbox_os}:{},...e.personal_workspace===!0?{personal_workspace:!0}:{},relay_url:F.toString(),...fe?.success?{environment_binding:fe.data}:{},session_id:e.session_id,...e.workspace_id===void 0?{}:{workspace_id:e.workspace_id},...e.legacy_workspace_id===void 0?{}:{legacy_workspace_id:e.legacy_workspace_id},...e[Ce]===ue?{[Ce]:ue}:{},...e[Ae]===Z?{[Ae]:Z}:{},...typeof e[Q]==="string"?{[Q]:e[Q]}:{},...e[Y]===pe?{[Y]:pe}:{},...e[q]===Re?{[q]:Re}:{},...typeof e.workspace_path==="string"?{workspace_path:e.workspace_path}:{},...Pt(e.workspace_worktree)?{workspace_worktree:{...typeof e.workspace_worktree.source_path==="string"?{source_path:e.workspace_worktree.source_path}:{},branch:String(e.workspace_worktree.branch)}}:{},environment_id:e.environment_id,expires_at:e.expires_at,policy_mode:"full_access",policy_version:1,hands_protocol_version:P,hands_worker_version:D,hands_worker_artifact_sha256:b,hands_worker_entrypoint:R,target_generation:e.target_generation,target_fence_id:e.target_fence_id,...Ye in e?{[Ye]:e[Ye]}:{},...x===void 0?{}:{[St]:x},...W===void 0?{}:{[lo]:{mode:"enforce",allowed_domains:[...new Set(W.allowed_domains)].sort()}}}}function Fd(){let e=new Map;return{acquire(l,f){if(e.has(l))return null;let _=[...e.values()],w=(I)=>f.group!==void 0&&I.group===f.group;if(f.exclusive?!_.every(w):_.some((I)=>I.exclusive))return null;if(f.limit!==void 0&&!_.some(w)&&new Set(_.map((I,W)=>I.group??W)).size>=f.limit)return null;e.set(l,f);let S=!1;return()=>{if(S)return;S=!0,e.delete(l)}},activeOwners:()=>[...e.keys()]}}var Ud=Fd();function zd(e,l){Tt(e,{recursive:!0,mode:448});let f=tr(e),_=()=>new r("invalid_hands_workspace","Reason Hands managed workspace ancestor must be a real directory, not a link.");for(let I of l.split("/")){let W=cr(f,I);try{let M=dr(W);if(M.isSymbolicLink()||!M.isDirectory())throw _()}catch(M){if(!(M&&typeof M==="object"&&("code"in M)&&M.code==="ENOENT"))throw M;try{Tt(W,{mode:448})}catch(G){if(!(G&&typeof G==="object"&&("code"in G)&&G.code==="EEXIST"))throw G}}let x=dr(W);if(x.isSymbolicLink()||!x.isDirectory()||tr(W)!==W)throw _();f=W}if(process.platform==="win32"){let I=dr(f);if(I.isSymbolicLink()||!I.isDirectory()||tr(f)!==f||!Ur(tr(e),f))throw _();return f}let w=dr(f),S=xd(f,At.O_RDONLY|At.O_DIRECTORY|At.O_NOFOLLOW);try{let I=Od(S);if(!I.isDirectory()||I.dev!==w.dev||I.ino!==w.ino||tr(f)!==f)throw _();Rd(S,448)}finally{Ed(S)}return f}function $d(e,l=Lo(),f,_,w){if(!Xr.test(e)||f!==void 0&&!Xr.test(f))throw new r("invalid_hands_workspace","Reason Hands run identity is invalid.");let S=Tr(O({kind:"managed",workspaceId:e,..._?{base:_}:{},...w?{layout:w}:{}})),I=zd(l,Tr(S)),W=cr(I,Dd(S)),x=!1;try{let T=dr(W);if(x=!0,T.isSymbolicLink())throw new r("invalid_hands_workspace","Reason Hands workspace cannot be a symbolic link.");if(!T.isDirectory())throw new r("invalid_hands_workspace","Reason Hands workspace must be a managed directory.")}catch(T){if(T instanceof r||!(T&&typeof T==="object"&&("code"in T)&&T.code==="ENOENT"))throw T}if(w&&!x)try{let T=cr(tr(l),Tr(O({kind:"managed",workspaceId:e,..._?{base:_}:{}}))),re=dr(T);if(!re.isSymbolicLink()&&re.isDirectory()&&tr(T)===T)cn(T,W),x=!0}catch{}if(f&&f!==e){let T=cr(I,f);try{let re=dr(T);if(re.isSymbolicLink()||!re.isDirectory())throw new r("invalid_hands_workspace","Reason Hands legacy workspace must be a managed directory.");let J=tr(T);if(Tr(J)!==I)throw new r("invalid_hands_workspace","Reason Hands legacy workspace escaped its managed parent.");let z=null;if(x){for(let fe=1;fe<=1000&&!z;fe++){let ve=cr(I,fe===1?`.${e}.previous`:`.${e}.previous.${fe}`);try{dr(ve)}catch(be){if(!(be&&typeof be==="object"&&("code"in be)&&be.code==="ENOENT"))throw be;z=ve}}if(!z)throw new r("invalid_hands_workspace","Reason Hands has too many previous workspace backups.");cn(W,z)}try{cn(J,W)}catch(fe){if(z)cn(z,W);throw fe}x=!0}catch(re){if(re instanceof r||!(re&&typeof re==="object"&&("code"in re)&&re.code==="ENOENT"))throw re}}Tt(W,{recursive:!0,mode:448}),Wt(W,448);let M=tr(W);if(Tr(M)!==I)throw new r("invalid_hands_workspace","Reason Hands workspace escaped its managed parent.");let G=cr(M,"repo");try{let T=dr(G);if(T.isSymbolicLink()||!T.isDirectory())throw new r("invalid_hands_workspace","Reason Hands repository must be a managed directory.")}catch(T){if(T instanceof r||!(T&&typeof T==="object"&&("code"in T)&&T.code==="ENOENT"))throw T}Tt(G,{recursive:!0,mode:448}),Wt(G,448);let F=tr(G);if(Tr(F)!==M)throw new r("invalid_hands_workspace","Reason Hands repository escaped its managed run workspace.");return{workRoot:M,repoPath:F}}function vr(e){let l=null;try{l=dr(e)}catch{}if(!l||l.isSymbolicLink()||!l.isDirectory()||l.uid!==0||l.gid!==0||(l.mode&4095)!==493)throw new r("cloud_workspace_root_invalid","This cloud Session's workspace root is not root's 0755 directory, so Reason Hands cannot use it.")}function Kd(e,l,f=process.geteuid?.(),_=process.platform){if(_==="win32")return"unknown";let w;try{if(w=dt(e),!w.isDirectory())return"unready";Sd(e,At.R_OK|At.W_OK|At.X_OK)}catch{return"unready"}try{if(dr(e).isSymbolicLink()||tr(e)!==e)return"unknown"}catch{return"unknown"}if(f!==0)return"checked";if(l===null||w.uid!==l.uid||(w.mode&448)!==448)return"unknown";for(let S=Tr(e);;S=Tr(S)){let I;try{I=dt(S)}catch{return"unknown"}if(!(I.uid===l.uid?(I.mode&64)!==0:I.gid===l.gid?(I.mode&8)!==0:(I.mode&1)!==0))return"unknown";if(S===Tr(S))return"checked"}}function Gd(e,l){let f="/";for(let _ of["",...e.split("/"),...l.split("/")].filter((w,S)=>S===0||w)){if(_)f=cr(f,_);let w;try{w=dr(f)}catch{return null}if(w.uid!==0)return w.uid;if((w.mode&2)!==0&&(w.mode&512)===0&&!w.isSymbolicLink())return-1;if(w.isSymbolicLink()||!w.isDirectory())return null}return null}function Jd(e,l,f,_=process.geteuid?.(),w){if(!Xr.test(l))return null;let S,I;try{S=tr(e),I=Tr(O({kind:"managed",workspaceId:l,...f?{base:f}:{},...w?{layout:w}:{}}))}catch{return null}let W=cr(S,I),x=tn(W)!==null,M=(J)=>new r("cloud_workspace_root_invalid",J),G;if(_===0){let J=Gd(S,I);if(J===null)return null;if(!x)throw new r("invalid_hands_workspace","As root, Reason Hands never prepares a workspace in folders another user owns.");G=J}else{if(!x)return null;let J,z;try{J=dr(Tr(W)),z=dr(W)}catch{return null}if(J.isSymbolicLink()||!J.isDirectory()||J.uid===0||z.uid!==0)return null;G=J.uid}let F=S;for(let J of I.split("/")){let z=cr(F,J),fe=!1;try{let ve=dr(z);fe=!ve.isSymbolicLink()&&ve.isDirectory()&&tr(z)===z}catch{}if(!fe)throw M("This cloud Session's workspace root is missing or is not a real directory.");F=z}vr(W);let T;try{T=Sr(W)}catch(J){if(J instanceof r)throw J;throw M("This cloud Session's workspace root changed while Reason Hands checked it.")}let re=null;try{re=dt(T.repoPath).uid}catch{}if(re!==G)throw new r("invalid_hands_workspace","Reason Hands repository must belong to the cloud Session's user.");return T}function Sr(e,l=!1){let f=tr(e),_=cr(f,"repo"),w;try{w=dr(_)}catch{throw new r("invalid_hands_workspace","Reason Hands repository is missing from the granted root.")}if(l){if(!/^\/var\/lib\/reason\/sessions\/[0-9a-f-]{36}$/.test(f))throw new r("invalid_hands_workspace","Personal runtime identity is invalid.");if(an(f.slice(f.lastIndexOf("/")+1)).runtimeRoot!==f)throw new r("invalid_hands_workspace","Personal runtime identity is invalid.");let W=tr("/workspace"),x=tr(_);if(W!=="/workspace"||!dt(x).isDirectory()||!x.startsWith("/workspace/"))throw new r("invalid_hands_workspace","Personal files escaped the personal computer.");return{workRoot:f,repoPath:x}}let S=Hs(f);if(S&&w.isSymbolicLink()){let W=tr(_);if(W!==tr(S)||!dt(W).isDirectory())throw new r("invalid_hands_workspace","Side chat repository must be its parent's checkout.");return{workRoot:f,repoPath:W}}if(w.isSymbolicLink()||!w.isDirectory())throw new r("invalid_hands_workspace","Reason Hands repository must be a managed directory.");let I=tr(_);if(Tr(I)!==f)throw new r("invalid_hands_workspace","Reason Hands repository escaped its granted root.");return{workRoot:f,repoPath:I}}function fo(e,l,f){if(l!==void 0&&!X(l))throw new r("invalid_hands_workspace",`Reason Hands ${f} is invalid.`);let _=ai(e,l??".");if(!Ur(e,_))throw new r("invalid_hands_workspace",`Reason Hands ${f} escapes its granted root.`);return _}function di(e,l,f){if(Qe(l)){let _=tr(f);return{anchor:_,target:ai(_,l),boundary:cr(_,de)}}return{anchor:e,target:fo(e,l,"folder"),boundary:e}}function Vd(e,l){if(!Ur(e,l))throw new r("invalid_hands_workspace","Reason Hands folder escapes its granted root.");let f=e;for(let _ of l.slice(e.length).split(Cd).filter(Boolean)){f=cr(f,_);let w=null;try{w=dr(f)}catch(S){if(S.code!=="ENOENT")throw S}if(!w)Tt(f,{mode:448});else if(w.isSymbolicLink()||!w.isDirectory())throw new r("invalid_hands_workspace","Reason Hands folder must be made of real directories.")}}function li(e,l){let f=tr(fo(e,l.source_path,"repository"));if(!Ur(e,f)||!dt(f).isDirectory())throw new r("invalid_hands_workspace","Reason Hands repository must be a folder in its granted root.");return f}async function qd(e,l,f,_=a()){try{let w=tr(e);if(uo(di(w,l,_).target))return;return await Ws(li(w,f))??void 0}catch{return}}function Yd(e,l,f,_,w=Xd,S=a()){let I=tr(e),{target:W,boundary:x,anchor:M}=di(I,l,S);if(f&&!uo(W)){let T=li(I,f);Vd(M,Tr(W));let re=["-c","core.hooksPath=/dev/null","-C",T];if(_)w([...re,"update-ref","--create-reflog","-m",_.note,`refs/heads/${f.branch}`,_.commit,""]);let J=_?w([...re,"worktree","add",W,f.branch]):w([...re,"worktree","add","-b",f.branch,W]);if(!_&&J.status!==0&&/already exists/.test(J.stderr)&&!uo(W))J=w([...re,"worktree","add",W,f.branch]);if(J.status!==0)throw new r(/not a git repository/i.test(J.stderr)?"workspace_not_git_repository":"workspace_worktree_failed","Reason could not create this Session's git worktree.")}let G;try{G=dr(W)}catch{throw new r("workspace_folder_missing","This Session's folder no longer exists.")}let F=tr(W);if(G.isSymbolicLink()&&!Ur(x,F))throw new r("invalid_hands_workspace","Reason Hands folder resolves outside its granted root.");if(!dt(F).isDirectory()||!Ur(x,F))throw new r("invalid_hands_workspace","Reason Hands folder must be a directory in its granted root.");if(E(F))throw new r("protected_path","Credential and secret folders are unavailable to Sessions.");return F}function Xd(e){let l=Ho();if(!l)return{status:null,stderr:"git was not found. Install Git for Windows (https://git-scm.com/download/win)."};let f=kd(l,e,{encoding:"utf8",timeout:60000,env:{...process.env,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});return{status:f.status,stderr:f.stderr??""}}function ui(e){return wr(e)??tn(e)?.jobEnv??cr(e,"job.env")}function Zd(e,l){let f=ui(e),_=dr(f);if(_.isSymbolicLink()||!_.isFile())throw new r("invalid_hands_workspace","Reason Hands job environment must be a managed regular file.");Pd(f,l),Wt(l,384)}function Qd(e){if(e.workspaceMode===jr&&e.workspacePath!==void 0){let I=e.home??a(),W=Yd(e.grantedRoot,e.workspacePath,e.workspaceWorktree,e.workspaceWorktreeStart,void 0,I);if(e.workspaceWorktree&&e.deviceId)Us(I,e.workspacePath,e.deviceId);return{workRoot:W,repoPath:W,workspace:{kind:"root",path:e.workspacePath},jobEnvPath:cr(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}if(e.workspaceMode===Yr)return{...Sr(e.grantedRoot,e.personalWorkspace),workspace:{kind:"root"},jobEnvPath:cr(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1};if(e.workspaceMode===kt||e.workspaceMode===jr){let I=dr(e.grantedRoot);if(I.isSymbolicLink()||!I.isDirectory())throw new r("invalid_hands_workspace","Reason Hands root must be a real directory.");let W=tr(e.grantedRoot);return{workRoot:W,repoPath:W,workspace:{kind:"root"},jobEnvPath:cr(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}let l=e.workspaceId??e.runId,f={kind:"managed",workspaceId:l,...e.workspaceBase?{base:e.workspaceBase}:{},...e.workspaceLayout?{layout:e.workspaceLayout}:{}},_=ie(e.grantedRoot,f,e.home).anchor,w=Jd(_,l,e.workspaceBase,void 0,e.workspaceLayout);if(w)return{...w,workspace:f,jobEnvPath:cr(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1,cloudSessionRoot:!0};let S=$d(l,_,e.legacyWorkspaceId,e.workspaceBase,e.workspaceLayout);return{...S,workspace:f,jobEnvPath:cr(e.temporaryDirectory,"job.env"),workspacePoolPath:Tr(S.workRoot),managedWorkspace:!0}}function wn(e){let{command:l,prefix:f}=Dn(e.executablePath,e.sourceEntrypoint),_=He({home:Td(),temporaryDirectory:e.temporaryDirectory,path:e.path});if(_.REASON_DEVICE_ROOT=_.ARA_DEVICE_ROOT=e.grantedRoot,_.REASON_HANDS_WORKSPACE=_.ARA_HANDS_WORKSPACE=e.workRoot,_.REASON_HANDS_REPO=_.ARA_HANDS_REPO=e.root,e.workspacePoolPath)_.REASON_HANDS_WORKSPACE_POOL=_.ARA_HANDS_WORKSPACE_POOL=e.workspacePoolPath;return{command:l,args:[...f,"__device","__hands-worker","--config",e.configPath],options:{cwd:e.root,env:_,shell:!1,stdio:[bn,"ignore","pipe"]}}}var bn=process.platform==="win32"?"pipe":"ignore";function ot(e,l){if(process.platform!=="win32")return e.kill(l);if(l==="SIGTERM")e.stdin?.end();else if(e.pid)Me(e.pid);return!0}function el(e,l){let f="",_=!1,w=Date.now(),S=0,I=new Set(["connecting","open","dial_pending","socket_error","close","claim_accepted","claim_rejected","stopping","stopped","request_cancelled","permission_denied"].map((F)=>`hands.worker.${F}`)),W=new Set([null,"open_not_received","current_connection","obsolete_connection","request_aborted","request_timeout","client_closed","driver_stopped","driver_handoff","run_cancelled","run_finished","other","frame_too_large","invalid_json","invalid_claim","executor_mismatch","stale_generation","fence_conflict","SIGTERM","SIGINT","SIGHUP","expired","cleanup_complete","cleanup_failed","cancelled","settled","unsupported","unconfirmed",...["sandbox_policy","os_permission_unknown"].flatMap((F)=>["bash","read","write","edit"].map((T)=>`${F}:${T}`))]),x=["timestampMs","connectionAttempt","connectionGeneration","targetGeneration","activeRequestCount","remainingLifetimeMs","suppressedDiagnostics"],M=["peerGeneration","socketState","closeCode"],G=new Set(["event","reason","launchId",...x,...M]);return(F)=>{for(let T of F.toString().split(/(?<=\n)/)){let re=T.endsWith(`
 `);if(!_&&f.length+T.length<=2048)f+=T;else _=!0;if(!re)continue;let J=f;if(f="",_){_=!1;continue}try{let z=JSON.parse(J);if(!z||typeof z!=="object"||Array.isArray(z)||Object.keys(z).some((fe)=>!G.has(fe))||!I.has(z.event)||!W.has(z.reason)||z.event==="hands.worker.permission_denied"!==(typeof z.reason==="string"&&z.reason.includes(":"))||z.launchId!==e||x.some((fe)=>!Number.isSafeInteger(z[fe])||z[fe]<0)||M.some((fe)=>z[fe]!==null&&(!Number.isSafeInteger(z[fe])||z[fe]<0)))continue;if(Date.now()-w>=60000)w=Date.now(),S=0;if(S>=122)continue;S+=1,l(z)}catch{}}}}async function rl(e){let l=e.now()+e.timeoutMs;while(e.now()<l){if(e.signal.aborted)throw new r("cancelled","Reason Hands start was cancelled.");if(e.spawnFailed?.()||e.child.exitCode!==null||e.child.signalCode!==null)throw new r("hands_worker_exited","Reason Hands exited before ready.");let f=on(e.path,{pid:e.child.pid??-1,launchId:e.launchId,workerVersion:D,protocolVersion:P,workerArtifactSha256:b,workerEntrypoint:R});if(f?.targetGeneration===e.targetGeneration&&f.fenceId===e.fenceId)return f;await new Promise((_)=>setTimeout(_,10))}throw new r("hands_ready_timeout","Reason Hands did not become ready.")}async function tl(e,l){let f=()=>e.exitCode===0&&e.signalCode===null;if(e.exitCode!==null||e.signalCode!==null)return f()?"stopped":"already_exited";let _=new Promise((I)=>e.once("exit",()=>I()));try{if(!ot(e,"SIGTERM"))return f()?"stopped":"unobserved"}catch{return f()?"stopped":"unobserved"}if(await si(_,l))return f()?"stopped":"unobserved";try{ot(e,"SIGKILL")}catch{}return await si(_,l)?"forced":"unobserved"}async function si(e,l){let f;try{return await Promise.race([e.then(()=>!0),new Promise((_)=>{f=setTimeout(()=>_(!1),l)})])}finally{clearTimeout(f)}}function nl(e){return new Promise((l)=>{let f=!1,_=(W)=>{if(f)return;f=!0,clearTimeout(I),e.signal.removeEventListener("abort",w),e.child.off("exit",S),l(W)},w=()=>_("cancelled"),S=()=>_("exited"),I=setTimeout(()=>_("expired"),Math.max(0,e.expiresAt-e.now()));if(e.signal.addEventListener("abort",w,{once:!0}),e.child.once("exit",S),e.signal.aborted)w();else if(e.child.exitCode!==null||e.child.signalCode!==null)S()})}var ol=no();function sl(e,l){if(!(e instanceof Error)||e instanceof r)return!1;let f=["hands_browser_driver_missing","hands_browser_driver_version_mismatch","hands_browser_executable_missing","hands_browser_unsupported_platform","hands_browser_unavailable"].includes(e.message),_=["ENOENT","EACCES","EPERM"].includes(e.code??"");if(!f&&!_)return!1;try{return dr(l),!1}catch(w){return Pt(w)&&w.code==="ENOENT"}}function il(e){return e.sandbox_provider==="compute"&&!e.cloud_browser&&e[Ye]===Yr}function al(e,l,f){return e===void 0?{}:{dispatch_stages:{version:1,claim_to_entered_ms:Lr(e,l),...f===void 0?{}:{worker_prespawned:f}}}}async function Ot(e,l={}){let f=l.logDiagnostic??((le)=>console.warn(le)),_=new Map,w=(le)=>{let he=Date.now();_.set(le,he);try{f(JSON.stringify({event:"sandbox.hands_startup",stage:le,timestampMs:he}))}catch{}};w("entered");let S=e.claimEnvironment;e.claimEnvironment=void 0;let I=l.now??Date.now,W,x=Wd(e.payload,l.now?.(),(le)=>{W=le});if(e.managedPty&&(e.managedPty.version!==1||!e.headless||!e.runtimeDirectory||![void 0,!0].includes(e.managedPty.startupVerified)||!e.deviceIdentity||!e.claimOwner||e.claimOwner.device_id!==e.deviceIdentity.deviceId||!x.environment_binding||!["darwin","linux","win32"].includes(process.platform)))throw new r("pty_unsupported","Bound PTY requires qualified headless Hands with private jobs and environment.");let M=async(le)=>{let he;try{await Promise.race([le,new Promise((xe,Ke)=>{he=setTimeout(()=>Ke(new r("hands_event_delivery_unavailable","Hands event delivery did not settle within its deadline.")),Math.max(1,Math.min(l.eventDeliveryTimeoutMs??5000,5000)))})])}finally{clearTimeout(he)}},G=async(le,he)=>M(e.emitEvent(le,he));if(e.headless&&(x.cloud_browser===!0||e.managedBrowser!==void 0||x[St]!==void 0||x[Ye]!==void 0&&x[Ye]!==jr))throw new r("invalid_hands_request","Managed sandbox extensions are unavailable to a headless worker.");let F=ge(),T=x[q]===void 0?null:Rt(F);if(x[q]!==void 0&&(T===null||!e.headless||!me(e.hostExecution,l.hostIdentity?.platform,l.hostIdentity?.euid)))throw new r("hands_model_jobs_egress_unavailable","This worker cannot hold its jobs to the guest egress guard; the Hands did not start.");if(x[Y]!==void 0&&!(e.headless&&me(e.hostExecution,l.hostIdentity?.platform,l.hostIdentity?.euid)))throw new r("hands_confinement_unavailable","Confined Hands need a root Linux worker in host mode.");if(x.cloud_browser&&process.platform!=="linux")throw new r("cloud_browser_target_invalid","Cloud browser is available only on a cloud machine.");let re=`${e.operationId}:${e.attemptId}`,J=x[Ye]===kt,z=e.headless||process.platform==="darwin"&&e.managedBrowser===void 0&&!x.cloud_browser&&!x.browser_egress&&(x[Ye]===void 0||x[Ye]===jr)||il(x),fe=J?x[St]??"bash":null,ve=fe?Bs(fe):null;if(ve)throw new r(ve,"Persistent Node REPL execution is unavailable; this benchmark profile cannot start.");let be=x[Ye],Oe=e.headless===!0&&e.ownComputer!==!0?e.handsSlots??1:void 0,$e=(l.slot??Ud).acquire(re,{exclusive:Oe===1||be!==void 0&&be!==jr,...Oe!==void 0&&Oe>1?{limit:Oe}:{},...e.headless===!0&&x[Q]!==void 0?{group:x[Q]}:{}});if(!$e)throw new r("hands_slot_busy",Oe!==void 0&&Oe>1?`This Reason worker runs at most ${Oe} sessions at a time.`:"This Reason Device runs one session at a time.");let qe=e.headless===!0?Ni(e.runId):null,ye=null,Fe=null,Ve,Te;try{w("browser_resolution");let le=e.headless&&l.browserExecutablePath===void 0?await jt():null,he=J||x.cloud_browser?null:l.browserExecutablePath===void 0?e.headless?le?.status==="resolved"?le.executablePath:null:await As(void 0,process.platform,e.managedBrowser):l.browserExecutablePath;if(!J&&!x.cloud_browser&&!z&&!he)throw new r("hands_browser_unavailable","Reason Hands requires Chrome, Edge, Brave, Chromium, or a Playwright Chromium install.");w("path_resolution");let xe;try{xe=await(l.resolvePathEnvironment??ol)()}catch{xe={path:vn(),source:"fallback"}}if(w("workspace_setup"),process.platform==="darwin"){let er=x[Ye]===jr&&x.workspace_path!==void 0?fo(e.root,x.workspace_worktree?x.workspace_worktree.source_path:x.workspace_path,"folder"):null;for(let Rr of new Set([e.root,...er?[er]:[]]))await ss(Rr)}let Le=x[Ye]===Yr||x[Ye]===kt?Bd(process.platform,l.sandboxRuntimeRoot):null,Be=e.headless&&e.runtimeDirectory?e.runtimeDirectory:Le?Le.temporaryRoot:ii();if(ye="private_runtime",e.headless&&e.runtimeDirectory){v(Be);let er=tr(e.root);if(!je(er,Be))throw new r("invalid_hands_workspace","Private worker state must not overlap the granted workspace.")}if(e.headless&&e.runtimeDirectory&&(!e.deviceIdentity||!x.environment_binding))throw new r("environment_unavailable","Headless Hands requires a server-bound private environment.");if(ye="runtime_root",Le?.prepareRoot)Tt(Be,{recursive:!0,mode:457}),Wt(Be,457);ye="temporary_directory";let ke=tr(Id(cr(Be,"reason-hands-session-")));Fe=ke,Wt(ke,Le?.sessionMode??448);let We=cr(ke,"hands-config.json"),nr=cr(ke,"hands-ready.json"),or=yd(),Pr=x.target_fence_id;if(e.workspaceGrant){ye="workspace_grant",w("workspace_grant_wait");let er=e.workspaceGrant;await new Promise((Rr,rt)=>{let ft=()=>rt(new r("cancelled","Reason Hands was cancelled."));if(e.signal.aborted){ft();return}e.signal.addEventListener("abort",ft,{once:!0}),er.then(Rr,rt).finally(()=>e.signal.removeEventListener("abort",ft))})}ye="granted_root";let Ge=tr(e.root);ye="workspace_layout";let sr=x[Ye]===jr&&x.workspace_path!==void 0&&x.workspace_worktree?await qd(Ge,x.workspace_path,x.workspace_worktree):void 0,{workRoot:ir,repoPath:lr,jobEnvPath:Fr,workspacePoolPath:ln,managedWorkspace:Gr,workspace:lt,cloudSessionRoot:Ft}=Qd({grantedRoot:Ge,personalWorkspace:x.personal_workspace===!0,runId:e.runId,workspaceId:x.workspace_id,legacyWorkspaceId:x.legacy_workspace_id,workspaceBase:x[Ce],workspaceLayout:x[Ae],temporaryDirectory:ke,workspaceMode:x[Ye],applicationSupportPath:l.applicationSupportPath,...x.workspace_path===void 0?{}:{workspacePath:x.workspace_path},...x.workspace_worktree?{workspaceWorktree:x.workspace_worktree}:{},...sr?{workspaceWorktreeStart:sr}:{},...e.deviceIdentity?{deviceId:e.deviceIdentity.deviceId}:{}}),Zr="ara_device_wss";ye="jobs";let ur=e.headless&&e.runtimeDirectory?hr({runtimeDirectory:e.runtimeDirectory,root:Ge,runId:e.runId}):void 0;Ve=ur?.disposeSocket;let Mr=ur?Jo(ur):null;if(Mr)try{f(JSON.stringify({event:"hands.journal_owner_retired",run_id:e.runId,reason:Mr.reason,prior_executor_launch_id:Mr.executorLaunchId}))}catch{}if(ur&&[ir,lr].some((er)=>!je(er,ur.journalDirectory)))throw new r("invalid_hands_workspace","A Session can't work in the folder that holds this worker's settings; start it in a project or repository inside it.");let ut=x.personal_workspace?ir.slice(ir.lastIndexOf("/")+1):void 0;if(ut&&ut!==x.workspace_id)throw new r("invalid_hands_workspace","Personal session identity does not match its Device grant.");ye="browser_socket";let Br=x.cloud_browser?jd(x.sandbox_os,ut):process.platform==="win32"?`\\\\.\\pipe\\reason-repl-${or}`:cr(ur?ur.launchDirectory:ke,"repl.sock");ye="relay_url";let Wr=ci(new URL(x.relay_url).hostname),Qr=Zr==="ara_device_wss"&&!Wr?(l.loadProxy??j)()?.url:void 0,Dr;ye="environment_owner";let Ar=e.headless&&e.deviceIdentity&&x.environment_binding?zs(ke,{runId:e.runId,...e.deviceIdentity,binding:x.environment_binding,expiresAtMs:Date.parse(x.expires_at),identity:()=>Dr?.()??null}):void 0;ye="job_environment";let Ct=!Ar&&lt.kind==="managed"&&Gr?cr(ir,"job.env"):null;if(Ct)try{dn(Ct,"",{mode:384,flag:"wx"})}catch(er){if(!(er instanceof Error&&("code"in er)&&er.code==="EEXIST"))throw er}let un={url:x.relay_url,transport:Zr,...Qr===void 0?{}:{proxyUrl:Qr},...e.localGithubConfinement?{localGithubConfinement:!0}:{},...x[Y]&&Ar?{gitCredentialEnvironment:!0}:{},workerVersion:D,protocolVersion:P,workerArtifactSha256:b,workerEntrypoint:R,...process.platform==="win32"?{bashExecutable:se()}:{},targetGeneration:x.target_generation,fenceId:Pr,workRoot:ir,workspaceAliasPath:ir,jobEnvPath:Fr,...Ar?{environmentSnapshotPath:Ar.path,...e.hostExecution?{executionEnvironment:gr()}:{},environmentExpectedBinding:{runId:e.runId,...e.deviceIdentity,binding:x.environment_binding}}:Ct?{jobEnvSourcePath:Ct,workspacePoolPath:Tr(ir)}:Gr?{}:{jobEnvSourcePath:ui(ir)},repoPath:lr,replSocketPath:Br,...x.cloud_browser?{browserRunId:e.runId}:{},readyPath:nr,launchId:or,expiresAtMs:Date.parse(x.expires_at),bashTimeoutMs:300000,replTimeoutMs:120000,...ur?{managedJobs:{journalDirectory:ur.journalDirectory,scopeId:ur.scopeId},jobControlSocketPath:ur.socketPath}:{},...ur&&F?{jobsUser:{...F,...T!==null?{modelGid:T}:{}}}:{},...e.managedPty&&ur&&Ar?{managedPty:{version:1,...e.managedPty.startupVerified===!0?{persistent:!0}:{},...process.platform==="darwin"?{shell:_r()}:{}}}:{},...z&&!he?{allowedTools:["bash","read","write","edit"]}:J?{allowedTools:fe==="bash"?["bash"]:["bash","repl"]}:{}};if(Ar||Gr&&!Ct)dn(Fr,"",{mode:384});else Zd(ir,Fr);ye="config_write",dn(We,JSON.stringify(un),{mode:384}),ye=null;let et={session_id:x.session_id,environment_id:x.environment_id,hands_protocol_version:P,hands_worker_version:D,hands_worker_artifact_sha256:b,hands_worker_entrypoint:R,target_generation:x.target_generation,target_fence_id:x.target_fence_id,executor_launch_id:or},Ut=null,po=!1,_o=!1,mo,Ir=null,ho,go,zt="failed",bo=null,fn=Promise.resolve(),wo=null,pn=async(er,Rr)=>{try{await G(er,Rr)}catch{}};try{w("event_started");let er,Rr=(async()=>{await e.emitEvent("hands.started",{...et,policy_mode:"full_access",policy_version:1,path_source:xe.source}),er=Date.now()})();Rr.catch(()=>{return}),w("worker_setup");let rt=x.browser_egress?{mode:"enforce",allowedDomains:x.browser_egress.allowed_domains}:{mode:"off"};if(fe&&fe!=="bash")Ut=await(l.startNodeRepl??Zs)({socketPath:Br,workRoot:ir});else if(!J&&!x.cloud_browser&&he)Ut=await(l.startRepl??Ts)({socketPath:Br,browserExecutablePath:he,workspaceRoot:lr,...e.managedBrowser?{managedBrowser:e.managedBrowser}:{},...e.desktopRecording?{recording:e.desktopRecording}:{},networkPolicy:rt,onEgressDenied:(Ne)=>{let Nr=Ns(Ne.host);f(JSON.stringify({event:"sandbox.repl_egress_denied",destination_id:Nr,reason:Ne.reason,run_id:e.runId})),fn=fn.then(()=>G("hands.browser_egress_denied",{destination_id:Nr,reason:Ne.reason})).catch((Kt)=>{wo??=Kt})}}).catch((Ne)=>{if(!z||e.signal.aborted||I()>=Date.parse(x.expires_at)||!sl(Ne,Br))throw Ne;return Object.assign(un,{allowedTools:["bash","read","write","edit"]}),dn(We,JSON.stringify(un),{mode:384}),_o=!0,null});let ft=wn({configPath:We,root:lr,grantedRoot:Ge,workRoot:ir,workspacePoolPath:ln,temporaryDirectory:ke,path:xe.path,executablePath:l.executablePath,sourceEntrypoint:l.sourceEntrypoint}),mn=Date.now(),hn,yo,kn=l.takePrespawnedWorker?.(ft)??null;if(mo=l.takePrespawnedWorker?kn!==null:void 0,Ir=kn??(l.spawnWorker??((Ne)=>vd(Ne.command,Ne.args,Ne.options)))(ft),!kn)l.adoptSpawnedWorker?.(Ir);Ir.stderr?.on("data",el(or,(Ne)=>{if(Ne.event==="hands.worker.connecting")hn??=Ne.timestampMs;else if(Ne.event==="hands.worker.open")yo??=Ne.timestampMs;if(f(JSON.stringify({...Ne,run_id:e.runId})),Ne.event==="hands.worker.permission_denied"&&typeof Ne.reason==="string"){let[Nr,Kt]=Ne.reason.split(":");if(["sandbox_policy","os_permission_unknown"].includes(Nr??"")&&["bash","read","write","edit"].includes(Kt??""))G("permission.denied",{provenance:Nr,operation:Kt}).catch(()=>{return})}}));let vo=!1;Ir.on("error",()=>{vo=!0}),Ir.once("exit",(Ne,Nr)=>{try{f(JSON.stringify({event:"hands.worker.exited",run_id:e.runId,launchId:or,exit_code:Ne,exit_signal:Nr}))}catch{}}),Te=Ir,w("worker_ready_wait");let Ht=await rl({path:nr,launchId:or,fenceId:Pr,targetGeneration:x.target_generation,child:Ir,spawnFailed:()=>vo,signal:e.signal,timeoutMs:l.readyTimeoutMs??Hd,now:I}),fi=Date.now();if(Dr=()=>{if(!Ir||Ir.exitCode!==null||Ir.signalCode!==null)return null;let Ne=on(nr,Ht);return Ne?{generation:Ne.targetGeneration,fenceId:Ne.fenceId}:null},ur){let Ne={root:Ge,runId:e.runId,operationId:e.operationId,scopeId:ur.scopeId,socketPath:ur.socketPath,generation:Ht.targetGeneration,fenceId:Ht.fenceId,executorLaunchId:or,expiresAtMs:Date.parse(x.expires_at),readIdentity:Dr,workspace:lt,localGithubConfinement:e.localGithubConfinement===!0};if(Ar)Ne.environment=Ar;if(e.claimOwner&&e.deviceIdentity&&e.claimOwner.device_id===e.deviceIdentity.deviceId){let Nr=[e.deviceIdentity.apiOrigin,x.relay_url];if(Qr)Nr.push(Qr);Ne.previewAuthority={owner:Object.freeze({...e.claimOwner}),rootId:e.deviceIdentity.rootId,relayOrigin:new URL(x.relay_url).origin,deniedPorts:pr(Nr)}}go=Vo(Ne)}if(await new Promise((Ne)=>{setImmediate(Ne)}),Ft)vr(ir);let $t;if(S&&Ar){try{let Ne=Ar.install(S);$t={snapshot_id:Ne.snapshot_id,installed_revision:Ne.installed_revision}}catch{}try{f(JSON.stringify({event:"hands.environment_at_claim",run_id:e.runId,installed:$t!==void 0}))}catch{}}S=void 0;let ko=!1;if(e.headless){let Ne=Kd(lr,F);try{f(JSON.stringify({event:"hands.workspace_check",run_id:e.runId,outcome:Ne}))}catch{}if(Ne==="unready")throw new r("hands_workspace_unready","This Session's checkout is not a readable, writable directory at its own path, so Reason Hands cannot use it.");ko=Ne==="checked"}w("event_ready");let Eo=M(Rr);Eo.catch(()=>{return});let Ro=Date.now();po=!0,await G("hands.ready",{...et,expiry_diagnostic:W,startup_stages:{version:1,browser_resolution_ms:Lr(_.get("browser_resolution"),_.get("path_resolution")),path_resolution_ms:Lr(_.get("path_resolution"),_.get("workspace_setup")),workspace_setup_ms:Lr(_.get("workspace_setup"),_.get("event_started")),repl_setup_ms:Lr(_.get("worker_setup"),mn),worker_boot_ms:Lr(mn,hn),worker_dial_ms:Lr(hn,yo),worker_ready_ms:Lr(mn,fi),started_event_ms:Lr(_.get("event_started"),er),started_join_wait_ms:Lr(_.get("event_ready"),Ro),total_ms:Lr(_.get("entered"),Ro)},...al(e.claimedAtMs,_.get("entered"),mo),...e.managedPty?.startupVerified===!0?{managed_pty:{version:1,execution_mode:"host",descendant_cleanup_verified:!0}}:{},policy_mode:"full_access",policy_version:1,path_source:xe.source,connection_generation:Ht.generation,...$t?{environment_installed:$t}:{},...ko?{workspace_checked:!0}:{},...z&&!Ut?{browser_state:"unavailable",browser_reason_code:_o?"setup_failed":"not_resolved"}:{viewport_width:1440,viewport_height:900}}),await Eo,w("ready"),ho=qs({path:nr,initial:Ht,signal:e.signal,isAlive:()=>Ir!==null&&Ir.exitCode===null&&Ir.signalCode===null&&I()<Date.parse(x.expires_at),publish:(Ne,Nr)=>e.emitEvent("hands.reconnected",{...et,target_generation:Ne.targetGeneration,target_fence_id:Ne.fenceId,connection_generation:Ne.generation},Nr),failed:()=>f(JSON.stringify({event:"hands.worker.generation_proof_failed",run_id:e.runId,executor_launch_id:or}))});let Oo=await nl({child:Ir,signal:e.signal,expiresAt:Date.parse(x.expires_at),now:I});if(Oo==="cancelled"){let Ne=e.signal.reason instanceof r?e.signal.reason.code:"cancelled";throw zt=Ne,new r(Ne,"Reason Hands was cancelled.")}if(Oo==="exited")throw new r("hands_worker_exited","Reason Hands exited unexpectedly.");return zt="expired",{...et,policy_mode:"full_access",policy_version:1,ended:"expired"}}catch(er){bo=er;let Rr=er instanceof r?er.code:"hands_failed",rt=Rr==="cancelled"||["run_finished","run_cancelled","driver_handoff","driver_stopped"].includes(Rr);if(zt=rt?Rr:"failed",!rt)await pn("hands.failed",{...et,reason_code:Rr});throw er}finally{ho?.stop(),go?.();let er=Ir?await tl(Ir,l.stopTimeoutMs??Nd):null,Rr=!1;await e.desktopRecording?.close();try{await Ut?.stop()}catch{Rr=!0}if(await fn,(er==="stopped"||er==="already_exited"&&!po)&&!Rr)await pn("hands.stopped",{...et,reason_code:zt});else if(er!==null||Rr){if(await pn("hands.failed",{...et,reason_code:er==="forced"?"hands_stop_forced":"hands_stop_unconfirmed"}),bo===null||Rr)throw new r("hands_stop_unconfirmed","Reason Hands resource cleanup could not be proven.")}if(wo!==null)throw new r("hands_egress_audit_failed","Reason Hands could not persist a browser egress denial receipt.")}}catch(le){let he=Ds(ye,le);if(he)try{f(JSON.stringify({event:"sandbox.hands_workspace_failed",...he}))}catch{}throw le}finally{try{if(!Te||Te.exitCode!==null||Te.signalCode!==null)Ve?.();if(Fe!==null&&(!Te||Te.exitCode!==null||Te.signalCode!==null))Ad(Fe,{recursive:!0,force:!0})}finally{qe?.(),$e()}}}
 export{B,m,je,te,pr,Gi,hr,Ki,it,Ji,Zi,Xi,Yi,fr,Qi,eo,mr,to,gr,_r,gn,_n,yr,ro,Ue,yn,wr,me,ge,Rt,br,vr,Sr,wn,bn,ot,Ot};

package/bin/vm-hands/{vm-hands-entry-lite-xb6ks2r6.js → vm-hands-entry-lite-axc88qt5.js}

@@ -1,5 +1,5 @@
 // @bun
-import{T}from"./vm-hands-entry-lite-fcvf8md1.js";import{Vr}from"./vm-hands-entry-lite-fapx7y70.js";import{ht}from"./vm-hands-entry-lite-arrmd8qx.js";import{a}from"./vm-hands-entry-lite-cf1x5cbr.js";import{A}from"./vm-hands-entry-lite-vdhgwmmp.js";import{randomUUID as f}from"crypto";import{chmodSync as U,closeSync as h,constants as g,existsSync as me,fstatSync as F,lstatSync as R,mkdirSync as B,openSync as G,readFileSync as Y,readdirSync as z,readlinkSync as J,realpathSync as P,renameSync as _,rmSync as p,statSync as K,symlinkSync as gt,unlinkSync as M,writeFileSync as L}from"fs";import{basename as yt,dirname as S,isAbsolute as fe,join as c,relative as ge,resolve as b,sep as _e}from"path";import{createRequire as H}from"module";var q=1,j=1,ye=128,ve=65536;var he=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var D=/^[a-z0-9_.-]{1,80}$/,be=64,Ee="so.ara.device-broker",Me=[Ee,"com.reasonmachines.device-broker"],Pt=Vr(Me);var we=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function W(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function X(e,t,n=[]){let r=new Set([...t,...n]);return t.every((i)=>(i in e))&&Object.keys(e).every((i)=>r.has(i))}function E(e){return typeof e==="string"&&he.test(e)}function Z(e){return typeof e==="string"&&!Number.isNaN(Date.parse(e))&&new Date(e).toISOString()===e}function k(e){B(e,{recursive:!0,mode:448}),U(e,448)}function Re(e,t){k(S(e));let n=`${e}.${process.pid}.${f()}.tmp`;try{L(n,t,{mode:384,flag:"wx"}),U(n,384),_(n,e)}finally{if(me(n))M(n)}}function gs(e={}){if((e.platform??process.platform)!=="darwin")throw new ht("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let n=e.environment??process.env,r=T(n,"REASON_CLI_CHANNEL")==="staging",i=r?T(n,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,o=e.root!==void 0||Boolean(i&&fe(i))?null:c(e.home??a(),"Library","Application Support"),d=e.root??(o?c(o,r?"Reason Staging":"Reason","CLI"):i);return{executableName:"reason",root:d,...o?{legacyRoot:c(o,"Ara",...r?["staging","runtime"]:["runtime"])}:{},versions:c(d,"versions"),current:c(d,"current"),previous:c(d,"previous"),brokerLock:c(d,"broker.lock"),transitionLock:c(d,"transition.lock"),lifecycleEvents:c(d,"lifecycle-events")}}function _s(e){let t=e.legacyRoot;if(!t)return null;return{root:t,versions:c(t,"versions"),current:c(t,"current"),previous:c(t,"previous"),brokerLock:c(t,"broker.lock"),transitionLock:c(t,"transition.lock"),lifecycleEvents:c(t,"lifecycle-events")}}function pe(e,t){let n;try{if(!R(e).isSymbolicLink())return null;n=J(e)}catch{return null}let r=n.match(/^versions\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\/(ara|Reason|reason)$/);return r&&(r[2]==="ara"||r[2]===t)?r[1]:null}function ys(e){return pe(e.current,e.executableName)}function O(e,t,n){let i=ge(t,e).split(_e);return i.length===2&&E(i[0])&&(i[1]==="ara"||n!==void 0&&i[1]===n)?i[0]:null}function Le(e,t){try{return R(t).isSymbolicLink()&&b(S(t),J(t))===b(e.current)}catch{return!1}}function bs(e,t=process.execPath){try{return O(P(t),P(e.versions),e.executableName)!==null}catch{let n=b(t);return n===b(e.current)||Le(e,n)||O(n,b(e.versions),e.executableName)!==null}}function Ae(e){return W(e)&&X(e,["schema_version","pid","nonce","started_at","runtime_version"])&&e.schema_version===q&&typeof e.pid==="number"&&Number.isSafeInteger(e.pid)&&e.pid>0&&typeof e.nonce==="string"&&/^[0-9a-f-]{36}$/.test(e.nonce)&&Z(e.started_at)&&E(e.runtime_version)}function Q(e,t){try{let n=R(e);if(!n.isDirectory()||!A(n))return null;let r=G(c(e,t),g.O_RDONLY|g.O_NOFOLLOW|g.O_NONBLOCK);try{let i=F(r);if(!i.isFile()||i.nlink!==1||!A(i)||i.size>4096)return null;return Y(r,"utf8")}finally{h(r)}}catch{return null}}function N(e){try{let t=JSON.parse(Q(e,"owner.json")??"null");return Ae(t)?t:null}catch{return null}}function ee(e){try{return process.kill(e,0),!0}catch(t){return!(t instanceof Error&&("code"in t)&&t.code==="ESRCH")}}var C="lease",Ne=2,Se=4,y;function ke(){if(y!==void 0)return y;if(y=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let e;try{e=H(import.meta.url)("bun:ffi")}catch{return null}let t=process.platform==="darwin"?"__error":"__errno_location",n=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let r of n)try{let i=e.dlopen(r,{flock:{args:[e.FFIType.i32,e.FFIType.i32],returns:e.FFIType.i32},[t]:{args:[],returns:e.FFIType.ptr}}),s=i.symbols[t]();if(s===null)continue;return y={flock:(o,d)=>i.symbols.flock(o,d),errno:()=>e.read.i32(s),wouldBlock:process.platform==="darwin"?35:11},y}catch{}return null}var v,Ie=3221225472,Te=4,xe=128,Pe=32;function De(e){if(v===void 0){v=null;try{let s=H(import.meta.url)("bun:ffi"),{FFIType:o}=s;v={kernel:s.dlopen("kernel32.dll",{CreateFileW:{args:[o.ptr,o.u32,o.u32,o.ptr,o.u32,o.u32,o.ptr],returns:o.i64_fast},CloseHandle:{args:[o.i64_fast],returns:o.i32},GetLastError:{args:[],returns:o.u32}}).symbols,ptr:(l)=>s.ptr(l)}}catch{return null}}if(!v)return null;let{kernel:t,ptr:n}=v,r=Buffer.from(`${e}\x00`,"utf16le"),i=t.CreateFileW(n(r),Ie,0,null,Te,xe,null);if(Number(i)===-1)return t.GetLastError()===Pe?"busy":null;return{release:()=>{t.CloseHandle(i)}}}function Oe(e){if(process.platform==="win32")return De(`${e}.lease`);let t=ke();if(!t)return null;let n=G(`${e}.lease`,g.O_RDWR|g.O_CREAT|g.O_NOFOLLOW,384);try{let r=F(n);if(!r.isFile()||r.nlink!==1||!A(r))return h(n),"busy";if(t.flock(n,Ne|Se)===0)return{release:()=>h(n)};let i=t.errno();return h(n),i===t.wouldBlock?"busy":null}catch(r){throw h(n),r}}function vs(e){k(S(e.path));let t=Oe(e.path);if(t==="busy")return{acquired:!1,owner:N(e.path),recoveredStaleOwner:!1};let n=t!==null;try{let r=Ce(e,t);if(r.acquired)n=!1;return r}finally{if(n)t.release()}}function Ce(e,t){let n=e.alive??ee,r=!1;for(let i=0;i<4;i+=1){let s={schema_version:q,pid:e.pid??process.pid,nonce:e.nonce?.()??f(),started_at:(e.now?.()??new Date).toISOString(),runtime_version:e.runtimeVersion},o=`${e.path}.init-${process.pid}-${f()}`,d=!1;try{if(B(o,{mode:448}),L(c(o,"owner.json"),`${JSON.stringify(s)}
+import{T}from"./vm-hands-entry-lite-fcvf8md1.js";import{Vr}from"./vm-hands-entry-lite-va9q8qh7.js";import{ht}from"./vm-hands-entry-lite-arrmd8qx.js";import{a}from"./vm-hands-entry-lite-cf1x5cbr.js";import{A}from"./vm-hands-entry-lite-vdhgwmmp.js";import{randomUUID as f}from"crypto";import{chmodSync as U,closeSync as h,constants as g,existsSync as me,fstatSync as F,lstatSync as R,mkdirSync as B,openSync as G,readFileSync as Y,readdirSync as z,readlinkSync as J,realpathSync as P,renameSync as _,rmSync as p,statSync as K,symlinkSync as gt,unlinkSync as M,writeFileSync as L}from"fs";import{basename as yt,dirname as S,isAbsolute as fe,join as c,relative as ge,resolve as b,sep as _e}from"path";import{createRequire as H}from"module";var q=1,j=1,ye=128,ve=65536;var he=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var D=/^[a-z0-9_.-]{1,80}$/,be=64,Ee="so.ara.device-broker",Me=[Ee,"com.reasonmachines.device-broker"],Pt=Vr(Me);var we=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function W(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function X(e,t,n=[]){let r=new Set([...t,...n]);return t.every((i)=>(i in e))&&Object.keys(e).every((i)=>r.has(i))}function E(e){return typeof e==="string"&&he.test(e)}function Z(e){return typeof e==="string"&&!Number.isNaN(Date.parse(e))&&new Date(e).toISOString()===e}function k(e){B(e,{recursive:!0,mode:448}),U(e,448)}function Re(e,t){k(S(e));let n=`${e}.${process.pid}.${f()}.tmp`;try{L(n,t,{mode:384,flag:"wx"}),U(n,384),_(n,e)}finally{if(me(n))M(n)}}function gs(e={}){if((e.platform??process.platform)!=="darwin")throw new ht("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let n=e.environment??process.env,r=T(n,"REASON_CLI_CHANNEL")==="staging",i=r?T(n,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,o=e.root!==void 0||Boolean(i&&fe(i))?null:c(e.home??a(),"Library","Application Support"),d=e.root??(o?c(o,r?"Reason Staging":"Reason","CLI"):i);return{executableName:"reason",root:d,...o?{legacyRoot:c(o,"Ara",...r?["staging","runtime"]:["runtime"])}:{},versions:c(d,"versions"),current:c(d,"current"),previous:c(d,"previous"),brokerLock:c(d,"broker.lock"),transitionLock:c(d,"transition.lock"),lifecycleEvents:c(d,"lifecycle-events")}}function _s(e){let t=e.legacyRoot;if(!t)return null;return{root:t,versions:c(t,"versions"),current:c(t,"current"),previous:c(t,"previous"),brokerLock:c(t,"broker.lock"),transitionLock:c(t,"transition.lock"),lifecycleEvents:c(t,"lifecycle-events")}}function pe(e,t){let n;try{if(!R(e).isSymbolicLink())return null;n=J(e)}catch{return null}let r=n.match(/^versions\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\/(ara|Reason|reason)$/);return r&&(r[2]==="ara"||r[2]===t)?r[1]:null}function ys(e){return pe(e.current,e.executableName)}function O(e,t,n){let i=ge(t,e).split(_e);return i.length===2&&E(i[0])&&(i[1]==="ara"||n!==void 0&&i[1]===n)?i[0]:null}function Le(e,t){try{return R(t).isSymbolicLink()&&b(S(t),J(t))===b(e.current)}catch{return!1}}function bs(e,t=process.execPath){try{return O(P(t),P(e.versions),e.executableName)!==null}catch{let n=b(t);return n===b(e.current)||Le(e,n)||O(n,b(e.versions),e.executableName)!==null}}function Ae(e){return W(e)&&X(e,["schema_version","pid","nonce","started_at","runtime_version"])&&e.schema_version===q&&typeof e.pid==="number"&&Number.isSafeInteger(e.pid)&&e.pid>0&&typeof e.nonce==="string"&&/^[0-9a-f-]{36}$/.test(e.nonce)&&Z(e.started_at)&&E(e.runtime_version)}function Q(e,t){try{let n=R(e);if(!n.isDirectory()||!A(n))return null;let r=G(c(e,t),g.O_RDONLY|g.O_NOFOLLOW|g.O_NONBLOCK);try{let i=F(r);if(!i.isFile()||i.nlink!==1||!A(i)||i.size>4096)return null;return Y(r,"utf8")}finally{h(r)}}catch{return null}}function N(e){try{let t=JSON.parse(Q(e,"owner.json")??"null");return Ae(t)?t:null}catch{return null}}function ee(e){try{return process.kill(e,0),!0}catch(t){return!(t instanceof Error&&("code"in t)&&t.code==="ESRCH")}}var C="lease",Ne=2,Se=4,y;function ke(){if(y!==void 0)return y;if(y=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let e;try{e=H(import.meta.url)("bun:ffi")}catch{return null}let t=process.platform==="darwin"?"__error":"__errno_location",n=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let r of n)try{let i=e.dlopen(r,{flock:{args:[e.FFIType.i32,e.FFIType.i32],returns:e.FFIType.i32},[t]:{args:[],returns:e.FFIType.ptr}}),s=i.symbols[t]();if(s===null)continue;return y={flock:(o,d)=>i.symbols.flock(o,d),errno:()=>e.read.i32(s),wouldBlock:process.platform==="darwin"?35:11},y}catch{}return null}var v,Ie=3221225472,Te=4,xe=128,Pe=32;function De(e){if(v===void 0){v=null;try{let s=H(import.meta.url)("bun:ffi"),{FFIType:o}=s;v={kernel:s.dlopen("kernel32.dll",{CreateFileW:{args:[o.ptr,o.u32,o.u32,o.ptr,o.u32,o.u32,o.ptr],returns:o.i64_fast},CloseHandle:{args:[o.i64_fast],returns:o.i32},GetLastError:{args:[],returns:o.u32}}).symbols,ptr:(l)=>s.ptr(l)}}catch{return null}}if(!v)return null;let{kernel:t,ptr:n}=v,r=Buffer.from(`${e}\x00`,"utf16le"),i=t.CreateFileW(n(r),Ie,0,null,Te,xe,null);if(Number(i)===-1)return t.GetLastError()===Pe?"busy":null;return{release:()=>{t.CloseHandle(i)}}}function Oe(e){if(process.platform==="win32")return De(`${e}.lease`);let t=ke();if(!t)return null;let n=G(`${e}.lease`,g.O_RDWR|g.O_CREAT|g.O_NOFOLLOW,384);try{let r=F(n);if(!r.isFile()||r.nlink!==1||!A(r))return h(n),"busy";if(t.flock(n,Ne|Se)===0)return{release:()=>h(n)};let i=t.errno();return h(n),i===t.wouldBlock?"busy":null}catch(r){throw h(n),r}}function vs(e){k(S(e.path));let t=Oe(e.path);if(t==="busy")return{acquired:!1,owner:N(e.path),recoveredStaleOwner:!1};let n=t!==null;try{let r=Ce(e,t);if(r.acquired)n=!1;return r}finally{if(n)t.release()}}function Ce(e,t){let n=e.alive??ee,r=!1;for(let i=0;i<4;i+=1){let s={schema_version:q,pid:e.pid??process.pid,nonce:e.nonce?.()??f(),started_at:(e.now?.()??new Date).toISOString(),runtime_version:e.runtimeVersion},o=`${e.path}.init-${process.pid}-${f()}`,d=!1;try{if(B(o,{mode:448}),L(c(o,"owner.json"),`${JSON.stringify(s)}
 `,{mode:384,flag:"wx"}),t!==null)L(c(o,C),`flock
 `,{mode:384,flag:"wx"});e.beforePublish?.();try{throw R(e.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(m){if(m.code!=="ENOENT")throw m}_(o,e.path),d=!0;let l=!1;return{acquired:!0,owner:s,recoveredStaleOwner:r,release(){if(l)return;if(l=!0,N(e.path)?.nonce===s.nonce)p(e.path,{recursive:!0,force:!0});t?.release()}}}catch(l){let m=l.code;if(!["EEXIST","ENOTEMPTY"].includes(m??""))throw l;let u=N(e.path),re=(e.now?.()??new Date).getTime(),ie=u&&e.staleAfterMs!==void 0?re-Date.parse(u.started_at)<e.staleAfterMs:!1,ae=u!==null&&!(t!==null&&Q(e.path,C)!==null)&&n(u.pid);if(!u||ae||ie)return{acquired:!1,owner:u,recoveredStaleOwner:!1};let I=`${e.path}.stale-${process.pid}-${f()}`;try{_(e.path,I),p(I,{recursive:!0,force:!0}),r=!0}catch(x){let oe=x.code;if(!["ENOENT","EEXIST"].includes(oe??""))throw x}}finally{if(!d)p(o,{recursive:!0,force:!0})}}throw new ht("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function te(e){return W(e)&&X(e,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&e.schema_version===j&&typeof e.event_id==="string"&&/^[0-9a-f-]{36}$/.test(e.event_id)&&Z(e.occurred_at)&&typeof e.event==="string"&&we.includes(e.event)&&E(e.runtime_version)&&(e.from_version===void 0||E(e.from_version))&&(e.to_version===void 0||E(e.to_version))&&(e.reason_code===void 0||typeof e.reason_code==="string"&&D.test(e.reason_code))&&(e.duration_ms===void 0||typeof e.duration_ms==="number"&&Number.isSafeInteger(e.duration_ms)&&e.duration_ms>=0&&e.duration_ms<=86400000)&&(e.attempt_count===void 0||typeof e.attempt_count==="number"&&Number.isSafeInteger(e.attempt_count)&&e.attempt_count>=1&&e.attempt_count<=1e5)&&(e.retry_in_ms===void 0||typeof e.retry_in_ms==="number"&&Number.isSafeInteger(e.retry_in_ms)&&e.retry_in_ms>=0&&e.retry_in_ms<=30000)&&(e.capabilities===void 0||Array.isArray(e.capabilities)&&e.capabilities.length<=be&&e.capabilities.every((t)=>typeof t==="string"&&D.test(t)))}var Ve=/^(\d{22}-[0-9a-f-]{36}\.json)$/,Ue=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,Fe=300000,w=0n;function Be(e){let t=BigInt(new Date(e.occurred_at).getTime())*1000000n;return w=t>w?t:w+1n,`${String(w).padStart(22,"0")}-${e.event_id}.json`}function ne(e){try{return z(e.lifecycleEvents).filter((t)=>Ve.test(t)).sort()}catch{return[]}}function V(e){try{let t=JSON.parse(Y(e,"utf8"));return te(t)?t:null}catch{return null}}function $e(e,t=ee,n=Date.now()){let r;try{r=z(e.lifecycleEvents)}catch{return}for(let i of r){let s=i.match(Ue);if(!s)continue;let o=c(e.lifecycleEvents,i),d=c(e.lifecycleEvents,s[1]),l=!t(Number(s[2]));if(!l)try{l=n-K(o).mtimeMs>=Fe}catch{continue}if(!l)continue;try{_(o,d)}catch(m){let u=m.code;if(u==="EEXIST")M(o);else if(u!=="ENOENT")throw m}}}function Ge(e){let n=ne(e).flatMap((i)=>{try{return[{name:i,size:K(c(e.lifecycleEvents,i)).size}]}catch{return[]}}),r=n.reduce((i,s)=>i+s.size,0);while(n.length>ye||r>ve){let i=n.shift();if(!i)break;try{M(c(e.lifecycleEvents,i.name)),r-=i.size}catch(s){if(s.code!=="ENOENT")throw s}}}function Ss(e,t,n={}){let r={schema_version:j,event_id:n.eventId?.()??f(),occurred_at:(n.now?.()??new Date).toISOString(),...t};if(!te(r))throw new ht("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return k(e.lifecycleEvents),Re(c(e.lifecycleEvents,Be(r)),`${JSON.stringify(r)}
 `),Ge(e),r}async function Es(e,t,n){$e(e);let r=0;for(let i of ne(e)){let s=c(e.lifecycleEvents,i);if(n){let l=V(s);if(!l||!n(l))continue}let o=`${s}.sending-${process.pid}-${f()}`;try{_(s,o)}catch(l){if(l.code==="ENOENT")continue;throw l}let d=V(o);if(!d){M(o);continue}try{await t(d),M(o),r+=1}catch{try{_(o,s)}catch(l){if(l.code!=="ENOENT")throw l}break}}return r}export{gs,_s,ys,bs,vs,Ss,Es};

package/bin/vm-hands/vm-hands-entry-lite-frb11zec.js

@@ -0,0 +1,2 @@
+// @bun
+import{Qt}from"./vm-hands-entry-lite-j7gv6vvr.js";var mt=Qt.version;export{mt};

package/bin/vm-hands/{vm-hands-entry-lite-pk94gtvb.js → vm-hands-entry-lite-g916c0tx.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ge,ut}from"./vm-hands-entry-lite-jyvmw8b7.js";import{mt}from"./vm-hands-entry-lite-9zjqe34s.js";import{Ao,le,Gr,ft,Po}from"./vm-hands-entry-lite-fapx7y70.js";import{E}from"./vm-hands-entry-lite-txd50spx.js";import{a,tr}from"./vm-hands-entry-lite-cf1x5cbr.js";import{spawnSync as H}from"child_process";import{dirname as w}from"path";import{spawn as A}from"child_process";import{accessSync as _,constants as v}from"fs";import{basename as C,join as O}from"path";var l=null;function S(e){if(l===e)l=null;if(e.exitCode===null&&e.signalCode===null)e.kill("SIGTERM")}var Rr=(e,t)=>{if(l)S(l);let s=O(e,Ao);try{_(s,v.X_OK)}catch{return()=>{}}let n;try{n=A(s,["--app",e,"--name",C(e,".app"),"--permission",t==="screen"?"screen_recording":"accessibility"],{detached:!0,stdio:"ignore"})}catch{return()=>{}}return n.on("error",()=>{if(l===n)l=null}),n.once("exit",()=>{if(l===n)l=null}),n.unref(),l=n,()=>S(n)};import{chmodSync as ne,existsSync as se,mkdirSync as re,readFileSync as D,realpathSync as ie,renameSync as oe,statSync as j,writeFileSync as ae}from"fs";import{dirname as de,isAbsolute as G,join as N,resolve as T,sep as b}from"path";function F(e=a()){return N(tr(e),"reason","protected-path-grants.json")}var f=null;function L(e){let t=JSON.parse(e);if(!Array.isArray(t?.grants))return[];return t.grants.flatMap((s)=>{let n=s;return n&&typeof n.path==="string"&&G(n.path)&&(n.kind==="file"||n.kind==="folder")&&typeof n.grantedAt==="number"?[{path:n.path,kind:n.kind,grantedAt:n.grantedAt}]:[]})}function y(e=F()){try{let{mtimeMs:t}=j(e);if(f&&f.file===e&&f.mtimeMs===t)return f.grants;let s=L(D(e,"utf8"));return f={file:e,mtimeMs:t,grants:s},s}catch{return[]}}function W(e,t){return e.kind==="file"?t===e.path:t===e.path||t.startsWith(`${e.path}${b}`)}function U(e,t){let s=T(e);return y(t).some((n)=>W(n,s))}function po(e,t){return E(e)&&!U(e,t)}function ho(e,t,s){let n=t?"file-read* file-write*":"file-read*";return y(s).filter((r)=>r.path===e||r.path.startsWith(`${e}${b}`)).map((r)=>`(allow ${n} (${r.kind==="file"?"literal":"subpath"} ${JSON.stringify(r.path)}))`)}var P="x-apple.systempreferences:com.apple.preference.security",J="curl -fsSL https://reasonmachines.com/install.sh | bash",q=180000,B=2000;var k={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${P}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${P}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${P}?Privacy_AllFiles`}};function R(e){return e.executable}function K(e,t){if(e==="computer_use_identity_missing")return`Reason's background identity is not installed (${e}); reinstall Reason: ${J}`;if(e==="computer_use_identity_outdated")return`Reason's background identity is outdated (${Gr(t)??"unknown"}; this CLI is ${mt}) (${e}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${e}); run the installed \`reason\``}function Yo(e=a()){let t=ft(e);if(t.length>0)return{state:"ready",path:w(w(w(t[0]))),prefix:t};let s=Po(t,e)??"computer_use_identity_unavailable";return{state:s,path:le(e),detail:K(s,e)}}function V(){return{identity:()=>Yo(),grants:(e)=>Ge(e),request:(e,t)=>ut(e,t),worker:async()=>(await import("./status-vqkxrfr8.js")).connectionMacState(),open:(e)=>{H("/usr/bin/open",e,{stdio:"ignore",timeout:1e4})},tile:Rr,restartConnection:async()=>(await import("./connect-cli-vszbx3gr.js")).restartConnection(),sleep:(e)=>new Promise((t)=>setTimeout(t,e)),now:()=>Date.now()}}function M(e,t,s){if(e.state!=="ready"||!t)return"unknown";return t[s]?"granted":"missing"}async function Qo(e){let t=e.identity(),s=t.state==="ready"?await e.grants(t.prefix):null,n=await e.worker(),r=n?R(n):null,i=!r||n?.full_disk_access==="unknown"?"unknown":n?.full_disk_access==="granted"?"granted":"missing",c=(u,d,o)=>{let{label:p,purpose:h,level:m}=k[u];return{id:u,label:p,purpose:h,level:m,state:d,holder:o}};return{identity:{state:t.state,path:t.path,detail:t.state==="ready"?null:t.detail},worker_detail:r?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[c("screen",M(t,s,"screen"),t.path),c("accessibility",M(t,s,"accessibility"),t.path),c("disk",i,r)]}}function Ls(e){let t=e.identity.state==="ready"?null:e.identity.state,s=e.permissions.filter((i)=>i.state==="granted").length,n=[...t?[t]:[],...e.permissions.filter((i)=>i.state!=="granted"&&!(t&&i.id!=="disk")).map((i)=>`${i.label} ${i.state}`)],r=!t&&e.permissions.some((i)=>i.state==="missing");return`Permissions: ${s} of ${e.permissions.length}${n.length>0?` (${n.join(", ")})`:""}`+(r?" \u2014 reason permissions allow":n.length>0?" \u2014 reason permissions":"")}async function x(e,t){let s=t.now()+q;for(;;){if(await e())return!0;if(t.now()>=s)return!1;await t.sleep(B)}}async function Ms(e,t){let s=t.host??V(),{io:n}=t,r=await Qo(s),i=r.permissions.filter((o)=>e.includes(o.id)&&o.state!=="granted");if(i.length===0)return n.stdout.write(`Reason permissions: ${e.map((o)=>k[o].label).join(", ")} already allowed.
+import{Ge,ut}from"./vm-hands-entry-lite-jyvmw8b7.js";import{mt}from"./vm-hands-entry-lite-frb11zec.js";import{Ao,le,Gr,ft,Po}from"./vm-hands-entry-lite-va9q8qh7.js";import{E}from"./vm-hands-entry-lite-txd50spx.js";import{a,tr}from"./vm-hands-entry-lite-cf1x5cbr.js";import{spawnSync as H}from"child_process";import{dirname as w}from"path";import{spawn as A}from"child_process";import{accessSync as _,constants as v}from"fs";import{basename as C,join as O}from"path";var l=null;function S(e){if(l===e)l=null;if(e.exitCode===null&&e.signalCode===null)e.kill("SIGTERM")}var Rr=(e,t)=>{if(l)S(l);let s=O(e,Ao);try{_(s,v.X_OK)}catch{return()=>{}}let n;try{n=A(s,["--app",e,"--name",C(e,".app"),"--permission",t==="screen"?"screen_recording":"accessibility"],{detached:!0,stdio:"ignore"})}catch{return()=>{}}return n.on("error",()=>{if(l===n)l=null}),n.once("exit",()=>{if(l===n)l=null}),n.unref(),l=n,()=>S(n)};import{chmodSync as ne,existsSync as se,mkdirSync as re,readFileSync as D,realpathSync as ie,renameSync as oe,statSync as j,writeFileSync as ae}from"fs";import{dirname as de,isAbsolute as G,join as N,resolve as T,sep as b}from"path";function F(e=a()){return N(tr(e),"reason","protected-path-grants.json")}var f=null;function L(e){let t=JSON.parse(e);if(!Array.isArray(t?.grants))return[];return t.grants.flatMap((s)=>{let n=s;return n&&typeof n.path==="string"&&G(n.path)&&(n.kind==="file"||n.kind==="folder")&&typeof n.grantedAt==="number"?[{path:n.path,kind:n.kind,grantedAt:n.grantedAt}]:[]})}function y(e=F()){try{let{mtimeMs:t}=j(e);if(f&&f.file===e&&f.mtimeMs===t)return f.grants;let s=L(D(e,"utf8"));return f={file:e,mtimeMs:t,grants:s},s}catch{return[]}}function W(e,t){return e.kind==="file"?t===e.path:t===e.path||t.startsWith(`${e.path}${b}`)}function U(e,t){let s=T(e);return y(t).some((n)=>W(n,s))}function po(e,t){return E(e)&&!U(e,t)}function ho(e,t,s){let n=t?"file-read* file-write*":"file-read*";return y(s).filter((r)=>r.path===e||r.path.startsWith(`${e}${b}`)).map((r)=>`(allow ${n} (${r.kind==="file"?"literal":"subpath"} ${JSON.stringify(r.path)}))`)}var P="x-apple.systempreferences:com.apple.preference.security",J="curl -fsSL https://reasonmachines.com/install.sh | bash",q=180000,B=2000;var k={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${P}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${P}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${P}?Privacy_AllFiles`}};function R(e){return e.executable}function K(e,t){if(e==="computer_use_identity_missing")return`Reason's background identity is not installed (${e}); reinstall Reason: ${J}`;if(e==="computer_use_identity_outdated")return`Reason's background identity is outdated (${Gr(t)??"unknown"}; this CLI is ${mt}) (${e}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${e}); run the installed \`reason\``}function Yo(e=a()){let t=ft(e);if(t.length>0)return{state:"ready",path:w(w(w(t[0]))),prefix:t};let s=Po(t,e)??"computer_use_identity_unavailable";return{state:s,path:le(e),detail:K(s,e)}}function V(){return{identity:()=>Yo(),grants:(e)=>Ge(e),request:(e,t)=>ut(e,t),worker:async()=>(await import("./status-cfmb6538.js")).connectionMacState(),open:(e)=>{H("/usr/bin/open",e,{stdio:"ignore",timeout:1e4})},tile:Rr,restartConnection:async()=>(await import("./connect-cli-8qpnd6ts.js")).restartConnection(),sleep:(e)=>new Promise((t)=>setTimeout(t,e)),now:()=>Date.now()}}function M(e,t,s){if(e.state!=="ready"||!t)return"unknown";return t[s]?"granted":"missing"}async function Qo(e){let t=e.identity(),s=t.state==="ready"?await e.grants(t.prefix):null,n=await e.worker(),r=n?R(n):null,i=!r||n?.full_disk_access==="unknown"?"unknown":n?.full_disk_access==="granted"?"granted":"missing",c=(u,d,o)=>{let{label:p,purpose:h,level:m}=k[u];return{id:u,label:p,purpose:h,level:m,state:d,holder:o}};return{identity:{state:t.state,path:t.path,detail:t.state==="ready"?null:t.detail},worker_detail:r?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[c("screen",M(t,s,"screen"),t.path),c("accessibility",M(t,s,"accessibility"),t.path),c("disk",i,r)]}}function Ls(e){let t=e.identity.state==="ready"?null:e.identity.state,s=e.permissions.filter((i)=>i.state==="granted").length,n=[...t?[t]:[],...e.permissions.filter((i)=>i.state!=="granted"&&!(t&&i.id!=="disk")).map((i)=>`${i.label} ${i.state}`)],r=!t&&e.permissions.some((i)=>i.state==="missing");return`Permissions: ${s} of ${e.permissions.length}${n.length>0?` (${n.join(", ")})`:""}`+(r?" \u2014 reason permissions allow":n.length>0?" \u2014 reason permissions":"")}async function x(e,t){let s=t.now()+q;for(;;){if(await e())return!0;if(t.now()>=s)return!1;await t.sleep(B)}}async function Ms(e,t){let s=t.host??V(),{io:n}=t,r=await Qo(s),i=r.permissions.filter((o)=>e.includes(o.id)&&o.state!=="granted");if(i.length===0)return n.stdout.write(`Reason permissions: ${e.map((o)=>k[o].label).join(", ")} already allowed.
 `),0;let c=!1,u=!1,d=s.identity();for(let o of i){let{label:p,pane:h}=k[o.id];if(o.id!=="disk"){if(d.state!=="ready"){if(!c)n.stderr.write(`Reason permissions: ${d.detail}
 `);c=!0;continue}let g=o.id;await s.request(d.prefix,g),s.open([h]);let I=s.tile(d.path,g);if(n.stdout.write(`Allow Reason in System Settings > Privacy & Security > ${p}.
 `),!t.wait)continue;if(n.stdout.write(`Waiting for it (Ctrl-C to stop)\u2026

package/bin/vm-hands/{vm-hands-entry-lite-xhxxgn3b.js → vm-hands-entry-lite-j7gv6vvr.js}

@@ -1,3 +1,3 @@
 // @bun
-var Qt={name:"github-native-engineer-device-worker-production",version:"0.2.480",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@agentclientprotocol/sdk":"1.9.0","@anthropic-ai/sandbox-runtime":"^0.0.80","@earendil-works/pi-tui":"1.0.0","@reason/runtime-distribution":"workspace:*",diff:"8.0.4","open-browser-use-sdk":"0.1.42","playwright-core":"1.60.0",toml:"4.2.0",zod:"^4.4.3"},overrides:{"@hono/node-server":"^1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"^1.20.0","basic-ftp":"^6.2.1","@grpc/grpc-js":"^1.14.5",browserslist:"^4.28.8","engine.io":"^6.6.7","fast-uri":"^3.1.8",hono:"^4.13.7","ip-address":"^10.7.1",nanoid:"^3.3.18",dompurify:"^3.4.17",postcss:"^8.5.23",qs:"^6.16.0","shell-quote":"^1.11.0","socket.io-parser":"^4.2.7",tmp:"^0.2.7",toml:"^4.2.0",undici:"^8.10.2",ws:"^8.21.0","js-yaml":"^4.3.2","@modelcontextprotocol/sdk":"^1.31.0","proxy-addr":"^2.0.8","source-map-js":"^1.2.2"}};
+var Qt={name:"github-native-engineer-device-worker-production",version:"0.2.483",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@agentclientprotocol/sdk":"1.9.0","@anthropic-ai/sandbox-runtime":"^0.0.80","@earendil-works/pi-tui":"1.0.0","@reason/runtime-distribution":"workspace:*",diff:"8.0.4","open-browser-use-sdk":"0.1.42","playwright-core":"1.60.0",toml:"4.2.0",zod:"^4.4.3"},overrides:{"@hono/node-server":"^1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"^1.20.0","basic-ftp":"^6.2.1","@grpc/grpc-js":"^1.14.5",browserslist:"^4.28.8","engine.io":"^6.6.7","fast-uri":"^3.1.8",hono:"^4.13.7","ip-address":"^10.7.1",nanoid:"^3.3.18",dompurify:"^3.4.17",postcss:"^8.5.23",qs:"^6.16.0","shell-quote":"^1.11.0","socket.io-parser":"^4.2.7",tmp:"^0.2.7",toml:"^4.2.0",undici:"^8.10.2",ws:"^8.21.0","js-yaml":"^4.3.2","@modelcontextprotocol/sdk":"^1.31.0","proxy-addr":"^2.0.8","source-map-js":"^1.2.2"}};
 export{Qt};

package/bin/vm-hands/{vm-hands-entry-lite-3q885ynr.js → vm-hands-entry-lite-qm1tvr26.js}

@@ -1,5 +1,5 @@
 // @bun
-import{S,zt,Mn,Ge,$n,Bn}from"./vm-hands-entry-lite-jyvmw8b7.js";import{Xn}from"./vm-hands-entry-lite-fapx7y70.js";import{Gn}from"./vm-hands-entry-lite-fykfnzjg.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ys,spawn as qe}from"child_process";import{existsSync as ws}from"fs";import{connect as xs}from"net";function pn(){let e=new Set,t=null,n=(s)=>({holder:t?.viewer??null,you:t===s,same_user:Boolean(t?.viewer&&s.viewer&&t.viewer.user_id===s.viewer.user_id)}),o=()=>{for(let s of e)s.notify(n(s))};return{join(s){return e.add(s),s.notify(n(s)),()=>{if(!e.delete(s))return;if(t!==s)return;t=null,o()}},claim(s){if(t===s||!e.has(s))return;t=s,o()}}}var ut=pn();import{createHash as St}from"crypto";import{once as Sn}from"events";import{createWriteStream as vn,existsSync as mr,mkdirSync as gr,mkdtempSync as hr,readFileSync as le,readdirSync as br,renameSync as yr,realpathSync as En,rmSync as Pn,statSync as Ne,writeFileSync as wr}from"fs";import{delimiter as _r,dirname as vt,join as b}from"path";import{finished as Cn}from"stream/promises";var We="omljlfpmafedpplnpkkahegadhkimdje",co="https://chromewebstore.google.com/detail/reason/omljlfpmafedpplnpkkahegadhkimdje";var O={ocu:{repository:"https://github.com/iFurySt/open-codex-computer-use.git",revision:"386a260d1ab8b690adbbb27f7471595cf0c2b752",version:"0.3.5"},obu:{repository:"https://github.com/iFurySt/open-browser-use.git",revision:"ac015846df75928fbcf0f3a0f3ba3a210ce1a507",version:"0.1.42"}},H={version:"155.0.8059.84",macArm64Sha256:"13b9e98ce56f5ce18e100a009f455c9285f399e7c9dc8a76fdf2f3a9755bb5f2",linux64Sha256:"cf0f049892dea22e6a6db26d47ed0d7776b7158edcbec4634086633df8bafcbc",win64Sha256:"507f2a031441d10c62b5e3d4e863f09ac1198a571c1419976cbd8387f639afde"};var J={ocu:{url:`https://registry.npmjs.org/open-computer-use/-/open-computer-use-${O.ocu.version}.tgz`,sha256:"7c16a87c8cd357787b02c0ebd040dd5f93880c1fb51c1901caa2e0c05d063130",size_bytes:5844280},obu:{url:`https://registry.npmjs.org/open-browser-use/-/open-browser-use-${O.obu.version}.tgz`,sha256:"9386d8ce0a147b3f55e1807b68edf736836378807541c457c9b5f6ca2cabaa4e",size_bytes:21372018},extension:{url:`https://github.com/iFurySt/open-browser-use/releases/download/v${O.obu.version}/open-browser-use-chrome-extension-${O.obu.version}.zip`,sha256:"c9c07bec1175e12ea6985b0e7784a5ef01fd03f014b958224a1e17dcd838a241",size_bytes:31070}},F="pnbmoicbkopffjjgfgfglopechaiemkp";import{spawn as Me}from"child_process";import{createRequire as fn}from"module";import{join as mn}from"path";var gn=30000,hn=1048576;function Te(){return process.env.SystemRoot??"C:\\Windows"}function bn(){return mn(Te(),"System32","WindowsPowerShell","v1.0","powershell.exe")}var yn=String.raw`
+import{S,zt,Mn,Ge,$n,Bn}from"./vm-hands-entry-lite-jyvmw8b7.js";import{Xn}from"./vm-hands-entry-lite-va9q8qh7.js";import{Gn}from"./vm-hands-entry-lite-fykfnzjg.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ys,spawn as qe}from"child_process";import{existsSync as ws}from"fs";import{connect as xs}from"net";function pn(){let e=new Set,t=null,n=(s)=>({holder:t?.viewer??null,you:t===s,same_user:Boolean(t?.viewer&&s.viewer&&t.viewer.user_id===s.viewer.user_id)}),o=()=>{for(let s of e)s.notify(n(s))};return{join(s){return e.add(s),s.notify(n(s)),()=>{if(!e.delete(s))return;if(t!==s)return;t=null,o()}},claim(s){if(t===s||!e.has(s))return;t=s,o()}}}var ut=pn();import{createHash as St}from"crypto";import{once as Sn}from"events";import{createWriteStream as vn,existsSync as mr,mkdirSync as gr,mkdtempSync as hr,readFileSync as le,readdirSync as br,renameSync as yr,realpathSync as En,rmSync as Pn,statSync as Ne,writeFileSync as wr}from"fs";import{delimiter as _r,dirname as vt,join as b}from"path";import{finished as Cn}from"stream/promises";var We="omljlfpmafedpplnpkkahegadhkimdje",co="https://chromewebstore.google.com/detail/reason/omljlfpmafedpplnpkkahegadhkimdje";var O={ocu:{repository:"https://github.com/iFurySt/open-codex-computer-use.git",revision:"386a260d1ab8b690adbbb27f7471595cf0c2b752",version:"0.3.5"},obu:{repository:"https://github.com/iFurySt/open-browser-use.git",revision:"ac015846df75928fbcf0f3a0f3ba3a210ce1a507",version:"0.1.42"}},H={version:"155.0.8059.84",macArm64Sha256:"13b9e98ce56f5ce18e100a009f455c9285f399e7c9dc8a76fdf2f3a9755bb5f2",linux64Sha256:"cf0f049892dea22e6a6db26d47ed0d7776b7158edcbec4634086633df8bafcbc",win64Sha256:"507f2a031441d10c62b5e3d4e863f09ac1198a571c1419976cbd8387f639afde"};var J={ocu:{url:`https://registry.npmjs.org/open-computer-use/-/open-computer-use-${O.ocu.version}.tgz`,sha256:"7c16a87c8cd357787b02c0ebd040dd5f93880c1fb51c1901caa2e0c05d063130",size_bytes:5844280},obu:{url:`https://registry.npmjs.org/open-browser-use/-/open-browser-use-${O.obu.version}.tgz`,sha256:"9386d8ce0a147b3f55e1807b68edf736836378807541c457c9b5f6ca2cabaa4e",size_bytes:21372018},extension:{url:`https://github.com/iFurySt/open-browser-use/releases/download/v${O.obu.version}/open-browser-use-chrome-extension-${O.obu.version}.zip`,sha256:"c9c07bec1175e12ea6985b0e7784a5ef01fd03f014b958224a1e17dcd838a241",size_bytes:31070}},F="pnbmoicbkopffjjgfgfglopechaiemkp";import{spawn as Me}from"child_process";import{createRequire as fn}from"module";import{join as mn}from"path";var gn=30000,hn=1048576;function Te(){return process.env.SystemRoot??"C:\\Windows"}function bn(){return mn(Te(),"System32","WindowsPowerShell","v1.0","powershell.exe")}var yn=String.raw`
 $ErrorActionPreference = "Stop"
 Add-Type -TypeDefinition @"
 using System;

package/bin/vm-hands/{vm-hands-entry-lite-fapx7y70.js → vm-hands-entry-lite-va9q8qh7.js}

@@ -1,5 +1,5 @@
 // @bun
-import{mt}from"./vm-hands-entry-lite-9zjqe34s.js";import{a}from"./vm-hands-entry-lite-cf1x5cbr.js";import{randomUUID as L}from"crypto";import{spawnSync as b}from"child_process";import{chmodSync as ee,cpSync as te,existsSync as x,lstatSync as A,mkdirSync as Y,readdirSync as ne,readFileSync as w,readlinkSync as re,realpathSync as T,renameSync as E,rmdirSync as ie,rmSync as g,symlinkSync as M,writeFileSync as oe}from"fs";import{dirname as I,join as u,relative as se,resolve as ce}from"path";var Zn="so.ara.cli",k=[Zn,"com.reasonmachines.cli"],F="5LJFSBRY2F";function Vr(e){return`(${e.map((t)=>`identifier "${t}"`).join(" or ")}) and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${F}"`}var G="ReasonBackgroundIdentity",Ao="Contents/Helpers/ReasonPermissionTile",ae="so.ara.cli.permission-tile",Ne=Vr([ae,"com.reasonmachines.cli.permission-tile"]),v="AraBackgroundIdentity",ue="Reason",Ce=Vr(k),de=`anchor apple generic and (${k.map((e)=>`identifier "${e}"`).join(" or ")}) and certificate leaf[subject.OU] = "${F}"`;class h extends Error{code;constructor(e,t){super(t);this.code=e;this.name="MacOSBackgroundIdentityError"}}var R="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function le(e=a()){return u(e,"Library","Application Support","Reason","Background","Reason.app")}function O(e=a()){return u(e,"Library","Application Support","Ara","Background","Ara.app")}function fe(e){try{return A(e).isFile()}catch{return!1}}function D(e){return[G,v].map((t)=>u(e,"Contents","MacOS",t)).find(fe)??null}function d(e){try{if(!A(e).isDirectory())return!1;let t=w(u(e,"Contents","Info.plist"),"utf8");return k.some((n)=>t.includes(`<string>${n}</string>`))&&(t.includes(`<string>${ue}</string>`)||t.includes("<string>Ara</string>"))&&D(e)!==null}catch{return!1}}function Gr(e=a()){let t=le(e);if(!d(t))return null;try{let n=w(u(t,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(n)?.[1]??null}catch{return null}}function pe(e,t=a()){let n=Gr(t);return n===null||j(N(n.split(".")),N(e.split(/[.-]/).slice(0,3)))}var ge=1e4;function K(e,t){return b(e,[...t],{stdio:"ignore",timeout:ge}).status??1}var W=new Set;function H(e){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let t=(n)=>{try{return T(n)}catch{return ce(n)}};if(e!==void 0&&t(e)!==t(a()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var V=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.(?:ara|reason)(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,J=new Set(["ara","ara.exe","reason","reason.exe"]);function N(e){return e.map((t)=>Number(t))}function j(e,t){for(let n=0;n<3;n+=1)if(e[n]!==t[n])return e[n]<t[n];return!1}var ye=[0,2,161];function me(e){if(e===null)return!0;let t=ye,n=null;try{n=T(process.execPath)}catch{}return e.some((r)=>{let i=V.exec(r);if(i){let f=i[1]===void 0?i.slice(4,7):i.slice(1,4);return j(N(f),t)}let o=r.slice(r.lastIndexOf("/")+1);return J.has(o)&&r!==n&&r!==process.execPath})}function Ee(){let e=b("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(e.status!==0)return null;let t=[];for(let n of e.stdout.split(`
+import{mt}from"./vm-hands-entry-lite-frb11zec.js";import{a}from"./vm-hands-entry-lite-cf1x5cbr.js";import{randomUUID as L}from"crypto";import{spawnSync as b}from"child_process";import{chmodSync as ee,cpSync as te,existsSync as x,lstatSync as A,mkdirSync as Y,readdirSync as ne,readFileSync as w,readlinkSync as re,realpathSync as T,renameSync as E,rmdirSync as ie,rmSync as g,symlinkSync as M,writeFileSync as oe}from"fs";import{dirname as I,join as u,relative as se,resolve as ce}from"path";var Zn="so.ara.cli",k=[Zn,"com.reasonmachines.cli"],F="5LJFSBRY2F";function Vr(e){return`(${e.map((t)=>`identifier "${t}"`).join(" or ")}) and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${F}"`}var G="ReasonBackgroundIdentity",Ao="Contents/Helpers/ReasonPermissionTile",ae="so.ara.cli.permission-tile",Ne=Vr([ae,"com.reasonmachines.cli.permission-tile"]),v="AraBackgroundIdentity",ue="Reason",Ce=Vr(k),de=`anchor apple generic and (${k.map((e)=>`identifier "${e}"`).join(" or ")}) and certificate leaf[subject.OU] = "${F}"`;class h extends Error{code;constructor(e,t){super(t);this.code=e;this.name="MacOSBackgroundIdentityError"}}var R="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function le(e=a()){return u(e,"Library","Application Support","Reason","Background","Reason.app")}function O(e=a()){return u(e,"Library","Application Support","Ara","Background","Ara.app")}function fe(e){try{return A(e).isFile()}catch{return!1}}function D(e){return[G,v].map((t)=>u(e,"Contents","MacOS",t)).find(fe)??null}function d(e){try{if(!A(e).isDirectory())return!1;let t=w(u(e,"Contents","Info.plist"),"utf8");return k.some((n)=>t.includes(`<string>${n}</string>`))&&(t.includes(`<string>${ue}</string>`)||t.includes("<string>Ara</string>"))&&D(e)!==null}catch{return!1}}function Gr(e=a()){let t=le(e);if(!d(t))return null;try{let n=w(u(t,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(n)?.[1]??null}catch{return null}}function pe(e,t=a()){let n=Gr(t);return n===null||j(N(n.split(".")),N(e.split(/[.-]/).slice(0,3)))}var ge=1e4;function K(e,t){return b(e,[...t],{stdio:"ignore",timeout:ge}).status??1}var W=new Set;function H(e){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let t=(n)=>{try{return T(n)}catch{return ce(n)}};if(e!==void 0&&t(e)!==t(a()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var V=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.(?:ara|reason)(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,J=new Set(["ara","ara.exe","reason","reason.exe"]);function N(e){return e.map((t)=>Number(t))}function j(e,t){for(let n=0;n<3;n+=1)if(e[n]!==t[n])return e[n]<t[n];return!1}var ye=[0,2,161];function me(e){if(e===null)return!0;let t=ye,n=null;try{n=T(process.execPath)}catch{}return e.some((r)=>{let i=V.exec(r);if(i){let f=i[1]===void 0?i.slice(4,7):i.slice(1,4);return j(N(f),t)}let o=r.slice(r.lastIndexOf("/")+1);return J.has(o)&&r!==n&&r!==process.execPath})}function Ee(){let e=b("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(e.status!==0)return null;let t=[];for(let n of e.stdout.split(`
 `)){let r=/^\s*(\d+)\s+(\S.*)$/.exec(n);if(!r||Number(r[1])===process.pid)continue;let i=r[2].trimEnd(),o=i.slice(i.lastIndexOf("/")+1);if(!V.test(i)&&J.has(o)){let c=b("/usr/sbin/lsof",["-a","-p",r[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
 `).find((l)=>l.startsWith("n/"));if(c)i=c.slice(1)}t.push(i)}return t}function _e(e){if(H(e.home),!d(e.sourceApp))throw new h("identity_invalid","The packaged Reason background identity is missing or invalid.");let t=e.command??K,n=le(e.home),r=I(n);Y(r,{recursive:!0,mode:448}),ee(r,448);let i=T(e.sourceApp),o=null;try{o=T(n)}catch{}if(i!==o){let f=`${process.pid}.${L()}`,c=u(r,`.Reason.app.${f}.tmp`),l=u(r,`.Reason.app.${f}.old`),y=!1;try{if(te(i,c,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!d(c))throw new h("identity_invalid","The copied Reason background identity is invalid.");let _=e.releaseSigned?["--test-requirement",`=${de}`]:[];if(t("/usr/bin/codesign",["--verify","--strict",..._,c])!==0)throw new h("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let S=!1;for(let p=0;p<4;p+=1){let m=!1;try{E(n,l),m=!0,y=!0}catch(s){if(s.code!=="ENOENT")throw s}if(p===0)e.beforePublish?.();try{E(c,n),S=!0}catch(s){let Z=s.code;if(!["EEXIST","ENOTEMPTY"].includes(Z??""))throw s;if(m)g(l,{recursive:!0,force:!0}),y=!1;if(p===3)throw s;continue}if(m)g(l,{recursive:!0,force:!0}),y=!1;break}if(!S)throw Error("Could not publish Reason's background identity.")}catch(_){if(y&&!x(n)&&x(l))E(l,n);throw _}finally{g(c,{recursive:!0,force:!0}),g(l,{recursive:!0,force:!0})}}return z(n,e,{verified:i!==o}),n}function X(e){return u(I(e),".Reason.app.registered")}function q(e){try{let t=A(e);return t.isDirectory()?`${t.ino}:${t.birthtimeMs}`:null}catch{return null}}function C(e){let t=q(e);try{return t!==null&&w(X(e),"utf8")===t}catch{return!1}}function Q(e){if(d(e))return"bundle";try{if(A(u(e,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return A(u(e,"Contents","MacOS",v)).isSymbolicLink()?"retired":null}catch{return null}}function z(e,t,n={}){let r=t.command??K;if(!n.verified&&r("/usr/bin/codesign",["--verify","--strict",e])!==0)throw new h("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if(r(R,["-f",e])!==0)throw new h("identity_register_failed","Could not register Reason's macOS background identity.");let i=q(e);try{if(i)oe(X(e),i,{mode:384})}catch{}try{Se(e,t.home,r,t.runningExecutables??Ee)}catch(o){let f=o.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${f})
 `)}}function Se(e,t,n,r){let i=D(e);if(!i)return;let o=O(t),f=I(o),c=(s)=>u(s,"Contents","MacOS",v),l=se(I(c(o)),i),y=`${process.pid}.${L()}`,_=Q(o);if(_===null)return;let S=_==="bundle";if(S)n(R,["-u",o]);let p=u(f,`.Ara.app.${y}.old`);if(!W.has(o)&&!me(r())){if(!S)n(R,["-u",o]);try{E(o,p)}catch(s){if(s.code==="ENOENT")return;throw s}g(p,{recursive:!0,force:!0}),Ie(f);return}if(!S){if(re(c(o))===l)return;let s=`${c(o)}.${y}`;M(l,s);try{E(s,c(o))}finally{g(s,{force:!0})}return}let m=u(f,`.Ara.app.${y}.shim`);Y(I(c(m)),{recursive:!0}),M(l,c(m));try{try{E(o,p)}catch(s){if(s.code==="ENOENT")return;throw s}try{E(m,o)}catch(s){if(x(o))return;throw E(p,o),s}}finally{g(m,{recursive:!0,force:!0}),g(p,{recursive:!0,force:!0})}}function Ie(e){try{if(ne(e).some((n)=>n!==".DS_Store"))return;g(u(e,".DS_Store"),{force:!0}),ie(e)}catch{}}var B=new Map;function Xn(e=a()){let t=B.get(e);if(t)return t;if(process.platform!=="darwin")return[];let n=U(e);if(n===null&&x(I(le(e))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),n=U(e);if(n===null)return[];return B.set(e,n),n}function U(e){let t=le(e),n=O(e);if(!d(t)||!C(t))try{he({home:e,skipWhenSettled:!0})}catch{}let r=d(t)&&(C(t)||!d(n))?t:d(n)?n:null,i=r?D(r):null;if(!i)return null;if(r===n)W.add(n);let o=b(i,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return o.status===0&&o.stdout===`spawn

package/bin/vm-hands/{vm-hands-entry-lite-p287w6qe.js → vm-hands-entry-lite-wzs26rwe.js}

@@ -1,5 +1,5 @@
 // @bun
-import{We,co,F,Ve,Ft,Tr,x}from"./vm-hands-entry-lite-3q885ynr.js";import{K}from"./vm-hands-entry-lite-fykfnzjg.js";import{ut}from"./vm-hands-entry-lite-jyvmw8b7.js";import{ft}from"./vm-hands-entry-lite-fapx7y70.js";import{Rr}from"./vm-hands-entry-lite-pk94gtvb.js";import{xt,Li}from"./vm-hands-entry-lite-jwgheerx.js";import{G,qe}from"./vm-hands-entry-lite-n53t84sv.js";import{xe,Kn}from"./vm-hands-entry-lite-chxzwdrc.js";import{vt}from"./vm-hands-entry-lite-mb6atrr0.js";import{a}from"./vm-hands-entry-lite-cf1x5cbr.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{C}from"./vm-hands-entry-lite-vdhgwmmp.js";import{spawn as R,spawnSync as st}from"child_process";import{createHash as it,randomUUID as ge}from"crypto";import{closeSync as at,copyFileSync as ae,existsSync as M,fstatSync as ct,mkdirSync as ce,openSync as lt,readdirSync as U,readFileSync as X,readlinkSync as dt,renameSync as he,rmSync as pt,statSync as mt,writeFileSync as gt}from"fs";import{connect as ht}from"net";import{tmpdir as L,userInfo as we}from"os";import{basename as le,delimiter as wt,dirname as B,join as f}from"path";var z=`import { spawn, execFileSync } from "node:child_process";
+import{We,co,F,Ve,Ft,Tr,x}from"./vm-hands-entry-lite-qm1tvr26.js";import{K}from"./vm-hands-entry-lite-fykfnzjg.js";import{ut}from"./vm-hands-entry-lite-jyvmw8b7.js";import{ft}from"./vm-hands-entry-lite-va9q8qh7.js";import{Rr}from"./vm-hands-entry-lite-g916c0tx.js";import{xt,Li}from"./vm-hands-entry-lite-jwgheerx.js";import{G,qe}from"./vm-hands-entry-lite-4p3h7yw9.js";import{xe,Kn}from"./vm-hands-entry-lite-0fhyeqk2.js";import{vt}from"./vm-hands-entry-lite-mb6atrr0.js";import{a}from"./vm-hands-entry-lite-cf1x5cbr.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{C}from"./vm-hands-entry-lite-vdhgwmmp.js";import{spawn as R,spawnSync as st}from"child_process";import{createHash as it,randomUUID as ge}from"crypto";import{closeSync as at,copyFileSync as ae,existsSync as M,fstatSync as ct,mkdirSync as ce,openSync as lt,readdirSync as U,readFileSync as X,readlinkSync as dt,renameSync as he,rmSync as pt,statSync as mt,writeFileSync as gt}from"fs";import{connect as ht}from"net";import{tmpdir as L,userInfo as we}from"os";import{basename as le,delimiter as wt,dirname as B,join as f}from"path";var z=`import { spawn, execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
 import { tmpdir } from "node:os";