@reason-machines/cli-linux-x64 0.2.486 → 0.2.487

package/bin/vm-hands/{vm-hands-entry-lite-mb6atrr0.js → vm-hands-entry-lite-vezfnqf1.js}

@@ -1,5 +1,5 @@
 // @bun
-import{t,St,k,o,d,u,c,g,ee,s,n}from"./vm-hands-entry-lite-vmnxnr7y.js";var I=t().max(201).regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>e.split("/").every((r)=>r!=="."&&r!=="..")),y=t().min(1).max(255).regex(/^[A-Za-z0-9_][A-Za-z0-9_./-]*$/).refine((e)=>!e.includes("..")&&!e.includes("//")&&!e.endsWith("/")&&!e.endsWith(".lock")),x=t().regex(/^[a-f0-9]{40}$/),E=o().int().positive(),T=t().min(1).max(256),D=t().max(60000),L={version:n(1),repoFullName:I},C=u(t().max(1024).regex(/^(?:Co-authored-by: [^<>\r\n\x00]+ <[^<>\s]+@[^<>\s]+>|Reason-Contributor-ID: rc_[a-f0-9]{32})$/)).max(1000),G=c({expectedTrailers:C,missingFromHead:C}),z=g("action",[c({action:n("edit"),title:T.optional(),body:D.optional(),base:y.optional()}),c({action:s(["ready","draft","close"])}),c({action:n("metadata"),field:s(["reviewer","assignee","label"]),change:s(["add","remove"]),value:t().min(1).max(100).refine((e)=>!/[\r\n\0]/.test(e))})]),Pe=g("kind",[c({...L,kind:n("read"),path:t().min(1).max(2048),accept:s(["application/vnd.github+json","application/vnd.github.full+json","application/vnd.github.v3.diff"]).optional()}),c({...L,kind:n("pr_review_context"),number:E,after:t().min(1).max(1024).optional()}),c({...L,kind:n("prepare"),branch:y,baseSha:x,defaultBranch:y,diagnosticsVersion:n(1).optional()}),c({...L,kind:n("publish"),branch:y,defaultBranch:y,baseSha:x,remoteHeadSha:x.nullable(),contributorTrailers:C.optional()}),c({...L,kind:n("pr_create"),head:y,base:y,title:T,body:D,draft:d()}),c({...L,kind:n("pr_mutation"),number:E,mutation:z}),c({...L,kind:n("pr_merge"),number:E,expectedHeadSha:x,expectedBaseRef:y,method:s(["merge","squash","rebase"]),commitBody:t().max(65536).optional()})]),V=["local_device_gh_prepare_setup","local_device_gh_prepare_metadata","local_device_gh_prepare_private_init","local_device_gh_prepare_fetch","local_device_gh_prepare_base_mismatch","local_device_gh_prepare_checkout_validation","local_device_gh_prepare_checkout_init","local_device_gh_prepare_materialization"];function F(e){return V.some((r)=>r===e)}class ir extends Error{code;constructor(e){super(e);this.code=e}}function ti(e,r,i){let _=Pe.safeParse(e);return r==="failed"&&_.success&&_.data.kind==="prepare"&&_.data.diagnosticsVersion===1&&F(i)}var yt=245760,Mo=g("kind",[c({kind:n("pr_review_context"),body:t().max(yt)}),c({kind:n("prepare"),headSha:x}),c({kind:n("read"),status:o().int().min(200).max(599),headers:ee(t(),t().max(8192)).refine((e)=>Object.keys(e).every((r)=>r==="link"||r==="content-type")),body:t().max(yt)}),c({kind:n("publish"),headSha:x,scannedObjectCount:o().int().min(0).max(5000),attribution:G.optional()}),c({kind:n("pr_create"),url:t().max(1024).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/)}),c({kind:n("pr_mutation"),number:E,applied:n(!0)}),c({kind:n("pr_merge"),number:E,merged:n(!0)})]).refine((e)=>new TextEncoder().encode(JSON.stringify(e)).byteLength<=yt,"local_device_gh_result_too_large"),B=c({source:s(["agent","human"]),operationId:k()}),oe=c({version:n(1),userId:St(),deviceId:St(),rootId:St(),runId:St(),merge:B.optional(),contributorRefresh:St().optional(),repoFullName:I.nullable(),rootRevision:t().regex(/^[1-9][0-9]*$/),readOnly:d(),generation:o().int().positive().nullable(),fenceId:St().nullable()}).refine((e)=>e.generation===null===(e.fenceId===null));function w(e){return/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(e)&&e.split("/").every((r)=>r!=="."&&r!=="..")}function $o(e,r,i={},_="read"){if(w(e)&&(r==="/search/issues"||r.startsWith("/search/issues?")))return J(e,r,i);if(!w(e)||!r.startsWith(`/repos/${e}/`)&&r!==`/repos/${e}`)throw Error("local_device_gh_repository_mismatch");if(/[\\#\u0000-\u001f]/.test(r)||/%(?:2e|5c|00)/i.test(r))throw Error("local_device_gh_path_denied");let R=new URL(r,"https://api.github.com");if(R.pathname!==r.split("?")[0]||R.username||R.password)throw Error("local_device_gh_path_denied");let h;try{h=decodeURIComponent(R.pathname.slice(`/repos/${e}`.length))}catch{throw Error("local_device_gh_path_denied")}if(h.includes("%")||h.split("/").some((p)=>p==="."||p===".."))throw Error("local_device_gh_path_denied");if((i.method??"GET").toUpperCase()!=="GET"||i.body!=null)throw Error("local_device_gh_mutation_not_admitted");if(![/^$/,/^\/commits$/,/^\/pulls$/,/^\/pulls\/[1-9][0-9]*(?:\/(?:commits|files|reviews|comments))?$/,/^\/issues\/[1-9][0-9]*(?:\/comments)?$/,/^\/issues\/comments\/[1-9][0-9]*\/reactions$/,/^\/commits\/[A-Za-z0-9_./-]+(?:\/(?:check-runs|status))?$/,/^\/check-runs\/[1-9][0-9]*(?:\/annotations)?$/,/^\/branches\/[A-Za-z0-9_./-]+$/,/^\/git\/ref\/heads\/[A-Za-z0-9_./-]+$/,/^\/compare\/[A-Za-z0-9_./-]+\.\.\.[A-Za-z0-9_./-]+$/].some((p)=>p.test(h)))throw Error("local_device_gh_path_denied");if(R.searchParams.forEach((p,b)=>{if(b==="per_page"&&/^[1-9][0-9]*$/.test(p)&&Number(p)<=100)return;if(b==="page"&&/^[1-9][0-9]*$/.test(p)&&Number(p)<=100)return;if(h==="/pulls"&&b==="state"&&["open","closed","all"].includes(p))return;if(h==="/pulls"&&b==="sort"&&p==="updated")return;if(h==="/pulls"&&b==="direction"&&p==="desc")return;if(h==="/pulls"&&["head","base"].includes(b)&&/^[A-Za-z0-9_./:-]{1,255}$/.test(p))return;throw Error("local_device_gh_query_denied")}),i.headers)new Headers(i.headers).forEach((b,j)=>{if(j!=="accept"||!["application/vnd.github+json","application/vnd.github.full+json","application/vnd.github.v3.diff"].includes(b))throw Error("local_device_gh_header_denied")})}function J(e,r,i){if(/[\\#\u0000-\u001f]/.test(r))throw Error("local_device_gh_path_denied");let _=new URL(r,"https://api.github.com");if(_.pathname!=="/search/issues"||_.username||_.password)throw Error("local_device_gh_path_denied");if((i.method??"GET").toUpperCase()!=="GET"||i.body!=null)throw Error("local_device_gh_mutation_not_admitted");let R=null;_.searchParams.forEach((f,p)=>{if(p==="q"&&R===null){R=f;return}if(p==="per_page"&&/^[1-9][0-9]*$/.test(f)&&Number(f)<=100)return;if(p==="page"&&/^[1-9][0-9]*$/.test(f)&&Number(f)<=100)return;throw Error("local_device_gh_query_denied")});let h=`repo:${e.toLowerCase()} `,S=R?.toLowerCase()??"";if(S.length>512||!(S+" ").startsWith(h)||/(?:^|\s)(?:repo|org|user):/.test(S.slice(h.length)))throw Error("local_device_gh_query_denied");if(i.headers)new Headers(i.headers).forEach((f,p)=>{if(p!=="accept"||f!=="application/vnd.github+json")throw Error("local_device_gh_header_denied")})}var Bo=`query PullRequestReviewContext($owner: String!, $repo: String!, $number: Int!, $after: String) {
+import{t,St,k,o,d,u,c,g,ee,s,n}from"./vm-hands-entry-lite-g27kmejx.js";var I=t().max(201).regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>e.split("/").every((r)=>r!=="."&&r!=="..")),y=t().min(1).max(255).regex(/^[A-Za-z0-9_][A-Za-z0-9_./-]*$/).refine((e)=>!e.includes("..")&&!e.includes("//")&&!e.endsWith("/")&&!e.endsWith(".lock")),x=t().regex(/^[a-f0-9]{40}$/),E=o().int().positive(),T=t().min(1).max(256),D=t().max(60000),L={version:n(1),repoFullName:I},C=u(t().max(1024).regex(/^(?:Co-authored-by: [^<>\r\n\x00]+ <[^<>\s]+@[^<>\s]+>|Reason-Contributor-ID: rc_[a-f0-9]{32})$/)).max(1000),G=c({expectedTrailers:C,missingFromHead:C}),z=g("action",[c({action:n("edit"),title:T.optional(),body:D.optional(),base:y.optional()}),c({action:s(["ready","draft","close"])}),c({action:n("metadata"),field:s(["reviewer","assignee","label"]),change:s(["add","remove"]),value:t().min(1).max(100).refine((e)=>!/[\r\n\0]/.test(e))})]),Pe=g("kind",[c({...L,kind:n("read"),path:t().min(1).max(2048),accept:s(["application/vnd.github+json","application/vnd.github.full+json","application/vnd.github.v3.diff"]).optional()}),c({...L,kind:n("pr_review_context"),number:E,after:t().min(1).max(1024).optional()}),c({...L,kind:n("prepare"),branch:y,baseSha:x,defaultBranch:y,diagnosticsVersion:n(1).optional()}),c({...L,kind:n("publish"),branch:y,defaultBranch:y,baseSha:x,remoteHeadSha:x.nullable(),contributorTrailers:C.optional()}),c({...L,kind:n("pr_create"),head:y,base:y,title:T,body:D,draft:d()}),c({...L,kind:n("pr_mutation"),number:E,mutation:z}),c({...L,kind:n("pr_merge"),number:E,expectedHeadSha:x,expectedBaseRef:y,method:s(["merge","squash","rebase"]),commitBody:t().max(65536).optional()})]),V=["local_device_gh_prepare_setup","local_device_gh_prepare_metadata","local_device_gh_prepare_private_init","local_device_gh_prepare_fetch","local_device_gh_prepare_base_mismatch","local_device_gh_prepare_checkout_validation","local_device_gh_prepare_checkout_init","local_device_gh_prepare_materialization"];function F(e){return V.some((r)=>r===e)}class ir extends Error{code;constructor(e){super(e);this.code=e}}function ri(e,r,i){let _=Pe.safeParse(e);return r==="failed"&&_.success&&_.data.kind==="prepare"&&_.data.diagnosticsVersion===1&&F(i)}var yt=245760,$o=g("kind",[c({kind:n("pr_review_context"),body:t().max(yt)}),c({kind:n("prepare"),headSha:x}),c({kind:n("read"),status:o().int().min(200).max(599),headers:ee(t(),t().max(8192)).refine((e)=>Object.keys(e).every((r)=>r==="link"||r==="content-type")),body:t().max(yt)}),c({kind:n("publish"),headSha:x,scannedObjectCount:o().int().min(0).max(5000),attribution:G.optional()}),c({kind:n("pr_create"),url:t().max(1024).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/)}),c({kind:n("pr_mutation"),number:E,applied:n(!0)}),c({kind:n("pr_merge"),number:E,merged:n(!0)})]).refine((e)=>new TextEncoder().encode(JSON.stringify(e)).byteLength<=yt,"local_device_gh_result_too_large"),B=c({source:s(["agent","human"]),operationId:k()}),oe=c({version:n(1),userId:St(),deviceId:St(),rootId:St(),runId:St(),merge:B.optional(),contributorRefresh:St().optional(),repoFullName:I.nullable(),rootRevision:t().regex(/^[1-9][0-9]*$/),readOnly:d(),generation:o().int().positive().nullable(),fenceId:St().nullable()}).refine((e)=>e.generation===null===(e.fenceId===null));function w(e){return/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(e)&&e.split("/").every((r)=>r!=="."&&r!=="..")}function Bo(e,r,i={},_="read"){if(w(e)&&(r==="/search/issues"||r.startsWith("/search/issues?")))return J(e,r,i);if(!w(e)||!r.startsWith(`/repos/${e}/`)&&r!==`/repos/${e}`)throw Error("local_device_gh_repository_mismatch");if(/[\\#\u0000-\u001f]/.test(r)||/%(?:2e|5c|00)/i.test(r))throw Error("local_device_gh_path_denied");let R=new URL(r,"https://api.github.com");if(R.pathname!==r.split("?")[0]||R.username||R.password)throw Error("local_device_gh_path_denied");let h;try{h=decodeURIComponent(R.pathname.slice(`/repos/${e}`.length))}catch{throw Error("local_device_gh_path_denied")}if(h.includes("%")||h.split("/").some((p)=>p==="."||p===".."))throw Error("local_device_gh_path_denied");if((i.method??"GET").toUpperCase()!=="GET"||i.body!=null)throw Error("local_device_gh_mutation_not_admitted");if(![/^$/,/^\/commits$/,/^\/pulls$/,/^\/pulls\/[1-9][0-9]*(?:\/(?:commits|files|reviews|comments))?$/,/^\/issues\/[1-9][0-9]*(?:\/comments)?$/,/^\/issues\/comments\/[1-9][0-9]*\/reactions$/,/^\/commits\/[A-Za-z0-9_./-]+(?:\/(?:check-runs|status))?$/,/^\/check-runs\/[1-9][0-9]*(?:\/annotations)?$/,/^\/branches\/[A-Za-z0-9_./-]+$/,/^\/git\/ref\/heads\/[A-Za-z0-9_./-]+$/,/^\/compare\/[A-Za-z0-9_./-]+\.\.\.[A-Za-z0-9_./-]+$/].some((p)=>p.test(h)))throw Error("local_device_gh_path_denied");if(R.searchParams.forEach((p,b)=>{if(b==="per_page"&&/^[1-9][0-9]*$/.test(p)&&Number(p)<=100)return;if(b==="page"&&/^[1-9][0-9]*$/.test(p)&&Number(p)<=100)return;if(h==="/pulls"&&b==="state"&&["open","closed","all"].includes(p))return;if(h==="/pulls"&&b==="sort"&&p==="updated")return;if(h==="/pulls"&&b==="direction"&&p==="desc")return;if(h==="/pulls"&&["head","base"].includes(b)&&/^[A-Za-z0-9_./:-]{1,255}$/.test(p))return;throw Error("local_device_gh_query_denied")}),i.headers)new Headers(i.headers).forEach((b,j)=>{if(j!=="accept"||!["application/vnd.github+json","application/vnd.github.full+json","application/vnd.github.v3.diff"].includes(b))throw Error("local_device_gh_header_denied")})}function J(e,r,i){if(/[\\#\u0000-\u001f]/.test(r))throw Error("local_device_gh_path_denied");let _=new URL(r,"https://api.github.com");if(_.pathname!=="/search/issues"||_.username||_.password)throw Error("local_device_gh_path_denied");if((i.method??"GET").toUpperCase()!=="GET"||i.body!=null)throw Error("local_device_gh_mutation_not_admitted");let R=null;_.searchParams.forEach((f,p)=>{if(p==="q"&&R===null){R=f;return}if(p==="per_page"&&/^[1-9][0-9]*$/.test(f)&&Number(f)<=100)return;if(p==="page"&&/^[1-9][0-9]*$/.test(f)&&Number(f)<=100)return;throw Error("local_device_gh_query_denied")});let h=`repo:${e.toLowerCase()} `,S=R?.toLowerCase()??"";if(S.length>512||!(S+" ").startsWith(h)||/(?:^|\s)(?:repo|org|user):/.test(S.slice(h.length)))throw Error("local_device_gh_query_denied");if(i.headers)new Headers(i.headers).forEach((f,p)=>{if(p!=="accept"||f!=="application/vnd.github+json")throw Error("local_device_gh_header_denied")})}var Fo=`query PullRequestReviewContext($owner: String!, $repo: String!, $number: Int!, $after: String) {
       repository(owner: $owner, name: $repo) {
         nameWithOwner
         pullRequest(number: $number) {
@@ -34,9 +34,9 @@ import{t,St,k,o,d,u,c,g,ee,s,n}from"./vm-hands-entry-lite-vmnxnr7y.js";var I=t()
           }
         }
       }
-    }`;function et(e){return e.kind==="read"||e.kind==="pr_review_context"}var wt=["inspect_project","fs.read","fs.write","fs.search","fs.watch","fs.upload","fs.export","fs.import","fs.download","exec.run","exec.full","process.run.v1","process.full.v1","pty.start","pty.input","pty.resize","pty.close","git.run","process.list","process.signal","ports.list","tunnel.open","tunnel.close","env.discover","setup.run","mcp.discover","mcp.start","mcp.proxy","browser.snapshot","browser.navigate","browser.act","computer.snapshot","computer.act","computer.use","browser.use","browser.recording.v1","browser.pr-proof.v1","hands.connect","jobs.control","environment.install","github.local.v1","inference.ollama.v1","inference.custom.v1","delegate.devin.copy.v1","delegate.cursor.copy.v1","display.stream.v1","automation.call.v1","preview.serve.v1","workspace.setup.v1","simulator.call.v1","simulator.stream.v1"];var tt=2,N="/app/local-runtime",Te=262144,qs="x-reason-relay-host-alias",Ws="v1";function l(e,r){return{path:`${N}${e}`,routerPath:e,auth:r}}function O(e,r){return{...l(e,"device_proof"),forOperation(i){return l(`/operations/${encodeURIComponent(i)}${r}`,"device_proof")}}}var Vs={register:l("/register","registration_bearer"),enroll:l("/enroll","none"),authChallenge:l("/auth/challenge","none"),identity:l("/identity","device_proof"),heartbeat:l("/heartbeat","device_proof"),rootsSync:l("/roots/sync","device_proof"),disconnect:l("/disconnect","device_proof"),lifecycle:l("/lifecycle","device_proof"),localSubscription:l("/local-subscription","device_proof"),ownerWorkspaces:l("/owner-workspaces","device_proof"),ownerWorkspaceEnrollment:l("/owner-workspaces/enrollment","device_proof"),sessionWorktrees:l("/session-worktrees","device_proof"),operationClaim:l("/operations/claim","device_proof"),operationHeartbeat:O("/operations/:operationId/heartbeat","/heartbeat"),operationEvents:O("/operations/:operationId/events","/events"),operationComplete:O("/operations/:operationId/complete","/complete"),operationEnvironment:O("/operations/:operationId/environment","/environment"),operationEnvironmentAck:O("/operations/:operationId/environment-ack","/environment-ack"),operationCustomEndpointCredential:O("/operations/:operationId/custom-endpoint-credential","/custom-endpoint-credential")},ri=`${N}/session`;var W=[/^\/app\/local-runtime\/heartbeat$/,/^\/app\/local-runtime\/operations\/claim$/,/^\/app\/local-runtime\/operations\/[0-9a-fA-F-]{36}\/(?:heartbeat|events|complete|environment|environment-ack)$/];function Gs(e){return W.some((r)=>r.test(e))}var rn=60000;var ni="hands_control_v1",bt="environment.deliver",ii="vm_hands_workspace_deferred",oi="vm_hands.workspace_grant",si="hands.unbind_unverified",ai="claim_v1",ci="environment_at_claim",li="ready_v1",ui="workspace_check",di="rebind_v1",pi="resident_rebind",hi="hands.rebind",fi="snapshot_v1",mi="cloud_access",gi="playwright_v1",_i="headless_browser",yi="v1",wi="job_env_large_values",pe="srt_root_v1",Y="hands_confinement",Re="gid_v1",q="model_jobs_egress",bi="setpriv_v1",vi="jobs_user",Si="spawning_attempt_v1",Q="hands_session_group";var Ei="session_cap",xi="none",ki="same_launch_v1",Ci="exit_v1",Ai="start_wait",vt="user_chrome",Pi="cloud_sessions";function v(e){if(!a(e)||Object.keys(e).length!==5||e.version!==1)return!1;let r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;return["boot_generation","recording_operation_id","recording_attempt_id"].every((i)=>typeof e[i]==="string"&&r.test(e[i]))&&typeof e.root_version==="string"&&/^[0-9]{1,20}(?:\.[0-9]{1,6})?$/.test(e.root_version)}function A(e){if(!a(e)||Object.keys(e).length!==6)return!1;let r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;return typeof e.device_id==="string"&&r.test(e.device_id)&&(e.binding==="workspace_source"||e.binding==="mcp_control")&&Number.isSafeInteger(e.target_revision)&&Number(e.target_revision)>=0&&Number.isSafeInteger(e.root_grant_revision)&&Number(e.root_grant_revision)>0&&Number.isSafeInteger(e.target_generation)&&Number(e.target_generation)>0&&typeof e.target_fence_id==="string"&&r.test(e.target_fence_id)}var Ks=["lock_acquired","enrollment_started","enrollment_completed","readiness_started","readiness_completed","inventory_completed","control_ready"],or=86400000;var K=["production","staging"];function P(e){if(!a(e)||Object.keys(e).length!==3)return!1;let r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;return["organization_id","user_id","device_id"].every((i)=>Object.hasOwn(e,i)&&typeof e[i]==="string"&&r.test(e[i])&&e[i]!=="00000000-0000-0000-0000-000000000000")}var Z="DEVICE-PROOF-V2";function Ti(e,r=Z){let i=e.method.toUpperCase();if(!/^[A-Z]+$/.test(i)||!e.pathAndQuery.startsWith(`${N}/`)||e.pathAndQuery.includes(`
+    }`;function tt(e){return e.kind==="read"||e.kind==="pr_review_context"}var wt=["inspect_project","fs.read","fs.write","fs.search","fs.watch","fs.upload","fs.export","fs.import","fs.download","exec.run","exec.full","process.run.v1","process.full.v1","pty.start","pty.input","pty.resize","pty.close","git.run","process.list","process.signal","ports.list","tunnel.open","tunnel.close","env.discover","setup.run","mcp.discover","mcp.start","mcp.proxy","browser.snapshot","browser.navigate","browser.act","computer.snapshot","computer.act","computer.use","browser.use","browser.recording.v1","browser.pr-proof.v1","hands.connect","jobs.control","environment.install","github.local.v1","inference.ollama.v1","inference.custom.v1","delegate.devin.copy.v1","delegate.cursor.copy.v1","display.stream.v1","automation.call.v1","preview.serve.v1","workspace.setup.v1","simulator.call.v1","simulator.stream.v1"];var rt=2,N="/app/local-runtime",Te=262144,Ws="x-reason-relay-host-alias",Vs="v1";function l(e,r){return{path:`${N}${e}`,routerPath:e,auth:r}}function O(e,r){return{...l(e,"device_proof"),forOperation(i){return l(`/operations/${encodeURIComponent(i)}${r}`,"device_proof")}}}var Gs={register:l("/register","registration_bearer"),enroll:l("/enroll","none"),authChallenge:l("/auth/challenge","none"),identity:l("/identity","device_proof"),heartbeat:l("/heartbeat","device_proof"),rootsSync:l("/roots/sync","device_proof"),disconnect:l("/disconnect","device_proof"),lifecycle:l("/lifecycle","device_proof"),localSubscription:l("/local-subscription","device_proof"),ownerWorkspaces:l("/owner-workspaces","device_proof"),ownerWorkspaceEnrollment:l("/owner-workspaces/enrollment","device_proof"),sessionWorktrees:l("/session-worktrees","device_proof"),operationClaim:l("/operations/claim","device_proof"),operationHeartbeat:O("/operations/:operationId/heartbeat","/heartbeat"),operationEvents:O("/operations/:operationId/events","/events"),operationComplete:O("/operations/:operationId/complete","/complete"),operationEnvironment:O("/operations/:operationId/environment","/environment"),operationEnvironmentAck:O("/operations/:operationId/environment-ack","/environment-ack"),operationCustomEndpointCredential:O("/operations/:operationId/custom-endpoint-credential","/custom-endpoint-credential")},ni=`${N}/session`;var W=[/^\/app\/local-runtime\/heartbeat$/,/^\/app\/local-runtime\/operations\/claim$/,/^\/app\/local-runtime\/operations\/[0-9a-fA-F-]{36}\/(?:heartbeat|events|complete|environment|environment-ack)$/];function Ks(e){return W.some((r)=>r.test(e))}var rn=60000;var ii="hands_control_v1",bt="environment.deliver",oi="vm_hands_workspace_deferred",si="vm_hands.workspace_grant",ai="hands.unbind_unverified",ci="claim_v1",li="environment_at_claim",ui="ready_v1",di="workspace_check",pi="rebind_v1",hi="resident_rebind",fi="hands.rebind",mi="snapshot_v1",gi="cloud_access",_i="playwright_v1",yi="headless_browser",wi="v1",bi="job_env_large_values",pe="srt_root_v1",Y="hands_confinement",Re="gid_v1",q="model_jobs_egress",vi="setpriv_v1",Si="jobs_user",Ei="spawning_attempt_v1",Q="hands_session_group";var xi="session_cap",ki="none",Ci="same_launch_v1",Ai="exit_v1",Pi="start_wait",vt="user_chrome",Ti="cloud_sessions";function v(e){if(!a(e)||Object.keys(e).length!==5||e.version!==1)return!1;let r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;return["boot_generation","recording_operation_id","recording_attempt_id"].every((i)=>typeof e[i]==="string"&&r.test(e[i]))&&typeof e.root_version==="string"&&/^[0-9]{1,20}(?:\.[0-9]{1,6})?$/.test(e.root_version)}function A(e){if(!a(e)||Object.keys(e).length!==6)return!1;let r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;return typeof e.device_id==="string"&&r.test(e.device_id)&&(e.binding==="workspace_source"||e.binding==="mcp_control")&&Number.isSafeInteger(e.target_revision)&&Number(e.target_revision)>=0&&Number.isSafeInteger(e.root_grant_revision)&&Number(e.root_grant_revision)>0&&Number.isSafeInteger(e.target_generation)&&Number(e.target_generation)>0&&typeof e.target_fence_id==="string"&&r.test(e.target_fence_id)}var Js=["lock_acquired","enrollment_started","enrollment_completed","readiness_started","readiness_completed","inventory_completed","control_ready"],or=86400000;var K=["production","staging"];function P(e){if(!a(e)||Object.keys(e).length!==3)return!1;let r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;return["organization_id","user_id","device_id"].every((i)=>Object.hasOwn(e,i)&&typeof e[i]==="string"&&r.test(e[i])&&e[i]!=="00000000-0000-0000-0000-000000000000")}var Z="DEVICE-PROOF-V2";function Ri(e,r=Z){let i=e.method.toUpperCase();if(!/^[A-Z]+$/.test(i)||!e.pathAndQuery.startsWith(`${N}/`)||e.pathAndQuery.includes(`
 `)||!/^[0-9]{1,20}$/.test(e.timestamp)||!/^[A-Za-z0-9_-]{22,43}$/.test(e.nonce)||e.challenge.length<16||e.challenge.length>1024||e.challenge.includes(`
 `)||!/^[a-f0-9]{64}$/.test(e.bodySha256))throw Error("Invalid Reason Device proof input.");return Buffer.from([r,i,e.pathAndQuery,e.timestamp,e.nonce,e.challenge,e.bodySha256].join(`
-`),"utf8")}function a(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function X(e,r){return typeof e==="string"&&r.some((i)=>i===e)}function H(e){return a(e)&&typeof e.id==="string"&&typeof e.label==="string"&&typeof e.path_fingerprint==="string"}function te(e){return a(e)&&Number.isInteger(e.seq)&&Number(e.seq)>=0&&typeof e.kind==="string"&&/^[A-Za-z0-9._:-]{1,64}$/.test(e.kind)&&a(e.payload)}function m(e){throw Error(e)}function Js(e,r){let i=a(e)?e:{},_=typeof i.error==="string"?i.error:`http_${r}`,R=typeof i.detail==="string"?i.detail:typeof i.message==="string"?i.message:`Reason Device request failed (${r})`;return{code:_,message:R}}function rs(e){if(!a(e)||typeof e.challenge!=="string"||e.challenge.length<16||e.challenge.length>1024||e.challenge.includes(`
-`)||typeof e.expires_at!=="string"||!Number.isFinite(Date.parse(e.expires_at)))m("Reason returned an invalid Device proof challenge.");return{challenge:e.challenge,expires_at:e.expires_at}}function M(e,r){if(!a(e)||typeof e.device_id!=="string"||e.auth_scheme!=="p256"||e.organization_id!==void 0&&typeof e.organization_id!=="string"||e.protocol_version!==tt||!Array.isArray(e.roots)||!e.roots.every(H)||r&&typeof e.organization_id!=="string"||e.device_credential!==void 0)m(r?"Reason returned an invalid Device enrollment.":"Reason returned an invalid Device registration.");return{...{device_id:e.device_id,...typeof e.organization_id==="string"?{organization_id:e.organization_id}:{},protocol_version:tt,roots:e.roots},auth_scheme:"p256"}}function Zs(e){return M(e,!1)}function Xs(e){let r=M(e,!0);if(typeof r.organization_id!=="string")return m("Reason returned an invalid Device enrollment.");return{...r,organization_id:r.organization_id}}function Ys(e){if(!a(e)||typeof e.server_time!=="string"||typeof e.drain!=="boolean")return m("Reason returned an invalid Device heartbeat.");return{server_time:e.server_time,drain:e.drain,...U(e),...typeof e.update_policy==="string"||e.update_policy===null?{update_policy:e.update_policy}:{},...typeof e.supported_protocol_version==="number"?{supported_protocol_version:e.supported_protocol_version}:{},...re(e.latest_cli_versions),...e.hands_prespawn===!0?{hands_prespawn:!0}:{}}}var ne=["account_root_metadata_supported","workspace_root_metadata_supported","account_root_path_supported","home_contained_roots_supported","root_paths_supported","startup_supported"];function U(e){return Object.fromEntries(ne.filter((r)=>e[r]===!0).map((r)=>[r,!0]))}function Qs(e){if(!a(e))return;try{return{...rs(e),...U(e)}}catch{return}}function re(e){if(!a(e))return{};let r={};for(let i of K){let _=e[i];if(typeof _==="string"&&/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/.test(_))r[i]=_}return Object.keys(r).length>0?{latest_cli_versions:r}:{}}function ea(e){if(!a(e)||!Array.isArray(e.roots)||!e.roots.every(H))return m("Reason returned an invalid Device root sync.");return{roots:e.roots}}function ta(e){if(!a(e)||e.user_id!==void 0&&typeof e.user_id!=="string"||typeof e.organization_id!=="string"||typeof e.organization_name!=="string"||typeof e.organization_slug!=="string")return m("Reason returned an invalid Device identity.");return{...typeof e.user_id==="string"?{user_id:e.user_id}:{},organization_id:e.organization_id,organization_name:e.organization_name,organization_slug:e.organization_slug}}function ra(e){if(!a(e)||e.disconnected!==!0)return m("Reason did not disconnect this Device.");let r=e.sessions_moved;return typeof r==="number"&&Number.isSafeInteger(r)&&r>=0?{disconnected:!0,sessions_moved:r}:{disconnected:!0}}function na(e){if(a(e)&&e.ok===!0&&typeof e.expires==="number")return{ok:!0,expires:e.expires};if(a(e)&&e.ok===!1&&typeof e.error==="string")return{ok:!1,error:e.error};return m("Reason did not answer the local login hand-over.")}function ia(e){if(!a(e)||e.accepted!==!0)return m("Reason did not accept the Device lifecycle event.");return{accepted:!0}}function ie(e){return Buffer.byteLength(JSON.stringify(e),"utf8")}function oa(e,r=wt){if(!a(e)||typeof e.operation_id!=="string"||typeof e.attempt_id!=="string"||typeof e.attempt_token!=="string"||!/^(?:reason|ara)_attempt_/.test(e.attempt_token)||typeof e.lease_until!=="string"||typeof e.run_id!=="string"||typeof e.root_id!=="string"||e.owner!==void 0&&!P(e.owner)||!X(e.capability,r)||!a(e.payload)||e.protocol_version!==tt||ie(e.payload)>Te||e.authority!==void 0&&!A(e.authority)||e.local_github_authority!==void 0&&!oe.safeParse(e.local_github_authority).success||e.capability==="github.local.v1"&&!oe.safeParse(e.local_github_authority).success||e.recording_authority!==void 0&&!v(e.recording_authority)||e.capability==="browser.recording.v1"&&(!v(e.recording_authority)||!P(e.owner))||e.capability!=="browser.recording.v1"&&e.recording_authority!==void 0)return m("Reason returned an invalid Device operation claim.");let i={operation_id:e.operation_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,lease_until:e.lease_until,run_id:e.run_id,root_id:e.root_id,capability:e.capability,payload:e.payload,...A(e.authority)?{authority:e.authority}:{},...v(e.recording_authority)?{recording_authority:Object.freeze({...e.recording_authority})}:{},...e.local_github_authority!==void 0?{local_github_authority:oe.parse(e.local_github_authority)}:{},...e.capability==="hands.connect"&&a(e.environment)&&a(e.environment.payload)&&A(e.environment.authority)?{environment:{payload:e.environment.payload,authority:e.environment.authority}}:{},protocol_version:tt};if(e.owner!==void 0)i.owner=Object.freeze({...e.owner});return i}function sa(e){if(!a(e)||typeof e.lease_until!=="string"||!Array.isArray(e.controls)||!e.controls.every(te)||!Number.isInteger(e.next_control_seq)||Number(e.next_control_seq)<0)return m("Reason returned an invalid Device operation heartbeat.");return{lease_until:e.lease_until,controls:e.controls,next_control_seq:Number(e.next_control_seq)}}function aa(e){if(!a(e)||!Number.isInteger(e.next_event_seq)||Number(e.next_event_seq)<0||typeof e.duplicate!=="boolean"||!Number.isInteger(e.accepted_count)||Number(e.accepted_count)<0)return m("Reason returned an invalid Device operation event result.");return{next_event_seq:Number(e.next_event_seq),duplicate:e.duplicate,accepted_count:Number(e.accepted_count)}}function ca(e){if(!a(e)||!a(e.payload)||!A(e.authority))return m("Reason returned an invalid Device environment delivery.");return{payload:e.payload,authority:e.authority}}function ae(e){return e==="succeeded"||e==="failed"||e==="cancelled"||e==="expired"}function la(e){if(!a(e)||!ae(e.status)||typeof e.idempotent!=="boolean")return m("Reason returned an invalid Device operation completion.");return{status:e.status,idempotent:e.idempotent}}
-export{Pe,ir,ti,yt,Mo,oe,$o,Bo,et,wt,tt,Te,qs,Ws,Vs,ri,Gs,rn,ni,bt,ii,oi,si,ai,ci,li,ui,di,pi,hi,fi,mi,gi,_i,yi,wi,pe,Y,Re,q,bi,vi,Si,Q,Ei,xi,ki,Ci,Ai,vt,Pi,Ks,or,Ti,Js,rs,Zs,Xs,Ys,Qs,ea,ta,ra,na,ia,oa,sa,aa,ca,la};
+`),"utf8")}function a(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function X(e,r){return typeof e==="string"&&r.some((i)=>i===e)}function H(e){return a(e)&&typeof e.id==="string"&&typeof e.label==="string"&&typeof e.path_fingerprint==="string"}function te(e){return a(e)&&Number.isInteger(e.seq)&&Number(e.seq)>=0&&typeof e.kind==="string"&&/^[A-Za-z0-9._:-]{1,64}$/.test(e.kind)&&a(e.payload)}function m(e){throw Error(e)}function Zs(e,r){let i=a(e)?e:{},_=typeof i.error==="string"?i.error:`http_${r}`,R=typeof i.detail==="string"?i.detail:typeof i.message==="string"?i.message:`Reason Device request failed (${r})`;return{code:_,message:R}}function ns(e){if(!a(e)||typeof e.challenge!=="string"||e.challenge.length<16||e.challenge.length>1024||e.challenge.includes(`
+`)||typeof e.expires_at!=="string"||!Number.isFinite(Date.parse(e.expires_at)))m("Reason returned an invalid Device proof challenge.");return{challenge:e.challenge,expires_at:e.expires_at}}function M(e,r){if(!a(e)||typeof e.device_id!=="string"||e.auth_scheme!=="p256"||e.organization_id!==void 0&&typeof e.organization_id!=="string"||e.protocol_version!==rt||!Array.isArray(e.roots)||!e.roots.every(H)||r&&typeof e.organization_id!=="string"||e.device_credential!==void 0)m(r?"Reason returned an invalid Device enrollment.":"Reason returned an invalid Device registration.");return{...{device_id:e.device_id,...typeof e.organization_id==="string"?{organization_id:e.organization_id}:{},protocol_version:rt,roots:e.roots},auth_scheme:"p256"}}function Xs(e){return M(e,!1)}function Ys(e){let r=M(e,!0);if(typeof r.organization_id!=="string")return m("Reason returned an invalid Device enrollment.");return{...r,organization_id:r.organization_id}}function Qs(e){if(!a(e)||typeof e.server_time!=="string"||typeof e.drain!=="boolean")return m("Reason returned an invalid Device heartbeat.");return{server_time:e.server_time,drain:e.drain,...U(e),...typeof e.update_policy==="string"||e.update_policy===null?{update_policy:e.update_policy}:{},...typeof e.supported_protocol_version==="number"?{supported_protocol_version:e.supported_protocol_version}:{},...re(e.latest_cli_versions),...e.hands_prespawn===!0?{hands_prespawn:!0}:{}}}var ne=["account_root_metadata_supported","workspace_root_metadata_supported","account_root_path_supported","home_contained_roots_supported","root_paths_supported","startup_supported"];function U(e){return Object.fromEntries(ne.filter((r)=>e[r]===!0).map((r)=>[r,!0]))}function ea(e){if(!a(e))return;try{return{...ns(e),...U(e)}}catch{return}}function re(e){if(!a(e))return{};let r={};for(let i of K){let _=e[i];if(typeof _==="string"&&/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/.test(_))r[i]=_}return Object.keys(r).length>0?{latest_cli_versions:r}:{}}function ta(e){if(!a(e)||!Array.isArray(e.roots)||!e.roots.every(H))return m("Reason returned an invalid Device root sync.");return{roots:e.roots}}function ra(e){if(!a(e)||e.user_id!==void 0&&typeof e.user_id!=="string"||typeof e.organization_id!=="string"||typeof e.organization_name!=="string"||typeof e.organization_slug!=="string")return m("Reason returned an invalid Device identity.");return{...typeof e.user_id==="string"?{user_id:e.user_id}:{},organization_id:e.organization_id,organization_name:e.organization_name,organization_slug:e.organization_slug}}function na(e){if(!a(e)||e.disconnected!==!0)return m("Reason did not disconnect this Device.");let r=e.sessions_moved;return typeof r==="number"&&Number.isSafeInteger(r)&&r>=0?{disconnected:!0,sessions_moved:r}:{disconnected:!0}}function ia(e){if(a(e)&&e.ok===!0&&typeof e.expires==="number")return{ok:!0,expires:e.expires};if(a(e)&&e.ok===!1&&typeof e.error==="string")return{ok:!1,error:e.error};return m("Reason did not answer the local login hand-over.")}function oa(e){if(!a(e)||e.accepted!==!0)return m("Reason did not accept the Device lifecycle event.");return{accepted:!0}}function ie(e){return Buffer.byteLength(JSON.stringify(e),"utf8")}function sa(e,r=wt){if(!a(e)||typeof e.operation_id!=="string"||typeof e.attempt_id!=="string"||typeof e.attempt_token!=="string"||!/^(?:reason|ara)_attempt_/.test(e.attempt_token)||typeof e.lease_until!=="string"||typeof e.run_id!=="string"||typeof e.root_id!=="string"||e.owner!==void 0&&!P(e.owner)||!X(e.capability,r)||!a(e.payload)||e.protocol_version!==rt||ie(e.payload)>Te||e.authority!==void 0&&!A(e.authority)||e.local_github_authority!==void 0&&!oe.safeParse(e.local_github_authority).success||e.capability==="github.local.v1"&&!oe.safeParse(e.local_github_authority).success||e.recording_authority!==void 0&&!v(e.recording_authority)||e.capability==="browser.recording.v1"&&(!v(e.recording_authority)||!P(e.owner))||e.capability!=="browser.recording.v1"&&e.recording_authority!==void 0)return m("Reason returned an invalid Device operation claim.");let i={operation_id:e.operation_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,lease_until:e.lease_until,run_id:e.run_id,root_id:e.root_id,capability:e.capability,payload:e.payload,...A(e.authority)?{authority:e.authority}:{},...v(e.recording_authority)?{recording_authority:Object.freeze({...e.recording_authority})}:{},...e.local_github_authority!==void 0?{local_github_authority:oe.parse(e.local_github_authority)}:{},...e.capability==="hands.connect"&&a(e.environment)&&a(e.environment.payload)&&A(e.environment.authority)?{environment:{payload:e.environment.payload,authority:e.environment.authority}}:{},protocol_version:rt};if(e.owner!==void 0)i.owner=Object.freeze({...e.owner});return i}function aa(e){if(!a(e)||typeof e.lease_until!=="string"||!Array.isArray(e.controls)||!e.controls.every(te)||!Number.isInteger(e.next_control_seq)||Number(e.next_control_seq)<0)return m("Reason returned an invalid Device operation heartbeat.");return{lease_until:e.lease_until,controls:e.controls,next_control_seq:Number(e.next_control_seq)}}function ca(e){if(!a(e)||!Number.isInteger(e.next_event_seq)||Number(e.next_event_seq)<0||typeof e.duplicate!=="boolean"||!Number.isInteger(e.accepted_count)||Number(e.accepted_count)<0)return m("Reason returned an invalid Device operation event result.");return{next_event_seq:Number(e.next_event_seq),duplicate:e.duplicate,accepted_count:Number(e.accepted_count)}}function la(e){if(!a(e)||!a(e.payload)||!A(e.authority))return m("Reason returned an invalid Device environment delivery.");return{payload:e.payload,authority:e.authority}}function ae(e){return e==="succeeded"||e==="failed"||e==="cancelled"||e==="expired"}function ua(e){if(!a(e)||!ae(e.status)||typeof e.idempotent!=="boolean")return m("Reason returned an invalid Device operation completion.");return{status:e.status,idempotent:e.idempotent}}
+export{Pe,ir,ri,yt,$o,oe,Bo,Fo,tt,wt,rt,Te,Ws,Vs,Gs,ni,Ks,rn,ii,bt,oi,si,ai,ci,li,ui,di,pi,hi,fi,mi,gi,_i,yi,wi,bi,pe,Y,Re,q,vi,Si,Ei,Q,xi,ki,Ci,Ai,Pi,vt,Ti,Js,or,Ri,Zs,ns,Xs,Ys,Qs,ea,ta,ra,na,ia,oa,sa,aa,ca,la,ua};

package/bin/vm-hands/{vm-hands-entry-lite-fykfnzjg.js → vm-hands-entry-lite-vtbw3evj.js}

@@ -1,4 +1,4 @@
 // @bun
-import{a}from"./vm-hands-entry-lite-cf1x5cbr.js";import{readFileSync as c}from"fs";import{isAbsolute as l,normalize as i}from"path";var m="REASON_WORKER_DESKTOP_USER",u=null;function p(t,o){for(let s of o.split(`
-`)){let e=s.split(":");if(e.length<7||Number(e[2])!==t||!/^\d+$/.test(e[2])||!/^\d+$/.test(e[3]))continue;let n=e[5];if(!/^[a-z_][a-z0-9_-]*$/i.test(e[0])||!l(n)||i(n)!==n||n==="/")return null;return{username:e[0],uid:t,gid:Number(e[3]),home:n}}return null}function $s(t={}){let o="value"in t?t.value:process.env[m];if(u=null,o===void 0||o==="")return null;let s=t.platform??process.platform,e="euid"in t?t.euid:process.geteuid?.(),n=/^[1-9]\d{0,9}$/.test(o)?Number(o):NaN,r=s==="linux"&&e===0&&Number.isSafeInteger(n)?p(n,(t.passwd??(()=>c("/etc/passwd","utf8")))()):null;if(!r||r.gid===0)throw Error("worker_desktop_user_invalid");return u=r,r}function K(){return u}function Gn(){return u?.home??a()}
-export{$s,K,Gn};
+import{a}from"./vm-hands-entry-lite-y7z8pfgt.js";import{readFileSync as c}from"fs";import{isAbsolute as l,normalize as i}from"path";var m="REASON_WORKER_DESKTOP_USER",u=null;function p(t,o){for(let s of o.split(`
+`)){let e=s.split(":");if(e.length<7||Number(e[2])!==t||!/^\d+$/.test(e[2])||!/^\d+$/.test(e[3]))continue;let n=e[5];if(!/^[a-z_][a-z0-9_-]*$/i.test(e[0])||!l(n)||i(n)!==n||n==="/")return null;return{username:e[0],uid:t,gid:Number(e[3]),home:n}}return null}function Bs(t={}){let o="value"in t?t.value:process.env[m];if(u=null,o===void 0||o==="")return null;let s=t.platform??process.platform,e="euid"in t?t.euid:process.geteuid?.(),n=/^[1-9]\d{0,9}$/.test(o)?Number(o):NaN,r=s==="linux"&&e===0&&Number.isSafeInteger(n)?p(n,(t.passwd??(()=>c("/etc/passwd","utf8")))()):null;if(!r||r.gid===0)throw Error("worker_desktop_user_invalid");return u=r,r}function K(){return u}function Gn(){return u?.home??a()}
+export{Bs,K,Gn};

package/bin/vm-hands/{vm-hands-entry-lite-jyvmw8b7.js → vm-hands-entry-lite-whdnstpa.js}

@@ -1,5 +1,5 @@
 // @bun
-import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ie,spawn as E}from"child_process";var fo="h264_ws_v1",mo="video",lt=["smooth","sharp","data_saver","balanced"];var go="video_presets";var L=8388608,S=65536,_o="control",yo="v1",X=200;function Ln(t){if(!t||typeof t!=="object"||Array.isArray(t))return null;let e=t,n=(i)=>typeof i==="string"&&i.length>0&&i.length<=X;if(Object.keys(e).length!==2||!n(e.user_id)||!n(e.name))return null;return{user_id:e.user_id,name:e.name}}var wo="windows",bo="v1",D=200,J=(t)=>typeof t==="string"&&lt.includes(t);function vo(t){if(!t||typeof t!=="object"||Array.isArray(t))return null;let e=t;if(Object.keys(e).length!==2||e.format!=="h264_ws_v1"||!J(e.preset))return null;return{format:"h264_ws_v1",preset:e.preset}}var o={hello:1,frame:2,stats:3,pong:4,serverClipboard:5,error:6,audioHello:7,audio:8,control:9,windows:10,pointer:16,key:17,config:18,ping:19,clientClipboard:20,keyframeRequest:21,ack:22,audioEnable:23,resize:24};class l extends Error{constructor(t){super(t);this.name="DisplayVideoProtocolError"}}var Z=new TextEncoder,Q=new TextDecoder("utf-8",{fatal:!0});function p(t,e){if(e.byteLength+1>L)throw new l("message_too_large");let n=new Uint8Array(5+e.byteLength),i=new DataView(n.buffer);return i.setUint32(0,e.byteLength+1),i.setUint8(4,t),n.set(e,5),n}function w(t){let e=Z.encode(t);if(e.byteLength>S)throw new l("text_too_large");return e}function _(t,e){if(!Number.isInteger(t)||t<0||t>65535)throw new l(`invalid_${e}`);return t}function ee(t){if(!Number.isFinite(t))throw new l("invalid_window");return Math.max(-2147483648,Math.min(2147483647,Math.round(t)))}function zt(t){switch(t.type){case"hello":{let e=w(t.codec),n=new Uint8Array(6+e.byteLength),i=new DataView(n.buffer);return i.setUint16(0,_(t.width,"width")),i.setUint16(2,_(t.height,"height")),i.setUint8(4,Math.max(1,Math.min(240,Math.round(t.fps)))),i.setUint8(5,lt.indexOf(t.preset)),n.set(e,6),p(o.hello,n)}case"frame":{let e=new Uint8Array(13+t.data.byteLength),n=new DataView(e.buffer);return n.setUint8(0,t.key?1:0),n.setUint32(1,t.seq>>>0),n.setBigUint64(5,BigInt(Math.max(0,Math.floor(t.captureMicros)))),e.set(t.data,13),p(o.frame,e)}case"stats":return p(o.stats,w(JSON.stringify(t.stats)));case"pong":case"ping":{let e=new Uint8Array(8);return new DataView(e.buffer).setFloat64(0,t.token),p(t.type==="ping"?o.ping:o.pong,e)}case"serverClipboard":return p(o.serverClipboard,w(t.text));case"clientClipboard":return p(o.clientClipboard,w(t.text));case"error":return p(o.error,w(t.code));case"pointer":{let e=new Uint8Array(5),n=new DataView(e.buffer);return n.setUint16(0,_(t.x,"x")),n.setUint16(2,_(t.y,"y")),n.setUint8(4,t.buttons&255),p(o.pointer,e)}case"key":{let e=new Uint8Array(5),n=new DataView(e.buffer);return n.setUint8(0,t.down?1:0),n.setUint32(1,t.keysym>>>0),p(o.key,e)}case"config":return p(o.config,Uint8Array.of(lt.indexOf(t.preset)));case"keyframeRequest":return p(o.keyframeRequest,new Uint8Array(0));case"audioHello":{let e=w(t.codec),n=new Uint8Array(5+e.byteLength),i=new DataView(n.buffer);return i.setUint32(0,t.sampleRate>>>0),i.setUint8(4,t.channels&255),n.set(e,5),p(o.audioHello,n)}case"audio":{let e=new Uint8Array(8+t.data.byteLength);return new DataView(e.buffer).setBigUint64(0,BigInt(Math.max(0,Math.floor(t.captureMicros)))),e.set(t.data,8),p(o.audio,e)}case"control":return p(o.control,w(JSON.stringify(t.control)));case"windows":{let e=t.bounds.slice(0,D),n=new Uint8Array(e.length*16),i=new DataView(n.buffer);return e.forEach((s,a)=>{[s.x,s.y,s.width,s.height].forEach((c,d)=>i.setInt32(a*16+d*4,ee(c)))}),p(o.windows,n)}case"audioEnable":return p(o.audioEnable,Uint8Array.of(t.on?1:0));case"resize":{let e=new Uint8Array(4),n=new DataView(e.buffer);return n.setUint16(0,_(t.width,"width")),n.setUint16(2,_(t.height,"height")),p(o.resize,e)}case"ack":{let e=new Uint8Array(4);return new DataView(e.buffer).setUint32(0,t.seq>>>0),p(o.ack,e)}}}function M(t){let e=lt[t];if(!e)throw new l("invalid_preset");return e}function y(t,e){if(t.byteLength!==e)throw new l("invalid_length")}function x(t){if(t.byteLength>S)throw new l("text_too_large");try{return Q.decode(t)}catch{throw new l("invalid_text")}}function te(t){let e;try{e=JSON.parse(x(t))}catch{throw new l("invalid_stats")}let n=e;if(!n||typeof n!=="object"||["fps","kbps","dropped","restarts","queued_bytes"].some((s)=>typeof n[s]!=="number"||!Number.isFinite(n[s])))throw new l("invalid_stats");return{fps:n.fps,kbps:n.kbps,dropped:n.dropped,restarts:n.restarts,queued_bytes:n.queued_bytes}}function ne(t){let e;try{e=JSON.parse(x(t))}catch{throw new l("invalid_control")}let n=e;if(!n||typeof n!=="object"||typeof n.you!=="boolean"||typeof n.same_user!=="boolean")throw new l("invalid_control");let i=n.holder===null?null:Ln(n.holder);if(i===null&&n.holder!==null)throw new l("invalid_control");return{holder:i,you:n.you,same_user:n.same_user}}function re(t,e){let n=new DataView(e.buffer,e.byteOffset,e.byteLength);switch(t){case o.hello:if(e.byteLength<6)throw new l("invalid_length");return{type:"hello",width:n.getUint16(0),height:n.getUint16(2),fps:n.getUint8(4),preset:M(n.getUint8(5)),codec:x(e.subarray(6))};case o.frame:if(e.byteLength<14)throw new l("invalid_length");if(n.getUint8(0)>1)throw new l("invalid_frame_flags");return{type:"frame",key:n.getUint8(0)===1,seq:n.getUint32(1),captureMicros:Number(n.getBigUint64(5)),data:e.subarray(13)};case o.stats:return{type:"stats",stats:te(e)};case o.ping:case o.pong:return y(e,8),{type:t===o.ping?"ping":"pong",token:n.getFloat64(0)};case o.serverClipboard:return{type:"serverClipboard",text:x(e)};case o.clientClipboard:return{type:"clientClipboard",text:x(e)};case o.error:return{type:"error",code:x(e)};case o.pointer:return y(e,5),{type:"pointer",x:n.getUint16(0),y:n.getUint16(2),buttons:n.getUint8(4)};case o.key:if(y(e,5),n.getUint8(0)>1)throw new l("invalid_key_flags");return{type:"key",down:n.getUint8(0)===1,keysym:n.getUint32(1)};case o.config:return y(e,1),{type:"config",preset:M(n.getUint8(0))};case o.keyframeRequest:return y(e,0),{type:"keyframeRequest"};case o.audioHello:if(e.byteLength<5)throw new l("invalid_length");return{type:"audioHello",sampleRate:n.getUint32(0),channels:n.getUint8(4),codec:x(e.subarray(5))};case o.audio:if(e.byteLength<9)throw new l("invalid_length");return{type:"audio",captureMicros:Number(n.getBigUint64(0)),data:e.subarray(8)};case o.audioEnable:if(y(e,1),n.getUint8(0)>1)throw new l("invalid_audio_flags");return{type:"audioEnable",on:n.getUint8(0)===1};case o.resize:return y(e,4),{type:"resize",width:n.getUint16(0),height:n.getUint16(2)};case o.control:return{type:"control",control:ne(e)};case o.windows:{if(e.byteLength%16!==0||e.byteLength>D*16)throw new l("invalid_length");let i=[];for(let s=0;s<e.byteLength;s+=16)i.push({x:n.getInt32(s),y:n.getInt32(s+4),width:n.getInt32(s+8),height:n.getInt32(s+12)});return{type:"windows",bounds:i}}case o.ack:return y(e,4),{type:"ack",seq:n.getUint32(0)};default:return null}}class Mn{buffer=new Uint8Array(0);push(t){let e=new Uint8Array(this.buffer.byteLength+t.byteLength);e.set(this.buffer),e.set(t,this.buffer.byteLength);let n=[],i=0;while(e.byteLength-i>=4){let s=new DataView(e.buffer,e.byteOffset+i,4).getUint32(0);if(s<1||s>L)throw new l("invalid_message_length");if(e.byteLength-i-4<s)break;let a=e[i+4],c=e.slice(i+5,i+4+s),d=re(a,c);if(d)n.push(d);i+=4+s}return this.buffer=e.slice(i),n}}var Y="/usr/bin/osascript",se=5000,oe=1048576,ae=String.raw`
+import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ie,spawn as E}from"child_process";var mo="h264_ws_v1",go="video",ut=["smooth","sharp","data_saver","balanced"];var _o="video_presets";var L=8388608,S=65536,yo="control",wo="v1",X=200;function Ln(t){if(!t||typeof t!=="object"||Array.isArray(t))return null;let e=t,n=(i)=>typeof i==="string"&&i.length>0&&i.length<=X;if(Object.keys(e).length!==2||!n(e.user_id)||!n(e.name))return null;return{user_id:e.user_id,name:e.name}}var bo="windows",vo="v1",D=200,J=(t)=>typeof t==="string"&&ut.includes(t);function So(t){if(!t||typeof t!=="object"||Array.isArray(t))return null;let e=t;if(Object.keys(e).length!==2||e.format!=="h264_ws_v1"||!J(e.preset))return null;return{format:"h264_ws_v1",preset:e.preset}}var o={hello:1,frame:2,stats:3,pong:4,serverClipboard:5,error:6,audioHello:7,audio:8,control:9,windows:10,pointer:16,key:17,config:18,ping:19,clientClipboard:20,keyframeRequest:21,ack:22,audioEnable:23,resize:24};class l extends Error{constructor(t){super(t);this.name="DisplayVideoProtocolError"}}var Z=new TextEncoder,Q=new TextDecoder("utf-8",{fatal:!0});function p(t,e){if(e.byteLength+1>L)throw new l("message_too_large");let n=new Uint8Array(5+e.byteLength),i=new DataView(n.buffer);return i.setUint32(0,e.byteLength+1),i.setUint8(4,t),n.set(e,5),n}function w(t){let e=Z.encode(t);if(e.byteLength>S)throw new l("text_too_large");return e}function _(t,e){if(!Number.isInteger(t)||t<0||t>65535)throw new l(`invalid_${e}`);return t}function ee(t){if(!Number.isFinite(t))throw new l("invalid_window");return Math.max(-2147483648,Math.min(2147483647,Math.round(t)))}function zt(t){switch(t.type){case"hello":{let e=w(t.codec),n=new Uint8Array(6+e.byteLength),i=new DataView(n.buffer);return i.setUint16(0,_(t.width,"width")),i.setUint16(2,_(t.height,"height")),i.setUint8(4,Math.max(1,Math.min(240,Math.round(t.fps)))),i.setUint8(5,ut.indexOf(t.preset)),n.set(e,6),p(o.hello,n)}case"frame":{let e=new Uint8Array(13+t.data.byteLength),n=new DataView(e.buffer);return n.setUint8(0,t.key?1:0),n.setUint32(1,t.seq>>>0),n.setBigUint64(5,BigInt(Math.max(0,Math.floor(t.captureMicros)))),e.set(t.data,13),p(o.frame,e)}case"stats":return p(o.stats,w(JSON.stringify(t.stats)));case"pong":case"ping":{let e=new Uint8Array(8);return new DataView(e.buffer).setFloat64(0,t.token),p(t.type==="ping"?o.ping:o.pong,e)}case"serverClipboard":return p(o.serverClipboard,w(t.text));case"clientClipboard":return p(o.clientClipboard,w(t.text));case"error":return p(o.error,w(t.code));case"pointer":{let e=new Uint8Array(5),n=new DataView(e.buffer);return n.setUint16(0,_(t.x,"x")),n.setUint16(2,_(t.y,"y")),n.setUint8(4,t.buttons&255),p(o.pointer,e)}case"key":{let e=new Uint8Array(5),n=new DataView(e.buffer);return n.setUint8(0,t.down?1:0),n.setUint32(1,t.keysym>>>0),p(o.key,e)}case"config":return p(o.config,Uint8Array.of(ut.indexOf(t.preset)));case"keyframeRequest":return p(o.keyframeRequest,new Uint8Array(0));case"audioHello":{let e=w(t.codec),n=new Uint8Array(5+e.byteLength),i=new DataView(n.buffer);return i.setUint32(0,t.sampleRate>>>0),i.setUint8(4,t.channels&255),n.set(e,5),p(o.audioHello,n)}case"audio":{let e=new Uint8Array(8+t.data.byteLength);return new DataView(e.buffer).setBigUint64(0,BigInt(Math.max(0,Math.floor(t.captureMicros)))),e.set(t.data,8),p(o.audio,e)}case"control":return p(o.control,w(JSON.stringify(t.control)));case"windows":{let e=t.bounds.slice(0,D),n=new Uint8Array(e.length*16),i=new DataView(n.buffer);return e.forEach((s,a)=>{[s.x,s.y,s.width,s.height].forEach((c,d)=>i.setInt32(a*16+d*4,ee(c)))}),p(o.windows,n)}case"audioEnable":return p(o.audioEnable,Uint8Array.of(t.on?1:0));case"resize":{let e=new Uint8Array(4),n=new DataView(e.buffer);return n.setUint16(0,_(t.width,"width")),n.setUint16(2,_(t.height,"height")),p(o.resize,e)}case"ack":{let e=new Uint8Array(4);return new DataView(e.buffer).setUint32(0,t.seq>>>0),p(o.ack,e)}}}function M(t){let e=ut[t];if(!e)throw new l("invalid_preset");return e}function y(t,e){if(t.byteLength!==e)throw new l("invalid_length")}function x(t){if(t.byteLength>S)throw new l("text_too_large");try{return Q.decode(t)}catch{throw new l("invalid_text")}}function te(t){let e;try{e=JSON.parse(x(t))}catch{throw new l("invalid_stats")}let n=e;if(!n||typeof n!=="object"||["fps","kbps","dropped","restarts","queued_bytes"].some((s)=>typeof n[s]!=="number"||!Number.isFinite(n[s])))throw new l("invalid_stats");return{fps:n.fps,kbps:n.kbps,dropped:n.dropped,restarts:n.restarts,queued_bytes:n.queued_bytes}}function ne(t){let e;try{e=JSON.parse(x(t))}catch{throw new l("invalid_control")}let n=e;if(!n||typeof n!=="object"||typeof n.you!=="boolean"||typeof n.same_user!=="boolean")throw new l("invalid_control");let i=n.holder===null?null:Ln(n.holder);if(i===null&&n.holder!==null)throw new l("invalid_control");return{holder:i,you:n.you,same_user:n.same_user}}function re(t,e){let n=new DataView(e.buffer,e.byteOffset,e.byteLength);switch(t){case o.hello:if(e.byteLength<6)throw new l("invalid_length");return{type:"hello",width:n.getUint16(0),height:n.getUint16(2),fps:n.getUint8(4),preset:M(n.getUint8(5)),codec:x(e.subarray(6))};case o.frame:if(e.byteLength<14)throw new l("invalid_length");if(n.getUint8(0)>1)throw new l("invalid_frame_flags");return{type:"frame",key:n.getUint8(0)===1,seq:n.getUint32(1),captureMicros:Number(n.getBigUint64(5)),data:e.subarray(13)};case o.stats:return{type:"stats",stats:te(e)};case o.ping:case o.pong:return y(e,8),{type:t===o.ping?"ping":"pong",token:n.getFloat64(0)};case o.serverClipboard:return{type:"serverClipboard",text:x(e)};case o.clientClipboard:return{type:"clientClipboard",text:x(e)};case o.error:return{type:"error",code:x(e)};case o.pointer:return y(e,5),{type:"pointer",x:n.getUint16(0),y:n.getUint16(2),buttons:n.getUint8(4)};case o.key:if(y(e,5),n.getUint8(0)>1)throw new l("invalid_key_flags");return{type:"key",down:n.getUint8(0)===1,keysym:n.getUint32(1)};case o.config:return y(e,1),{type:"config",preset:M(n.getUint8(0))};case o.keyframeRequest:return y(e,0),{type:"keyframeRequest"};case o.audioHello:if(e.byteLength<5)throw new l("invalid_length");return{type:"audioHello",sampleRate:n.getUint32(0),channels:n.getUint8(4),codec:x(e.subarray(5))};case o.audio:if(e.byteLength<9)throw new l("invalid_length");return{type:"audio",captureMicros:Number(n.getBigUint64(0)),data:e.subarray(8)};case o.audioEnable:if(y(e,1),n.getUint8(0)>1)throw new l("invalid_audio_flags");return{type:"audioEnable",on:n.getUint8(0)===1};case o.resize:return y(e,4),{type:"resize",width:n.getUint16(0),height:n.getUint16(2)};case o.control:return{type:"control",control:ne(e)};case o.windows:{if(e.byteLength%16!==0||e.byteLength>D*16)throw new l("invalid_length");let i=[];for(let s=0;s<e.byteLength;s+=16)i.push({x:n.getInt32(s),y:n.getInt32(s+4),width:n.getInt32(s+8),height:n.getInt32(s+12)});return{type:"windows",bounds:i}}case o.ack:return y(e,4),{type:"ack",seq:n.getUint32(0)};default:return null}}class Mn{buffer=new Uint8Array(0);push(t){let e=new Uint8Array(this.buffer.byteLength+t.byteLength);e.set(this.buffer),e.set(t,this.buffer.byteLength);let n=[],i=0;while(e.byteLength-i>=4){let s=new DataView(e.buffer,e.byteOffset+i,4).getUint32(0);if(s<1||s>L)throw new l("invalid_message_length");if(e.byteLength-i-4<s)break;let a=e[i+4],c=e.slice(i+5,i+4+s),d=re(a,c);if(d)n.push(d);i+=4+s}return this.buffer=e.slice(i),n}}var Y="/usr/bin/osascript",se=5000,oe=1048576,ae=String.raw`
 ObjC.import("CoreGraphics");
 ObjC.import("ApplicationServices");
 ObjC.import("AppKit");
@@ -70,7 +70,7 @@ function run(argv) {
   }
 }
 `;function q(t){let e;try{e=JSON.parse(t)}catch{return null}if(!e||typeof e!=="object")return null;let n=e,i=(c)=>typeof c==="number"&&Number.isFinite(c)?Math.min(65535,Math.round(c)):0;if(typeof n.screen!=="boolean"||typeof n.accessibility!=="boolean")return null;let s=i(n.width),a=i(n.height);return s>0&&a>0?{screen:n.screen,accessibility:n.accessibility,width:s,height:a}:null}function k(t,...e){let[n,...i]=[...t,Y,"-l","JavaScript","-e",ae,...e];return[n,i]}function H(t,...e){return new Promise((n)=>{ie(...k(t,...e),{env:{},timeout:se,killSignal:"SIGKILL",maxBuffer:65536,encoding:"utf8"},(i,s)=>n(i?null:q(s.split(`
-`)[0]??"")))})}function Ge(t=[]){return H(t,"probe")}function ut(t,e){return H(t,"request",...e?[e]:[])}var N=2,ce=8,ue=String.raw`
+`)[0]??"")))})}function Ge(t=[]){return H(t,"probe")}function dt(t,e){return H(t,"request",...e?[e]:[])}var N=2,ce=8,ue=String.raw`
 ObjC.import("CoreGraphics");
 ObjC.import("Foundation");
 ObjC.bindFunction("getppid", ["int", []]);
@@ -109,4 +109,4 @@ function run() {
 `);h>=0;h=f.indexOf(`
 `)){let U=f.slice(0,h);if(f=f.slice(h+1),!U.startsWith("c "))continue;let A=U.slice(2);if(A.length>Math.ceil(S/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(A)){u({reason:"display_protocol"});return}let C=Buffer.from(A,"base64");if(C.byteLength<=S)t.clipboard(C.toString("utf8"));if(a)return}if(f.length>Math.ceil(S/3)*4+2)u({reason:"display_protocol"})}),c.once("error",()=>b("Reason could not watch this Mac's desktop clipboard.")),c.once("exit",()=>{if(!a)b("Reason could not watch this Mac's desktop clipboard.")})};return n.stdout.on("data",(f)=>{if(a||s===null)return;s+=f.toString("utf8");let g=s.indexOf(`
 `);if(g<0){if(s.length>4096)u({reason:"display_protocol"});return}let h=q(s.slice(0,g));if(s=null,!h)u({reason:"display_protocol"});else if(!h.screen||!h.accessibility)b(e.length>0?"Reason's background worker needs Screen Recording and Accessibility on this Mac (its own Reason entry in System Settings > Privacy & Security, not the Reason app's): run `reason permissions allow` on this Mac.":"Allow Screen Recording and Accessibility for this Mac's Reason worker, then restart it.");else z(),t.ready({width:h.width,height:h.height})}),n.stdin.on("error",()=>{return}),n.once("error",()=>b("Reason could not start this Mac's desktop input.")),n.once("exit",()=>{if(s!==null)b("Reason could not start this Mac's desktop input.");else u({reason:"display_closed"})}),{pointer:(f,g,h)=>m(i.pointer(f,g,h)),key:(f,g)=>m(i.key(f,g)),clipboard:(f)=>m([`c ${Buffer.from(f,"utf8").toString("base64")}`]),close(){a=!0,d()}}}
-export{fo,mo,lt,go,S,_o,yo,Ln,wo,bo,vo,zt,Mn,Ge,ut,$n,Bn};
+export{mo,go,ut,_o,S,yo,wo,Ln,bo,vo,So,zt,Mn,Ge,dt,$n,Bn};

package/bin/vm-hands/{vm-hands-entry-lite-arrmd8qx.js → vm-hands-entry-lite-xkba45hh.js}

@@ -1,3 +1,3 @@
 // @bun
-var i="libara_device_keychain.dylib",e="libreason_device_keychain.dylib";class ht extends Error{code;constructor(n,t){super(t);this.code=n;this.name="ManagedRuntimeError"}}import{existsSync as s}from"fs";import{join as a}from"path";function Co(n){let t=a(n,e);return s(t)?t:a(n,i)}
-export{ht,Co};
+var i="libara_device_keychain.dylib",e="libreason_device_keychain.dylib";class ft extends Error{code;constructor(n,t){super(t);this.code=n;this.name="ManagedRuntimeError"}}import{existsSync as s}from"fs";import{join as a}from"path";function Ao(n){let t=a(n,e);return s(t)?t:a(n,i)}
+export{ft,Ao};

package/bin/vm-hands/{vm-hands-entry-lite-cf1x5cbr.js → vm-hands-entry-lite-y7z8pfgt.js}

@@ -1,3 +1,3 @@
 // @bun
-import{de,Qe,O}from"./vm-hands-entry-lite-3krzmhkk.js";import{execFileSync as p}from"child_process";import{existsSync as s,realpathSync as c}from"fs";import{userInfo as l}from"os";import{isAbsolute as u,join as t,normalize as f,parse as d}from"path";function a(){let r=f(l().homedir);if(!u(r)||r===d(r).root)throw Error("Could not resolve the canonical user home.");return r}function ie(r,n,e=a()){let i=O(n);if(n.kind==="managed"&&n.base){let o=c(e);return{anchor:o,boundary:t(o,n.base),path:t(o,i)}}if(n.kind==="root"&&Qe(n.path)){let o=c(e);return{anchor:o,boundary:t(o,de),path:t(o,i)}}return{anchor:r,boundary:r,path:t(r,i)}}function tr(r=a()){return t(r,".config")}function No(){if(process.platform!=="darwin")return null;try{let r=p("/usr/bin/getconf",["DARWIN_USER_DIR"],{encoding:"utf8",timeout:5000}).trim();return u(r)?c(r):null}catch{return null}}function Lo(r=a()){let n=t(r,"Library","Application Support","Ara"),e=t(r,"Library","Application Support","Reason");return s(n)&&!s(e)?n:e}
-export{a,ie,tr,No,Lo};
+import{de,et,O}from"./vm-hands-entry-lite-38g65s5x.js";import{execFileSync as p}from"child_process";import{existsSync as s,realpathSync as c}from"fs";import{userInfo as l}from"os";import{isAbsolute as u,join as t,normalize as f,parse as d}from"path";function a(){let r=f(l().homedir);if(!u(r)||r===d(r).root)throw Error("Could not resolve the canonical user home.");return r}function ie(r,n,e=a()){let i=O(n);if(n.kind==="managed"&&n.base){let o=c(e);return{anchor:o,boundary:t(o,n.base),path:t(o,i)}}if(n.kind==="root"&&et(n.path)){let o=c(e);return{anchor:o,boundary:t(o,de),path:t(o,i)}}return{anchor:r,boundary:r,path:t(r,i)}}function tr(r=a()){return t(r,".config")}function Lo(){if(process.platform!=="darwin")return null;try{let r=p("/usr/bin/getconf",["DARWIN_USER_DIR"],{encoding:"utf8",timeout:5000}).trim();return u(r)?c(r):null}catch{return null}}function Mo(r=a()){let n=t(r,"Library","Application Support","Ara"),e=t(r,"Library","Application Support","Reason");return s(n)&&!s(e)?n:e}
+export{a,ie,tr,Lo,Mo};

package/bin/vm-hands/{vm-hands-entry-lite-5zdybh8s.js → vm-hands-entry-lite-ya9p67x3.js}

@@ -1,2 +1,2 @@
 // @bun
-import{H}from"./vm-hands-entry-lite-3krzmhkk.js";var So=32;var Eo="__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__",xo=262144;var P=2,$r=33554432,Br=200000,Un=4000000,pt=240000;var Hn=2000;var Fr=16384,Je=32768,Se=128,zn=64,Ze=2097152,Jt=1,ne=16384,Xe=32768,qn=8388608,Ee=1000,Zt=2500,jr=2000,Xt=Zt+jr,R=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/,h=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Ur={text_only:4430,invalid_json:4431,invalid_cancel_request:4432,invalid_sdk_response:4433,claim_required:4434,invalid_claim:4435,executor_mismatch:4436,stale_generation:4437,fence_conflict:4438,frame_too_large:4439,result_too_large:4440,progress_too_large:4441,terminal_cleanup_started:4442,job_journal_unavailable:4443},I=new Map(Object.entries(Ur).map(([t,n])=>[n,t]));var y=["cancelled","command_failed","duplicate_request_id","duplicate_result_evicted","invalid_repl_response","invalid_request","process_group_cleanup_unconfirmed","repl_failed","result_too_large","repl_response_too_large","repl_transport_failed","request_ledger_full","request_journal_unavailable","request_outcome_uncertain","maintenance_held","request_not_found","resume_digest_mismatch","spawn_failed","stale_generation","timeout"],k=new Set(y),Wn=16384,w=["maintenance_held","invalid_job_request","jobs_disabled","job_not_found","job_conflict","job_capacity","job_journal_unavailable","job_not_running","job_lease_expired","job_input_sequence","job_input_backpressure","stale_generation","pty_unsupported","job_mode_mismatch"];class r extends Error{code;constructor(t){super(t);this.name="HandsProtocolError",this.code=t}}function m(t){return new TextEncoder().encode(t).byteLength}function a(t){return typeof t==="object"&&t!==null&&!Array.isArray(t)}function i(t,n){let e=new Set(n);return Object.keys(t).every((s)=>e.has(s))}function ae(t){return typeof t==="string"&&R.test(t)}function U(t){return Number.isSafeInteger(t)&&Number(t)>=1}function N(t){return typeof t==="string"&&h.test(t)}function ce(t){return typeof t==="string"&&t.startsWith("pty-")&&N(t.slice(4))}function p(t){return[t.cols,t.rows].every((n)=>Number.isSafeInteger(n)&&Number(n)>=1&&Number(n)<=Ee)}function _(t){if(typeof t!=="string"||t.length>Math.ceil(ne/3)*4||t.length%4!==0||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(t))return-1;let n=t.endsWith("==")?2:t.endsWith("=")?1:0;if(n&&"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(t[t.length-n-1])&(n===2?15:3))return-1;let s=t.length/4*3-n;return s<=ne?s:-1}function l(t){if(m(t)>$r)throw new r("frame_too_large");try{return JSON.parse(t)}catch{throw new r("invalid_json")}}function Hr(t){let n=l(t);if(!a(n)||!i(n,["type","version","generation","id","jobId","action","input"])||n.type!=="job"||n.version!==P||!U(n.generation)||!ae(n.id)||!ae(n.jobId)||!a(n.input))throw new r("invalid_job_request");let e=n.input,s=Number.isSafeInteger(e.leaseExpiresAtMs)&&Number(e.leaseExpiresAtMs)>0,d=Number.isSafeInteger(e.sequence)&&Number(e.sequence)>=1;if(!(n.action==="start"?e.mode==="pty"?i(e,["mode","cols","rows","leaseExpiresAtMs"])&&ce(n.jobId)&&p(e)&&s:i(e,["script","leaseExpiresAtMs"])&&typeof e.script==="string"&&e.script.length<=Br&&s:n.action==="inspect"?i(e,["after"])&&Number.isSafeInteger(e.after)&&Number(e.after)>=0:n.action==="input"?"dataBase64"in e?i(e,["sequence","dataBase64"])&&ce(n.jobId)&&d&&_(e.dataBase64)>0:i(e,["sequence","data","eof"])&&d&&typeof e.data==="string"&&e.data.length<=Fr&&typeof e.eof==="boolean":n.action==="resize"?i(e,["sequence","cols","rows"])&&ce(n.jobId)&&d&&p(e):n.action==="renew"?i(e,["leaseExpiresAtMs"])&&s:n.action==="cancel"&&i(e,[])))throw new r("invalid_job_request");return n}function zr(t){let n=l(t);if(!a(n)||!i(n,["type","version","generation","id","ok","job","error"])||n.type!=="job_result"||n.version!==P||!U(n.generation)||!ae(n.id))throw new r("invalid_job_result");if(n.ok===!1&&n.job===void 0&&typeof n.error==="string"&&w.some((o)=>o===n.error))return n;let e=n.job;if(n.ok!==!0||n.error!==void 0||!a(e)||!i(e,["jobId","state","startedAtMs","finishedAtMs","leaseExpiresAtMs","exitCode","inputSequence","output","firstCursor","nextCursor","truncated","process","environmentRevision","environmentSnapshotId","pty"])||!ae(e.jobId)||!["starting","running","exited","cancelled","expired","uncertain"].includes(String(e.state))||!Number.isSafeInteger(e.startedAtMs)||Number(e.startedAtMs)<1||!Number.isSafeInteger(e.leaseExpiresAtMs)||Number(e.leaseExpiresAtMs)<1||e.finishedAtMs!==null&&(!Number.isSafeInteger(e.finishedAtMs)||Number(e.finishedAtMs)<Number(e.startedAtMs))||e.exitCode!==null&&(!Number.isSafeInteger(e.exitCode)||Number(e.exitCode)<0||Number(e.exitCode)>255)||!Number.isSafeInteger(e.inputSequence)||Number(e.inputSequence)<0||!Number.isSafeInteger(e.firstCursor)||Number(e.firstCursor)<1||!Number.isSafeInteger(e.nextCursor)||Number(e.nextCursor)<Number(e.firstCursor)-1||typeof e.truncated!=="boolean"||!Array.isArray(e.output)||e.output.length>Se)throw new r("invalid_job_result");if(e.environmentRevision===void 0!==(e.environmentSnapshotId===void 0)||e.environmentRevision!==void 0&&(!Number.isSafeInteger(e.environmentRevision)||Number(e.environmentRevision)<1||!N(e.environmentSnapshotId)))throw new r("invalid_job_result");let s=Number(e.firstCursor)-1,d=0;for(let o of e.output){if(!a(o)||!i(o,["cursor","stream","text"])||!Number.isSafeInteger(o.cursor)||Number(o.cursor)<=s||Number(o.cursor)>Number(e.nextCursor)||!["stdout","stderr"].includes(String(o.stream))||typeof o.text!=="string")throw new r("invalid_job_result");d+=o.text.length,s=Number(o.cursor)}if(d>Je)throw new r("invalid_job_result");let c=e.state==="starting"||e.state==="running";if(c&&(e.finishedAtMs!==null||e.exitCode!==null)||!c&&e.finishedAtMs===null||e.state==="uncertain"&&e.exitCode!==null||e.state==="exited"&&e.exitCode===null||e.state==="cancelled"&&e.exitCode!==130||e.state==="expired"&&e.exitCode!==124)throw new r("invalid_job_result");if(e.process!==void 0){let o=e.process;if(!a(o)||!i(o,["pid","processGroupId","executorLaunchId"])||!Number.isSafeInteger(o.pid)||Number(o.pid)<1||o.processGroupId!==o.pid||!N(o.executorLaunchId)||!["starting","running"].includes(String(e.state)))throw new r("invalid_job_result")}if(e.pty!==void 0){let o=e.pty;if(!a(o)||!i(o,["version","cols","rows","output","cleanup"])||o.version!==Jt||!ce(e.jobId)||!p(o)||e.output.length!==0||!Array.isArray(o.output)||o.output.length>Se||(c?o.cleanup!=="pending":e.state==="uncertain"?o.cleanup!=="unconfirmed":o.cleanup!=="confirmed")||e.state==="running"&&(e.process===void 0||e.environmentRevision===void 0))throw new r("invalid_job_result");let g=Number(e.firstCursor)-1,b=0;for(let u of o.output){if(!a(u)||!i(u,["cursor","dataBase64"])||!Number.isSafeInteger(u.cursor)||Number(u.cursor)<=g||Number(u.cursor)>Number(e.nextCursor))throw new r("invalid_job_result");let f=_(u.dataBase64);if(f<=0||(b+=f)>Xe)throw new r("invalid_job_result");g=Number(u.cursor)}}return n}function Vn(t){if(m(t)>Ze)throw new r("frame_too_large");let n=l(t);if(!a(n)||!i(n,["version","sessionId","operationId","runId","deviceId","rootId","workspace","binding","targetRevision","rootGrantRevision","generation","fenceId","executorLaunchId","job"])||n.version!==Jt||![n.sessionId,n.operationId,n.runId].every(ae)||![n.deviceId,n.rootId,n.fenceId,n.executorLaunchId].every(N)||!U(n.generation)||!Number.isSafeInteger(n.rootGrantRevision)||Number(n.rootGrantRevision)<1||!["workspace_source","mcp_control"].includes(String(n.binding))||!Number.isSafeInteger(n.targetRevision)||Number(n.targetRevision)<0||n.binding==="workspace_source"&&n.targetRevision!==0||!a(n.workspace))throw new r("invalid_pty_receipt");if(!H(n.workspace))throw new r("invalid_pty_receipt");let e=zr(JSON.stringify({type:"job_result",version:P,generation:n.generation,id:n.operationId,ok:!0,job:n.job}));if(!e.ok||!e.job.pty||e.job.pty.output.length!==0||e.job.process&&e.job.process.executorLaunchId!==n.executorLaunchId)throw new r("invalid_pty_receipt");return n}export{So,Eo,xo,P,$r,Br,Un,pt,Hn,Fr,Je,Se,zn,Ze,Jt,ne,Xe,qn,Ee,Zt,jr,Xt,Ur,Wn,ae,U,N,ce,Hr,zr,Vn};
+import{H}from"./vm-hands-entry-lite-38g65s5x.js";var Eo=32;var xo="__ARA_PI_TOOL_CONFINED_SCRIPT_5f0c9e2a__",ko=262144;var P=2,$r=33554432,Br=200000,Un=4000000,ht=240000;var Hn=2000;var Fr=16384,Je=32768,Se=128,zn=64,Ze=2097152,Jt=1,ne=16384,Xe=32768,qn=8388608,Ee=1000,Zt=2500,jr=2000,Xt=Zt+jr,R=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/,h=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Ur={text_only:4430,invalid_json:4431,invalid_cancel_request:4432,invalid_sdk_response:4433,claim_required:4434,invalid_claim:4435,executor_mismatch:4436,stale_generation:4437,fence_conflict:4438,frame_too_large:4439,result_too_large:4440,progress_too_large:4441,terminal_cleanup_started:4442,job_journal_unavailable:4443},I=new Map(Object.entries(Ur).map(([t,n])=>[n,t]));var y=["cancelled","command_failed","duplicate_request_id","duplicate_result_evicted","invalid_repl_response","invalid_request","process_group_cleanup_unconfirmed","repl_failed","result_too_large","repl_response_too_large","repl_transport_failed","request_ledger_full","request_journal_unavailable","request_outcome_uncertain","maintenance_held","request_not_found","resume_digest_mismatch","spawn_failed","stale_generation","timeout"],k=new Set(y),Wn=16384,w=["maintenance_held","invalid_job_request","jobs_disabled","job_not_found","job_conflict","job_capacity","job_journal_unavailable","job_not_running","job_lease_expired","job_input_sequence","job_input_backpressure","stale_generation","pty_unsupported","job_mode_mismatch"];class r extends Error{code;constructor(t){super(t);this.name="HandsProtocolError",this.code=t}}function m(t){return new TextEncoder().encode(t).byteLength}function a(t){return typeof t==="object"&&t!==null&&!Array.isArray(t)}function i(t,n){let e=new Set(n);return Object.keys(t).every((s)=>e.has(s))}function ae(t){return typeof t==="string"&&R.test(t)}function U(t){return Number.isSafeInteger(t)&&Number(t)>=1}function N(t){return typeof t==="string"&&h.test(t)}function ce(t){return typeof t==="string"&&t.startsWith("pty-")&&N(t.slice(4))}function p(t){return[t.cols,t.rows].every((n)=>Number.isSafeInteger(n)&&Number(n)>=1&&Number(n)<=Ee)}function _(t){if(typeof t!=="string"||t.length>Math.ceil(ne/3)*4||t.length%4!==0||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(t))return-1;let n=t.endsWith("==")?2:t.endsWith("=")?1:0;if(n&&"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(t[t.length-n-1])&(n===2?15:3))return-1;let s=t.length/4*3-n;return s<=ne?s:-1}function l(t){if(m(t)>$r)throw new r("frame_too_large");try{return JSON.parse(t)}catch{throw new r("invalid_json")}}function Hr(t){let n=l(t);if(!a(n)||!i(n,["type","version","generation","id","jobId","action","input"])||n.type!=="job"||n.version!==P||!U(n.generation)||!ae(n.id)||!ae(n.jobId)||!a(n.input))throw new r("invalid_job_request");let e=n.input,s=Number.isSafeInteger(e.leaseExpiresAtMs)&&Number(e.leaseExpiresAtMs)>0,d=Number.isSafeInteger(e.sequence)&&Number(e.sequence)>=1;if(!(n.action==="start"?e.mode==="pty"?i(e,["mode","cols","rows","leaseExpiresAtMs"])&&ce(n.jobId)&&p(e)&&s:i(e,["script","leaseExpiresAtMs"])&&typeof e.script==="string"&&e.script.length<=Br&&s:n.action==="inspect"?i(e,["after"])&&Number.isSafeInteger(e.after)&&Number(e.after)>=0:n.action==="input"?"dataBase64"in e?i(e,["sequence","dataBase64"])&&ce(n.jobId)&&d&&_(e.dataBase64)>0:i(e,["sequence","data","eof"])&&d&&typeof e.data==="string"&&e.data.length<=Fr&&typeof e.eof==="boolean":n.action==="resize"?i(e,["sequence","cols","rows"])&&ce(n.jobId)&&d&&p(e):n.action==="renew"?i(e,["leaseExpiresAtMs"])&&s:n.action==="cancel"&&i(e,[])))throw new r("invalid_job_request");return n}function zr(t){let n=l(t);if(!a(n)||!i(n,["type","version","generation","id","ok","job","error"])||n.type!=="job_result"||n.version!==P||!U(n.generation)||!ae(n.id))throw new r("invalid_job_result");if(n.ok===!1&&n.job===void 0&&typeof n.error==="string"&&w.some((o)=>o===n.error))return n;let e=n.job;if(n.ok!==!0||n.error!==void 0||!a(e)||!i(e,["jobId","state","startedAtMs","finishedAtMs","leaseExpiresAtMs","exitCode","inputSequence","output","firstCursor","nextCursor","truncated","process","environmentRevision","environmentSnapshotId","pty"])||!ae(e.jobId)||!["starting","running","exited","cancelled","expired","uncertain"].includes(String(e.state))||!Number.isSafeInteger(e.startedAtMs)||Number(e.startedAtMs)<1||!Number.isSafeInteger(e.leaseExpiresAtMs)||Number(e.leaseExpiresAtMs)<1||e.finishedAtMs!==null&&(!Number.isSafeInteger(e.finishedAtMs)||Number(e.finishedAtMs)<Number(e.startedAtMs))||e.exitCode!==null&&(!Number.isSafeInteger(e.exitCode)||Number(e.exitCode)<0||Number(e.exitCode)>255)||!Number.isSafeInteger(e.inputSequence)||Number(e.inputSequence)<0||!Number.isSafeInteger(e.firstCursor)||Number(e.firstCursor)<1||!Number.isSafeInteger(e.nextCursor)||Number(e.nextCursor)<Number(e.firstCursor)-1||typeof e.truncated!=="boolean"||!Array.isArray(e.output)||e.output.length>Se)throw new r("invalid_job_result");if(e.environmentRevision===void 0!==(e.environmentSnapshotId===void 0)||e.environmentRevision!==void 0&&(!Number.isSafeInteger(e.environmentRevision)||Number(e.environmentRevision)<1||!N(e.environmentSnapshotId)))throw new r("invalid_job_result");let s=Number(e.firstCursor)-1,d=0;for(let o of e.output){if(!a(o)||!i(o,["cursor","stream","text"])||!Number.isSafeInteger(o.cursor)||Number(o.cursor)<=s||Number(o.cursor)>Number(e.nextCursor)||!["stdout","stderr"].includes(String(o.stream))||typeof o.text!=="string")throw new r("invalid_job_result");d+=o.text.length,s=Number(o.cursor)}if(d>Je)throw new r("invalid_job_result");let c=e.state==="starting"||e.state==="running";if(c&&(e.finishedAtMs!==null||e.exitCode!==null)||!c&&e.finishedAtMs===null||e.state==="uncertain"&&e.exitCode!==null||e.state==="exited"&&e.exitCode===null||e.state==="cancelled"&&e.exitCode!==130||e.state==="expired"&&e.exitCode!==124)throw new r("invalid_job_result");if(e.process!==void 0){let o=e.process;if(!a(o)||!i(o,["pid","processGroupId","executorLaunchId"])||!Number.isSafeInteger(o.pid)||Number(o.pid)<1||o.processGroupId!==o.pid||!N(o.executorLaunchId)||!["starting","running"].includes(String(e.state)))throw new r("invalid_job_result")}if(e.pty!==void 0){let o=e.pty;if(!a(o)||!i(o,["version","cols","rows","output","cleanup"])||o.version!==Jt||!ce(e.jobId)||!p(o)||e.output.length!==0||!Array.isArray(o.output)||o.output.length>Se||(c?o.cleanup!=="pending":e.state==="uncertain"?o.cleanup!=="unconfirmed":o.cleanup!=="confirmed")||e.state==="running"&&(e.process===void 0||e.environmentRevision===void 0))throw new r("invalid_job_result");let g=Number(e.firstCursor)-1,b=0;for(let u of o.output){if(!a(u)||!i(u,["cursor","dataBase64"])||!Number.isSafeInteger(u.cursor)||Number(u.cursor)<=g||Number(u.cursor)>Number(e.nextCursor))throw new r("invalid_job_result");let f=_(u.dataBase64);if(f<=0||(b+=f)>Xe)throw new r("invalid_job_result");g=Number(u.cursor)}}return n}function Vn(t){if(m(t)>Ze)throw new r("frame_too_large");let n=l(t);if(!a(n)||!i(n,["version","sessionId","operationId","runId","deviceId","rootId","workspace","binding","targetRevision","rootGrantRevision","generation","fenceId","executorLaunchId","job"])||n.version!==Jt||![n.sessionId,n.operationId,n.runId].every(ae)||![n.deviceId,n.rootId,n.fenceId,n.executorLaunchId].every(N)||!U(n.generation)||!Number.isSafeInteger(n.rootGrantRevision)||Number(n.rootGrantRevision)<1||!["workspace_source","mcp_control"].includes(String(n.binding))||!Number.isSafeInteger(n.targetRevision)||Number(n.targetRevision)<0||n.binding==="workspace_source"&&n.targetRevision!==0||!a(n.workspace))throw new r("invalid_pty_receipt");if(!H(n.workspace))throw new r("invalid_pty_receipt");let e=zr(JSON.stringify({type:"job_result",version:P,generation:n.generation,id:n.operationId,ok:!0,job:n.job}));if(!e.ok||!e.job.pty||e.job.pty.output.length!==0||e.job.process&&e.job.process.executorLaunchId!==n.executorLaunchId)throw new r("invalid_pty_receipt");return n}export{Eo,xo,ko,P,$r,Br,Un,ht,Hn,Fr,Je,Se,zn,Ze,Jt,ne,Xe,qn,Ee,Zt,jr,Xt,Ur,Wn,ae,U,N,ce,Hr,zr,Vn};

package/bin/vm-hands/vm-hands-entry-lite-ytazq3rk.js

@@ -0,0 +1,3 @@
+// @bun
+import{Ui,Hi}from"./vm-hands-entry-lite-gn2rg810.js";function hs(o=process.platform){if(Ui(),o==="linux"||o==="win32")Hi("strict")}
+export{hs};

package/bin/vm-hands/{vm-hands-entry-lite-jwgheerx.js → vm-hands-entry-lite-ytxa5cq0.js}

@@ -1,4 +1,4 @@
 // @bun
-import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{C}from"./vm-hands-entry-lite-vdhgwmmp.js";import{execFileSync as b}from"child_process";import{mkdirSync as y,readdirSync as h,readFileSync as D,rmSync as f,statSync as k,writeFileSync as w}from"fs";import{join as p,sep as S}from"path";import{setTimeout as x}from"timers/promises";var L=3000,u=null;function g(e){return p(e,"users")}function xt(e){if(u?.root===e.root)return;let t=g(e.root);y(t,{recursive:!0,mode:448}),w(p(t,String(process.pid)),"",{mode:384}),u=e}function ua(){if(!u)return;f(p(g(u.root),String(process.pid)),{force:!0}),u=null}function m(e){try{return process.kill(e,0),!0}catch(t){return t instanceof Error&&"code"in t&&t.code==="EPERM"}}function _(){let e=process.getuid?.();if(process.platform==="linux")return h("/proc").flatMap((n)=>{if(!/^\d+$/.test(n))return[];try{if(k(`/proc/${n}`).uid!==e)return[];let s=D(`/proc/${n}/cmdline`).toString("utf8").split("\x00").join(" ").trim();return s?[{pid:Number(n),command:s}]:[]}catch{return[]}});if(process.platform==="win32")return b(C("powershell.exe"),["-NoLogo","-NoProfile","-NonInteractive","-Command",'Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.CommandLine)" }'],{encoding:"utf8",maxBuffer:16777216,windowsHide:!0}).split(/\r?\n/).flatMap((s)=>{let c=/^(\d+) (.+)$/.exec(s.trim());return c?[{pid:Number(c[1]),command:c[2]}]:[]});return b("/bin/ps",["-axww","-o","pid=,uid=,command="],{encoding:"utf8",maxBuffer:16777216}).split(`
-`).flatMap((n)=>{let s=/^\s*(\d+)\s+(\d+)\s+(.+)$/.exec(n);return s&&Number(s[2])===e?[{pid:Number(s[1]),command:s[3]}]:[]})}async function da(){let e=u;if(!e)return{released:"unused",stopped:0};let t=g(e.root);f(p(t,String(process.pid)),{force:!0}),u=null;let n=!1;for(let o of h(t)){let i=Number(o);if(Number.isSafeInteger(i)&&i>0&&m(i))n=!0;else f(p(t,o),{force:!0})}if(n)return{released:"shared",stopped:0};let s=_().filter((o)=>o.pid!==process.pid&&(o.command.includes(`${e.root}${S}`)||o.command.includes(`${e.automation}${S}`)||o.command.includes(e.extensionDir))),c=(o,i)=>{try{process.kill(o,i)}catch{}};for(let o of s)c(o.pid,"SIGTERM");for(let o=Date.now()+L;Date.now()<o&&s.some((i)=>m(i.pid));)await new Promise((i)=>setTimeout(i,100));for(let o of s)if(m(o.pid))c(o.pid,"SIGKILL");return{released:"stopped",stopped:s.length}}var P=20000,E=30000,M=100,a=new Map,l=null,d=[];function Ni(e){a.set(e,(a.get(e)??0)+1);let t=!1;return()=>{if(t)return;t=!0;let n=(a.get(e)??1)-1;if(n>0){a.set(e,n);return}if(a.delete(e),l?.run===e)l.idleUntil=0}}function N(){return new r("automation_desktop_busy","Another Session, or another agent of this Session, is using this worker's desktop. Retry after it finishes.")}function O(e,t){return l!==null&&l.run!==e&&(l.calls>0||t<l.idleUntil)}async function Li(e,t,n=Date.now){let s=Symbol(e);d.push(s);try{let i=n()+E;for(;;){if(!O(e,n())&&(l?.run===e||d[0]===s))break;if(n()>=i)throw N();await x(M,void 0,{signal:t}).catch(()=>t.throwIfAborted())}}finally{d.splice(d.indexOf(s),1)}if(l?.run!==e)l={run:e,calls:0,idleUntil:0};let c=l;c.calls+=1;let o=!1;return()=>{if(o)return;o=!0,c.calls-=1,c.idleUntil=n()+P}}
-export{xt,ua,da,Ni,Li};
+import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{C}from"./vm-hands-entry-lite-tbawqj1n.js";import{execFileSync as b}from"child_process";import{mkdirSync as y,readdirSync as h,readFileSync as D,rmSync as f,statSync as k,writeFileSync as w}from"fs";import{join as p,sep as S}from"path";import{setTimeout as x}from"timers/promises";var L=3000,u=null;function g(e){return p(e,"users")}function xt(e){if(u?.root===e.root)return;let t=g(e.root);y(t,{recursive:!0,mode:448}),w(p(t,String(process.pid)),"",{mode:384}),u=e}function da(){if(!u)return;f(p(g(u.root),String(process.pid)),{force:!0}),u=null}function m(e){try{return process.kill(e,0),!0}catch(t){return t instanceof Error&&"code"in t&&t.code==="EPERM"}}function _(){let e=process.getuid?.();if(process.platform==="linux")return h("/proc").flatMap((n)=>{if(!/^\d+$/.test(n))return[];try{if(k(`/proc/${n}`).uid!==e)return[];let s=D(`/proc/${n}/cmdline`).toString("utf8").split("\x00").join(" ").trim();return s?[{pid:Number(n),command:s}]:[]}catch{return[]}});if(process.platform==="win32")return b(C("powershell.exe"),["-NoLogo","-NoProfile","-NonInteractive","-Command",'Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.CommandLine)" }'],{encoding:"utf8",maxBuffer:16777216,windowsHide:!0}).split(/\r?\n/).flatMap((s)=>{let c=/^(\d+) (.+)$/.exec(s.trim());return c?[{pid:Number(c[1]),command:c[2]}]:[]});return b("/bin/ps",["-axww","-o","pid=,uid=,command="],{encoding:"utf8",maxBuffer:16777216}).split(`
+`).flatMap((n)=>{let s=/^\s*(\d+)\s+(\d+)\s+(.+)$/.exec(n);return s&&Number(s[2])===e?[{pid:Number(s[1]),command:s[3]}]:[]})}async function pa(){let e=u;if(!e)return{released:"unused",stopped:0};let t=g(e.root);f(p(t,String(process.pid)),{force:!0}),u=null;let n=!1;for(let o of h(t)){let i=Number(o);if(Number.isSafeInteger(i)&&i>0&&m(i))n=!0;else f(p(t,o),{force:!0})}if(n)return{released:"shared",stopped:0};let s=_().filter((o)=>o.pid!==process.pid&&(o.command.includes(`${e.root}${S}`)||o.command.includes(`${e.automation}${S}`)||o.command.includes(e.extensionDir))),c=(o,i)=>{try{process.kill(o,i)}catch{}};for(let o of s)c(o.pid,"SIGTERM");for(let o=Date.now()+L;Date.now()<o&&s.some((i)=>m(i.pid));)await new Promise((i)=>setTimeout(i,100));for(let o of s)if(m(o.pid))c(o.pid,"SIGKILL");return{released:"stopped",stopped:s.length}}var P=20000,E=30000,M=100,a=new Map,l=null,d=[];function Li(e){a.set(e,(a.get(e)??0)+1);let t=!1;return()=>{if(t)return;t=!0;let n=(a.get(e)??1)-1;if(n>0){a.set(e,n);return}if(a.delete(e),l?.run===e)l.idleUntil=0}}function N(){return new r("automation_desktop_busy","Another Session, or another agent of this Session, is using this worker's desktop. Retry after it finishes.")}function O(e,t){return l!==null&&l.run!==e&&(l.calls>0||t<l.idleUntil)}async function Mi(e,t,n=Date.now){let s=Symbol(e);d.push(s);try{let i=n()+E;for(;;){if(!O(e,n())&&(l?.run===e||d[0]===s))break;if(n()>=i)throw N();await x(M,void 0,{signal:t}).catch(()=>t.throwIfAborted())}}finally{d.splice(d.indexOf(s),1)}if(l?.run!==e)l={run:e,calls:0,idleUntil:0};let c=l;c.calls+=1;let o=!1;return()=>{if(o)return;o=!0,c.calls-=1,c.idleUntil=n()+P}}
+export{xt,da,pa,Li,Mi};

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,4 +1,4 @@
 // @bun
-import{ri,bt,ii,oi,si,Ti}from"./vm-hands-entry-lite-mb6atrr0.js";import{createHash as H,randomBytes as he}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Xe,openSync as Oe,renameSync as Qe,rmSync as Ze,statSync as De,writeSync as Me,constants as W}from"fs";import{join as se}from"path";var en=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:r}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!r||typeof r!=="object"||Array.isArray(r)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||r.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:nn(e)}}function nn(e){let n=e.payload[ii];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var G=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),K=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function $i(e){let n=await crypto.subtle.importKey("pkcs8",K(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=K(e.device_key.spki),r=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),h=new Uint8Array(await crypto.subtle.exportKey("spki",r.publicKey)),m=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:r,signingSpki:i,agreementSpki:h,fingerprint:m}}var tn=16;class ln{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,r){this.init=e;this.keys=n;this.hooks=i;this.options=r;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let r=Date.now()+n;;){let h=this.bound.get(e);if(!h)return!1;if(h.envInstalled)return!0;if(Date.now()>=r||i?.aborted)return!1;await new Promise((m)=>setTimeout(m,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:en,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:G(this.keys.signingSpki),env_public_key:G(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:G(he(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:G(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),r=G(he(32)),h=Ti({method:"GET",pathAndQuery:ri,timestamp:i,nonce:r,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),m=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(h)));return{t:"hello",timestamp:i,nonce:r,signature:G(rn(m)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let r of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(r))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((r)=>r.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=tn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((r)=>r.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let r,h,m=new Promise((_,k)=>{r=_,h=k});return m.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:m,resolve:r,reject:h}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(v){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(v,"the bind's kill-verify failed")}let i,r=new Promise((v)=>{i=v}),h=!1,m=!1,_=()=>{m=!0,i()},k=n.promise.then(()=>new Promise((v,I)=>{this.exclusive(async()=>{if(m){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}h=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();v()}catch(w){I(w)}await r})}));k.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:k,inTurn:()=>h,leave:_})}finally{_()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,r=!1;try{if(!n)await this.prepareBind(e);r=!0;let{launchId:h,applied:m,readyData:_}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),k=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let v=null,I=null;if(e.env){let w=e.claim?.owner??{},E=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:e.claim?.root_id??""});v=this.hooks.installEnvironment(e.bind_id,E),I=typeof E.snapshot_id==="string"&&E.snapshot_id?E.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,E)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:h,envInstalled:v!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:h,snapshot_revision:v,snapshot_id:I,layout:k,..._?{ready_data:_}:{},policy_digest:H("sha256").update(V({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(h){if(i)fe(i);if(r){let m=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(m);else await m()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(h,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let r=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),h=this.hooks.installEnvironment(n.bindId,r);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${h}`,r),{snapshot_id:e.snapshotId,installed_revision:h,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let r=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:r})}catch(h){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw h}if(this.unverified.delete(e),!r.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:r.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},r=await crypto.subtle.importKey("spki",K(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),h=await crypto.subtle.deriveKey({name:"ECDH",public:r},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:K(e.iv),additionalData:new TextEncoder().encode(n)},h,K(e.ct)).catch(i),_=JSON.parse(new TextDecoder().decode(m));if(!_||typeof _!=="object"||Array.isArray(_))throw new l("vm_hands_env_invalid","env not an object");return _}writeJobEnvRootOnly(e,n){let i=se(this.options.envRoot,`bind-${e}`);Xe(i,{mode:448});let r=De(i);if(!r.isDirectory()||(r.mode&63)!==0||r.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let h=n.variables&&typeof n.variables==="object"?n.variables:{},m=Object.entries(h).filter(([v,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(v)&&typeof I==="string").map(([v,I])=>`export ${v}='${String(I).replaceAll("'","'\\''")}'`).join(`
+import{ni,bt,oi,si,ai,Ri}from"./vm-hands-entry-lite-vezfnqf1.js";import{createHash as H,randomBytes as he}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Xe,openSync as Oe,renameSync as Qe,rmSync as Ze,statSync as De,writeSync as Me,constants as W}from"fs";import{join as se}from"path";var en=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:r}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!r||typeof r!=="object"||Array.isArray(r)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||r.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:nn(e)}}function nn(e){let n=e.payload[oi];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var G=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),K=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function Bi(e){let n=await crypto.subtle.importKey("pkcs8",K(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=K(e.device_key.spki),r=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),h=new Uint8Array(await crypto.subtle.exportKey("spki",r.publicKey)),m=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:r,signingSpki:i,agreementSpki:h,fingerprint:m}}var tn=16;class ln{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,r){this.init=e;this.keys=n;this.hooks=i;this.options=r;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let r=Date.now()+n;;){let h=this.bound.get(e);if(!h)return!1;if(h.envInstalled)return!0;if(Date.now()>=r||i?.aborted)return!1;await new Promise((m)=>setTimeout(m,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:en,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:G(this.keys.signingSpki),env_public_key:G(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:G(he(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:G(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),r=G(he(32)),h=Ri({method:"GET",pathAndQuery:ni,timestamp:i,nonce:r,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),m=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(h)));return{t:"hello",timestamp:i,nonce:r,signature:G(rn(m)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let r of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(r))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((r)=>r.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=tn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((r)=>r.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let r,h,m=new Promise((_,k)=>{r=_,h=k});return m.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:m,resolve:r,reject:h}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(v){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(v,"the bind's kill-verify failed")}let i,r=new Promise((v)=>{i=v}),h=!1,m=!1,_=()=>{m=!0,i()},k=n.promise.then(()=>new Promise((v,I)=>{this.exclusive(async()=>{if(m){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}h=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();v()}catch(w){I(w)}await r})}));k.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:k,inTurn:()=>h,leave:_})}finally{_()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,r=!1;try{if(!n)await this.prepareBind(e);r=!0;let{launchId:h,applied:m,readyData:_}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),k=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let v=null,I=null;if(e.env){let w=e.claim?.owner??{},E=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:e.claim?.root_id??""});v=this.hooks.installEnvironment(e.bind_id,E),I=typeof E.snapshot_id==="string"&&E.snapshot_id?E.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,E)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:h,envInstalled:v!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:h,snapshot_revision:v,snapshot_id:I,layout:k,..._?{ready_data:_}:{},policy_digest:H("sha256").update(V({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(h){if(i)fe(i);if(r){let m=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(m);else await m()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(h,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let r=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),h=this.hooks.installEnvironment(n.bindId,r);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${h}`,r),{snapshot_id:e.snapshotId,installed_revision:h,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let r=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:r})}catch(h){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw h}if(this.unverified.delete(e),!r.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:r.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},r=await crypto.subtle.importKey("spki",K(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),h=await crypto.subtle.deriveKey({name:"ECDH",public:r},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:K(e.iv),additionalData:new TextEncoder().encode(n)},h,K(e.ct)).catch(i),_=JSON.parse(new TextDecoder().decode(m));if(!_||typeof _!=="object"||Array.isArray(_))throw new l("vm_hands_env_invalid","env not an object");return _}writeJobEnvRootOnly(e,n){let i=se(this.options.envRoot,`bind-${e}`);Xe(i,{mode:448});let r=De(i);if(!r.isDirectory()||(r.mode&63)!==0||r.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let h=n.variables&&typeof n.variables==="object"?n.variables:{},m=Object.entries(h).filter(([v,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(v)&&typeof I==="string").map(([v,I])=>`export ${v}='${String(I).replaceAll("'","'\\''")}'`).join(`
 `)+`
-`,_=se(i,`.job.env.${he(8).toString("hex")}`),k=Oe(_,W.O_WRONLY|W.O_CREAT|W.O_EXCL|W.O_NOFOLLOW,384);try{Me(k,m),xe(k)}finally{Ae(k)}return Qe(_,se(i,"job.env")),i}}function fe(e){try{let n=se(e,"job.env"),i=De(n).size,r=Oe(n,W.O_WRONLY|W.O_NOFOLLOW);try{Me(r,Buffer.alloc(i)),xe(r)}finally{Ae(r)}}catch{}Ze(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as sn}from"crypto";var on="/app/local-runtime/session?register=vm_hands_v1",an="/app/local-runtime",Ce=25000,we=20000,dn=1e4,Ue=5000,cn=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),un="preview.serve.v1",_n=60000,ye=75000,mn=2000,gn=1e4,hn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),fn=3,pn=20000,vn=250,wn=2000;function $e(e){let n=Math.min(vn*2**(e-1),wn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function bn(e){return e>=500||e===408||e===429}var ae=20000;function Be(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class D extends Error{}var kn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function je(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Sn(e,n,i,r,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[v,I]of qe.entries()){if(r.aborted)return;if(await new Promise((w)=>{let E=setTimeout(w,I);E.unref?.(),r.addEventListener("abort",()=>{clearTimeout(E),w()},{once:!0})}),r.aborted)return;try{let w=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:v+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let E=je(w);if(h("vm_hands.unbind_unverified",{operation_id:k,code:E,attempt:v+1}),E==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:qe.length})})().finally(()=>_.delete(m))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))])}async function In(e,n){let i=[...e.personTerminals].filter((r)=>r.session===null||r.session===n);for(let r of i)r.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))]);return i.length}function Pn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Tn=1000;async function Bi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},r=e.log??(()=>{}),h=async(k)=>{for(let[v,I]of[...i.turns]){i.turns.delete(v),e.onTurn?.(v,null),de(I);let w=await L(i,e.agent,v).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});r("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let v=await Rn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&hn.has(w.code)&&m<fn&&Date.now()-n<pn)return m++,_=$e(m),r("vm_hands.register_retry",{attempt:m,code:w.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(r("vm_hands.session_closed",{close_code:v.closeCode,reason:v.closeReason.slice(0,120),registered:i.deviceId!==null}),v.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=v.closeReason==="drain_reconnect"?0:v.closeReason==="vm_hands_register_retry"?_:v.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ye-Date.now())):Math.min(500*2**k,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Rn(e,n){let i=n.deviceId,r=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:on,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,v="",I=new Map,w=[],E=null,ce=new Promise((t)=>{_.onclose=(o)=>{k=o.code,v=o.reason;for(let s of I.values())s.reject(new D(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,Tn));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!E?.(o))w.push(o)};let J=(t,o)=>new Promise((s,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){s(w.splice(u,1)[0]);return}let f=setTimeout(()=>{E=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);E=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),E=null,s(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),q=(t,o)=>new Promise((s,a)=>{if(_.readyState!==WebSocket.OPEN){a(new D("session closed"));return}let u=sn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new D(`no answer to ${t.split("/").pop()} in ${f+Ne} ms`)),_.close(4000,"request_timeout")},f+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}s({status:c,json:g})}}),Y({t:"req",id:u,path:`${an}${t}`,body:JSON.stringify(o)})}),be=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",be,{once:!0});let le,X=new Map,Q=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);_.onopen=()=>{clearTimeout(g),r("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(s=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((T)=>T&&T.operation_id===S.claim.operation_id&&T.attempt_id===S.claim.attempt_id)){o.push(S),r("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),de(S);let P=await L(n,e.agent,g).catch((T)=>ee(T,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),ce.then(()=>{throw new l(v==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await q("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=q,ce.then(()=>{if(n.request===q)n.request=null}),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(s,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await Se(g,c),g instanceof D)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ke;try{await ne();for(let c of o)c.flush=()=>Ie(c),c.flush(),p(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await q("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Ce,Ce)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",be);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;_.close(),await ce,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>s?ee(u,s,"vm_hands_bind_lost"):null);if(a&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:a});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:k,closeReason:v};async function Se(t,o){if(t instanceof D){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)ue=!0;for(let a of s){let u=n.turns.get(a);if(n.turns.delete(a),u)de(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=q){let s=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>s(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(R)=>s(`/operations/${f}/events`,{...u,event_seq_start:R,events:[{kind:c,payload:{sequence:R,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,T=await S(P),M=T.status===409?T.json?.expected_event_seq:void 0;if(typeof M==="number"&&M>=0&&M!==g)P=M,T=await S(P);if(T.status<300)t.eventSeq=P+1;return T}}function We(t){return(o,s)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=kn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:a,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof D)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{_e.delete(t)}})()}async function ze(t,o){try{let s=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(s);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function Fe(t){let o=Z&&n.attest==="pending",s=t.vm_hands_attest,a=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,B=Math.max(0,Math.min(ae,Number.isFinite(b)?b:ae));if(!await new Promise((ie)=>{let y=setTimeout(()=>ie(!1),B);n.attestWaiters.push((x)=>{clearTimeout(y),ie(x)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await In(n,P);if(b)r("vm_hands.person_terminals_closed",{count:b});let B=ve(t),j=e.agent.bind(B);if(B.workspace_deferred)S=!0,g=He(u,()=>S);d=await j}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let T=g?await g:-1,M={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete M.environment_installed;let R=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:-1});let F={...M,...R,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},te=Date.now()+yn,U=1,N=await p("hands.ready",F);while(bn(N.status)&&!e.signal.aborted){let b=$e(U);if(Date.now()+b>=te)break;await new Promise((B)=>setTimeout(B,b)),U++,N=await p("hands.ready",F)}if(U>1)r("vm_hands.ready_retried",{attempts:U,status_class:`${Math.floor(N.status/100)}xx`});if(X.delete(t.attempt_id),N.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Be(N.json?.error,"vm_hands_probe_failed")});return}let C={claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:T};n.turns.set(t.attempt_id,C),C.flush=()=>Ie(C),e.onTurn?.(t.attempt_id,We(C)),await Pe(C)}async function He(t,o){let{fence:s,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await q(`/operations/${a}/heartbeat`,{...s,control_ack_seq:f,wait_ms:we});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===oi)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Pe(t){let{fence:o,op:s}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,q(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!p){a="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===bt)try{await Le(t,d.payload??{})}catch(g){if(g instanceof D)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;r("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ve(t,a)}async function ge(t,o){let s=Date.now()+_n;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof D))throw u}if(Date.now()>=s||e.signal.aborted)throw new D("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,s={claim:o,eventSeq:0},a=String(t.capability??""),u=a===un,{complete:f,emit:p,fence:c,op:d}={...O(s,ge)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let y of n.attestWaiters.splice(0))y(!0)}if(n.attest!=="accepted"){let y=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(y)?y:ae));if(!(x>0&&await new Promise((re)=>{let Je=setTimeout(()=>re(!1),x);n.attestWaiters.push((Ye)=>{clearTimeout(Je),re(Ye)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,T=P?Pn(t):null;if(P&&((y)=>y===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(y)||n.bindsStarting.has(y))(T)){await f("failed",{error_code:"vm_hands_bound"});return}if(cn.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let R=new AbortController,F=()=>R.abort();e.signal.addEventListener("abort",F,{once:!0});let te,U=new Promise((y)=>{te=y}),N={abort:R,settled:U},C=P?{...N,session:T}:null;if(C)n.personTerminals.add(C);if(g==="model"&&S&&a!=="preview.serve.v1"){let y=n.modelOps.get(S)??new Set;y.add(N),n.modelOps.set(S,y),await e.agent.environmentInstalled(S,mn,R.signal)}let b=-1,B=!1,j=!1,ie=u?void 0:setInterval(()=>{if(j)return;j=!0,ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:0}).then((y)=>{if(y.status>=300){R.abort();return}let x=y.json?.controls??[];for(let A of x)if(b=Math.max(b,A.seq),A.kind==="operation.cancel"||A.kind==="cancel")R.abort()},()=>R.abort()).finally(()=>{j=!1})},dn);if(u)(async()=>{while(!B&&!R.signal.aborted){let y;try{y=await ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:we})}catch{R.abort();return}if(B)return;if(y.status>=300){R.abort();return}let x=(y.json?.controls??[]).slice().sort((A,re)=>A.seq-re.seq);for(let A of x){if(A.seq<=b)continue;if(A.kind==="operation.cancel"||A.kind==="cancel")R.abort();else await e.controlOp?.({claim:t,control:A}).catch(()=>!1);b=A.seq}}})();try{let y=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:R.signal,emit:async(A)=>{await p(A.kind,A.data??{})}}),x=await f(y.status,{...y.result?{result:y.result}:{},...y.error_code?{error_code:Be(y.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:y.status,acknowledged:x.status<300}),r("vm_hands.op",{capability:a,kind:g,status:y.status,code:y.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(B=!0,clearInterval(ie),e.signal.removeEventListener("abort",F),S)n.modelOps.get(S)?.delete(N);if(C)n.personTerminals.delete(C);te()}}async function Ve(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),de(t);let a=await L(n,e.agent,s).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,s){let a=je(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(si,{code:a}).catch(()=>{return}),Sn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function ne(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof D)return}n.receipts.shift()}}async function Le(t,o){let{fence:s,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await q(`/operations/${a}/environment`,{...s,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await q(`/operations/${a}/environment-ack`,{...s,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as xn}from"fs";var An=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function On(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-kr6hkzsk.js");await m();return}z("parsed",{t0:Math.round(An)});let e="";try{e=xn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-vtfgjv2n.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}On();export{$i,ln,Bi};
+`,_=se(i,`.job.env.${he(8).toString("hex")}`),k=Oe(_,W.O_WRONLY|W.O_CREAT|W.O_EXCL|W.O_NOFOLLOW,384);try{Me(k,m),xe(k)}finally{Ae(k)}return Qe(_,se(i,"job.env")),i}}function fe(e){try{let n=se(e,"job.env"),i=De(n).size,r=Oe(n,W.O_WRONLY|W.O_NOFOLLOW);try{Me(r,Buffer.alloc(i)),xe(r)}finally{Ae(r)}}catch{}Ze(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as sn}from"crypto";var on="/app/local-runtime/session?register=vm_hands_v1",an="/app/local-runtime",Ce=25000,we=20000,dn=1e4,Ue=5000,cn=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),un="preview.serve.v1",_n=60000,ye=75000,mn=2000,gn=1e4,hn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),fn=3,pn=20000,vn=250,wn=2000;function $e(e){let n=Math.min(vn*2**(e-1),wn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function bn(e){return e>=500||e===408||e===429}var ae=20000;function Be(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class D extends Error{}var kn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function je(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Sn(e,n,i,r,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[v,I]of qe.entries()){if(r.aborted)return;if(await new Promise((w)=>{let E=setTimeout(w,I);E.unref?.(),r.addEventListener("abort",()=>{clearTimeout(E),w()},{once:!0})}),r.aborted)return;try{let w=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:v+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let E=je(w);if(h("vm_hands.unbind_unverified",{operation_id:k,code:E,attempt:v+1}),E==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:qe.length})})().finally(()=>_.delete(m))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))])}async function In(e,n){let i=[...e.personTerminals].filter((r)=>r.session===null||r.session===n);for(let r of i)r.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))]);return i.length}function Pn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Tn=1000;async function Fi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},r=e.log??(()=>{}),h=async(k)=>{for(let[v,I]of[...i.turns]){i.turns.delete(v),e.onTurn?.(v,null),de(I);let w=await L(i,e.agent,v).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});r("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let v=await Rn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&hn.has(w.code)&&m<fn&&Date.now()-n<pn)return m++,_=$e(m),r("vm_hands.register_retry",{attempt:m,code:w.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(r("vm_hands.session_closed",{close_code:v.closeCode,reason:v.closeReason.slice(0,120),registered:i.deviceId!==null}),v.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=v.closeReason==="drain_reconnect"?0:v.closeReason==="vm_hands_register_retry"?_:v.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ye-Date.now())):Math.min(500*2**k,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Rn(e,n){let i=n.deviceId,r=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:on,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,v="",I=new Map,w=[],E=null,ce=new Promise((t)=>{_.onclose=(o)=>{k=o.code,v=o.reason;for(let s of I.values())s.reject(new D(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,Tn));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!E?.(o))w.push(o)};let J=(t,o)=>new Promise((s,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){s(w.splice(u,1)[0]);return}let f=setTimeout(()=>{E=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);E=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),E=null,s(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),q=(t,o)=>new Promise((s,a)=>{if(_.readyState!==WebSocket.OPEN){a(new D("session closed"));return}let u=sn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new D(`no answer to ${t.split("/").pop()} in ${f+Ne} ms`)),_.close(4000,"request_timeout")},f+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}s({status:c,json:g})}}),Y({t:"req",id:u,path:`${an}${t}`,body:JSON.stringify(o)})}),be=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",be,{once:!0});let le,X=new Map,Q=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);_.onopen=()=>{clearTimeout(g),r("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(s=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((T)=>T&&T.operation_id===S.claim.operation_id&&T.attempt_id===S.claim.attempt_id)){o.push(S),r("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),de(S);let P=await L(n,e.agent,g).catch((T)=>ee(T,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),ce.then(()=>{throw new l(v==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await q("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=q,ce.then(()=>{if(n.request===q)n.request=null}),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(s,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await Se(g,c),g instanceof D)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ke;try{await ne();for(let c of o)c.flush=()=>Ie(c),c.flush(),p(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await q("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Ce,Ce)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",be);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;_.close(),await ce,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>s?ee(u,s,"vm_hands_bind_lost"):null);if(a&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:a});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:k,closeReason:v};async function Se(t,o){if(t instanceof D){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)ue=!0;for(let a of s){let u=n.turns.get(a);if(n.turns.delete(a),u)de(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=q){let s=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>s(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(R)=>s(`/operations/${f}/events`,{...u,event_seq_start:R,events:[{kind:c,payload:{sequence:R,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,T=await S(P),M=T.status===409?T.json?.expected_event_seq:void 0;if(typeof M==="number"&&M>=0&&M!==g)P=M,T=await S(P);if(T.status<300)t.eventSeq=P+1;return T}}function We(t){return(o,s)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=kn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:a,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof D)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{_e.delete(t)}})()}async function ze(t,o){try{let s=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(s);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function Fe(t){let o=Z&&n.attest==="pending",s=t.vm_hands_attest,a=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,B=Math.max(0,Math.min(ae,Number.isFinite(b)?b:ae));if(!await new Promise((ie)=>{let y=setTimeout(()=>ie(!1),B);n.attestWaiters.push((x)=>{clearTimeout(y),ie(x)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await In(n,P);if(b)r("vm_hands.person_terminals_closed",{count:b});let B=ve(t),j=e.agent.bind(B);if(B.workspace_deferred)S=!0,g=He(u,()=>S);d=await j}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let T=g?await g:-1,M={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete M.environment_installed;let R=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:-1});let F={...M,...R,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},te=Date.now()+yn,U=1,N=await p("hands.ready",F);while(bn(N.status)&&!e.signal.aborted){let b=$e(U);if(Date.now()+b>=te)break;await new Promise((B)=>setTimeout(B,b)),U++,N=await p("hands.ready",F)}if(U>1)r("vm_hands.ready_retried",{attempts:U,status_class:`${Math.floor(N.status/100)}xx`});if(X.delete(t.attempt_id),N.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Be(N.json?.error,"vm_hands_probe_failed")});return}let C={claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:T};n.turns.set(t.attempt_id,C),C.flush=()=>Ie(C),e.onTurn?.(t.attempt_id,We(C)),await Pe(C)}async function He(t,o){let{fence:s,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await q(`/operations/${a}/heartbeat`,{...s,control_ack_seq:f,wait_ms:we});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===si)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Pe(t){let{fence:o,op:s}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,q(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!p){a="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===bt)try{await Le(t,d.payload??{})}catch(g){if(g instanceof D)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;r("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ve(t,a)}async function ge(t,o){let s=Date.now()+_n;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof D))throw u}if(Date.now()>=s||e.signal.aborted)throw new D("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,s={claim:o,eventSeq:0},a=String(t.capability??""),u=a===un,{complete:f,emit:p,fence:c,op:d}={...O(s,ge)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let y of n.attestWaiters.splice(0))y(!0)}if(n.attest!=="accepted"){let y=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(y)?y:ae));if(!(x>0&&await new Promise((re)=>{let Je=setTimeout(()=>re(!1),x);n.attestWaiters.push((Ye)=>{clearTimeout(Je),re(Ye)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,T=P?Pn(t):null;if(P&&((y)=>y===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(y)||n.bindsStarting.has(y))(T)){await f("failed",{error_code:"vm_hands_bound"});return}if(cn.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let R=new AbortController,F=()=>R.abort();e.signal.addEventListener("abort",F,{once:!0});let te,U=new Promise((y)=>{te=y}),N={abort:R,settled:U},C=P?{...N,session:T}:null;if(C)n.personTerminals.add(C);if(g==="model"&&S&&a!=="preview.serve.v1"){let y=n.modelOps.get(S)??new Set;y.add(N),n.modelOps.set(S,y),await e.agent.environmentInstalled(S,mn,R.signal)}let b=-1,B=!1,j=!1,ie=u?void 0:setInterval(()=>{if(j)return;j=!0,ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:0}).then((y)=>{if(y.status>=300){R.abort();return}let x=y.json?.controls??[];for(let A of x)if(b=Math.max(b,A.seq),A.kind==="operation.cancel"||A.kind==="cancel")R.abort()},()=>R.abort()).finally(()=>{j=!1})},dn);if(u)(async()=>{while(!B&&!R.signal.aborted){let y;try{y=await ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:we})}catch{R.abort();return}if(B)return;if(y.status>=300){R.abort();return}let x=(y.json?.controls??[]).slice().sort((A,re)=>A.seq-re.seq);for(let A of x){if(A.seq<=b)continue;if(A.kind==="operation.cancel"||A.kind==="cancel")R.abort();else await e.controlOp?.({claim:t,control:A}).catch(()=>!1);b=A.seq}}})();try{let y=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:R.signal,emit:async(A)=>{await p(A.kind,A.data??{})}}),x=await f(y.status,{...y.result?{result:y.result}:{},...y.error_code?{error_code:Be(y.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:y.status,acknowledged:x.status<300}),r("vm_hands.op",{capability:a,kind:g,status:y.status,code:y.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(B=!0,clearInterval(ie),e.signal.removeEventListener("abort",F),S)n.modelOps.get(S)?.delete(N);if(C)n.personTerminals.delete(C);te()}}async function Ve(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),de(t);let a=await L(n,e.agent,s).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,s){let a=je(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(ai,{code:a}).catch(()=>{return}),Sn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function ne(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof D)return}n.receipts.shift()}}async function Le(t,o){let{fence:s,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await q(`/operations/${a}/environment`,{...s,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await q(`/operations/${a}/environment-ack`,{...s,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as xn}from"fs";var An=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function On(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-xtazaybz.js");await m();return}z("parsed",{t0:Math.round(An)});let e="";try{e=xn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-p5v7wfyx.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}On();export{Bi,ln,Fi};