@reason-machines/cli-linux-x64 0.2.503 → 0.2.505

package/bin/vm-hands/vm-hands-entry-lite-ah2ep922.js

@@ -0,0 +1,4 @@
+// @bun
+import{Xc as GB,Yc as HB,Zc as _,fc as KB,kc as CB,rc as LB}from"./vm-hands-entry-lite-v0k8b768.js";import{kd as UB,ld as VB,sd as g}from"./vm-hands-entry-lite-b7wy89y0.js";import{Ad as r,Bd as a,Gd as n,ud as u,yd as f}from"./vm-hands-entry-lite-dhqmbqsh.js";import{Md as XB,Nd as FB}from"./vm-hands-entry-lite-tafgty5k.js";import{mi as $B}from"./vm-hands-entry-lite-td309c1y.js";import{mk as BB,ok as JB,pk as QB}from"./vm-hands-entry-lite-56v9haps.js";import{Ak as s}from"./vm-hands-entry-lite-jd31as70.js";import{dl as J}from"./vm-hands-entry-lite-e4hwb89r.js";import{ll as T}from"./vm-hands-entry-lite-v4r1fggm.js";import{pl as YB,xl as ZB}from"./vm-hands-entry-lite-kqbats5n.js";import{randomUUID as j}from"crypto";import{spawn as hB}from"child_process";import{existsSync as h,lstatSync as MB,mkdirSync as mB,readFileSync as yB,realpathSync as R,rmSync as bB,writeFileSync as dB}from"fs";import{dirname as vB,join as O,relative as cB,sep as lB}from"path";var qB=["process.run.v1","process.full.v1"],kB=600000,xB=1800000,DB=20000,v="process.cancel.v1",c=J.object({action:J.literal("start"),request_id:J.string().uuid(),command:J.string().min(1).max(16000).refine((B)=>!B.includes("\x00")),cwd:J.string().min(1).max(4096).refine((B)=>!B.includes("\x00")&&!B.startsWith("/")&&!B.split(/[\\/]/).includes("..")).describe("Path relative to the granted device root; omit to use that root. Must not start with /, contain a .. path segment, or contain a NUL character.").optional(),mode:J.enum(["host","confined"]).default("host"),timeout_ms:J.number().int().min(1000).max(xB).default(kB).describe("Absolute process budget including queue and startup time. Defaults to ten minutes; longer explicit requests require the selected root's advertised max_timeout_ms. Retrying never renews the deadline.")}).strict(),I={device_id:J.string().uuid(),root_id:J.string().uuid()},AB=J.discriminatedUnion("action",[c.extend(I),J.object({...I,action:J.literal("inspect"),process_id:J.string().uuid(),after:J.number().int().min(0).default(0),wait_ms:J.number().int().min(0).max(DB).default(0).describe("Wait for new output or a state change, bounded by this call's wait budget. Expiring this wait does not cancel the process or extend its deadline.")}).strict(),J.object({...I,action:J.literal("cancel"),process_id:J.string().uuid()}).strict()]),uB=J.toJSONSchema(AB,{io:"input"}),rB=c.extend({process_brain_fence:J.string().uuid(),process_expires_at:J.iso.datetime()}).strict(),D=J.object({version:J.literal(1),process_id:J.string().uuid(),state:J.enum(["starting","running","exited","cancelled","expired","uncertain"]),exit_code:J.number().int().nullable(),first_cursor:J.number().int().min(0),next_cursor:J.number().int().min(0),truncated:J.boolean(),observed_at:J.iso.datetime(),output:J.array(J.object({cursor:J.number().int().min(1),stream:J.enum(["stdout","stderr"]),text:J.string().max(32768)}).strict()).max(128)}).strict().refine((B)=>{if(Buffer.byteLength(JSON.stringify(B))>1e5||B.next_cursor<B.first_cursor-1)return!1;if((B.state==="starting"||B.state==="running"||B.state==="uncertain")&&B.exit_code!==null)return!1;if(B.state==="exited"&&(B.exit_code===null||B.exit_code<0||B.exit_code>255))return!1;if(B.state==="cancelled"&&B.exit_code!==130||B.state==="expired"&&B.exit_code!==124)return!1;let Z=B.first_cursor-1;for(let Y of B.output){if(Y.cursor<=Z||Y.cursor>B.next_cursor)return!1;Z=Y.cursor}return!0});function l(B){return qB.includes(B)}var aB=J.object({operation_constraints:J.record(J.string(),J.unknown())}),nB=J.object({ready:J.literal(!0),version:J.literal(1),execution_mode:J.enum(["host","confined"]),max_timeout_ms:J.number().int().min(1000).optional()});var _B=J.object({version:J.literal(1),process_id:J.string().uuid(),state:J.enum(["queued","cancelled_before_start","not_started"]),exit_code:J.null(),output:J.array(J.never()).length(0),first_cursor:J.literal(0),next_cursor:J.literal(0),truncated:J.literal(!1),cancellation_requested:J.literal(!1),reason_code:J.enum(["cancelled_before_start","process_journal_capacity","path_not_found","process_timeout_unsupported"]).optional(),expires_at:J.iso.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it.")}).strict(),RB=J.object({...D.shape,state:J.enum(["queued","starting","running","exited","cancelled","expired","uncertain","cancelled_before_start","not_started"]),observed_at:J.iso.datetime().optional(),expires_at:J.iso.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it."),cancellation_requested:J.boolean(),reason_code:J.string().nullable().optional(),execution_authority:J.literal("lost").optional().describe("Historical receipt only; the current Brain cannot control this older-generation process."),recovery:J.object({cause:J.literal("brain_generation_changed"),terminal_confirmed:J.boolean(),next_step:J.enum(["inspect_until_terminal","reconcile_effects_before_new_intent"])}).strict().optional().describe("Historical process recovery only. An unconfirmed outcome forbids replay. A confirmed terminal observation proves the old process stopped, not that its command had no effects. Reconcile the result; only restart still-needed, safely repeatable work with a new request_id and current authority. Respect user cancellation."),last_observed_state:D.shape.state.or(J.literal("cancelled_before_start")).nullable().optional().describe("Last saved observation before authority was lost; a running observation does not establish current child liveness.")}).strict(),iB=J.toJSONSchema(RB),tB=J.union([D,_B.refine((B)=>B.state==="cancelled_before_start")]),S=J.object({version:J.literal(1),process_id:J.string().uuid(),state:J.enum(["exited","cancelled","expired"]),exit_code:J.number().int().min(0).max(255),observed_at:J.iso.datetime()}).strict().refine((B)=>(B.state!=="cancelled"||B.exit_code===130)&&(B.state!=="expired"||B.exit_code===124)),PB=J.object({process_terminal_observation:S}).strict();function eB(B,Q){let Z=PB.safeParse(B);return Z.success&&Z.data.process_terminal_observation.process_id===Q?Z.data:null}var YJ="preview.serve.v1",ZJ=43200000;var $J=3,p="preview.open.v1",o=1,EB="gid_proxy_v1",XJ="egress",IB=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::[1-9][0-9]{0,4})?$/,SB=J.object({version:J.literal(EB),allowed_domains:J.array(J.string().max(260).regex(IB)).max(1024)}).strict(),fB=J.custom((B)=>s(B)!==null,"invalid workspace"),wB=J.object({version:J.literal(1),request_id:J.uuid(),session_id:J.uuid(),command:J.string().min(1).max(16000).refine((B)=>!B.includes("\x00")),port:J.number().int().min(1024).max(65535),workspace:fB,egress:SB.optional()}).strict(),FJ=wB.extend({expires_at:J.iso.datetime()}).strict();var jB=4,gB=5000;function w(B,Q,Z){let Y=null;try{Y=f(B)}catch{}r({deviceRelayUrl:Y?.deviceRelayUrl??"",binding:Y?.binding??null,jobId:Q,port:Y?.binding.port??0,reason:Y?Z:"binding_invalid"})}function i(B){let Q=new Map;return{open(Z){let Y=(C)=>w(Z,B.claim.operation_id,C),G;try{G=f(Z)}catch{return Y("binding_invalid")}let{binding:F,deviceRelayUrl:A}=G,U=B.claim.owner;if(!U||F.organizationId!==U.organization_id||F.userId!==U.user_id||F.deviceId!==U.device_id||F.rootId!==B.claim.root_id||F.jobId!==B.claim.operation_id||F.fenceId!==B.claim.operation_id||F.generation!==o||F.expiresAtMs>Math.min(Date.now()+u.lifetimeMs+gB,B.expiresAtMs))return Y("binding_mismatch");if(F.expiresAtMs<=Date.now())return Y("binding_expired");if(Q.get(F.port)?.abort(),Q.delete(F.port),Q.size>=jB)return Y("preview_capacity");let z=new AbortController;Q.set(F.port,z);let L=n({binding:F,deniedPorts:B.deniedPorts,readCurrentJob:async()=>{if(z.signal.aborted)return null;let C=await B.inspect();return C?{binding:F,executorLaunchId:B.executorLaunchId,job:C}:null}});a({binding:F,deviceRelayUrl:A,port:L,signal:z.signal}).then((C)=>C.closed,(C)=>{let V=C instanceof Error?C.message:"preview_failed";if(V!=="preview_not_authorized")process.stderr.write(`${JSON.stringify({event:"worker_preview.open_failed",job_id:F.jobId,port:F.port,reason_code:V})}
+`)}).finally(()=>{if(Q.get(F.port)===z)Q.delete(F.port)})},dispose(){for(let Z of Q.values())Z.abort();Q.clear()}}}class m extends T{observation;constructor(B){super("process_authority_lost","Process authority was lost; the owned process group has stopped.");this.observation=B}}var NB=256,P=new Map,OB="preview.serve.v1",q=new Map;function TB(B){let Q=q.get(B.operation_id);if(Q){if(Q.claim!==B)throw M("process_authority_lost");return Q}if(q.size>=NB)throw M("process_journal_capacity");let Z={claim:B,executing:!1,cancelRequested:!1,phase:"pending"};return q.set(B.operation_id,Z),Z}function t(B){return{version:1,process_id:B,state:"cancelled_before_start",exit_code:null,output:[],first_cursor:0,next_cursor:0,truncated:!1,cancellation_requested:!1,reason_code:"cancelled_before_start"}}var e=(B)=>new Promise((Q)=>setTimeout(Q,B)),M=(B="process_outcome_uncertain")=>new T(B,"The managed process outcome could not be confirmed; inspect its saved receipt before starting another intent.");function sB(B=BB(),Q=pB()){let Z=vB($B({},B)),Y=cB(JB(B),Z),[G,...F]=Y.split(lB);return{directory:O(Q,Y,"processes"),previous:[O(Z,"processes"),...G==="reason"?[O(Q,"ara",...F,"processes")]:[]]}}function pB(){if(process.platform!=="darwin")throw new T("process_unavailable","Managed Mac process execution is unavailable.");let B=QB();if(!B)throw new T("process_unavailable","The private per-user process directory is unavailable.");return B}async function IJ(B){if(!B.claim.owner||B.signal.aborted||B.expiresAtMs<=Date.now())throw M("process_authority_lost");let Q=TB(B.claim);if(Q.executing)throw M("process_busy");if(Q.executing=!0,Q.cancelRequested)return Q.phase="settling",t(B.claim.operation_id);Q.phase="starting";let Z=B.journals??sB();mB(Z.directory,{recursive:!0,mode:448});let Y=CB({runtimeDirectory:R(Z.directory),previousRuntimeDirectories:(Z.previous??[]).filter(($)=>h($)).map(($)=>R($)),root:B.root,runId:JSON.stringify([B.claim.owner,B.claim.run_id,B.claim.root_id,B.claim.operation_id]),maxScopes:NB});try{for(let $ of[B.root,B.cwd])if(!KB(R($),Y.journalDirectory))throw new T("process_journal_inside_workspace","The selected root contains the private process journal. Select an existing narrower granted workspace root outside the journal; no command was dispatched.")}catch($){throw Y.disposeSocket(),$}let G=MB(Y.journalDirectory),F=B.claim.capability===OB,A=()=>P.set(B.claim.operation_id,{path:Y.journalDirectory,ino:G.ino,dev:G.dev,anyCompletion:F}),U=Y.launchDirectory,z=O(U,"config.json"),L={url:"",transport:"local_job_ipc",directShell:{mode:B.mode,executable:B.shell,jobId:B.claim.operation_id},workerVersion:UB,protocolVersion:2,workerArtifactSha256:g,workerEntrypoint:VB,targetGeneration:1,fenceId:j(),...process.platform==="win32"?{bashExecutable:YB()}:{},workRoot:B.root,workspaceAliasPath:B.root,repoPath:B.cwd,jobEnvPath:O(U,"unused.env"),replSocketPath:O(U,"unused.sock"),readyPath:O(U,"ready.json"),directTerminalReceiptPath:O(U,"terminal.json"),launchId:j(),expiresAtMs:B.expiresAtMs+5000,bashTimeoutMs:60000,replTimeoutMs:1000,allowedTools:["bash"],managedJobs:{journalDirectory:Y.journalDirectory,scopeId:Y.scopeId},jobControlSocketPath:Y.socketPath,...B.prefix?{bashCommandPrefix:B.prefix}:{},...B.jobsUser?{jobsUser:B.jobsUser}:{}},C;try{dB(z,JSON.stringify(L),{mode:384});let $=GB({configPath:z,root:B.cwd,grantedRoot:B.root,workRoot:B.root,temporaryDirectory:U});C=B.spawnWorker?.(z,L)??hB($.command,$.args,{...$.options,env:B.environment,stdio:[HB,"ignore","ignore"]})}catch($){throw Y.disposeSocket(),$}let V=!1,E=new Promise(($,K)=>{C.once("exit",(X)=>{V=!0,$(X)}),C.once("error",(X)=>{V=!0,K(X)})});E.catch(()=>{});let zB={root:B.root,runId:B.claim.run_id,scopeId:Y.scopeId,socketPath:Y.socketPath,generation:1,fenceId:L.fenceId,executorLaunchId:L.launchId,expiresAtMs:L.expiresAtMs},W=async($)=>{let K=await LB(zB,{type:"job",version:2,generation:1,id:j(),jobId:B.claim.operation_id,...$==="start"?{action:$,input:{script:B.command,leaseExpiresAtMs:B.expiresAtMs}}:$==="inspect"?{action:$,input:{after:0}}:$==="probe"?{action:"inspect",input:{after:Number.MAX_SAFE_INTEGER}}:{action:$,input:{}}},new AbortController().signal);if(!K.ok)throw M(K.error);return K.job},k=!1,x=!1,y,b=()=>{k=!0,_(C,"SIGTERM")};B.signal.addEventListener("abort",b,{once:!0});let N,d=0,WB=async($)=>{let K=[...$.output],X={version:1,process_id:B.claim.operation_id,state:$.state,exit_code:$.exitCode,first_cursor:$.firstCursor,next_cursor:$.nextCursor,truncated:$.truncated,output:K,observed_at:new Date().toISOString()};while(Buffer.byteLength(JSON.stringify(X))>90000&&K.length)K.shift(),X.truncated=!0,X.first_cursor=K[0]?.cursor??X.next_cursor+1;N=D.parse(X),await B.emit(N),d=Date.now()};try{let $=Math.min(Date.now()+1e4,B.expiresAtMs);while(!h(L.readyPath)){if(V)throw new T("process_start_failed","The managed process supervisor exited before accepting a command; no command was dispatched.");if(B.signal.aborted||Date.now()>=$)throw M("process_start_unconfirmed");await e(25)}let K=JSON.parse(yB(L.readyPath,"utf8"));if(K.launchId!==L.launchId||K.fenceId!==L.fenceId||K.workerArtifactSha256!==g)throw M();if(B.signal.throwIfAborted(),Q.cancelRequested)return t(B.claim.operation_id);let X;try{x=!0,X=await W("start")}catch(H){if(!(H instanceof T)||H.code!=="hands_job_result_unknown")throw H;X=await W("inspect")}if(Q.phase="running",Q.cancel=async()=>{await W("cancel")},F&&B.preview)Q.tunnels=i({claim:B.claim,executorLaunchId:L.launchId,expiresAtMs:B.expiresAtMs,deniedPorts:B.preview.deniedPorts,inspect:async()=>Q.phase==="running"&&!V?await W("probe"):null});if(Q.cancelRequested)await Q.cancel(),X=await W("inspect");for(;;){if(!["starting","running"].includes(X.state))Q.phase="settling",Q.cancel=void 0;if(!N||N.state!==X.state||N.next_cursor!==X.nextCursor&&Date.now()-d>=5000)await WB(X);if(!["starting","running"].includes(X.state))break;if(B.signal.aborted||V)throw M();await e(1000);try{X=await W("inspect"),y=void 0}catch(H){if(!(H instanceof T)||H.code!=="hands_job_result_unknown"||B.signal.aborted||V||Date.now()-(y??=Date.now())>120000)throw H}}if(!N||N.state==="uncertain")throw M();return N}finally{if(Q.phase="settling",Q.cancel=void 0,Q.tunnels?.dispose(),Q.tunnels=void 0,await Q.cancelInFlight?.catch(()=>{}),B.signal.removeEventListener("abort",b),!V&&!k)_(C,"SIGTERM");let $,K=await Promise.race([E.then((X)=>({code:X})),new Promise((X)=>{$=setTimeout(()=>X(null),6000)})]).finally(()=>{clearTimeout($)});if(!K){try{_(C,"SIGKILL")}catch{}try{await E}finally{if(V)Y.disposeSocket()}throw M("process_cleanup_unconfirmed")}try{if((k||B.signal.aborted)&&K.code===0&&x){XB(U);let X=JSON.parse(FB(L.directTerminalReceiptPath)),H=S.safeParse(X.observation);if(Object.keys(X).length===4&&X.launch_id===L.launchId&&X.fence_id===L.fenceId&&X.scope_id===Y.scopeId&&H.success&&H.data.process_id===B.claim.operation_id){if(F)A();throw new m(H.data)}}}catch(X){if(X instanceof m)throw X}finally{if(V)Y.disposeSocket()}if(K.code!==0&&!k&&x)throw M("process_cleanup_unconfirmed");if(!k&&K.code===0&&(N&&["exited","cancelled","expired"].includes(N.state)||!x&&Q.cancelRequested)||F&&K.code===0&&!x)A()}}async function SJ(B,Q){if(Q.kind===p&&B.capability===OB){let G=q.get(B.operation_id);if(G?.claim===B&&G.tunnels)G.tunnels.open(Q.payload);else w(Q.payload,B.operation_id,"server_not_running");return!0}if(Q.kind!==v||!l(B.capability)||!B.owner||Q.payload.process_id!==B.operation_id)return!1;let Z=q.get(B.operation_id);if(Z&&Z.claim!==B)return!1;let Y=TB(B);if(Y.cancelRequested=!0,Y.phase==="running"&&Y.cancel)Y.cancelInFlight??=Y.cancel(),await Y.cancelInFlight;return!0}function fJ(B,Q){q.delete(B);let Z=P.get(B);if(!Z||Q!=="succeeded"&&!Z.anyCompletion)return P.delete(B),!1;try{let Y=MB(Z.path);if(!Y.isDirectory()||Y.isSymbolicLink()||Y.ino!==Z.ino||Y.dev!==Z.dev||!ZB(Y)||R(Z.path)!==Z.path||h(O(Z.path,"owner.lock")))return!1;return bB(Z.path,{recursive:!0}),P.delete(B),!0}catch{return!1}}
+export{l as Jb,eB as Kb,YJ as Lb,ZJ as Mb,$J as Nb,EB as Ob,XJ as Pb,IB as Qb,FJ as Rb,m as Sb,NB as Tb,sB as Ub,IJ as Vb,SJ as Wb,fJ as Xb};

package/bin/vm-hands/vm-hands-entry-lite-b0p8f295.js

@@ -0,0 +1,52 @@
+// @bun
+import{Ah as v}from"./vm-hands-entry-lite-26xb026c.js";import{Ph as m,Qh as h}from"./vm-hands-entry-lite-8twscwtw.js";import{$j as n,Sj as T,Vj as d,Xj as p,ak as a}from"./vm-hands-entry-lite-r374pchj.js";import{mk as j,ok as F}from"./vm-hands-entry-lite-56v9haps.js";import{Mk as l}from"./vm-hands-entry-lite-q9g11dbj.js";import{Gl as y}from"./vm-hands-entry-lite-pkk555dx.js";import{spawnSync as Eq}from"child_process";import{dirname as I}from"path";import{spawn as r}from"child_process";import{accessSync as e,constants as qq}from"fs";import{basename as zq,join as Jq}from"path";var V=null;function O(q){if(V===q)V=null;if(q.exitCode===null&&q.signalCode===null)q.kill("SIGTERM")}var _=(q,z)=>{if(V)O(V);let Q=Jq(q,T);try{e(Q,qq.X_OK)}catch{return()=>{}}let J;try{J=r(Q,["--app",q,"--name",zq(q,".app"),"--permission",z==="screen"?"screen_recording":"accessibility"],{detached:!0,stdio:"ignore"})}catch{return()=>{}}return J.on("error",()=>{if(V===J)V=null}),J.once("exit",()=>{if(V===J)V=null}),J.unref(),V=J,()=>O(J)};import{chmodSync as Qq,existsSync as x,mkdirSync as Xq,readFileSync as Zq,realpathSync as k,renameSync as $q,statSync as G,writeFileSync as Kq}from"fs";import{dirname as P,isAbsolute as Rq,join as Vq,resolve as S,sep as W}from"path";function U(q=j()){return Vq(F(q),"reason","protected-path-grants.json")}var B=null;function Yq(q){let z=JSON.parse(q);if(!Array.isArray(z?.grants))return[];return z.grants.flatMap((Q)=>{let J=Q;return J&&typeof J.path==="string"&&Rq(J.path)&&(J.kind==="file"||J.kind==="folder")&&typeof J.grantedAt==="number"?[{path:J.path,kind:J.kind,grantedAt:J.grantedAt}]:[]})}function D(q=U()){try{let{mtimeMs:z}=G(q);if(B&&B.file===q&&B.mtimeMs===z)return B.grants;let Q=Yq(Zq(q,"utf8"));return B={file:q,mtimeMs:z,grants:Q},Q}catch{return[]}}function Bq(q,z){return q.kind==="file"?z===q.path:z===q.path||z.startsWith(`${q.path}${W}`)}function Dq(q,z){let Q=S(q);return D(z).some((J)=>Bq(J,Q))}function Sq(q,z){return v(q)&&!Dq(q,z)}function w(q,z){Xq(P(z),{recursive:!0,mode:448});let Q=`${z}.${process.pid}.tmp`;Kq(Q,`${JSON.stringify({version:1,grants:q},null,2)}
+`,{mode:384}),Qq(Q,384),$q(Q,z),B=null}function b(q,z=U(),Q=Date.now()){if(!x(q))throw Error(`No file or folder at ${q}.`);let J=k(q),X=P(z);if(X===J||X.startsWith(`${J}${W}`)||J.startsWith(`${X}${W}`))throw Error("Reason's own configuration folder cannot be allowed.");let Z={path:J,kind:G(J).isDirectory()?"folder":"file",grantedAt:Q},$=D(z).filter((R)=>R.path!==J);return w([...$,Z],z),Z}function u(q,z=U()){let Q=x(q)?k(q):S(q),J=D(z),X=J.filter((Z)=>Z.path!==Q);if(X.length===J.length)return!1;return w(X,z),!0}function wq(q,z,Q){let J=z?"file-read* file-write*":"file-read*";return D(Q).filter((X)=>X.path===q||X.path.startsWith(`${q}${W}`)).map((X)=>`(allow ${J} (${X.kind==="file"?"literal":"subpath"} ${JSON.stringify(X.path)}))`)}var f=`Reason permissions
+
+Usage:
+  reason permissions [--json]
+  reason permissions allow [screen|accessibility|disk]
+  reason permissions protected [list|allow <path>|revoke <path>] [--json]
+
+The macOS privacy permissions of this computer's Reason worker:
+  screen         Screen & System Audio Recording: desktop video, computer-use screenshots
+  accessibility  Accessibility: computer-use clicks and typing, desktop input
+  disk           Full Disk Access (recommended): Sessions in Desktop, Documents,
+                 Downloads, iCloud Drive and Mail
+
+protected lists, allows or revokes files and folders on Reason's credential
+denylist (shell startup files, ~/.ssh, .env and similar) that every Session on
+this Mac may open. Only you can change this list; Sessions cannot.
+
+allow asks for each missing one, or the one named. macOS cannot ask for Full
+Disk Access: allow disk opens its pane, shows the file to add in Finder and
+waits until the worker has it.
+`,M="x-apple.systempreferences:com.apple.preference.security",Nq="curl -fsSL https://reasonmachines.com/install.sh | bash",Hq=180000,Wq=2000,A=["screen","accessibility","disk"],L={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${M}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${M}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${M}?Privacy_AllFiles`}};function s(q){return q.executable}function jq(q,z){if(q==="computer_use_identity_missing")return`Reason's background identity is not installed (${q}); reinstall Reason: ${Nq}`;if(q==="computer_use_identity_outdated")return`Reason's background identity is outdated (${p(z)??"unknown"}; this CLI is ${l}) (${q}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${q}); run the installed \`reason\``}function Cq(q=j()){let z=n(q);if(z.length>0)return{state:"ready",path:I(I(I(z[0]))),prefix:z};let Q=a(z,q)??"computer_use_identity_unavailable";return{state:Q,path:d(q),detail:jq(Q,q)}}function o(){return{identity:()=>Cq(),grants:(q)=>m(q),request:(q,z)=>h(q,z),worker:async()=>(await import("./status-m0g7k47a.js")).connectionMacState(),open:(q)=>{Eq("/usr/bin/open",q,{stdio:"ignore",timeout:1e4})},tile:_,restartConnection:async()=>(await import("./connect-cli-xyxgcg6z.js")).restartConnection(),sleep:(q)=>new Promise((z)=>setTimeout(z,q)),now:()=>Date.now()}}function c(q,z,Q){if(q.state!=="ready"||!z)return"unknown";return z[Q]?"granted":"missing"}async function i(q){let z=q.identity(),Q=z.state==="ready"?await q.grants(z.prefix):null,J=await q.worker(),X=J?s(J):null,Z=!X||J?.full_disk_access==="unknown"?"unknown":J?.full_disk_access==="granted"?"granted":"missing",$=(R,Y,K)=>{let{label:E,purpose:H,level:N}=L[R];return{id:R,label:E,purpose:H,level:N,state:Y,holder:K}};return{identity:{state:z.state,path:z.path,detail:z.state==="ready"?null:z.detail},worker_detail:X?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[$("screen",c(z,Q,"screen"),z.path),$("accessibility",c(z,Q,"accessibility"),z.path),$("disk",Z,X)]}}function dq(q){let z=q.identity.state==="ready"?null:q.identity.state,Q=q.permissions.filter((Z)=>Z.state==="granted").length,J=[...z?[z]:[],...q.permissions.filter((Z)=>Z.state!=="granted"&&!(z&&Z.id!=="disk")).map((Z)=>`${Z.label} ${Z.state}`)],X=!z&&q.permissions.some((Z)=>Z.state==="missing");return`Permissions: ${Q} of ${q.permissions.length}${J.length>0?` (${J.join(", ")})`:""}`+(X?" \u2014 reason permissions allow":J.length>0?" \u2014 reason permissions":"")}function Uq(q){let z=[];if(q.identity.detail)z.push(q.identity.detail);z.push(`Reason: ${q.identity.path}`);let Q=q.permissions.find((J)=>J.id==="disk");z.push(Q?.holder?`Worker: ${Q.holder}`:`Worker: ${q.worker_detail}`),z.push("");for(let J of q.permissions){let X=`${J.label}${J.level==="recommended"?" (recommended)":""}`;z.push(`  ${J.id.padEnd(13)}  ${J.state.padEnd(7)}  ${X}: ${J.purpose}`)}if(q.permissions.some((J)=>J.state==="missing"))z.push("","Allow the missing ones: reason permissions allow");return`${z.join(`
+`)}
+`}async function g(q,z){let Q=z.now()+Hq;for(;;){if(await q())return!0;if(z.now()>=Q)return!1;await z.sleep(Wq)}}async function Iq(q,z){let Q=z.host??o(),{io:J}=z,X=await i(Q),Z=X.permissions.filter((K)=>q.includes(K.id)&&K.state!=="granted");if(Z.length===0)return J.stdout.write(`Reason permissions: ${q.map((K)=>L[K].label).join(", ")} already allowed.
+`),0;let $=!1,R=!1,Y=Q.identity();for(let K of Z){let{label:E,pane:H}=L[K.id];if(K.id!=="disk"){if(Y.state!=="ready"){if(!$)J.stderr.write(`Reason permissions: ${Y.detail}
+`);$=!0;continue}let C=K.id;await Q.request(Y.prefix,C),Q.open([H]);let t=Q.tile(Y.path,C);if(J.stdout.write(`Allow Reason in System Settings > Privacy & Security > ${E}.
+`),!z.wait)continue;if(J.stdout.write(`Waiting for it (Ctrl-C to stop)\u2026
+`),await g(async()=>(await Q.grants(Y.prefix))?.[C]===!0,Q).finally(t))J.stdout.write(`${E}: granted.
+`),R=!0;else J.stderr.write(`${E} is not allowed yet; turn on Reason there, then run \`reason permissions\`.
+`),$=!0;continue}let N=s(await Q.worker()??{executable:null});if(!N){J.stderr.write(`Reason permissions: ${X.worker_detail} Then run \`reason permissions allow disk\`.
+`),$=!0;continue}if(Q.open([H]),Q.open(["-R",N]),J.stdout.write(`Full Disk Access: click + and choose ${N} (shown in Finder), or drag it into the list.
+`),!z.wait)continue;if(J.stdout.write(`Waiting for the worker to report it (Ctrl-C to stop)\u2026
+`),await g(async()=>(await Q.worker())?.full_disk_access==="granted",Q))J.stdout.write(`Full Disk Access: granted.
+`);else J.stderr.write("Full Disk Access is not reported yet. If you allowed it, `reason connect` restarts the worker with it.\n"),$=!0}if(R)try{if(await Q.restartConnection())J.stdout.write(`This computer's Reason connection restarted to use them.
+`)}catch(K){J.stderr.write(`This computer's Reason connection uses them after it restarts (\`reason connect\`): ${K instanceof Error?K.message:String(K)}
+`)}return $?1:0}function Mq(q){if(q.some((J)=>["--help","-h","help"].includes(J)))return{command:"help"};let[z,...Q]=q;if(z==="protected"){let J=Q.includes("--json"),[X="list",Z,$]=Q.filter((R)=>R!=="--json");if(X==="list"&&Z===void 0)return{command:"protected",action:X,json:J};if((X==="allow"||X==="revoke")&&Z&&$===void 0)return{command:"protected",action:X,path:Z,json:J};return{error:"protected expects list, allow <path> or revoke <path>."}}if(z===void 0||z==="--json")return q.length<=1?{command:"list",json:z==="--json"}:{error:`Unknown option: ${q[1]}`};if(z!=="allow")return{error:`Unknown permissions command: ${z}`};if(Q.length>1)return{error:`Unknown option: ${Q[1]}`};if(Q.length===0)return{command:"allow",ids:[...A]};if(!A.includes(Q[0]))return{error:`allow expects ${A.join(", ")}.`};return{command:"allow",ids:[Q[0]]}}async function pq(q,z={}){let Q=z.io??{stdout:process.stdout,stderr:process.stderr},J=Mq(q);if("error"in J)return Q.stderr.write(`${J.error}
+
+${f}`),1;if(J.command==="help")return Q.stdout.write(f),0;if(J.command==="protected")return Aq(J,Q);let X=z.platform??process.platform;if(X!=="darwin")return Q.stdout.write(J.command==="list"&&J.json?`${JSON.stringify({platform:X,applicable:!1})}
+`:`Reason permissions: macOS privacy permissions do not apply on this computer.
+`),0;let Z=z.host??o();if(J.command==="allow")return Iq(J.ids,{io:Q,wait:!0,host:Z});let $=await i(Z);return Q.stdout.write(J.json?`${JSON.stringify({platform:X,applicable:!0,...$},null,2)}
+`:Uq($)),0}function Aq(q,z){try{if(q.action==="allow"){let J=b(q.path);return z.stdout.write(q.json?`${JSON.stringify({grant:J})}
+`:`Sessions on this computer may now open ${J.path}.
+`),0}if(q.action==="revoke"){let J=u(q.path);return z.stdout.write(q.json?`${JSON.stringify({revoked:J})}
+`:J?`Revoked ${q.path}.
+`:`No grant for ${q.path}.
+`),0}let Q=D();return z.stdout.write(q.json?`${JSON.stringify({grants:Q})}
+`:Q.length?Q.map((J)=>`${J.kind}	${J.path}
+`).join(""):`No protected paths are allowed on this computer.
+`),0}catch(Q){return z.stderr.write(`${Q instanceof Error?Q.message:String(Q)}
+`),1}}
+export{_ as jh,Sq as kh,wq as lh,f as mh,A as nh,s as oh,Cq as ph,i as qh,dq as rh,Uq as sh,Iq as th,Mq as uh,pq as vh};

package/bin/vm-hands/{vm-hands-entry-lite-3gztfxwt.js → vm-hands-entry-lite-b7wy89y0.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Yr,Qr,en,nr}from"./vm-hands-entry-lite-38g65s5x.js";import{ko,Co,P,$r,Br,Hn,ht,zn,Fr,Je,Se,qn,Ze,ne,Xe,Ee,Zt,jr,Ur,Vn}from"./vm-hands-entry-lite-dw558ggz.js";import{sr}from"./vm-hands-entry-lite-rfz60hb3.js";import{Kt}from"./vm-hands-entry-lite-wrvz9jxy.js";import{ve}from"./vm-hands-entry-lite-txd50spx.js";var r=["cgroup_membership_read_failed","cgroup_v2_membership_absent","cgroup_scope_invalid","cgroup_root_unavailable","cgroup_directory_unavailable","cgroup_limit_read_failed","cgroup_events_read_failed","cgroup_current_read_failed","cgroup_stat_read_failed","boot_id_read_failed","boot_id_invalid","guest_meminfo_read_failed","guest_vmstat_read_failed","memory_counter_invalid","memory_field_missing","memory_capacity_invalid"];var o=String.raw`(function(fs, path) {
+import{wh as w}from"./vm-hands-entry-lite-26xb026c.js";import{vi as H}from"./vm-hands-entry-lite-c8bf82tx.js";import{Ai as W,Bi as F,Ci as Q,Di as j,Fi as k,Hi as z,Ii as Z,Ji as J,Ki as K,Li as $,Ni as G,Oi as M,Qi as X,Ri as s,Si as _,Ui as S,Xi as Y,xi as m,yi as L,zi as B}from"./vm-hands-entry-lite-1nj03gbj.js";import{Dk as y,Ek as p,Fk as x,Gk as b}from"./vm-hands-entry-lite-jd31as70.js";import{zl as q}from"./vm-hands-entry-lite-xd2dn3n8.js";var o=["cgroup_membership_read_failed","cgroup_v2_membership_absent","cgroup_scope_invalid","cgroup_root_unavailable","cgroup_directory_unavailable","cgroup_limit_read_failed","cgroup_events_read_failed","cgroup_current_read_failed","cgroup_stat_read_failed","boot_id_read_failed","boot_id_invalid","guest_meminfo_read_failed","guest_vmstat_read_failed","memory_counter_invalid","memory_field_missing","memory_capacity_invalid"];var c=String.raw`(function(fs, path) {
   const fail = (message, reasonCode) => { throw Object.assign(Error(message), {reasonCode}); };
   const read = (p, reasonCode, trim=true) => { try { const text=fs.readFileSync(p, "utf8"); return trim?text.trim():text; }
     catch { fail("memory_read", reasonCode); } };
@@ -64,7 +64,7 @@ import{Yr,Qr,en,nr}from"./vm-hands-entry-lite-38g65s5x.js";import{ko,Co,P,$r,Br,
   if(!Number.isSafeInteger(limitBytes)||limitBytes<=0||!Number.isSafeInteger(available)||available>limitBytes) fail("memory_capacity", "memory_capacity_invalid");
   return {bootId,oomKills:field(read("/proc/vmstat", "guest_vmstat_read_failed"),"oom_kill"),currentBytes:limitBytes-available,
     limitBytes,inactiveFileBytes:0,capacitySource:"guest",memoryScope:"/proc"};
-})`;var i=String.raw`import os,sys,json,stat,fcntl,time,ctypes
+})`;var u=String.raw`import os,sys,json,stat,fcntl,time,ctypes
 v=json.load(sys.stdin)
 root=v['root']; paths=list(dict.fromkeys([v['source'],v['snapshot']]))
 marker=('# reason-job-env-owner:'+v['runId']+'\n').encode()
@@ -309,7 +309,7 @@ function fileOperation(request) {
   });
   return { promise, cancel() {} };
 }
-`;var s="a3e39eb55160acfc116fa9871ccc594c68be7a642d2331b24baa707c8f601ec0";import{createHash as I}from"crypto";var H=Object.freeze({"api.ara.so":"api.reasonmachines.com","api.reasonmachines.ai":"api.reasonmachines.com","api-staging.ara.so":"staging-api.reasonmachines.com","staging-api.reasonmachines.ai":"staging-api.reasonmachines.com"});var a=Object.freeze({trailingSlashPattern:/\/+$/.source,keyPrefix:"http.",keySuffix:"/.extraheader",valuePrefix:"Authorization: Bearer "});var l=Object.freeze({tokenEnv:"ARA_GIT_BROKER_TOKEN",reasonTokenEnv:"REASON_GIT_BROKER_TOKEN",urlEnv:"ARA_GIT_BROKER_URL",keyPrefix:"credential.",keySuffix:"/.helper",value:'!f(){ printf "username=%s\\npassword=%s\\n" "ara-run" "${REASON_GIT_BROKER_TOKEN:-$ARA_GIT_BROKER_TOKEN}"; };f'});var It=/^[A-Za-z_][A-Za-z0-9_]*$/;var h=new Set(["ARA_INFERENCE_TOKEN","AI_GATEWAY_API_KEY","CLOUD_AGENT_AI_GATEWAY_API_KEY","INFERENCE_V2_GATEWAY_API_KEY","VERCEL_AI_GATEWAY_API_KEY","INFERENCE_V2_CONCENTRATE_API_KEY","INFERENCE_V2_OPENAI_API_KEY","INFERENCE_V2_ANTHROPIC_API_KEY","INFERENCE_V2_FINGERPRINT_SECRET","OPENAI_API_KEY","OPENROUTER_API_KEY","ANTHROPIC_API_KEY","CODEX_ACCESS_TOKEN","GITHUB_COPILOT_API_KEY","AZURE_OPENAI_API_KEY","AZURE_OPENAI_CLIENT_SECRET"]),m=new Set(["ARA_OPERATOR_KEY","BL_API_KEY","BLAXEL_API_KEY","NSC_TOKEN","NSC_TOKEN_FILE","NAMESPACE_API_KEY","NAMESPACE_ACCESS_TOKEN","NAMESPACE_TOKEN","NAMESPACE_TOKEN_JSON","NAMESPACE_SANDBOX_TOKEN_JSON","ARA_LOCAL_QA_NAMESPACE_WORKLOAD_TOKEN_FILE","NAMESPACE_SANDBOX_USE_LOCAL_USER_TOKEN","COMPUTE_SERVICE_TOKEN"]),g=["INFISICAL_","NSC_"],_=new Set(["ARA_JOB_ENV","ARA_DELIVERY_BASE_SHA","WORK_ROOT","REPO_DIR","ARA_CONTROL_DIR","ARA_PRESERVE_WORKSPACE","ARA_PINNED_CHECKOUT_REUSE","FOLLOWUP_BRANCH","REPO_URL","TOKENLESS_URL","REPOSITORY_IDENTITY_URL","DEFAULT_BRANCH","BRANCH","BRANCH_GENERATED","BASE_REF","REPO_EMPTY","REPO_WRITABLE","ARA_DELIVERY_BASE_BRANCH","ARA_SERVER_GIT_PUBLICATION","ARA_EMPTY_REPOSITORY_COMMIT","REASON_MODEL","REASON_DELIVERY_BASE_BRANCH","REASON_DELIVERY_BASE_SHA","REASON_EMPTY_REPOSITORY_COMMIT","REASON_SCRATCH_SESSION_ID","REASON_SERVER_GIT_PUBLICATION","REASON_ALLOW_INSTALL_SCRIPTS","SCM_TOKEN","SCM_TOKEN_USER","REASON_OIDC_TOKEN_URL","REASON_OIDC_REQUEST_TOKEN","AWS_CONTAINER_CREDENTIALS_FULL_URI","AWS_CONTAINER_AUTHORIZATION_TOKEN","AWS_CONTAINER_CREDENTIALS_RELATIVE_URI","AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE","BASH_ENV","ENV","BASHOPTS","SHELLOPTS","PS4","IFS","CDPATH","GLOBIGNORE","PROMPT_COMMAND","PATH","HOME","TMPDIR","TMP","TEMP","XDG_CONFIG_HOME","GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES","GIT_DISCOVERY_ACROSS_FILESYSTEM","GIT_SHALLOW_FILE","GIT_ALLOW_PROTOCOL","GIT_PROTOCOL_FROM_USER","GIT_REPLACE_REF_BASE","NODE_OPTIONS","NODE_PATH","NODE_REPL_EXTERNAL_MODULES","CLASSPATH","PYTHONPATH","PYTHONSTARTUP","PYTHONHOME","RUBYOPT","RUBYLIB","PERL5LIB","PERL5OPT","JAVA_TOOL_OPTIONS","_JAVA_OPTIONS","JDK_JAVA_OPTIONS","GEM_PATH","GEM_HOME","GIT_SSH","GIT_SSH_COMMAND","GIT_EXEC_PATH","GIT_TEMPLATE_DIR","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_PROXY_COMMAND","GIT_EXTERNAL_DIFF","GIT_PAGER","GIT_EDITOR","GIT_ASKPASS","SSH_ASKPASS","PAGER","EDITOR","TAR_OPTIONS","CURL_HOME","WGETRC","APT_CONFIG","PERLLIB","GIT_GRAFT_FILE","POSIXLY_CORRECT"]),y=["GIT_TRACE","CONTEXT_REPO_","ARA_CHECKPOINT_BOOTSTRAP_","_","ARA_HANDS_","ARA_DEVICE_","ARA_GIT_BROKER_","REASON_HANDS_","REASON_DEVICE_","REASON_GIT_BROKER_","LD_","DYLD_","GIT_CONFIG","BASH_FUNC_"];var t="^(?!(?:"+[...h,...m,..._].join("|")+")$)(?!(?:"+[...g,...y].join("|")+"))"+It.source.slice(1),W=new RegExp(t);var v=["HOME","PWD","OLDPWD","TMPDIR","TMP","TEMP","SHELL","USER","LOGNAME","SCM_TOKEN","SCM_TOKEN_USER","GH_TOKEN","GITHUB_TOKEN","GH_ENTERPRISE_TOKEN","GITHUB_ENTERPRISE_TOKEN","GITLAB_TOKEN"],E=["ARA_HANDS_","ARA_DEVICE_","ARA_GIT_BROKER_","REASON_HANDS_","REASON_DEVICE_","REASON_GIT_BROKER_","BUN_"],S="^(?!(?:"+v.join("|")+")$)(?!(?:"+E.join("|")+"))"+t.slice(1),w="ARA_DELIVERY_BASE_SHA|WORK_ROOT|FOLLOWUP_BRANCH|ARA_PRESERVE_WORKSPACE|ARA_PINNED_CHECKOUT_REUSE|CONTEXT_REPO_[A-Z0-9_]+|REPO_URL|TOKENLESS_URL|REPOSITORY_IDENTITY_URL|DEFAULT_BRANCH|BRANCH|BRANCH_GENERATED|BASE_REF|REPO_EMPTY|REPO_WRITABLE|ARA_DELIVERY_BASE_BRANCH|ARA_SERVER_GIT_PUBLICATION|ARA_EMPTY_REPOSITORY_COMMIT|REASON_MODEL|REASON_DELIVERY_BASE_BRANCH|REASON_DELIVERY_BASE_SHA|REASON_EMPTY_REPOSITORY_COMMIT|REASON_SCRATCH_SESSION_ID|REASON_SERVER_GIT_PUBLICATION|REASON_ALLOW_INSTALL_SCRIPTS",n="^(?:"+w+"|"+S.slice(1,-1)+")$",O=new RegExp(n);function kr(u){return O.test(u)}var at=Object.freeze({tokenPath:"/identity/token",awsPath:"/identity/aws",tokenPattern:/^[A-Za-z0-9_.~-]+$/.source}),V=Object.freeze({variables:256,valueBytes:130816,snapshotBytes:1048576}),Z=Object.freeze({valueChars:16384,snapshotBytes:65536});var c=["set -g history-limit 50000","set -g status off","set -g window-size smallest","set -gq fill-character ' '","set -g escape-time 10","set -g prefix None","set -g prefix2 None","set -g terminal-overrides ',*:smcup@:rmcup@'"];var D=2,R="ara-hands-worker.cjs",d=["/usr/local/go/bin","/opt/node/bin","/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin","/usr/local/cargo/bin"],A=d.join(":"),T=["/opt/homebrew/bin",...d].join(":"),k='(platform, linuxPath, macosPath) => platform === "darwin" ? macosPath : linuxPath';var N=String.raw`(function(anchor, pid, native) {
+`;var a="a3e39eb55160acfc116fa9871ccc594c68be7a642d2331b24baa707c8f601ec0";import{createHash as rt}from"crypto";var bt=Object.freeze({"api.ara.so":"api.reasonmachines.com","api.reasonmachines.ai":"api.reasonmachines.com","api-staging.ara.so":"staging-api.reasonmachines.com","staging-api.reasonmachines.ai":"staging-api.reasonmachines.com"});var d=Object.freeze({trailingSlashPattern:/\/+$/.source,keyPrefix:"http.",keySuffix:"/.extraheader",valuePrefix:"Authorization: Bearer "});var f=Object.freeze({tokenEnv:"ARA_GIT_BROKER_TOKEN",reasonTokenEnv:"REASON_GIT_BROKER_TOKEN",urlEnv:"ARA_GIT_BROKER_URL",keyPrefix:"credential.",keySuffix:"/.helper",value:'!f(){ printf "username=%s\\npassword=%s\\n" "ara-run" "${REASON_GIT_BROKER_TOKEN:-$ARA_GIT_BROKER_TOKEN}"; };f'});var r=/^[A-Za-z_][A-Za-z0-9_]*$/;var T=new Set(["ARA_INFERENCE_TOKEN","AI_GATEWAY_API_KEY","CLOUD_AGENT_AI_GATEWAY_API_KEY","INFERENCE_V2_GATEWAY_API_KEY","VERCEL_AI_GATEWAY_API_KEY","INFERENCE_V2_CONCENTRATE_API_KEY","INFERENCE_V2_OPENAI_API_KEY","INFERENCE_V2_ANTHROPIC_API_KEY","INFERENCE_V2_FINGERPRINT_SECRET","OPENAI_API_KEY","OPENROUTER_API_KEY","ANTHROPIC_API_KEY","CODEX_ACCESS_TOKEN","GITHUB_COPILOT_API_KEY","AZURE_OPENAI_API_KEY","AZURE_OPENAI_CLIENT_SECRET"]),A=new Set(["ARA_OPERATOR_KEY","BL_API_KEY","BLAXEL_API_KEY","NSC_TOKEN","NSC_TOKEN_FILE","NAMESPACE_API_KEY","NAMESPACE_ACCESS_TOKEN","NAMESPACE_TOKEN","NAMESPACE_TOKEN_JSON","NAMESPACE_SANDBOX_TOKEN_JSON","ARA_LOCAL_QA_NAMESPACE_WORKLOAD_TOKEN_FILE","NAMESPACE_SANDBOX_USE_LOCAL_USER_TOKEN","COMPUTE_SERVICE_TOKEN"]),D=["INFISICAL_","NSC_"],v=new Set(["ARA_JOB_ENV","ARA_DELIVERY_BASE_SHA","WORK_ROOT","REPO_DIR","ARA_CONTROL_DIR","ARA_PRESERVE_WORKSPACE","ARA_PINNED_CHECKOUT_REUSE","FOLLOWUP_BRANCH","REPO_URL","TOKENLESS_URL","REPOSITORY_IDENTITY_URL","DEFAULT_BRANCH","BRANCH","BRANCH_GENERATED","BASE_REF","REPO_EMPTY","REPO_WRITABLE","ARA_DELIVERY_BASE_BRANCH","ARA_SERVER_GIT_PUBLICATION","ARA_EMPTY_REPOSITORY_COMMIT","REASON_MODEL","REASON_DELIVERY_BASE_BRANCH","REASON_DELIVERY_BASE_SHA","REASON_EMPTY_REPOSITORY_COMMIT","REASON_SCRATCH_SESSION_ID","REASON_SERVER_GIT_PUBLICATION","REASON_ALLOW_INSTALL_SCRIPTS","SCM_TOKEN","SCM_TOKEN_USER","REASON_OIDC_TOKEN_URL","REASON_OIDC_REQUEST_TOKEN","AWS_CONTAINER_CREDENTIALS_FULL_URI","AWS_CONTAINER_AUTHORIZATION_TOKEN","AWS_CONTAINER_CREDENTIALS_RELATIVE_URI","AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE","BASH_ENV","ENV","BASHOPTS","SHELLOPTS","PS4","IFS","CDPATH","GLOBIGNORE","PROMPT_COMMAND","PATH","HOME","TMPDIR","TMP","TEMP","XDG_CONFIG_HOME","GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES","GIT_DISCOVERY_ACROSS_FILESYSTEM","GIT_SHALLOW_FILE","GIT_ALLOW_PROTOCOL","GIT_PROTOCOL_FROM_USER","GIT_REPLACE_REF_BASE","NODE_OPTIONS","NODE_PATH","NODE_REPL_EXTERNAL_MODULES","CLASSPATH","PYTHONPATH","PYTHONSTARTUP","PYTHONHOME","RUBYOPT","RUBYLIB","PERL5LIB","PERL5OPT","JAVA_TOOL_OPTIONS","_JAVA_OPTIONS","JDK_JAVA_OPTIONS","GEM_PATH","GEM_HOME","GIT_SSH","GIT_SSH_COMMAND","GIT_EXEC_PATH","GIT_TEMPLATE_DIR","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_PROXY_COMMAND","GIT_EXTERNAL_DIFF","GIT_PAGER","GIT_EDITOR","GIT_ASKPASS","SSH_ASKPASS","PAGER","EDITOR","TAR_OPTIONS","CURL_HOME","WGETRC","APT_CONFIG","PERLLIB","GIT_GRAFT_FILE","POSIXLY_CORRECT"]),N=["GIT_TRACE","CONTEXT_REPO_","ARA_CHECKPOINT_BOOTSTRAP_","_","ARA_HANDS_","ARA_DEVICE_","ARA_GIT_BROKER_","REASON_HANDS_","REASON_DEVICE_","REASON_GIT_BROKER_","LD_","DYLD_","GIT_CONFIG","BASH_FUNC_"];var n="^(?!(?:"+[...T,...A,...v].join("|")+")$)(?!(?:"+[...D,...N].join("|")+"))"+r.source.slice(1),Lt=new RegExp(n);var U=["HOME","PWD","OLDPWD","TMPDIR","TMP","TEMP","SHELL","USER","LOGNAME","SCM_TOKEN","SCM_TOKEN_USER","GH_TOKEN","GITHUB_TOKEN","GH_ENTERPRISE_TOKEN","GITHUB_ENTERPRISE_TOKEN","GITLAB_TOKEN"],R=["ARA_HANDS_","ARA_DEVICE_","ARA_GIT_BROKER_","REASON_HANDS_","REASON_DEVICE_","REASON_GIT_BROKER_","BUN_"],E="^(?!(?:"+U.join("|")+")$)(?!(?:"+R.join("|")+"))"+n.slice(1),tt="ARA_DELIVERY_BASE_SHA|WORK_ROOT|FOLLOWUP_BRANCH|ARA_PRESERVE_WORKSPACE|ARA_PINNED_CHECKOUT_REUSE|CONTEXT_REPO_[A-Z0-9_]+|REPO_URL|TOKENLESS_URL|REPOSITORY_IDENTITY_URL|DEFAULT_BRANCH|BRANCH|BRANCH_GENERATED|BASE_REF|REPO_EMPTY|REPO_WRITABLE|ARA_DELIVERY_BASE_BRANCH|ARA_SERVER_GIT_PUBLICATION|ARA_EMPTY_REPOSITORY_COMMIT|REASON_MODEL|REASON_DELIVERY_BASE_BRANCH|REASON_DELIVERY_BASE_SHA|REASON_EMPTY_REPOSITORY_COMMIT|REASON_SCRATCH_SESSION_ID|REASON_SERVER_GIT_PUBLICATION|REASON_ALLOW_INSTALL_SCRIPTS",i="^(?:"+tt+"|"+E.slice(1,-1)+")$",et=new RegExp(i);function jt(t){return et.test(t)}var l=Object.freeze({tokenPath:"/identity/token",awsPath:"/identity/aws",tokenPattern:/^[A-Za-z0-9_.~-]+$/.source}),g=Object.freeze({variables:256,valueBytes:130816,snapshotBytes:1048576}),kt=Object.freeze({valueChars:16384,snapshotBytes:65536});var h=["set -g history-limit 50000","set -g status off","set -g window-size smallest","set -gq fill-character ' '","set -g escape-time 10","set -g prefix None","set -g prefix2 None","set -g terminal-overrides ',*:smcup@:rmcup@'"];var nt=2,it="ara-hands-worker.cjs",P=["/usr/local/go/bin","/opt/node/bin","/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin","/usr/local/cargo/bin"],st=P.join(":"),ot=["/opt/homebrew/bin",...P].join(":"),ct='(platform, linuxPath, macosPath) => platform === "darwin" ? macosPath : linuxPath';function Ot(t,V,C){return t==="darwin"?C:V}var ut=String.raw`(function(anchor, pid, native) {
   const token = native.identity(pid);
   const session = native.session(pid);
   if (!native.same(anchor)) throw new Error("pty_session_identity_lost");
@@ -317,7 +317,7 @@ function fileOperation(request) {
   if (session.id !== anchor[5]) throw new Error("pty_member_session_changed");
   if (!token) return { retry: true, token: null };
   return { retry: false, token };
-})`,C=String.raw`(function(native) {
+})`,at=String.raw`(function(native) {
   let probe;
   try {
     try {
@@ -327,7 +327,7 @@ function fileOperation(request) {
       native.signal(probe);
     } finally { if (probe) native.release(probe); }
   } catch (error) { native.close(); throw error; }
-})`,x=String.raw`(function(bootstrap) {
+})`,dt=String.raw`(function(bootstrap) {
   const { dlopen, ptr } = require("bun:ffi");
   const api = dlopen("libc.so.6", {
     prctl: { args: ["i32", "u64", "u64", "u64", "u64"], returns: "i32" },
@@ -348,7 +348,7 @@ function fileOperation(request) {
   require("node:fs").writeSync(3, "subreaper\n");
   api.execve(ptr(args[0]), ptr(argv), ptr(envp));
   throw new Error("pty_exec_failed");
-})`,Qo=String.raw`
+})`,ft=String.raw`
 "use strict";
 const crypto = require("node:crypto");
 const fs = require("node:fs");
@@ -356,46 +356,46 @@ const net = require("node:net");
 const path = require("node:path");
 const { spawn, spawnSync } = require("node:child_process");
 const { StringDecoder } = require("node:string_decoder");
-const GIT_BROKER_HTTP_HEADER_POLICY = ${JSON.stringify(a)};
-const GIT_BROKER_CREDENTIAL_HELPER_POLICY = ${JSON.stringify(l)};
-const DEVICE_ENVIRONMENT_NAME_RE = new RegExp(${JSON.stringify(n)});
-const DEVICE_CLOUD_ACCESS_POLICY = ${JSON.stringify(at)};
-const DEVICE_ENVIRONMENT_LIMITS = ${JSON.stringify(V)};
+const GIT_BROKER_HTTP_HEADER_POLICY = ${JSON.stringify(d)};
+const GIT_BROKER_CREDENTIAL_HELPER_POLICY = ${JSON.stringify(f)};
+const DEVICE_ENVIRONMENT_NAME_RE = new RegExp(${JSON.stringify(i)});
+const DEVICE_CLOUD_ACCESS_POLICY = ${JSON.stringify(l)};
+const DEVICE_ENVIRONMENT_LIMITS = ${JSON.stringify(g)};
 
-const VERSION = ${P};
-const WORKER_VERSION = ${D};
-const WORKER_ENTRYPOINT = ${JSON.stringify(R)};
-const GUEST_MEMORY_UNAVAILABLE_REASONS = ${JSON.stringify(r)};
-const sampleGuestMemory = ${o};
-const inspectMacPtyMember = ${N};
-const probeLinuxPtyLibrary = ${C};
-const windowsPtyApi = ${Kt};
-const LINUX_PTY_EXEC_SOURCE = ${JSON.stringify(x)};
-const CLOSE_CODES = ${JSON.stringify(Ur)};
+const VERSION = ${B};
+const WORKER_VERSION = ${nt};
+const WORKER_ENTRYPOINT = ${JSON.stringify(it)};
+const GUEST_MEMORY_UNAVAILABLE_REASONS = ${JSON.stringify(o)};
+const sampleGuestMemory = ${c};
+const inspectMacPtyMember = ${ut};
+const probeLinuxPtyLibrary = ${at};
+const windowsPtyApi = ${H};
+const LINUX_PTY_EXEC_SOURCE = ${JSON.stringify(dt)};
+const CLOSE_CODES = ${JSON.stringify(S)};
 const SHA256_RE = /^[0-9a-f]{64}$/;
-const MAX_FRAME_BYTES = ${$r};
-const MAX_INPUT_CHARS = ${Br};
-const MAX_STRUCTURED_INPUT_CHARS = ${Hn};
-const MAX_OUTPUT_CHARS = ${ht};
-const WORKSPACE_BEFORE_MAX_OUTPUT_CHARS = ${Vn};
-const MAX_ERROR_CHARS = ${zn};
+const MAX_FRAME_BYTES = ${W};
+const MAX_INPUT_CHARS = ${F};
+const MAX_STRUCTURED_INPUT_CHARS = ${Q};
+const MAX_OUTPUT_CHARS = ${j};
+const WORKSPACE_BEFORE_MAX_OUTPUT_CHARS = ${Y};
+const MAX_ERROR_CHARS = ${k};
 const MAX_LEDGER_IDS = 16384;
 const MAX_CACHED_RESULTS = 256;
-const MAX_JOB_INPUT_CHARS = ${Fr};
-const MAX_JOB_OUTPUT_CHARS = ${Je};
-const MAX_JOB_OUTPUT_CHUNKS = ${Se};
-const MAX_JOBS = ${qn};
+const MAX_JOB_INPUT_CHARS = ${z};
+const MAX_JOB_OUTPUT_CHARS = ${Z};
+const MAX_JOB_OUTPUT_CHUNKS = ${J};
+const MAX_JOBS = ${K};
 const MAX_JOB_RECORD_BYTES = 262144;
 const MAX_JOB_JOURNAL_BYTES = MAX_JOBS * MAX_JOB_RECORD_BYTES;
-const MAX_JOB_CONTROL_FRAME_BYTES = ${Ze};
-const MAX_PTY_INPUT_BYTES = ${ne};
-const MAX_PTY_OUTPUT_BYTES = ${Xe};
-const MAX_PTY_DIMENSION = ${Ee};
+const MAX_JOB_CONTROL_FRAME_BYTES = ${$};
+const MAX_PTY_INPUT_BYTES = ${G};
+const MAX_PTY_OUTPUT_BYTES = ${M};
+const MAX_PTY_DIMENSION = ${X};
 const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const WINDOWS = process.platform === "win32";
 // Each Bash leader's tree on Windows, children that outlive it included (shared/windows-job-object.ts).
-const windowsJobs = WINDOWS ? ${sr}(require) : null;
+const windowsJobs = WINDOWS ? ${q}(require) : null;
 /** Windows has no POSIX owner or mode bits: the user's own profile folders are
  * private by their ACLs, and the worker runs as that ordinary user. */
 function ownedPrivately(stat, mask = 0o077) {
@@ -492,9 +492,9 @@ function jobsUserPrefix(model) {
   return user ? ["/usr/bin/setpriv", "--reuid=" + user.uid, "--regid=" + gid, "--clear-groups", "--no-new-privs", "--",
     "/usr/bin/env", "HOME=" + user.home, "USER=" + user.username, "LOGNAME=" + user.username] : [];
 }
-const FIXED_CLOUD_CHILD_PATH = ${JSON.stringify(A)};
-const FIXED_MACOS_CLOUD_CHILD_PATH = ${JSON.stringify(T)};
-const selectCloudChildPath = ${k};
+const FIXED_CLOUD_CHILD_PATH = ${JSON.stringify(st)};
+const FIXED_MACOS_CLOUD_CHILD_PATH = ${JSON.stringify(ot)};
+const selectCloudChildPath = ${ct};
 const config = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
 const FIXED_BASH = WINDOWS ? config.bashExecutable : "/bin/bash";
 const allowedTools = config.allowedTools === undefined
@@ -577,12 +577,12 @@ function validJobEnvSourcePath() {
   if (config.jobEnvSourcePath === undefined || config.jobEnvSourcePath === path.join(config.workRoot, "job.env")) return true;
   // A cloud workspace's job.env is in its Session's root-only control
   // directory (shared/device-workspace.ts), derived from the root alone.
-  const cloud = new RegExp(${JSON.stringify(nr.source)}).exec(config.workRoot);
+  const cloud = new RegExp(${JSON.stringify(b.source)}).exec(config.workRoot);
   if (process.platform === "linux" && cloud) {
     const workspaceId = cloud[3];
-    const owner = (new RegExp(${JSON.stringify(Qr.source)}).exec(workspaceId) || [])[1]
-      ?? (new RegExp(${JSON.stringify(en.source)}).exec(workspaceId) || [])[1] ?? workspaceId;
-    return config.jobEnvSourcePath === ${JSON.stringify(Yr)} + "/" + owner + "/job.env";
+    const owner = (new RegExp(${JSON.stringify(p.source)}).exec(workspaceId) || [])[1]
+      ?? (new RegExp(${JSON.stringify(x.source)}).exec(workspaceId) || [])[1] ?? workspaceId;
+    return config.jobEnvSourcePath === ${JSON.stringify(y)} + "/" + owner + "/job.env";
   }
   // Personal Cloud controls are root-owned and outside the writable grant.
   // Admit only the same canonical session, never a caller-selected private path.
@@ -1027,7 +1027,7 @@ function initializeJobs() {
 // (shared/local-protected-paths.ts) that the file tools and every confinement
 // refuse. A home-folder worker keeps it in ~/.config/reason, so its Session may
 // work in the home folder itself, as a Mac's home grant does.
-const PROTECTED_STATE_DIRECTORIES = ${JSON.stringify(ve)};
+const PROTECTED_STATE_DIRECTORIES = ${JSON.stringify(w)};
 function stateOverlapsWorkspace(state, root) {
   if (pathWithin(root, state)) return true;
   if (!pathWithin(state, root)) return false;
@@ -1372,7 +1372,7 @@ async function handleTerminalCleanup(target, claim, raw) {
     let child, timer, killTimer;
     const finish = ok => { clearTimeout(timer); clearTimeout(killTimer); if (!ok) cleanupUnconfirmed = true; resolve(ok); };
     try {
-      child = spawn("/usr/bin/python3", ["-I", "-c", ${JSON.stringify(i)}],
+      child = spawn("/usr/bin/python3", ["-I", "-c", ${JSON.stringify(u)}],
         { stdio: ["pipe", "ignore", "ignore"], env: { PATH: "/usr/bin:/bin" }, detached: true });
       let timedOut = false;
       timer = setTimeout(() => { timedOut = true; try { process.kill(-child.pid, "SIGTERM"); } catch { cleanupUnconfirmed = true; }
@@ -2347,7 +2347,7 @@ function windowsPtyOperation(request, managed) {
       try {
         if (pty.activeProcesses() > 0) pty.terminate();
         for (const startedAt = Date.now(); pty.activeProcesses() > 0;) {
-          if (Date.now() - startedAt > ${Zt}) throw new Error("pty_cleanup_timeout");
+          if (Date.now() - startedAt > ${s}) throw new Error("pty_cleanup_timeout");
           await new Promise((resolve) => setTimeout(resolve, 20));
         }
         pty.close();
@@ -2651,7 +2651,7 @@ function linuxPtyOwner() {
 // user detaches from the shell (nohup, setsid, disown, or jobs left at exit)
 // are not swept. At most TERMINAL_HOST_LIMIT shells per scope.
 const TERMINAL_SHELL = "/bin/bash --noprofile --norc -i";
-const TERMINAL_TMUX_CONFIG = ${JSON.stringify([...c,"new-session -d -s main /bin/bash --noprofile --norc -i","set -g exit-empty on","run-shell -b -d 43200 -C kill-server",""].join(`
+const TERMINAL_TMUX_CONFIG = ${JSON.stringify([...h,"new-session -d -s main /bin/bash --noprofile --norc -i","set -g exit-empty on","run-shell -b -d 43200 -C kill-server",""].join(`
 `))};
 const TERMINAL_HOST_LIMIT = 4;
 const terminalViewers = new Map();
@@ -2795,7 +2795,7 @@ function ptyOperation(request, managed, program = TERMINAL_SHELL) {
           const { members, empty } = native.session(anchor, device);
           try {
             if (empty && exitCode !== null && subreaper) break;
-            if (Date.now() - startedAt > ${Zt}) throw new Error("pty_cleanup_timeout");
+            if (Date.now() - startedAt > ${s}) throw new Error("pty_cleanup_timeout");
             for (const token of members) {
               if (!native.same(anchor)) throw new Error("pty_session_identity_lost");
               const id = native.identityKey(token);
@@ -2811,7 +2811,7 @@ function ptyOperation(request, managed, program = TERMINAL_SHELL) {
         controlReleased = true;
         let exitTimer;
         try { await Promise.race([child.exited, new Promise((_, reject) => {
-          exitTimer = setTimeout(() => reject(new Error("pty_anchor_exit_unconfirmed")), ${jr});
+          exitTimer = setTimeout(() => reject(new Error("pty_anchor_exit_unconfirmed")), ${_});
         })]); } finally { clearTimeout(exitTimer); }
         if (timedOut) finish("timeout", 124);
         else if (cancelled) finish("cancelled", 130);
@@ -3329,7 +3329,7 @@ function replOperation(request) {
 // timeout and the lease, and background processes retained until the worker
 // stops. One departure from stock: a command idle on a watcher's banner is
 // stopped (PI_WATCH_BANNER). PI_* variables are not set here.
-const PI_TOOLS_SHA256 = "${s}";
+const PI_TOOLS_SHA256 = "${a}";
 const piToolsSource = typeof araHandsPiToolsSource === "function" ? araHandsPiToolsSource : null;
 let piTools = null;
 function loadPiTools() {
@@ -3362,10 +3362,10 @@ const PI_EXIT_STDIO_GRACE_MS = 100;
 // the token once under quoteDepth layers of single quoting, so the confined
 // script is byte-identical to what the Brain's confineBashPayload gives the
 // bash tool: srt/bwrap, the payload uid, the network allowlist and allowWrite.
-const PI_TOOL_CONFINEMENT_TOKEN = "${ko}";
+const PI_TOOL_CONFINEMENT_TOKEN = "${m}";
 function validPiToolConfinement(value) {
   return hasOnlyKeys(value, ["template", "quoteDepth"]) && typeof value.template === "string"
-    && value.template.length <= ${Co} && !value.template.includes("\0")
+    && value.template.length <= ${L} && !value.template.includes("\0")
     && value.template.split(PI_TOOL_CONFINEMENT_TOKEN).length === 2 && [1, 2, 3].includes(value.quoteDepth);
 }
 // The script T when this command is exactly this policy's confineBashPayload(T)
@@ -4176,5 +4176,5 @@ void startJobControl().then(() => {
   try { loadJobs(); prepareRequestJournal(); } catch { process.exit(44); }
   if (validPrivateJob) markReady(); else connect();
 }, () => process.exit(45));
-`.trimStart();var b=I("sha256").update(Qo,"utf8").digest("hex"),En={42:"worker_config_invalid",43:"workspace_alias_failed",44:"job_journal_unavailable",45:"job_control_failed",46:"job_journal_owned"};
-export{It,kr,at,V,D,R,Qo,b,En};
+`.trimStart(),Tt=rt("sha256").update(ft,"utf8").digest("hex"),At={42:"worker_config_invalid",43:"workspace_alias_failed",44:"job_journal_unavailable",45:"job_control_failed",46:"job_journal_owned"};
+export{r as gd,jt as hd,l as id,g as jd,nt as kd,it as ld,st as md,ot as nd,Ot as od,ut as pd,at as qd,ft as rd,Tt as sd,At as td};

package/bin/vm-hands/vm-hands-entry-lite-c5gt0086.js

@@ -0,0 +1,3 @@
+// @bun
+var o={name:"github-native-engineer-device-worker-production",version:"0.2.505",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@agentclientprotocol/sdk":"1.9.0","@anthropic-ai/sandbox-runtime":"^0.0.80","@earendil-works/pi-tui":"1.0.0","@reason/runtime-distribution":"workspace:*",diff:"8.0.4","open-browser-use-sdk":"0.1.42","playwright-core":"1.60.0",toml:"4.2.0",zod:"^4.4.3"},overrides:{"@hono/node-server":"^1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"^1.20.0","basic-ftp":"^6.2.1","@grpc/grpc-js":"^1.14.5",browserslist:"^4.28.8","engine.io":"^6.6.7","fast-uri":"^3.1.8",hono:"^4.13.7","ip-address":"^10.7.1",nanoid:"^3.3.18",dompurify:"^3.4.17",postcss:"^8.5.23",qs:"^6.16.0","shell-quote":"^1.11.0","socket.io-parser":"^4.2.7",tmp:"^0.2.7",toml:"^4.2.0",undici:"^8.10.2",ws:"^8.21.0","js-yaml":"^4.3.2","@modelcontextprotocol/sdk":"^1.31.0","proxy-addr":"^2.0.8","source-map-js":"^1.2.2"}};
+export{o as Rk};

package/bin/vm-hands/{vm-hands-entry-lite-wrvz9jxy.js → vm-hands-entry-lite-c8bf82tx.js}

@@ -1,5 +1,5 @@
 // @bun
-var Kt=String.raw`(function(loadFfi, existsSync) {
+var e=String.raw`(function(loadFfi, existsSync) {
   const STARTF_USESTDHANDLES = 0x100;
   const CREATE_SUSPENDED = 0x4;
   const CREATE_UNICODE_ENVIRONMENT = 0x400;
@@ -242,4 +242,4 @@ var Kt=String.raw`(function(loadFfi, existsSync) {
   }
   return { available, unavailableReason, defaultShell, shellArgs, quoteArg, environmentBlock, spawn };
 })`;
-export{Kt};
+export{e as vi};

package/bin/vm-hands/vm-hands-entry-lite-dgmap6z4.js

@@ -0,0 +1,5 @@
+// @bun
+import{gk as m}from"./vm-hands-entry-lite-3rg3znp8.js";import{Sk as A,Tk as y,Uk as p}from"./vm-hands-entry-lite-e1xjfj57.js";import{bl as u}from"./vm-hands-entry-lite-8p8hz0j1.js";import{randomUUID as d}from"crypto";import{chmodSync as c,existsSync as n,mkdirSync as YJ,readlinkSync as GJ,readFileSync as OJ,renameSync as VJ,unlinkSync as FJ,writeFileSync as HJ}from"fs";import{homedir as v}from"os";import{basename as C,dirname as H,isAbsolute as g,join as N,normalize as a,relative as TJ,resolve as zJ}from"path";import{unlinkSync as XJ}from"fs";import{dirname as ZJ,join as $J}from"path";function jJ(J){return $J(ZJ(J),"future-device-grant.json")}function l(J){try{XJ(jJ(J))}catch(Q){if(!(Q instanceof Error&&("code"in Q)&&Q.code==="ENOENT"))throw Q}}var z=3,BJ=1,SJ=2,D=1,i=1,r="Reason may read and write files and run commands in this signed-in OS account, subject to saved restrictions and operating system permissions.",E="Reason may later execute on this computer inside a Reason sandbox, limited to folders explicitly attached by the user.",_J=[E,"Ara may later execute on this computer inside an Ara sandbox, limited to folders explicitly attached by the user."];function t(J){return typeof J==="string"&&_J.includes(J)}var IJ=["future_device","updates_only","cli_only"];function h(J){return typeof J==="string"&&IJ.some((Q)=>Q===J)}function LJ(J=process.env,Q=v()){return J.XDG_CONFIG_HOME?.trim()||N(Q,".config")}function K(J=process.env,Q=v()){let U=y({env:J}),W=LJ(J,Q);return N(W,m(W).state==="kept"?"ara":"reason",...U==="staging"?["staging"]:[],"installation.json")}function G(J){return typeof J==="string"&&J.trim().length>0}var NJ=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;function AJ(J){return typeof J==="string"&&NJ.test(J)}function M(J){return G(J)&&g(J)&&a(J)===J}function e(J){if(!J||typeof J!=="object"||Array.isArray(J))return!1;let Q=J;return M(Q.path)&&(Q.role==="launcher"&&(Q.kind==="file"||Q.kind==="symlink")||Q.role==="worker_root"&&Q.kind==="directory"||Q.role==="alias"&&Q.kind==="symlink"&&M(Q.target))}function JJ(J){return J==="staging"?["reason-staging","ara-staging"]:["reason","ara"]}var gJ=/^\.(?:reason|ara)(?:-staging)?-worker-/,hJ=["reason","ara"];function oJ(J){let Q=J.owned_paths.filter((W)=>W.role==="launcher").map((W)=>W.path),[U]=JJ(J.channel);return Q.find((W)=>C(W)===U)??Q[0]??null}function o(J){let[Q,U]=JJ(J.channel==="staging"?"staging":"production"),W=[[Q,U],[U,Q]];return J.owned_paths?.every((X)=>X.role!=="alias"||J.installer==="shell"&&W.some(([$,j])=>X.path===N(J.install_dir,$)&&X.target===N(J.install_dir,j))&&J.owned_paths?.some(($)=>$.role==="launcher"&&$.path===X.target))??!1}function w(J,Q){try{return zJ(H(J),GJ(J))===Q}catch{return!1}}function sJ(J){let Q=C(J),U=Q==="ara"?"reason":Q==="ara-staging"?"reason-staging":null;if(!U)return J;let W=N(H(J),U);return w(W,J)||w(J,W)?W:J}function f(J,Q){let U=TJ(J,Q);return U.length>0&&!U.startsWith("..")&&!g(U)}function QJ(J){if(J===null)return!0;if(!J||typeof J!=="object"||Array.isArray(J))return!1;let Q=J;return(Q.kind==="shell_profile"||Q.kind==="windows_user_path")&&G(Q.location)&&G(Q.value)&&(typeof Q.added_by_installer==="boolean"||typeof Q.added_by_ara==="boolean")&&(Q.added_by_installer===void 0||typeof Q.added_by_installer==="boolean")&&(Q.added_by_ara===void 0||typeof Q.added_by_ara==="boolean")}function q(J){return J.added_by_installer??J.added_by_ara??!1}function UJ(J,Q){if(Q===null)return J==="cli_only";if(!Q||typeof Q!=="object"||Array.isArray(Q))return!1;let U=Q;if(U.version!==D||!G(U.recorded_at))return!1;if(J==="future_device")return U.decision==="authorized"&&t(U.scope);return U.scope===null&&U.decision===(J==="updates_only"?"ask":"disabled")}function DJ(J){if(!J||typeof J!=="object"||Array.isArray(J))return null;let Q=J;if(Q.schema_version!==BJ||!A.includes(Q.channel)||Q.install_method!=="curl"||Q.installer!=="shell"&&Q.installer!=="powershell"||!G(Q.installed_at)||!G(Q.version)||!G(Q.target)||!M(Q.install_dir)||!Array.isArray(Q.owned_paths)||!Q.owned_paths.every(e)||!Q.owned_paths.every((U)=>f(Q.install_dir,U.path))||!o(Q)||!QJ(Q.path_entry))return null;return{...Q,schema_version:z,installation_id:null,background_mode:"cli_only",device_consent:null}}function KJ(J){if(!J||typeof J!=="object"||Array.isArray(J))return null;let Q=J;if(Q.schema_version!==SJ||!WJ(Q)||!h(Q.background_mode)||!UJ(Q.background_mode,Q.device_consent))return null;return{...Q,schema_version:z,installation_id:null}}function WJ(J){return A.includes(J.channel)&&(J.install_method==="curl"&&(J.installer==="shell"||J.installer==="powershell")||J.install_method==="desktop"&&J.installer==="desktop"&&Array.isArray(J.owned_paths)&&J.owned_paths.length===0&&J.path_entry===null)&&G(J.installed_at)&&G(J.version)&&G(J.target)&&M(J.install_dir)&&Array.isArray(J.owned_paths)&&J.owned_paths.every(e)&&J.owned_paths.every((Q)=>f(J.install_dir,Q.path))&&o(J)&&QJ(J.path_entry)}function RJ(J){let Q=DJ(J);if(Q)return Q;let U=KJ(J);if(U)return U;if(!J||typeof J!=="object"||Array.isArray(J))return null;let W=J;if(W.schema_version!==z||!AJ(W.installation_id)||!WJ(W)||!h(W.background_mode)||!UJ(W.background_mode,W.device_consent)||W.desktop_account_access!==void 0&&(W.desktop_account_access===null||typeof W.desktop_account_access!=="object"||Array.isArray(W.desktop_account_access)||W.desktop_account_access.version!==i||W.desktop_account_access.scope!==r||!G(W.desktop_account_access.recorded_at)||!Number.isFinite(Date.parse(W.desktop_account_access.recorded_at))))return null;return W}function k(J=K()){if(!n(J))return null;try{return RJ(JSON.parse(OJ(J,"utf8")))}catch{return null}}function b(J){return Boolean(J?.installation_id&&J.background_mode==="future_device"&&J.device_consent?.version===D&&J.device_consent.decision==="authorized"&&t(J.device_consent.scope))}function s(J,Q){let U=k(Q);if(!(b(U)&&b(J)&&U.installation_id===J.installation_id&&U.channel===J.channel))l(Q);YJ(H(Q),{recursive:!0,mode:448}),c(H(Q),448);let X=`${Q}.${process.pid}.${d()}.tmp`;try{HJ(X,`${JSON.stringify(J,null,2)}
+`,{mode:384,flag:"wx"}),c(X,384),VJ(X,Q)}finally{if(n(X))FJ(X)}let $=H(Q),j=C($)==="staging"?H($):$;if(C(j)==="reason")m(H(j));return J}function qJ(J=K(),Q=new Date){let U=k(J);if(!U?.installation_id)throw Error("Reason installation ownership is missing; reinstall the current CLI before enabling Device execution");if(b(U))return U;let W={...U,background_mode:"future_device",device_consent:{version:D,decision:"authorized",scope:E,recorded_at:Q.toISOString()}};return delete W.desktop_account_access,s(W,J)}function lJ(J,Q=K(),U=new Date){if(!A.includes(J.channel))throw Error("invalid installation channel");if(!J.version.trim())throw Error("installation version is required");if(!J.target.trim())throw Error("installation target is required");let W=L(J.installDir,"install directory"),X=k(Q);if(X?.installation_id&&!J.accountAccess)return qJ(Q,U);return s({...X??{schema_version:z,channel:J.channel,install_method:"desktop",installer:"desktop",installed_at:U.toISOString(),version:J.version.trim(),target:J.target.trim(),install_dir:W,owned_paths:[],path_entry:null},schema_version:z,installation_id:X?.installation_id??d(),background_mode:"future_device",...J.accountAccess?{desktop_account_access:{version:i,scope:r,recorded_at:U.toISOString()}}:{},device_consent:{version:D,decision:"authorized",scope:E,recorded_at:U.toISOString()}},Q)}function CJ(J,Q){return J.kind===Q.kind&&J.location===Q.location&&J.value===Q.value}function L(J,Q){let U=a(J);if(!g(U))throw Error(`${Q} must be an absolute path`);return U}function MJ(J,Q=K(),U=new Date){if(!A.includes(J.channel))throw Error("invalid installation channel");if(!J.version.trim())throw Error("installation version is required");if(!J.target.trim())throw Error("installation target is required");let W=L(J.install_dir,"install directory"),X=k(Q),$=J.backgroundMode??"preserve",j=$==="preserve"?X?.background_mode??"cli_only":$,T=X?.channel===J.channel&&b(X)&&j==="future_device",B=$==="preserve"&&!X||X?.channel===J.channel&&($==="preserve"||T),O={path:L(J.launcherPath,"launcher path"),kind:J.launcherKind,role:"launcher"};if(!f(W,O.path))throw Error("launcher path must be inside the install directory");let S=(J.workerRoots??[]).map((Y)=>L(Y,"worker root"));if(S.some((Y)=>!f(W,Y)))throw Error("worker root must be inside the install directory");let _=[];if(J.aliasPath){let Y={path:L(J.aliasPath,"alias path"),kind:"symlink",role:"alias",target:O.path};if(!o({installer:J.installer,channel:J.channel,install_dir:W,owned_paths:[O,Y]})||!w(Y.path,Y.target))throw Error("alias must be the channel's symlink to its canonical launcher");_.push(Y)}let R=[...X?.channel===J.channel&&X.install_dir===W?X.owned_paths:[],O,..._,...S.map((Y)=>({path:Y,kind:"directory",role:"worker_root"}))],P=Array.from(new Map(R.map((Y)=>[Y.path,Y])).values()),Z=J.pathEntry??null,F=Z?X?.path_entry&&CJ(Z,X.path_entry)?{...Z,added_by_installer:q(Z)||q(X.path_entry),added_by_ara:q(Z)||q(X.path_entry)}:Z:X?.path_entry??null,I={schema_version:z,installation_id:X?.installation_id??d(),channel:J.channel,install_method:"curl",installer:J.installer,installed_at:U.toISOString(),version:J.version.trim(),target:J.target.trim(),install_dir:W,owned_paths:P,path_entry:F,background_mode:j,device_consent:B?X?.device_consent??null:{version:D,decision:j==="future_device"?"authorized":j==="updates_only"?"ask":"disabled",scope:j==="future_device"?E:null,recorded_at:U.toISOString()},...T&&X.desktop_account_access?{desktop_account_access:X.desktop_account_access}:{}};return s(I,Q)}function x(J,Q){let U=J.indexOf(Q);if(U===-1)return;let W=J[U+1];if(!W||W.startsWith("--"))throw Error(`${Q} needs a value`);return W}function V(J,Q){let U=x(J,Q);if(!U)throw Error(`${Q} is required`);return U}function cJ(J,Q={}){let U=Q.io??{stdout:process.stdout,stderr:process.stderr};try{let W=new Set(["--channel","--installer","--version","--target","--install-dir","--launcher-path","--launcher-kind","--worker-root","--path-kind","--path-location","--path-value","--background-mode"]);for(let Z=0;Z<J.length;Z+=1){let F=J[Z];if(F==="--path-added")continue;if(!W.has(F))throw Error(`unknown option: ${F}`);if(Z+=1,Z>=J.length)throw Error(`${F} needs a value`)}let X=Q.env??process.env,$=V(J,"--channel"),j=y({env:X,executablePath:Q.executablePath});if($!==j)throw Error(`installer channel ${$} does not match running ${j} CLI`);let T=V(J,"--installer");if(T!=="shell"&&T!=="powershell")throw Error("--installer must be shell or powershell");let B=V(J,"--launcher-kind");if(B!=="file"&&B!=="symlink")throw Error("--launcher-kind must be file or symlink");let O=x(J,"--path-kind"),S=null;if(O){if(O!=="shell_profile"&&O!=="windows_user_path")throw Error("--path-kind must be shell_profile or windows_user_path");S={kind:O,location:V(J,"--path-location"),value:V(J,"--path-value"),added_by_installer:J.includes("--path-added"),added_by_ara:J.includes("--path-added")}}else if(J.includes("--path-location")||J.includes("--path-value")||J.includes("--path-added"))throw Error("path entry flags require --path-kind");let _={channel:j,install_method:"curl",installer:T,version:V(J,"--version"),target:V(J,"--target"),install_dir:V(J,"--install-dir"),launcherPath:V(J,"--launcher-path"),launcherKind:B,workerRoots:J.flatMap((Z,F)=>{if(Z!=="--worker-root")return[];let I=J[F+1];if(!I||I.startsWith("--"))throw Error("--worker-root needs a value");return[I]}),pathEntry:S,backgroundMode:(()=>{let Z=x(J,"--background-mode")??"preserve";if(Z!=="preserve"&&!h(Z))throw Error("--background-mode must be future_device, updates_only, cli_only, or preserve");return Z})()},R=u(X,"REASON_INSTALL_ALIAS_PATH");if(R)_.aliasPath=R;let P=K(p(X,j),Q.home??v());return(Q.writeReceipt??MJ)(_,P,Q.now?.()??new Date),0}catch(W){return U.stderr.write(`Reason installer receipt: ${W instanceof Error?W.message:String(W)}
+`),1}}
+export{z as Qe,D as Re,i as Se,r as Te,E as Ue,IJ as Ve,LJ as We,K as Xe,JJ as Ye,gJ as Ze,hJ as _e,oJ as $e,w as af,sJ as bf,q as cf,RJ as df,k as ef,b as ff,qJ as gf,lJ as hf,MJ as if,cJ as jf};

package/bin/vm-hands/vm-hands-entry-lite-dhqmbqsh.js

@@ -0,0 +1,9 @@
+// @bun
+import{ll as t}from"./vm-hands-entry-lite-v4r1fggm.js";import{rl as WJ,tl as LJ}from"./vm-hands-entry-lite-kqbats5n.js";import{request as IJ}from"http";import{pipeline as wJ}from"stream";import{constants as QJ,createBrotliCompress as gJ,createGzip as mJ}from"zlib";import{WebSocket as v}from"ws";import{randomBytes as hJ,timingSafeEqual as yJ}from"crypto";import{createServer as bJ}from"net";var A={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000,window:8};function n(J){return J!==null&&typeof J==="object"&&!Array.isArray(J)}function y(J,X,Z=Number.MAX_SAFE_INTEGER){return typeof J==="number"&&Number.isSafeInteger(J)&&J>=X&&J<=Z}function xJ(J){return typeof J==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test(J)}function NJ(J,X){let Z=Buffer.from(J,"latin1");return Buffer.concat([Buffer.from([Z.length]),Z,X])}function b(J){if(!n(J)||Object.keys(J).length!==12||![J.organizationId,J.userId,J.runId,J.deviceId,J.rootId,J.jobId,J.fenceId].every(xJ)||!y(J.attachmentRevision,0)||!y(J.grantRevision,1)||!y(J.generation,1)||!y(J.port,1024,65535)||!y(J.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...J})}function o(J,X){return Object.keys(J).every((Z)=>J[Z]===X[Z])}function k(J){if(J.length>4096||!J.startsWith("/")||J.startsWith("//")||/[\\\x00-\x20\x7f#]/.test(J))throw Error("preview_path_invalid");let X=decodeURIComponent(J);if(X.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(X))throw Error("preview_path_invalid");return J}function qJ(J){return Array.isArray(J)&&J.length<=64&&J.every((X)=>Array.isArray(X)&&X.length===2&&typeof X[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(X[0])&&typeof X[1]==="string"&&X[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(X[1]))}function f(J,X=A.chunk){if(J.length>Math.ceil(X/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(J))throw Error("preview_data_invalid");let Z=Buffer.from(J,"base64");if(Z.length>X)throw Error("preview_data_too_large");return Z}function OJ(J){if(Array.isArray(J))return Buffer.concat(J);if(typeof J==="string")return Buffer.from(J,"utf8");if(J instanceof ArrayBuffer)return Buffer.from(J);return J}function jJ(J){if(Buffer.byteLength(J)>A.upload*1.4+300000)throw Error("preview_frame_too_large");let X=JSON.parse(J);if(!n(X))throw Error("preview_frame_invalid");if(X.type==="hello")return{type:"hello",binding:b(X.binding),...y(X.messages,A.chunk,A.upload)?{messages:X.messages}:{},...y(X.window,1,A.window)?{window:X.window}:{},...X.bytes===!0?{bytes:!0}:{}};if(X.type==="refused"&&typeof X.reason==="string"&&/^[a-z_]{1,32}$/.test(X.reason))return{type:"refused",binding:b(X.binding),reason:X.reason};if(!xJ(X.id))throw Error("preview_frame_invalid");if(X.type==="end"||X.type==="cancel"||X.type==="credit")return{type:X.type,id:X.id};if(X.type==="ws"&&typeof X.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(X.protocol))return{type:"ws",id:X.id,protocol:X.protocol};if(X.type==="data"&&typeof X.data==="string"&&typeof X.binary==="boolean")return f(X.data,A.upload),{type:"data",id:X.id,data:X.data,binary:X.binary};if(X.type==="head"&&y(X.status,200,599)&&qJ(X.headers))return{type:"head",id:X.id,status:X.status,headers:X.headers};if(X.type==="request"&&typeof X.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(X.method)&&typeof X.path==="string"&&qJ(X.headers)&&typeof X.body==="string"&&typeof X.upgrade==="boolean")return f(X.body,A.upload),{type:"request",id:X.id,method:X.method,path:k(X.path),headers:X.headers,body:X.body,upgrade:X.upgrade};throw Error("preview_frame_invalid")}function ZJ(J){let X=[...J],Z=new Set(X.filter(([$])=>$.toLowerCase()==="connection").flatMap(([,$])=>$.toLowerCase().split(",").map((Y)=>Y.trim()))),Q=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return X.filter(([$])=>!Q.has($.toLowerCase())&&!Z.has($.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test($))}async function $J(J){let X;try{return await Promise.race([Promise.resolve().then(J).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{X=setTimeout(()=>Z(void 0),A.authorizationMs)})])}finally{clearTimeout(X)}}async function CJ(J){return await $J(J)===!0}function a(J,X){let Z=new URL(J);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${X}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function UX(J){if(!n(J)||Object.keys(J).length!==2||typeof J.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:b(J.binding),deviceRelayUrl:a(J.deviceRelayUrl,"device")}}function qX(J){if(!n(J)||Object.keys(J).length!==1||!("binding"in J))throw Error("preview_close_invalid");return{binding:b(J.binding)}}var AJ="x-preview-connection";async function BJ(J,X){if(X.aborted)throw Error("preview_closed");let Z=hJ(32).toString("base64url"),Q=new Set,$=!1,Y=bJ((F)=>{if($||X.aborted||Q.size>=A.streams*2)return F.destroy();Q.add(F);let K=new AbortController;F.once("close",()=>{Q.delete(F),K.abort()}),F.on("error",()=>F.destroy()),F.setTimeout(2000,()=>F.destroy());let N=Buffer.alloc(0),q=(x)=>{N=Buffer.concat([N,x]);let U=N.indexOf(`\r
+\r
+`);if(U<0){if(N.length>16384)F.destroy();return}if(F.pause(),F.off("data",q),U>16384||N.length>A.upload+16384)return F.destroy();D(N,U).catch(()=>F.destroy())};F.on("data",q);async function D(x,U){let O=x.subarray(0,U).toString("latin1").split(`\r
+`),T=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(O.shift()??"");if(!T)throw Error("preview_request_invalid");k(T[2]);let V=!1,g=0,S=[];for(let h of O){let L=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(h);if(!L)throw Error("preview_header_invalid");if(L[1].toLowerCase()===AJ){g++;let I=Buffer.from(L[2].trim());V=I.length===Z.length&&yJ(I,Buffer.from(Z))}else if(L[1].toLowerCase()!=="host")S.push(h)}if(!V||g!==1||$||K.signal.aborted)throw Error("preview_connection_denied");let B=await J.connect(K.signal);if($||K.signal.aborted)throw B.destroy(),Error("preview_closed");Q.add(B),B.on("error",()=>F.destroy()),B.once("close",()=>{Q.delete(B),F.destroy()}),F.once("close",()=>B.destroy()),F.setTimeout(0);let C=[`${T[1]} ${T[2]} HTTP/1.1`,`Host: 127.0.0.1:${B.remotePort}`,...S,"",""].join(`\r
+`);B.write(Buffer.concat([Buffer.from(C,"latin1"),x.subarray(U+4)])),B.pipe(F),F.pipe(B),F.resume()}});await new Promise((F,K)=>{Y.once("error",K),Y.listen(0,"127.0.0.1",F)});let G=Y.address();if(!G||typeof G==="string")throw Y.close(),Error("preview_bind_failed");function H(){if($)return;$=!0,X.removeEventListener("abort",H);for(let F of Q)F.destroy();Q.clear(),Y.close()}if(X.addEventListener("abort",H,{once:!0}),X.aborted)H();return{port:G.port,headers:{[AJ]:Z},close:H}}var fJ=60000,kJ=1e4,vJ=5000,uJ=/^(?:text\/(?!event-stream)|application\/(?:(?:x-)?javascript|json|[a-z.+-]*\+json|xml|[a-z.+-]*\+xml|wasm)|image\/svg\+xml)/i;function pJ(J,X,Z,Q){let $=(F)=>X.find(([K])=>K.toLowerCase()===F)?.[1],Y=(F)=>Q.find(([K])=>K.toLowerCase()===F)?.[1],G=Number(Y("content-length")??Number.NaN);if(J!=="GET"||Z!==200||$("range")!==void 0||Y("content-encoding")!==void 0||!uJ.test(Y("content-type")??"")||/\bno-transform\b/i.test(Y("cache-control")??"")||G<1024)return null;let H=(F)=>new RegExp(`(?:^|,)\\s*${F}\\s*(?:,|$|;\\s*q=(?:1|0?\\.0*[1-9]))`,"i").test($("accept-encoding")??"");return H("br")?"br":H("gzip")?"gzip":null}function dJ(J,X){let Z=J.filter(([Q])=>Q.toLowerCase()==="vary").map(([,Q])=>Q).join(", ");return[...J.filter(([Q])=>!["vary","etag","content-md5"].includes(Q.toLowerCase())),...J.filter(([Q])=>Q.toLowerCase()==="etag").map(([Q,$])=>[Q,$.startsWith("W/")?$:`W/${$}`]),["Content-Encoding",X],["Vary",Z.split(",").some((Q)=>/^\s*(?:accept-encoding|\*)\s*$/i.test(Q))?Z:Z?`${Z}, Accept-Encoding`:"Accept-Encoding"]]}async function cJ(J){process.stderr.write(`${JSON.stringify({event:"worker_preview.open_refused",job_id:J.jobId,port:J.port,reason_code:J.reason})}
+`);let X=J.binding,Z;try{Z=a(J.deviceRelayUrl,"device")}catch{return}if(!X)return;await new Promise((Q)=>{let $=new v(Z,{followRedirects:!1,perMessageDeflate:!1,maxPayload:4096}),Y=setTimeout(()=>{$.terminate(),Q()},A.authorizationMs*2);$.addEventListener("open",()=>{$.send(JSON.stringify({type:"refused",binding:X,reason:J.reason})),$.close(1000,`worker_refused_${J.reason}`)}),$.addEventListener("error",()=>{clearTimeout(Y),Q()}),$.addEventListener("close",()=>{clearTimeout(Y),Q()})})}async function lJ(J,X){let Z=Date.now()+kJ,Q;for(;;){if(!X())return"closed";let $=Q??=J.refusal().finally(()=>{Q=void 0}),Y,G=await Promise.race([$.catch(()=>"port_unproved"),new Promise((H)=>{Y=setTimeout(()=>H("port_check_timeout"),A.authorizationMs)})]).finally(()=>clearTimeout(Y));if(G===null)return null;if(!["listener_unproved","port_check_timeout"].includes(G)||Date.now()+500>=Z)return G;await new Promise((H)=>setTimeout(H,500))}}async function MX(J){let X=b(J.binding),Z=()=>!J.signal.aborted&&Date.now()<X.expiresAtMs,Q=X.expiresAtMs>Date.now()+A.lifetimeMs+vJ?"binding_mismatch":await lJ(J.port,Z);if(Q)throw await cJ({deviceRelayUrl:J.deviceRelayUrl,binding:X,jobId:X.jobId,port:X.port,reason:Q}),Error("preview_not_authorized",{cause:Q});let $=a(J.deviceRelayUrl,"device"),Y=await BJ(J.port,J.signal),G;try{G=new v($,{followRedirects:!1,perMessageDeflate:!1,maxPayload:A.upload*1.4+300000})}catch(z){throw Y.close(),z}let H=new Map,F=!1,K=!1,N=0,q=!1,D,x,U,O=new Promise((z)=>{U=z}),T,V,g=new Promise((z,j)=>{T=z,V=j}),S=!1,B=(z)=>{let j=Buffer.isBuffer(z)?z:JSON.stringify(z);if(N+=Buffer.byteLength(j),!Z()||K||G.readyState!==v.OPEN)return C(Z()?"relay_closed":"expired");if(G.bufferedAmount>A.relayBuffered)return C("relay_backlog");if(N>A.total)return C("quota");G.send(j)};function C(z="closed"){if(K)return;K=!0,clearInterval(I),clearTimeout(L),J.signal.removeEventListener("abort",h);for(let j of H.values())j.stop();H.clear(),Y.close(),G.close(1000,`worker_${z}`),V(Error("preview_closed")),U()}let h=()=>C("aborted"),L=setTimeout(()=>C("pair_timeout"),A.requestMs),I=setInterval(async()=>{if(!Z())return C(J.signal.aborted?"aborted":"expired");if(q)return;q=!0;try{let z=D??=Promise.resolve().then(()=>J.port.check()).finally(()=>{D=void 0}),j=await $J(()=>z);if(j===!1)return C("port_refused");if(j){x=void 0;return}if(Date.now()-(x??=Date.now())>fJ)return C("port_unknown");for(let M of H.values())M.stop()}finally{q=!1}},1000);if(J.signal.addEventListener("abort",h,{once:!0}),!Z())C(J.signal.aborted?"aborted":"expired");G.addEventListener("open",()=>B({type:"hello",binding:X,messages:A.upload,window:A.window})),G.addEventListener("close",()=>C("relay_closed")),G.addEventListener("error",()=>C("relay_error")),G.addEventListener("message",(z)=>{try{if(!Z()||K)return C(J.signal.aborted?"aborted":"expired");if(typeof z.data!=="string")throw Error("preview_frame_invalid");if(N+=Buffer.byteLength(z.data),N>A.total)return C("quota");let j=jJ(z.data);if(!F){if(j.type!=="hello"||!o(X,j.binding))return C("binding_mismatch");F=!0,S=j.bytes===!0,clearTimeout(L),T();return}if(j.type==="hello"||j.type==="refused")return C("invalid_frame");if(j.type==="request"){d(j).catch(()=>C("invalid_request"));return}let M=H.get(j.id);if(!M)return;if(j.type==="cancel"||j.type==="end")M.stop();else if(j.type==="credit"&&M.credit)M.credit();else if(j.type==="data"&&M.ws){if(M.ws.readyState!==v.OPEN||M.ws.bufferedAmount>A.buffered)return M.stop();let R=f(j.data,A.upload);M.ws.send(j.binary?R:R.toString("utf8"))}else C("invalid_frame")}catch{C("invalid_frame")}});async function d(z){if(H.has(z.id)||H.size>=A.streams)return C("stream_limit");if(!Z())return C(J.signal.aborted?"aborted":"expired");let j=new AbortController,M,R,c,JJ=0,E=(P=!1)=>{if(!H.delete(z.id))return;clearTimeout(M),j.abort(),R?.close(1000,"preview_closed"),c?.(),B({type:P?"end":"cancel",id:z.id})},FJ={stop:()=>E(),credit:()=>{JJ++,c?.()}};if(H.set(z.id,FJ),M=setTimeout(E,A.requestMs),!await CJ(()=>J.port.check())||!Z()||j.signal.aborted)return E();let HJ=k(z.path);if(z.upgrade){if(z.method!=="GET"||z.body)return E();let P=z.headers.find(([_])=>_.toLowerCase()==="sec-websocket-protocol")?.[1].split(",").map((_)=>_.trim());if(P?.some((_)=>!/^[a-zA-Z0-9._-]{1,100}$/.test(_))||(P?.length??0)>8)return E();R=new v(`ws://127.0.0.1:${Y.port}${HJ}`,P,{headers:Y.headers,followRedirects:!1,perMessageDeflate:!1,maxPayload:A.upload}),FJ.ws=R,R.binaryType="arraybuffer",R.addEventListener("open",()=>{clearTimeout(M),B({type:"ws",id:z.id,protocol:R.protocol})}),R.addEventListener("message",(_)=>{let l=typeof _.data!=="string",w=OJ(_.data);if(w.length>A.upload)return E();B({type:"data",id:z.id,data:w.toString("base64"),binary:l})}),R.addEventListener("error",()=>E()),R.addEventListener("close",(_)=>E(_.wasClean));return}let PJ=f(z.body,A.upload),DJ=IJ({hostname:"127.0.0.1",port:Y.port,path:HJ,method:z.method,headers:{...Object.fromEntries(ZJ(z.headers)),...Y.headers,connection:"close"},signal:j.signal,agent:!1,maxHeaderSize:16384},async(P)=>{try{let _=[];for(let m=0;m<P.rawHeaders.length;m+=2)_.push([P.rawHeaders[m],P.rawHeaders[m+1]]);let l=P.statusCode??502,w=pJ(z.method,z.headers,l,_),XJ=w==="br"?gJ({flush:QJ.BROTLI_OPERATION_FLUSH,params:{[QJ.BROTLI_PARAM_QUALITY]:5}}):w==="gzip"?mJ({level:6,flush:QJ.Z_SYNC_FLUSH}):void 0;if(B({type:"head",id:z.id,status:l,headers:ZJ(w?dJ(_,w):_)}),clearTimeout(M),XJ)wJ(P,XJ,()=>{});for await(let m of XJ??P){let zJ=Buffer.from(m);for(let i=0;i<zJ.length;i+=A.chunk){if(JJ===0&&!j.signal.aborted)await new Promise((EJ)=>{c=EJ});if(c=void 0,j.signal.aborted)return;JJ--;let UJ=zJ.subarray(i,i+A.chunk);B(S?NJ(z.id,UJ):{type:"data",id:z.id,data:UJ.toString("base64"),binary:!0})}}E(!0)}catch{E()}});DJ.on("error",()=>E()),DJ.end(PJ)}return await g,{close:C,closed:O}}import{execFile as iJ}from"child_process";import{createRequire as nJ}from"module";import{win32 as r}from"path";var oJ=250,aJ=50,tJ=250,rJ=4194304;function TJ(J){let X=/^(?:\[([^\]]+)\]|([^:]+)):([0-9]{1,5})$/.exec(J??""),Z=Number(X?.[3]);return X&&Z<=65535?{address:X[1]??X[2],port:Z}:null}function sJ(J){let X=[];for(let Z of J.split(/\r?\n/)){let Q=Z.trim().split(/\s+/);if(Q[0]!=="TCP"||Q.length<5)continue;let $=TJ(Q[1]),Y=TJ(Q[2]),G=Number(Q.at(-1));if(!$||!Y||!Number.isSafeInteger(G)||G<0)continue;X.push({pid:G,localAddress:$.address,localPort:$.port,remoteAddress:Y.address,remotePort:Y.port,listening:Y.port===0})}return X}function eJ(J){if(J.localAddress==="0.0.0.0"||J.localAddress==="::")return`*:${J.localPort}`;return J.localAddress.includes(":")?`[${J.localAddress}]:${J.localPort}`:`${J.localAddress}:${J.localPort}`}var YJ=(J)=>new Promise((X,Z)=>iJ(r.join(WJ("win32").split(";")[0],"NETSTAT.EXE"),["-ano"],{timeout:J,maxBuffer:rJ,encoding:"utf8",windowsHide:!0,env:LJ()},(Q,$)=>Q?Z(Q):X($)));function p(J){let X=r.normalize(J.startsWith("\\\\?\\")?J.slice(4):J);return X.length>3&&X.endsWith("\\")?X.slice(0,-1):X}function JX(J,X){let Z=J.toLowerCase(),Q=X.toLowerCase();return Q===Z||Q.startsWith(Z.endsWith("\\")?Z:`${Z}\\`)}function MJ(J,X,Z){let Q=J.cwd(Z),$=Q?p(Q):null;return $&&r.isAbsolute($)&&JX(X,$)?$:null}var u;function s(){if(u!==void 0)return u;if(u=null,process.platform!=="win32"||!["x64","arm64"].includes(process.arch))return null;let J;try{J=nJ(import.meta.url)("bun:ffi")}catch{return null}let{FFIType:X,ptr:Z}=J,Q,$;try{Q=J.dlopen("kernel32.dll",{CreateToolhelp32Snapshot:{args:[X.u32,X.u32],returns:X.u64},Process32FirstW:{args:[X.u64,X.ptr],returns:X.i32},Process32NextW:{args:[X.u64,X.ptr],returns:X.i32},OpenProcess:{args:[X.u32,X.i32,X.u32],returns:X.u64},ReadProcessMemory:{args:[X.u64,X.u64,X.ptr,X.u64,X.ptr],returns:X.i32},CloseHandle:{args:[X.u64],returns:X.i32}}).symbols,$=J.dlopen("ntdll.dll",{NtQueryInformationProcess:{args:[X.u64,X.i32,X.ptr,X.u32,X.ptr],returns:X.i32}}).symbols}catch{return null}let Y=0xFFFF_FFFF_FFFF_FFFFn,G=2,H=1040,F=568,K=(N,q,D)=>{let x=Buffer.alloc(D);return Q.ReadProcessMemory(N,q,Z(x),D,null)?x:null};return u={processes(){let N=BigInt(Q.CreateToolhelp32Snapshot(G,0));if(N===Y)throw new t("process_inspection_failed","Reading this computer's processes did not complete.");try{let q=Buffer.alloc(F);q.writeUInt32LE(F,0);let D=Z(q),x=[];for(let U=Q.Process32FirstW(N,D);U;U=Q.Process32NextW(N,D)){let O=q.toString("utf16le",44,F),T=O.slice(0,O.includes("\x00")?O.indexOf("\x00"):void 0),V=q.readUInt32LE(8);if(V>0)x.push({pid:V,parentPid:q.readUInt32LE(32),command:T.replace(/\.exe$/i,"")||null})}return x}finally{Q.CloseHandle(N)}},cwd(N){let q=BigInt(Q.OpenProcess(H,0,N));if(q===0n)return null;try{let D=Buffer.alloc(48);if($.NtQueryInformationProcess(q,0,Z(D),D.length,null)!==0)return null;let x=K(q,D.readBigUInt64LE(8)+0x20n,8)?.readBigUInt64LE(0),U=x?K(q,x+0x38n,16):null,O=U?.readUInt16LE(0)??0;if(!U||O===0||O%2!==0)return null;return K(q,U.readBigUInt64LE(8),O)?.toString("utf16le")??null}finally{Q.CloseHandle(q)}}},u}function GJ(J){if(!J)throw new t("process_inspection_failed","Reading this computer's processes is unavailable.");return J}async function _J(J,X){let Z;try{Z=await J(X)}catch{throw new t("process_inspection_failed","Reading this computer's ports did not complete.")}return sJ(Z)}async function yX(J,X=s()){let Z=GJ(X),Q=p(J),$=[];for(let Y of Z.processes()){if($.length>=oJ)break;let G=MJ(Z,Q,Y.pid);if(G)$.push({pid:Y.pid,command:Y.command,cwd:r.relative(Q,G)||"."})}return{processes:$}}async function bX(J,X=s(),Z=YJ){let Q=GJ(X),$=p(J),Y=(await _J(Z,5000)).filter((K)=>K.listening&&K.pid>0).map((K)=>({pid:K.pid,port:K.localPort,address:eJ(K)})).sort((K,N)=>K.pid-N.pid||K.port-N.port||(K.address<N.address?-1:K.address>N.address?1:0)),G=[...new Set(Y.map((K)=>K.pid))].slice(0,aJ),H=new Set(G.filter((K)=>MJ(Q,$,K)!==null));if(H.size===0)return{ports:[]};let F=new Map(Q.processes().map((K)=>[K.pid,K.command]));return{ports:Y.filter((K)=>H.has(K.pid)).slice(0,tJ).map((K)=>({pid:K.pid,command:F.get(K.pid)??null,address:K.address}))}}function VJ(J,X){let Z=new Set([X]);for(let Q=!0;Q;){Q=!1;for(let $ of J)if(!Z.has($.pid)&&Z.has($.parentPid)&&$.pid!==$.parentPid)Z.add($.pid),Q=!0}return Z}function XX(J,X,Z,Q){let $=(Y)=>Y==="127.0.0.1"||Y==="::ffff:127.0.0.1"||Y==="::1";return J.flatMap((Y)=>{if(!X.has(Y.pid)||Y.localPort!==Q)return[];let G=Y.listening&&($(Y.localAddress)||["0.0.0.0","::"].includes(Y.localAddress)),H=!Y.listening&&$(Y.localAddress)&&$(Y.remoteAddress);if(!G&&!H)return[];let F=`${Y.localAddress}:${Y.localPort}>${Y.remoteAddress}:${Y.remotePort}`;return[{pid:Y.pid,processGroupId:Z,descriptor:String(Y.pid),kernelId:F,state:G?"listen":"established",port:Q,peerPort:G?null:Y.remotePort,host:Y.localAddress==="::1"?"::1":"127.0.0.1"}]})}async function SJ(J,X,Z=s(),Q=YJ){let $=GJ(Z),Y=VJ($.processes(),J),G=await _J(Q,1000),H=VJ($.processes(),J);return XX(G,new Set([...Y].filter((F)=>H.has(F))),J,X)}async function IX(J,X=s(),Z=YJ){if(!X||J.aborted)return!1;let Q=X.processes().some((H)=>H.pid===process.pid),$=X.cwd(process.pid),Y=$!==null&&p($).toLowerCase()===p(process.cwd()).toLowerCase(),G=await Z(5000).then((H)=>/^\s*TCP\s/m.test(H),()=>!1);return Q&&Y&&G&&!J.aborted}import{execFile as ZX}from"child_process";import{readFile as $X,readdir as QX,readlink as YX}from"fs/promises";import{connect as GX}from"net";import{setTimeout as KX}from"timers/promises";var FX={directory:QX,text:(J)=>$X(J,"utf8"),link:YX};class KJ extends Error{code;constructor(J="port_unproved"){super("preview_port_ownership_unproved");this.code=J}}var W=(J)=>new KJ(J),e="preview_listener_unproved",RJ="00000000000000000000000001000000";async function HX(J,X,Z=FX){let Q=new Map;for(let G of["tcp","tcp6"]){let H=await Z.text(`/proc/net/${G}`);if(H.length>4194304)throw W();for(let F of H.split(`
+`).slice(1)){let K=F.trim().split(/\s+/);if(K.length<10||!["0A","01"].includes(K[3]))continue;let[N,q]=K[1].split(":"),[D,x]=K[2].split(":");if(Number.parseInt(q,16)!==X)continue;let U=(V)=>V==="0100007F"||V==="0000000000000000FFFF00000100007F"||V===RJ,O=K[3]==="0A";if(!(U(N)||O&&/^0+$/.test(N??"")))continue;if(!O&&!U(D))continue;let T=K[9];if(!/^[1-9][0-9]*$/.test(T))continue;Q.set(T,{kernelId:T,port:X,peerPort:O?null:Number.parseInt(x,16),state:O?"listen":"established",host:N===RJ?"::1":"127.0.0.1"})}}let $=await Z.directory("/proc");if($.length>8192)throw W();let Y=[];for(let G of $){if(!/^[1-9][0-9]*$/.test(G))continue;try{let H=await Z.text(`/proc/${G}/stat`),F=H.slice(H.lastIndexOf(")")+2).trim().split(/\s+/);if(Number(F[2])!==J)continue;let K=await Z.directory(`/proc/${G}/fd`);if(K.length>1024)throw W();let N=[];for(let x of K){if(!/^[0-9]+$/.test(x))continue;let U=await Z.link(`/proc/${G}/fd/${x}`).catch(()=>""),O=/^socket:\[([0-9]+)\]$/.exec(U)?.[1],T=O?Q.get(O):void 0;if(T)N.push({...T,pid:Number(G),processGroupId:J,descriptor:x})}let q=await Z.text(`/proc/${G}/stat`),D=q.slice(q.lastIndexOf(")")+2).trim().split(/\s+/);if(F[19]===D[19]&&F[2]===D[2])Y.push(...N)}catch(H){if(H instanceof Error&&H.message==="preview_port_ownership_unproved")throw H}}return Y}function DX(J,X,Z){if(J.length>2097152)throw W();let Q=0,$=0,Y="",G="",H="",F="",K=[],N=()=>{if(Q<1||$!==X||!/^\d+$/.test(Y)||!/^0x[0-9a-f]+$/i.test(G))return;let q=F==="LISTEN"&&["*","127.0.0.1","[::ffff:127.0.0.1]","[::1]"].some((x)=>H===`${x}:${Z}`),D=new RegExp(`^(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):${Z}->(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):([0-9]+)$`).exec(H);if(q||F==="ESTABLISHED"&&D)K.push({pid:Q,processGroupId:$,descriptor:Y,kernelId:G,state:q?"listen":"established",port:Z,peerPort:q?null:Number(D[1]),host:H.startsWith("[::1]:")?"::1":"127.0.0.1"})};for(let q of J.split(/[\0\n]/)){let D=q.slice(1);if(q[0]==="p")N(),Q=Number(D),$=0,Y=G=H=F="";else if(q[0]==="g")$=Number(D);else if(q[0]==="f")N(),Y=D,G=H=F="";else if(q[0]==="d")G=D;else if(q[0]==="n")H=D;else if(q.startsWith("TST="))F=q.slice(4)}return N(),K}async function zX(J,X){if(process.platform==="linux")return HX(J,X);if(process.platform==="win32")return SJ(J,X);if(process.platform!=="darwin")throw W();let Z=await new Promise((Q,$)=>ZX("/usr/sbin/lsof",["-nP","-a","-g",String(J),`-iTCP:${X}`,"-F0pgfdnT"],{timeout:1000,maxBuffer:2097152,encoding:"utf8",env:{PATH:"/usr/bin:/bin",LC_ALL:"C"}},(Y,G)=>Y?$(W()):Q(G)));return DX(Z,J,X)}function pX(J,X={}){let Z=b(J.binding),Q=X.inspectSockets??zX,$=X.monotonicNow??(()=>performance.now());async function Y(){let D=()=>{if(Date.now()>=Z.expiresAtMs)throw W("binding_expired");if(J.deniedPorts.has(Z.port))throw W("port_denied")};D();let x=await J.readCurrentJob(),U=x?.job,O=U?.process;if(D(),!x)throw W("server_stopped");if(!o(Z,x.binding)||U?.jobId!==Z.jobId)throw W("binding_changed");if(U.state!=="running"||U.finishedAtMs!==null||U.leaseExpiresAtMs<Z.expiresAtMs)throw W("job_not_running");if(!O||O.pid<1||O.pid!==O.processGroupId||O.executorLaunchId!==x.executorLaunchId)throw W("process_unproved");return{pid:O.pid,launch:O.executorLaunchId,started:U.startedAtMs}}let G,H;async function F(){let D=await Y(),x=await Q(D.pid,Z.port).catch(()=>{throw Error(e)}),U=await Y();if(D.pid!==U.pid||D.launch!==U.launch||D.started!==U.started)throw W("job_restarted");return x}async function K(D){for(;;){if(H&&H.startedAt>=D)return H.sockets;if(G&&G.startedAt>=D)return await G.sockets;if(G){await G.sockets.catch(()=>{});continue}let x={startedAt:$(),sockets:F()};G=x;try{let U=await x.sockets;if(!H||H.startedAt<=x.startedAt)H={startedAt:x.startedAt,sockets:U};return U}finally{if(G===x)G=void 0}}}async function N(D=()=>{},x=$()){D();let U=await K(x);if(D(),Date.now()>=Z.expiresAtMs)throw W("binding_expired");if(!U.some((O)=>O.state==="listen"))throw Error(e);return U}async function q(){try{return await N(()=>{},$()-1000),null}catch(D){if(D instanceof Error&&D.message===e)return"listener_unproved";return D instanceof KJ?D.code:"port_unproved"}}return{refusal:q,async check(){let D=await q();if(D==="listener_unproved")throw Error(e);return D===null},async connect(D){if(D.aborted)throw W();let x=$()+2000,U=new AbortController,O=new Promise((C)=>U.signal.addEventListener("abort",()=>C(null),{once:!0})),T,V=()=>{U.abort(),T?.destroy()},g=setTimeout(V,2000);D.addEventListener("abort",V,{once:!0});let S=()=>{if(U.signal.aborted||D.aborted||$()>=x||T?.destroyed)throw V(),W()};async function B(C){S();let h=await Promise.race([C().then((L)=>({value:L})),O]);if(S(),!h)throw W();return h.value}try{let C=await B(()=>N(S,$()-1000));S();let h=C.some((z)=>z.state==="listen"&&z.host==="127.0.0.1")?"127.0.0.1":"::1",L=GX({host:h,port:Z.port,signal:D});T=L,L.once("close",V),await B(()=>new Promise((z,j)=>{L.once("connect",z),L.once("error",j)}));let I=L.localPort;if(!I)throw W();let d=$();while(!(await B(()=>N(S,d))).some((z)=>z.state==="established"&&z.peerPort===I))await B(()=>KX(Math.min(20,Math.max(1,x-$())),void 0,{signal:U.signal})),d=$();return S(),L}catch(C){throw V(),C}finally{clearTimeout(g),D.removeEventListener("abort",V),T?.off("close",V),U.abort()}}}}
+export{A as ud,o as vd,jJ as wd,CJ as xd,UX as yd,qX as zd,cJ as Ad,MX as Bd,s as Cd,yX as Dd,bX as Ed,IX as Fd,pX as Gd};

package/bin/vm-hands/vm-hands-entry-lite-e1xjfj57.js

@@ -0,0 +1,3 @@
+// @bun
+import{bl as $,cl as j}from"./vm-hands-entry-lite-8p8hz0j1.js";import{basename as W}from"path";var X=["production","staging"],x="https://api.reasonmachines.com",B="https://staging-api.reasonmachines.com",q="https://reasonmachines.com",y="https://staging.reasonmachines.com",Q={production:{api:"https://api.reasonmachines.ai",app:"https://reasonmachines.ai"},staging:{api:"https://staging-api.reasonmachines.ai",app:"https://staging.reasonmachines.ai"}},z=new Set(["ara-staging","ara-staging.exe","reason-staging","reason-staging.exe"]);function f(w={}){let J=$(w.env??process.env,"REASON_CLI_CHANNEL")?.trim().toLowerCase();if(J){if(X.includes(J))return J;throw Error(`Unknown Reason CLI channel: ${J}`)}let K=W(w.executablePath??process.execPath).toLowerCase();return z.has(K)?"staging":"production"}function F(w,J){return{...w,...j("REASON_CLI_CHANNEL",J)}}function V(w){return w==="staging"?B:x}function H(w,J){if(J===Q[w].api)return Q[w].app;return w==="staging"?y:q}function D(w){return`${V(w)}/mcp/ara`}function T(w){return`${H(w)}/api/app/client-telemetry/cli`}var k={production:["https://api.ara.so",Q.production.api],staging:["https://api-staging.ara.so",Q.staging.api]};function Z(w){let J;try{J=new URL(w).origin}catch{return w}let K=X.find((M)=>k[M].includes(J));return K?V(K):J}function b(w,J){return w===J||Z(w)===Z(J)}function v(w,J){return X.some((K)=>k[K].includes(w)&&J===V(K))}function L(w,J){try{let K=new URL(J);return!K.username&&!K.password&&(K.origin===V(w)||K.origin===Q[w].api)}catch{return!1}}function S(w){try{let J=new URL(w).hostname.replace(/^\[|\]$/g,"").toLowerCase();return J==="localhost"||J==="127.0.0.1"||J==="::1"}catch{return!1}}
+export{X as Sk,f as Tk,F as Uk,V as Vk,D as Wk,T as Xk,Z as Yk,b as Zk,v as _k,L as $k,S as al};