@reason-machines/cli-linux-x64 0.2.505 → 0.2.506

package/bin/vm-hands/vm-hands-entry-lite-xwqrndky.js

@@ -0,0 +1,105 @@
+// @bun
+import{T}from"./vm-hands-entry-lite-fcvf8md1.js";import{_}from"./vm-hands-entry-lite-nqdstx24.js";import{Kr,ei,Jr,ti}from"./vm-hands-entry-lite-hmaazqdr.js";import{Xn,Yt,Io}from"./vm-hands-entry-lite-nkp4ccvt.js";import{C}from"./vm-hands-entry-lite-87vmbt38.js";import{spawnSync as y}from"child_process";import{createHash as ke,randomUUID as Se}from"crypto";import{chmodSync as we,existsSync as P,mkdirSync as $e,readdirSync as Ve,readFileSync as p,renameSync as ye,rmSync as u,statSync as ve,writeFileSync as be}from"fs";import{dirname as We,isAbsolute as q,join as g}from"path";import{spawnSync as de}from"child_process";import{readFileSync as me}from"fs";import{userInfo as D}from"os";import{join as fe}from"path";var ge="REASON_SCHEDULED_TASK";function H(r){return fe(r,"AppData","Local","Reason","Tasks")}function S(r){if(/[\0-\x1f\x7f"%]/.test(r))throw Error(`A background task cannot use a value with a double quote, percent sign or control character: ${r}`);return`'${r.replace(/['\u2018\u2019\u201a\u201b]/g,"$&$&")}'`}function M(r){if(!/^[A-Za-z0-9._-]+$/.test(r))throw Error(`Invalid Windows Scheduled Task name: ${r}`);return`$env:${ge}=${S(r)};`}function K(r){let e=Object.entries(r.environment).map(([t,i])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(t))throw Error(`Invalid Windows Scheduled Task environment name: ${t}`);return`$env:${t}=${S(i)};`}),n=`$global:LASTEXITCODE=1; & ${[r.program,...r.args].map(S).join(" ")} 2>&1 | ForEach-Object { Add-Content -LiteralPath ${S(r.log)} -Value $_.ToString() -Encoding UTF8 }; $c=$LASTEXITCODE;`;return[M(r.name),...e,"$ErrorActionPreference='Continue';",r.keepAlive?`do { ${n} if ($c) { Start-Sleep -Seconds 10 } } while ($c)`:`${n} exit $c`].join(" ")}function A(r){return r.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function pe(){let r=process.env.USERDOMAIN?.trim();return r?`${r}\\${D().username}`:D().username}function U(r){let e=A(r.user??pe()),n=r.schedule==="logon",t=r.schedule==="logon"?`<LogonTrigger><Enabled>true</Enabled><UserId>${e}</UserId></LogonTrigger>`:`<TimeTrigger><Repetition><Interval>PT${r.schedule.everyMinutes}M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition><StartBoundary>2026-01-01T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger>`,i=`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "${r.script}"`;return`<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>${A(r.description)}</Description>
+  </RegistrationInfo>
+  <Triggers>
+    ${t}
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${e}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>${n?"StopExisting":"IgnoreNew"}</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <IdleSettings>
+      <StopOnIdleEnd>false</StopOnIdleEnd>
+      <RestartOnIdle>false</RestartOnIdle>
+    </IdleSettings>
+    <ExecutionTimeLimit>${n?"PT0S":"PT1H"}</ExecutionTimeLimit>
+    <Priority>${n?5:7}</Priority>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>%SystemRoot%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe</Command>
+      <Arguments>${A(i)}</Arguments>
+    </Exec>
+  </Actions>
+</Task>
+`}function B(r){return Buffer.concat([Buffer.from([255,254]),Buffer.from(r.replaceAll(`\r
+`,`
+`).replaceAll(`
+`,`\r
+`),"utf16le")])}function V(r){let e=me(r);return(e[0]===255&&e[1]===254?e.subarray(2).toString("utf16le"):e.toString("utf8")).replaceAll(`\r
+`,`
+`)}function j(r,e){return["/Create","/TN",r,"/XML",e,"/F"]}function I(r){return["-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-EncodedCommand",Buffer.from(r,"utf16le").toString("base64")]}function x(r){return`'*${M(r).replaceAll("'","''")}*'`}function E(r,e){return I(["$all = @(Get-CimInstance Win32_Process)",`$wrappers = @($all | ? { $_.ProcessId -ne $PID -and $_.CommandLine -like ${x(r)} })`,...e.keepWrapper?[]:["foreach ($w in $wrappers) { Stop-Process -Id $w.ProcessId -Force -ErrorAction SilentlyContinue }"],`foreach ($w in $wrappers) { $all | ? { $_.ParentProcessId -eq $w.ProcessId } | % { taskkill.exe /F ${e.tree?"/T ":""}/PID $_.ProcessId | Out-Null } }`].join(`
+`))}function F(r){return I(["$all = @(Get-CimInstance Win32_Process)",`$wrappers = @($all | ? { $_.ProcessId -ne $PID -and $_.CommandLine -like ${x(r)} })`,"foreach ($w in $wrappers) { if ($all | ? { $_.ParentProcessId -eq $w.ProcessId -and $_.Name -ne 'conhost.exe' }) { 'running'; exit 0 } }","exit 1"].join(`
+`))}function X(r,e=process.pid){let n=de(C("powershell.exe"),I(["$all = @{}; Get-CimInstance Win32_Process | % { $all[[int]$_.ProcessId] = $_ }",`$p = $all[${Math.trunc(e)}]`,"for ($i = 0; $p -and $i -lt 64; $i++) {",`  if ($p.CommandLine -like ${x(r)}) { exit 10 }`,"  $n = $all[[int]$p.ParentProcessId]","  if (-not $n -or $n.ProcessId -eq $p.ProcessId -or $n.CreationDate -gt $p.CreationDate) { exit 11 }","  $p = $n","}","exit 11"].join(`
+`)),{stdio:"ignore",timeout:15000,windowsHide:!0});return n.status===10?!0:n.status===11?!1:null}var qr="REASON_WORKER_SERVICE",Ae="worker_identity_unavailable";function xe(r){return{platform:process.platform,home:r,uid:process.getuid?.(),command:(e,n)=>y(C(e),[...n],{stdio:"ignore"}).status??1,read:(e,n)=>{let t=y(C(e),[...n],{stdio:["ignore","pipe","ignore"],encoding:"utf8",timeout:1e4});return t.status===0?t.stdout:null},sleep:(e)=>Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,e),workerIdentity:(e)=>Io(r,e),insideService:(e,n)=>Ie(e,process.platform,process.getuid?.(),n)}}function Ie(r,e,n,t=!0){if(process.env[qr]===r||process.env.XPC_SERVICE_NAME===r)return!0;if(e==="linux")try{return p("/proc/self/cgroup","utf8").includes(`/${r}.service`)}catch{return!0}if(e==="win32")return X(r)??t;if(e!=="darwin")return!1;if(typeof n!=="number")return!0;let i=y("/bin/launchctl",["print",`gui/${n}/${r}`],{encoding:"utf8",timeout:5000});if(i.status===Ee)return!1;if(i.error||i.status!==0)return!0;let s=Number(/^\s*pid = (\d+)$/m.exec(i.stdout??"")?.[1]??0);if(!s)return!1;let a=process.pid;for(let o=0;o<64&&a>1;o+=1){if(a===s)return!0;let l=y("/bin/ps",["-o","ppid=","-p",String(a)],{encoding:"utf8",timeout:5000}),c=Number(l.stdout?.trim());if(l.error||l.status!==0||!Number.isSafeInteger(c)||c<=0)return!0;if(c===a)return!1;a=c}return a>1}var Ee=113;class J extends Error{code;constructor(r,e){super(r);this.code=e}}function Jn(r,e){if(!re(r.home,r.platform))throw new J(ee);if(r.platform==="darwin")k(r);let n=ti(Kr(e,r.home)),t=_({env:e})==="staging",i=t?"ara-staging":"ara",s=[n?ei(n):null,T(e,"REASON_CLI_LAUNCHER_PATH")?.trim(),r.platform==="win32"?g(r.home,"AppData","Local","Reason",...t?["staging"]:[],"bin",t?"reason-staging.exe":"reason.exe"):g(r.home,".local","bin",i)];for(let a of s)try{if(a&&q(a)&&ve(a).isFile())return Jr(a)}catch{}throw new J(`A background service runs the installed Reason launcher, which was not found. Install Reason with: ${r.platform==="win32"?"irm https://reasonmachines.com/install.ps1 | iex":"curl -fsSL https://reasonmachines.com/install | sh"}`,"worker_launcher_missing")}var R=/(<key>ProgramArguments<\/key>\s*<array>\n)((?:\s*<string>[^<]*<\/string>\n)*)(\s*<\/array>)/,w=new RegExp(`(\\n\\s*<key>${Yt}</key>\\s*<string>)[^<]*(</string>)`),_e=/(<key>EnvironmentVariables<\/key>\s*<dict>[\s\S]*?)(\n\s*<\/dict>)/;function Te(r){return r.replaceAll("&lt;","<").replaceAll("&gt;",">").replaceAll("&quot;",'"').replaceAll("&apos;","'").replaceAll("&amp;","&")}function Y(r){let e=[...(R.exec(r)?.[2]??"").matchAll(/<string>([^<]*)<\/string>/g)].map((t)=>Te(t[1])),n=e[1]==="--run-worker"?e.slice(2):e;return n[0]?{launcher:n[0],args:n.slice(1)}:null}function z(r,e,n){let t=n.workerIdentity?.(r)??null;return{program:t?[t.executable,"--run-worker",r,...e]:[r,...e],identity:t}}function h(r){return r.map((e)=>`    <string>${d(e)}</string>`).join(`
+`)}function Z(r,e){let n;try{n=p(r,"utf8")}catch{return null}let t=Y(n);if(!t)return null;let i=q(t.launcher)?Jr(t.launcher):t.launcher,{program:s,identity:a}=z(i,t.args,e),o=n.replace(R,(l,c,m,O)=>`${c}${h(s)}
+${O}`);if(!a)o=o.replace(w,"");else if(w.test(o))o=o.replace(w,(l,c,m)=>`${c}${d(a.app)}${m}`);else o=o.replace(_e,(l,c,m)=>`${c}
+    <key>${Yt}</key>
+    <string>${d(a.app)}</string>${m}`);return o===n?null:o}function Pe(r,e){let n=Z(r,e);if(n!==null)W(r,n)}function Hs(r,e,n){if(e.platform!=="darwin")return!1;let t=Ye(r,e,n);return t!==null&&Z(t.definition,e)!==null}var b="com.reasonmachines.worker.",N="so.reason.worker.",Q=[b,N];function Ao(r,e=b){return`${e}connect${r==="production"?"":`.${r}`}`}function zs(r,e){return Q.some((n)=>r===Ao(e,n))}function Re(r,e,n){if(e==="connect")return Ao(r.channel,n);let t=ke("sha256").update(r.workspaceRoot).digest("hex").slice(0,8);return`${n}${r.name.toLowerCase()}.${t}`}var ee="A background service needs macOS (launchd), Linux (systemd --user) or Windows (Task Scheduler).";function re(r,e){if(e==="darwin")return{directory:g(r,"Library","LaunchAgents"),suffix:".plist"};if(e==="linux")return{directory:g(r,".config","systemd","user"),suffix:".service"};if(e==="win32")return{directory:H(r),suffix:".xml"};return null}function f(r,e,n,t=b){let i=Re(r,n,t),s=re(e.home,e.platform);if(!s)return null;return{label:i,definition:g(s.directory,`${i}${s.suffix}`),logs:e.platform==="linux"?`journalctl --user -u ${i}.service`:g(r.stateDirectory,"service.log")}}function Ye(r,e,n="serve"){return ne(r,e,n)[0]??null}function ne(r,e,n){return Q.map((t)=>f(r,e,n,t)).filter((t)=>t!==null&&P(t.definition))}function te(r,e,n){let t=f(r,e,n,N);return t&&P(t.definition)?t:null}function is(r,e,n){let t=f(r,e,n),i=te(r,e,n);if(!t||!i||!P(t.definition)||e.insideService?.(i.label))return null;if(!Ce(t,e))return"current_not_running";if(e.platform==="darwin"){if(typeof e.uid==="number"&&e.uid>0)e.command("/bin/launchctl",["bootout",`gui/${e.uid}/${i.label}`]);return u(i.definition,{force:!0}),"retired"}if(e.platform==="win32")return v(i,e,!0),"retired";return e.command("systemctl",["--user","disable","--now",`${i.label}.service`]),u(i.definition,{force:!0}),e.command("systemctl",["--user","daemon-reload"]),"retired"}function Ce(r,e){if(e.platform==="darwin")return typeof e.uid==="number"&&e.uid>0&&e.command("/bin/launchctl",["print",`gui/${e.uid}/${r.label}`])===0;if(e.platform==="win32")return e.command("schtasks",["/Query","/TN",r.label])===0;let n=`${r.label}.service`;return e.command("systemctl",["--user","is-enabled","--quiet",n])===0&&he.has(e.read("systemctl",["--user","show","--property=ActiveState","--value",n])?.trim()??"")}var he=new Set(["active","activating","reloading"]);function Zn(r,e){if(e.platform==="darwin"){if(typeof e.uid!=="number"||e.uid<=0)return!1;let n=e.read("/bin/launchctl",["print",`gui/${e.uid}/${r.label}`]);return Number(/^\s*pid = (\d+)$/m.exec(n??"")?.[1]??0)>0}if(e.platform==="win32")return e.read("powershell.exe",F(r.label))?.trim()==="running";return Number(e.read("systemctl",["--user","show","--property=MainPID","--value",`${r.label}.service`])?.trim()??0)>0}function qs(r){let{config:e,launcher:n,host:t,kind:i}=r,s=f(e,t,i);if(!s)return!1;let a;try{a=t.platform==="win32"?V(s.definition):p(s.definition,"utf8")}catch{return!1}if(t.platform==="win32")return a===se(e,i,s,n);if(t.platform!=="darwin")return a===oe(e,i,s,n,t.home,r.path);let o=Y(a);return a.replace(w,"").replace(R,(c,m,O,ue)=>`${m}${o?`${h([o.launcher,...o.args])}
+`:""}${ue}`)===ie(e,i,s,n,{...t,workerIdentity:()=>null},r.path).plist}function L(r,e){if(e==="connect")return{args:["connect"],environment:{REASON_CLI_CHANNEL:r.channel},description:"Reason connection of this computer"};return{args:["serve",r.name,"--dir",r.workspaceRoot,...r.executionMode==="confined"?["--sandbox"]:[]],environment:{},description:`Reason machine ${r.name} worker`}}function d(r){return r.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function G(r,e=!1){if(/[\0-\x1f\x7f]/.test(r))throw new J("A background service cannot use a path with control characters.");let n=r.replaceAll("\\","\\\\").replaceAll('"',"\\\"").replaceAll("%","%%");return`"${e?n.replaceAll("$","$$$$"):n}"`}function ie(r,e,n,t,i,s){let a=L(r,e),o=z(t,a.args,i),l={HOME:i.home,PATH:s,[qr]:n.label,...a.environment,...o.identity?{[Yt]:o.identity.app}:{}};return{identity:o.identity,plist:`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${d(n.label)}</string>
+  <key>AssociatedBundleIdentifiers</key>
+  <array>
+    <string>${Xn}</string>
+  </array>
+  <key>ProgramArguments</key>
+  <array>
+${h(o.program)}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+${Object.entries(l).map(([c,m])=>`    <key>${c}</key>
+    <string>${d(m)}</string>`).join(`
+`)}
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>ThrottleInterval</key>
+  <integer>10</integer>
+  <key>ExitTimeOut</key>
+  <integer>${Math.ceil(r.shutdownGraceMs/1000)+10}</integer>
+  <key>ProcessType</key>
+  <string>Standard</string>
+  <key>Umask</key>
+  <integer>63</integer>
+  <key>StandardOutPath</key>
+  <string>${d(n.logs)}</string>
+  <key>StandardErrorPath</key>
+  <string>${d(n.logs)}</string>
+</dict>
+</plist>
+`}}function oe(r,e,n,t,i,s){let a=L(r,e);return`[Unit]
+Description=${a.description}
+
+[Service]
+ExecStart=${[t,...a.args].map((o)=>G(o,!0)).join(" ")}
+Environment=${[`HOME=${i}`,`PATH=${s}`,`${qr}=${n.label}`,...Object.entries(a.environment).map(([o,l])=>`${o}=${l}`)].map((o)=>G(o)).join(" ")}
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=${Math.ceil(r.shutdownGraceMs/1000)+10}
+UMask=0077
+
+[Install]
+WantedBy=default.target
+`}function se(r,e,n,t){let i=L(r,e);return U({description:i.description,schedule:"logon",script:K({name:n.label,program:t,args:i.args,environment:{[qr]:n.label,...i.environment},log:n.logs,keepAlive:!0})})}function ae(r,e,n){e.command("powershell.exe",E(r.label,{tree:n,keepWrapper:!n}))}function v(r,e,n){e.command("schtasks",["/Delete","/F","/TN",r.label]),e.command("powershell.exe",E(r.label,{tree:n,keepWrapper:!1})),u(r.definition,{force:!0})}function W(r,e){$e(We(r),{recursive:!0,mode:448});let n=`${r}.${Se()}.tmp`;try{be(n,e,{mode:384,flag:"wx"}),we(n,384),ye(n,r)}finally{u(n,{force:!0})}}function k(r){if(typeof r.uid!=="number"||!Number.isSafeInteger(r.uid)||r.uid<=0)throw new J("Set up a background service as your own user, not with sudo.","worker_service_root_user");return`gui/${r.uid}`}function Ws(r){let{config:e,launcher:n,host:t}=r,i=r.kind??"serve",s=te(e,t,i),a=s!==null&&t.insideService?.(s.label)===!0,o=f(e,t,i,a?N:b);if(!o)throw new J(ee);if(t.platform==="darwin")k(t);if(t.platform==="linux"&&t.command("systemctl",["--user","show-environment"])!==0)throw new J("No background service here: this computer has no systemd user session.","worker_service_manager_missing");let l=t.platform==="darwin"?ie(e,i,o,n,t,r.path):null;if(W(o.definition,l?l.plist:t.platform==="win32"?B(se(e,i,o,n)):oe(e,i,o,n,t.home,r.path)),le(e,t,o,a?null:s),l)return l.identity?o:{...o,identityProblem:Ae};if(t.platform==="win32")return o;return{...o,lingering:t.command("loginctl",["enable-linger"])===0}}function le(r,e,n,t){if(e.platform==="darwin"){let a=k(e);if(t)e.command("/bin/launchctl",["bootout",`${a}/${t.label}`]);if(ce(r,n,e)){if(t)u(t.definition,{force:!0});return}if(u(n.definition,{force:!0}),t)e.command("/bin/launchctl",["bootstrap",a,t.definition]);throw new J("Could not start the background service (launchctl bootstrap failed).","worker_service_start_failed")}if(e.platform==="win32"){if(t)v(t,e,!0);if(e.command("schtasks",j(n.label,n.definition))===0){if(ae(n,e,e.insideService?.(n.label)!==!0),e.command("schtasks",["/Run","/TN",n.label])===0)return}throw v(n,e,!0),new J("Could not start the background service (schtasks failed).")}let i=`${n.label}.service`,s=t?`${t.label}.service`:null;if(e.command("systemctl",["--user","daemon-reload"])!==0||s!==null&&e.command("systemctl",["--user","disable","--now",s])!==0||e.command("systemctl",["--user","enable",i])!==0||e.command("systemctl",["--user","restart",i])!==0){if(e.command("systemctl",["--user","disable",i]),u(n.definition,{force:!0}),e.command("systemctl",["--user","daemon-reload"]),s)e.command("systemctl",["--user","enable","--now",s]);throw new J("Could not start the background service (systemctl --user failed).","worker_service_start_failed")}if(t)u(t.definition,{force:!0}),e.command("systemctl",["--user","daemon-reload"])}function ce(r,e,n){let t=k(n);n.command("/bin/launchctl",["bootout",`${t}/${e.label}`]);let i=(Math.ceil(r.shutdownGraceMs/1000)+10)*1000;for(let s=0,a=100;;a=Math.min(a*2,2000)){if(n.command("/bin/launchctl",["bootstrap",t,e.definition])===0)return!0;if(s>=i)return!1;n.sleep(a),s+=a}}function Wr(r,e,n){let t=Ye(r,e,n);if(!t)return null;let i=e.insideService?.(t.label)===!0;if(e.platform==="darwin"&&!i)Pe(t.definition,e);let s=f(r,e,n);if(s&&t.label!==s.label&&!i)return W(s.definition,p(t.definition,"utf8").replaceAll(t.label,s.label)),le(r,e,s,t),s;let a=e.platform==="darwin"&&i,o;if(e.platform==="win32")ae(t,e,!i),o=e.command("schtasks",["/Run","/TN",t.label])===0;else if(a)o=e.command("/bin/launchctl",["kickstart","-k",`${k(e)}/${t.label}`])===0;else if(e.platform==="darwin")o=ce(r,t,e);else e.command("systemctl",["--user","enable",`${t.label}.service`]),o=e.command("systemctl",["--user","restart",`${t.label}.service`])===0;if(!o)throw new J(`Could not restart the background service ${t.label}.`,"worker_service_restart_failed");if(s&&t.label===s.label)is(r,e,n);return t}function Vs(r,e,n,t){let i=Ye(r,n,t),s=f(e,n,t);if(n.platform!=="darwin"||!i||!s)return;let a=`<string>${d(i.logs)}</string>`,o=p(i.definition,"utf8");if(o.includes(a))W(i.definition,o.replaceAll(a,`<string>${d(s.logs)}</string>`))}function Gs(r,e,n="serve"){let t=ne(r,e,n);for(let i of t){if(e.platform==="win32"){v(i,e,e.insideService?.(i.label,!1)!==!0);continue}if(e.platform==="darwin"){if(typeof e.uid==="number"&&e.uid>0)e.command("/bin/launchctl",["bootout",`gui/${e.uid}/${i.label}`]);u(i.definition,{force:!0});continue}e.command("systemctl",["--user","disable","--now",`${i.label}.service`]),u(i.definition,{force:!0}),e.command("systemctl",["--user","daemon-reload"])}return t[0]??null}
+export{qr,xe,J,Jn,Hs,Ao,zs,Ye,is,Zn,qs,Ws,Wr,Vs,Gs};

package/bin/vm-hands/vm-hands-entry-lite-yretc2th.js

@@ -0,0 +1,3 @@
+// @bun
+function be(n){return typeof n==="object"&&n!==null&&!Array.isArray(n)}
+export{be};

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,2 +1,4 @@
 // @bun
-import"./vm-hands-entry-lite-07q2xvk1.js";import"./vm-hands-entry-lite-p9fwt68c.js";import"./vm-hands-entry-lite-e4hwb89r.js";import{Gl as B}from"./vm-hands-entry-lite-pkk555dx.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var z=(q,b={})=>console.log(JSON.stringify({stage:q,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:j}=await import("./vm-hands-op-runner-s1ghsym7.js");await j();return}z("parsed",{t0:Math.round(G)});let q="";try{q=J(3,"utf8")}catch{}z("fd3_read",{bytes:q.length});let b=null;if(q.trim())try{b=JSON.parse(q)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))z(q.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:C,runVmHands:D}=await import("./vm-hands-runtime-k6egwk2t.js"),A=C(b);if(!A)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await D(A,z)}catch(j){let E=j&&typeof j==="object"&&"code"in j&&typeof j.code==="string"?j.code:"error";throw z("failed",{code:E}),j}process.exit(0)}K();
+import{ii,bt,si,ai,ci,Oi}from"./vm-hands-entry-lite-5tbntcyq.js";import{createHash as H,randomBytes as he}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Xe,openSync as Oe,renameSync as Qe,rmSync as Ze,statSync as De,writeSync as Me,constants as W}from"fs";import{join as se}from"path";var en=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:r}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!r||typeof r!=="object"||Array.isArray(r)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||r.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:nn(e)}}function nn(e){let n=e.payload[si];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var G=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),K=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function V(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(V).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${V(e[n])}`).join(",")}}`}async function Fi(e){let n=await crypto.subtle.importKey("pkcs8",K(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=K(e.device_key.spki),r=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),h=new Uint8Array(await crypto.subtle.exportKey("spki",r.publicKey)),m=H("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:r,signingSpki:i,agreementSpki:h,fingerprint:m}}var tn=16;class ln{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,r){this.init=e;this.keys=n;this.hooks=i;this.options=r;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let r=Date.now()+n;;){let h=this.bound.get(e);if(!h)return!1;if(h.envInstalled)return!0;if(Date.now()>=r||i?.aborted)return!1;await new Promise((m)=>setTimeout(m,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:en,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:G(this.keys.signingSpki),env_public_key:G(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:G(he(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(V(n)));return{...n,device_signature:G(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),r=G(he(32)),h=Oi({method:"GET",pathAndQuery:ii,timestamp:i,nonce:r,challenge:e,bodySha256:H("sha256").update("").digest("hex")}),m=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(h)));return{t:"hello",timestamp:i,nonce:r,signature:G(rn(m)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let r of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(r))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(H("sha256").update(V({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((r)=>r.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=tn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((r)=>r.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let r,h,m=new Promise((_,k)=>{r=_,h=k});return m.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:m,resolve:r,reject:h}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(v){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(v,"the bind's kill-verify failed")}let i,r=new Promise((v)=>{i=v}),h=!1,m=!1,_=()=>{m=!0,i()},k=n.promise.then(()=>new Promise((v,I)=>{this.exclusive(async()=>{if(m){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}h=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();v()}catch(w){I(w)}await r})}));k.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:k,inTurn:()=>h,leave:_})}finally{_()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,r=!1;try{if(!n)await this.prepareBind(e);r=!0;let{launchId:h,applied:m,readyData:_}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),k=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let v=null,I=null;if(e.env){let w=e.claim?.owner??{},E=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof w.device_id==="string"?w.device_id:"",rootId:e.claim?.root_id??""});v=this.hooks.installEnvironment(e.bind_id,E),I=typeof E.snapshot_id==="string"&&E.snapshot_id?E.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,E)}if(this.unbinding.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:h,envInstalled:v!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:h,snapshot_revision:v,snapshot_id:I,layout:k,..._?{ready_data:_}:{},policy_digest:H("sha256").update(V({hands_confinement:m.hands_confinement??null,browser_egress:m.browser_egress??null})).digest("hex")}}catch(h){if(i)fe(i);if(r){let m=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(m);else await m()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(h,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let r=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),h=this.hooks.installEnvironment(n.bindId,r);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${h}`,r),{snapshot_id:e.snapshotId,installed_revision:h,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:H("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let r=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:r})}catch(h){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw h}if(this.unverified.delete(e),!r.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:r.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},r=await crypto.subtle.importKey("spki",K(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),h=await crypto.subtle.deriveKey({name:"ECDH",public:r},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),m=await crypto.subtle.decrypt({name:"AES-GCM",iv:K(e.iv),additionalData:new TextEncoder().encode(n)},h,K(e.ct)).catch(i),_=JSON.parse(new TextDecoder().decode(m));if(!_||typeof _!=="object"||Array.isArray(_))throw new l("vm_hands_env_invalid","env not an object");return _}writeJobEnvRootOnly(e,n){let i=se(this.options.envRoot,`bind-${e}`);Xe(i,{mode:448});let r=De(i);if(!r.isDirectory()||(r.mode&63)!==0||r.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let h=n.variables&&typeof n.variables==="object"?n.variables:{},m=Object.entries(h).filter(([v,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(v)&&typeof I==="string").map(([v,I])=>`export ${v}='${String(I).replaceAll("'","'\\''")}'`).join(`
+`)+`
+`,_=se(i,`.job.env.${he(8).toString("hex")}`),k=Oe(_,W.O_WRONLY|W.O_CREAT|W.O_EXCL|W.O_NOFOLLOW,384);try{Me(k,m),xe(k)}finally{Ae(k)}return Qe(_,se(i,"job.env")),i}}function fe(e){try{let n=se(e,"job.env"),i=De(n).size,r=Oe(n,W.O_WRONLY|W.O_NOFOLLOW);try{Me(r,Buffer.alloc(i)),xe(r)}finally{Ae(r)}}catch{}Ze(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(h)=>{let m=0;while(m<h.length-1&&h[m]===0)m++;let _=h.subarray(m),k=_[0]&128?Uint8Array.of(0,..._):_;return Uint8Array.of(2,k.length,...k)},i=n(e.subarray(0,32)),r=n(e.subarray(32));return Uint8Array.of(48,i.length+r.length,...i,...r)}import{randomUUID as sn}from"crypto";var on="/app/local-runtime/session?register=vm_hands_v1",an="/app/local-runtime",Ce=25000,we=20000,dn=1e4,Ue=5000,cn=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),un="preview.serve.v1",_n=60000,ye=75000,mn=2000,gn=1e4,hn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),fn=3,pn=20000,vn=250,wn=2000;function $e(e){let n=Math.min(vn*2**(e-1),wn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function bn(e){return e>=500||e===408||e===429}var ae=20000;function Be(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class D extends Error{}var kn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function je(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Sn(e,n,i,r,h){let m=i.turn.claim.attempt_id,_=e.healing??=new Set;if(_.has(m))return;_.add(m);let k=i.turn.claim.operation_id;(async()=>{for(let[v,I]of qe.entries()){if(r.aborted)return;if(await new Promise((w)=>{let E=setTimeout(w,I);E.unref?.(),r.addEventListener("abort",()=>{clearTimeout(E),w()},{once:!0})}),r.aborted)return;try{let w=await n.retryUnbind(m);h("vm_hands.unbind_healed",{operation_id:k,attempt:v+1}),e.receipts.push({...i,unbound:w}),e.flushReceipts?.();return}catch(w){let E=je(w);if(h("vm_hands.unbind_unverified",{operation_id:k,code:E,attempt:v+1}),E==="vm_hands_unbind_unknown")return}}h("vm_hands.unbind_heal_exhausted",{operation_id:k,attempts:qe.length})})().finally(()=>_.delete(m))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let r of i)r.abort.abort();await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))])}async function In(e,n){let i=[...e.personTerminals].filter((r)=>r.session===null||r.session===n);for(let r of i)r.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((r)=>r.settled)),new Promise((r)=>setTimeout(r,Ue))]);return i.length}function Pn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function L(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,En=1e4,Tn=1000;async function ji(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},r=e.log??(()=>{}),h=async(k)=>{for(let[v,I]of[...i.turns]){i.turns.delete(v),e.onTurn?.(v,null),de(I);let w=await L(i,e.agent,v).catch(()=>null);if(w)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:w});r("vm_hands.bound_dropped",{reason:k})}},m=0,_=0;try{for(let k=0;!e.signal.aborted;k++){let v=await Rn(e,i).catch((w)=>{if(w instanceof l&&i.deviceId===null&&w.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(w instanceof l&&i.deviceId===null&&hn.has(w.code)&&m<fn&&Date.now()-n<pn)return m++,_=$e(m),r("vm_hands.register_retry",{attempt:m,code:w.code,delay_ms:_}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(w instanceof l&&i.deviceId===null)throw w;return{closeCode:0,closeReason:w instanceof Error?w.message:String(w)}});if(r("vm_hands.session_closed",{close_code:v.closeCode,reason:v.closeReason.slice(0,120),registered:i.deviceId!==null}),v.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline");if(i.served)i.served=!1,k=0;let I=v.closeReason==="drain_reconnect"?0:v.closeReason==="vm_hands_register_retry"?_:v.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(k,5),2000):i.turns.size?Math.min(250*2**Math.min(k,5),5000,Math.max(0,i.lostAt+ye-Date.now())):Math.min(500*2**k,30000);if(await new Promise((w)=>setTimeout(w,I)),i.turns.size&&Date.now()-i.lostAt>=ye)await h("reconnect_deadline")}}finally{await h("session_ended")}}async function Rn(e,n){let i=n.deviceId,r=e.log??(()=>{}),h=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:on,m=`${e.apiOrigin.replace(/^http/,"ws")}${h}`,_=new WebSocket(m),k=0,v="",I=new Map,w=[],E=null,ce=new Promise((t)=>{_.onclose=(o)=>{k=o.code,v=o.reason;for(let s of I.values())s.reject(new D(`session closed ${o.code}`));for(let s of n.attestWaiters.splice(0))s(!1);I.clear(),t()}});_.onmessage=(t)=>{let o;try{o=JSON.parse(String(t.data))}catch{_.close(4400);return}if(o.t==="res"){let s=o;I.get(s.id)?.resolve({status:s.status,body:s.body}),I.delete(s.id);return}if(o.t==="reconnect"){let s=Math.max(0,Math.min(Number(o.after_ms)||0,Tn));r("vm_hands.drain_reconnect",{after_ms:s}),setTimeout(()=>{try{_.close(4001,"drain_reconnect")}catch{}},s).unref?.();return}if(!E?.(o))w.push(o)};let J=(t,o)=>new Promise((s,a)=>{let u=w.findIndex((p)=>t.includes(p.t));if(u>=0){s(w.splice(u,1)[0]);return}let f=setTimeout(()=>{E=null,a(new l("vm_hands_no_register",`no ${t.join("/")} in ${o} ms`))},o);E=(p)=>{if(!t.includes(p.t))return!1;return clearTimeout(f),E=null,s(p),!0}}),Y=(t)=>_.send(JSON.stringify(t)),q=(t,o)=>new Promise((s,a)=>{if(_.readyState!==WebSocket.OPEN){a(new D("session closed"));return}let u=sn(),f=typeof o.wait_ms==="number"?o.wait_ms:0,p=setTimeout(()=>{if(!I.delete(u))return;a(new D(`no answer to ${t.split("/").pop()} in ${f+Ne} ms`)),_.close(4000,"request_timeout")},f+Ne);I.set(u,{reject:(c)=>{clearTimeout(p),a(c)},resolve:({status:c,body:d})=>{clearTimeout(p);let g=null;try{g=d?JSON.parse(d):null}catch{}s({status:c,json:g})}}),Y({t:"req",id:u,path:`${an}${t}`,body:JSON.stringify(o)})}),be=()=>_.close(1001,"stopping");e.signal.addEventListener("abort",be,{once:!0});let le,X=new Map,Q=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{ne().catch(()=>{return})},Z=!1;try{await new Promise((c,d)=>{let g=setTimeout(()=>d(Error("session open timeout")),En);_.onopen=()=>{clearTimeout(g),r("vm_hands.ws_open",{}),c()},_.onerror=()=>{clearTimeout(g),d(Error("session socket error"))}});let t=await J(["challenge"],5000);r("vm_hands.challenge",{});let o=[],s=null,a;if(i){Y(await e.agent.helloFrame(t.challenge,n.connection));let c=await J(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(a={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(s=c.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[g,S]of[...n.turns]){if(d.some((T)=>T&&T.operation_id===S.claim.operation_id&&T.attempt_id===S.claim.attempt_id)){o.push(S),r("vm_hands.bound_resumed",{operation_id:S.claim.operation_id});continue}n.turns.delete(g),e.onTurn?.(g,null),de(S);let P=await L(n,e.agent,g).catch((T)=>ee(T,S,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:S,failure:"vm_hands_bind_lost",unbound:P});r("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{Y(await e.agent.registerFrame(t.challenge)),r("vm_hands.register_sent",{});let c=await Promise.race([J(["registered","register_refused"],1e4),ce.then(()=>{throw new l(v==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(a=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(s=d.vm_hands_probe_script,Z=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,r("vm_hands.registered",{device_id:a.device_id})}let u=async()=>{let c=await q("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let f=a.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>_.close())},f),e.onHeartbeatNow?.(()=>{u().catch(()=>_.close())}),n.request=q,ce.then(()=>{if(n.request===q)n.request=null}),s&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)ze(s,t.challenge);let p=(c,d)=>{Q.set(c,d().catch(async(g)=>{if(await Se(g,c),g instanceof D)_.close();else await ne().catch(()=>{return})}).finally(()=>{Q.delete(c)}))};n.flushReceipts=ke;try{await ne();for(let c of o)c.flush=()=>Ie(c),c.flush(),p(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&_.readyState===WebSocket.OPEN){let c=await q("/operations/claim",{wait_ms:Math.min(a.cadence?.claim_wait_ms??Ce,Ce)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Q.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}p(d.attempt_id,()=>Fe(d))}else Ke(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",be);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;_.close(),await ce,await Promise.all([...Q.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let o=X.get(t),s=o?{...o,eventSeq:o.eventSeq+1}:null,a=await L(n,e.agent,t).catch((u)=>s?ee(u,s,"vm_hands_bind_lost"):null);if(a&&s)n.receipts.push({turn:s,failure:"vm_hands_bind_lost",unbound:a});r("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:k,closeReason:v};async function Se(t,o){if(t instanceof D){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let s=o!==null?[o]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(o===null)ue=!0;for(let a of s){let u=n.turns.get(a);if(n.turns.delete(a),u)de(u),e.onTurn?.(a,null);if(e.agent.liveBindIds.includes(a)){let f=X.get(a)??u,p=f?{...f,eventSeq:f.eventSeq+1}:null,c=await L(n,e.agent,a).catch((d)=>p?ee(d,p,"vm_hands_bind_lost"):null);if(c&&p)n.receipts.push({turn:p,failure:"vm_hands_bind_lost",unbound:c})}}}r("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,o=q){let s=o,a=t.claim,u={attempt_id:a.attempt_id,attempt_token:a.attempt_token},f=encodeURIComponent(a.operation_id);return{fence:u,op:f,complete:(c,d={})=>s(`/operations/${f}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let g=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>p(c,d));return t.chain=g,g}};async function p(c,d){let g=t.eventSeq,S=(R)=>s(`/operations/${f}/events`,{...u,event_seq_start:R,events:[{kind:c,payload:{sequence:R,capability:String(a.capability??"hands.connect"),data:d}}]}),P=g,T=await S(P),M=T.status===409?T.json?.expected_event_seq:void 0;if(typeof M==="number"&&M>=0&&M!==g)P=M,T=await S(P);if(T.status<300)t.eventSeq=P+1;return T}}function We(t){return(o,s)=>new Promise((a,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=kn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:o,data:s,resolve:a,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&_.readyState===WebSocket.OPEN){let o=t.outbox[0],s;try{s=await O(t).emit(o.kind,o.data)}catch(a){if(a instanceof D)return;s={status:500}}if(t.outbox.shift(),s.status<300)o.resolve();else o.reject(Error(`${o.kind} refused ${s.status}`))}}finally{_e.delete(t)}})()}async function ze(t,o){try{let s=await e.agent.attestFrame(t,o);if(_.readyState!==WebSocket.OPEN)return;Y(s);let a=await J(["attested","attest_refused"],15000);n.attest=a.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(r("vm_hands.attest",{result:n.attest,exit_code:s.exit_code,...a.t==="attest_refused"?{code:String(a.code??"")}:{}}),n.attest==="refused")_.close(4401,"attest_refused")}catch(s){r("vm_hands.attest_failed",{code:s instanceof l?s.code:"probe_error"});for(let a of n.attestWaiters.splice(0))a(!1);if(n.attest!=="accepted")_.close(4000,"attest_unanswered")}}async function Fe(t){let o=Z&&n.attest==="pending",s=t.vm_hands_attest,a=s;if(n.attest==="refused"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(a==="accepted"){if(!o&&n.attest!=="accepted"){n.attest="accepted";for(let b of n.attestWaiters.splice(0))b(!0)}}else if(a!=="pending"||!o&&n.attest!=="accepted"){r("vm_hands.claim_attest_refused",{said:typeof s==="string"?s.slice(0,16):typeof s,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let b=Date.parse(t.lease_until)-Date.now()-5000,B=Math.max(0,Math.min(ae,Number.isFinite(b)?b:ae));if(!await new Promise((ie)=>{let y=setTimeout(()=>ie(!1),B);n.attestWaiters.push((x)=>{clearTimeout(y),ie(x)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:f,emit:p}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_invalid"});return}let d,g=null,S=!1,P=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(P,(n.bindsStarting.get(P)??0)+1);try{let b=await In(n,P);if(b)r("vm_hands.person_terminals_closed",{count:b});let B=ve(t),j=e.agent.bind(B);if(B.workspace_deferred)S=!0,g=He(u,()=>S);d=await j}catch(b){r("vm_hands.bind_refused",{code:b instanceof l?b.code:"unexpected"}),await f("failed",{error_code:b instanceof l?b.code:"vm_hands_bind_failed"});return}finally{S=!1;let b=(n.bindsStarting.get(P)??1)-1;if(b>0)n.bindsStarting.set(P,b);else n.bindsStarting.delete(P)}let T=g?await g:-1,M={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete M.environment_installed;let R=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};X.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:-1});let F={...M,...R,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},te=Date.now()+yn,U=1,N=await p("hands.ready",F);while(bn(N.status)&&!e.signal.aborted){let b=$e(U);if(Date.now()+b>=te)break;await new Promise((B)=>setTimeout(B,b)),U++,N=await p("hands.ready",F)}if(U>1)r("vm_hands.ready_retried",{attempts:U,status_class:`${Math.floor(N.status/100)}xx`});if(X.delete(t.attempt_id),N.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await f("failed",{error_code:Be(N.json?.error,"vm_hands_probe_failed")});return}let C={claim:t,launchId:d.launch_id,readyData:M,eventSeq:u.eventSeq,ackSeq:T};n.turns.set(t.attempt_id,C),C.flush=()=>Ie(C),e.onTurn?.(t.attempt_id,We(C)),await Pe(C)}async function He(t,o){let{fence:s,op:a}=O(t),u=t.claim.attempt_id,f=-1;try{for(;;){let p=await q(`/operations/${a}/heartbeat`,{...s,control_ack_seq:f,wait_ms:we});if(!o())return f;if(p.status>=300)return e.agent.abandonWorkspaceGrant(u),f;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=f)continue;if(f=d.seq,d.kind===ai)return r("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(u),f;return r("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(d.kind)?d.kind:"other"}),e.agent.abandonWorkspaceGrant(u),f}}}catch{return e.agent.abandonWorkspaceGrant(u),f}}async function Pe(t){let{fence:o,op:s}=O(t),a=null,u=null,f=e.agent.executorExited(t.claim.attempt_id).then((p)=>(u=p,null));e:for(;;){let p=await Promise.race([f,q(`/operations/${s}/heartbeat`,{...o,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!p){a="vm_hands_executor_exited",r("vm_hands.executor_exited",{reason:u});break}if(p.status>=300)break;let c=(p.json?.controls??[]).slice().sort((d,g)=>d.seq-g.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===bt)try{await Le(t,d.payload??{})}catch(g){if(g instanceof D)throw g;a=g instanceof l?g.code:"environment_unavailable";let S=g&&typeof g==="object"&&"code"in g&&typeof g.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(g.code)?g.code:null;r("vm_hands.environment_refused",{code:a,cause:S});break e}t.ackSeq=d.seq}}await Ve(t,a)}async function ge(t,o){let s=Date.now()+_n;for(;;){let a=n.request;if(a)try{return await a(t,o)}catch(u){if(!(u instanceof D))throw u}if(Date.now()>=s||e.signal.aborted)throw new D("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ke(t){let o=t,s={claim:o,eventSeq:0},a=String(t.capability??""),u=a===un,{complete:f,emit:p,fence:c,op:d}={...O(s,ge)},g=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await f("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(Z&&n.attest==="pending")){n.attest="accepted";for(let y of n.attestWaiters.splice(0))y(!0)}if(n.attest!=="accepted"){let y=Date.parse(String(t.lease_until??""))-Date.now()-5000,x=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(y)?y:ae));if(!(x>0&&await new Promise((re)=>{let Je=setTimeout(()=>re(!1),x);n.attestWaiters.push((Ye)=>{clearTimeout(Je),re(Ye)})}))){await f("failed",{error_code:"vm_hands_unattested"});return}}let S=e.agent.bindIdForRun(o.run_id);if(g==="model"&&S===null){await f("failed",{error_code:"vm_hands_not_bound"});return}let P=a==="pty.start"&&g==="person"&&!t.authority,T=P?Pn(t):null;if(P&&((y)=>y===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(y)||n.bindsStarting.has(y))(T)){await f("failed",{error_code:"vm_hands_bound"});return}if(cn.has(a)&&!P&&e.agent.liveBindIds.length===0){await f("failed",{error_code:"vm_hands_not_bound"});return}let R=new AbortController,F=()=>R.abort();e.signal.addEventListener("abort",F,{once:!0});let te,U=new Promise((y)=>{te=y}),N={abort:R,settled:U},C=P?{...N,session:T}:null;if(C)n.personTerminals.add(C);if(g==="model"&&S&&a!=="preview.serve.v1"){let y=n.modelOps.get(S)??new Set;y.add(N),n.modelOps.set(S,y),await e.agent.environmentInstalled(S,mn,R.signal)}let b=-1,B=!1,j=!1,ie=u?void 0:setInterval(()=>{if(j)return;j=!0,ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:0}).then((y)=>{if(y.status>=300){R.abort();return}let x=y.json?.controls??[];for(let A of x)if(b=Math.max(b,A.seq),A.kind==="operation.cancel"||A.kind==="cancel")R.abort()},()=>R.abort()).finally(()=>{j=!1})},dn);if(u)(async()=>{while(!B&&!R.signal.aborted){let y;try{y=await ge(`/operations/${d}/heartbeat`,{...c,control_ack_seq:b,wait_ms:we})}catch{R.abort();return}if(B)return;if(y.status>=300){R.abort();return}let x=(y.json?.controls??[]).slice().sort((A,re)=>A.seq-re.seq);for(let A of x){if(A.seq<=b)continue;if(A.kind==="operation.cancel"||A.kind==="cancel")R.abort();else await e.controlOp?.({claim:t,control:A}).catch(()=>!1);b=A.seq}}})();try{let y=await e.executeOp({kind:g,claim:t,...g==="model"&&S?{bindId:S}:{},signal:R.signal,emit:async(A)=>{await p(A.kind,A.data??{})}}),x=await f(y.status,{...y.result?{result:y.result}:{},...y.error_code?{error_code:Be(y.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:y.status,acknowledged:x.status<300}),r("vm_hands.op",{capability:a,kind:g,status:y.status,code:y.error_code??null,...x.status>=300?{complete_status:x.status,complete_error:String(x.json?.error??"").slice(0,64)}:{}})}finally{if(B=!0,clearInterval(ie),e.signal.removeEventListener("abort",F),S)n.modelOps.get(S)?.delete(N);if(C)n.personTerminals.delete(C);te()}}async function Ve(t,o){let s=t.claim.attempt_id;if(n.turns.get(s)===t)n.turns.delete(s);e.onTurn?.(s,null),de(t);let a=await L(n,e.agent,s).catch((u)=>ee(u,t,o));if(!a)return;n.receipts.push({turn:t,failure:o,unbound:a}),await ne()}function ee(t,o,s){let a=je(t);return r("vm_hands.unbind_unverified",{operation_id:o.claim.operation_id,code:a,attempt:0}),O(o).emit(ci,{code:a}).catch(()=>{return}),Sn(n,e.agent,{turn:o,failure:s},e.signal,r),null}function ne(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:o,unbound:s}=n.receipts[0],{complete:a,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:o?"failed":"cancelled",killed_verified:s.killed_verified,shredded:s.shredded,...s.srt_fallbacks?{vm_hands_srt_fallbacks:s.srt_fallbacks}:{}}),o)await a("failed",{error_code:o});else await a("cancelled",{error_code:"driver_stopped"})}catch(f){if(f instanceof D)return}n.receipts.shift()}}async function Le(t,o){let{fence:s,op:a}=O(t),u=o.snapshot_id;if(o.version!==1||typeof u!=="string"||Object.keys(o).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let f=await q(`/operations/${a}/environment`,{...s,snapshot_id:u}),p=f.json?.environment_sealed;if(f.status!==200||!p||f.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:p});if((await q(`/operations/${a}/environment-ack`,{...s,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as xn}from"fs";var An=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function On(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:m}=await import("./vm-hands-op-runner-r4m9whbb.js");await m();return}z("parsed",{t0:Math.round(An)});let e="";try{e=xn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:r}=await import("./vm-hands-runtime-x79a9j7q.js"),h=i(n);if(!h)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await r(h,z)}catch(m){let _=m&&typeof m==="object"&&"code"in m&&typeof m.code==="string"?m.code:"error";throw z("failed",{code:_}),m}process.exit(0)}On();export{Fi,ln,ji};

package/bin/vm-hands/vm-hands-executor-bcw4gm80.js

@@ -0,0 +1,12 @@
+// @bun
+import"./vm-hands-entry-lite-5tbntcyq.js";import"./vm-hands-entry-lite-38g65s5x.js";import"./vm-hands-entry-lite-5gevvgec.js";import"./vm-hands-entry-lite-rfz60hb3.js";import{ot,no,vr,Ot}from"./vm-hands-entry-lite-r3vd5k1q.js";import"./vm-hands-entry-lite-ncbzy69k.js";import"./vm-hands-entry-lite-77j164ps.js";import"./vm-hands-entry-lite-v9qq2cgv.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-tebh7dcm.js";import"./vm-hands-entry-lite-nqdstx24.js";import"./vm-hands-entry-lite-rzr2ncf5.js";import"./vm-hands-entry-lite-wrvz9jxy.js";import{ar,cr,kt,Ct}from"./vm-hands-entry-lite-622t4qbv.js";import"./vm-hands-entry-lite-psywfz8m.js";import"./vm-hands-entry-lite-f69t48dj.js";import"./vm-hands-entry-lite-swrymqj9.js";import"./vm-hands-entry-lite-87vmbt38.js";import{spawn as Ae}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as G,lstatSync as q,mkdirSync as V,mkdtempSync as Te,readdirSync as Z,readFileSync as k,realpathSync as We,rmdirSync as de,rmSync as He,writeFileSync as B}from"fs";import{basename as ze,dirname as Ue,join as d}from"path";import{readFileSync as ie,readlinkSync as ae}from"fs";import{relative as Ie}from"path";var ce=16;function ue(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Ne(e){let r=[];for(let t of e.split(`
+`)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:ue(n[3]),mountPoint:ue(n[4])})}return r}function De(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(Ne(m).filter((_)=>c(_.mountPoint)).map((_)=>[`${_.mountPoint}\x00${_.device}\x00${_.root}`,_.mountPoint])),u=o(r),p=o(t),b=(m)=>Ie(n,m)||".",P=[...u].filter(([m])=>!p.has(m)).map(([,m])=>b(m)),x=[...p].filter(([m])=>!u.has(m)).map(([,m])=>b(m));return{missing:P,extra:x,referenceCount:u.size,ownCount:p.size}}function le(e,r,t,n="/proc"){let c,o,u=null;try{c=ie(`${n}/1/mountinfo`,"utf8"),o=ie(`${n}/self/mountinfo`,"utf8")}catch(_){let O=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{u=ae(`${n}/1/ns/mnt`)===ae(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:b,referenceCount:P,ownCount:x}=De(e,c,o),m={reference_count:P,own_count:x,missing_count:p.length,extra_count:b.length,same_namespace:u};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ce)});if(p.length)throw r("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ce)}),t(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var we="/sys/fs/cgroup/reason-payload",M="vm-hands",Be="/run/ara-srt/fallbacks.jsonl",se="/reason-person",Fe="/reason-workload",Ke="surface",ee=5000,je=1e4,pe="__VM_HANDS_PROOF_DIR__",Ge="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,r){super(r);this.code=e}}function Ee(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new w("vm_hands_bind_invalid","bad bind id");return d(e,M,`b-${r.toLowerCase()}`)}var Ve=5000,ve=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Je(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=d(Ue(e),r.toLowerCase());return ze(e).toLowerCase()===r.toLowerCase()?e:t}function gn(e){let r=e.cgroup??we,t=e.init.layout.payload_uid,n=e.init.workload_ended!==!0,c=(s)=>z(s,se)||n&&z(s,Fe),o=e.log??(()=>{}),u=(s)=>Je(e.init.layout.session_root,s),p=new Map,b=new Map,P=0,x=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(P>s.length?0:P).split(`
+`).filter(Boolean);P=s.length;let l=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(l.length)o("vm_hands.srt_server_starts",{count:l.length,elapsed_ms:l.slice(0,8)})}catch{}},m=null,_=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",I=()=>{m??=fe()},R=0,F=()=>{try{let s=k(Be,"utf8"),i=s.slice(R>s.length?0:R);R=s.length;let l=i.split(`
+`).filter(Boolean).slice(0,1000);if(!l.length)return null;let f={},g=0;for(let S of l)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:l.length,codes:f,max_elapsed_ms:g}),{count:l.length,codes:f,max_elapsed_ms:g}}catch{return null}},U=(s,i,l)=>Re(s,i,l),K=(s)=>(i,l,f)=>Ae("/bin/sh",["-c",`echo $$ > ${ve(d(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...l],f),Re=K(d(r,M)),j=d(r,M,"probe"),T=(s)=>Ee(r,s),Ce=(s)=>{let i=T(s);try{V(i,{mode:493})}catch(l){if(!(l&&typeof l==="object"&&("code"in l)&&l.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},Oe=(s)=>{try{de(T(s))}catch{}},W=e.prespawn?no({spawnProcess:U,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;W?.arm();let X=W?setInterval(()=>{W.arm()},Ve):null;X?.unref?.();async function Y(s){let i=p.get(s);if(p.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:T,async startExecutor(s){if(I(),b.set(s.bindId,fe()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await Y(s.bindId);let{claim:i,bindId:l}=s,f=Ce(l),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,N=new Promise((a,v)=>{h=a,y=v}),D,C=new Promise((a)=>{D=a}),H=Ot({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(l,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...W?{takePrespawnedWorker:(a)=>{let v=W.take(a);if(!v?.pid)return v;try{return B(d(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:W.adopt}:{}}).then(()=>{D("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),D(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));p.set(l,{abort:S,done:H,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0});let A=await N,E=A.executor_launch_id;if(typeof E!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:A,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return p.get(s)?.exited??new Promise(()=>{})},freezeBind(s){let i=T(s);if(G(d(i,"cgroup.freeze")))B(d(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){let i=new Set(s?.keep??[]);if(await $e(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&G(d(O,"cgroup.events")))x(),await te(O,Date.now()+ee,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ee;if(G(d(j,"cgroup.events"))){await te(j,s,"probe");try{de(j)}catch{}}let i=oe(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Ze(r,i,s);let l=(g)=>{let S=oe(g);return S!==null&&S<=i},f=he(t).filter((g)=>l(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...me(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,d(r,M)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=ge(m).filter((y)=>y!==process.pid&&!c(y)&&!z(y,"/reason-vm-hands")&&!z(y,S)&&!g.some((N)=>ne(y,N)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:re(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:re(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(I(),!i.includes(pe))throw new w("vm_hands_probe_failed","probe names no proof directory");let l=e.proofParent??"/tmp/reason-vm-hands-proof";V(l,{mode:457,recursive:!0});let f=q(l);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Te(d(l,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Le(g,t,t),Me(g,448);let h=q(g).ino;try{V(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(pe,g).replaceAll(Ge,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),N="";y.stdout?.on("data",(C)=>{if(N.length<16384)N+=C.toString("utf8").slice(0,16384-N.length)});let D=await new Promise((C)=>{let H=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},je);y.once("error",()=>{clearTimeout(H),C(127)}),y.once("close",(A)=>{clearTimeout(H),C(A??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:D}),{exitCode:D,markers:N,proofDirInode:h}}finally{if(!S)He(g,{recursive:!0,force:!0})}},restatLayout(s){let i=u(s),l=i===e.init.layout.session_root?e.init.layout.alias:d(i,"repo"),f="invalid";try{vr(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=q(l);S=h.uid,g=f==="0:0:755"&&l===d(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&We(l)===l&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=u(s);try{le(i,o,(l)=>new w("vm_hands_mount_mismatch",l))}catch(l){if(i!==e.init.layout.session_root&&l instanceof w&&l.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw l}},installEnvironment(s,i){let l=p.get(s);if(!l)throw new w("environment_unavailable","no executor owns an environment");return ot({root:e.root,operationId:l.operationId,payload:i}).installed_revision},async stop(){if(X)clearInterval(X);W?.close(),await Promise.all([...p.keys()].map((s)=>Y(s)))}};function xe(){try{return Z(d(r,M),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function $e(s,i,l=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=qe();try{await nn();let S=Date.now()+ee,h=new Set(xe().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=Y(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(G(d(T(a),"cgroup.events")))await te(T(a),S,"bind");await v}let N=[...f].map((a)=>T(a).replace(/^\/sys\/fs\/cgroup/,"")),D=["/",...[r,d(r,M)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),H=(a)=>c(a)||N.some((v)=>z(a,v))||D.some((v)=>ne(a,v)),A=l?[]:he(t).filter((a)=>!H(a));if(A.length)throw o("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size,...me(A)}),new w("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let E=(a)=>!H(a)&&!z(a,"/reason-vm-hands")&&!z(a,C)&&!D.some((v)=>ne(a,v));if(y!==null){let a=ge(y).filter((v)=>v!==process.pid&&E(v));if(a.length)throw o("vm_hands.kill_strays",{strays:re(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),Oe(a)}finally{g()}}}function oe(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function be(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ze(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=ke(e).filter((o)=>Se(o,e)),c=new Set(n.filter((o)=>{let u=oe(o);return u!==null&&u<=r}));for(let o=!0;o;){o=!1;for(let u of n){if(c.has(u))continue;let p=be(u);if(p!==null&&c.has(p))c.add(u),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,r,t="/proc"){try{return k(d(t,String(e),"cgroup"),"utf8").split(`
+`).find((c)=>c.startsWith("0::"))?.slice(3)===r}catch{return!1}}function z(e,r,t="/proc"){try{let c=k(d(t,String(e),"cgroup"),"utf8").split(`
+`).find((o)=>o.startsWith("0::"))?.slice(3)??"";return c===r||c.startsWith(`${r}/`)}catch{return!1}}var Xe=100;function fe(){try{return Math.floor(Number(k("/proc/uptime","utf8").split(" ")[0])*Xe)}catch{return 0}}async function te(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`${t} cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}while(!/^populated 0$/m.test(k(d(e,"cgroup.events"),"utf8"))){if(Date.now()>r)throw new w("vm_hands_kill_unverified",`${t} cgroup still populated (left frozen)`);for(let n of ke(e)){if(!Se(n,e))continue;try{process.kill(n,"SIGKILL")}catch{}}await new Promise((n)=>setTimeout(n,10))}try{B(d(e,"cgroup.freeze"),"0")}catch(n){throw new w("vm_hands_kill_unverified",`${t} cgroup thaw: ${n instanceof Error?n.message:String(n)}`)}}function Se(e,r){let t=r.replace(/^\/sys\/fs\/cgroup/,"")||"/",n="";try{n=k(`/proc/${e}/cgroup`,"utf8").split(`
+`).find((o)=>o.startsWith("0::"))??""}catch{return!1}let c=n.slice(3);return c===t||c.startsWith(`${t}/`)}function ke(e){let r=[],t=(n)=>{try{for(let o of k(d(n,"cgroup.procs"),"utf8").split(`
+`))if(/^\d+$/.test(o))r.push(Number(o))}catch{}let c=[];try{c=Z(n,{withFileTypes:!0}).filter((o)=>o.isDirectory()).map((o)=>o.name)}catch{}for(let o of c)t(d(n,o))};return t(e),r}function me(e,r="/proc"){let t=new Map;for(let c of e.slice(0,64)){let o=`${Ye(c,r)}:${Qe(c,r)}`;t.set(o,(t.get(o)??0)+1)}let n=[...t.entries()].sort((c,o)=>o[1]-c[1])[0]?.[0]??"none";return{count:e.length,cause:n}}function Ye(e,r){let t;try{t=(k(d(r,String(e),"cgroup"),"utf8").split(`
+`).find((n)=>n.startsWith("0::"))??"").slice(3)}catch{return"gone"}if(t==="/")return"root";if(t==="/reason-payload")return"payload";if(t.startsWith("/reason-payload/vm-hands/b-"))return"payload_bind";if(t==="/reason-payload/vm-hands"||t.startsWith("/reason-payload/vm-hands/"))return"payload_vm_hands";if(t.startsWith("/reason-payload/"))return"payload_sub";if(t==="/reason-person"||t.startsWith("/reason-person/"))return"person";if(t==="/reason-srt"||t.startsWith("/reason-srt/"))return"srt";if(t==="/reason-vm-hands"||t.startsWith("/reason-vm-hands/"))return"vm_hands";if(t==="/reason-workload"||t.startsWith("/reason-workload/"))return"workload";return"other"}function Qe(e,r){let t;try{t=k(d(r,String(e),"stat"),"utf8")}catch{return"gone"}let n=t.slice(t.lastIndexOf(")")+2,t.lastIndexOf(")")+3);return{R:"running",S:"sleeping",D:"disk",Z:"zombie",T:"stopped",t:"stopped",I:"idle"}[n]??"other"}function re(e,r="/proc"){return e.slice(0,16).map((t)=>{let n="?",c="?";try{n=k(d(r,String(t),"comm"),"utf8").trim().slice(0,32)}catch{}try{c=(k(d(r,String(t),"cgroup"),"utf8").split(`
+`).find((o)=>o.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:t,comm:n,ppid:be(t,r),cgroup:c}})}function ge(e,r="/proc"){let t=[];for(let n of Z(r)){if(!/^\d+$/.test(n))continue;let c;try{c=k(d(r,n,"stat"),"utf8")}catch{continue}let o=c.slice(c.lastIndexOf(")")+2).split(" "),u=Number(o[1]),p=Number(o[6]),b=Number(o[19]),P=(p&2097152)!==0||u===2||n==="2",x=(o[0]==="Z"||o[0]==="X")&&o[17]==="1";if(!P&&!x&&b>=e)t.push(Number(n))}return t}function he(e,r="/proc"){let t=[];for(let n of Z(r)){if(!/^\d+$/.test(n))continue;let c;try{c=k(d(r,n,"status"),"utf8")}catch{continue}if(/^State:\s+[ZX]/m.test(c)&&/^Threads:\s+1$/m.test(c))continue;let o=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(c);if(o&&o.slice(1).some((u)=>Number(u)===e))t.push(Number(n))}return t}function _e(e="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(k(e,"utf8").trim())>=1}catch{return!1}}var L=0,Pe=[],J=new Set;function qe(){L++;let e=!1;return()=>{if(e)return;if(e=!0,--L===0)for(let r of Pe.splice(0))r()}}function en(){return L===0?Promise.resolve():new Promise((e)=>{Pe.push(e)})}async function ye(){while(L>0)await en()}async function nn(){let e=Date.now()+1000;while(J.size&&Date.now()<e)await new Promise((r)=>setTimeout(r,2))}function tn(e,r){let t=r.replace(/^\/sys\/fs\/cgroup/,"");J.add(e);let n=()=>{let c="";try{c=k(`/proc/${e}/cgroup`,"utf8").split(`
+`).find((o)=>o.startsWith("0::"))??""}catch{J.delete(e);return}if(c.slice(3)===t){J.delete(e);return}setTimeout(n,1)};n()}function hn(e){let r={person:e.personCgroup??d("/sys/fs/cgroup",se,M),model:e.payloadCgroup??d(we,M),surface:e.surfaceCgroup??d("/sys/fs/cgroup",se,M,Ke)},t=e.entry??process.argv[1]??"",n={},c=(u)=>u.startsWith("model:")&&e.bindCgroup?e.bindCgroup(u.slice(6)):r[u.startsWith("model")?"model":u==="surface"?"surface":"person"],o=(u)=>{let p=u.startsWith("model")?"model":u==="surface"?"surface":"person",b=new Map,P=String(e.payloadUid),x=String(e.payloadGid);if(p==="surface")try{V(c(u),{mode:493})}catch{}let m=p==="surface"?'exec "$@"':`exec /usr/bin/setpriv --no-new-privs --reuid=${P} --regid=${x} --clear-groups -- "$@"`,_=Bun.spawn(["/bin/sh","-c",`echo $$ > ${ve(d(c(u),"cgroup.procs"))} || exit 125; ${m}`,"vm-hands-op-join",process.execPath,"--no-install",t,"--vm-hands-op-runner",...p==="person"?[ar]:[],...p==="surface"?[cr,`${kt}${P}`,`${Ct}${e.surfaceDirectory??""}`]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:p==="surface"?process.env.HOME||"/root":"/home/runner",...G("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(I){let R=I;if(p==="surface"&&R.t==="readiness"){let U=I;e.log?.("vm_hands.surface_ready",{lanes:Object.keys(U.lanes??{}).filter((K)=>U.lanes[K]===!0),display_video:U.display_video===!0}),e.onSurfaceReadiness?.(U);return}let F=b.get(R.id);if(!F)return;if(R.t==="event"&&R.event)F.onEvent(R.event);if(R.t==="done")b.delete(R.id),F.done(R.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});_.exited.then((I)=>{if(n[u]?.child===_)delete n[u];for(let[,R]of b)R.done({status:"failed",error_code:"vm_hands_op_runner_exited"});if(b.clear(),e.log?.("vm_hands.op_runner_exited",{kind:p,code:I}),p==="surface")e.onSurfaceReadiness?.(null)}),tn(_.pid,c(u));let O={child:_,pending:b};return n[u]=O,O};return{run(u,p,b,P,x){if(!_e())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=u==="model"&&x&&e.bindCgroup?`model:${x.toLowerCase()}`:u,_=async()=>{while(!n[m]&&L>0)await ye()};return _().then(async()=>{if(!n[m]&&L>0)await _()}).then(()=>new Promise((O)=>{if(!n[m]&&L>0){O({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let I=n[m]??o(m);I.pending.set(p.id,{onEvent:b,done:O}),P.addEventListener("abort",()=>{try{I.child.send({t:"cancel",id:p.id})}catch{}},{once:!0});try{I.child.send({t:"op",...p})}catch{I.pending.delete(p.id),O({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(u){if(!n[u]&&_e())ye().then(()=>{if(!n[u]&&L===0)o(u)})},notify(u,p){let b=n[u];if(!b)return!1;try{return b.child.send(p),!0}catch{return!1}},stop(){for(let u of Object.keys(n))n[u]?.child.kill()}}}export{we as VM_HANDS_PAYLOAD_CGROUP,M as VM_HANDS_PAYLOAD_JOIN,se as VM_HANDS_PERSON_CGROUP,Ge as VM_HANDS_PROBE_NONCE_TOKEN,pe as VM_HANDS_PROOF_DIR_TOKEN,Ke as VM_HANDS_SURFACE_JOIN,Fe as VM_HANDS_WORKLOAD_CGROUP,w as VmHandsExecutorError,gn as createVmHandsExecutor,hn as createVmHandsOpRunners,re as describeProcesses,z as inCgroup,he as payloadUidProcesses,ge as processesStartedSince,_e as ptraceProtected,ke as subtreePids,me as survivorSummary,Ee as vmHandsBindCgroup,Je as vmHandsSessionRoot};

package/bin/vm-hands/vm-hands-op-runner-r4m9whbb.js

@@ -0,0 +1,2 @@
+// @bun
+import{ar,cr,kt,Ct,At,ps}from"./vm-hands-entry-lite-622t4qbv.js";export{ar as VM_HANDS_OP_RUNNER_PERSON_ARG,cr as VM_HANDS_OP_RUNNER_SURFACE_ARG,Ct as VM_HANDS_SURFACE_DIRECTORY_ARG,At as VM_HANDS_SURFACE_OPS,kt as VM_HANDS_SURFACE_UID_ARG,ps as runVmHandsOpRunner};

package/bin/vm-hands/vm-hands-runtime-x79a9j7q.js

@@ -0,0 +1,4 @@
+// @bun
+import{rt}from"./vm-hands-entry-lite-5tbntcyq.js";import{At}from"./vm-hands-entry-lite-622t4qbv.js";import{Fi,ln,ji}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
+`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function B(r,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((y)=>N(y,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[y,m]of[[a,!1],["/usr/local/bin",!0]]){let _=N(y);if((m?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),g=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:g}),u()})})}var Y=3000;function Re(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(r){j(r,{recursive:!0,mode:448});let n=te(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ce(r){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-96pq5c8m.js"),import("./hands-worker-source-atg5dc7b.js"),import("./network-contract-rzw769gw.js"),import("./device-workspace-pt07525s.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-8fgk2s53.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:rt,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:X.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function _e(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=r.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let g=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of g)l[c]=s.operation_constraints[c];return{...r,capabilities:{...a,supported_operations:["hands.connect",...I,...g],operation_constraints:l}}}function pe(r){for(let n of G("/etc/passwd","utf8").split(`
+`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(r,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(r,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((o)=>setTimeout(()=>o(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:g},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-4525j7h3.js"),import("./worker-sandbox-s9pyac8p.js")]);c();try{g({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,y=new Promise((e)=>{f=e}),m=y.then(()=>import("./vm-hands-executor-bcw4gm80.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:V,runtimeDirectory:O,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(r,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),o}),_=(e)=>async(...o)=>(await m)[e](...o),x=null;m.then((e)=>{x=(o)=>e.executorExited(o)});let S={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};m.then((e)=>{S.restatLayout=(o)=>e.restatLayout(o),S.verifyMounts=(o)=>e.verifyMounts(o),S.installEnvironment=(o,d)=>e.installEnvironment(o,d),S.freezeBind=(o)=>e.freezeBind(o),S.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await Fi(r),C=new ln(r,q,S,{envRoot:W}),M=ce(r),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-3j6ftyf5.js")]).then(([e,o])=>{K=()=>_e(e,o.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=y.then(()=>import("./vm-hands-executor-bcw4gm80.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:r.layout.payload_uid,payloadGid:pe(r.layout.payload_uid),bindCgroup:(i)=>o(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+le;while(C.settingUp&&Date.now()<o)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await ji({apiOrigin:r.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:o,bindId:d,signal:i,emit:E})=>{let k=fe(r,o);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=o.capability==="pty.start"&&e==="person"&&!o.authority;if(de.has(String(o.capability))&&!Z){let{executeLocalOperation:p}=await import("./local-capabilities-3j6ftyf5.js");return p(k,o,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(At.has(String(o.capability))){if(w.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(o.attempt_id),claim:o,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(o.attempt_id),claim:o,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:o})=>At.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,o)},onTurn:(e,o)=>{if(o)u.set(e,o);else u.delete(e)}}),await(await m).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};

package/bin/vm-hands/worker-preview-readiness-7xtgxsar.js

@@ -0,0 +1,2 @@
+// @bun
+import{_s}from"./vm-hands-entry-lite-x39tmj7j.js";import"./vm-hands-entry-lite-psywfz8m.js";import"./vm-hands-entry-lite-87vmbt38.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{_s as probeWorkerPreview};

package/bin/vm-hands/worker-sandbox-s9pyac8p.js

@@ -0,0 +1,2 @@
+// @bun
+import{gs}from"./vm-hands-entry-lite-3sjkzhf6.js";import"./vm-hands-entry-lite-6x1an7es.js";import"./vm-hands-entry-lite-tebh7dcm.js";import"./vm-hands-entry-lite-87vmbt38.js";import"./vm-hands-entry-lite-rfz60hb3.js";export{gs as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-x64",
-  "version": "0.2.505",
+  "version": "0.2.506",
   "description": "Reason CLI native binary for linux-x64",
   "os": [
     "linux"

package/bin/vm-hands/api-credentials-23k36ayh.js

@@ -1,2 +0,0 @@
-// @bun
-import{A as a,B as b,C as c,D as d,E as e}from"./vm-hands-entry-lite-rck5h8fr.js";import"./vm-hands-entry-lite-6x5pj2y0.js";import"./vm-hands-entry-lite-0a4cy8gw.js";import"./vm-hands-entry-lite-33h8294z.js";import"./vm-hands-entry-lite-3882raa5.js";import"./vm-hands-entry-lite-3rg3znp8.js";import"./vm-hands-entry-lite-56v9haps.js";import"./vm-hands-entry-lite-jd31as70.js";import"./vm-hands-entry-lite-q9g11dbj.js";import"./vm-hands-entry-lite-c5gt0086.js";import"./vm-hands-entry-lite-e1xjfj57.js";import"./vm-hands-entry-lite-8p8hz0j1.js";import"./vm-hands-entry-lite-e4hwb89r.js";import"./vm-hands-entry-lite-kqbats5n.js";import"./vm-hands-entry-lite-xd2dn3n8.js";import"./vm-hands-entry-lite-ghhpgt3v.js";import"./vm-hands-entry-lite-pkk555dx.js";export{d as resolveApiCredentials,e as requireApiCredentials,b as explicitApiOrigin,c as environmentApiKey,a as apiOriginFromEnvironment};

package/bin/vm-hands/api-jd29p2kc.js

@@ -1,2 +0,0 @@
-// @bun
-import{M as a,N as b,O as c,P as d,Q as e,R as f}from"./vm-hands-entry-lite-6x5pj2y0.js";import"./vm-hands-entry-lite-0a4cy8gw.js";import"./vm-hands-entry-lite-33h8294z.js";import"./vm-hands-entry-lite-3rg3znp8.js";import"./vm-hands-entry-lite-56v9haps.js";import"./vm-hands-entry-lite-jd31as70.js";import"./vm-hands-entry-lite-q9g11dbj.js";import"./vm-hands-entry-lite-c5gt0086.js";import"./vm-hands-entry-lite-e1xjfj57.js";import"./vm-hands-entry-lite-8p8hz0j1.js";import"./vm-hands-entry-lite-e4hwb89r.js";import"./vm-hands-entry-lite-kqbats5n.js";import"./vm-hands-entry-lite-xd2dn3n8.js";import"./vm-hands-entry-lite-ghhpgt3v.js";import"./vm-hands-entry-lite-pkk555dx.js";export{d as sessionPlace,c as sessionMachine,e as createMachineEnrollmentTicketWithToken,f as ReasonApi,b as REASONING_EFFORTS,a as ApiError};

package/bin/vm-hands/ask-relay-zpp0rkhg.js

@@ -1,4 +0,0 @@
-// @bun
-import{Ia as Q,Ka as w,Oa as E}from"./vm-hands-entry-lite-4swa18qz.js";import{Qa as X}from"./vm-hands-entry-lite-33h8294z.js";import{Mk as Y}from"./vm-hands-entry-lite-q9g11dbj.js";import"./vm-hands-entry-lite-c5gt0086.js";import"./vm-hands-entry-lite-e1xjfj57.js";import"./vm-hands-entry-lite-8p8hz0j1.js";import"./vm-hands-entry-lite-e4hwb89r.js";import{Gl as N}from"./vm-hands-entry-lite-pkk555dx.js";import{existsSync as P,mkdirSync as R,readFileSync as S,writeFileSync as y}from"fs";import{homedir as F}from"os";import{dirname as _,join as g}from"path";import{existsSync as V,mkdirSync as zq,rmSync as Aq,writeFileSync as Bq}from"fs";import{dirname as Dq,join as k}from"path";var x=(q)=>k(q,".reason","do-not-track");function M(q){let z=q.DO_NOT_TRACK?.trim().toLowerCase();if(!z)return null;return z!=="0"&&z!=="false"}function Z(q,z){return M(q)===!0||V(x(z))}var $=86400000,p=300,l=900000,u=21600000,c=60000,O=(q)=>g(q,".reason","ask-relay.json"),v=300000,r=8,o=300000;function W(q){try{let z=JSON.parse(S(O(q),"utf8"));return{sessions:Array.isArray(z.sessions)?z.sessions.filter((B)=>typeof B?.name==="string"&&typeof B.agent==="string"&&typeof B.usedAt==="number"):[]}}catch{return{sessions:[]}}}function s(q,z){try{if(!P(_(O(q))))R(_(O(q)),{recursive:!0});y(O(q),`${JSON.stringify(z)}
-`,{mode:384})}catch{}}var L=(q,z)=>new Promise((B)=>{if(z.aborted)return B();let A=setTimeout(D,q);A.unref?.();function D(){clearTimeout(A),z.removeEventListener("abort",D),B()}z.addEventListener("abort",D,{once:!0})});function b(q){let z=q?.status;return typeof z==="number"?z:null}var j=60000;function d(q){return{address:q.address.slice(0,300),state:q.state.slice(0,40),note:q.note.slice(0,500)}}function h(q){let z=Number.isFinite(q.sentAt)&&Math.abs(q.sentAt)<8640000000000000?q.sentAt:Date.now();return{id:q.id.slice(0,100),from:q.from.slice(0,300),from_agent:q.fromAgent?.slice(0,100)??null,to:q.to.slice(0,300),reply_to:q.replyTo?.slice(0,100)??null,sent_at:z,body:q.body.length>j?`${q.body.slice(0,j)}
-[cut: the answer was ${q.body.length} characters]`:q.body}}class T{network;api;home;signal;log;team;sessions=new Map;readers=new Set;constructor(q,z,B,A,D,C){this.network=q;this.api=z;this.home=B;this.signal=A;this.log=D;this.team=C}async run(){let q=Date.now()-$;for(let C of W(this.home).sessions)if(C.usedAt>q)this.read(C);let z=0,B=0,A=-1/0,D=-1/0;while(!this.signal.aborted){let C=await this.network.team().catch(()=>null);if(!C){await L(60000,this.signal);continue}if(this.team!==null&&C.name!==this.team)return;if(this.team===null&&Date.now()-D>=o)D=Date.now(),this.sendLink();let G,H=new Date(Date.now()+86400000).toISOString().slice(0,10),I=Date.now()-A>=v&&!Z(process.env,this.home)?C.messageCounts?.filter((K)=>K.day<=H).slice(-r):void 0;try{let K=await this.api.claimAgentNetworkRelayJob({machine:C.machine,person:C.person,...this.onNetwork(C),version:Y,wait_seconds:X,...I?.length?{message_counts:I,...C.endpoint?{endpoint:C.endpoint}:{}}:{}},AbortSignal.any([this.signal,AbortSignal.timeout((X+20)*1000)]));if(I?.length)A=Date.now();if(z=0,B=0,K.retry_after_seconds)await L(K.retry_after_seconds*1000,this.signal);G=K.job}catch(K){if(this.signal.aborted)return;let J=b(K);if(J===401){B+=1,await this.untilSignedInAgain(Math.min(u,l*2**Math.min(B-1,10)));continue}if(J===403){await L(900000,this.signal);continue}if(J===404||J===405){await L(120000,this.signal);continue}z+=1,await L(Math.min(60000,1000*2**Math.min(z,6)),this.signal);continue}if(G)this.carry(G)}}linkSent=null;async sendLink(){let{sendTeamLink:q}=await import("./network-sign-in-3dkdkh3a.js");this.linkSent=await q(this.network,this.linkSent,this.home).catch(()=>this.linkSent)}onNetwork(q){return{team:q.name,...q.teamId?{team_id:q.teamId}:{},...this.team===null?{workspace:!1}:{}}}async untilSignedInAgain(q){let{loadCredentials:z}=await import("./credentials-byna24dv.js"),B=()=>{let C=z();return C?[C.apiOrigin,C.orgId,C.clientId].join("\x00"):""},A=B(),D=Date.now()+q;while(!this.signal.aborted&&Date.now()<D)if(await L(Math.min(c,Math.max(0,D-Date.now())),this.signal),B()!==A)return}async carry(q){let z;try{z=q.kind==="who"?{who:await this.who(q)}:{sent:await this.send(q)}}catch(B){z={error:B instanceof Error?B.message:String(B)}}for(let B=1;;B+=1)try{if(await this.api.completeAgentNetworkRelayJob(q.id,z),q.kind==="send")this.log(Q(`relayed a message to ${q.to} from ${"sent"in z?z.sent.from:q.from_name}`),"relayed");return}catch(A){if(B>=4||this.signal.aborted){this.log(Q(`couldn't report a relayed call: ${A instanceof Error?A.message:String(A)}`));return}await L(B*1000,this.signal)}}async who(q){let z=q.all===!0,B=await this.network.snapshot({all:z});return{all:z,team:B.team,sessions:B.sessions.map((A)=>({address:A.address,person:A.person,machine:A.machine,agent:A.agent,repo:A.repo,branch:A.branch,status:A.status,since:A.since,doing:A.doing,worker:A.worker,...A.tier?{tier:A.tier.slice(0,10)}:{}})),machines:B.machines.map((A)=>({person:A.person,machine:A.machine,online:A.online}))}}async send(q){let z={name:q.from_name,agent:q.from_agent},B=await this.session(z),A=await B.send(q.to,q.body,q.reply_to,{notify:q.notify===!0});return this.remember(z),this.read(z),{ids:A.ids,recipients:A.recipients,from:B.address,deliveries:A.deliveries.slice(0,500).map(d)}}session(q){let z=`${q.agent}:${q.name}`,B=this.sessions.get(z);if(!B)B=this.network.session(q.name,{agent:q.agent}).then(async(A)=>{return await A.idle(`personal agent (${q.agent}), through Reason`).catch(()=>{}),A}),B.catch(()=>this.sessions.delete(z)),this.sessions.set(z,B);return B}remember(q){let B=W(this.home).sessions.filter((A)=>A.name!==q.name||A.agent!==q.agent);s(this.home,{sessions:[...B,{...q,usedAt:Date.now()}].slice(-50)})}read(q){let z=`${q.agent}:${q.name}`;if(this.readers.has(z))return;this.readers.add(z),(async()=>{let B=0;try{while(!this.signal.aborted){let A=W(this.home).sessions.find((D)=>D.name===q.name&&D.agent===q.agent)?.usedAt??0;if(Date.now()-A>$)return;try{let D=await this.session(q),C=await D.next(p);if(C.length===0)continue;let G=await this.network.team();if(!G)throw Error("not on a team");await this.api.recordAgentNetworkRelayReplies({messages:C.map(h),...this.onNetwork(G)}).catch((H)=>{let I=b(H);if(I===null||I>=500||I===429||I===401)throw H;this.log(`dropped ${C.length} answer(s) the server refused (HTTP ${I})`)}),await D.ack(C.map((H)=>H.id)),B=0}catch{if(this.signal.aborted)return;this.sessions.delete(z),B+=1,await L(Math.min(60000,1000*2**Math.min(B,6)),this.signal)}}}finally{this.readers.delete(z)}})()}}async function m(q){await new T(q.network,q.api,q.home??F(),q.signal,q.log??(()=>{}),q.team).run()}async function i(q,z=()=>{}){let B="";while(!q.aborted){try{let A=w.openInstalled();if(A)try{let[{resolveApiCredentials:D},{ReasonApi:C}]=await Promise.all([import("./api-credentials-23k36ayh.js"),import("./api-jd29p2kc.js")]),G=await D({});if(G&&G.credentialKind!=="api_key"){let H=E(),I=H&&G.orgId.toLowerCase()===H.orgId.toLowerCase()?H.team:null;await m({network:A,api:new C(G),team:I,signal:q,log:z})}}finally{A.close()}B=""}catch(A){let D=Q(`agent network relay: ${A instanceof Error?A.message:String(A)}`);if(D!==B)z(D);B=D}await L(300000,q)}}var t=600000,a=3600000,n=180000;async function Wq(q,z,B={}){let A=-1/0,D="",C=(J,f)=>{let U=Date.now();if(f==="relayed"||U-A<t||J===D&&U-A<a)return;A=U,D=J,z(J)},G=new AbortController,H=()=>G.abort();q.once("end",H),q.once("close",H),q.once("error",H),q.resume();let I=B.installedVersion??(()=>e()),K=setInterval(()=>{I().then((J)=>{if(J!==null&&J!==Y)G.abort()},()=>{})},B.checkMs??n);K.unref?.();try{await(B.relay??i)(G.signal,C)}finally{clearInterval(K)}}async function e(q={}){if(!(q.compiled??Bun.main.startsWith("/$bunfs/")))return null;let z=q.home??F(),B=q.env??process.env;if((q.platform??process.platform)==="darwin"){let{currentManagedRuntimeVersion:C,isManagedRuntimeVersionExecutable:G,legacyManagedRuntimePaths:H,managedRuntimePaths:I}=await import("./managed-runtime-8y90twae.js");try{let K=I({platform:"darwin",home:z,environment:B});for(let J of[K,H(K)])if(J&&G(J))return C(J)}catch{}return null}let{installationReceiptPath:A,loadInstallationReceipt:D}=await import("./install-receipt-nnragt7p.js");return D(A(B,z))?.version??null}export{Wq as runDaemonRelay,i as runBackgroundAskRelay,m as runAskRelay,e as installedCliVersion};

package/bin/vm-hands/connect-cli-xyxgcg6z.js

@@ -1,2 +0,0 @@
-// @bun
-import{l as a,m as b,n as c,o as d,p as e,q as f,r as g,s as h,t as i,u as j,v as k,w as l,x as m}from"./vm-hands-entry-lite-0572m6cr.js";import"./vm-hands-entry-lite-x3pbyg92.js";import"./vm-hands-entry-lite-pmw3ycgc.js";import"./vm-hands-entry-lite-rck5h8fr.js";import"./vm-hands-entry-lite-6x5pj2y0.js";import"./vm-hands-entry-lite-0a4cy8gw.js";import"./vm-hands-entry-lite-zz8tr0bm.js";import"./vm-hands-entry-lite-33h8294z.js";import"./vm-hands-entry-lite-vqr3zrqr.js";import"./vm-hands-entry-lite-00y3kn86.js";import"./vm-hands-entry-lite-ah2ep922.js";import"./vm-hands-entry-lite-v0k8b768.js";import"./vm-hands-entry-lite-s8zfzv0k.js";import"./vm-hands-entry-lite-b7wy89y0.js";import"./vm-hands-entry-lite-dhqmbqsh.js";import"./vm-hands-entry-lite-3882raa5.js";import"./vm-hands-entry-lite-tbdcmq09.js";import"./vm-hands-entry-lite-tafgty5k.js";import"./vm-hands-entry-lite-8xe0wzp9.js";import"./vm-hands-entry-lite-s8ty42st.js";import"./vm-hands-entry-lite-g6r5xrk0.js";import"./vm-hands-entry-lite-dgmap6z4.js";import"./vm-hands-entry-lite-p9fwt68c.js";import"./vm-hands-entry-lite-v0bp1v66.js";import"./vm-hands-entry-lite-zj3hb5jk.js";import"./vm-hands-entry-lite-b0p8f295.js";import"./vm-hands-entry-lite-26xb026c.js";import"./vm-hands-entry-lite-8twscwtw.js";import"./vm-hands-entry-lite-rj8yq6gp.js";import"./vm-hands-entry-lite-td309c1y.js";import"./vm-hands-entry-lite-c8bf82tx.js";import"./vm-hands-entry-lite-1nj03gbj.js";import"./vm-hands-entry-lite-k9n1pk42.js";import"./vm-hands-entry-lite-wbfmc0xn.js";import"./vm-hands-entry-lite-r374pchj.js";import"./vm-hands-entry-lite-3rg3znp8.js";import"./vm-hands-entry-lite-56v9haps.js";import"./vm-hands-entry-lite-jd31as70.js";import"./vm-hands-entry-lite-q9g11dbj.js";import"./vm-hands-entry-lite-c5gt0086.js";import"./vm-hands-entry-lite-e1xjfj57.js";import"./vm-hands-entry-lite-8p8hz0j1.js";import"./vm-hands-entry-lite-e4hwb89r.js";import"./vm-hands-entry-lite-r665z809.js";import"./vm-hands-entry-lite-v4r1fggm.js";import"./vm-hands-entry-lite-kqbats5n.js";import"./vm-hands-entry-lite-xd2dn3n8.js";import"./vm-hands-entry-lite-ghhpgt3v.js";import"./vm-hands-entry-lite-pkk555dx.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};

package/bin/vm-hands/credentials-byna24dv.js

@@ -1,2 +0,0 @@
-// @bun
-import{S as a,T as b,U as c,V as d}from"./vm-hands-entry-lite-0a4cy8gw.js";import"./vm-hands-entry-lite-3rg3znp8.js";import"./vm-hands-entry-lite-56v9haps.js";import"./vm-hands-entry-lite-jd31as70.js";import"./vm-hands-entry-lite-e1xjfj57.js";import"./vm-hands-entry-lite-8p8hz0j1.js";import"./vm-hands-entry-lite-pkk555dx.js";export{b as saveCredentials,c as loadCredentials,d as deleteCredentials,a as credentialsPath};

package/bin/vm-hands/custom-endpoint-device-p2agcsk0.js

@@ -1,2 +0,0 @@
-// @bun
-import{$d as m,Pd as a,Qd as b,Rd as c,Sd as d,Td as e,Ud as f,Vd as g,Wd as h,Xd as i,Yd as j,Zd as k,_d as l,ae as n,be as o,ce as p,de as q,ee as r,fe as s,ge as t,he as u,ie as v,je as w}from"./vm-hands-entry-lite-8xe0wzp9.js";import"./vm-hands-entry-lite-e4hwb89r.js";import"./vm-hands-entry-lite-pkk555dx.js";export{v as isCustomEndpointStreamFailureMessage,q as isCustomEndpointSessionRequiredMessage,w as isCustomEndpointFirewallBlockMessage,u as isCustomEndpointFailureMessage,s as isCustomEndpointDeviceFailureMessage,o as isCustomEndpointDeviceFailureCode,h as customEndpointRequestMatchesConfig,t as customEndpointFailureMessage,r as customEndpointDeviceFailureMessage,i as CustomEndpointDeviceRequestSchema,l as CustomEndpointDeviceReceiptSchema,j as CustomEndpointDeviceHeadersSchema,m as CustomEndpointDeviceCredentialSchema,k as CustomEndpointDeviceChunkSchema,f as CUSTOM_ENDPOINT_DEVICE_TIMEOUT_MS,p as CUSTOM_ENDPOINT_DEVICE_SESSION_REQUIRED,g as CUSTOM_ENDPOINT_DEVICE_SAFE_HEADERS,c as CUSTOM_ENDPOINT_DEVICE_MAX_RESPONSE_BYTES,d as CUSTOM_ENDPOINT_DEVICE_MAX_CHUNKS,e as CUSTOM_ENDPOINT_DEVICE_MAX_BODY_BYTES,n as CUSTOM_ENDPOINT_DEVICE_FAILURE_CODES,b as CUSTOM_ENDPOINT_DEVICE_CHUNK_BYTES,a as CUSTOM_ENDPOINT_DEVICE_CAPABILITY};

package/bin/vm-hands/desktop-account-z16mmkxg.js

@@ -1,2 +0,0 @@
-// @bun
-import{sj as a,tj as b,uj as c,vj as d,wj as e}from"./vm-hands-entry-lite-k9n1pk42.js";import"./vm-hands-entry-lite-56v9haps.js";import"./vm-hands-entry-lite-jd31as70.js";import"./vm-hands-entry-lite-pkk555dx.js";export{b as passwdAccount,e as desktopHome,d as desktopAccount,c as configureDesktopAccount,a as DESKTOP_USER_ENV};

package/bin/vm-hands/device-workspace-y0tk3ne8.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ak as j,Bk as k,Ck as l,Dk as m,Ek as n,Fk as o,Gk as p,Hk as q,Ik as r,Jk as s,Kk as t,Lk as u,rk as a,sk as b,tk as c,uk as d,vk as e,wk as f,xk as g,yk as h,zk as i}from"./vm-hands-entry-lite-jd31as70.js";import"./vm-hands-entry-lite-pkk555dx.js";export{j as parseDeviceWorkspace,g as isSessionWorktreePath,h as isDeviceWorkspacePath,i as deviceWorkspaceRootRelative,t as computeWorkerWorkspace,s as cloudSessionRootLayout,u as cloudSessionLayoutOfRoot,r as cloudSessionLayout,n as SIDECHAT_WORKSPACE_ID,f as SESSION_WORKTREE_ID,e as SESSION_WORKTREES,c as SESSION_WORKSPACE_LAYOUT,a as REASON_WORKSPACE_BASE,d as HANDS_WORKSPACE_LAYOUT_KEY,b as HANDS_WORKSPACE_BASE_KEY,q as CLOUD_SESSION_ROOT_SHELL_PATTERNS,p as CLOUD_SESSION_ROOT,m as CLOUD_SESSION_CONTROL_BASE,o as CLOUD_REPOSITORY_WORKSPACE_ID,l as CLOUD_PAYLOAD_UID,k as CLOUD_PAYLOAD_HOME};

package/bin/vm-hands/hands-worker-source-0qa16xzj.js

@@ -1,2 +0,0 @@
-// @bun
-import{kd as a,ld as b,md as c,nd as d,od as e,pd as f,qd as g,rd as h,sd as i,td as j}from"./vm-hands-entry-lite-b7wy89y0.js";import"./vm-hands-entry-lite-26xb026c.js";import"./vm-hands-entry-lite-c8bf82tx.js";import"./vm-hands-entry-lite-1nj03gbj.js";import"./vm-hands-entry-lite-jd31as70.js";import"./vm-hands-entry-lite-xd2dn3n8.js";import"./vm-hands-entry-lite-pkk555dx.js";export{e as selectCloudChildPath,a as REASON_HANDS_WORKER_VERSION,j as REASON_HANDS_WORKER_STARTUP_REFUSALS,h as REASON_HANDS_WORKER_SOURCE,b as REASON_HANDS_WORKER_ENTRYPOINT,i as REASON_HANDS_WORKER_ARTIFACT_SHA256,f as REASON_HANDS_MAC_PTY_MEMBER_SOURCE,g as REASON_HANDS_LINUX_PTY_PROBE_SOURCE,d as REASON_HANDS_CLOUD_CHILD_PATH_MACOS,c as REASON_HANDS_CLOUD_CHILD_PATH_LINUX};