@reason-machines/cli-linux-x64 0.2.521 → 0.2.523

package/bin/vm-hands/{vm-hands-executor-v24y415a.js → vm-hands-executor-5n4k8t53.js}

@@ -1,12 +1,12 @@
 // @bun
-import"./vm-hands-entry-lite-ydgedg8n.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-fgppp6x9.js";import"./vm-hands-entry-lite-s85p7tqp.js";import{at,so,xr,Nt}from"./vm-hands-entry-lite-423rvptb.js";import"./vm-hands-entry-lite-wx1fmrbs.js";import"./vm-hands-entry-lite-q80xmhrx.js";import"./vm-hands-entry-lite-mma9qt5r.js";import"./vm-hands-entry-lite-148nz8be.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-dcrz19xf.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-gh0yjzye.js";import"./vm-hands-entry-lite-td73npv3.js";import{ur,dr,Tt,Rt}from"./vm-hands-entry-lite-gtnpk3sc.js";import"./vm-hands-entry-lite-90y6pf98.js";import"./vm-hands-entry-lite-ymqb2927.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-qz74j563.js";import{spawn as Ae}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as G,lstatSync as q,mkdirSync as V,mkdtempSync as Te,readdirSync as Z,readFileSync as k,realpathSync as We,rmdirSync as de,rmSync as He,writeFileSync as B}from"fs";import{basename as ze,dirname as Ue,join as d}from"path";import{readFileSync as ie,readlinkSync as ae}from"fs";import{relative as Ie}from"path";var ce=16;function ue(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Ne(e){let r=[];for(let t of e.split(`
+import"./vm-hands-entry-lite-88yjxxvf.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-c0t5xpzh.js";import"./vm-hands-entry-lite-s85p7tqp.js";import{at,ao,xr,Nt}from"./vm-hands-entry-lite-nercg1yz.js";import"./vm-hands-entry-lite-bvqwsd3b.js";import"./vm-hands-entry-lite-tash5m18.js";import"./vm-hands-entry-lite-mfvtp7py.js";import"./vm-hands-entry-lite-9x81cr3a.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-a6w60nv9.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-hc11hecd.js";import"./vm-hands-entry-lite-td73npv3.js";import{ur,dr,Rt,Tt}from"./vm-hands-entry-lite-nb0n1vy1.js";import"./vm-hands-entry-lite-kwmjn9y3.js";import"./vm-hands-entry-lite-c4959xva.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-1kt82jes.js";import{spawn as Ae}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as G,lstatSync as q,mkdirSync as V,mkdtempSync as Te,readdirSync as Z,readFileSync as k,realpathSync as We,rmdirSync as de,rmSync as He,writeFileSync as B}from"fs";import{basename as ze,dirname as Ue,join as d}from"path";import{readFileSync as ie,readlinkSync as ae}from"fs";import{relative as Ie}from"path";var ce=16;function ue(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Ne(e){let r=[];for(let t of e.split(`
 `)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:ue(n[3]),mountPoint:ue(n[4])})}return r}function De(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(Ne(m).filter((_)=>c(_.mountPoint)).map((_)=>[`${_.mountPoint}\x00${_.device}\x00${_.root}`,_.mountPoint])),u=o(r),p=o(t),b=(m)=>Ie(n,m)||".",P=[...u].filter(([m])=>!p.has(m)).map(([,m])=>b(m)),x=[...p].filter(([m])=>!u.has(m)).map(([,m])=>b(m));return{missing:P,extra:x,referenceCount:u.size,ownCount:p.size}}function le(e,r,t,n="/proc"){let c,o,u=null;try{c=ie(`${n}/1/mountinfo`,"utf8"),o=ie(`${n}/self/mountinfo`,"utf8")}catch(_){let O=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{u=ae(`${n}/1/ns/mnt`)===ae(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:b,referenceCount:P,ownCount:x}=De(e,c,o),m={reference_count:P,own_count:x,missing_count:p.length,extra_count:b.length,same_namespace:u};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ce)});if(p.length)throw r("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ce)}),t(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var we="/sys/fs/cgroup/reason-payload",M="vm-hands",Be="/run/ara-srt/fallbacks.jsonl",se="/reason-person",Fe="/reason-workload",Ke="surface",ee=5000,je=1e4,pe="__VM_HANDS_PROOF_DIR__",Ge="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,r){super(r);this.code=e}}function Ee(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new w("vm_hands_bind_invalid","bad bind id");return d(e,M,`b-${r.toLowerCase()}`)}var Ve=5000,ve=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Je(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=d(Ue(e),r.toLowerCase());return ze(e).toLowerCase()===r.toLowerCase()?e:t}function gn(e){let r=e.cgroup??we,t=e.init.layout.payload_uid,n=e.init.workload_ended!==!0,c=(s)=>z(s,se)||n&&z(s,Fe),o=e.log??(()=>{}),u=(s)=>Je(e.init.layout.session_root,s),p=new Map,b=new Map,P=0,x=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(P>s.length?0:P).split(`
 `).filter(Boolean);P=s.length;let l=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(l.length)o("vm_hands.srt_server_starts",{count:l.length,elapsed_ms:l.slice(0,8)})}catch{}},m=null,_=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",I=()=>{m??=fe()},R=0,F=()=>{try{let s=k(Be,"utf8"),i=s.slice(R>s.length?0:R);R=s.length;let l=i.split(`
-`).filter(Boolean).slice(0,1000);if(!l.length)return null;let f={},g=0;for(let S of l)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:l.length,codes:f,max_elapsed_ms:g}),{count:l.length,codes:f,max_elapsed_ms:g}}catch{return null}},U=(s,i,l)=>Re(s,i,l),K=(s)=>(i,l,f)=>Ae("/bin/sh",["-c",`echo $$ > ${ve(d(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...l],f),Re=K(d(r,M)),j=d(r,M,"probe"),T=(s)=>Ee(r,s),Ce=(s)=>{let i=T(s);try{V(i,{mode:493})}catch(l){if(!(l&&typeof l==="object"&&("code"in l)&&l.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},Oe=(s)=>{try{de(T(s))}catch{}},W=e.prespawn?so({spawnProcess:U,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;W?.arm();let X=W?setInterval(()=>{W.arm()},Ve):null;X?.unref?.();async function Y(s){let i=p.get(s);if(p.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:T,async startExecutor(s){if(I(),b.set(s.bindId,fe()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await Y(s.bindId);let{claim:i,bindId:l}=s,f=Ce(l),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,N=new Promise((a,v)=>{h=a,y=v}),D,C=new Promise((a)=>{D=a}),H=Nt({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(l,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...W?{takePrespawnedWorker:(a)=>{let v=W.take(a);if(!v?.pid)return v;try{return B(d(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:W.adopt}:{}}).then(()=>{D("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),D(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));p.set(l,{abort:S,done:H,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0});let A=await N,E=A.executor_launch_id;if(typeof E!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:A,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return p.get(s)?.exited??new Promise(()=>{})},freezeBind(s){let i=T(s);if(G(d(i,"cgroup.freeze")))B(d(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){let i=new Set(s?.keep??[]);if(await $e(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&G(d(O,"cgroup.events")))x(),await te(O,Date.now()+ee,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ee;if(G(d(j,"cgroup.events"))){await te(j,s,"probe");try{de(j)}catch{}}let i=oe(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Ze(r,i,s);let l=(g)=>{let S=oe(g);return S!==null&&S<=i},f=he(t).filter((g)=>l(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...me(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,d(r,M)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=ge(m).filter((y)=>y!==process.pid&&!c(y)&&!z(y,"/reason-vm-hands")&&!z(y,S)&&!g.some((N)=>ne(y,N)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:re(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:re(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(I(),!i.includes(pe))throw new w("vm_hands_probe_failed","probe names no proof directory");let l=e.proofParent??"/tmp/reason-vm-hands-proof";V(l,{mode:457,recursive:!0});let f=q(l);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Te(d(l,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Le(g,t,t),Me(g,448);let h=q(g).ino;try{V(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(pe,g).replaceAll(Ge,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),N="";y.stdout?.on("data",(C)=>{if(N.length<16384)N+=C.toString("utf8").slice(0,16384-N.length)});let D=await new Promise((C)=>{let H=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},je);y.once("error",()=>{clearTimeout(H),C(127)}),y.once("close",(A)=>{clearTimeout(H),C(A??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:D}),{exitCode:D,markers:N,proofDirInode:h}}finally{if(!S)He(g,{recursive:!0,force:!0})}},restatLayout(s){let i=u(s),l=i===e.init.layout.session_root?e.init.layout.alias:d(i,"repo"),f="invalid";try{xr(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=q(l);S=h.uid,g=f==="0:0:755"&&l===d(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&We(l)===l&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=u(s);try{le(i,o,(l)=>new w("vm_hands_mount_mismatch",l))}catch(l){if(i!==e.init.layout.session_root&&l instanceof w&&l.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw l}},installEnvironment(s,i){let l=p.get(s);if(!l)throw new w("environment_unavailable","no executor owns an environment");return at({root:e.root,operationId:l.operationId,payload:i}).installed_revision},async stop(){if(X)clearInterval(X);W?.close(),await Promise.all([...p.keys()].map((s)=>Y(s)))}};function xe(){try{return Z(d(r,M),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function $e(s,i,l=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=qe();try{await nn();let S=Date.now()+ee,h=new Set(xe().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=Y(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(G(d(T(a),"cgroup.events")))await te(T(a),S,"bind");await v}let N=[...f].map((a)=>T(a).replace(/^\/sys\/fs\/cgroup/,"")),D=["/",...[r,d(r,M)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),H=(a)=>c(a)||N.some((v)=>z(a,v))||D.some((v)=>ne(a,v)),A=l?[]:he(t).filter((a)=>!H(a));if(A.length)throw o("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size,...me(A)}),new w("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let E=(a)=>!H(a)&&!z(a,"/reason-vm-hands")&&!z(a,C)&&!D.some((v)=>ne(a,v));if(y!==null){let a=ge(y).filter((v)=>v!==process.pid&&E(v));if(a.length)throw o("vm_hands.kill_strays",{strays:re(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),Oe(a)}finally{g()}}}function oe(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function be(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ze(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=ke(e).filter((o)=>Se(o,e)),c=new Set(n.filter((o)=>{let u=oe(o);return u!==null&&u<=r}));for(let o=!0;o;){o=!1;for(let u of n){if(c.has(u))continue;let p=be(u);if(p!==null&&c.has(p))c.add(u),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,r,t="/proc"){try{return k(d(t,String(e),"cgroup"),"utf8").split(`
+`).filter(Boolean).slice(0,1000);if(!l.length)return null;let f={},g=0;for(let S of l)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:l.length,codes:f,max_elapsed_ms:g}),{count:l.length,codes:f,max_elapsed_ms:g}}catch{return null}},U=(s,i,l)=>Re(s,i,l),K=(s)=>(i,l,f)=>Ae("/bin/sh",["-c",`echo $$ > ${ve(d(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...l],f),Re=K(d(r,M)),j=d(r,M,"probe"),T=(s)=>Ee(r,s),Ce=(s)=>{let i=T(s);try{V(i,{mode:493})}catch(l){if(!(l&&typeof l==="object"&&("code"in l)&&l.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},Oe=(s)=>{try{de(T(s))}catch{}},W=e.prespawn?ao({spawnProcess:U,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;W?.arm();let X=W?setInterval(()=>{W.arm()},Ve):null;X?.unref?.();async function Y(s){let i=p.get(s);if(p.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:T,async startExecutor(s){if(I(),b.set(s.bindId,fe()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await Y(s.bindId);let{claim:i,bindId:l}=s,f=Ce(l),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,N=new Promise((a,v)=>{h=a,y=v}),D,C=new Promise((a)=>{D=a}),H=Nt({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(l,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...W?{takePrespawnedWorker:(a)=>{let v=W.take(a);if(!v?.pid)return v;try{return B(d(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:W.adopt}:{}}).then(()=>{D("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),D(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));p.set(l,{abort:S,done:H,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0});let A=await N,E=A.executor_launch_id;if(typeof E!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:A,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return p.get(s)?.exited??new Promise(()=>{})},freezeBind(s){let i=T(s);if(G(d(i,"cgroup.freeze")))B(d(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){let i=new Set(s?.keep??[]);if(await $e(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&G(d(O,"cgroup.events")))x(),await te(O,Date.now()+ee,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ee;if(G(d(j,"cgroup.events"))){await te(j,s,"probe");try{de(j)}catch{}}let i=oe(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Ze(r,i,s);let l=(g)=>{let S=oe(g);return S!==null&&S<=i},f=he(t).filter((g)=>l(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...me(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,d(r,M)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=ge(m).filter((y)=>y!==process.pid&&!c(y)&&!z(y,"/reason-vm-hands")&&!z(y,S)&&!g.some((N)=>ne(y,N)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:re(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:re(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(I(),!i.includes(pe))throw new w("vm_hands_probe_failed","probe names no proof directory");let l=e.proofParent??"/tmp/reason-vm-hands-proof";V(l,{mode:457,recursive:!0});let f=q(l);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Te(d(l,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Le(g,t,t),Me(g,448);let h=q(g).ino;try{V(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(pe,g).replaceAll(Ge,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),N="";y.stdout?.on("data",(C)=>{if(N.length<16384)N+=C.toString("utf8").slice(0,16384-N.length)});let D=await new Promise((C)=>{let H=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},je);y.once("error",()=>{clearTimeout(H),C(127)}),y.once("close",(A)=>{clearTimeout(H),C(A??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:D}),{exitCode:D,markers:N,proofDirInode:h}}finally{if(!S)He(g,{recursive:!0,force:!0})}},restatLayout(s){let i=u(s),l=i===e.init.layout.session_root?e.init.layout.alias:d(i,"repo"),f="invalid";try{xr(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=q(l);S=h.uid,g=f==="0:0:755"&&l===d(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&We(l)===l&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=u(s);try{le(i,o,(l)=>new w("vm_hands_mount_mismatch",l))}catch(l){if(i!==e.init.layout.session_root&&l instanceof w&&l.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw l}},installEnvironment(s,i){let l=p.get(s);if(!l)throw new w("environment_unavailable","no executor owns an environment");return at({root:e.root,operationId:l.operationId,payload:i}).installed_revision},async stop(){if(X)clearInterval(X);W?.close(),await Promise.all([...p.keys()].map((s)=>Y(s)))}};function xe(){try{return Z(d(r,M),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function $e(s,i,l=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=qe();try{await nn();let S=Date.now()+ee,h=new Set(xe().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=Y(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(G(d(T(a),"cgroup.events")))await te(T(a),S,"bind");await v}let N=[...f].map((a)=>T(a).replace(/^\/sys\/fs\/cgroup/,"")),D=["/",...[r,d(r,M)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),H=(a)=>c(a)||N.some((v)=>z(a,v))||D.some((v)=>ne(a,v)),A=l?[]:he(t).filter((a)=>!H(a));if(A.length)throw o("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size,...me(A)}),new w("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let E=(a)=>!H(a)&&!z(a,"/reason-vm-hands")&&!z(a,C)&&!D.some((v)=>ne(a,v));if(y!==null){let a=ge(y).filter((v)=>v!==process.pid&&E(v));if(a.length)throw o("vm_hands.kill_strays",{strays:re(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),Oe(a)}finally{g()}}}function oe(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function be(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ze(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=ke(e).filter((o)=>Se(o,e)),c=new Set(n.filter((o)=>{let u=oe(o);return u!==null&&u<=r}));for(let o=!0;o;){o=!1;for(let u of n){if(c.has(u))continue;let p=be(u);if(p!==null&&c.has(p))c.add(u),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,r,t="/proc"){try{return k(d(t,String(e),"cgroup"),"utf8").split(`
 `).find((c)=>c.startsWith("0::"))?.slice(3)===r}catch{return!1}}function z(e,r,t="/proc"){try{let c=k(d(t,String(e),"cgroup"),"utf8").split(`
 `).find((o)=>o.startsWith("0::"))?.slice(3)??"";return c===r||c.startsWith(`${r}/`)}catch{return!1}}var Xe=100;function fe(){try{return Math.floor(Number(k("/proc/uptime","utf8").split(" ")[0])*Xe)}catch{return 0}}async function te(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`${t} cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}while(!/^populated 0$/m.test(k(d(e,"cgroup.events"),"utf8"))){if(Date.now()>r)throw new w("vm_hands_kill_unverified",`${t} cgroup still populated (left frozen)`);for(let n of ke(e)){if(!Se(n,e))continue;try{process.kill(n,"SIGKILL")}catch{}}await new Promise((n)=>setTimeout(n,10))}try{B(d(e,"cgroup.freeze"),"0")}catch(n){throw new w("vm_hands_kill_unverified",`${t} cgroup thaw: ${n instanceof Error?n.message:String(n)}`)}}function Se(e,r){let t=r.replace(/^\/sys\/fs\/cgroup/,"")||"/",n="";try{n=k(`/proc/${e}/cgroup`,"utf8").split(`
 `).find((o)=>o.startsWith("0::"))??""}catch{return!1}let c=n.slice(3);return c===t||c.startsWith(`${t}/`)}function ke(e){let r=[],t=(n)=>{try{for(let o of k(d(n,"cgroup.procs"),"utf8").split(`
 `))if(/^\d+$/.test(o))r.push(Number(o))}catch{}let c=[];try{c=Z(n,{withFileTypes:!0}).filter((o)=>o.isDirectory()).map((o)=>o.name)}catch{}for(let o of c)t(d(n,o))};return t(e),r}function me(e,r="/proc"){let t=new Map;for(let c of e.slice(0,64)){let o=`${Ye(c,r)}:${Qe(c,r)}`;t.set(o,(t.get(o)??0)+1)}let n=[...t.entries()].sort((c,o)=>o[1]-c[1])[0]?.[0]??"none";return{count:e.length,cause:n}}function Ye(e,r){let t;try{t=(k(d(r,String(e),"cgroup"),"utf8").split(`
 `).find((n)=>n.startsWith("0::"))??"").slice(3)}catch{return"gone"}if(t==="/")return"root";if(t==="/reason-payload")return"payload";if(t.startsWith("/reason-payload/vm-hands/b-"))return"payload_bind";if(t==="/reason-payload/vm-hands"||t.startsWith("/reason-payload/vm-hands/"))return"payload_vm_hands";if(t.startsWith("/reason-payload/"))return"payload_sub";if(t==="/reason-person"||t.startsWith("/reason-person/"))return"person";if(t==="/reason-srt"||t.startsWith("/reason-srt/"))return"srt";if(t==="/reason-vm-hands"||t.startsWith("/reason-vm-hands/"))return"vm_hands";if(t==="/reason-workload"||t.startsWith("/reason-workload/"))return"workload";return"other"}function Qe(e,r){let t;try{t=k(d(r,String(e),"stat"),"utf8")}catch{return"gone"}let n=t.slice(t.lastIndexOf(")")+2,t.lastIndexOf(")")+3);return{R:"running",S:"sleeping",D:"disk",Z:"zombie",T:"stopped",t:"stopped",I:"idle"}[n]??"other"}function re(e,r="/proc"){return e.slice(0,16).map((t)=>{let n="?",c="?";try{n=k(d(r,String(t),"comm"),"utf8").trim().slice(0,32)}catch{}try{c=(k(d(r,String(t),"cgroup"),"utf8").split(`
 `).find((o)=>o.startsWith("0::"))??"").slice(3,120)}catch{}return{pid:t,comm:n,ppid:be(t,r),cgroup:c}})}function ge(e,r="/proc"){let t=[];for(let n of Z(r)){if(!/^\d+$/.test(n))continue;let c;try{c=k(d(r,n,"stat"),"utf8")}catch{continue}let o=c.slice(c.lastIndexOf(")")+2).split(" "),u=Number(o[1]),p=Number(o[6]),b=Number(o[19]),P=(p&2097152)!==0||u===2||n==="2",x=(o[0]==="Z"||o[0]==="X")&&o[17]==="1";if(!P&&!x&&b>=e)t.push(Number(n))}return t}function he(e,r="/proc"){let t=[];for(let n of Z(r)){if(!/^\d+$/.test(n))continue;let c;try{c=k(d(r,n,"status"),"utf8")}catch{continue}if(/^State:\s+[ZX]/m.test(c)&&/^Threads:\s+1$/m.test(c))continue;let o=/^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)/m.exec(c);if(o&&o.slice(1).some((u)=>Number(u)===e))t.push(Number(n))}return t}function _e(e="/proc/sys/kernel/yama/ptrace_scope"){try{return Number(k(e,"utf8").trim())>=1}catch{return!1}}var L=0,Pe=[],J=new Set;function qe(){L++;let e=!1;return()=>{if(e)return;if(e=!0,--L===0)for(let r of Pe.splice(0))r()}}function en(){return L===0?Promise.resolve():new Promise((e)=>{Pe.push(e)})}async function ye(){while(L>0)await en()}async function nn(){let e=Date.now()+1000;while(J.size&&Date.now()<e)await new Promise((r)=>setTimeout(r,2))}function tn(e,r){let t=r.replace(/^\/sys\/fs\/cgroup/,"");J.add(e);let n=()=>{let c="";try{c=k(`/proc/${e}/cgroup`,"utf8").split(`
-`).find((o)=>o.startsWith("0::"))??""}catch{J.delete(e);return}if(c.slice(3)===t){J.delete(e);return}setTimeout(n,1)};n()}function hn(e){let r={person:e.personCgroup??d("/sys/fs/cgroup",se,M),model:e.payloadCgroup??d(we,M),surface:e.surfaceCgroup??d("/sys/fs/cgroup",se,M,Ke)},t=e.entry??process.argv[1]??"",n={},c=(u)=>u.startsWith("model:")&&e.bindCgroup?e.bindCgroup(u.slice(6)):r[u.startsWith("model")?"model":u==="surface"?"surface":"person"],o=(u)=>{let p=u.startsWith("model")?"model":u==="surface"?"surface":"person",b=new Map,P=String(e.payloadUid),x=String(e.payloadGid);if(p==="surface")try{V(c(u),{mode:493})}catch{}let m=p==="surface"?'exec "$@"':`exec /usr/bin/setpriv --no-new-privs --reuid=${P} --regid=${x} --clear-groups -- "$@"`,_=Bun.spawn(["/bin/sh","-c",`echo $$ > ${ve(d(c(u),"cgroup.procs"))} || exit 125; ${m}`,"vm-hands-op-join",process.execPath,"--no-install",t,"--vm-hands-op-runner",...p==="person"?[ur]:[],...p==="surface"?[dr,`${Tt}${P}`,`${Rt}${e.surfaceDirectory??""}`]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:p==="surface"?process.env.HOME||"/root":"/home/runner",...G("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(I){let R=I;if(p==="surface"&&R.t==="readiness"){let U=I;e.log?.("vm_hands.surface_ready",{lanes:Object.keys(U.lanes??{}).filter((K)=>U.lanes[K]===!0),display_video:U.display_video===!0}),e.onSurfaceReadiness?.(U);return}let F=b.get(R.id);if(!F)return;if(R.t==="event"&&R.event)F.onEvent(R.event);if(R.t==="done")b.delete(R.id),F.done(R.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});_.exited.then((I)=>{if(n[u]?.child===_)delete n[u];for(let[,R]of b)R.done({status:"failed",error_code:"vm_hands_op_runner_exited"});if(b.clear(),e.log?.("vm_hands.op_runner_exited",{kind:p,code:I}),p==="surface")e.onSurfaceReadiness?.(null)}),tn(_.pid,c(u));let O={child:_,pending:b};return n[u]=O,O};return{run(u,p,b,P,x){if(!_e())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=u==="model"&&x&&e.bindCgroup?`model:${x.toLowerCase()}`:u,_=async()=>{while(!n[m]&&L>0)await ye()};return _().then(async()=>{if(!n[m]&&L>0)await _()}).then(()=>new Promise((O)=>{if(!n[m]&&L>0){O({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let I=n[m]??o(m);I.pending.set(p.id,{onEvent:b,done:O}),P.addEventListener("abort",()=>{try{I.child.send({t:"cancel",id:p.id})}catch{}},{once:!0});try{I.child.send({t:"op",...p})}catch{I.pending.delete(p.id),O({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(u){if(!n[u]&&_e())ye().then(()=>{if(!n[u]&&L===0)o(u)})},notify(u,p){let b=n[u];if(!b)return!1;try{return b.child.send(p),!0}catch{return!1}},stop(){for(let u of Object.keys(n))n[u]?.child.kill()}}}export{we as VM_HANDS_PAYLOAD_CGROUP,M as VM_HANDS_PAYLOAD_JOIN,se as VM_HANDS_PERSON_CGROUP,Ge as VM_HANDS_PROBE_NONCE_TOKEN,pe as VM_HANDS_PROOF_DIR_TOKEN,Ke as VM_HANDS_SURFACE_JOIN,Fe as VM_HANDS_WORKLOAD_CGROUP,w as VmHandsExecutorError,gn as createVmHandsExecutor,hn as createVmHandsOpRunners,re as describeProcesses,z as inCgroup,he as payloadUidProcesses,ge as processesStartedSince,_e as ptraceProtected,ke as subtreePids,me as survivorSummary,Ee as vmHandsBindCgroup,Je as vmHandsSessionRoot};
+`).find((o)=>o.startsWith("0::"))??""}catch{J.delete(e);return}if(c.slice(3)===t){J.delete(e);return}setTimeout(n,1)};n()}function hn(e){let r={person:e.personCgroup??d("/sys/fs/cgroup",se,M),model:e.payloadCgroup??d(we,M),surface:e.surfaceCgroup??d("/sys/fs/cgroup",se,M,Ke)},t=e.entry??process.argv[1]??"",n={},c=(u)=>u.startsWith("model:")&&e.bindCgroup?e.bindCgroup(u.slice(6)):r[u.startsWith("model")?"model":u==="surface"?"surface":"person"],o=(u)=>{let p=u.startsWith("model")?"model":u==="surface"?"surface":"person",b=new Map,P=String(e.payloadUid),x=String(e.payloadGid);if(p==="surface")try{V(c(u),{mode:493})}catch{}let m=p==="surface"?'exec "$@"':`exec /usr/bin/setpriv --no-new-privs --reuid=${P} --regid=${x} --clear-groups -- "$@"`,_=Bun.spawn(["/bin/sh","-c",`echo $$ > ${ve(d(c(u),"cgroup.procs"))} || exit 125; ${m}`,"vm-hands-op-join",process.execPath,"--no-install",t,"--vm-hands-op-runner",...p==="person"?[ur]:[],...p==="surface"?[dr,`${Rt}${P}`,`${Tt}${e.surfaceDirectory??""}`]:[]],{cwd:"/",env:{PATH:process.env.PATH??"/usr/bin:/bin",BUN_BE_BUN:"1",HOME:p==="surface"?process.env.HOME||"/root":"/home/runner",...G("/bin/bash")?{SHELL:"/bin/bash"}:{}},stdio:["ignore","ignore","ignore"],ipc(I){let R=I;if(p==="surface"&&R.t==="readiness"){let U=I;e.log?.("vm_hands.surface_ready",{lanes:Object.keys(U.lanes??{}).filter((K)=>U.lanes[K]===!0),display_video:U.display_video===!0}),e.onSurfaceReadiness?.(U);return}let F=b.get(R.id);if(!F)return;if(R.t==="event"&&R.event)F.onEvent(R.event);if(R.t==="done")b.delete(R.id),F.done(R.completion??{status:"failed",error_code:"vm_hands_op_failed"})}});_.exited.then((I)=>{if(n[u]?.child===_)delete n[u];for(let[,R]of b)R.done({status:"failed",error_code:"vm_hands_op_runner_exited"});if(b.clear(),e.log?.("vm_hands.op_runner_exited",{kind:p,code:I}),p==="surface")e.onSurfaceReadiness?.(null)}),tn(_.pid,c(u));let O={child:_,pending:b};return n[u]=O,O};return{run(u,p,b,P,x){if(!_e())return Promise.resolve({status:"failed",error_code:"vm_hands_ptrace_unprotected"});let m=u==="model"&&x&&e.bindCgroup?`model:${x.toLowerCase()}`:u,_=async()=>{while(!n[m]&&L>0)await ye()};return _().then(async()=>{if(!n[m]&&L>0)await _()}).then(()=>new Promise((O)=>{if(!n[m]&&L>0){O({status:"failed",error_code:"vm_hands_op_runner_unavailable"});return}let I=n[m]??o(m);I.pending.set(p.id,{onEvent:b,done:O}),P.addEventListener("abort",()=>{try{I.child.send({t:"cancel",id:p.id})}catch{}},{once:!0});try{I.child.send({t:"op",...p})}catch{I.pending.delete(p.id),O({status:"failed",error_code:"vm_hands_op_runner_unavailable"})}}))},warm(u){if(!n[u]&&_e())ye().then(()=>{if(!n[u]&&L===0)o(u)})},notify(u,p){let b=n[u];if(!b)return!1;try{return b.child.send(p),!0}catch{return!1}},stop(){for(let u of Object.keys(n))n[u]?.child.kill()}}}export{we as VM_HANDS_PAYLOAD_CGROUP,M as VM_HANDS_PAYLOAD_JOIN,se as VM_HANDS_PERSON_CGROUP,Ge as VM_HANDS_PROBE_NONCE_TOKEN,pe as VM_HANDS_PROOF_DIR_TOKEN,Ke as VM_HANDS_SURFACE_JOIN,Fe as VM_HANDS_WORKLOAD_CGROUP,w as VmHandsExecutorError,gn as createVmHandsExecutor,hn as createVmHandsOpRunners,re as describeProcesses,z as inCgroup,he as payloadUidProcesses,ge as processesStartedSince,_e as ptraceProtected,ke as subtreePids,me as survivorSummary,Ee as vmHandsBindCgroup,Je as vmHandsSessionRoot};

package/bin/vm-hands/vm-hands-op-runner-mzyesbyf.js

@@ -0,0 +1,2 @@
+// @bun
+import{ur,dr,Rt,Tt,Ot,vs}from"./vm-hands-entry-lite-nb0n1vy1.js";export{ur as VM_HANDS_OP_RUNNER_PERSON_ARG,dr as VM_HANDS_OP_RUNNER_SURFACE_ARG,Tt as VM_HANDS_SURFACE_DIRECTORY_ARG,Ot as VM_HANDS_SURFACE_OPS,Rt as VM_HANDS_SURFACE_UID_ARG,vs as runVmHandsOpRunner};

package/bin/vm-hands/{vm-hands-runtime-gsjba3vg.js → vm-hands-runtime-zhsw99cm.js}

@@ -1,4 +1,4 @@
 // @bun
-import{rt}from"./vm-hands-entry-lite-ydgedg8n.js";import"./vm-hands-entry-lite-mma9qt5r.js";import{Ot}from"./vm-hands-entry-lite-gtnpk3sc.js";import{Hi,pn,zi}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
-`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function B(r,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((y)=>N(y,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[y,m]of[[a,!1],["/usr/local/bin",!0]]){let _=N(y);if((m?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),g=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:g}),u()})})}var Y=3000;function Re(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(r){j(r,{recursive:!0,mode:448});let n=te(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ce(r){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-0r7g0x44.js"),import("./hands-worker-source-h0qmr1jt.js"),import("./network-contract-4wew8f21.js"),import("./device-workspace-qjyzphga.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-6fxcbhzd.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:rt,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:X.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function _e(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=r.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let g=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of g)l[c]=s.operation_constraints[c];return{...r,capabilities:{...a,supported_operations:["hands.connect",...I,...g],operation_constraints:l}}}function pe(r){for(let n of G("/etc/passwd","utf8").split(`
-`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(r,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(r,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((o)=>setTimeout(()=>o(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:g},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-j6fjngt1.js"),import("./worker-sandbox-j6cmex8e.js")]);c();try{g({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,y=new Promise((e)=>{f=e}),m=y.then(()=>import("./vm-hands-executor-v24y415a.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:V,runtimeDirectory:O,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(r,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),o}),_=(e)=>async(...o)=>(await m)[e](...o),x=null;m.then((e)=>{x=(o)=>e.executorExited(o)});let S={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};m.then((e)=>{S.restatLayout=(o)=>e.restatLayout(o),S.verifyMounts=(o)=>e.verifyMounts(o),S.installEnvironment=(o,d)=>e.installEnvironment(o,d),S.freezeBind=(o)=>e.freezeBind(o),S.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await Hi(r),C=new pn(r,q,S,{envRoot:W}),M=ce(r),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-wj42bc6s.js")]).then(([e,o])=>{K=()=>_e(e,o.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=y.then(()=>import("./vm-hands-executor-v24y415a.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:r.layout.payload_uid,payloadGid:pe(r.layout.payload_uid),bindCgroup:(i)=>o(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+le;while(C.settingUp&&Date.now()<o)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await zi({apiOrigin:r.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:o,bindId:d,signal:i,emit:E})=>{let k=fe(r,o);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=o.capability==="pty.start"&&e==="person"&&!o.authority;if(de.has(String(o.capability))&&!Z){let{executeLocalOperation:p}=await import("./local-capabilities-wj42bc6s.js");return p(k,o,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Ot.has(String(o.capability))){if(w.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(o.attempt_id),claim:o,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(o.attempt_id),claim:o,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:o})=>Ot.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,o)},onTurn:(e,o)=>{if(o)u.set(e,o);else u.delete(e)}}),await(await m).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};
+import{rt}from"./vm-hands-entry-lite-88yjxxvf.js";import"./vm-hands-entry-lite-mfvtp7py.js";import{Ot}from"./vm-hands-entry-lite-nb0n1vy1.js";import{zi,pn,qi}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
+`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function B(r,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((y)=>N(y,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[y,m]of[[a,!1],["/usr/local/bin",!0]]){let _=N(y);if((m?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),g=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:g}),u()})})}var Y=3000;function Re(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(r){j(r,{recursive:!0,mode:448});let n=te(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ce(r){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-whw9wgya.js"),import("./hands-worker-source-hzkacxxz.js"),import("./network-contract-5wc6wbn2.js"),import("./device-workspace-qjyzphga.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-zffy7kc8.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:rt,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:X.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function _e(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=r.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let g=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of g)l[c]=s.operation_constraints[c];return{...r,capabilities:{...a,supported_operations:["hands.connect",...I,...g],operation_constraints:l}}}function pe(r){for(let n of G("/etc/passwd","utf8").split(`
+`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(r,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(r,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((o)=>setTimeout(()=>o(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:g},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-gm7m5bwr.js"),import("./worker-sandbox-k0vx97tx.js")]);c();try{g({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,y=new Promise((e)=>{f=e}),m=y.then(()=>import("./vm-hands-executor-5n4k8t53.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:V,runtimeDirectory:O,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(r,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),o}),_=(e)=>async(...o)=>(await m)[e](...o),x=null;m.then((e)=>{x=(o)=>e.executorExited(o)});let S={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};m.then((e)=>{S.restatLayout=(o)=>e.restatLayout(o),S.verifyMounts=(o)=>e.verifyMounts(o),S.installEnvironment=(o,d)=>e.installEnvironment(o,d),S.freezeBind=(o)=>e.freezeBind(o),S.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await zi(r),C=new pn(r,q,S,{envRoot:W}),M=ce(r),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-mvnm7kc8.js")]).then(([e,o])=>{K=()=>_e(e,o.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=y.then(()=>import("./vm-hands-executor-5n4k8t53.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:r.layout.payload_uid,payloadGid:pe(r.layout.payload_uid),bindCgroup:(i)=>o(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+le;while(C.settingUp&&Date.now()<o)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await qi({apiOrigin:r.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:o,bindId:d,signal:i,emit:E})=>{let k=fe(r,o);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=o.capability==="pty.start"&&e==="person"&&!o.authority;if(de.has(String(o.capability))&&!Z){let{executeLocalOperation:p}=await import("./local-capabilities-mvnm7kc8.js");return p(k,o,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Ot.has(String(o.capability))){if(w.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(o.attempt_id),claim:o,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(o.attempt_id),claim:o,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:o})=>Ot.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,o)},onTurn:(e,o)=>{if(o)u.set(e,o);else u.delete(e)}}),await(await m).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};

package/bin/vm-hands/worker-preview-readiness-8ftb3nbw.js

@@ -0,0 +1,2 @@
+// @bun
+import{Cs}from"./vm-hands-entry-lite-0tavq3p4.js";import"./vm-hands-entry-lite-kwmjn9y3.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Cs as probeWorkerPreview};

package/bin/vm-hands/worker-sandbox-k0vx97tx.js

@@ -0,0 +1,2 @@
+// @bun
+import{ks}from"./vm-hands-entry-lite-f8ts9y2q.js";import"./vm-hands-entry-lite-wfc0agnt.js";import"./vm-hands-entry-lite-a6w60nv9.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{ks as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-x64",
-  "version": "0.2.521",
+  "version": "0.2.523",
   "description": "Reason CLI native binary for linux-x64",
   "os": [
     "linux"

package/bin/vm-hands/api-693jj5gc.js

@@ -1,2 +0,0 @@
-// @bun
-import{I,ks,Qo}from"./vm-hands-entry-lite-cwsjrxqj.js";import"./vm-hands-entry-lite-v0zva5nj.js";import"./vm-hands-entry-lite-etg5ft0x.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{I as ApiError,Qo as ReasonApi,ks as createMachineEnrollmentTicketWithToken};

package/bin/vm-hands/api-credentials-jed7tp30.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ui,Xo,Yo,xs}from"./vm-hands-entry-lite-gj1ce9nc.js";import"./vm-hands-entry-lite-cwsjrxqj.js";import"./vm-hands-entry-lite-v0zva5nj.js";import"./vm-hands-entry-lite-etg5ft0x.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Ui as apiOriginFromEnvironment,Yo as environmentApiKey,Xo as explicitApiOrigin,xs as resolveApiCredentials};

package/bin/vm-hands/connect-cli-wstfzzds.js

@@ -1,2 +0,0 @@
-// @bun
-import{it,ys,bs,vs}from"./vm-hands-entry-lite-d7kdqz8w.js";import"./vm-hands-entry-lite-60pnam39.js";import"./vm-hands-entry-lite-wzq3qsh1.js";import"./vm-hands-entry-lite-gj1ce9nc.js";import"./vm-hands-entry-lite-cwsjrxqj.js";import"./vm-hands-entry-lite-v0zva5nj.js";import"./vm-hands-entry-lite-spb0z2m4.js";import"./vm-hands-entry-lite-25yzr6m8.js";import"./vm-hands-entry-lite-5np5k3wb.js";import"./vm-hands-entry-lite-wh0xwp85.js";import"./vm-hands-entry-lite-423rvptb.js";import"./vm-hands-entry-lite-dcrz19xf.js";import"./vm-hands-entry-lite-q80xmhrx.js";import"./vm-hands-entry-lite-90y6pf98.js";import"./vm-hands-entry-lite-ymqb2927.js";import"./vm-hands-entry-lite-zk6hbpa3.js";import"./vm-hands-entry-lite-y5b73xe5.js";import"./vm-hands-entry-lite-4wgq9vfr.js";import"./vm-hands-entry-lite-wx1fmrbs.js";import"./vm-hands-entry-lite-3f6bayc8.js";import"./vm-hands-entry-lite-1nrxnm0y.js";import"./vm-hands-entry-lite-qxeegp2n.js";import"./vm-hands-entry-lite-gh0yjzye.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-fgppp6x9.js";import"./vm-hands-entry-lite-x9qp374y.js";import"./vm-hands-entry-lite-g6fr9e30.js";import"./vm-hands-entry-lite-etg5ft0x.js";import"./vm-hands-entry-lite-19dpjtpb.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-ydgedg8n.js";import"./vm-hands-entry-lite-mma9qt5r.js";import"./vm-hands-entry-lite-148nz8be.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{ys as computerDisconnected,it as connectionDirectory,bs as connectionReport,vs as restartConnection};

package/bin/vm-hands/credentials-yf556ykn.js

@@ -1,2 +0,0 @@
-// @bun
-import{Fe,un,It,dn}from"./vm-hands-entry-lite-v0zva5nj.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{Fe as credentialsPath,dn as deleteCredentials,It as loadCredentials,un as saveCredentials};

package/bin/vm-hands/custom-endpoint-device-vbct7bj9.js

@@ -1,2 +0,0 @@
-// @bun
-import{nt,Et,cr,on,xt,kt,Oi,sn,Ii,Di,Ni}from"./vm-hands-entry-lite-mma9qt5r.js";export{nt as CUSTOM_ENDPOINT_DEVICE_CAPABILITY,Et as CUSTOM_ENDPOINT_DEVICE_CHUNK_BYTES,xt as CUSTOM_ENDPOINT_DEVICE_MAX_BODY_BYTES,on as CUSTOM_ENDPOINT_DEVICE_MAX_CHUNKS,kt as CUSTOM_ENDPOINT_DEVICE_MAX_PAYLOAD_BYTES,cr as CUSTOM_ENDPOINT_DEVICE_MAX_RESPONSE_BYTES,Oi as CUSTOM_ENDPOINT_DEVICE_TIMEOUT_MS,Di as CustomEndpointDeviceCredentialSchema,Ii as CustomEndpointDeviceRequestSchema,sn as customEndpointRequestMatchesConfig,Ni as isCustomEndpointDeviceFailureCode};

package/bin/vm-hands/desktop-account-j6fjngt1.js

@@ -1,2 +0,0 @@
-// @bun
-import{qs,K,Ln}from"./vm-hands-entry-lite-wx1fmrbs.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{qs as configureDesktopAccount,K as desktopAccount,Ln as desktopHome};

package/bin/vm-hands/install-receipt-gwv1qv2m.js

@@ -1,2 +0,0 @@
-// @bun
-import{us,Jr,Qn,Zr,ei}from"./vm-hands-entry-lite-19dpjtpb.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{us as FUTURE_DEVICE_CONSENT_SCOPE,Jr as installationReceiptPath,Zr as installerReasonAlias,Qn as installerReceiptLauncher,ei as loadInstallationReceipt};

package/bin/vm-hands/local-automation-06wtwxjp.js

@@ -1,2 +0,0 @@
-// @bun
-import{Pn,Fs,js,Us,Hs,Tn}from"./vm-hands-entry-lite-zk6hbpa3.js";import"./vm-hands-entry-lite-y5b73xe5.js";import"./vm-hands-entry-lite-4wgq9vfr.js";import"./vm-hands-entry-lite-wx1fmrbs.js";import"./vm-hands-entry-lite-3f6bayc8.js";import"./vm-hands-entry-lite-1nrxnm0y.js";import"./vm-hands-entry-lite-qxeegp2n.js";import"./vm-hands-entry-lite-gh0yjzye.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-fgppp6x9.js";import"./vm-hands-entry-lite-x9qp374y.js";import"./vm-hands-entry-lite-g6fr9e30.js";import"./vm-hands-entry-lite-etg5ft0x.js";import"./vm-hands-entry-lite-19dpjtpb.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-ydgedg8n.js";import"./vm-hands-entry-lite-mma9qt5r.js";import"./vm-hands-entry-lite-148nz8be.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{js as ensureLocalBrowser,Pn as localAutomationAvailable,Us as localBrowserProfile,Fs as localUserChromeHost,Hs as runAutomationCallLocally,Tn as runLocalAutomation};

package/bin/vm-hands/local-capabilities-wj42bc6s.js

@@ -1,2 +0,0 @@
-// @bun
-import{es,qi,mn,ts,rs,ns,is,Ds,Ns,Ls,Ms}from"./vm-hands-entry-lite-25yzr6m8.js";import"./vm-hands-entry-lite-5np5k3wb.js";import"./vm-hands-entry-lite-wh0xwp85.js";import"./vm-hands-entry-lite-423rvptb.js";import"./vm-hands-entry-lite-dcrz19xf.js";import"./vm-hands-entry-lite-q80xmhrx.js";import"./vm-hands-entry-lite-90y6pf98.js";import"./vm-hands-entry-lite-ymqb2927.js";import"./vm-hands-entry-lite-zk6hbpa3.js";import"./vm-hands-entry-lite-y5b73xe5.js";import"./vm-hands-entry-lite-4wgq9vfr.js";import"./vm-hands-entry-lite-wx1fmrbs.js";import"./vm-hands-entry-lite-3f6bayc8.js";import"./vm-hands-entry-lite-1nrxnm0y.js";import"./vm-hands-entry-lite-qxeegp2n.js";import"./vm-hands-entry-lite-gh0yjzye.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-fgppp6x9.js";import"./vm-hands-entry-lite-x9qp374y.js";import"./vm-hands-entry-lite-g6fr9e30.js";import"./vm-hands-entry-lite-etg5ft0x.js";import"./vm-hands-entry-lite-19dpjtpb.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-ydgedg8n.js";import"./vm-hands-entry-lite-mma9qt5r.js";import"./vm-hands-entry-lite-148nz8be.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{r as LocalCapabilityError,es as SHORT_REQUEST_CAPABILITIES,Ds as capabilityInventoryForRoots,qi as confinedExecutionShell,ts as defaultLocalCommandRunner,Ns as deliverLocalHandsEnvironment,is as enrolledRootPaths,Ms as executeLocalOperation,Ls as rebindLocalHandsControl,rs as runFileCapability,ns as runTransferCapability,mn as spawnCaptured};

package/bin/vm-hands/local-desktop-users-4hc6jysa.js

@@ -1,2 +0,0 @@
-// @bun
-import{Pt,wa,ba,Fi,ji}from"./vm-hands-entry-lite-148nz8be.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{wa as forgetLocalDesktopUse,ji as holdLocalDesktop,Pt as noteLocalDesktopUse,ba as releaseLocalDesktop,Fi as trackDesktopRun};

package/bin/vm-hands/local-display-mac-fjeyb4h9.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ge,pt,Bn,Fn}from"./vm-hands-entry-lite-1nrxnm0y.js";export{Ge as macScreenStatus,Fn as openMacInput,Bn as openMacWindowBounds,pt as requestMacScreenAccess};

package/bin/vm-hands/local-display-session-n5pv37tf.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ft,zs,G,qe,jt}from"./vm-hands-entry-lite-y5b73xe5.js";import"./vm-hands-entry-lite-4wgq9vfr.js";import"./vm-hands-entry-lite-wx1fmrbs.js";import"./vm-hands-entry-lite-3f6bayc8.js";import"./vm-hands-entry-lite-1nrxnm0y.js";import"./vm-hands-entry-lite-qxeegp2n.js";import"./vm-hands-entry-lite-gh0yjzye.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-fgppp6x9.js";import"./vm-hands-entry-lite-g6fr9e30.js";import"./vm-hands-entry-lite-etg5ft0x.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-148nz8be.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{qe as ensureLinuxDesktop,Ft as localDisplayAvailable,zs as localDisplayReady,G as privateDirectory,jt as runLocalDisplayStream};

package/bin/vm-hands/local-display-video-kdybca06.js

@@ -1,2 +0,0 @@
-// @bun
-import{On,In,Dn,Nn,Tr}from"./vm-hands-entry-lite-4wgq9vfr.js";import"./vm-hands-entry-lite-wx1fmrbs.js";import"./vm-hands-entry-lite-3f6bayc8.js";import"./vm-hands-entry-lite-1nrxnm0y.js";import"./vm-hands-entry-lite-g6fr9e30.js";import"./vm-hands-entry-lite-etg5ft0x.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{On as MAC_SCREEN,In as WINDOWS_SCREEN,Dn as createDisplayVideoLane,Tr as localDisplayVideoAvailable,Nn as simulatorVideoFfmpeg};

package/bin/vm-hands/local-managed-process-c890ref6.js

@@ -1,2 +0,0 @@
-// @bun
-import{st,fr,$s,Bs}from"./vm-hands-entry-lite-wh0xwp85.js";import"./vm-hands-entry-lite-423rvptb.js";import"./vm-hands-entry-lite-dcrz19xf.js";import"./vm-hands-entry-lite-q80xmhrx.js";import"./vm-hands-entry-lite-90y6pf98.js";import"./vm-hands-entry-lite-ymqb2927.js";import"./vm-hands-entry-lite-wx1fmrbs.js";import"./vm-hands-entry-lite-gh0yjzye.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-fgppp6x9.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-ydgedg8n.js";import"./vm-hands-entry-lite-mma9qt5r.js";import"./vm-hands-entry-lite-148nz8be.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{st as ManagedProcessStoppedError,$s as controlManagedDeviceProcess,Bs as retireManagedDeviceProcess,fr as runManagedDeviceProcess};

package/bin/vm-hands/local-pty-session-4h4ekakp.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ir,Vt,Dr,cs,jn,Nr,Un}from"./vm-hands-entry-lite-qxeegp2n.js";import"./vm-hands-entry-lite-gh0yjzye.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-fgppp6x9.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{Vt as LOCAL_PTY_MAX_BUFFERED_OUTPUT_BYTES,Dr as LOCAL_PTY_MAX_SESSIONS,Ir as LOCAL_PTY_MAX_SESSION_MS,Nr as defaultConnect,cs as defaultLoginShell,jn as ptyRuntimeSupported,Un as runLocalPtySession};

package/bin/vm-hands/managed-runtime-ar9pn1mp.js

@@ -1,2 +0,0 @@
-// @bun
-import{Cs,As,Ps,Ts,Rs,Os,Is}from"./vm-hands-entry-lite-spb0z2m4.js";import"./vm-hands-entry-lite-ymqb2927.js";import"./vm-hands-entry-lite-g6fr9e30.js";import"./vm-hands-entry-lite-etg5ft0x.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Rs as acquireManagedRuntimeDirectoryLock,Ps as currentManagedRuntimeVersion,Is as flushManagedRuntimeLifecycleEvents,Ts as isManagedRuntimeVersionExecutable,As as legacyManagedRuntimePaths,Cs as managedRuntimePaths,Os as recordManagedRuntimeLifecycle};

package/bin/vm-hands/network-contract-4wew8f21.js

@@ -1,2 +0,0 @@
-// @bun
-import{rt,Te,Qs,ea,ta,ni,ra,nn,ii,vt,oi,si,ai,ci,li,ui,di,pi,hi,fi,mi,gi,_i,yi,wi,bi,pe,Y,Re,q,vi,Si,Ei,Q,xi,ki,Ci,Ai,Pi,St,Ti,na,ar,Ri,ia,ds,oa,sa,aa,ca,la,ua,da,pa,ha,fa,ma,ga,_a,ya}from"./vm-hands-entry-lite-ydgedg8n.js";import"./vm-hands-entry-lite-mma9qt5r.js";export{Ti as AUTOMATION_CLOUD_SESSIONS,St as AUTOMATION_USER_CHROME,mi as HANDS_CLOUD_ACCESS,gi as HANDS_CLOUD_ACCESS_KEY,pe as HANDS_CONFINEMENT,Y as HANDS_CONFINEMENT_KEY,ci as HANDS_ENVIRONMENT_AT_CLAIM,li as HANDS_ENVIRONMENT_AT_CLAIM_KEY,ii as HANDS_ENVIRONMENT_DELIVERY,vt as HANDS_ENVIRONMENT_DELIVER_CONTROL,_i as HANDS_HEADLESS_BROWSER,yi as HANDS_HEADLESS_BROWSER_KEY,vi as HANDS_JOBS_USER,Si as HANDS_JOBS_USER_KEY,wi as HANDS_LARGE_ENVIRONMENT,bi as HANDS_LARGE_ENVIRONMENT_KEY,Re as HANDS_MODEL_JOBS_EGRESS,q as HANDS_MODEL_JOBS_EGRESS_KEY,pi as HANDS_REBIND,fi as HANDS_REBIND_CONTROL,hi as HANDS_REBIND_KEY,xi as HANDS_SESSION_CAP_KEY,ki as HANDS_SESSION_CAP_NONE,Ei as HANDS_SESSION_GROUP,Q as HANDS_SESSION_GROUP_KEY,ui as HANDS_WORKSPACE_CHECK,di as HANDS_WORKSPACE_CHECK_KEY,Ai as JOBS_START_WAIT,Pi as JOBS_START_WAIT_KEY,Te as LOCAL_OPERATION_MAX_BYTES,rt as LOCAL_RUNTIME_PROTOCOL_VERSION,ta as LOCAL_RUNTIME_ROUTES,nn as LOCAL_RUNTIME_SESSION_CLAIM_WAIT_MAX_MS,ni as LOCAL_RUNTIME_SESSION_PATH,ar as LOCAL_RUNTIME_WORKER_STARTUP_MAX_MS,Qs as RELAY_HOST_ALIAS_HEADER,ea as RELAY_HOST_ALIAS_VERSION,ai as VM_HANDS_UNBIND_UNVERIFIED_EVENT,oi as VM_HANDS_WORKSPACE_DEFERRED_KEY,si as VM_HANDS_WORKSPACE_GRANT_CONTROL,Ci as WORKER_PREVIEW_CARRIED_JOBS,na as WORKER_STARTUP_TIMING_STAGES,Ri as buildLocalRuntimeDeviceProofBytes,ra as localRuntimeSessionRoutable,da as parseLocalRuntimeDisconnectResponse,sa as parseLocalRuntimeEnrollmentResponse,ia as parseLocalRuntimeErrorEnvelope,ca as parseLocalRuntimeFirstHeartbeat,aa as parseLocalRuntimeHeartbeatResponse,ua as parseLocalRuntimeIdentityResponse,ha as parseLocalRuntimeLifecycleResponse,pa as parseLocalRuntimeLocalSubscriptionResponse,fa as parseLocalRuntimeOperationClaim,ya as parseLocalRuntimeOperationCompletionResponse,_a as parseLocalRuntimeOperationEnvironmentResponse,ga as parseLocalRuntimeOperationEventsResponse,ma as parseLocalRuntimeOperationHeartbeatResponse,ds as parseLocalRuntimeProofChallenge,oa as parseLocalRuntimeRegistrationResponse,la as parseLocalRuntimeRootsSyncResponse};

package/bin/vm-hands/package-sng72tm1.js

@@ -1,2 +0,0 @@
-// @bun
-import{hn}from"./vm-hands-entry-lite-svd5v9dr.js";export default hn();

package/bin/vm-hands/permissions-t03k97w0.js

@@ -1,2 +0,0 @@
-// @bun
-import{ss,as,Ws,Vs}from"./vm-hands-entry-lite-3f6bayc8.js";import"./vm-hands-entry-lite-1nrxnm0y.js";import"./vm-hands-entry-lite-g6fr9e30.js";import"./vm-hands-entry-lite-etg5ft0x.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{Vs as allowMacPermissions,Ws as permissionsSummary,as as readMacPermissions,ss as reasonIdentity};

package/bin/vm-hands/serve-service-nrb9h8af.js

@@ -1,2 +0,0 @@
-// @bun
-import{Wr,xe,J,Kn,Gs,Ro,Ks,Ye,ls,Jn,Js,Zs,Vr,Xs,Ys}from"./vm-hands-entry-lite-x9qp374y.js";import"./vm-hands-entry-lite-g6fr9e30.js";import"./vm-hands-entry-lite-etg5ft0x.js";import"./vm-hands-entry-lite-19dpjtpb.js";import"./vm-hands-entry-lite-5eg3tgdq.js";import"./vm-hands-entry-lite-fcvf8md1.js";import"./vm-hands-entry-lite-0sh835na.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Wr as WORKER_SERVICE_ENV,J as WorkerServiceError,Ro as connectServiceLabel,xe as defaultWorkerServiceHost,Zs as installWorkerService,Ye as installedWorkerService,Ks as isConnectServiceLabel,Ys as removeWorkerService,Vr as restartWorkerService,Xs as retargetWorkerServiceLogs,ls as retireLegacyWorkerService,Js as workerServiceDefinitionCurrent,Kn as workerServiceLauncher,Jn as workerServiceProcessRunning,Gs as workerServiceRetargetPending};

package/bin/vm-hands/version-0r7g0x44.js

@@ -1,2 +0,0 @@
-// @bun
-import{Qe,Yn}from"./vm-hands-entry-lite-etg5ft0x.js";export{Yn as CLI_USER_AGENT,Qe as CLI_VERSION};

package/bin/vm-hands/vm-hands-entry-lite-60pnam39.js

@@ -1,3 +0,0 @@
-// @bun
-import{Wi,Vi}from"./vm-hands-entry-lite-5np5k3wb.js";function Ss(o=process.platform){if(Wi(),o==="linux"||o==="win32")Vi("strict")}
-export{Ss};

package/bin/vm-hands/vm-hands-entry-lite-etg5ft0x.js

@@ -1,2 +0,0 @@
-// @bun
-import{tr}from"./vm-hands-entry-lite-1jdt74g0.js";var Qe=tr.version,Yn=`reason-cli/${Qe}`;export{Qe,Yn};

package/bin/vm-hands/vm-hands-entry-lite-y5b73xe5.js

@@ -1,128 +0,0 @@
-// @bun
-import{Mn,Co,Wt}from"./vm-hands-entry-lite-1nrxnm0y.js";import{Rn,Ve,mo,On,In,Dn,Tr,x}from"./vm-hands-entry-lite-4wgq9vfr.js";import{Pt}from"./vm-hands-entry-lite-148nz8be.js";import{Nr}from"./vm-hands-entry-lite-qxeegp2n.js";import{j}from"./vm-hands-entry-lite-gh0yjzye.js";import{a}from"./vm-hands-entry-lite-0sh835na.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as z,spawn as H}from"child_process";import{randomBytes as Qe}from"crypto";import{chmodSync as De,existsSync as I,lstatSync as _e,mkdirSync as we,readFileSync as Re,rmSync as ee,writeFileSync as g}from"fs";import{connect as de}from"net";import{join as y}from"path";var S=32,w=76;var B="./desktop-wallpaper-0pjhgyfk.jpg";var O="./dock-browser-afp005mt.png";var F="./dock-files-rywdm96b.png";var k="./dock-terminal-s41cj1jp.png";var K=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
-# The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
-# python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
-# Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE
-import ctypes, sys
-import gi
-gi.require_version("GdkPixbuf", "2.0")
-from gi.repository import GdkPixbuf
-x = ctypes.cdll.LoadLibrary("libX11.so.6")
-x.XOpenDisplay.restype = ctypes.c_void_p
-x.XOpenDisplay.argtypes = [ctypes.c_char_p]
-d = x.XOpenDisplay(None)
-if not d: sys.exit("no display")
-for name, res, args in [
-    ("XDefaultScreen", ctypes.c_int, [ctypes.c_void_p]),
-    ("XRootWindow", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDisplayWidth", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDisplayHeight", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultDepth", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultVisual", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultGC", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_int]),
-    ("XCreatePixmap", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_uint, ctypes.c_uint, ctypes.c_uint]),
-    ("XCreateImage", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_uint, ctypes.c_int, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint, ctypes.c_uint, ctypes.c_int, ctypes.c_int]),
-    ("XPutImage", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_int, ctypes.c_int, ctypes.c_int, ctypes.c_int, ctypes.c_uint, ctypes.c_uint]),
-    ("XInternAtom", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_char_p, ctypes.c_int]),
-    ("XChangeProperty", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_int, ctypes.c_int, ctypes.c_void_p, ctypes.c_int]),
-    ("XSetWindowBackgroundPixmap", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_ulong]),
-    ("XClearWindow", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong]),
-    ("XSetCloseDownMode", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XCloseDisplay", ctypes.c_int, [ctypes.c_void_p]),
-]:
-    f = getattr(x, name); f.restype = res; f.argtypes = args
-s = x.XDefaultScreen(d); root = x.XRootWindow(d, s)
-w, h = x.XDisplayWidth(d, s), x.XDisplayHeight(d, s)
-if x.XDefaultDepth(d, s) != 24: sys.exit("unsupported depth")
-# Scale to cover the screen, then crop the centre.
-src = GdkPixbuf.Pixbuf.new_from_file(sys.argv[1])
-k = max(w / src.get_width(), h / src.get_height())
-sw, sh = max(w, round(src.get_width() * k)), max(h, round(src.get_height() * k))
-pb = src.scale_simple(sw, sh, GdkPixbuf.InterpType.BILINEAR).new_subpixbuf((sw - w) // 2, (sh - h) // 2, w, h).copy()
-if pb.get_has_alpha(): pb = pb.composite_color_simple(w, h, GdkPixbuf.InterpType.NEAREST, 255, 1, 0, 0)
-rgb, stride = pb.get_pixels(), pb.get_rowstride()
-bgrx = bytearray(w * h * 4)
-for y in range(h):
-    row = rgb[y * stride:y * stride + w * 3]; o = y * w * 4
-    bgrx[o:o + w * 4:4] = row[2::3]; bgrx[o + 1:o + w * 4:4] = row[1::3]; bgrx[o + 2:o + w * 4:4] = row[0::3]
-buf = ctypes.create_string_buffer(bytes(bgrx), len(bgrx))
-pix = x.XCreatePixmap(d, root, w, h, 24)
-img = x.XCreateImage(d, x.XDefaultVisual(d, s), 24, 2, 0, buf, w, h, 32, 0)  # ZPixmap
-x.XPutImage(d, pix, x.XDefaultGC(d, s), img, 0, 0, 0, 0, w, h)
-ref = ctypes.c_ulong(pix)
-for atom in (b"_XROOTPMAP_ID", b"ESETROOT_PMAP_ID"):
-    x.XChangeProperty(d, root, x.XInternAtom(d, atom, 0), 20, 32, 0, ctypes.byref(ref), 1)  # XA_PIXMAP, PropModeReplace
-x.XSetWindowBackgroundPixmap(d, root, pix)
-x.XClearWindow(d, root)
-x.XSetCloseDownMode(d, 1)  # RetainPermanent: the pixmap outlives this process
-x.XCloseDisplay(d)
-`;function ye(e){return`<?xml version="1.0" encoding="UTF-8"?>
-<openbox_config xmlns="http://openbox.org/3.4/rc">
-  <theme><keepBorder>no</keepBorder></theme>
-  <applications>
-    <!-- Debian Chromium is "Chromium"; Chrome for Testing is "Chromium-browser". -->
-    <application class="Chromium*">
-      <decor>no</decor>
-      <position force="yes"><x>${S}</x><y>${S}</y></position>
-      <size><width>${e.width-S*2}</width><height>${e.height-S-w}</height></size>
-    </application>
-  </applications>
-</openbox_config>`}var le=`# Remote sandbox dock \u2014 launcher icons only, centred, no panel fill
-panel_items = L
-panel_size = 100% 46
-panel_margin = 0 10
-panel_padding = 0 0 10
-panel_position = bottom center horizontal
-panel_shrink = 1
-panel_background_id = 0
-panel_layer = top
-mouse_effects = 1
-mouse_hover_icon_asb = 100 0 12
-mouse_pressed_icon_asb = 100 0 -12
-
-launcher_icon_size = 46
-launcher_padding = 0 0 10
-launcher_background_id = 0
-launcher_tooltip = 1
-
-launcher_item_app = /tmp/ara-chromium.desktop
-launcher_item_app = /tmp/ara-terminal.desktop
-launcher_item_app = /tmp/ara-files.desktop
-`,ue=`corner-radius = 12;
-rounded-corners-exclude = [
-  "class_g = 'tint2'",
-  "window_type = 'dock'",
-  "window_type = 'desktop'"
-];
-backend = "xrender";
-shadow = false;
-fading = false;
-vsync = false;
-inactive-opacity = 1.0;
-active-opacity = 1.0;
-`,Pe="/tmp/ara-dock-browser.png",Se=`[Desktop Entry]
-Name=Chrome
-Exec=chromium --no-sandbox %U
-Icon=${Pe}
-Type=Application
-Categories=Network;WebBrowser;
-`,Xe=`[Desktop Entry]
-Name=Terminal
-Exec=bash -c "DISPLAY=:99 xterm -fa DejaVuSansMono -fs 11 -bg black -fg white"
-Icon=/tmp/ara-dock-terminal.png
-Type=Application
-Categories=System;TerminalEmulator;
-`,fe=`[Desktop Entry]
-Name=Files
-Exec=bash -c "DISPLAY=:99 pcmanfm --no-desktop"
-Icon=/tmp/ara-dock-files.png
-Type=Application
-Categories=System;FileManager;
-`;var V={"wallpaper.jpg":B,"dock-browser.png":O,"dock-terminal.png":k,"dock-files.png":F},Te=K,he='set_wallpaper() { if command -v feh >/dev/null 2>&1; then feh --bg-fill "$1"; else python3 "$2" "$1"; fi; }';function v(e){let s=(i)=>i.replaceAll("DISPLAY=:99",`DISPLAY=${e.display}`).replaceAll("/tmp/ara-",`${e.root}/ara-`),p=new Set(e.absent??[]),n=le.split(`
-`).filter((i)=>!(p.has("terminal")&&i.endsWith("/ara-terminal.desktop"))&&!(p.has("files")&&i.endsWith("/ara-files.desktop"))).join(`
-`),t={"openbox/rc.xml":ye(e.screen),"tint2/tint2rc":s(n),"picom/picom.conf":ue,...p.has("terminal")?{}:{"ara-terminal.desktop":s(Xe)},...p.has("files")?{}:{"ara-files.desktop":s(fe)},"ara-chromium.desktop":s(Se).replace("chromium --no-sandbox %U",e.browserExec),"ara-set-root-wallpaper.py":Te},o=[...R.slice(0,3),he,'[ ! -f "$ROOT/ara-wallpaper.jpg" ] || set_wallpaper "$ROOT/ara-wallpaper.jpg" "$ROOT/ara-set-root-wallpaper.py" || true',...R.slice(3)];return{files:t,start:o}}var R=['ticks() { line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1; rest=${line##*) }; case $rest in Z*|X*) return 1;; esac; printf "%s" "$rest" | cut -d " " -f20; }','alive() { [ -f "$ROOT/$1.pid" ] || return 1; read -r pid start <"$ROOT/$1.pid"; current=$(ticks "$pid") || return 1; [ "$current" = "$start" ] && kill -0 "$pid" 2>/dev/null; }','launch() { name=$1; shift; "$@" 9>&- >"$ROOT/$name.log" 2>&1 & pid=$!; start=$(ticks "$pid"); printf "%s %s\\n" "$pid" "$start" >"$ROOT/$name.pid"; }','if [ -f "$ROOT/tint2/tint2rc" ] && ! alive tint2 && command -v tint2 >/dev/null 2>&1; then launch tint2 tint2 -c "$ROOT/tint2/tint2rc"; fi','if [ -f "$ROOT/picom/picom.conf" ] && ! alive picom && command -v picom >/dev/null 2>&1; then launch picom picom --config "$ROOT/picom/picom.conf"; fi'];var Ae=43200000,D=":99",Ee=60000,_=15000,C={width:1280,height:800},Ne=/^[A-Za-z0-9._:-]{1,160}$/;function Le(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}var Je=["video","viewer","viewer_same_network","viewer_network"];function Ce(e,s=Date.now()){let p=["relay_url","session_id","expires_at"];if(!Le(e)||p.some((c)=>!(c in e))||Object.keys(e).some((c)=>!p.includes(c)&&!Je.includes(c)))throw new r("invalid_display_request","Reason desktop request is malformed.");let n="video"in e?Co(e.video):void 0,t="viewer"in e?Mn(e.viewer):null;if(n===null)throw new r("invalid_display_request","Reason desktop video request is invalid.");let o=null;try{o=typeof e.relay_url==="string"?new URL(e.relay_url):null}catch{}if(!o||o.protocol!=="wss:"&&o.protocol!=="ws:"||o.username||o.password)throw new r("invalid_display_request","Reason desktop relay URL is invalid.");if(typeof e.session_id!=="string"||!Ne.test(e.session_id))throw new r("invalid_display_request","Reason desktop session identity is invalid.");let i=typeof e.expires_at==="string"?Date.parse(e.expires_at):Number.NaN;if(!Number.isFinite(i)||i<=s)throw new r("invalid_display_request","Reason desktop session has already expired.");return{relay_url:e.relay_url,session_id:e.session_id,expires_at:new Date(Math.min(i,s+Ae)).toISOString(),...n?{video:n}:{},...t?{viewer:t}:{},...n&&e.viewer_same_network===!0?{viewer_same_network:!0}:{}}}function Ft(e=process.platform){return(e==="linux"||e==="darwin"||e==="win32")&&x()?.features.display===!0}async function zs(){if(process.platform==="win32")return Ft()&&await Tr();if(process.platform!=="darwin")return Ft();return await Tr()}function G(e){we(e,{recursive:!0,mode:448});let s=_e(e);if(!s.isDirectory()||s.isSymbolicLink()||process.getuid&&s.uid!==process.getuid())throw new r("display_unavailable","Reason desktop state directory is not private.");De(e,448)}function Ue(e,s){let p=(t)=>{let o=Buffer.alloc(2);return o.writeUInt16BE(t.length),Buffer.concat([o,t])},n=Buffer.from([255,255]);return Buffer.concat([n,p(Buffer.alloc(0)),p(Buffer.from(e)),p(Buffer.from("MIT-MAGIC-COOKIE-1")),p(s)])}function T(e,s,p=2000){return new Promise((n)=>{let t=de(e),o="",i=(c)=>{t.destroy(),n(c)};t.setTimeout(p,()=>i(!1)),t.once("error",()=>i(!1)),t.once("close",()=>i(!1)),t.once("connect",()=>{if(!s)i(!0)}),t.on("data",(c)=>{if(o+=c.toString("latin1"),o.length>=4)i(o.startsWith("RFB "))})})}async function m(e,s){let p=Date.now()+s;while(Date.now()<p){if(await e())return!0;await new Promise((n)=>setTimeout(n,100))}return!1}function d(e,s,p){return new Promise((n)=>{let t=H(e,s,{detached:!0,stdio:"ignore",env:p});t.once("error",()=>n(-1)),t.once("exit",(o)=>n(o)),t.unref(),setTimeout(()=>n(null),_).unref()})}var U=null;function qe(e=a()){return U??=ge(e).finally(()=>{U=null}),U}async function ge(e){let s=x({home:e});if(!s?.xvfb||!s.x11vnc||!s.openbox)throw new r("display_unavailable","Run `reason desktop install` on this machine to enable its desktop.");Pt({root:s.root,automation:s.automation,extensionDir:s.extensionDir});let p=y(s.root,"display");G(p);let n=await Me(e,p,s.x11vnc);if(n)return n;let t={display:D,xauthority:y(p,"Xauthority"),rfbSocket:y(p,"rfb.sock")},o=y(p,"pulse"),i=(async()=>{try{G(o)}catch{return null}return await mo(o,s.pulseaudio)})();G(y(p,"home"));let c=re(p,t,s.pulseaudio),h=async()=>({...t,sound:await i});if(await T({path:t.rfbSocket},!0))return pe(y(p,"theme"),R,c),await h();if(!I(t.xauthority))g(t.xauthority,Ue(D.slice(1),Qe(16)),{mode:384,flag:"wx"});let l=te(y(p,"theme"),t.display,C),q={path:`/tmp/.X11-unix/X${D.slice(1)}`};if(!await T(q,!1)){let u=`${C.width}x${C.height}`;if(s.xvnc)ee(t.rfbSocket,{force:!0}),d(s.xvnc,[t.display,"-geometry",u,"-depth","24","-nolisten","tcp","-auth",t.xauthority,"-rfbport","-1","-rfbunixpath",t.rfbSocket,"-SecurityTypes","None","-UseBlacklist=0","-AlwaysShared","-desktop","Reason"],c);else d(s.xvfb,[t.display,"-screen","0",`${u}x24`,"-nolisten","tcp","-auth",t.xauthority],c);if(!await m(()=>T(q,!1),_)||s.xvnc&&!await m(()=>T({path:t.rfbSocket},!0),_))throw new r("display_unavailable","Reason could not start the virtual display.");d(s.openbox,["--config-file",l.openboxConfig],c)}if(await ne(l,c),!await se(s.x11vnc,t,p,"x11vnc.log",c))throw new r("display_unavailable","Reason could not start the desktop server.");return await h()}function re(e,s,p){let n={HOME:y(e,"home"),PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:s.display,XAUTHORITY:s.xauthority};if(p)n.PULSE_SERVER=Ve(Rn(y(e,"pulse")));return n}async function se(e,s,p,n,t){if(await T({path:s.rfbSocket},!0))return!0;ee(s.rfbSocket,{force:!0});let o=await d(e,["-display",s.display,"-auth",s.xauthority,"-rfbport","0","-rfbportv6","-1","-unixsock",s.rfbSocket,"-nopw","-forever","-shared","-noxdamage","-sb","0","-rfbversion","3.7","-quiet","-bg","-o",y(p,n)],t);if(o!==null&&o!==0)return!1;return await m(()=>T({path:s.rfbSocket},!0),_)}async function me(){let e=["DISPLAY","XAUTHORITY","WAYLAND_DISPLAY","XDG_SESSION_TYPE"],s=(p)=>Object.fromEntries(e.flatMap((n)=>p[n]?[[n,p[n]]]:[]));if(process.env.DISPLAY)return s(process.env);try{let p=await new Promise((n,t)=>z("systemctl",["--user","show-environment"],{encoding:"utf8",timeout:2000},(o,i)=>o?t(o):n(i)));return s(Object.fromEntries(p.split(`
-`).flatMap((n)=>{let t=n.indexOf("=");return t>0?[[n.slice(0,t),n.slice(t+1)]]:[]})))}catch{return{}}}var Z=new Set;async function Me(e,s,p){let n=await me(),t=/^:(\d+)(?:\.\d+)?$/.exec(n.DISPLAY??"")?.[1];if(!t||`:${t}`===D||n.WAYLAND_DISPLAY||n.XDG_SESSION_TYPE==="wayland")return null;let o={display:`:${t}`,xauthority:n.XAUTHORITY??y(e,".Xauthority"),rfbSocket:y(s,`rfb-${t}.sock`)},i=`${o.display} ${o.xauthority}`;if(Z.has(i)||!await T({path:`/tmp/.X11-unix/X${t}`},!1))return null;let c={HOME:e,PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:o.display,XAUTHORITY:o.xauthority};if(await se(p,o,s,`x11vnc-${t}.log`,c))return{...o,sound:null};return Z.add(i),process.stderr.write(`Reason worker: your screen ${o.display} could not be served; using the virtual desktop
-`),null}function te(e,s,p){let n=`chromium --no-first-run --no-default-browser-check${process.geteuid?.()===0?" --no-sandbox":""} %U`,t=[["terminal","xterm"],["files","pcmanfm"]].filter(([,i])=>!I(`/usr/bin/${i}`)).map(([i])=>i),o=v({root:e,display:s,screen:p,browserExec:n,absent:t});for(let i of["","openbox","tint2","picom"])G(y(e,i));for(let[i,c]of Object.entries(o.files))g(y(e,i),c,{mode:384});for(let[i,c]of Object.entries(V))g(y(e,`ara-${i}`),Re(c),{mode:384});return{root:e,openboxConfig:y(e,"openbox","rc.xml"),start:o.start}}function ne(e,s){return pe(e.root,[...e.start,"openbox --reconfigure >/dev/null 2>&1 || true"],s)}function pe(e,s,p){let n=[`ROOT=${JSON.stringify(e)}`,...s].join(`
-`);return new Promise((t)=>{let o=H("/bin/sh",["-c",n],{stdio:"ignore",env:{...p,PATH:"/usr/bin:/bin"}}),i=setTimeout(()=>{o.kill(),t()},_);o.once("error",()=>{clearTimeout(i),t()}),o.once("exit",()=>{clearTimeout(i),t()})})}var We=2073600,je=320;function Be(e,s){let p=Math.min(1,Math.sqrt(We/(e.width*e.height))),n=(t,o)=>Math.min(Math.floor(o/8)*8,Math.max(je,Math.round(t*p/8)*8));return{width:n(e.width,s.width),height:n(e.height,s.height)}}function oe(e,s,p){return new Promise((n)=>z(e,s,{env:p,encoding:"utf8",timeout:5000},(t,o)=>n(t?null:o)))}function Oe(e){let s=/current (\d+) x (\d+), maximum (\d+) x (\d+)/.exec(e),p=e.split(`
-`),n=p.findIndex((o)=>/^\S+ connected/.test(o));if(!s||n<0)return null;let t=[];for(let o of p.slice(n+1)){let i=/^\s+(\d+x\d+)\s/.exec(o);if(!i)break;t.push(i[1])}return{current:{width:Number(s[1]),height:Number(s[2])},maximum:{width:Number(s[3]),height:Number(s[4])},output:p[n].split(" ")[0],modes:t}}async function Fe(e,s,p){if(e.display!==D)return null;let n={PATH:"/usr/bin:/bin",DISPLAY:e.display,XAUTHORITY:e.xauthority},t=(h)=>oe("xrandr",h,n),o=Oe(await t(["--query"])??"");if(!o||o.maximum.width<=o.current.width&&o.maximum.height<=o.current.height)return null;let i=Be(s,o.maximum);if(i.width===o.current.width&&i.height===o.current.height)return{size:i,changed:!1};let c=`${i.width}x${i.height}`;if(!o.modes.includes(c)){if(await t(["--newmode",c,"60",...[i.width,i.width,i.width,i.width,i.height,i.height,i.height,i.height].map(String)]),await t(["--addmode",o.output,c])===null)return null}return p(),await t(["--output",o.output,"--mode",c])===null?null:{size:i,changed:!0}}async function ke(e,s){let p=x({home:a()});if(!p)return;let n=y(p.root,"display"),t=re(n,e,p.pulseaudio);await ne(te(y(n,"theme"),e.display,s),t);let o=s.width-S*2,i=s.height-S-w;await oe("xdotool",["search","--onlyvisible","--class","Chromium","windowsize","%@",String(o),String(i),"windowmove","%@",String(S),String(S)],{...t,PATH:"/usr/bin:/bin"})}var Y=Promise.resolve();function Ge(e,s,p=()=>{}){let n=Y.then(()=>Fe(e,s,p));return Y=n.then((t)=>t?.changed?ke(e,t.size):void 0).catch(()=>{}),n.then((t)=>t?.size??null,()=>null)}async function jt(e,s={}){let p=s.now??Date.now,n=Ce(e.payload,p());if(e.signal.throwIfAborted(),!n.video)throw new r("display_video_required","Reason desktops stream as video now; this request came without it.");let t=s.platform??process.platform;if(t!=="linux"&&t!=="darwin"&&t!=="win32")throw new r("display_video_unsupported","This machine does not serve desktop video.");let o=n.video,i=(s.video?.desktop??(t==="darwin"?async()=>On:t==="win32"?async()=>In:qe))();return await Ke(e.signal,n,s,p,(c)=>Dn(c,{request:o,desktop:i,...n.viewer?{viewer:n.viewer}:{},viewerSameNetwork:n.viewer_same_network===!0},{resizeDesktop:Ge,...s.video}),(c)=>Wt({type:"error",code:c}))}function Ke(e,s,p,n,t,o){let i=n();return new Promise((c,h)=>{let l=null,q=!1,u=!1,M,A,Q,E=!1,P=null,X=(b)=>{if(u)return;if(P)b=P.outcome;u=!0,clearTimeout(M),clearTimeout(A),e.removeEventListener("abort",L),Q?.close();try{l?.close(1000,"display_session_over")}catch{}if("error"in b){h(b.error);return}c({reason:b.reason,...Q?.summary(),duration_ms:Math.max(0,n()-i)})},N=()=>X({error:new r("display_relay_unavailable","Reason could not reach the desktop relay.")}),L=()=>{let b=e.reason;X({error:b instanceof r?b:new r("cancelled","Reason closed the desktop session.")})},W=()=>{if(!P||!l)return;let{outcome:b}=P,f=!("error"in b)?b.reason:b.error instanceof r?b.error.code:"display_unavailable";if(!P.told)try{l.send(o(f))}catch{}X(b)};if(Q=t({get done(){return u||P!==null},get open(){return q&&!u&&P===null},get bufferedAmount(){return l?.bufferedAmount??0},send(b){if(u||P||!q||!l)return;try{l.send(b)}catch{X({reason:"relay_closed"})}},end:(b)=>{if(u||P)return;if(!("error"in b)&&E&&q){X(b);return}if(P={outcome:b,told:!("error"in b)&&q},E&&q)W()}}),u){Q.close();return}if(e.aborted){L();return}e.addEventListener("abort",L,{once:!0}),M=setTimeout(()=>X({reason:"session_expired"}),Math.max(1,Date.parse(s.expires_at)-n())),A=setTimeout(()=>X({reason:"viewer_absent"}),p.viewerWaitMs??Ee);try{l=(p.connect??Nr)(s.relay_url,(p.loadProxy??j)()?.url)}catch{N();return}l.binaryType="arraybuffer",l.onopen=()=>{if(u||!l)return;q=!0,Q?.opened()},l.onmessage=(b)=>{if(u)return;let f=b.data,J=f instanceof ArrayBuffer?new Uint8Array(f):ArrayBuffer.isView(f)?new Uint8Array(f.buffer,f.byteOffset,f.byteLength):null;if(!J||J.byteLength===0)return;if(clearTimeout(A),E=!0,P){W();return}Q?.received(J)},l.onclose=()=>{if(u)return;if(!q){N();return}X({reason:"relay_closed"})},l.onerror=()=>{if(u||q)return;N()}})}
-export{Ft,zs,G,qe,jt};

package/bin/vm-hands/vm-hands-op-runner-7derp3tq.js

@@ -1,2 +0,0 @@
-// @bun
-import{ur,dr,Tt,Rt,Ot,_s}from"./vm-hands-entry-lite-gtnpk3sc.js";export{ur as VM_HANDS_OP_RUNNER_PERSON_ARG,dr as VM_HANDS_OP_RUNNER_SURFACE_ARG,Rt as VM_HANDS_SURFACE_DIRECTORY_ARG,Ot as VM_HANDS_SURFACE_OPS,Tt as VM_HANDS_SURFACE_UID_ARG,_s as runVmHandsOpRunner};

package/bin/vm-hands/worker-preview-readiness-ye6cvg3k.js

@@ -1,2 +0,0 @@
-// @bun
-import{Es}from"./vm-hands-entry-lite-wzq3qsh1.js";import"./vm-hands-entry-lite-90y6pf98.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Es as probeWorkerPreview};

package/bin/vm-hands/worker-sandbox-j6cmex8e.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ss}from"./vm-hands-entry-lite-60pnam39.js";import"./vm-hands-entry-lite-5np5k3wb.js";import"./vm-hands-entry-lite-dcrz19xf.js";import"./vm-hands-entry-lite-qz74j563.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Ss as configureWorkerSandbox};