@reason-machines/cli-linux-x64 0.2.525 → 0.2.528

package/bin/vm-hands/{vm-hands-executor-ftg1qx7c.js → vm-hands-executor-htmapgrt.js}

@@ -1,8 +1,8 @@
 // @bun
-import"./vm-hands-entry-lite-88yjxxvf.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-c0t5xpzh.js";import"./vm-hands-entry-lite-s85p7tqp.js";import{at,ao,xr,Nt}from"./vm-hands-entry-lite-0zby1r00.js";import"./vm-hands-entry-lite-bvqwsd3b.js";import"./vm-hands-entry-lite-tash5m18.js";import"./vm-hands-entry-lite-mfvtp7py.js";import"./vm-hands-entry-lite-9x81cr3a.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-a6w60nv9.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-hc11hecd.js";import"./vm-hands-entry-lite-td73npv3.js";import{ur,dr,Rt,Tt}from"./vm-hands-entry-lite-r31yba20.js";import"./vm-hands-entry-lite-kwmjn9y3.js";import"./vm-hands-entry-lite-c4959xva.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-1kt82jes.js";import{spawn as Ae}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as G,lstatSync as q,mkdirSync as V,mkdtempSync as Te,readdirSync as Z,readFileSync as k,realpathSync as We,rmdirSync as de,rmSync as He,writeFileSync as B}from"fs";import{basename as ze,dirname as Ue,join as d}from"path";import{readFileSync as ie,readlinkSync as ae}from"fs";import{relative as Ie}from"path";var ce=16;function ue(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Ne(e){let r=[];for(let t of e.split(`
+import"./vm-hands-entry-lite-qc6gxqgs.js";import"./vm-hands-entry-lite-a0g6c3wr.js";import"./vm-hands-entry-lite-hv3dxd5k.js";import"./vm-hands-entry-lite-s85p7tqp.js";import{at,co,xr,Nt}from"./vm-hands-entry-lite-610728bf.js";import"./vm-hands-entry-lite-ct4mtq1m.js";import"./vm-hands-entry-lite-4r1yn35v.js";import"./vm-hands-entry-lite-37b5045h.js";import"./vm-hands-entry-lite-xe0benev.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-5tnma5qb.js";import"./vm-hands-entry-lite-4anjdcth.js";import"./vm-hands-entry-lite-cgddp0y3.js";import"./vm-hands-entry-lite-y9jarm7q.js";import{ur,dr,Rt,Tt}from"./vm-hands-entry-lite-q3mgvd2b.js";import"./vm-hands-entry-lite-2hfrcr50.js";import"./vm-hands-entry-lite-hfx1q0b0.js";import"./vm-hands-entry-lite-jvszqt0z.js";import"./vm-hands-entry-lite-b6gsggvp.js";import{spawn as Ae}from"child_process";import{chmodSync as Me,chownSync as Le,existsSync as G,lstatSync as q,mkdirSync as V,mkdtempSync as Te,readdirSync as Z,readFileSync as k,realpathSync as We,rmdirSync as de,rmSync as He,writeFileSync as B}from"fs";import{basename as ze,dirname as Ue,join as d}from"path";import{readFileSync as ie,readlinkSync as ae}from"fs";import{relative as Ie}from"path";var ce=16;function ue(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Ne(e){let r=[];for(let t of e.split(`
 `)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:ue(n[3]),mountPoint:ue(n[4])})}return r}function De(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(Ne(m).filter((_)=>c(_.mountPoint)).map((_)=>[`${_.mountPoint}\x00${_.device}\x00${_.root}`,_.mountPoint])),u=o(r),p=o(t),b=(m)=>Ie(n,m)||".",P=[...u].filter(([m])=>!p.has(m)).map(([,m])=>b(m)),x=[...p].filter(([m])=>!u.has(m)).map(([,m])=>b(m));return{missing:P,extra:x,referenceCount:u.size,ownCount:p.size}}function le(e,r,t,n="/proc"){let c,o,u=null;try{c=ie(`${n}/1/mountinfo`,"utf8"),o=ie(`${n}/self/mountinfo`,"utf8")}catch(_){let O=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{u=ae(`${n}/1/ns/mnt`)===ae(`${n}/self/ns/mnt`)}catch{}let{missing:p,extra:b,referenceCount:P,ownCount:x}=De(e,c,o),m={reference_count:P,own_count:x,missing_count:p.length,extra_count:b.length,same_namespace:u};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ce)});if(p.length)throw r("vm_hands.mount_mismatch",{...m,missing:p.slice(0,ce)}),t(`${p.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var we="/sys/fs/cgroup/reason-payload",M="vm-hands",Be="/run/ara-srt/fallbacks.jsonl",se="/reason-person",Fe="/reason-workload",Ke="surface",ee=5000,je=1e4,pe="__VM_HANDS_PROOF_DIR__",Ge="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,r){super(r);this.code=e}}function Ee(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new w("vm_hands_bind_invalid","bad bind id");return d(e,M,`b-${r.toLowerCase()}`)}var Ve=5000,ve=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Je(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=d(Ue(e),r.toLowerCase());return ze(e).toLowerCase()===r.toLowerCase()?e:t}function gn(e){let r=e.cgroup??we,t=e.init.layout.payload_uid,n=e.init.workload_ended!==!0,c=(s)=>z(s,se)||n&&z(s,Fe),o=e.log??(()=>{}),u=(s)=>Je(e.init.layout.session_root,s),p=new Map,b=new Map,P=0,x=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(P>s.length?0:P).split(`
 `).filter(Boolean);P=s.length;let l=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(l.length)o("vm_hands.srt_server_starts",{count:l.length,elapsed_ms:l.slice(0,8)})}catch{}},m=null,_=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",I=()=>{m??=fe()},R=0,F=()=>{try{let s=k(Be,"utf8"),i=s.slice(R>s.length?0:R);R=s.length;let l=i.split(`
-`).filter(Boolean).slice(0,1000);if(!l.length)return null;let f={},g=0;for(let S of l)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:l.length,codes:f,max_elapsed_ms:g}),{count:l.length,codes:f,max_elapsed_ms:g}}catch{return null}},U=(s,i,l)=>Re(s,i,l),K=(s)=>(i,l,f)=>Ae("/bin/sh",["-c",`echo $$ > ${ve(d(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...l],f),Re=K(d(r,M)),j=d(r,M,"probe"),T=(s)=>Ee(r,s),Ce=(s)=>{let i=T(s);try{V(i,{mode:493})}catch(l){if(!(l&&typeof l==="object"&&("code"in l)&&l.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},Oe=(s)=>{try{de(T(s))}catch{}},W=e.prespawn?ao({spawnProcess:U,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;W?.arm();let X=W?setInterval(()=>{W.arm()},Ve):null;X?.unref?.();async function Y(s){let i=p.get(s);if(p.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:T,async startExecutor(s){if(I(),b.set(s.bindId,fe()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await Y(s.bindId);let{claim:i,bindId:l}=s,f=Ce(l),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,N=new Promise((a,v)=>{h=a,y=v}),D,C=new Promise((a)=>{D=a}),H=Nt({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(l,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...W?{takePrespawnedWorker:(a)=>{let v=W.take(a);if(!v?.pid)return v;try{return B(d(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:W.adopt}:{}}).then(()=>{D("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),D(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));p.set(l,{abort:S,done:H,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0});let A=await N,E=A.executor_launch_id;if(typeof E!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:A,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return p.get(s)?.exited??new Promise(()=>{})},freezeBind(s){let i=T(s);if(G(d(i,"cgroup.freeze")))B(d(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){let i=new Set(s?.keep??[]);if(await $e(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&G(d(O,"cgroup.events")))x(),await te(O,Date.now()+ee,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ee;if(G(d(j,"cgroup.events"))){await te(j,s,"probe");try{de(j)}catch{}}let i=oe(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Ze(r,i,s);let l=(g)=>{let S=oe(g);return S!==null&&S<=i},f=he(t).filter((g)=>l(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...me(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,d(r,M)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=ge(m).filter((y)=>y!==process.pid&&!c(y)&&!z(y,"/reason-vm-hands")&&!z(y,S)&&!g.some((N)=>ne(y,N)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:re(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:re(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(I(),!i.includes(pe))throw new w("vm_hands_probe_failed","probe names no proof directory");let l=e.proofParent??"/tmp/reason-vm-hands-proof";V(l,{mode:457,recursive:!0});let f=q(l);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Te(d(l,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Le(g,t,t),Me(g,448);let h=q(g).ino;try{V(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(pe,g).replaceAll(Ge,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),N="";y.stdout?.on("data",(C)=>{if(N.length<16384)N+=C.toString("utf8").slice(0,16384-N.length)});let D=await new Promise((C)=>{let H=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},je);y.once("error",()=>{clearTimeout(H),C(127)}),y.once("close",(A)=>{clearTimeout(H),C(A??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:D}),{exitCode:D,markers:N,proofDirInode:h}}finally{if(!S)He(g,{recursive:!0,force:!0})}},restatLayout(s){let i=u(s),l=i===e.init.layout.session_root?e.init.layout.alias:d(i,"repo"),f="invalid";try{xr(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=q(l);S=h.uid,g=f==="0:0:755"&&l===d(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&We(l)===l&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=u(s);try{le(i,o,(l)=>new w("vm_hands_mount_mismatch",l))}catch(l){if(i!==e.init.layout.session_root&&l instanceof w&&l.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw l}},installEnvironment(s,i){let l=p.get(s);if(!l)throw new w("environment_unavailable","no executor owns an environment");return at({root:e.root,operationId:l.operationId,payload:i}).installed_revision},async stop(){if(X)clearInterval(X);W?.close(),await Promise.all([...p.keys()].map((s)=>Y(s)))}};function xe(){try{return Z(d(r,M),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function $e(s,i,l=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=qe();try{await nn();let S=Date.now()+ee,h=new Set(xe().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=Y(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(G(d(T(a),"cgroup.events")))await te(T(a),S,"bind");await v}let N=[...f].map((a)=>T(a).replace(/^\/sys\/fs\/cgroup/,"")),D=["/",...[r,d(r,M)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),H=(a)=>c(a)||N.some((v)=>z(a,v))||D.some((v)=>ne(a,v)),A=l?[]:he(t).filter((a)=>!H(a));if(A.length)throw o("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size,...me(A)}),new w("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let E=(a)=>!H(a)&&!z(a,"/reason-vm-hands")&&!z(a,C)&&!D.some((v)=>ne(a,v));if(y!==null){let a=ge(y).filter((v)=>v!==process.pid&&E(v));if(a.length)throw o("vm_hands.kill_strays",{strays:re(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),Oe(a)}finally{g()}}}function oe(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function be(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ze(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=ke(e).filter((o)=>Se(o,e)),c=new Set(n.filter((o)=>{let u=oe(o);return u!==null&&u<=r}));for(let o=!0;o;){o=!1;for(let u of n){if(c.has(u))continue;let p=be(u);if(p!==null&&c.has(p))c.add(u),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,r,t="/proc"){try{return k(d(t,String(e),"cgroup"),"utf8").split(`
+`).filter(Boolean).slice(0,1000);if(!l.length)return null;let f={},g=0;for(let S of l)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:l.length,codes:f,max_elapsed_ms:g}),{count:l.length,codes:f,max_elapsed_ms:g}}catch{return null}},U=(s,i,l)=>Re(s,i,l),K=(s)=>(i,l,f)=>Ae("/bin/sh",["-c",`echo $$ > ${ve(d(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...l],f),Re=K(d(r,M)),j=d(r,M,"probe"),T=(s)=>Ee(r,s),Ce=(s)=>{let i=T(s);try{V(i,{mode:493})}catch(l){if(!(l&&typeof l==="object"&&("code"in l)&&l.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},Oe=(s)=>{try{de(T(s))}catch{}},W=e.prespawn?co({spawnProcess:U,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;W?.arm();let X=W?setInterval(()=>{W.arm()},Ve):null;X?.unref?.();async function Y(s){let i=p.get(s);if(p.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:T,async startExecutor(s){if(I(),b.set(s.bindId,fe()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await Y(s.bindId);let{claim:i,bindId:l}=s,f=Ce(l),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,N=new Promise((a,v)=>{h=a,y=v}),D,C=new Promise((a)=>{D=a}),H=Nt({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(l,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...W?{takePrespawnedWorker:(a)=>{let v=W.take(a);if(!v?.pid)return v;try{return B(d(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:W.adopt}:{}}).then(()=>{D("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),D(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));p.set(l,{abort:S,done:H,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0});let A=await N,E=A.executor_launch_id;if(typeof E!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:E,readyData:A,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return p.get(s)?.exited??new Promise(()=>{})},freezeBind(s){let i=T(s);if(G(d(i,"cgroup.freeze")))B(d(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){let i=new Set(s?.keep??[]);if(await $e(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&G(d(O,"cgroup.events")))x(),await te(O,Date.now()+ee,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ee;if(G(d(j,"cgroup.events"))){await te(j,s,"probe");try{de(j)}catch{}}let i=oe(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Ze(r,i,s);let l=(g)=>{let S=oe(g);return S!==null&&S<=i},f=he(t).filter((g)=>l(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...me(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,d(r,M)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=ge(m).filter((y)=>y!==process.pid&&!c(y)&&!z(y,"/reason-vm-hands")&&!z(y,S)&&!g.some((N)=>ne(y,N)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:re(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:re(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(I(),!i.includes(pe))throw new w("vm_hands_probe_failed","probe names no proof directory");let l=e.proofParent??"/tmp/reason-vm-hands-proof";V(l,{mode:457,recursive:!0});let f=q(l);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=Te(d(l,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Le(g,t,t),Me(g,448);let h=q(g).ino;try{V(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(pe,g).replaceAll(Ge,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),N="";y.stdout?.on("data",(C)=>{if(N.length<16384)N+=C.toString("utf8").slice(0,16384-N.length)});let D=await new Promise((C)=>{let H=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},je);y.once("error",()=>{clearTimeout(H),C(127)}),y.once("close",(A)=>{clearTimeout(H),C(A??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:D}),{exitCode:D,markers:N,proofDirInode:h}}finally{if(!S)He(g,{recursive:!0,force:!0})}},restatLayout(s){let i=u(s),l=i===e.init.layout.session_root?e.init.layout.alias:d(i,"repo"),f="invalid";try{xr(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=q(l);S=h.uid,g=f==="0:0:755"&&l===d(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&We(l)===l&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=u(s);try{le(i,o,(l)=>new w("vm_hands_mount_mismatch",l))}catch(l){if(i!==e.init.layout.session_root&&l instanceof w&&l.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw l}},installEnvironment(s,i){let l=p.get(s);if(!l)throw new w("environment_unavailable","no executor owns an environment");return at({root:e.root,operationId:l.operationId,payload:i}).installed_revision},async stop(){if(X)clearInterval(X);W?.close(),await Promise.all([...p.keys()].map((s)=>Y(s)))}};function xe(){try{return Z(d(r,M),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function $e(s,i,l=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=qe();try{await nn();let S=Date.now()+ee,h=new Set(xe().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=Y(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(G(d(T(a),"cgroup.events")))await te(T(a),S,"bind");await v}let N=[...f].map((a)=>T(a).replace(/^\/sys\/fs\/cgroup/,"")),D=["/",...[r,d(r,M)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),H=(a)=>c(a)||N.some((v)=>z(a,v))||D.some((v)=>ne(a,v)),A=l?[]:he(t).filter((a)=>!H(a));if(A.length)throw o("vm_hands.kill_survivors",{pids:A.slice(0,16),beside:f.size,...me(A)}),new w("vm_hands_kill_unverified",`${A.length} payload-uid process(es) outside a live bind`);let E=(a)=>!H(a)&&!z(a,"/reason-vm-hands")&&!z(a,C)&&!D.some((v)=>ne(a,v));if(y!==null){let a=ge(y).filter((v)=>v!==process.pid&&E(v));if(a.length)throw o("vm_hands.kill_strays",{strays:re(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),Oe(a)}finally{g()}}}function oe(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function be(e,r="/proc"){try{let t=k(d(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Ze(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=ke(e).filter((o)=>Se(o,e)),c=new Set(n.filter((o)=>{let u=oe(o);return u!==null&&u<=r}));for(let o=!0;o;){o=!1;for(let u of n){if(c.has(u))continue;let p=be(u);if(p!==null&&c.has(p))c.add(u),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(d(e,"cgroup.freeze"),"0")}catch{}}}function ne(e,r,t="/proc"){try{return k(d(t,String(e),"cgroup"),"utf8").split(`
 `).find((c)=>c.startsWith("0::"))?.slice(3)===r}catch{return!1}}function z(e,r,t="/proc"){try{let c=k(d(t,String(e),"cgroup"),"utf8").split(`
 `).find((o)=>o.startsWith("0::"))?.slice(3)??"";return c===r||c.startsWith(`${r}/`)}catch{return!1}}var Xe=100;function fe(){try{return Math.floor(Number(k("/proc/uptime","utf8").split(" ")[0])*Xe)}catch{return 0}}async function te(e,r,t){try{B(d(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`${t} cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}while(!/^populated 0$/m.test(k(d(e,"cgroup.events"),"utf8"))){if(Date.now()>r)throw new w("vm_hands_kill_unverified",`${t} cgroup still populated (left frozen)`);for(let n of ke(e)){if(!Se(n,e))continue;try{process.kill(n,"SIGKILL")}catch{}}await new Promise((n)=>setTimeout(n,10))}try{B(d(e,"cgroup.freeze"),"0")}catch(n){throw new w("vm_hands_kill_unverified",`${t} cgroup thaw: ${n instanceof Error?n.message:String(n)}`)}}function Se(e,r){let t=r.replace(/^\/sys\/fs\/cgroup/,"")||"/",n="";try{n=k(`/proc/${e}/cgroup`,"utf8").split(`
 `).find((o)=>o.startsWith("0::"))??""}catch{return!1}let c=n.slice(3);return c===t||c.startsWith(`${t}/`)}function ke(e){let r=[],t=(n)=>{try{for(let o of k(d(n,"cgroup.procs"),"utf8").split(`

package/bin/vm-hands/{vm-hands-op-runner-agy05x0c.js → vm-hands-op-runner-gmsqah3r.js}

@@ -1,2 +1,2 @@
 // @bun
-import{ur,dr,Rt,Tt,Ot,vs}from"./vm-hands-entry-lite-r31yba20.js";export{ur as VM_HANDS_OP_RUNNER_PERSON_ARG,dr as VM_HANDS_OP_RUNNER_SURFACE_ARG,Tt as VM_HANDS_SURFACE_DIRECTORY_ARG,Ot as VM_HANDS_SURFACE_OPS,Rt as VM_HANDS_SURFACE_UID_ARG,vs as runVmHandsOpRunner};
+import{ur,dr,Rt,Tt,It,vs}from"./vm-hands-entry-lite-q3mgvd2b.js";export{ur as VM_HANDS_OP_RUNNER_PERSON_ARG,dr as VM_HANDS_OP_RUNNER_SURFACE_ARG,Tt as VM_HANDS_SURFACE_DIRECTORY_ARG,It as VM_HANDS_SURFACE_OPS,Rt as VM_HANDS_SURFACE_UID_ARG,vs as runVmHandsOpRunner};

package/bin/vm-hands/{vm-hands-runtime-kbdb0rj5.js → vm-hands-runtime-004m9v3r.js}

@@ -1,4 +1,4 @@
 // @bun
-import{rt}from"./vm-hands-entry-lite-88yjxxvf.js";import"./vm-hands-entry-lite-mfvtp7py.js";import{Ot}from"./vm-hands-entry-lite-r31yba20.js";import{zi,pn,qi}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
-`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function B(r,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((y)=>N(y,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[y,m]of[[a,!1],["/usr/local/bin",!0]]){let _=N(y);if((m?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),g=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:g}),u()})})}var Y=3000;function Re(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(r){j(r,{recursive:!0,mode:448});let n=te(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ce(r){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-qxsa289q.js"),import("./hands-worker-source-hzkacxxz.js"),import("./network-contract-5wc6wbn2.js"),import("./device-workspace-qjyzphga.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-zffy7kc8.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:rt,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:X.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function _e(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=r.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let g=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of g)l[c]=s.operation_constraints[c];return{...r,capabilities:{...a,supported_operations:["hands.connect",...I,...g],operation_constraints:l}}}function pe(r){for(let n of G("/etc/passwd","utf8").split(`
-`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(r,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(r,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((o)=>setTimeout(()=>o(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:g},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-gm7m5bwr.js"),import("./worker-sandbox-k0vx97tx.js")]);c();try{g({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,y=new Promise((e)=>{f=e}),m=y.then(()=>import("./vm-hands-executor-ftg1qx7c.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:V,runtimeDirectory:O,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(r,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),o}),_=(e)=>async(...o)=>(await m)[e](...o),x=null;m.then((e)=>{x=(o)=>e.executorExited(o)});let S={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};m.then((e)=>{S.restatLayout=(o)=>e.restatLayout(o),S.verifyMounts=(o)=>e.verifyMounts(o),S.installEnvironment=(o,d)=>e.installEnvironment(o,d),S.freezeBind=(o)=>e.freezeBind(o),S.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await zi(r),C=new pn(r,q,S,{envRoot:W}),M=ce(r),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-45tqt3q6.js")]).then(([e,o])=>{K=()=>_e(e,o.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=y.then(()=>import("./vm-hands-executor-ftg1qx7c.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:r.layout.payload_uid,payloadGid:pe(r.layout.payload_uid),bindCgroup:(i)=>o(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+le;while(C.settingUp&&Date.now()<o)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await qi({apiOrigin:r.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:o,bindId:d,signal:i,emit:E})=>{let k=fe(r,o);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=o.capability==="pty.start"&&e==="person"&&!o.authority;if(de.has(String(o.capability))&&!Z){let{executeLocalOperation:p}=await import("./local-capabilities-45tqt3q6.js");return p(k,o,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Ot.has(String(o.capability))){if(w.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(o.attempt_id),claim:o,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(o.attempt_id),claim:o,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:o})=>Ot.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,o)},onTurn:(e,o)=>{if(o)u.set(e,o);else u.delete(e)}}),await(await m).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};
+import{rt}from"./vm-hands-entry-lite-qc6gxqgs.js";import"./vm-hands-entry-lite-37b5045h.js";import{It}from"./vm-hands-entry-lite-q3mgvd2b.js";import{qi,pn,Wi}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
+`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}function B(r,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((y)=>N(y,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[y,m]of[[a,!1],["/usr/local/bin",!0]]){let _=N(y);if((m?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),g=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:g}),u()})})}var Y=3000;function Re(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(r){j(r,{recursive:!0,mode:448});let n=te(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function ce(r){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-nj7n5by8.js"),import("./hands-worker-source-hkjndq4w.js"),import("./network-contract-e98v6mwd.js"),import("./device-workspace-rxqaw78v.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-39wqa1xa.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:rt,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:X.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function _e(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=r.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let g=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of g)l[c]=s.operation_constraints[c];return{...r,capabilities:{...a,supported_operations:["hands.connect",...I,...g],operation_constraints:l}}}function pe(r){for(let n of G("/etc/passwd","utf8").split(`
+`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(r,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(r,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((o)=>setTimeout(()=>o(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:g},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-jdqya1ff.js"),import("./worker-sandbox-563c5g2f.js")]);c();try{g({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,y=new Promise((e)=>{f=e}),m=y.then(()=>import("./vm-hands-executor-htmapgrt.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:V,runtimeDirectory:O,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(r,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),o}),_=(e)=>async(...o)=>(await m)[e](...o),x=null;m.then((e)=>{x=(o)=>e.executorExited(o)});let S={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};m.then((e)=>{S.restatLayout=(o)=>e.restatLayout(o),S.verifyMounts=(o)=>e.verifyMounts(o),S.installEnvironment=(o,d)=>e.installEnvironment(o,d),S.freezeBind=(o)=>e.freezeBind(o),S.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await qi(r),C=new pn(r,q,S,{envRoot:W}),M=ce(r),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-xcgvjt4m.js")]).then(([e,o])=>{K=()=>_e(e,o.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=y.then(()=>import("./vm-hands-executor-htmapgrt.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:r.layout.payload_uid,payloadGid:pe(r.layout.payload_uid),bindCgroup:(i)=>o(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+le;while(C.settingUp&&Date.now()<o)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await Wi({apiOrigin:r.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:o,bindId:d,signal:i,emit:E})=>{let k=fe(r,o);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=o.capability==="pty.start"&&e==="person"&&!o.authority;if(de.has(String(o.capability))&&!Z){let{executeLocalOperation:p}=await import("./local-capabilities-xcgvjt4m.js");return p(k,o,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(It.has(String(o.capability))){if(w.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(o.attempt_id),claim:o,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(o.attempt_id),claim:o,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:o})=>It.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,o)},onTurn:(e,o)=>{if(o)u.set(e,o);else u.delete(e)}}),await(await m).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};

package/bin/vm-hands/worker-preview-readiness-84stxabw.js

@@ -0,0 +1,2 @@
+// @bun
+import{Cs}from"./vm-hands-entry-lite-13s0mfpr.js";import"./vm-hands-entry-lite-2hfrcr50.js";import"./vm-hands-entry-lite-b6gsggvp.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Cs as probeWorkerPreview};

package/bin/vm-hands/worker-sandbox-563c5g2f.js

@@ -0,0 +1,2 @@
+// @bun
+import{ks}from"./vm-hands-entry-lite-y5hv1gjv.js";import"./vm-hands-entry-lite-9azmqs47.js";import"./vm-hands-entry-lite-5tnma5qb.js";import"./vm-hands-entry-lite-b6gsggvp.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{ks as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-x64",
-  "version": "0.2.525",
+  "version": "0.2.528",
   "description": "Reason CLI native binary for linux-x64",
   "os": [
     "linux"

package/bin/vm-hands/api-468skzhq.js

@@ -1,2 +0,0 @@
-// @bun
-import{I,Ps,rs}from"./vm-hands-entry-lite-9knf91et.js";import"./vm-hands-entry-lite-krnvgf71.js";import"./vm-hands-entry-lite-9y3dvyfj.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{I as ApiError,rs as ReasonApi,Ps as createMachineEnrollmentTicketWithToken};

package/bin/vm-hands/api-credentials-9f82kd61.js

@@ -1,2 +0,0 @@
-// @bun
-import{Hi,es,ts,As}from"./vm-hands-entry-lite-5qanp33p.js";import"./vm-hands-entry-lite-9knf91et.js";import"./vm-hands-entry-lite-krnvgf71.js";import"./vm-hands-entry-lite-9y3dvyfj.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Hi as apiOriginFromEnvironment,ts as environmentApiKey,es as explicitApiOrigin,As as resolveApiCredentials};

package/bin/vm-hands/connect-cli-4t15y12x.js

@@ -1,2 +0,0 @@
-// @bun
-import{it,Ss,Es,xs}from"./vm-hands-entry-lite-x5048q8d.js";import"./vm-hands-entry-lite-f8ts9y2q.js";import"./vm-hands-entry-lite-0tavq3p4.js";import"./vm-hands-entry-lite-5qanp33p.js";import"./vm-hands-entry-lite-9knf91et.js";import"./vm-hands-entry-lite-krnvgf71.js";import"./vm-hands-entry-lite-x1vm200a.js";import"./vm-hands-entry-lite-nj4kjex8.js";import"./vm-hands-entry-lite-wfc0agnt.js";import"./vm-hands-entry-lite-dhb4fwrv.js";import"./vm-hands-entry-lite-0zby1r00.js";import"./vm-hands-entry-lite-a6w60nv9.js";import"./vm-hands-entry-lite-tash5m18.js";import"./vm-hands-entry-lite-kwmjn9y3.js";import"./vm-hands-entry-lite-c4959xva.js";import"./vm-hands-entry-lite-11dq75hb.js";import"./vm-hands-entry-lite-413em054.js";import"./vm-hands-entry-lite-60t7x9vw.js";import"./vm-hands-entry-lite-bvqwsd3b.js";import"./vm-hands-entry-lite-89ahrw19.js";import"./vm-hands-entry-lite-sfmeafdm.js";import"./vm-hands-entry-lite-5wsygx6n.js";import"./vm-hands-entry-lite-hc11hecd.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-c0t5xpzh.js";import"./vm-hands-entry-lite-scvg31ds.js";import"./vm-hands-entry-lite-vf02kfyy.js";import"./vm-hands-entry-lite-9y3dvyfj.js";import"./vm-hands-entry-lite-n3274tws.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-88yjxxvf.js";import"./vm-hands-entry-lite-mfvtp7py.js";import"./vm-hands-entry-lite-9x81cr3a.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Ss as computerDisconnected,it as connectionDirectory,Es as connectionReport,xs as restartConnection};

package/bin/vm-hands/credentials-md79hkqh.js

@@ -1,2 +0,0 @@
-// @bun
-import{Fe,un,It,dn}from"./vm-hands-entry-lite-krnvgf71.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{Fe as credentialsPath,dn as deleteCredentials,It as loadCredentials,un as saveCredentials};

package/bin/vm-hands/desktop-account-gm7m5bwr.js

@@ -1,2 +0,0 @@
-// @bun
-import{Gs,K,Ln}from"./vm-hands-entry-lite-bvqwsd3b.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{Gs as configureDesktopAccount,K as desktopAccount,Ln as desktopHome};

package/bin/vm-hands/device-workspace-qjyzphga.js

@@ -1,2 +0,0 @@
-// @bun
-import{ue,Ce,Z,Ae,de,ir,et,X,O,H,Qr,en,tn,or,rn}from"./vm-hands-entry-lite-39qv4sqt.js";export{tn as CLOUD_REPOSITORY_WORKSPACE_ID,Qr as CLOUD_SESSION_CONTROL_BASE,or as CLOUD_SESSION_ROOT,Ce as HANDS_WORKSPACE_BASE_KEY,Ae as HANDS_WORKSPACE_LAYOUT_KEY,ue as REASON_WORKSPACE_BASE,Z as SESSION_WORKSPACE_LAYOUT,de as SESSION_WORKTREES,ir as SESSION_WORKTREE_ID,en as SIDECHAT_WORKSPACE_ID,rn as cloudSessionLayoutOfRoot,O as deviceWorkspaceRootRelative,X as isDeviceWorkspacePath,et as isSessionWorktreePath,H as parseDeviceWorkspace};

package/bin/vm-hands/hands-worker-source-hzkacxxz.js

@@ -1,2 +0,0 @@
-// @bun
-import{D,T,cs,b,Cn}from"./vm-hands-entry-lite-tash5m18.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-c0t5xpzh.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{b as REASON_HANDS_WORKER_ARTIFACT_SHA256,T as REASON_HANDS_WORKER_ENTRYPOINT,cs as REASON_HANDS_WORKER_SOURCE,Cn as REASON_HANDS_WORKER_STARTUP_REFUSALS,D as REASON_HANDS_WORKER_VERSION};

package/bin/vm-hands/install-receipt-qtwtzafq.js

@@ -1,2 +0,0 @@
-// @bun
-import{hs,Jr,ei,Zr,ti}from"./vm-hands-entry-lite-n3274tws.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{hs as FUTURE_DEVICE_CONSENT_SCOPE,Jr as installationReceiptPath,Zr as installerReasonAlias,ei as installerReceiptLauncher,ti as loadInstallationReceipt};

package/bin/vm-hands/local-automation-wjsbhagn.js

@@ -1,2 +0,0 @@
-// @bun
-import{Pn,Hs,zs,qs,Ws,Rn}from"./vm-hands-entry-lite-11dq75hb.js";import"./vm-hands-entry-lite-413em054.js";import"./vm-hands-entry-lite-60t7x9vw.js";import"./vm-hands-entry-lite-bvqwsd3b.js";import"./vm-hands-entry-lite-89ahrw19.js";import"./vm-hands-entry-lite-sfmeafdm.js";import"./vm-hands-entry-lite-5wsygx6n.js";import"./vm-hands-entry-lite-hc11hecd.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-c0t5xpzh.js";import"./vm-hands-entry-lite-scvg31ds.js";import"./vm-hands-entry-lite-vf02kfyy.js";import"./vm-hands-entry-lite-9y3dvyfj.js";import"./vm-hands-entry-lite-n3274tws.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-88yjxxvf.js";import"./vm-hands-entry-lite-mfvtp7py.js";import"./vm-hands-entry-lite-9x81cr3a.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{zs as ensureLocalBrowser,Pn as localAutomationAvailable,qs as localBrowserProfile,Hs as localUserChromeHost,Ws as runAutomationCallLocally,Rn as runLocalAutomation};

package/bin/vm-hands/local-capabilities-45tqt3q6.js

@@ -1,2 +0,0 @@
-// @bun
-import{ns,Wi,mn,is,os,ss,as,Ms,$s,Bs,Fs}from"./vm-hands-entry-lite-nj4kjex8.js";import"./vm-hands-entry-lite-wfc0agnt.js";import"./vm-hands-entry-lite-dhb4fwrv.js";import"./vm-hands-entry-lite-0zby1r00.js";import"./vm-hands-entry-lite-a6w60nv9.js";import"./vm-hands-entry-lite-tash5m18.js";import"./vm-hands-entry-lite-kwmjn9y3.js";import"./vm-hands-entry-lite-c4959xva.js";import"./vm-hands-entry-lite-11dq75hb.js";import"./vm-hands-entry-lite-413em054.js";import"./vm-hands-entry-lite-60t7x9vw.js";import"./vm-hands-entry-lite-bvqwsd3b.js";import"./vm-hands-entry-lite-89ahrw19.js";import"./vm-hands-entry-lite-sfmeafdm.js";import"./vm-hands-entry-lite-5wsygx6n.js";import"./vm-hands-entry-lite-hc11hecd.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-c0t5xpzh.js";import"./vm-hands-entry-lite-scvg31ds.js";import"./vm-hands-entry-lite-vf02kfyy.js";import"./vm-hands-entry-lite-9y3dvyfj.js";import"./vm-hands-entry-lite-n3274tws.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-88yjxxvf.js";import"./vm-hands-entry-lite-mfvtp7py.js";import"./vm-hands-entry-lite-9x81cr3a.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{r as LocalCapabilityError,ns as SHORT_REQUEST_CAPABILITIES,Ms as capabilityInventoryForRoots,Wi as confinedExecutionShell,is as defaultLocalCommandRunner,$s as deliverLocalHandsEnvironment,as as enrolledRootPaths,Fs as executeLocalOperation,Bs as rebindLocalHandsControl,os as runFileCapability,ss as runTransferCapability,mn as spawnCaptured};

package/bin/vm-hands/local-desktop-users-qdpbfh6s.js

@@ -1,2 +0,0 @@
-// @bun
-import{Pt,Sa,Ea,ji,Ui}from"./vm-hands-entry-lite-9x81cr3a.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Sa as forgetLocalDesktopUse,Ui as holdLocalDesktop,Pt as noteLocalDesktopUse,Ea as releaseLocalDesktop,ji as trackDesktopRun};

package/bin/vm-hands/local-display-session-efjd2gvs.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ft,Vs,G,qe,jt}from"./vm-hands-entry-lite-413em054.js";import"./vm-hands-entry-lite-60t7x9vw.js";import"./vm-hands-entry-lite-bvqwsd3b.js";import"./vm-hands-entry-lite-89ahrw19.js";import"./vm-hands-entry-lite-sfmeafdm.js";import"./vm-hands-entry-lite-5wsygx6n.js";import"./vm-hands-entry-lite-hc11hecd.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-c0t5xpzh.js";import"./vm-hands-entry-lite-vf02kfyy.js";import"./vm-hands-entry-lite-9y3dvyfj.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-9x81cr3a.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{qe as ensureLinuxDesktop,Ft as localDisplayAvailable,Vs as localDisplayReady,G as privateDirectory,jt as runLocalDisplayStream};

package/bin/vm-hands/local-display-video-bdmm490z.js

@@ -1,2 +0,0 @@
-// @bun
-import{On,In,Dn,Nn,Rr}from"./vm-hands-entry-lite-60t7x9vw.js";import"./vm-hands-entry-lite-bvqwsd3b.js";import"./vm-hands-entry-lite-89ahrw19.js";import"./vm-hands-entry-lite-sfmeafdm.js";import"./vm-hands-entry-lite-vf02kfyy.js";import"./vm-hands-entry-lite-9y3dvyfj.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{On as MAC_SCREEN,In as WINDOWS_SCREEN,Dn as createDisplayVideoLane,Rr as localDisplayVideoAvailable,Nn as simulatorVideoFfmpeg};

package/bin/vm-hands/local-managed-process-z5jpvttg.js

@@ -1,2 +0,0 @@
-// @bun
-import{st,fr,js,Us}from"./vm-hands-entry-lite-dhb4fwrv.js";import"./vm-hands-entry-lite-0zby1r00.js";import"./vm-hands-entry-lite-a6w60nv9.js";import"./vm-hands-entry-lite-tash5m18.js";import"./vm-hands-entry-lite-kwmjn9y3.js";import"./vm-hands-entry-lite-c4959xva.js";import"./vm-hands-entry-lite-bvqwsd3b.js";import"./vm-hands-entry-lite-hc11hecd.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-c0t5xpzh.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-88yjxxvf.js";import"./vm-hands-entry-lite-mfvtp7py.js";import"./vm-hands-entry-lite-9x81cr3a.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{st as ManagedProcessStoppedError,js as controlManagedDeviceProcess,Us as retireManagedDeviceProcess,fr as runManagedDeviceProcess};

package/bin/vm-hands/local-pty-session-s60ca00y.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ir,Vt,Dr,ds,Un,Nr,Hn}from"./vm-hands-entry-lite-5wsygx6n.js";import"./vm-hands-entry-lite-hc11hecd.js";import"./vm-hands-entry-lite-td73npv3.js";import"./vm-hands-entry-lite-c0t5xpzh.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{Vt as LOCAL_PTY_MAX_BUFFERED_OUTPUT_BYTES,Dr as LOCAL_PTY_MAX_SESSIONS,Ir as LOCAL_PTY_MAX_SESSION_MS,Nr as defaultConnect,ds as defaultLoginShell,Un as ptyRuntimeSupported,Hn as runLocalPtySession};

package/bin/vm-hands/managed-runtime-ze7n8w7x.js

@@ -1,2 +0,0 @@
-// @bun
-import{Rs,Ts,Os,Is,Ds,Ns,Ls}from"./vm-hands-entry-lite-x1vm200a.js";import"./vm-hands-entry-lite-c4959xva.js";import"./vm-hands-entry-lite-vf02kfyy.js";import"./vm-hands-entry-lite-9y3dvyfj.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Ds as acquireManagedRuntimeDirectoryLock,Os as currentManagedRuntimeVersion,Ls as flushManagedRuntimeLifecycleEvents,Is as isManagedRuntimeVersionExecutable,Ts as legacyManagedRuntimePaths,Rs as managedRuntimePaths,Ns as recordManagedRuntimeLifecycle};

package/bin/vm-hands/permissions-k1tnx28f.js

@@ -1,2 +0,0 @@
-// @bun
-import{ls,us,Ks,Js}from"./vm-hands-entry-lite-89ahrw19.js";import"./vm-hands-entry-lite-sfmeafdm.js";import"./vm-hands-entry-lite-vf02kfyy.js";import"./vm-hands-entry-lite-9y3dvyfj.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";export{Js as allowMacPermissions,Ks as permissionsSummary,us as readMacPermissions,ls as reasonIdentity};

package/bin/vm-hands/serve-service-3kj6xp04.js

@@ -1,2 +0,0 @@
-// @bun
-import{Wr,xe,J,Jn,Zs,Do,Xs,Ye,ps,Zn,Ys,Qs,Vr,ea,ta}from"./vm-hands-entry-lite-scvg31ds.js";import"./vm-hands-entry-lite-vf02kfyy.js";import"./vm-hands-entry-lite-9y3dvyfj.js";import"./vm-hands-entry-lite-n3274tws.js";import"./vm-hands-entry-lite-t82dzcxb.js";import"./vm-hands-entry-lite-a3p6xz53.js";import"./vm-hands-entry-lite-haws181e.js";import"./vm-hands-entry-lite-39qv4sqt.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Wr as WORKER_SERVICE_ENV,J as WorkerServiceError,Do as connectServiceLabel,xe as defaultWorkerServiceHost,Qs as installWorkerService,Ye as installedWorkerService,Xs as isConnectServiceLabel,ta as removeWorkerService,Vr as restartWorkerService,ea as retargetWorkerServiceLogs,ps as retireLegacyWorkerService,Ys as workerServiceDefinitionCurrent,Jn as workerServiceLauncher,Zn as workerServiceProcessRunning,Zs as workerServiceRetargetPending};

package/bin/vm-hands/version-qxsa289q.js

@@ -1,2 +0,0 @@
-// @bun
-import{Qe,Qn}from"./vm-hands-entry-lite-9y3dvyfj.js";export{Qn as CLI_USER_AGENT,Qe as CLI_VERSION};

package/bin/vm-hands/vm-hands-entry-lite-413em054.js

@@ -1,150 +0,0 @@
-// @bun
-import{Mn,$n,Ro,Wt}from"./vm-hands-entry-lite-sfmeafdm.js";import{Tn,Ve,go,On,In,Dn,Rr,x}from"./vm-hands-entry-lite-60t7x9vw.js";import{Pt}from"./vm-hands-entry-lite-9x81cr3a.js";import{Nr}from"./vm-hands-entry-lite-5wsygx6n.js";import{j}from"./vm-hands-entry-lite-hc11hecd.js";import{a}from"./vm-hands-entry-lite-haws181e.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as oe,spawn as ae}from"child_process";import{randomBytes as ge}from"crypto";import{chmodSync as Me,existsSync as ce,lstatSync as Ce,mkdirSync as Ke,readFileSync as be,rmSync as xe,writeFileSync as T}from"fs";import{connect as Ie}from"net";import{join as P}from"path";var u=32,R=76;var W="./desktop-wallpaper-0pjhgyfk.jpg";var Y="./dock-browser-afp005mt.png";var v="./dock-files-rywdm96b.png";var Z="./dock-terminal-s41cj1jp.png";var H="./grok-wallpaper-71zwn2pj.jpg";var z="./grok-dock-browser-pzw59wnd.png";var V="./grok-dock-files-eckq444x.png";var ee="./grok-dock-terminal-hcpz3e43.png";var re=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
-# The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
-# python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
-# Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE
-import ctypes, sys
-import gi
-gi.require_version("GdkPixbuf", "2.0")
-from gi.repository import GdkPixbuf
-x = ctypes.cdll.LoadLibrary("libX11.so.6")
-x.XOpenDisplay.restype = ctypes.c_void_p
-x.XOpenDisplay.argtypes = [ctypes.c_char_p]
-d = x.XOpenDisplay(None)
-if not d: sys.exit("no display")
-for name, res, args in [
-    ("XDefaultScreen", ctypes.c_int, [ctypes.c_void_p]),
-    ("XRootWindow", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDisplayWidth", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDisplayHeight", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultDepth", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultVisual", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_int]),
-    ("XDefaultGC", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_int]),
-    ("XCreatePixmap", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_uint, ctypes.c_uint, ctypes.c_uint]),
-    ("XCreateImage", ctypes.c_void_p, [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_uint, ctypes.c_int, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint, ctypes.c_uint, ctypes.c_int, ctypes.c_int]),
-    ("XPutImage", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_int, ctypes.c_int, ctypes.c_int, ctypes.c_int, ctypes.c_uint, ctypes.c_uint]),
-    ("XInternAtom", ctypes.c_ulong, [ctypes.c_void_p, ctypes.c_char_p, ctypes.c_int]),
-    ("XChangeProperty", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_int, ctypes.c_int, ctypes.c_void_p, ctypes.c_int]),
-    ("XSetWindowBackgroundPixmap", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong, ctypes.c_ulong]),
-    ("XClearWindow", ctypes.c_int, [ctypes.c_void_p, ctypes.c_ulong]),
-    ("XSetCloseDownMode", ctypes.c_int, [ctypes.c_void_p, ctypes.c_int]),
-    ("XCloseDisplay", ctypes.c_int, [ctypes.c_void_p]),
-]:
-    f = getattr(x, name); f.restype = res; f.argtypes = args
-s = x.XDefaultScreen(d); root = x.XRootWindow(d, s)
-w, h = x.XDisplayWidth(d, s), x.XDisplayHeight(d, s)
-if x.XDefaultDepth(d, s) != 24: sys.exit("unsupported depth")
-# Scale to cover the screen, then crop the centre.
-src = GdkPixbuf.Pixbuf.new_from_file(sys.argv[1])
-k = max(w / src.get_width(), h / src.get_height())
-sw, sh = max(w, round(src.get_width() * k)), max(h, round(src.get_height() * k))
-pb = src.scale_simple(sw, sh, GdkPixbuf.InterpType.BILINEAR).new_subpixbuf((sw - w) // 2, (sh - h) // 2, w, h).copy()
-if pb.get_has_alpha(): pb = pb.composite_color_simple(w, h, GdkPixbuf.InterpType.NEAREST, 255, 1, 0, 0)
-rgb, stride = pb.get_pixels(), pb.get_rowstride()
-bgrx = bytearray(w * h * 4)
-for y in range(h):
-    row = rgb[y * stride:y * stride + w * 3]; o = y * w * 4
-    bgrx[o:o + w * 4:4] = row[2::3]; bgrx[o + 1:o + w * 4:4] = row[1::3]; bgrx[o + 2:o + w * 4:4] = row[0::3]
-buf = ctypes.create_string_buffer(bytes(bgrx), len(bgrx))
-pix = x.XCreatePixmap(d, root, w, h, 24)
-img = x.XCreateImage(d, x.XDefaultVisual(d, s), 24, 2, 0, buf, w, h, 32, 0)  # ZPixmap
-x.XPutImage(d, pix, x.XDefaultGC(d, s), img, 0, 0, 0, 0, w, h)
-ref = ctypes.c_ulong(pix)
-for atom in (b"_XROOTPMAP_ID", b"ESETROOT_PMAP_ID"):
-    x.XChangeProperty(d, root, x.XInternAtom(d, atom, 0), 20, 32, 0, ctypes.byref(ref), 1)  # XA_PIXMAP, PropModeReplace
-x.XSetWindowBackgroundPixmap(d, root, pix)
-x.XClearWindow(d, root)
-x.XSetCloseDownMode(d, 1)  # RetainPermanent: the pixmap outlives this process
-x.XCloseDisplay(d)
-`;function Ne(e){return`<?xml version="1.0" encoding="UTF-8"?>
-<openbox_config xmlns="http://openbox.org/3.4/rc">
-  <theme><keepBorder>no</keepBorder></theme>
-  <applications>
-    <!-- Debian Chromium is "Chromium"; Chrome for Testing is "Chromium-browser". -->
-    <application class="Chromium*">
-      <decor>no</decor>
-      <position force="yes"><x>${u}</x><y>${u}</y></position>
-      <size><width>${e.width-u*2}</width><height>${e.height-u-R}</height></size>
-    </application>
-  </applications>
-</openbox_config>`}var Te=`# Remote sandbox dock \u2014 launcher icons only, centred, no panel fill
-panel_items = L
-panel_size = 100% 46
-panel_margin = 0 10
-panel_padding = 0 0 10
-panel_position = bottom center horizontal
-panel_shrink = 1
-panel_background_id = 0
-panel_layer = top
-mouse_effects = 1
-mouse_hover_icon_asb = 100 0 12
-mouse_pressed_icon_asb = 100 0 -12
-
-launcher_icon_size = 46
-launcher_padding = 0 0 10
-launcher_background_id = 0
-launcher_tooltip = 1
-
-launcher_item_app = /tmp/ara-chromium.desktop
-launcher_item_app = /tmp/ara-terminal.desktop
-launcher_item_app = /tmp/ara-files.desktop
-`,te=32,Ae=`# Remote sandbox dock (grok look) \u2014 small launcher icons only, centred, no panel fill
-panel_items = L
-panel_size = 100% ${te+16}
-panel_margin = 0 0
-panel_padding = 0 0 8
-panel_position = bottom center horizontal
-panel_shrink = 1
-panel_background_id = 0
-panel_layer = top
-mouse_effects = 1
-mouse_hover_icon_asb = 100 0 10
-mouse_pressed_icon_asb = 100 0 -10
-
-launcher_icon_size = ${te}
-launcher_padding = 0 0 8
-launcher_background_id = 0
-launcher_tooltip = 1
-
-launcher_item_app = /tmp/ara-chromium.desktop
-launcher_item_app = /tmp/ara-files.desktop
-launcher_item_app = /tmp/ara-terminal.desktop
-`,Le=`corner-radius = 12;
-rounded-corners-exclude = [
-  "class_g = 'tint2'",
-  "window_type = 'dock'",
-  "window_type = 'desktop'"
-];
-backend = "xrender";
-shadow = false;
-fading = false;
-vsync = false;
-inactive-opacity = 1.0;
-active-opacity = 1.0;
-`,_e="/tmp/ara-dock-browser.png",Oe=`[Desktop Entry]
-Name=Chrome
-Exec=chromium --no-sandbox %U
-Icon=${_e}
-Type=Application
-Categories=Network;WebBrowser;
-`,Be=`[Desktop Entry]
-Name=Terminal
-Exec=bash -c "DISPLAY=:99 xterm -fa DejaVuSansMono -fs 11 -bg black -fg white"
-Icon=/tmp/ara-dock-terminal.png
-Type=Application
-Categories=System;TerminalEmulator;
-`,se=`[Desktop Entry]
-Name=Files
-Exec=bash -c "DISPLAY=:99 pcmanfm --no-desktop"
-Icon=/tmp/ara-dock-files.png
-Type=Application
-Categories=System;FileManager;
-`;var ne={"wallpaper.jpg":W,"dock-browser.png":Y,"dock-terminal.png":Z,"dock-files.png":v,"grok-wallpaper.jpg":H,"grok-dock-browser.png":z,"grok-dock-terminal.png":ee,"grok-dock-files.png":V},Je=re,we='set_wallpaper() { if command -v feh >/dev/null 2>&1; then feh --bg-fill "$1"; else python3 "$2" "$1"; fi; }';function pe(e){let t=(y)=>y.replaceAll("DISPLAY=:99",`DISPLAY=${e.display}`).replaceAll("/tmp/ara-",`${e.root}/ara-`),p=e.look==="grok",n=new Set(e.absent??[]),s=p&&n.has("files")&&e.filesViewerExec?e.filesViewerExec:null;if(s)n.delete("files");let i=(p?Ae:Te).split(`
-`).filter((y)=>!(n.has("terminal")&&y.endsWith("/ara-terminal.desktop"))&&!(n.has("files")&&y.endsWith("/ara-files.desktop"))).join(`
-`),o=(y)=>p?y.replace("/tmp/ara-dock-","/tmp/ara-grok-dock-"):y,c=s?se.replace(/^Exec=.*$/m,`Exec=${s}`).replace("Categories=System;FileManager;","Categories=Utility;Viewer;"):se,l=p?"ara-grok-wallpaper.jpg":"ara-wallpaper.jpg",b={"openbox/rc.xml":Ne(e.screen),"tint2/tint2rc":t(i),"picom/picom.conf":Le,...n.has("terminal")?{}:{"ara-terminal.desktop":t(o(Be))},...n.has("files")?{}:{"ara-files.desktop":t(o(c))},"ara-chromium.desktop":t(o(Oe)).replace("chromium --no-sandbox %U",e.browserExec),"ara-set-root-wallpaper.py":Je},q=[...N.slice(0,3),we,`[ ! -f "$ROOT/${l}" ] || set_wallpaper "$ROOT/${l}" "$ROOT/ara-set-root-wallpaper.py" || true`,'if alive tint2 && ! cmp -s "$ROOT/tint2/tint2rc" "$ROOT/tint2/applied"; then read -r pid _ <"$ROOT/tint2.pid"; kill -USR1 "$pid" 2>/dev/null || true; fi','cp "$ROOT/tint2/tint2rc" "$ROOT/tint2/applied" 2>/dev/null || true',...N.slice(3)];return{files:b,start:q}}var N=['ticks() { line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1; rest=${line##*) }; case $rest in Z*|X*) return 1;; esac; printf "%s" "$rest" | cut -d " " -f20; }','alive() { [ -f "$ROOT/$1.pid" ] || return 1; read -r pid start <"$ROOT/$1.pid"; current=$(ticks "$pid") || return 1; [ "$current" = "$start" ] && kill -0 "$pid" 2>/dev/null; }','launch() { name=$1; shift; "$@" 9>&- >"$ROOT/$name.log" 2>&1 & pid=$!; start=$(ticks "$pid"); printf "%s %s\\n" "$pid" "$start" >"$ROOT/$name.pid"; }','if [ -f "$ROOT/tint2/tint2rc" ] && ! alive tint2 && command -v tint2 >/dev/null 2>&1; then launch tint2 tint2 -c "$ROOT/tint2/tint2rc"; fi','if [ -f "$ROOT/picom/picom.conf" ] && ! alive picom && command -v picom >/dev/null 2>&1; then launch picom picom --config "$ROOT/picom/picom.conf"; fi'];var me=43200000,h=":99",Fe=60000,Q=15000,A={width:1280,height:800},Ge=/^[A-Za-z0-9._:-]{1,160}$/;function ke(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}var je=["video","viewer","viewer_same_network","viewer_network","look"];function Ue(e,t=Date.now()){let p=["relay_url","session_id","expires_at"];if(!ke(e)||p.some((l)=>!(l in e))||Object.keys(e).some((l)=>!p.includes(l)&&!je.includes(l)))throw new r("invalid_display_request","Reason desktop request is malformed.");let n="video"in e?Ro(e.video):void 0,s="viewer"in e?Mn(e.viewer):null,i="look"in e?$n(e.look):null;if(n===null)throw new r("invalid_display_request","Reason desktop video request is invalid.");let o=null;try{o=typeof e.relay_url==="string"?new URL(e.relay_url):null}catch{}if(!o||o.protocol!=="wss:"&&o.protocol!=="ws:"||o.username||o.password)throw new r("invalid_display_request","Reason desktop relay URL is invalid.");if(typeof e.session_id!=="string"||!Ge.test(e.session_id))throw new r("invalid_display_request","Reason desktop session identity is invalid.");let c=typeof e.expires_at==="string"?Date.parse(e.expires_at):Number.NaN;if(!Number.isFinite(c)||c<=t)throw new r("invalid_display_request","Reason desktop session has already expired.");return{relay_url:e.relay_url,session_id:e.session_id,expires_at:new Date(Math.min(c,t+me)).toISOString(),...n?{video:n}:{},...s?{viewer:s}:{},...n&&e.viewer_same_network===!0?{viewer_same_network:!0}:{},...i?{look:i}:{}}}function Ft(e=process.platform){return(e==="linux"||e==="darwin"||e==="win32")&&x()?.features.display===!0}async function Vs(){if(process.platform==="win32")return Ft()&&await Rr();if(process.platform!=="darwin")return Ft();return await Rr()}function G(e){Ke(e,{recursive:!0,mode:448});let t=Ce(e);if(!t.isDirectory()||t.isSymbolicLink()||process.getuid&&t.uid!==process.getuid())throw new r("display_unavailable","Reason desktop state directory is not private.");Me(e,448)}function We(e,t){let p=(s)=>{let i=Buffer.alloc(2);return i.writeUInt16BE(s.length),Buffer.concat([i,s])},n=Buffer.from([255,255]);return Buffer.concat([n,p(Buffer.alloc(0)),p(Buffer.from(e)),p(Buffer.from("MIT-MAGIC-COOKIE-1")),p(t)])}function d(e,t,p=2000){return new Promise((n)=>{let s=Ie(e),i="",o=(c)=>{s.destroy(),n(c)};s.setTimeout(p,()=>o(!1)),s.once("error",()=>o(!1)),s.once("close",()=>o(!1)),s.once("connect",()=>{if(!t)o(!0)}),s.on("data",(c)=>{if(i+=c.toString("latin1"),i.length>=4)o(i.startsWith("RFB "))})})}async function C(e,t){let p=Date.now()+t;while(Date.now()<p){if(await e())return!0;await new Promise((n)=>setTimeout(n,100))}return!1}function L(e,t,p){return new Promise((n)=>{let s=ae(e,t,{detached:!0,stdio:"ignore",env:p});s.once("error",()=>n(-1)),s.once("exit",(i)=>n(i)),s.unref(),setTimeout(()=>n(null),Q).unref()})}var M=null;function qe(e=a()){return M??=Ye(e).finally(()=>{M=null}),M}async function Ye(e){let t=x({home:e});if(!t?.xvfb||!t.x11vnc||!t.openbox)throw new r("display_unavailable","Run `reason desktop install` on this machine to enable its desktop.");Pt({root:t.root,automation:t.automation,extensionDir:t.extensionDir});let p=P(t.root,"display");G(p);let n=await Ze(e,p,t.x11vnc);if(n)return n;let s={display:h,xauthority:P(p,"Xauthority"),rfbSocket:P(p,"rfb.sock")},i=P(p,"pulse"),o=(async()=>{try{G(i)}catch{return null}return await go(i,t.pulseaudio)})();G(P(p,"home"));let c=K(p,s,t.pulseaudio),l=async()=>({...s,sound:await o});if(await d({path:s.rfbSocket},!0))return De(P(p,"theme"),N,c),await l();if(!ce(s.xauthority))T(s.xauthority,We(h.slice(1),ge(16)),{mode:384,flag:"wx"});let b=I(P(p,"theme"),s.display,A,e),q={path:`/tmp/.X11-unix/X${h.slice(1)}`};if(!await d(q,!1)){let y=`${A.width}x${A.height}`;if(t.xvnc)xe(s.rfbSocket,{force:!0}),L(t.xvnc,[s.display,"-geometry",y,"-depth","24","-nolisten","tcp","-auth",s.xauthority,"-rfbport","-1","-rfbunixpath",s.rfbSocket,"-SecurityTypes","None","-UseBlacklist=0","-AlwaysShared","-desktop","Reason"],c);else L(t.xvfb,[s.display,"-screen","0",`${y}x24`,"-nolisten","tcp","-auth",s.xauthority],c);if(!await C(()=>d(q,!1),Q)||t.xvnc&&!await C(()=>d({path:s.rfbSocket},!0),Q))throw new r("display_unavailable","Reason could not start the virtual display.");L(t.openbox,["--config-file",b.openboxConfig],c)}if(await m(b,c),!await le(t.x11vnc,s,p,"x11vnc.log",c))throw new r("display_unavailable","Reason could not start the desktop server.");return await l()}function K(e,t,p){let n={HOME:P(e,"home"),PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:t.display,XAUTHORITY:t.xauthority};if(p)n.PULSE_SERVER=Ve(Tn(P(e,"pulse")));return n}async function le(e,t,p,n,s){if(await d({path:t.rfbSocket},!0))return!0;xe(t.rfbSocket,{force:!0});let i=await L(e,["-display",t.display,"-auth",t.xauthority,"-rfbport","0","-rfbportv6","-1","-unixsock",t.rfbSocket,"-nopw","-forever","-shared","-noxdamage","-sb","0","-rfbversion","3.7","-quiet","-bg","-o",P(p,n)],s);if(i!==null&&i!==0)return!1;return await C(()=>d({path:t.rfbSocket},!0),Q)}async function ve(){let e=["DISPLAY","XAUTHORITY","WAYLAND_DISPLAY","XDG_SESSION_TYPE"],t=(p)=>Object.fromEntries(e.flatMap((n)=>p[n]?[[n,p[n]]]:[]));if(process.env.DISPLAY)return t(process.env);try{let p=await new Promise((n,s)=>oe("systemctl",["--user","show-environment"],{encoding:"utf8",timeout:2000},(i,o)=>i?s(i):n(o)));return t(Object.fromEntries(p.split(`
-`).flatMap((n)=>{let s=n.indexOf("=");return s>0?[[n.slice(0,s),n.slice(s+1)]]:[]})))}catch{return{}}}var ie=new Set;async function Ze(e,t,p){let n=await ve(),s=/^:(\d+)(?:\.\d+)?$/.exec(n.DISPLAY??"")?.[1];if(!s||`:${s}`===h||n.WAYLAND_DISPLAY||n.XDG_SESSION_TYPE==="wayland")return null;let i={display:`:${s}`,xauthority:n.XAUTHORITY??P(e,".Xauthority"),rfbSocket:P(t,`rfb-${s}.sock`)},o=`${i.display} ${i.xauthority}`;if(ie.has(o)||!await d({path:`/tmp/.X11-unix/X${s}`},!1))return null;let c={HOME:e,PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:i.display,XAUTHORITY:i.xauthority};if(await le(p,i,t,`x11vnc-${s}.log`,c))return{...i,sound:null};return ie.add(o),process.stderr.write(`Reason worker: your screen ${i.display} could not be served; using the virtual desktop
-`),null}var Pe="look";function ye(e){try{return $n(be(P(e,Pe),"utf8").trim())??"reason"}catch{return"reason"}}function I(e,t,p,n,s=ye(e)){let i=`chromium --no-first-run --no-default-browser-check${process.geteuid?.()===0?" --no-sandbox":""} %U`,o=[["terminal","xterm"],["files","pcmanfm"]].filter(([,b])=>!ce(`/usr/bin/${b}`)).map(([b])=>b),c=`${i.replace(/ %U$/,"")} --app=file://${P(n,".reason","workspace")}/`,l=pe({root:e,display:t,screen:p,browserExec:i,absent:o,look:s,filesViewerExec:c});for(let b of["","openbox","tint2","picom"])G(P(e,b));T(P(e,Pe),`${s}
-`,{mode:384});for(let[b,q]of Object.entries(l.files))T(P(e,b),q,{mode:384});for(let[b,q]of Object.entries(ne))T(P(e,`ara-${b}`),be(q),{mode:384});return{root:e,openboxConfig:P(e,"openbox","rc.xml"),start:l.start}}function m(e,t){return De(e.root,[...e.start,"openbox --reconfigure >/dev/null 2>&1 || true"],t)}function De(e,t,p){let n=[`ROOT=${JSON.stringify(e)}`,...t].join(`
-`);return new Promise((s)=>{let i=ae("/bin/sh",["-c",n],{stdio:"ignore",env:{...p,PATH:"/usr/bin:/bin"}}),o=setTimeout(()=>{i.kill(),s()},Q);i.once("error",()=>{clearTimeout(o),s()}),i.once("exit",()=>{clearTimeout(o),s()})})}var He=2073600,ze=320;function er(e,t){let p=Math.min(1,Math.sqrt(He/(e.width*e.height))),n=(s,i)=>Math.min(Math.floor(i/8)*8,Math.max(ze,Math.round(s*p/8)*8));return{width:n(e.width,t.width),height:n(e.height,t.height)}}function F(e,t,p){return new Promise((n)=>oe(e,t,{env:p,encoding:"utf8",timeout:5000},(s,i)=>n(s?null:i)))}function fe(e){let t=/current (\d+) x (\d+), maximum (\d+) x (\d+)/.exec(e),p=e.split(`
-`),n=p.findIndex((i)=>/^\S+ connected/.test(i));if(!t||n<0)return null;let s=[];for(let i of p.slice(n+1)){let o=/^\s+(\d+x\d+)\s/.exec(i);if(!o)break;s.push(o[1])}return{current:{width:Number(t[1]),height:Number(t[2])},maximum:{width:Number(t[3]),height:Number(t[4])},output:p[n].split(" ")[0],modes:s}}async function rr(e,t,p){if(e.display!==h)return null;let n={PATH:"/usr/bin:/bin",DISPLAY:e.display,XAUTHORITY:e.xauthority},s=(l)=>F("xrandr",l,n),i=fe(await s(["--query"])??"");if(!i||i.maximum.width<=i.current.width&&i.maximum.height<=i.current.height)return null;let o=er(t,i.maximum);if(o.width===i.current.width&&o.height===i.current.height)return{size:o,changed:!1};let c=`${o.width}x${o.height}`;if(!i.modes.includes(c)){if(await s(["--newmode",c,"60",...[o.width,o.width,o.width,o.width,o.height,o.height,o.height,o.height].map(String)]),await s(["--addmode",i.output,c])===null)return null}return p(),await s(["--output",i.output,"--mode",c])===null?null:{size:o,changed:!0}}async function tr(e,t){let p=a(),n=x({home:p});if(!n)return;let s=P(n.root,"display"),i=K(s,e,n.pulseaudio);await m(I(P(s,"theme"),e.display,t,p),i);let o=t.width-u*2,c=t.height-u-R;await F("xdotool",["search","--onlyvisible","--class","Chromium","windowsize","%@",String(o),String(c),"windowmove","%@",String(u),String(u)],{...i,PATH:"/usr/bin:/bin"})}var _=Promise.resolve();function sr(e,t,p=()=>{}){let n=_.then(()=>rr(e,t,p));return _=n.then((s)=>s?.changed?tr(e,s.size):void 0).catch(()=>{}),n.then((s)=>s?.size??null,()=>null)}function nr(e,t){if(e.display!==h)return Promise.resolve();let p=_.then(async()=>{let n=a(),s=x({home:n});if(!s)return;let i=P(s.root,"display"),o=P(i,"theme");if(ye(o)===t)return;let c=K(i,e,s.pulseaudio),l=fe(await F("xrandr",["--query"],{PATH:"/usr/bin:/bin",DISPLAY:e.display,XAUTHORITY:e.xauthority})??"");await m(I(o,e.display,l?.current??A,n,t),c)});return _=p.catch(()=>{}),p.catch(()=>{})}async function jt(e,t={}){let p=t.now??Date.now,n=Ue(e.payload,p());if(e.signal.throwIfAborted(),!n.video)throw new r("display_video_required","Reason desktops stream as video now; this request came without it.");let s=t.platform??process.platform;if(s!=="linux"&&s!=="darwin"&&s!=="win32")throw new r("display_video_unsupported","This machine does not serve desktop video.");let{video:i,look:o}=n,c=(t.video?.desktop??(s==="darwin"?async()=>On:s==="win32"?async()=>In:async()=>{let l=await qe();if(o)await nr(l,o);return l}))();return await pr(e.signal,n,t,p,(l)=>Dn(l,{request:i,desktop:c,...n.viewer?{viewer:n.viewer}:{},viewerSameNetwork:n.viewer_same_network===!0},{resizeDesktop:sr,...t.video}),(l)=>Wt({type:"error",code:l}))}function pr(e,t,p,n,s,i){let o=n();return new Promise((c,l)=>{let b=null,q=!1,y=!1,k,O,S,B=!1,f=null,X=(D)=>{if(y)return;if(f)D=f.outcome;y=!0,clearTimeout(k),clearTimeout(O),e.removeEventListener("abort",w),S?.close();try{b?.close(1000,"display_session_over")}catch{}if("error"in D){l(D.error);return}c({reason:D.reason,...S?.summary(),duration_ms:Math.max(0,n()-o)})},J=()=>X({error:new r("display_relay_unavailable","Reason could not reach the desktop relay.")}),w=()=>{let D=e.reason;X({error:D instanceof r?D:new r("cancelled","Reason closed the desktop session.")})},U=()=>{if(!f||!b)return;let{outcome:D}=f,E=!("error"in D)?D.reason:D.error instanceof r?D.error.code:"display_unavailable";if(!f.told)try{b.send(i(E))}catch{}X(D)};if(S=s({get done(){return y||f!==null},get open(){return q&&!y&&f===null},get bufferedAmount(){return b?.bufferedAmount??0},send(D){if(y||f||!q||!b)return;try{b.send(D)}catch{X({reason:"relay_closed"})}},end:(D)=>{if(y||f)return;if(!("error"in D)&&B&&q){X(D);return}if(f={outcome:D,told:!("error"in D)&&q},B&&q)U()}}),y){S.close();return}if(e.aborted){w();return}e.addEventListener("abort",w,{once:!0}),k=setTimeout(()=>X({reason:"session_expired"}),Math.max(1,Date.parse(t.expires_at)-n())),O=setTimeout(()=>X({reason:"viewer_absent"}),p.viewerWaitMs??Fe);try{b=(p.connect??Nr)(t.relay_url,(p.loadProxy??j)()?.url)}catch{J();return}b.binaryType="arraybuffer",b.onopen=()=>{if(y||!b)return;q=!0,S?.opened()},b.onmessage=(D)=>{if(y)return;let E=D.data,g=E instanceof ArrayBuffer?new Uint8Array(E):ArrayBuffer.isView(E)?new Uint8Array(E.buffer,E.byteOffset,E.byteLength):null;if(!g||g.byteLength===0)return;if(clearTimeout(O),B=!0,f){U();return}S?.received(g)},b.onclose=()=>{if(y)return;if(!q){J();return}X({reason:"relay_closed"})},b.onerror=()=>{if(y||q)return;J()}})}
-export{Ft,Vs,G,qe,jt};

package/bin/vm-hands/vm-hands-entry-lite-9y3dvyfj.js

@@ -1,2 +0,0 @@
-// @bun
-import{tr}from"./vm-hands-entry-lite-h0s6n13f.js";var Qe=tr.version,Qn=`reason-cli/${Qe}`;export{Qe,Qn};

package/bin/vm-hands/vm-hands-entry-lite-dhb4fwrv.js

@@ -1,4 +0,0 @@
-// @bun
-import{H}from"./vm-hands-entry-lite-39qv4sqt.js";import{D,T,b}from"./vm-hands-entry-lite-tash5m18.js";import{je,gr,_r,Sn,En,ct}from"./vm-hands-entry-lite-0zby1r00.js";import{Mr}from"./vm-hands-entry-lite-hc11hecd.js";import{p,ut,An,_e,we}from"./vm-hands-entry-lite-kwmjn9y3.js";import{v,h}from"./vm-hands-entry-lite-c4959xva.js";import{a,nr,qo}from"./vm-hands-entry-lite-haws181e.js";import{an,y,t,k,o,d,ms,Oe,Bi,u,i,W,g,ee,s,n,cn}from"./vm-hands-entry-lite-4cdn822w.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{se,A}from"./vm-hands-entry-lite-1kt82jes.js";import{randomUUID as Q}from"crypto";import{spawn as Le}from"child_process";import{existsSync as Z,lstatSync as me,mkdirSync as We,readFileSync as Ne,realpathSync as G,rmSync as Ve,writeFileSync as He}from"fs";import{dirname as Ue,join as j,relative as qe,sep as Je}from"path";var Se=["process.run.v1","process.full.v1"],xe=600000,Pe=1800000,Ee=20000,ne="process.cancel.v1",ie=i({action:n("start"),request_id:t().uuid(),command:t().min(1).max(16000).refine((e)=>!e.includes("\x00")),cwd:t().min(1).max(4096).refine((e)=>!e.includes("\x00")&&!e.startsWith("/")&&!e.split(/[\\/]/).includes("..")).describe("Path relative to the granted device root; omit to use that root. Must not start with /, contain a .. path segment, or contain a NUL character.").optional(),mode:s(["host","confined"]).default("host"),timeout_ms:o().int().min(1000).max(Pe).default(xe).describe("Absolute process budget including queue and startup time. Defaults to ten minutes; longer explicit requests require the selected root's advertised max_timeout_ms. Retrying never renews the deadline.")}).strict(),K={device_id:t().uuid(),root_id:t().uuid()},Re=g("action",[ie.extend(K),i({...K,action:n("inspect"),process_id:t().uuid(),after:o().int().min(0).default(0),wait_ms:o().int().min(0).max(Ee).default(0).describe("Wait for new output or a state change, bounded by this call's wait budget. Expiring this wait does not cancel the process or extend its deadline.")}).strict(),i({...K,action:n("cancel"),process_id:t().uuid()}).strict()]),Fe=an(Re,{io:"input"}),Ke=ie.extend({process_brain_fence:t().uuid(),process_expires_at:y.datetime()}).strict(),J=i({version:n(1),process_id:t().uuid(),state:s(["starting","running","exited","cancelled","expired","uncertain"]),exit_code:o().int().nullable(),first_cursor:o().int().min(0),next_cursor:o().int().min(0),truncated:d(),observed_at:y.datetime(),output:u(i({cursor:o().int().min(1),stream:s(["stdout","stderr"]),text:t().max(32768)}).strict()).max(128)}).strict().refine((e)=>{if(Buffer.byteLength(JSON.stringify(e))>1e5||e.next_cursor<e.first_cursor-1)return!1;if((e.state==="starting"||e.state==="running"||e.state==="uncertain")&&e.exit_code!==null)return!1;if(e.state==="exited"&&(e.exit_code===null||e.exit_code<0||e.exit_code>255))return!1;if(e.state==="cancelled"&&e.exit_code!==130||e.state==="expired"&&e.exit_code!==124)return!1;let _=e.first_cursor-1;for(let l of e.output){if(l.cursor<=_||l.cursor>e.next_cursor)return!1;_=l.cursor}return!0});function ae(e){return Se.includes(e)}var Xe=i({operation_constraints:ee(t(),Oe())}),Ye=i({ready:n(!0),version:n(1),execution_mode:s(["host","confined"]),max_timeout_ms:o().int().min(1000).optional()});var Ie=i({version:n(1),process_id:t().uuid(),state:s(["queued","cancelled_before_start","not_started"]),exit_code:ms(),output:u(Bi()).length(0),first_cursor:n(0),next_cursor:n(0),truncated:n(!1),cancellation_requested:n(!1),reason_code:s(["cancelled_before_start","process_journal_capacity","path_not_found","process_timeout_unsupported"]).optional(),expires_at:y.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it.")}).strict(),De=i({...J.shape,state:s(["queued","starting","running","exited","cancelled","expired","uncertain","cancelled_before_start","not_started"]),observed_at:y.datetime().optional(),expires_at:y.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it."),cancellation_requested:d(),reason_code:t().nullable().optional(),execution_authority:n("lost").optional().describe("Historical receipt only; the current Brain cannot control this older-generation process."),recovery:i({cause:n("brain_generation_changed"),terminal_confirmed:d(),next_step:s(["inspect_until_terminal","reconcile_effects_before_new_intent"])}).strict().optional().describe("Historical process recovery only. An unconfirmed outcome forbids replay. A confirmed terminal observation proves the old process stopped, not that its command had no effects. Reconcile the result; only restart still-needed, safely repeatable work with a new request_id and current authority. Respect user cancellation."),last_observed_state:J.shape.state.or(n("cancelled_before_start")).nullable().optional().describe("Last saved observation before authority was lost; a running observation does not establish current child liveness.")}).strict(),$e=an(De),Qe=W([J,Ie.refine((e)=>e.state==="cancelled_before_start")]),X=i({version:n(1),process_id:t().uuid(),state:s(["exited","cancelled","expired"]),exit_code:o().int().min(0).max(255),observed_at:y.datetime()}).strict().refine((e)=>(e.state!=="cancelled"||e.exit_code===130)&&(e.state!=="expired"||e.exit_code===124)),Ze=i({process_terminal_observation:X}).strict();var Ji="preview.serve.v1",Zi=43200000;var ce="preview.open.v1",de=1,_n="gid_proxy_v1",Xi="egress",yn=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::[1-9][0-9]{0,4})?$/,Ce=i({version:n(_n),allowed_domains:u(t().max(260).regex(yn)).max(1024)}).strict(),Ae=cn((e)=>H(e)!==null,"invalid workspace"),ke=i({version:n(1),request_id:k(),session_id:k(),command:t().min(1).max(16000).refine((e)=>!e.includes("\x00")),port:o().int().min(1024).max(65535),workspace:Ae,egress:Ce.optional()}).strict(),Yi=ke.extend({expires_at:y.datetime()}).strict();var Me=4,Te=5000;function Y(e,c,_){let l=null;try{l=ut(e)}catch{}An({deviceRelayUrl:l?.deviceRelayUrl??"",binding:l?.binding??null,jobId:c,port:l?.binding.port??0,reason:l?_:"binding_invalid"})}function le(e){let c=new Map;return{open(_){let l=(x)=>Y(_,e.claim.operation_id,x),I;try{I=ut(_)}catch{return l("binding_invalid")}let{binding:w,deviceRelayUrl:z}=I,E=e.claim.owner;if(!E||w.organizationId!==E.organization_id||w.userId!==E.user_id||w.deviceId!==E.device_id||w.rootId!==e.claim.root_id||w.jobId!==e.claim.operation_id||w.fenceId!==e.claim.operation_id||w.generation!==de||w.expiresAtMs>Math.min(Date.now()+p.lifetimeMs+Te,e.expiresAtMs))return l("binding_mismatch");if(w.expiresAtMs<=Date.now())return l("binding_expired");if(c.get(w.port)?.abort(),c.delete(w.port),c.size>=Me)return l("preview_capacity");let L=new AbortController;c.set(w.port,L);let P=we({binding:w,deniedPorts:e.deniedPorts,readCurrentJob:async()=>{if(L.signal.aborted)return null;let x=await e.inspect();return x?{binding:w,executorLaunchId:e.executorLaunchId,job:x}:null}});_e({binding:w,deviceRelayUrl:z,port:P,signal:L.signal}).then((x)=>x.closed,(x)=>{let R=x instanceof Error?x.message:"preview_failed";if(R!=="preview_not_authorized")process.stderr.write(`${JSON.stringify({event:"worker_preview.open_failed",job_id:w.jobId,port:w.port,reason_code:R})}
-`)}).finally(()=>{if(c.get(w.port)===L)c.delete(w.port)})},dispose(){for(let _ of c.values())_.abort();c.clear()}}}class st extends r{observation;constructor(e){super("process_authority_lost","Process authority was lost; the owned process group has stopped.");this.observation=e}}var fe=256,B=new Map,he="preview.serve.v1",V=new Map;function be(e){let c=V.get(e.operation_id);if(c){if(c.claim!==e)throw O("process_authority_lost");return c}if(V.size>=fe)throw O("process_journal_capacity");let _={claim:e,executing:!1,cancelRequested:!1,phase:"pending"};return V.set(e.operation_id,_),_}function pe(e){return{version:1,process_id:e,state:"cancelled_before_start",exit_code:null,output:[],first_cursor:0,next_cursor:0,truncated:!1,cancellation_requested:!1,reason_code:"cancelled_before_start"}}var ue=(e)=>new Promise((c)=>setTimeout(c,e)),O=(e="process_outcome_uncertain")=>new r(e,"The managed process outcome could not be confirmed; inspect its saved receipt before starting another intent.");function ze(e=a(),c=Ge()){let _=Ue(Mr({},e)),l=qe(nr(e),_),[I,...w]=l.split(Je);return{directory:j(c,l,"processes"),previous:[j(_,"processes"),...I==="reason"?[j(c,"ara",...w,"processes")]:[]]}}function Ge(){if(process.platform!=="darwin")throw new r("process_unavailable","Managed Mac process execution is unavailable.");let e=qo();if(!e)throw new r("process_unavailable","The private per-user process directory is unavailable.");return e}async function fr(e){if(!e.claim.owner||e.signal.aborted||e.expiresAtMs<=Date.now())throw O("process_authority_lost");let c=be(e.claim);if(c.executing)throw O("process_busy");if(c.executing=!0,c.cancelRequested)return c.phase="settling",pe(e.claim.operation_id);c.phase="starting";let _=e.journals??ze();We(_.directory,{recursive:!0,mode:448});let l=gr({runtimeDirectory:G(_.directory),previousRuntimeDirectories:(_.previous??[]).filter((m)=>Z(m)).map((m)=>G(m)),root:e.root,runId:JSON.stringify([e.claim.owner,e.claim.run_id,e.claim.root_id,e.claim.operation_id]),maxScopes:fe});try{for(let m of[e.root,e.cwd])if(!je(G(m),l.journalDirectory))throw new r("process_journal_inside_workspace","The selected root contains the private process journal. Select an existing narrower granted workspace root outside the journal; no command was dispatched.")}catch(m){throw l.disposeSocket(),m}let I=me(l.journalDirectory),w=e.claim.capability===he,z=()=>B.set(e.claim.operation_id,{path:l.journalDirectory,ino:I.ino,dev:I.dev,anyCompletion:w}),E=l.launchDirectory,L=j(E,"config.json"),P={url:"",transport:"local_job_ipc",directShell:{mode:e.mode,executable:e.shell,jobId:e.claim.operation_id},workerVersion:D,protocolVersion:2,workerArtifactSha256:b,workerEntrypoint:T,targetGeneration:1,fenceId:Q(),...process.platform==="win32"?{bashExecutable:se()}:{},workRoot:e.root,workspaceAliasPath:e.root,repoPath:e.cwd,jobEnvPath:j(E,"unused.env"),replSocketPath:j(E,"unused.sock"),readyPath:j(E,"ready.json"),directTerminalReceiptPath:j(E,"terminal.json"),launchId:Q(),expiresAtMs:e.expiresAtMs+5000,bashTimeoutMs:60000,replTimeoutMs:1000,allowedTools:["bash"],managedJobs:{journalDirectory:l.journalDirectory,scopeId:l.scopeId},jobControlSocketPath:l.socketPath,...e.prefix?{bashCommandPrefix:e.prefix}:{},...e.jobsUser?{jobsUser:e.jobsUser}:{}},x;try{He(L,JSON.stringify(P),{mode:384});let m=Sn({configPath:L,root:e.cwd,grantedRoot:e.root,workRoot:e.root,temporaryDirectory:E});x=e.spawnWorker?.(L,P)??Le(m.command,m.args,{...m.options,env:e.environment,stdio:[En,"ignore","ignore"]})}catch(m){throw l.disposeSocket(),m}let R=!1,F=new Promise((m,S)=>{x.once("exit",(f)=>{R=!0,m(f)}),x.once("error",(f)=>{R=!0,S(f)})});F.catch(()=>{});let ge={root:e.root,runId:e.claim.run_id,scopeId:l.scopeId,socketPath:l.socketPath,generation:1,fenceId:P.fenceId,executorLaunchId:P.launchId,expiresAtMs:P.expiresAtMs},N=async(m)=>{let S=await _r(ge,{type:"job",version:2,generation:1,id:Q(),jobId:e.claim.operation_id,...m==="start"?{action:m,input:{script:e.command,leaseExpiresAtMs:e.expiresAtMs}}:m==="inspect"?{action:m,input:{after:0}}:m==="probe"?{action:"inspect",input:{after:Number.MAX_SAFE_INTEGER}}:{action:m,input:{}}},new AbortController().signal);if(!S.ok)throw O(S.error);return S.job},U=!1,q=!1,te,re=()=>{U=!0,ct(x,"SIGTERM")};e.signal.addEventListener("abort",re,{once:!0});let M,oe=0,ve=async(m)=>{let S=[...m.output],f={version:1,process_id:e.claim.operation_id,state:m.state,exit_code:m.exitCode,first_cursor:m.firstCursor,next_cursor:m.nextCursor,truncated:m.truncated,output:S,observed_at:new Date().toISOString()};while(Buffer.byteLength(JSON.stringify(f))>90000&&S.length)S.shift(),f.truncated=!0,f.first_cursor=S[0]?.cursor??f.next_cursor+1;M=J.parse(f),await e.emit(M),oe=Date.now()};try{let m=Math.min(Date.now()+1e4,e.expiresAtMs);while(!Z(P.readyPath)){if(R)throw new r("process_start_failed","The managed process supervisor exited before accepting a command; no command was dispatched.");if(e.signal.aborted||Date.now()>=m)throw O("process_start_unconfirmed");await ue(25)}let S=JSON.parse(Ne(P.readyPath,"utf8"));if(S.launchId!==P.launchId||S.fenceId!==P.fenceId||S.workerArtifactSha256!==b)throw O();if(e.signal.throwIfAborted(),c.cancelRequested)return pe(e.claim.operation_id);let f;try{q=!0,f=await N("start")}catch(C){if(!(C instanceof r)||C.code!=="hands_job_result_unknown")throw C;f=await N("inspect")}if(c.phase="running",c.cancel=async()=>{await N("cancel")},w&&e.preview)c.tunnels=le({claim:e.claim,executorLaunchId:P.launchId,expiresAtMs:e.expiresAtMs,deniedPorts:e.preview.deniedPorts,inspect:async()=>c.phase==="running"&&!R?await N("probe"):null});if(c.cancelRequested)await c.cancel(),f=await N("inspect");for(;;){if(!["starting","running"].includes(f.state))c.phase="settling",c.cancel=void 0;if(!M||M.state!==f.state||M.next_cursor!==f.nextCursor&&Date.now()-oe>=5000)await ve(f);if(!["starting","running"].includes(f.state))break;if(e.signal.aborted||R)throw O();await ue(1000);try{f=await N("inspect"),te=void 0}catch(C){if(!(C instanceof r)||C.code!=="hands_job_result_unknown"||e.signal.aborted||R||Date.now()-(te??=Date.now())>120000)throw C}}if(!M||M.state==="uncertain")throw O();return M}finally{if(c.phase="settling",c.cancel=void 0,c.tunnels?.dispose(),c.tunnels=void 0,await c.cancelInFlight?.catch(()=>{}),e.signal.removeEventListener("abort",re),!R&&!U)ct(x,"SIGTERM");let m,S=await Promise.race([F.then((f)=>({code:f})),new Promise((f)=>{m=setTimeout(()=>f(null),6000)})]).finally(()=>{clearTimeout(m)});if(!S){try{ct(x,"SIGKILL")}catch{}try{await F}finally{if(R)l.disposeSocket()}throw O("process_cleanup_unconfirmed")}try{if((U||e.signal.aborted)&&S.code===0&&q){v(E);let f=JSON.parse(h(P.directTerminalReceiptPath)),C=X.safeParse(f.observation);if(Object.keys(f).length===4&&f.launch_id===P.launchId&&f.fence_id===P.fenceId&&f.scope_id===l.scopeId&&C.success&&C.data.process_id===e.claim.operation_id){if(w)z();throw new st(C.data)}}}catch(f){if(f instanceof st)throw f}finally{if(R)l.disposeSocket()}if(S.code!==0&&!U&&q)throw O("process_cleanup_unconfirmed");if(!U&&S.code===0&&(M&&["exited","cancelled","expired"].includes(M.state)||!q&&c.cancelRequested)||w&&S.code===0&&!q)z()}}async function js(e,c){if(c.kind===ce&&e.capability===he){let I=V.get(e.operation_id);if(I?.claim===e&&I.tunnels)I.tunnels.open(c.payload);else Y(c.payload,e.operation_id,"server_not_running");return!0}if(c.kind!==ne||!ae(e.capability)||!e.owner||c.payload.process_id!==e.operation_id)return!1;let _=V.get(e.operation_id);if(_&&_.claim!==e)return!1;let l=be(e);if(l.cancelRequested=!0,l.phase==="running"&&l.cancel)l.cancelInFlight??=l.cancel(),await l.cancelInFlight;return!0}function Us(e,c){V.delete(e);let _=B.get(e);if(!_||c!=="succeeded"&&!_.anyCompletion)return B.delete(e),!1;try{let l=me(_.path);if(!l.isDirectory()||l.isSymbolicLink()||l.ino!==_.ino||l.dev!==_.dev||!A(l)||G(_.path)!==_.path||Z(j(_.path,"owner.lock")))return!1;return Ve(_.path,{recursive:!0}),B.delete(e),!0}catch{return!1}}
-export{Ji,Zi,_n,Xi,yn,Yi,st,fr,js,Us};

package/bin/vm-hands/vm-hands-entry-lite-f8ts9y2q.js

@@ -1,3 +0,0 @@
-// @bun
-import{Vi,Gi}from"./vm-hands-entry-lite-wfc0agnt.js";function ks(o=process.platform){if(Vi(),o==="linux"||o==="win32")Gi("strict")}
-export{ks};

package/bin/vm-hands/vm-hands-entry-lite-mcjca0ez.js

@@ -1,3 +0,0 @@
-// @bun
-function $e(n){return Function("return ("+n+")")()}
-export{$e};

package/bin/vm-hands/worker-preview-readiness-8ftb3nbw.js

@@ -1,2 +0,0 @@
-// @bun
-import{Cs}from"./vm-hands-entry-lite-0tavq3p4.js";import"./vm-hands-entry-lite-kwmjn9y3.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{Cs as probeWorkerPreview};

package/bin/vm-hands/worker-sandbox-k0vx97tx.js

@@ -1,2 +0,0 @@
-// @bun
-import{ks}from"./vm-hands-entry-lite-f8ts9y2q.js";import"./vm-hands-entry-lite-wfc0agnt.js";import"./vm-hands-entry-lite-a6w60nv9.js";import"./vm-hands-entry-lite-1kt82jes.js";import"./vm-hands-entry-lite-s85p7tqp.js";export{ks as configureWorkerSandbox};