@reason-machines/cli-linux-x64 0.2.552 → 0.2.554

package/bin/vm-hands/{vm-hands-entry-lite-xeam6mf5.js → vm-hands-entry-lite-r1n9zhsm.js}

@@ -1,8 +1,8 @@
 // @bun
-import{_,Ho,ke}from"./vm-hands-entry-lite-4anjdcth.js";import{l,Gt,Ke,Lr,Kt,Mr,ht}from"./vm-hands-entry-lite-w29d7ey0.js";import{bt,ar}from"./vm-hands-entry-lite-07apxfh8.js";import{fn}from"./vm-hands-entry-lite-1cfsncqq.js";import{F,m,te,He}from"./vm-hands-entry-lite-zx7mwtx5.js";import{j}from"./vm-hands-entry-lite-er4yqpbg.js";import{Bo}from"./vm-hands-entry-lite-a88zq6q6.js";import{xe,Ze,Xn,Vr}from"./vm-hands-entry-lite-vj96yg8f.js";import{f,v,h}from"./vm-hands-entry-lite-hfx1q0b0.js";import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{Xo,an,y,t,k,At,o,d,Ie,u,n,c,g,_s,s,i,cn}from"./vm-hands-entry-lite-wzv13c8k.js";import{closeSync as qh,existsSync as zh,mkdirSync as Kh,openSync as Vh,readdirSync as Jh,realpathSync as pe,rmSync as Gh}from"fs";import{dirname as Xh,join as J,resolve as Zh}from"path";import{createHash as It}from"crypto";import{platform as Ot}from"os";import{join as Dt}from"path";var Mt=g("store",[c({version:i(1),store:i("keychain")}),c({version:i(1),store:i("file"),api_key:t().min(1).max(4096)})]),We=(e)=>Dt(e,"api-key.json");function Ne(e){let r=It("sha256").update(`reason-connect-api-key
-${e}`).digest("hex");return new Ke(Gt(),Ot(),r)}function we(e,r=Ne(e)){if(!f(We(e)))return null;let p=Mt.parse(JSON.parse(h(We(e))));if(p.store==="file")return p.api_key;try{let b=r.loadBinding();return b?new TextDecoder().decode(b):null}catch(b){if(!(b instanceof l))throw b;throw Error("worker_api_key_unreadable")}}import{readdirSync as Zt,renameSync as Go,rmSync as Yo}from"fs";import{join as ee}from"path";import{createHash as Wt}from"crypto";import{platform as Nt}from"os";import{join as W}from"path";function w(e){return{state:W(m(e),"device.json"),control:W(m(e),"control.json"),lock:W(m(e),"lifecycle.lock"),socket:W(m(e),"control.sock"),daemon:W(m(e),"daemon.json"),releaseCheck:W(m(e),"release-check.json"),updateDeferral:W(m(e),"update-deferral.json"),firstHeartbeat:W(m(e),"first-heartbeat.json")}}var uo=n({version:i(1),device_id:t().min(1).max(160),offer:Ie().optional(),enrollment_ms:o().int().nonnegative().max(ar).optional()});function z(e,r=!1){v(m(e),r);let p=["local-device.key","local-device.binding","device.json"].filter((b)=>{let R=W(m(e),b);if(!f(R))return!1;return h(R),!0});return e.lifetime==="persistent"&&p.join()==="device.json"?Ht(e):new Lr(m(e))}function Ht(e){return new Ke(Gt(),Nt(),$t(e))}function $t(e){let r=Ft(e);return Wt("sha256").update(`reason-worker
-${r?.directory??m(e)}`).digest("hex")}var Bt="keychain-scope.json";var Ut=c({version:i(1),directory:t().min(1),devicePublicKey:t().min(1)});function Ft(e){let r=W(m(e),Bt);if(!f(r))return null;let p=Ut.safeParse(JSON.parse(h(r))),b=w(e).state;if(!p.success||!f(b))return null;return JSON.parse(h(b))?.devicePublicKey===p.data.devicePublicKey?p.data:null}function B(e){if(!f(m(e)))return null;let r=Mr(w(e).state,{proofStore:z(e),repair:!1}),p=r!==null&&Ho(e.apiOrigin,r.apiOrigin),b=p?[te(e),te({...e,apiOrigin:r.apiOrigin})]:[te(e)];if(r&&(!b.includes(r.worker?.configDigest??"")||r.worker.lifetime!==e.lifetime||r.apiOrigin!==e.apiOrigin&&!p||r.roots.length>32||r.roots[0]?.path!==e.workspaceRoot||r.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return r}var jt=c({version:i(1),drained:d(),revoked:d()});function N(e){let r=w(e).control;return f(r)?jt.parse(JSON.parse(h(r))):{version:1,drained:!1,revoked:!1}}var zt=c({read:d(),write:d(),execute:d(),discover_environment:d(),expose_mcp:i(!1)}),Vt=c({version:i(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:zt,execution_mode:s(["confined","host"]).default("confined")}),folders:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),Ro=n({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:i("p256"),protocol_version:i(2),roots:u(n({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:n({lifecycle:s(["persistent","ephemeral"]),expires_at:y.datetime({offset:!0})}),first_heartbeat:Ie().optional()});var qo=c({version:i(1),install_id:k(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),zo=n({enrollment_ticket:t().min(1).max(4096),expires_at:y.datetime({offset:!0}),device_kind:i("headless"),lifecycle:s(["persistent","ephemeral"]),device_expires_at:y.datetime({offset:!0})});var Ko=n({credentialKind:s(["oauth","api_key"]).optional(),apiOrigin:At(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:y.datetime({offset:!0}),scopes:u(t().max(128)).max(128),orgId:t().min(1).max(160)});var je=8;var Qt=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,_e=(e)=>ee(m(e),"workspaces"),er="account.json",tr=(e)=>f(ee(e,er));function Se(e){let r;try{r=Zt(_e(e))}catch{return[]}return r.filter((p)=>Qt.test(p)).sort().map((p)=>{let b=ee(_e(e),p),R=ee(b,"worker.json"),S=null;try{let P=F.safeParse(JSON.parse(h(R)));if(P.success&&P.data.stateDirectory===b)S=P.data}catch{}return{organizationId:p,directory:b,configPath:R,config:S,account:tr(b)}})}var rr=(e)=>ee(_e(e),"listed.json");function nr(e){try{let r=JSON.parse(h(rr(e))),p=r.names&&typeof r.names==="object"&&!Array.isArray(r.names)?Object.fromEntries(Object.entries(r.names).filter((R)=>typeof R[1]==="string")):{},b=r.refused&&typeof r.refused==="object"?r.refused:null;return{listed:r.listed===!0,reason:r.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(r.blocked)?r.blocked.filter((R)=>typeof R==="string"):[],names:p,...b&&typeof b.device==="string"&&typeof b.roots==="string"&&typeof b.at==="number"&&Number.isFinite(b.at)&&typeof b.count==="number"&&Number.isInteger(b.count)&&b.count>=1?{refused:{device:b.device,roots:b.roots,at:b.at,count:b.count}}:{}}}catch{return null}}function qe(e,r){let p=Se(e),b=p.filter((C)=>C.account),R=p.filter((C)=>!C.account),S=nr(e),P=S&&!S.listed?S.reason:null,E=P||R.length===0&&S&&!S.listed?[]:R;if(b.length===0&&E.length===0&&(P||S&&!S.listed))return{workspaces:null,off:P};return{off:P,workspaces:[...b,...E].map(({organizationId:C,config:D,account:I})=>{let A=!1,M=null,T=!1,he=null;try{A=D?N(D).revoked:!1,M=D&&!A?B(D):null;let Le=D?ht(w(D).daemon):null;T=r&&!!M&&Le?.state==="connected",he=T?Kt(Le,M):null}catch{}return{...he?{permission_recovery:he}:{},organization_id:C,device_id:M?.deviceId??null,name:S?.names?.[C]??null,root:M?.roots[0]?{id:M.roots[0].id,permissions:M.roots[0].permissions}:null,state:A?"removed":T?"connected":"not_running",blocked:!I&&!A&&!T&&(S?.blocked.includes(C)??!1),...I?{account:!0}:{}}})}}import{readFileSync as ir}from"fs";function pr(e){try{let r=JSON.parse(ir(`${e}.keep-awake.json`,"utf8"));return r!==null&&typeof r==="object"&&"version"in r&&r.version===1&&"enabled"in r&&r.enabled===!0?"battery_and_ac":void 0}catch(r){return r.code==="ENOENT"?"battery_and_ac":void 0}}import{chmodSync as qi,lstatSync as Xe,mkdtempSync as zi,realpathSync as sr,rmdirSync as Ki,rmSync as Vi,unlinkSync as Ji}from"fs";import{createConnection as cr,createServer as Yi}from"net";import{basename as Je,dirname as Ge,join as ne}from"path";var lr=s(["status","drain","resume","stop","reload_roots"]),dr=c({version:i(1),instanceId:t(),deviceId:t(),phase:s(["starting","running","reconnecting","stopping"]),drained:d(),activeClaims:o().int().nonnegative(),activeSessions:o().int().nonnegative().optional(),executionEligible:d(),supportedOperations:u(s(bt)).max(bt.length).optional(),capabilityReadiness:_s(s(bt),d()).optional(),lastHeartbeat:t().nullable(),expiresAt:t()}),ra=c({nonce:t(),action:lr}),ur=n({nonce:k()}),fr=c({version:i(1),nonce:k(),socketPath:t().max(100)});function mr(e){return ne(w(e).lock,"control.json")}function Qe(e){return v(w(e).lock),ur.parse(JSON.parse(h(ne(w(e).lock,"owner.json"))))}function Ye(e){if(!f(e))return!1;let r=Xe(e);if(!r.isSocket()||r.uid!==process.getuid?.()||(r.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function et(e,r){let p=mr(e);if(!f(p)){let S=w(e).socket;if(!f(S)||!Xe(S).isSocket())return null;return Ye(S)?S:null}let b=fr.parse(JSON.parse(h(p)));if(b.nonce!==r)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!hr.test(b.socketPath))throw Error("worker_control_endpoint_invalid");return b.socketPath}let R=Ge(b.socketPath);if(Ge(R)!==sr("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(Je(R))||Je(b.socketPath)!=="control.sock"||Buffer.byteLength(b.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!f(R))return null;return v(R),Ye(b.socketPath)?b.socketPath:null}var hr=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;function gr(e,r){try{let p=JSON.parse(h(ne(w(e).lock,"owner.json"))),b=p&&typeof p==="object"?p[r]:void 0;return typeof b==="string"?b:null}catch{return null}}function tt(e){return gr(e,"runtime_version")}function rt(e,r){if(r)return r.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!f(ne(w(e).lock,"owner.json")))return"no_lock";return et(e,Qe(e).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var na=c({instance:t().nullable(),since:o().int().nonnegative()});async function G(e,r){let p=w(e);if(!f(ne(p.lock,"owner.json")))return null;let b=Qe(e),R=et(e,b.nonce);if(!R)return null;return new Promise((S,P)=>{let E=cr(R),C="",D=!1,I=(A,M)=>{if(D)return;if(D=!0,E.destroy(),M)P(M);else S(A)};E.setTimeout(2000,()=>E.destroy(Error("worker_control_timeout"))),E.on("connect",()=>E.write(JSON.stringify({nonce:b.nonce,action:r})+`
-`)),E.on("data",(A)=>{if(C+=A.toString(),Buffer.byteLength(C)>16384)E.destroy(Error("worker_control_oversize"))}),E.on("error",(A)=>{if("code"in A&&["ECONNREFUSED","ENOENT"].includes(String(A.code)))I(null);else I(null,A.message==="worker_control_timeout"?A:Error("worker_control_unavailable"))}),E.on("end",()=>{try{let A=dr.parse(JSON.parse(C));if(A.instanceId!==b.nonce)throw Error("worker_instance_changed");I(A)}catch{I(null,Error("worker_control_invalid_response"))}}),E.once("close",()=>I(null,Error("worker_control_unavailable")))})}import{realpathSync as br}from"fs";import{constants as Re}from"fs";import{open as wr}from"fs/promises";var da={platform:process.platform,home:a,async openFile(e){let r=await wr(e,Re.O_RDONLY|Re.O_NOFOLLOW|Re.O_NONBLOCK);return{isFile:async()=>(await r.stat()).isFile(),close:()=>r.close()}}};var za=Bo(br(process.execPath));var hs=Buffer.from([0,255,3,4]);import{execFile as on}from"child_process";import{promisify as sn}from"util";var Pr=/#w=(\d{1,5})&h=(\d{1,5})$/;function at(e){return typeof e==="number"&&Number.isInteger(e)&&e>0&&e<=32768?e:void 0}function st(e){let r=Pr.exec(e);if(!r)return;let p=at(Number(r[1])),b=at(Number(r[2]));return p&&b?{width:p,height:b}:void 0}var ct="[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}",Cr=new RegExp(`^/media/pr-screenshots/(${ct})/(${ct})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$`,"i");var Ar=new Set(["png","jpg","jpeg","gif","webp"]),xr=new Set(["webm","mp4"]);function Ir(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function Or(e){let r=st(e);return Boolean(r&&e===`#w=${r.width}&h=${r.height}`)}function lt(e,r){let p;try{p=new URL(e)}catch{return null}let b=Ir(r),R=p.hostname==="ara.so"||p.hostname.endsWith(".ara.so")||p.hostname==="reasonmachines.ai"||p.hostname.endsWith(".reasonmachines.ai")||p.hostname==="reasonmachines.com"||p.hostname.endsWith(".reasonmachines.com");if(p.protocol!=="https:"||!R&&p.origin!==b||p.username||p.password||p.port||p.search||p.hash&&!Or(p.hash))return null;let S=Cr.exec(p.pathname);if(!S)return null;let P=S[1]?.toLowerCase(),E=S[2]?.toLowerCase(),C=S[3]?.toLowerCase(),D=S[4]?.toLowerCase();if(!P||!E||!C||!D)return null;let I=Ar.has(D)?"image":xr.has(D)?"video":null;if(!I)return null;let A=/^(before|after)[\s:_-]+/.exec(C),M=p.pathname.replace(/^\/media\//,"");return{url:p.toString(),storagePath:M,runId:P,artifactId:E,fileName:`${C}.${D}`,kind:I,phase:A?.[1]==="before"||A?.[1]==="after"?A[1]:null}}var Dr=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,dt=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),K=()=>{throw Error("cloud_browser_media_request_invalid")};function Pe(e){if(!dt(e)||Object.keys(e).some((S)=>!["runId","configuredMediaOrigin","media"].includes(S))||typeof e.runId!=="string"||!Dr.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return K();let r;try{r=new URL(e.configuredMediaOrigin)}catch{return K()}if(r.protocol!=="https:"||r.username||r.password||r.port||!He(r.origin,{mode:"public_web"}).allowed)return K();let p=e.runId.toLowerCase(),b=new Set,R=e.media.map((S)=>{if(!dt(S)||Object.keys(S).some((E)=>!["url","sourceUrl","kind"].includes(E))||typeof S.url!=="string"||S.url.length>2048||typeof S.sourceUrl!=="string"||S.sourceUrl.length>8192||!["image","video"].includes(String(S.kind)))return K();let P=lt(S.url,r.origin);if(!P||new URL(P.url).origin!==r.origin||P.runId!==p||P.kind!==S.kind||P.url!==S.url||b.has(S.url))return K();if(b.add(S.url),S.sourceUrl!==S.url){let E;try{E=new URL(S.sourceUrl)}catch{return K()}let C=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(E.pathname)?.[1];if(S.kind!=="image"||E.origin!=="https://camo.githubusercontent.com"||E.username||E.password||E.search||E.hash||!C||C.length%2!==0||Buffer.from(C,"hex").toString("utf8")!==S.url)return K()}return{url:S.url,sourceUrl:S.sourceUrl,kind:S.kind}});return{runId:e.runId,configuredMediaOrigin:r.origin,media:R}}var x=t().uuid(),X=t().regex(/^[a-f0-9]{64}$/),V=y.datetime({precision:3}),Ce=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),mt=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),H=n({kind:i("primary_mac"),version:i(1),organizationId:Ce,userId:Ce,sessionId:Ce,runId:x,deviceId:x,rootId:x,rootRevision:t().min(1).max(64),binding:s(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:x,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Tr=cn().transform((e,r)=>{try{return fn(e)}catch{return r.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),Xo}}),ue=n({version:i(1),owner:H,contextId:x,preparedAt:V,expiresAt:V,prUrl:mt,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:X,evidenceKind:s(["image","video"]),visualPlan:Tr.optional(),uploadOrigin:t().url().refine((e)=>{let r=new URL(e);return r.protocol==="https:"&&r.origin===e&&!r.username&&!r.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),Wr=n({version:i(1),producer:i("primary_mac"),context:ue,captureId:x,operationId:x,attemptId:x,tabId:o().int().positive(),startedAt:V,finishedAt:V,sha256:X,media:g("contentType",[n({contentType:i("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),n({contentType:i("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,r)=>{let p=Date.parse(e.startedAt),b=Date.parse(e.finishedAt);if(p<Date.parse(e.context.preparedAt)||b<p||b>Date.parse(e.context.expiresAt)||b-p>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((b-p)/1000-e.media.durationSeconds)>0.1))r.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),yc=g("action",[n({action:i("screenshot"),context_id:x,tab_id:o().int().positive()}).strict(),n({action:i("start_video"),context_id:x,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("stop_video"),recording_operation_id:x}).strict()]),fe=n({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),ce=t().regex(/^[1-9][0-9]{0,19}$/),le=n({version:i(1),owner:H,expectedActorId:ce.nullable(),repositoryId:ce,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),Nr=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],Hr=g("status",[le.extend({status:i("ready"),observedActor:fe,checkedAt:V}),le.extend({status:i("not_ready"),reason:s(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:s(Nr).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),Y=n({version:i(1),owner:H,expectedActorId:ce.nullable(),authenticatedActor:fe,attemptId:x,captureId:x,prUrl:mt,repositoryId:ce,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:X,sizeBytes:o().int().min(128).max(10485760),contentType:i("video/webm")}).strict(),pt=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),$r=g("status",[Y.extend({status:i("not_attempted"),reason:s(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),Y.extend({status:i("uncertain"),reason:i("upload_outcome_unknown")}),Y.extend({status:i("uploaded"),observedActor:fe,nativeUrl:pt,uploadedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),de=Y.extend({nativeUrl:pt,observedActor:fe,bodySha256:X}),Br=g("status",[de.extend({status:i("incomplete"),reason:s(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),de.extend({status:i("verified"),sourceSha256:X,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:i(!0),verifiedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Ur=cn().transform((e,r)=>{try{let p=Pe(e);if(p.media.some((b)=>b.kind!=="image"))throw Error();return p}catch{return r.addIssue({code:"custom",message:"proof_media_request_invalid"}),Xo}}),Fr=g("action",[n({action:i("auth_check"),input:le}).strict(),n({action:i("prepare"),context:ue}).strict(),n({action:i("capture_png"),owner:H,contextId:x,tabId:o().int().positive()}).strict(),n({action:i("start_video"),owner:H,contextId:x,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("inspect_capture"),owner:H,captureId:x}).strict(),n({action:i("publish_video"),input:Y}).strict(),n({action:i("verify_png_media"),owner:H,media:Ur}).strict().refine((e)=>e.media.runId===e.owner.runId),n({action:i("verify_saved_media"),input:de}).strict(),n({action:i("publish_png"),owner:H,attemptId:x,captureId:x,sha256:X,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var jr=n({requestId:x,command:Fr}).strict();var qr={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},ut={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},ft={type:"integer",minimum:1,description:"An already-owned tab's id."},_c={...qr,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:ut,tab_id:ft}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:ut,tab_id:ft,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};var Rc=n({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict();var zr=String.raw`async (media) => {
+import{_,Ho,ke}from"./vm-hands-entry-lite-4anjdcth.js";import{l,Ut,We,Dr,zt,Nr,dt}from"./vm-hands-entry-lite-dgfx0rbn.js";import{bt,ar}from"./vm-hands-entry-lite-07apxfh8.js";import{fn}from"./vm-hands-entry-lite-1pp7czc0.js";import{F,m,te,He}from"./vm-hands-entry-lite-drggrrr8.js";import{U}from"./vm-hands-entry-lite-8mttvhef.js";import{Bo}from"./vm-hands-entry-lite-ggyexab2.js";import{xe,Ze,Xn,Vr}from"./vm-hands-entry-lite-6qq4f3v5.js";import{f,v,h}from"./vm-hands-entry-lite-h1qjggz0.js";import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{Xo,an,y,t,k,At,o,d,Ie,u,n,c,g,_s,s,i,cn}from"./vm-hands-entry-lite-wzv13c8k.js";import{closeSync as qh,existsSync as zh,mkdirSync as Kh,openSync as Vh,readdirSync as Jh,realpathSync as pe,rmSync as Gh}from"fs";import{dirname as Xh,join as J,resolve as Zh}from"path";import{createHash as It}from"crypto";import{platform as Ot}from"os";import{join as Dt}from"path";var Mt=g("store",[c({version:i(1),store:i("keychain")}),c({version:i(1),store:i("file"),api_key:t().min(1).max(4096)})]),Ne=(e)=>Dt(e,"api-key.json");function $e(e){let r=It("sha256").update(`reason-connect-api-key
+${e}`).digest("hex");return new We(Ut(),Ot(),r)}function we(e,r=$e(e)){if(!f(Ne(e)))return null;let p=Mt.parse(JSON.parse(h(Ne(e))));if(p.store==="file")return p.api_key;try{let b=r.loadBinding();return b?new TextDecoder().decode(b):null}catch(b){if(!(b instanceof l))throw b;throw Error("worker_api_key_unreadable")}}import{readdirSync as Zt,renameSync as Go,rmSync as Yo}from"fs";import{join as ee}from"path";import{createHash as Wt}from"crypto";import{platform as Nt}from"os";import{join as W}from"path";function w(e){return{state:W(m(e),"device.json"),control:W(m(e),"control.json"),lock:W(m(e),"lifecycle.lock"),socket:W(m(e),"control.sock"),daemon:W(m(e),"daemon.json"),releaseCheck:W(m(e),"release-check.json"),updateDeferral:W(m(e),"update-deferral.json"),firstHeartbeat:W(m(e),"first-heartbeat.json")}}var uo=n({version:i(1),device_id:t().min(1).max(160),offer:Ie().optional(),enrollment_ms:o().int().nonnegative().max(ar).optional()});function z(e,r=!1){v(m(e),r);let p=["local-device.key","local-device.binding","device.json"].filter((b)=>{let R=W(m(e),b);if(!f(R))return!1;return h(R),!0});return e.lifetime==="persistent"&&p.join()==="device.json"?Ht(e):new Dr(m(e))}function Ht(e){return new We(Ut(),Nt(),$t(e))}function $t(e){let r=jt(e);return Wt("sha256").update(`reason-worker
+${r?.directory??m(e)}`).digest("hex")}var Bt="keychain-scope.json";var Ft=c({version:i(1),directory:t().min(1),devicePublicKey:t().min(1)});function jt(e){let r=W(m(e),Bt);if(!f(r))return null;let p=Ft.safeParse(JSON.parse(h(r))),b=w(e).state;if(!p.success||!f(b))return null;return JSON.parse(h(b))?.devicePublicKey===p.data.devicePublicKey?p.data:null}function B(e){if(!f(m(e)))return null;let r=Nr(w(e).state,{proofStore:z(e),repair:!1}),p=r!==null&&Ho(e.apiOrigin,r.apiOrigin),b=p?[te(e),te({...e,apiOrigin:r.apiOrigin})]:[te(e)];if(r&&(!b.includes(r.worker?.configDigest??"")||r.worker.lifetime!==e.lifetime||r.apiOrigin!==e.apiOrigin&&!p||r.roots.length>32||r.roots[0]?.path!==e.workspaceRoot||r.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return r}var qt=c({version:i(1),drained:d(),revoked:d()});function N(e){let r=w(e).control;return f(r)?qt.parse(JSON.parse(h(r))):{version:1,drained:!1,revoked:!1}}var Vt=c({read:d(),write:d(),execute:d(),discover_environment:d(),expose_mcp:i(!1)}),Jt=c({version:i(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:Vt,execution_mode:s(["confined","host"]).default("confined")}),folders:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),Ro=n({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:i("p256"),protocol_version:i(2),roots:u(n({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:n({lifecycle:s(["persistent","ephemeral"]),expires_at:y.datetime({offset:!0})}),first_heartbeat:Ie().optional()});var qo=c({version:i(1),install_id:k(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),zo=n({enrollment_ticket:t().min(1).max(4096),expires_at:y.datetime({offset:!0}),device_kind:i("headless"),lifecycle:s(["persistent","ephemeral"]),device_expires_at:y.datetime({offset:!0})});var Ko=n({credentialKind:s(["oauth","api_key"]).optional(),apiOrigin:At(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:y.datetime({offset:!0}),scopes:u(t().max(128)).max(128),orgId:t().min(1).max(160)});var qe=8;var Qt=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,_e=(e)=>ee(m(e),"workspaces"),er="account.json",tr=(e)=>f(ee(e,er));function Se(e){let r;try{r=Zt(_e(e))}catch{return[]}return r.filter((p)=>Qt.test(p)).sort().map((p)=>{let b=ee(_e(e),p),R=ee(b,"worker.json"),S=null;try{let P=F.safeParse(JSON.parse(h(R)));if(P.success&&P.data.stateDirectory===b)S=P.data}catch{}return{organizationId:p,directory:b,configPath:R,config:S,account:tr(b)}})}var rr=(e)=>ee(_e(e),"listed.json");function nr(e){try{let r=JSON.parse(h(rr(e))),p=r.names&&typeof r.names==="object"&&!Array.isArray(r.names)?Object.fromEntries(Object.entries(r.names).filter((R)=>typeof R[1]==="string")):{},b=r.refused&&typeof r.refused==="object"?r.refused:null;return{listed:r.listed===!0,reason:r.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(r.blocked)?r.blocked.filter((R)=>typeof R==="string"):[],names:p,...b&&typeof b.device==="string"&&typeof b.roots==="string"&&typeof b.at==="number"&&Number.isFinite(b.at)&&typeof b.count==="number"&&Number.isInteger(b.count)&&b.count>=1?{refused:{device:b.device,roots:b.roots,at:b.at,count:b.count}}:{}}}catch{return null}}function ze(e,r){let p=Se(e),b=p.filter((C)=>C.account),R=p.filter((C)=>!C.account),S=nr(e),P=S&&!S.listed?S.reason:null,E=P||R.length===0&&S&&!S.listed?[]:R;if(b.length===0&&E.length===0&&(P||S&&!S.listed))return{workspaces:null,off:P};return{off:P,workspaces:[...b,...E].map(({organizationId:C,config:D,account:I})=>{let A=!1,M=null,T=!1,he=null;try{A=D?N(D).revoked:!1,M=D&&!A?B(D):null;let Le=D?dt(w(D).daemon):null;T=r&&!!M&&Le?.state==="connected",he=T?zt(Le,M):null}catch{}return{...he?{permission_recovery:he}:{},organization_id:C,device_id:M?.deviceId??null,name:S?.names?.[C]??null,root:M?.roots[0]?{id:M.roots[0].id,permissions:M.roots[0].permissions}:null,state:A?"removed":T?"connected":"not_running",blocked:!I&&!A&&!T&&(S?.blocked.includes(C)??!1),...I?{account:!0}:{}}})}}import{readFileSync as ir}from"fs";function pr(e){try{let r=JSON.parse(ir(`${e}.keep-awake.json`,"utf8"));return r!==null&&typeof r==="object"&&"version"in r&&r.version===1&&"enabled"in r&&r.enabled===!0?"battery_and_ac":void 0}catch(r){return r.code==="ENOENT"?"battery_and_ac":void 0}}import{chmodSync as qi,lstatSync as Xe,mkdtempSync as zi,realpathSync as sr,rmdirSync as Ki,rmSync as Vi,unlinkSync as Ji}from"fs";import{createConnection as cr,createServer as Yi}from"net";import{basename as Je,dirname as Ge,join as ne}from"path";var lr=s(["status","drain","resume","stop","reload_roots"]),dr=c({version:i(1),instanceId:t(),deviceId:t(),phase:s(["starting","running","reconnecting","stopping"]),drained:d(),activeClaims:o().int().nonnegative(),activeSessions:o().int().nonnegative().optional(),executionEligible:d(),supportedOperations:u(s(bt)).max(bt.length).optional(),capabilityReadiness:_s(s(bt),d()).optional(),lastHeartbeat:t().nullable(),expiresAt:t()}),ra=c({nonce:t(),action:lr}),ur=n({nonce:k()}),fr=c({version:i(1),nonce:k(),socketPath:t().max(100)});function mr(e){return ne(w(e).lock,"control.json")}function Qe(e){return v(w(e).lock),ur.parse(JSON.parse(h(ne(w(e).lock,"owner.json"))))}function Ye(e){if(!f(e))return!1;let r=Xe(e);if(!r.isSocket()||r.uid!==process.getuid?.()||(r.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function et(e,r){let p=mr(e);if(!f(p)){let S=w(e).socket;if(!f(S)||!Xe(S).isSocket())return null;return Ye(S)?S:null}let b=fr.parse(JSON.parse(h(p)));if(b.nonce!==r)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!hr.test(b.socketPath))throw Error("worker_control_endpoint_invalid");return b.socketPath}let R=Ge(b.socketPath);if(Ge(R)!==sr("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(Je(R))||Je(b.socketPath)!=="control.sock"||Buffer.byteLength(b.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!f(R))return null;return v(R),Ye(b.socketPath)?b.socketPath:null}var hr=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;function gr(e,r){try{let p=JSON.parse(h(ne(w(e).lock,"owner.json"))),b=p&&typeof p==="object"?p[r]:void 0;return typeof b==="string"?b:null}catch{return null}}function tt(e){return gr(e,"runtime_version")}function rt(e,r){if(r)return r.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!f(ne(w(e).lock,"owner.json")))return"no_lock";return et(e,Qe(e).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var na=c({instance:t().nullable(),since:o().int().nonnegative()});async function G(e,r){let p=w(e);if(!f(ne(p.lock,"owner.json")))return null;let b=Qe(e),R=et(e,b.nonce);if(!R)return null;return new Promise((S,P)=>{let E=cr(R),C="",D=!1,I=(A,M)=>{if(D)return;if(D=!0,E.destroy(),M)P(M);else S(A)};E.setTimeout(2000,()=>E.destroy(Error("worker_control_timeout"))),E.on("connect",()=>E.write(JSON.stringify({nonce:b.nonce,action:r})+`
+`)),E.on("data",(A)=>{if(C+=A.toString(),Buffer.byteLength(C)>16384)E.destroy(Error("worker_control_oversize"))}),E.on("error",(A)=>{if("code"in A&&["ECONNREFUSED","ENOENT"].includes(String(A.code)))I(null);else I(null,A.message==="worker_control_timeout"?A:Error("worker_control_unavailable"))}),E.on("end",()=>{try{let A=dr.parse(JSON.parse(C));if(A.instanceId!==b.nonce)throw Error("worker_instance_changed");I(A)}catch{I(null,Error("worker_control_invalid_response"))}}),E.once("close",()=>I(null,Error("worker_control_unavailable")))})}import{realpathSync as br}from"fs";import{constants as Re}from"fs";import{open as wr}from"fs/promises";var da={platform:process.platform,home:a,async openFile(e){let r=await wr(e,Re.O_RDONLY|Re.O_NOFOLLOW|Re.O_NONBLOCK);return{isFile:async()=>(await r.stat()).isFile(),close:()=>r.close()}}};var za=Bo(br(process.execPath));var hs=Buffer.from([0,255,3,4]);import{execFile as on}from"child_process";import{promisify as sn}from"util";var Pr=/#w=(\d{1,5})&h=(\d{1,5})$/;function at(e){return typeof e==="number"&&Number.isInteger(e)&&e>0&&e<=32768?e:void 0}function st(e){let r=Pr.exec(e);if(!r)return;let p=at(Number(r[1])),b=at(Number(r[2]));return p&&b?{width:p,height:b}:void 0}var ct="[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}",Cr=new RegExp(`^/media/pr-screenshots/(${ct})/(${ct})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$`,"i");var Ar=new Set(["png","jpg","jpeg","gif","webp"]),xr=new Set(["webm","mp4"]);function Ir(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function Or(e){let r=st(e);return Boolean(r&&e===`#w=${r.width}&h=${r.height}`)}function lt(e,r){let p;try{p=new URL(e)}catch{return null}let b=Ir(r),R=p.hostname==="ara.so"||p.hostname.endsWith(".ara.so")||p.hostname==="reasonmachines.ai"||p.hostname.endsWith(".reasonmachines.ai")||p.hostname==="reasonmachines.com"||p.hostname.endsWith(".reasonmachines.com");if(p.protocol!=="https:"||!R&&p.origin!==b||p.username||p.password||p.port||p.search||p.hash&&!Or(p.hash))return null;let S=Cr.exec(p.pathname);if(!S)return null;let P=S[1]?.toLowerCase(),E=S[2]?.toLowerCase(),C=S[3]?.toLowerCase(),D=S[4]?.toLowerCase();if(!P||!E||!C||!D)return null;let I=Ar.has(D)?"image":xr.has(D)?"video":null;if(!I)return null;let A=/^(before|after)[\s:_-]+/.exec(C),M=p.pathname.replace(/^\/media\//,"");return{url:p.toString(),storagePath:M,runId:P,artifactId:E,fileName:`${C}.${D}`,kind:I,phase:A?.[1]==="before"||A?.[1]==="after"?A[1]:null}}var Mr=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,ut=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),K=()=>{throw Error("cloud_browser_media_request_invalid")};function Pe(e){if(!ut(e)||Object.keys(e).some((S)=>!["runId","configuredMediaOrigin","media"].includes(S))||typeof e.runId!=="string"||!Mr.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return K();let r;try{r=new URL(e.configuredMediaOrigin)}catch{return K()}if(r.protocol!=="https:"||r.username||r.password||r.port||!He(r.origin,{mode:"public_web"}).allowed)return K();let p=e.runId.toLowerCase(),b=new Set,R=e.media.map((S)=>{if(!ut(S)||Object.keys(S).some((E)=>!["url","sourceUrl","kind"].includes(E))||typeof S.url!=="string"||S.url.length>2048||typeof S.sourceUrl!=="string"||S.sourceUrl.length>8192||!["image","video"].includes(String(S.kind)))return K();let P=lt(S.url,r.origin);if(!P||new URL(P.url).origin!==r.origin||P.runId!==p||P.kind!==S.kind||P.url!==S.url||b.has(S.url))return K();if(b.add(S.url),S.sourceUrl!==S.url){let E;try{E=new URL(S.sourceUrl)}catch{return K()}let C=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(E.pathname)?.[1];if(S.kind!=="image"||E.origin!=="https://camo.githubusercontent.com"||E.username||E.password||E.search||E.hash||!C||C.length%2!==0||Buffer.from(C,"hex").toString("utf8")!==S.url)return K()}return{url:S.url,sourceUrl:S.sourceUrl,kind:S.kind}});return{runId:e.runId,configuredMediaOrigin:r.origin,media:R}}var x=t().uuid(),X=t().regex(/^[a-f0-9]{64}$/),V=y.datetime({precision:3}),Ce=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),pt=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),H=n({kind:i("primary_mac"),version:i(1),organizationId:Ce,userId:Ce,sessionId:Ce,runId:x,deviceId:x,rootId:x,rootRevision:t().min(1).max(64),binding:s(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:x,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Tr=cn().transform((e,r)=>{try{return fn(e)}catch{return r.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),Xo}}),ue=n({version:i(1),owner:H,contextId:x,preparedAt:V,expiresAt:V,prUrl:pt,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:X,evidenceKind:s(["image","video"]),visualPlan:Tr.optional(),uploadOrigin:t().url().refine((e)=>{let r=new URL(e);return r.protocol==="https:"&&r.origin===e&&!r.username&&!r.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),Lr=n({version:i(1),producer:i("primary_mac"),context:ue,captureId:x,operationId:x,attemptId:x,tabId:o().int().positive(),startedAt:V,finishedAt:V,sha256:X,media:g("contentType",[n({contentType:i("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),n({contentType:i("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,r)=>{let p=Date.parse(e.startedAt),b=Date.parse(e.finishedAt);if(p<Date.parse(e.context.preparedAt)||b<p||b>Date.parse(e.context.expiresAt)||b-p>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((b-p)/1000-e.media.durationSeconds)>0.1))r.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),yc=g("action",[n({action:i("screenshot"),context_id:x,tab_id:o().int().positive()}).strict(),n({action:i("start_video"),context_id:x,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("stop_video"),recording_operation_id:x}).strict()]),fe=n({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),ce=t().regex(/^[1-9][0-9]{0,19}$/),le=n({version:i(1),owner:H,expectedActorId:ce.nullable(),repositoryId:ce,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),Wr=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],Hr=g("status",[le.extend({status:i("ready"),observedActor:fe,checkedAt:V}),le.extend({status:i("not_ready"),reason:s(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:s(Wr).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),Y=n({version:i(1),owner:H,expectedActorId:ce.nullable(),authenticatedActor:fe,attemptId:x,captureId:x,prUrl:pt,repositoryId:ce,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:X,sizeBytes:o().int().min(128).max(10485760),contentType:i("video/webm")}).strict(),ht=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),$r=g("status",[Y.extend({status:i("not_attempted"),reason:s(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),Y.extend({status:i("uncertain"),reason:i("upload_outcome_unknown")}),Y.extend({status:i("uploaded"),observedActor:fe,nativeUrl:ht,uploadedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),de=Y.extend({nativeUrl:ht,observedActor:fe,bodySha256:X}),Br=g("status",[de.extend({status:i("incomplete"),reason:s(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),de.extend({status:i("verified"),sourceSha256:X,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:i(!0),verifiedAt:V})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Ur=cn().transform((e,r)=>{try{let p=Pe(e);if(p.media.some((b)=>b.kind!=="image"))throw Error();return p}catch{return r.addIssue({code:"custom",message:"proof_media_request_invalid"}),Xo}}),Fr=g("action",[n({action:i("auth_check"),input:le}).strict(),n({action:i("prepare"),context:ue}).strict(),n({action:i("capture_png"),owner:H,contextId:x,tabId:o().int().positive()}).strict(),n({action:i("start_video"),owner:H,contextId:x,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("inspect_capture"),owner:H,captureId:x}).strict(),n({action:i("publish_video"),input:Y}).strict(),n({action:i("verify_png_media"),owner:H,media:Ur}).strict().refine((e)=>e.media.runId===e.owner.runId),n({action:i("verify_saved_media"),input:de}).strict(),n({action:i("publish_png"),owner:H,attemptId:x,captureId:x,sha256:X,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var jr=n({requestId:x,command:Fr}).strict();var qr={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},ft={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},mt={type:"integer",minimum:1,description:"An already-owned tab's id."},_c={...qr,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:ft,tab_id:mt}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:ft,tab_id:mt,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};var Rc=n({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict();var zr=String.raw`async (media) => {
   const deadline = (promise) => {
     let timer;
     return Promise.race([promise, new Promise((_, reject) => {
@@ -49,4 +49,4 @@ ${r?.directory??m(e)}`).digest("hex")}var Bt="keychain-scope.json";var Ut=c({ver
     }
   }));
   return { verified: true, items };
-}`;import{execFile as Kr}from"child_process";import{promisify as Jr}from"util";var Ic=Jr(Kr);var Vc=g("ok",[n({ok:i(!0),actor:n({login:t(),id:t().nullable()}).strict()}).strict(),n({ok:i(!1),reason:s(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),Jc=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var Xc=n({version:i(1),recording_operation_id:t().uuid(),proof_ready:i(!1),acknowledged_at:y.datetime()}).strict(),me=n({action:i("start"),request_id:t().uuid(),profile:t().regex(/^(Default|Profile [0-9]+)$/),tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),gt=n({action:i("inspect"),recording_operation_id:t().uuid()}).strict(),Zc=g("action",[me,gt]),wt=n({recording_operation_id:t().uuid()}).strict(),Oe={device_id:t().uuid(),root_id:t().uuid()},Yr=g("action",[me.extend(Oe),gt.extend(Oe),wt.extend({...Oe,action:i("stop")})]),Qc=an(Yr),el=n({version:i(1),recordingId:t().uuid(),proofReady:i(!1),capture:n({captureId:t().uuid(),contentType:i("video/webm"),sha256:t().regex(/^[a-f0-9]{64}$/),sizeBytes:o().int().min(128).max(10485760),startedAt:y.datetime(),finishedAt:y.datetime(),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000),owner:n({runId:t().uuid(),deviceId:t().uuid(),rootId:t().uuid(),rootRevision:t().max(64),profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024),generation:t().uuid(),browserScope:t().max(128),tabId:o().int().positive()}).strict()}).strict().refine((e)=>e.receivedFrameCount>=e.frameCount&&Math.abs((Date.parse(e.finishedAt)-Date.parse(e.startedAt))/1000-e.durationSeconds)<=0.1)}).strict();var dl=me.extend({action:s(["start","inspect"]),recording_boot_generation:t().uuid(),recording_operation_id:t().uuid().optional(),recording_attempt_id:t().uuid().optional()}).strict();import{execFile as Xr}from"child_process";import{promisify as Zr}from"util";var pl=Zr(Xr);var Qr=s(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var U=t().min(1).max(1024),yt=n({path:U,sha256:t().regex(/^[a-f0-9]{64}$/)}).strict(),en=n({owner:n({runId:U,deviceId:U,rootId:U,rootRevision:U,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:U,generation:U,browserScope:U,tabId:o().int().positive()}).strict(),socketPath:U,extensionId:t().regex(/^[a-p]{32}$/),nativeHostName:U,seconds:o().int().min(1).max(15),encoder:n({ffmpeg:yt,ffprobe:yt}).strict()}).strict();var Ll=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var Vl=n({operationId:t().uuid()}).strict();var fd=sn(on);var md=n({version:i("0.1.42"),metadata:n({extensionId:i(j),extensionInstanceId:t().min(1).max(1024)})});var De=1;var Hf=c({type:i("configure"),protocol:i(De),version:t(),config:F}),$f=c({type:i("ticket"),organizationId:t().min(1).max(160),receipt:Ie()}),Bf=c({type:s(["ping","stop"])});var rm=c({type:i("hello"),protocol:i(De),version:t(),platform:s(["linux","darwin"]),architecture:s(["arm64","x64"]),enrolled:d()}),nm=c({type:i("ticket-request"),request:c({install_id:k(),code_challenge:t().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:s(["persistent","ephemeral"]),roots:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),execution_mode:s(["confined","host"]),permissions:c({read:i(!0),write:i(!0),execute:i(!0),discover_environment:i(!0),expose_mcp:i(!1)})})).length(1)})}),om=g("type",[c({type:i("running"),deviceId:t().min(1).max(160),expiresAt:y.datetime({offset:!0}),lifetime:s(["persistent","ephemeral"]),supervision:i("ssh-foreground")}),c({type:i("pong")}),c({type:i("stopped")})]);var En=1;var Z=k(),Pn=c({kind:i("install_only"),authorityId:Z,organizationId:Z,userId:Z,connectionId:Z,attemptId:Z,purpose:i("install"),generation:o().int().positive(),transport:i("reverse_ssh"),expiresAt:y.datetime({offset:!0}),maxDurationMs:i(300000),maxChannels:i(1),allowTcpForwarding:i(!1),allowPty:i(!1)}),Cn=t().max(2048).superRefine((e,r)=>{let p;try{p=new URL(e)}catch{r.addIssue({code:"custom",message:"invalid relay url"});return}if(p.protocol!=="ws:"&&p.protocol!=="wss:"){r.addIssue({code:"custom",message:"invalid relay protocol"});return}if(p.username||p.password||p.search||p.hash){r.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let b=p.pathname.split("/");if(b.length!==4||b[1]!=="device"||!Z.safeParse(b[2]).success||!/^[a-f0-9]{64}$/.test(b[3]??""))r.addIssue({code:"custom",message:"invalid device relay path"});if(p.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(p.hostname))r.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var sm=c({protocol:i(En),type:i("ssh_install_relay"),authorityToken:t().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:Pn,relayUrl:Cn,endpoint:c({host:i("127.0.0.1"),port:i(22)})});class Ct extends Error{}function Be(e){if(!f(e))return null;let r=new Ct(`${e} is not a valid worker config. Remove it to start over.`),p;try{p=JSON.parse(h(e))}catch(R){if(R instanceof SyntaxError)throw r;throw R}let b=F.safeParse(p);if(!b.success)throw r;return b.data}var Wn=200;var th=c({version:i(1),session_ids:u(t().min(1).max(200)).max(Wn)});function it(e,r,p=!1){let b=Nn(e,r,p);return b.length===1?b[0]:J(ke(J(e,".config")),...xt(r,p))}var xt=(e,r)=>[...e==="production"?[]:[e],r?"connect-once":"connect"];function Nn(e,r,p=!1){let b=e;try{b=pe(e)}catch{}return["ara","reason"].map((R)=>J(b,".config",R,...xt(r,p))).filter(Hn)}function Hn(e){try{if(pe(e)!==e)return!1;return Be(J(e,"worker.json"))?.stateDirectory===e}catch{return!1}}var $n="disconnected.json";function Ss(e,r){return f(J(it(e,r),$n))}function Bn(e,r){return r==="darwin"&&e.userChrome!==!1}var Dg=n({root:n({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});var Mg=Symbol("serve here");async function Es(e={}){let r=pe(e.home??a()),p=Be(J(it(r,e.channel??_()),"worker.json"));if(!p)return null;let b,R=await(e.controlWorker??G)(p,"status").catch((T)=>(b=T instanceof Error?T:Error(String(T)),null)),S=R?tt(p):null,P=e.serviceHost??xe(r),E=Ze(p,P,"connect"),C=N(p).revoked,D=!C&&!R,I=(()=>{try{return B(p)}catch{return null}})(),{workspaces:A,off:M}=C||we(p.stateDirectory)!==null?{workspaces:null,off:null}:qe(p,R?.phase==="running");return{workspaces:A,workspaces_off:M,workspaces_max:je+(A?.filter((T)=>T.account).length??0),name:p.name,device_id:I?.deviceId??null,organization_id:I?.orgId??null,folder:p.workspaceRoot,mode:p.executionMode,sessions_max:null,user_chrome:Bn(p,P.platform),cloud_sessions:p.cloudSessions===!0,root:I?.roots[0]?{id:I.roots[0].id,permissions:I.roots[0].permissions}:null,roots:I?.roots.map((T)=>({id:T.id,folder:T.path,permissions:T.permissions}))??[],state:C?"removed":R?R.phase==="running"?"connected":R.phase:"not_running",not_running_reason:D?rt(p,b):null,worker_alive:D&&E?Xn(E,P):null,sessions_running:R?.activeSessions??null,version:S,service:E?{label:E.label,logs:E.logs}:null}}function xs(e={}){let r=pe(e.home??a()),p=Be(J(it(r,e.channel??_()),"worker.json"));if(!p)return null;return Vr(p,e.serviceHost??xe(r),"connect")?.label??null}export{w,B,pr,Be,it,Ss,Es,xs};
+}`;import{execFile as Kr}from"child_process";import{promisify as Jr}from"util";var Ic=Jr(Kr);var Vc=g("ok",[n({ok:i(!0),actor:n({login:t(),id:t().nullable()}).strict()}).strict(),n({ok:i(!1),reason:s(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),Jc=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var Xc=n({version:i(1),recording_operation_id:t().uuid(),proof_ready:i(!1),acknowledged_at:y.datetime()}).strict(),me=n({action:i("start"),request_id:t().uuid(),profile:t().regex(/^(Default|Profile [0-9]+)$/),tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),gt=n({action:i("inspect"),recording_operation_id:t().uuid()}).strict(),Zc=g("action",[me,gt]),wt=n({recording_operation_id:t().uuid()}).strict(),Oe={device_id:t().uuid(),root_id:t().uuid()},Yr=g("action",[me.extend(Oe),gt.extend(Oe),wt.extend({...Oe,action:i("stop")})]),Qc=an(Yr),el=n({version:i(1),recordingId:t().uuid(),proofReady:i(!1),capture:n({captureId:t().uuid(),contentType:i("video/webm"),sha256:t().regex(/^[a-f0-9]{64}$/),sizeBytes:o().int().min(128).max(10485760),startedAt:y.datetime(),finishedAt:y.datetime(),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000),owner:n({runId:t().uuid(),deviceId:t().uuid(),rootId:t().uuid(),rootRevision:t().max(64),profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024),generation:t().uuid(),browserScope:t().max(128),tabId:o().int().positive()}).strict()}).strict().refine((e)=>e.receivedFrameCount>=e.frameCount&&Math.abs((Date.parse(e.finishedAt)-Date.parse(e.startedAt))/1000-e.durationSeconds)<=0.1)}).strict();var dl=me.extend({action:s(["start","inspect"]),recording_boot_generation:t().uuid(),recording_operation_id:t().uuid().optional(),recording_attempt_id:t().uuid().optional()}).strict();import{execFile as Xr}from"child_process";import{promisify as Zr}from"util";var pl=Zr(Xr);var Qr=s(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var j=t().min(1).max(1024),yt=n({path:j,sha256:t().regex(/^[a-f0-9]{64}$/)}).strict(),en=n({owner:n({runId:j,deviceId:j,rootId:j,rootRevision:j,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:j,generation:j,browserScope:j,tabId:o().int().positive()}).strict(),socketPath:j,extensionId:t().regex(/^[a-p]{32}$/),nativeHostName:j,seconds:o().int().min(1).max(15),encoder:n({ffmpeg:yt,ffprobe:yt}).strict()}).strict();var Ll=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});var Vl=n({operationId:t().uuid()}).strict();var fd=sn(on);var md=n({version:i("0.1.42"),metadata:n({extensionId:i(U),extensionInstanceId:t().min(1).max(1024)})});var De=1;var Hf=c({type:i("configure"),protocol:i(De),version:t(),config:F}),$f=c({type:i("ticket"),organizationId:t().min(1).max(160),receipt:Ie()}),Bf=c({type:s(["ping","stop"])});var rm=c({type:i("hello"),protocol:i(De),version:t(),platform:s(["linux","darwin"]),architecture:s(["arm64","x64"]),enrolled:d()}),nm=c({type:i("ticket-request"),request:c({install_id:k(),code_challenge:t().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:s(["persistent","ephemeral"]),roots:u(c({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),execution_mode:s(["confined","host"]),permissions:c({read:i(!0),write:i(!0),execute:i(!0),discover_environment:i(!0),expose_mcp:i(!1)})})).length(1)})}),om=g("type",[c({type:i("running"),deviceId:t().min(1).max(160),expiresAt:y.datetime({offset:!0}),lifetime:s(["persistent","ephemeral"]),supervision:i("ssh-foreground")}),c({type:i("pong")}),c({type:i("stopped")})]);var En=1;var Z=k(),Pn=c({kind:i("install_only"),authorityId:Z,organizationId:Z,userId:Z,connectionId:Z,attemptId:Z,purpose:i("install"),generation:o().int().positive(),transport:i("reverse_ssh"),expiresAt:y.datetime({offset:!0}),maxDurationMs:i(300000),maxChannels:i(1),allowTcpForwarding:i(!1),allowPty:i(!1)}),Cn=t().max(2048).superRefine((e,r)=>{let p;try{p=new URL(e)}catch{r.addIssue({code:"custom",message:"invalid relay url"});return}if(p.protocol!=="ws:"&&p.protocol!=="wss:"){r.addIssue({code:"custom",message:"invalid relay protocol"});return}if(p.username||p.password||p.search||p.hash){r.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let b=p.pathname.split("/");if(b.length!==4||b[1]!=="device"||!Z.safeParse(b[2]).success||!/^[a-f0-9]{64}$/.test(b[3]??""))r.addIssue({code:"custom",message:"invalid device relay path"});if(p.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(p.hostname))r.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var sm=c({protocol:i(En),type:i("ssh_install_relay"),authorityToken:t().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:Pn,relayUrl:Cn,endpoint:c({host:i("127.0.0.1"),port:i(22)})});class Ct extends Error{}function Be(e){if(!f(e))return null;let r=new Ct(`${e} is not a valid worker config. Remove it to start over.`),p;try{p=JSON.parse(h(e))}catch(R){if(R instanceof SyntaxError)throw r;throw R}let b=F.safeParse(p);if(!b.success)throw r;return b.data}var Wn=200;var th=c({version:i(1),session_ids:u(t().min(1).max(200)).max(Wn)});function it(e,r,p=!1){let b=Nn(e,r,p);return b.length===1?b[0]:J(ke(J(e,".config")),...xt(r,p))}var xt=(e,r)=>[...e==="production"?[]:[e],r?"connect-once":"connect"];function Nn(e,r,p=!1){let b=e;try{b=pe(e)}catch{}return["ara","reason"].map((R)=>J(b,".config",R,...xt(r,p))).filter(Hn)}function Hn(e){try{if(pe(e)!==e)return!1;return Be(J(e,"worker.json"))?.stateDirectory===e}catch{return!1}}var $n="disconnected.json";function Ss(e,r){return f(J(it(e,r),$n))}function Bn(e,r){return r==="darwin"&&e.userChrome!==!1}var Dg=n({root:n({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});var Mg=Symbol("serve here");async function Es(e={}){let r=pe(e.home??a()),p=Be(J(it(r,e.channel??_()),"worker.json"));if(!p)return null;let b,R=await(e.controlWorker??G)(p,"status").catch((T)=>(b=T instanceof Error?T:Error(String(T)),null)),S=R?tt(p):null,P=e.serviceHost??xe(r),E=Ze(p,P,"connect"),C=N(p).revoked,D=!C&&!R,I=(()=>{try{return B(p)}catch{return null}})(),{workspaces:A,off:M}=C||we(p.stateDirectory)!==null?{workspaces:null,off:null}:ze(p,R?.phase==="running");return{workspaces:A,workspaces_off:M,workspaces_max:qe+(A?.filter((T)=>T.account).length??0),name:p.name,device_id:I?.deviceId??null,organization_id:I?.orgId??null,folder:p.workspaceRoot,mode:p.executionMode,sessions_max:null,user_chrome:Bn(p,P.platform),cloud_sessions:p.cloudSessions===!0,root:I?.roots[0]?{id:I.roots[0].id,permissions:I.roots[0].permissions}:null,roots:I?.roots.map((T)=>({id:T.id,folder:T.path,permissions:T.permissions}))??[],state:C?"removed":R?R.phase==="running"?"connected":R.phase:"not_running",not_running_reason:D?rt(p,b):null,worker_alive:D&&E?Xn(E,P):null,sessions_running:R?.activeSessions??null,version:S,service:E?{label:E.label,logs:E.logs}:null}}function xs(e={}){let r=pe(e.home??a()),p=Be(J(it(r,e.channel??_()),"worker.json"));if(!p)return null;return Vr(p,e.serviceHost??xe(r),"connect")?.label??null}export{w,B,pr,Be,it,Ss,Es,xs};

package/bin/vm-hands/{vm-hands-entry-lite-y5hv1gjv.js → vm-hands-entry-lite-ravxhygk.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Gi,Ki}from"./vm-hands-entry-lite-9azmqs47.js";function ks(o=process.platform){if(Gi(),o==="linux"||o==="win32")Ki("strict")}
+import{Gi,Ki}from"./vm-hands-entry-lite-ak0hd94p.js";function ks(o=process.platform){if(Gi(),o==="linux"||o==="win32")Ki("strict")}
 export{ks};

package/bin/vm-hands/{vm-hands-entry-lite-4p00at6j.js → vm-hands-entry-lite-rp2twenv.js}

@@ -1,3 +1,3 @@
 // @bun
-import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{readdirSync as b,readFileSync as P}from"fs";import{userInfo as k}from"os";var ur="--vm-hands-op-runner-kind=person",dr="--vm-hands-op-runner-kind=surface",Rt="--vm-hands-surface-uid=",Tt="--vm-hands-surface-dir=",It=new Set(["automation.call.v1","display.stream.v1","preview.serve.v1"]);function R(t){let c=new Set([t]),l=[];try{l=b("/proc")}catch{}for(let o of l){if(!/^\d+$/.test(o))continue;try{let d=P(`/proc/${o}/stat`,"utf8");if(Number(d.slice(d.lastIndexOf(")")+2).split(" ")[3])===t)c.add(Number(o))}catch{}}for(let o of c)try{process.kill(o,"SIGKILL")}catch{}}var A=(t)=>{let c=globalThis.Bun;if(!c)throw new r("pty_unavailable","Reason terminals require the Bun runtime.");let l=c.spawn({cmd:[t.shell,...t.args],cwd:t.cwd,env:{...t.environment,TERM:"xterm-256color"},terminal:{cols:t.cols,rows:t.rows,data:(i,s)=>t.onData(s)}}),o=l.terminal,d=()=>{R(l.pid);try{o?.close()}catch{}};if(!o)throw d(),new r("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(i)=>o.write(i),resize:(i,s)=>o.resize(i,s),kill:d,exited:l.exited.then((i)=>typeof i==="number"?i:null,()=>null)}};function x(){let t=(()=>{try{return k().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...t?{USER:t,LOGNAME:t}:{}}}async function E(t){let[{localAutomationAvailable:c},{localDisplayReady:l},{localDisplayVideoAvailable:o},{probeWorkerPreview:d},y]=await Promise.all([import("./local-automation-ntm992ch.js"),import("./local-display-session-pwvn2bhn.js"),import("./local-display-video-r4h9bbp6.js"),import("./worker-preview-readiness-84stxabw.js"),import("fs")]),i=AbortSignal.timeout(15000),s=null;try{y.mkdirSync(t,{recursive:!0,mode:448}),s=y.mkdtempSync(`${t}/probe-`);let[g,p,m]=await Promise.all([Promise.resolve().then(()=>c()).catch(()=>!1),l().catch(()=>!1),d(s,i).catch(()=>!1)]);return{t:"readiness",display_video:p&&await o().catch(()=>!1),lanes:{"automation.call.v1":g,"display.stream.v1":p,"preview.serve.v1":m,"tunnel.open":m,"tunnel.close":m}}}finally{if(s)y.rmSync(s,{recursive:!0,force:!0})}}async function vs(){let[{executeLocalOperation:t,spawnCaptured:c},{runLocalPtySession:l},{configureDesktopAccount:o,desktopAccount:d},{configureWorkerSandbox:y}]=await Promise.all([import("./local-capabilities-ctjw338r.js"),import("./local-pty-session-yr22ryvy.js"),import("./desktop-account-d7x4xn27.js"),import("./worker-sandbox-563c5g2f.js")]);y();let i=process.argv.includes(ur),s=process.argv.includes(dr),g=(a,e,u)=>c(a,e[0]==="-lic"?["-lc",...e.slice(1)]:e,u),p=(process.geteuid?.()??0)!==0;if(s){p=!1;let a=process.argv.find((e)=>e.startsWith(Rt))?.slice(Rt.length);if((process.geteuid?.()??-1)===0&&a)try{p=o({value:a})!==null&&d()!==null}catch{p=!1}}let m=new Map,v=new Map,f=(a)=>{try{process.send?.(a)}catch{}};if(process.on("message",(a)=>{let e=a;if(e?.t==="cancel"){m.get(e.id)?.abort();return}if(e?.t==="control"){let n=v.get(e.id);if(s&&n&&e.control&&typeof e.control.kind==="string")import("./local-managed-process-15m5rtxd.js").then(({controlManagedDeviceProcess:_})=>_(n,{kind:e.control.kind,payload:e.control.payload??{}})).catch(()=>!1);return}if(e?.t==="retire"){if(s&&typeof e.operation_id==="string"&&typeof e.status==="string")import("./local-managed-process-15m5rtxd.js").then(({retireManagedDeviceProcess:n})=>n(e.operation_id,e.status)).catch(()=>!1);return}if(e?.t!=="op")return;if(!p){f({t:"done",id:e.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let u=e.claim.capability;if(u==="pty.start"&&!i){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}if(It.has(u)!==s){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}let w=new AbortController;m.set(e.id,w),v.set(e.id,e.claim);let S=u==="pty.start"?{runPtySession:(n)=>l(n,{spawnPty:A,environment:x(),loadProxy:()=>null})}:{worker:e.worker,...u==="exec.full"?{spawnFullControl:g}:{}};t(e.state,e.claim,{...S,signal:w.signal,emit:(n)=>{let{deliverySignal:_,...h}=n;f({t:"event",id:e.id,event:h})}}).then((n)=>f({t:"done",id:e.id,completion:n}),(n)=>f({t:"done",id:e.id,completion:{status:"failed",error_code:n&&typeof n==="object"&&"code"in n&&typeof n.code==="string"?n.code:"vm_hands_op_failed"}})).finally(()=>{m.delete(e.id),v.delete(e.id)})}),process.on("disconnect",()=>process.exit(0)),s){let a=process.argv.find((u)=>u.startsWith(Tt))?.slice(Tt.length),e={t:"readiness",display_video:!1,lanes:{}};f(p&&a?await E(a).catch(()=>e):e)}await new Promise(()=>{})}
+import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{readdirSync as b,readFileSync as P}from"fs";import{userInfo as k}from"os";var ur="--vm-hands-op-runner-kind=person",dr="--vm-hands-op-runner-kind=surface",Rt="--vm-hands-surface-uid=",Tt="--vm-hands-surface-dir=",It=new Set(["automation.call.v1","display.stream.v1","preview.serve.v1"]);function R(t){let c=new Set([t]),l=[];try{l=b("/proc")}catch{}for(let o of l){if(!/^\d+$/.test(o))continue;try{let d=P(`/proc/${o}/stat`,"utf8");if(Number(d.slice(d.lastIndexOf(")")+2).split(" ")[3])===t)c.add(Number(o))}catch{}}for(let o of c)try{process.kill(o,"SIGKILL")}catch{}}var A=(t)=>{let c=globalThis.Bun;if(!c)throw new r("pty_unavailable","Reason terminals require the Bun runtime.");let l=c.spawn({cmd:[t.shell,...t.args],cwd:t.cwd,env:{...t.environment,TERM:"xterm-256color"},terminal:{cols:t.cols,rows:t.rows,data:(i,s)=>t.onData(s)}}),o=l.terminal,d=()=>{R(l.pid);try{o?.close()}catch{}};if(!o)throw d(),new r("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(i)=>o.write(i),resize:(i,s)=>o.resize(i,s),kill:d,exited:l.exited.then((i)=>typeof i==="number"?i:null,()=>null)}};function x(){let t=(()=>{try{return k().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...t?{USER:t,LOGNAME:t}:{}}}async function E(t){let[{localAutomationAvailable:c},{localDisplayReady:l},{localDisplayVideoAvailable:o},{probeWorkerPreview:d},y]=await Promise.all([import("./local-automation-c75g446p.js"),import("./local-display-session-hvbp46qx.js"),import("./local-display-video-yh6hfavd.js"),import("./worker-preview-readiness-gy36ejp9.js"),import("fs")]),i=AbortSignal.timeout(15000),s=null;try{y.mkdirSync(t,{recursive:!0,mode:448}),s=y.mkdtempSync(`${t}/probe-`);let[g,p,m]=await Promise.all([Promise.resolve().then(()=>c()).catch(()=>!1),l().catch(()=>!1),d(s,i).catch(()=>!1)]);return{t:"readiness",display_video:p&&await o().catch(()=>!1),lanes:{"automation.call.v1":g,"display.stream.v1":p,"preview.serve.v1":m,"tunnel.open":m,"tunnel.close":m}}}finally{if(s)y.rmSync(s,{recursive:!0,force:!0})}}async function vs(){let[{executeLocalOperation:t,spawnCaptured:c},{runLocalPtySession:l},{configureDesktopAccount:o,desktopAccount:d},{configureWorkerSandbox:y}]=await Promise.all([import("./local-capabilities-1kcxmz0s.js"),import("./local-pty-session-njd0tprg.js"),import("./desktop-account-t0afsge2.js"),import("./worker-sandbox-f1tfb3y0.js")]);y();let i=process.argv.includes(ur),s=process.argv.includes(dr),g=(a,e,u)=>c(a,e[0]==="-lic"?["-lc",...e.slice(1)]:e,u),p=(process.geteuid?.()??0)!==0;if(s){p=!1;let a=process.argv.find((e)=>e.startsWith(Rt))?.slice(Rt.length);if((process.geteuid?.()??-1)===0&&a)try{p=o({value:a})!==null&&d()!==null}catch{p=!1}}let m=new Map,v=new Map,f=(a)=>{try{process.send?.(a)}catch{}};if(process.on("message",(a)=>{let e=a;if(e?.t==="cancel"){m.get(e.id)?.abort();return}if(e?.t==="control"){let n=v.get(e.id);if(s&&n&&e.control&&typeof e.control.kind==="string")import("./local-managed-process-g6vsy02z.js").then(({controlManagedDeviceProcess:_})=>_(n,{kind:e.control.kind,payload:e.control.payload??{}})).catch(()=>!1);return}if(e?.t==="retire"){if(s&&typeof e.operation_id==="string"&&typeof e.status==="string")import("./local-managed-process-g6vsy02z.js").then(({retireManagedDeviceProcess:n})=>n(e.operation_id,e.status)).catch(()=>!1);return}if(e?.t!=="op")return;if(!p){f({t:"done",id:e.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let u=e.claim.capability;if(u==="pty.start"&&!i){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}if(It.has(u)!==s){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}let w=new AbortController;m.set(e.id,w),v.set(e.id,e.claim);let S=u==="pty.start"?{runPtySession:(n)=>l(n,{spawnPty:A,environment:x(),loadProxy:()=>null})}:{worker:e.worker,...u==="exec.full"?{spawnFullControl:g}:{}};t(e.state,e.claim,{...S,signal:w.signal,emit:(n)=>{let{deliverySignal:_,...h}=n;f({t:"event",id:e.id,event:h})}}).then((n)=>f({t:"done",id:e.id,completion:n}),(n)=>f({t:"done",id:e.id,completion:{status:"failed",error_code:n&&typeof n==="object"&&"code"in n&&typeof n.code==="string"?n.code:"vm_hands_op_failed"}})).finally(()=>{m.delete(e.id),v.delete(e.id)})}),process.on("disconnect",()=>process.exit(0)),s){let a=process.argv.find((u)=>u.startsWith(Tt))?.slice(Tt.length),e={t:"readiness",display_video:!1,lanes:{}};f(p&&a?await E(a).catch(()=>e):e)}await new Promise(()=>{})}
 export{ur,dr,Rt,Tt,It,vs};

package/bin/vm-hands/{vm-hands-entry-lite-9ttdnmnx.js → vm-hands-entry-lite-sqzryt00.js}

@@ -1,5 +1,5 @@
 // @bun
-import{$n,Mn,To,Wt}from"./vm-hands-entry-lite-k9vk84wa.js";import{Tn,Ve,_o,In,Dn,On,Rr,x}from"./vm-hands-entry-lite-er4yqpbg.js";import{Pt}from"./vm-hands-entry-lite-xe0benev.js";import{Nr}from"./vm-hands-entry-lite-645wzfhr.js";import{H}from"./vm-hands-entry-lite-w29d7ey0.js";import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ce,spawn as ne}from"child_process";import{randomBytes as Oe}from"crypto";import{chmodSync as he,existsSync as ae,lstatSync as Je,mkdirSync as Qe,readFileSync as oe,rmSync as ie,writeFileSync as R}from"fs";import{connect as Se}from"net";import{join as I}from"path";var B=32,N=76;var v="./desktop-wallpaper-fd8f2wb2.jpg";var Z="./dock-browser-y53t41cx.png";var V="./dock-files-cp52htdw.png";var z="./dock-terminal-1es514yq.png";var W="./grok-wallpaper-71zwn2pj.jpg";var j="./grok-dock-browser-pzw59wnd.png";var U="./grok-dock-files-eckq444x.png";var ee="./grok-dock-terminal-hcpz3e43.png";var re=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
+import{qn,Wn,Oo,Qt}from"./vm-hands-entry-lite-2v4zh9ze.js";import{Bn,Xe,bo,Fn,jn,Hn,Ur,x}from"./vm-hands-entry-lite-8mttvhef.js";import{Pt}from"./vm-hands-entry-lite-qd46yhvz.js";import{Ir}from"./vm-hands-entry-lite-0wsr8edk.js";import{j}from"./vm-hands-entry-lite-dgfx0rbn.js";import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ce,spawn as ne}from"child_process";import{randomBytes as he}from"crypto";import{chmodSync as Je,existsSync as ae,lstatSync as Qe,mkdirSync as Se,readFileSync as oe,rmSync as ie,writeFileSync as u}from"fs";import{connect as Te}from"net";import{join as I}from"path";var B=32,Y=76;var m="./desktop-wallpaper-fd8f2wb2.jpg";var v="./dock-browser-y53t41cx.png";var Z="./dock-files-cp52htdw.png";var V="./dock-terminal-1es514yq.png";var z="./grok-wallpaper-71zwn2pj.jpg";var W="./grok-dock-browser-pzw59wnd.png";var U="./grok-dock-files-eckq444x.png";var ee="./grok-dock-terminal-hcpz3e43.png";var re=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
 # The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
 # python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
 # Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE
@@ -56,7 +56,7 @@ x.XSetWindowBackgroundPixmap(d, root, pix)
 x.XClearWindow(d, root)
 x.XSetCloseDownMode(d, 1)  # RetainPermanent: the pixmap outlives this process
 x.XCloseDisplay(d)
-`;function Ye(e){return`<?xml version="1.0" encoding="UTF-8"?>
+`;function Ne(e){return`<?xml version="1.0" encoding="UTF-8"?>
 <openbox_config xmlns="http://openbox.org/3.4/rc">
   <theme><keepBorder>no</keepBorder></theme>
   <applications>
@@ -64,10 +64,10 @@ x.XCloseDisplay(d)
     <application class="Chromium*">
       <decor>no</decor>
       <position force="yes"><x>${B}</x><y>${B}</y></position>
-      <size><width>${e.width-B*2}</width><height>${e.height-B-N}</height></size>
+      <size><width>${e.width-B*2}</width><height>${e.height-B-Y}</height></size>
     </application>
   </applications>
-</openbox_config>`}var Ne=`# Remote sandbox dock \u2014 launcher icons only, centred, no panel fill
+</openbox_config>`}var ue=`# Remote sandbox dock \u2014 launcher icons only, centred, no panel fill
 panel_items = L
 panel_size = 100% 46
 panel_margin = 0 10
@@ -88,7 +88,7 @@ launcher_tooltip = 1
 launcher_item_app = /tmp/ara-chromium.desktop
 launcher_item_app = /tmp/ara-files.desktop
 launcher_item_app = /tmp/ara-terminal.desktop
-`,De=32,ue=`# Remote sandbox dock (grok look) \u2014 small launcher icons only, centred, no panel fill
+`,De=32,Re=`# Remote sandbox dock (grok look) \u2014 small launcher icons only, centred, no panel fill
 panel_items = L
 panel_size = 100% ${De+16}
 panel_margin = 0 0
@@ -109,7 +109,7 @@ launcher_tooltip = 1
 launcher_item_app = /tmp/ara-chromium.desktop
 launcher_item_app = /tmp/ara-files.desktop
 launcher_item_app = /tmp/ara-terminal.desktop
-`,Re=`corner-radius = 12;
+`,ge=`corner-radius = 12;
 rounded-corners-exclude = [
   "class_g = 'tint2'",
   "window_type = 'dock'",
@@ -121,13 +121,13 @@ fading = false;
 vsync = false;
 inactive-opacity = 1.0;
 active-opacity = 1.0;
-`,ge="/tmp/ara-dock-browser.png",Ke=`[Desktop Entry]
+`,Ke="/tmp/ara-dock-browser.png",Fe=`[Desktop Entry]
 Name=Chrome
 Exec=chromium --no-sandbox %U
-Icon=${ge}
+Icon=${Ke}
 Type=Application
 Categories=Network;WebBrowser;
-`,Fe=`[Desktop Entry]
+`,Ce=`[Desktop Entry]
 Name=Terminal
 Exec=bash -c "DISPLAY=:99 xterm -fa DejaVuSansMono -fs 11 -bg black -fg white"
 Icon=/tmp/ara-dock-terminal.png
@@ -139,12 +139,12 @@ Exec=bash -c "DISPLAY=:99 pcmanfm --no-desktop"
 Icon=/tmp/ara-dock-files.png
 Type=Application
 Categories=System;FileManager;
-`;var te={"wallpaper.jpg":v,"dock-browser.png":Z,"dock-terminal.png":z,"dock-files.png":V,"grok-wallpaper.jpg":W,"grok-dock-browser.png":j,"grok-dock-terminal.png":ee,"grok-dock-files.png":U},Ce=re,Ge='set_wallpaper() { if command -v feh >/dev/null 2>&1; then feh --bg-fill "$1"; else python3 "$2" "$1"; fi; }';function de(e){let D=(p)=>p.replaceAll("DISPLAY=:99",`DISPLAY=${e.display}`).replaceAll("/tmp/ara-",`${e.root}/ara-`),s=e.look==="grok",d=new Set(e.absent??[]),t=d.has("files")&&e.filesViewerExec?e.filesViewerExec:null;if(t)d.delete("files");let c=(s?ue:Ne).split(`
+`;var te={"wallpaper.jpg":m,"dock-browser.png":v,"dock-terminal.png":V,"dock-files.png":Z,"grok-wallpaper.jpg":z,"grok-dock-browser.png":W,"grok-dock-terminal.png":ee,"grok-dock-files.png":U},Ge=re,Oe='set_wallpaper() { if command -v feh >/dev/null 2>&1; then feh --bg-fill "$1"; else python3 "$2" "$1"; fi; }';function de(e){let D=(p)=>p.replaceAll("DISPLAY=:99",`DISPLAY=${e.display}`).replaceAll("/tmp/ara-",`${e.root}/ara-`),s=e.look==="grok",d=new Set(e.absent??[]),t=d.has("files")&&e.filesViewerExec?e.filesViewerExec:null;if(t)d.delete("files");let c=(s?Re:ue).split(`
 `).filter((p)=>!(d.has("terminal")&&p.endsWith("/ara-terminal.desktop"))&&!(d.has("files")&&p.endsWith("/ara-files.desktop"))).join(`
-`),n=(p)=>s?p.replace("/tmp/ara-dock-","/tmp/ara-grok-dock-"):p,o=t?$e.replace(/^Exec=.*$/m,`Exec=${t}`).replace("Categories=System;FileManager;","Categories=Utility;Viewer;"):$e,f=s?"ara-grok-wallpaper.jpg":"ara-wallpaper.jpg",i={"openbox/rc.xml":Ye(e.screen),"tint2/tint2rc":D(c),"picom/picom.conf":Re,...d.has("terminal")?{}:{"ara-terminal.desktop":D(n(Fe))},...d.has("files")?{}:{"ara-files.desktop":D(n(o))},"ara-chromium.desktop":D(n(Ke)).replace("chromium --no-sandbox %U",e.browserExec),"ara-set-root-wallpaper.py":Ce},X=[...u.slice(0,3),Ge,`[ ! -f "$ROOT/${f}" ] || set_wallpaper "$ROOT/${f}" "$ROOT/ara-set-root-wallpaper.py" || true`,'if alive tint2 && ! cmp -s "$ROOT/tint2/tint2rc" "$ROOT/tint2/applied"; then read -r pid _ <"$ROOT/tint2.pid"; kill -USR1 "$pid" 2>/dev/null || true; fi','cp "$ROOT/tint2/tint2rc" "$ROOT/tint2/applied" 2>/dev/null || true',...u.slice(3)];return{files:i,start:X}}var u=['ticks() { line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1; rest=${line##*) }; case $rest in Z*|X*) return 1;; esac; printf "%s" "$rest" | cut -d " " -f20; }','alive() { [ -f "$ROOT/$1.pid" ] || return 1; read -r pid start <"$ROOT/$1.pid"; current=$(ticks "$pid") || return 1; [ "$current" = "$start" ] && kill -0 "$pid" 2>/dev/null; }','launch() { name=$1; shift; "$@" 9>&- >"$ROOT/$name.log" 2>&1 & pid=$!; start=$(ticks "$pid"); printf "%s %s\\n" "$pid" "$start" >"$ROOT/$name.pid"; }','if [ -f "$ROOT/tint2/tint2rc" ] && ! alive tint2 && command -v tint2 >/dev/null 2>&1; then launch tint2 tint2 -c "$ROOT/tint2/tint2rc"; fi','if [ -f "$ROOT/picom/picom.conf" ] && ! alive picom && command -v picom >/dev/null 2>&1; then launch picom picom --config "$ROOT/picom/picom.conf"; fi'];var Te=43200000,P=":99",ke=60000,Y=15000,g={width:1280,height:800},_e=/^[A-Za-z0-9._:-]{1,160}$/;function we(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}var Me=["video","viewer","viewer_same_network","viewer_network","look"];function me(e,D=Date.now()){let s=["relay_url","session_id","expires_at"];if(!we(e)||s.some((f)=>!(f in e))||Object.keys(e).some((f)=>!s.includes(f)&&!Me.includes(f)))throw new r("invalid_display_request","Reason desktop request is malformed.");let d="video"in e?To(e.video):void 0,t="viewer"in e?$n(e.viewer):null,c="look"in e?Mn(e.look):null;if(d===null)throw new r("invalid_display_request","Reason desktop video request is invalid.");let n=null;try{n=typeof e.relay_url==="string"?new URL(e.relay_url):null}catch{}if(!n||n.protocol!=="wss:"&&n.protocol!=="ws:"||n.username||n.password)throw new r("invalid_display_request","Reason desktop relay URL is invalid.");if(typeof e.session_id!=="string"||!_e.test(e.session_id))throw new r("invalid_display_request","Reason desktop session identity is invalid.");let o=typeof e.expires_at==="string"?Date.parse(e.expires_at):Number.NaN;if(!Number.isFinite(o)||o<=D)throw new r("invalid_display_request","Reason desktop session has already expired.");return{relay_url:e.relay_url,session_id:e.session_id,expires_at:new Date(Math.min(o,D+Te)).toISOString(),...d?{video:d}:{},...t?{viewer:t}:{},...d&&e.viewer_same_network===!0?{viewer_same_network:!0}:{},...c?{look:c}:{}}}function Ft(e=process.platform){return(e==="linux"||e==="darwin"||e==="win32")&&x()?.features.display===!0}async function Vs(){if(process.platform==="win32")return Ft()&&await Rr();if(process.platform!=="darwin")return Ft();return await Rr()}function G(e){Qe(e,{recursive:!0,mode:448});let D=Je(e);if(!D.isDirectory()||D.isSymbolicLink()||process.getuid&&D.uid!==process.getuid())throw new r("display_unavailable","Reason desktop state directory is not private.");he(e,448)}function ve(e,D){let s=(t)=>{let c=Buffer.alloc(2);return c.writeUInt16BE(t.length),Buffer.concat([c,t])},d=Buffer.from([255,255]);return Buffer.concat([d,s(Buffer.alloc(0)),s(Buffer.from(e)),s(Buffer.from("MIT-MAGIC-COOKIE-1")),s(D)])}function L(e,D,s=2000){return new Promise((d)=>{let t=Se(e),c="",n=(o)=>{t.destroy(),d(o)};t.setTimeout(s,()=>n(!1)),t.once("error",()=>n(!1)),t.once("close",()=>n(!1)),t.once("connect",()=>{if(!D)n(!0)}),t.on("data",(o)=>{if(c+=o.toString("latin1"),c.length>=4)n(c.startsWith("RFB "))})})}async function S(e,D){let s=Date.now()+D;while(Date.now()<s){if(await e())return!0;await new Promise((d)=>setTimeout(d,100))}return!1}function K(e,D,s){return new Promise((d)=>{let t=ne(e,D,{detached:!0,stdio:"ignore",env:s});t.once("error",()=>d(-1)),t.once("exit",(c)=>d(c)),t.unref(),setTimeout(()=>d(null),Y).unref()})}var Q=null;function qe(e=a()){return Q??=Ze(e).finally(()=>{Q=null}),Q}async function Ze(e){let D=x({home:e});if(!D?.xvfb||!D.x11vnc||!D.openbox)throw new r("display_unavailable","Run `reason desktop install` on this machine to enable its desktop.");Pt({root:D.root,automation:D.automation,extensionDir:D.extensionDir});let s=I(D.root,"display");G(s);let d=await We(e,s,D.x11vnc);if(d)return d;let t={display:P,xauthority:I(s,"Xauthority"),rfbSocket:I(s,"rfb.sock")},c=I(s,"pulse"),n=(async()=>{try{G(c)}catch{return null}return await _o(c,D.pulseaudio)})();G(I(s,"home"));let o=T(s,t,D.pulseaudio),f=async()=>({...t,sound:await n});if(await L({path:t.rfbSocket},!0))return be(I(s,"theme"),u,o),await f();if(!ae(t.xauthority))R(t.xauthority,ve(P.slice(1),Oe(16)),{mode:384,flag:"wx"});let i=k(I(s,"theme"),t.display,g,e),X={path:`/tmp/.X11-unix/X${P.slice(1)}`};if(!await L(X,!1)){let p=`${g.width}x${g.height}`;if(D.xvnc)ie(t.rfbSocket,{force:!0}),K(D.xvnc,[t.display,"-geometry",p,"-depth","24","-nolisten","tcp","-auth",t.xauthority,"-rfbport","-1","-rfbunixpath",t.rfbSocket,"-SecurityTypes","None","-UseBlacklist=0","-AlwaysShared","-desktop","Reason"],o);else K(D.xvfb,[t.display,"-screen","0",`${p}x24`,"-nolisten","tcp","-auth",t.xauthority],o);if(!await S(()=>L(X,!1),Y)||D.xvnc&&!await S(()=>L({path:t.rfbSocket},!0),Y))throw new r("display_unavailable","Reason could not start the virtual display.");K(D.openbox,["--config-file",i.openboxConfig],o)}if(await _(i,o),!await fe(D.x11vnc,t,s,"x11vnc.log",o))throw new r("display_unavailable","Reason could not start the desktop server.");return await f()}function T(e,D,s){let d={HOME:I(e,"home"),PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:D.display,XAUTHORITY:D.xauthority};if(s)d.PULSE_SERVER=Ve(Tn(I(e,"pulse")));return d}async function fe(e,D,s,d,t){if(await L({path:D.rfbSocket},!0))return!0;ie(D.rfbSocket,{force:!0});let c=await K(e,["-display",D.display,"-auth",D.xauthority,"-rfbport","0","-rfbportv6","-1","-unixsock",D.rfbSocket,"-nopw","-forever","-shared","-noxdamage","-sb","0","-rfbversion","3.7","-quiet","-bg","-o",I(s,d)],t);if(c!==null&&c!==0)return!1;return await S(()=>L({path:D.rfbSocket},!0),Y)}async function ze(){let e=["DISPLAY","XAUTHORITY","WAYLAND_DISPLAY","XDG_SESSION_TYPE"],D=(s)=>Object.fromEntries(e.flatMap((d)=>s[d]?[[d,s[d]]]:[]));if(process.env.DISPLAY)return D(process.env);try{let s=await new Promise((d,t)=>ce("systemctl",["--user","show-environment"],{encoding:"utf8",timeout:2000},(c,n)=>c?t(c):d(n)));return D(Object.fromEntries(s.split(`
-`).flatMap((d)=>{let t=d.indexOf("=");return t>0?[[d.slice(0,t),d.slice(t+1)]]:[]})))}catch{return{}}}var se=new Set;async function We(e,D,s){let d=await ze(),t=/^:(\d+)(?:\.\d+)?$/.exec(d.DISPLAY??"")?.[1];if(!t||`:${t}`===P||d.WAYLAND_DISPLAY||d.XDG_SESSION_TYPE==="wayland")return null;let c={display:`:${t}`,xauthority:d.XAUTHORITY??I(e,".Xauthority"),rfbSocket:I(D,`rfb-${t}.sock`)},n=`${c.display} ${c.xauthority}`;if(se.has(n)||!await L({path:`/tmp/.X11-unix/X${t}`},!1))return null;let o={HOME:e,PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:c.display,XAUTHORITY:c.xauthority};if(await fe(s,c,D,`x11vnc-${t}.log`,o))return{...c,sound:null};return se.add(n),process.stderr.write(`Reason worker: your screen ${c.display} could not be served; using the virtual desktop
-`),null}var Ie="look";function pe(e){try{return Mn(oe(I(e,Ie),"utf8").trim())??"reason"}catch{return"reason"}}function k(e,D,s,d,t=pe(e)){let c=`chromium --no-first-run --no-default-browser-check${process.geteuid?.()===0?" --no-sandbox":""} %U`,n=[["terminal","xterm"],["files","pcmanfm"]].filter(([,i])=>!ae(`/usr/bin/${i}`)).map(([i])=>i),o=`${c.replace(/ %U$/,"")} --app=file://${I(d,".reason","workspace")}/`,f=de({root:e,display:D,screen:s,browserExec:c,absent:n,look:t,filesViewerExec:o});for(let i of["","openbox","tint2","picom"])G(I(e,i));R(I(e,Ie),`${t}
-`,{mode:384});for(let[i,X]of Object.entries(f.files))R(I(e,i),X,{mode:384});for(let[i,X]of Object.entries(te))R(I(e,`ara-${i}`),oe(X),{mode:384});return{root:e,openboxConfig:I(e,"openbox","rc.xml"),start:f.start}}function _(e,D){return be(e.root,[...e.start,"openbox --reconfigure >/dev/null 2>&1 || true"],D)}function be(e,D,s){let d=[`ROOT=${JSON.stringify(e)}`,...D].join(`
-`);return new Promise((t)=>{let c=ne("/bin/sh",["-c",d],{stdio:"ignore",env:{...s,PATH:"/usr/bin:/bin"}}),n=setTimeout(()=>{c.kill(),t()},Y);c.once("error",()=>{clearTimeout(n),t()}),c.once("exit",()=>{clearTimeout(n),t()})})}var je=2073600,Ue=320;function er(e,D){let s=Math.min(1,Math.sqrt(je/(e.width*e.height))),d=(t,c)=>Math.min(Math.floor(c/8)*8,Math.max(Ue,Math.round(t*s/8)*8));return{width:d(e.width,D.width),height:d(e.height,D.height)}}function w(e,D,s){return new Promise((d)=>ce(e,D,{env:s,encoding:"utf8",timeout:5000},(t,c)=>d(t?null:c)))}function Xe(e){let D=/current (\d+) x (\d+), maximum (\d+) x (\d+)/.exec(e),s=e.split(`
-`),d=s.findIndex((c)=>/^\S+ connected/.test(c));if(!D||d<0)return null;let t=[];for(let c of s.slice(d+1)){let n=/^\s+(\d+x\d+)\s/.exec(c);if(!n)break;t.push(n[1])}return{current:{width:Number(D[1]),height:Number(D[2])},maximum:{width:Number(D[3]),height:Number(D[4])},output:s[d].split(" ")[0],modes:t}}async function rr(e,D,s){if(e.display!==P)return null;let d={PATH:"/usr/bin:/bin",DISPLAY:e.display,XAUTHORITY:e.xauthority},t=(f)=>w("xrandr",f,d),c=Xe(await t(["--query"])??"");if(!c||c.maximum.width<=c.current.width&&c.maximum.height<=c.current.height)return null;let n=er(D,c.maximum);if(n.width===c.current.width&&n.height===c.current.height)return{size:n,changed:!1};let o=`${n.width}x${n.height}`;if(!c.modes.includes(o)){if(await t(["--newmode",o,"60",...[n.width,n.width,n.width,n.width,n.height,n.height,n.height,n.height].map(String)]),await t(["--addmode",c.output,o])===null)return null}return s(),await t(["--output",c.output,"--mode",o])===null?null:{size:n,changed:!0}}async function Dr(e,D){let s=a(),d=x({home:s});if(!d)return;let t=I(d.root,"display"),c=T(t,e,d.pulseaudio);await _(k(I(t,"theme"),e.display,D,s),c);let n=D.width-B*2,o=D.height-B-N;await w("xdotool",["search","--onlyvisible","--class","Chromium","windowsize","%@",String(n),String(o),"windowmove","%@",String(B),String(B)],{...c,PATH:"/usr/bin:/bin"})}var F=Promise.resolve();function $r(e,D,s=()=>{}){let d=F.then(()=>rr(e,D,s));return F=d.then((t)=>t?.changed?Dr(e,t.size):void 0).catch(()=>{}),d.then((t)=>t?.size??null,()=>null)}function tr(e,D){if(e.display!==P)return Promise.resolve();let s=F.then(async()=>{let d=a(),t=x({home:d});if(!t)return;let c=I(t.root,"display"),n=I(c,"theme");if(pe(n)===D)return;let o=T(c,e,t.pulseaudio),f=Xe(await w("xrandr",["--query"],{PATH:"/usr/bin:/bin",DISPLAY:e.display,XAUTHORITY:e.xauthority})??"");await _(k(n,e.display,f?.current??g,d,D),o)});return F=s.catch(()=>{}),s.catch(()=>{})}async function jt(e,D={}){let s=D.now??Date.now,d=me(e.payload,s());if(e.signal.throwIfAborted(),!d.video)throw new r("display_video_required","Reason desktops stream as video now; this request came without it.");let t=D.platform??process.platform;if(t!=="linux"&&t!=="darwin"&&t!=="win32")throw new r("display_video_unsupported","This machine does not serve desktop video.");let{video:c,look:n}=d,o=(D.video?.desktop??(t==="darwin"?async()=>In:t==="win32"?async()=>Dn:async()=>{let f=await qe();if(n)await tr(f,n);return f}))();return await dr(e.signal,d,D,s,(f)=>On(f,{request:c,desktop:o,...d.viewer?{viewer:d.viewer}:{},viewerSameNetwork:d.viewer_same_network===!0},{resizeDesktop:$r,...D.video}),(f)=>Wt({type:"error",code:f}))}function dr(e,D,s,d,t,c){let n=d();return new Promise((o,f)=>{let i=null,X=!1,p=!1,M,q,A,C=!1,l=null,E=(b)=>{if(p)return;if(l)b=l.outcome;p=!0,clearTimeout(M),clearTimeout(q),e.removeEventListener("abort",h),A?.close();try{i?.close(1000,"display_session_over")}catch{}if("error"in b){f(b.error);return}o({reason:b.reason,...A?.summary(),duration_ms:Math.max(0,d()-n)})},O=()=>E({error:new r("display_relay_unavailable","Reason could not reach the desktop relay.")}),h=()=>{let b=e.reason;E({error:b instanceof r?b:new r("cancelled","Reason closed the desktop session.")})},m=()=>{if(!l||!i)return;let{outcome:b}=l,y=!("error"in b)?b.reason:b.error instanceof r?b.error.code:"display_unavailable";if(!l.told)try{i.send(c(y))}catch{}E(b)};if(A=t({get done(){return p||l!==null},get open(){return X&&!p&&l===null},get bufferedAmount(){return i?.bufferedAmount??0},send(b){if(p||l||!X||!i)return;try{i.send(b)}catch{E({reason:"relay_closed"})}},end:(b)=>{if(p||l)return;if(!("error"in b)&&C&&X){E(b);return}if(l={outcome:b,told:!("error"in b)&&X},C&&X)m()}}),p){A.close();return}if(e.aborted){h();return}e.addEventListener("abort",h,{once:!0}),M=setTimeout(()=>E({reason:"session_expired"}),Math.max(1,Date.parse(D.expires_at)-d())),q=setTimeout(()=>E({reason:"viewer_absent"}),s.viewerWaitMs??ke);try{i=(s.connect??Nr)(D.relay_url,(s.loadProxy??H)()?.url)}catch{O();return}i.binaryType="arraybuffer",i.onopen=()=>{if(p||!i)return;X=!0,A?.opened()},i.onmessage=(b)=>{if(p)return;let y=b.data,J=y instanceof ArrayBuffer?new Uint8Array(y):ArrayBuffer.isView(y)?new Uint8Array(y.buffer,y.byteOffset,y.byteLength):null;if(!J||J.byteLength===0)return;if(clearTimeout(q),C=!0,l){m();return}A?.received(J)},i.onclose=()=>{if(p)return;if(!X){O();return}E({reason:"relay_closed"})},i.onerror=()=>{if(p||X)return;O()}})}
+`),n=(p)=>s?p.replace("/tmp/ara-dock-","/tmp/ara-grok-dock-"):p,o=t?$e.replace(/^Exec=.*$/m,`Exec=${t}`).replace("Categories=System;FileManager;","Categories=Utility;Viewer;"):$e,f=s?"ara-grok-wallpaper.jpg":"ara-wallpaper.jpg",i={"openbox/rc.xml":Ne(e.screen),"tint2/tint2rc":D(c),"picom/picom.conf":ge,...d.has("terminal")?{}:{"ara-terminal.desktop":D(n(Ce))},...d.has("files")?{}:{"ara-files.desktop":D(n(o))},"ara-chromium.desktop":D(n(Fe)).replace("chromium --no-sandbox %U",e.browserExec),"ara-set-root-wallpaper.py":Ge},X=[...N.slice(0,3),Oe,`[ ! -f "$ROOT/${f}" ] || set_wallpaper "$ROOT/${f}" "$ROOT/ara-set-root-wallpaper.py" || true`,'if alive tint2 && ! cmp -s "$ROOT/tint2/tint2rc" "$ROOT/tint2/applied"; then read -r pid _ <"$ROOT/tint2.pid"; kill -USR1 "$pid" 2>/dev/null || true; fi','cp "$ROOT/tint2/tint2rc" "$ROOT/tint2/applied" 2>/dev/null || true',...N.slice(3)];return{files:i,start:X}}var N=['ticks() { line=$(cat "/proc/$1/stat" 2>/dev/null) || return 1; rest=${line##*) }; case $rest in Z*|X*) return 1;; esac; printf "%s" "$rest" | cut -d " " -f20; }','alive() { [ -f "$ROOT/$1.pid" ] || return 1; read -r pid start <"$ROOT/$1.pid"; current=$(ticks "$pid") || return 1; [ "$current" = "$start" ] && kill -0 "$pid" 2>/dev/null; }','launch() { name=$1; shift; "$@" 9>&- >"$ROOT/$name.log" 2>&1 & pid=$!; start=$(ticks "$pid"); printf "%s %s\\n" "$pid" "$start" >"$ROOT/$name.pid"; }','if [ -f "$ROOT/tint2/tint2rc" ] && ! alive tint2 && command -v tint2 >/dev/null 2>&1; then launch tint2 tint2 -c "$ROOT/tint2/tint2rc"; fi','if [ -f "$ROOT/picom/picom.conf" ] && ! alive picom && command -v picom >/dev/null 2>&1; then launch picom picom --config "$ROOT/picom/picom.conf"; fi'];var ke=43200000,A=":99",_e=60000,P=15000,R={width:1280,height:800},we=/^[A-Za-z0-9._:-]{1,160}$/;function Me(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}var me=["video","viewer","viewer_same_network","viewer_network","look"];function ve(e,D=Date.now()){let s=["relay_url","session_id","expires_at"];if(!Me(e)||s.some((f)=>!(f in e))||Object.keys(e).some((f)=>!s.includes(f)&&!me.includes(f)))throw new r("invalid_display_request","Reason desktop request is malformed.");let d="video"in e?Oo(e.video):void 0,t="viewer"in e?qn(e.viewer):null,c="look"in e?Wn(e.look):null;if(d===null)throw new r("invalid_display_request","Reason desktop video request is invalid.");let n=null;try{n=typeof e.relay_url==="string"?new URL(e.relay_url):null}catch{}if(!n||n.protocol!=="wss:"&&n.protocol!=="ws:"||n.username||n.password)throw new r("invalid_display_request","Reason desktop relay URL is invalid.");if(typeof e.session_id!=="string"||!we.test(e.session_id))throw new r("invalid_display_request","Reason desktop session identity is invalid.");let o=typeof e.expires_at==="string"?Date.parse(e.expires_at):Number.NaN;if(!Number.isFinite(o)||o<=D)throw new r("invalid_display_request","Reason desktop session has already expired.");return{relay_url:e.relay_url,session_id:e.session_id,expires_at:new Date(Math.min(o,D+ke)).toISOString(),...d?{video:d}:{},...t?{viewer:t}:{},...d&&e.viewer_same_network===!0?{viewer_same_network:!0}:{},...c?{look:c}:{}}}function Ft(e=process.platform){return(e==="linux"||e==="darwin"||e==="win32")&&x()?.features.display===!0}async function Vs(){if(process.platform==="win32")return Ft()&&await Ur();if(process.platform!=="darwin")return Ft();return await Ur()}function G(e){Se(e,{recursive:!0,mode:448});let D=Qe(e);if(!D.isDirectory()||D.isSymbolicLink()||process.getuid&&D.uid!==process.getuid())throw new r("display_unavailable","Reason desktop state directory is not private.");Je(e,448)}function Ze(e,D){let s=(t)=>{let c=Buffer.alloc(2);return c.writeUInt16BE(t.length),Buffer.concat([c,t])},d=Buffer.from([255,255]);return Buffer.concat([d,s(Buffer.alloc(0)),s(Buffer.from(e)),s(Buffer.from("MIT-MAGIC-COOKIE-1")),s(D)])}function y(e,D,s=2000){return new Promise((d)=>{let t=Te(e),c="",n=(o)=>{t.destroy(),d(o)};t.setTimeout(s,()=>n(!1)),t.once("error",()=>n(!1)),t.once("close",()=>n(!1)),t.once("connect",()=>{if(!D)n(!0)}),t.on("data",(o)=>{if(c+=o.toString("latin1"),c.length>=4)n(c.startsWith("RFB "))})})}async function Q(e,D){let s=Date.now()+D;while(Date.now()<s){if(await e())return!0;await new Promise((d)=>setTimeout(d,100))}return!1}function g(e,D,s){return new Promise((d)=>{let t=ne(e,D,{detached:!0,stdio:"ignore",env:s});t.once("error",()=>d(-1)),t.once("exit",(c)=>d(c)),t.unref(),setTimeout(()=>d(null),P).unref()})}var J=null;function qe(e=a()){return J??=Ve(e).finally(()=>{J=null}),J}async function Ve(e){let D=x({home:e});if(!D?.xvfb||!D.x11vnc||!D.openbox)throw new r("display_unavailable","Run `reason desktop install` on this machine to enable its desktop.");Pt({root:D.root,automation:D.automation,extensionDir:D.extensionDir});let s=I(D.root,"display");G(s);let d=await We(e,s,D.x11vnc);if(d)return d;let t={display:A,xauthority:I(s,"Xauthority"),rfbSocket:I(s,"rfb.sock")},c=I(s,"pulse"),n=(async()=>{try{G(c)}catch{return null}return await bo(c,D.pulseaudio)})();G(I(s,"home"));let o=S(s,t,D.pulseaudio),f=async()=>({...t,sound:await n});if(await y({path:t.rfbSocket},!0))return be(I(s,"theme"),N,o),await f();if(!ae(t.xauthority))u(t.xauthority,Ze(A.slice(1),he(16)),{mode:384,flag:"wx"});let i=T(I(s,"theme"),t.display,R,e),X={path:`/tmp/.X11-unix/X${A.slice(1)}`};if(!await y(X,!1)){let p=`${R.width}x${R.height}`;if(D.xvnc)ie(t.rfbSocket,{force:!0}),g(D.xvnc,[t.display,"-geometry",p,"-depth","24","-nolisten","tcp","-auth",t.xauthority,"-rfbport","-1","-rfbunixpath",t.rfbSocket,"-SecurityTypes","None","-UseBlacklist=0","-AlwaysShared","-desktop","Reason"],o);else g(D.xvfb,[t.display,"-screen","0",`${p}x24`,"-nolisten","tcp","-auth",t.xauthority],o);if(!await Q(()=>y(X,!1),P)||D.xvnc&&!await Q(()=>y({path:t.rfbSocket},!0),P))throw new r("display_unavailable","Reason could not start the virtual display.");g(D.openbox,["--config-file",i.openboxConfig],o)}if(await k(i,o),!await fe(D.x11vnc,t,s,"x11vnc.log",o))throw new r("display_unavailable","Reason could not start the desktop server.");return await f()}function S(e,D,s){let d={HOME:I(e,"home"),PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:D.display,XAUTHORITY:D.xauthority};if(s)d.PULSE_SERVER=Xe(Bn(I(e,"pulse")));return d}async function fe(e,D,s,d,t){if(await y({path:D.rfbSocket},!0))return!0;ie(D.rfbSocket,{force:!0});let c=await g(e,["-display",D.display,"-auth",D.xauthority,"-rfbport","0","-rfbportv6","-1","-unixsock",D.rfbSocket,"-nopw","-forever","-shared","-noxdamage","-sb","0","-rfbversion","3.7","-quiet","-bg","-o",I(s,d)],t);if(c!==null&&c!==0)return!1;return await Q(()=>y({path:D.rfbSocket},!0),P)}async function ze(){let e=["DISPLAY","XAUTHORITY","WAYLAND_DISPLAY","XDG_SESSION_TYPE"],D=(s)=>Object.fromEntries(e.flatMap((d)=>s[d]?[[d,s[d]]]:[]));if(process.env.DISPLAY)return D(process.env);try{let s=await new Promise((d,t)=>ce("systemctl",["--user","show-environment"],{encoding:"utf8",timeout:2000},(c,n)=>c?t(c):d(n)));return D(Object.fromEntries(s.split(`
+`).flatMap((d)=>{let t=d.indexOf("=");return t>0?[[d.slice(0,t),d.slice(t+1)]]:[]})))}catch{return{}}}var se=new Set;async function We(e,D,s){let d=await ze(),t=/^:(\d+)(?:\.\d+)?$/.exec(d.DISPLAY??"")?.[1];if(!t||`:${t}`===A||d.WAYLAND_DISPLAY||d.XDG_SESSION_TYPE==="wayland")return null;let c={display:`:${t}`,xauthority:d.XAUTHORITY??I(e,".Xauthority"),rfbSocket:I(D,`rfb-${t}.sock`)},n=`${c.display} ${c.xauthority}`;if(se.has(n)||!await y({path:`/tmp/.X11-unix/X${t}`},!1))return null;let o={HOME:e,PATH:"/usr/local/bin:/usr/bin:/bin",DISPLAY:c.display,XAUTHORITY:c.xauthority};if(await fe(s,c,D,`x11vnc-${t}.log`,o))return{...c,sound:null};return se.add(n),process.stderr.write(`Reason worker: your screen ${c.display} could not be served; using the virtual desktop
+`),null}var Ie="look";function pe(e){try{return Wn(oe(I(e,Ie),"utf8").trim())??"reason"}catch{return"reason"}}function T(e,D,s,d,t=pe(e)){let c=`chromium --no-first-run --no-default-browser-check${process.geteuid?.()===0?" --no-sandbox":""} %U`,n=[["terminal","xterm"],["files","pcmanfm"]].filter(([,i])=>!ae(`/usr/bin/${i}`)).map(([i])=>i),o=`${c.replace(/ %U$/,"")} --app=file://${I(d,".reason","workspace")}/`,f=de({root:e,display:D,screen:s,browserExec:c,absent:n,look:t,filesViewerExec:o});for(let i of["","openbox","tint2","picom"])G(I(e,i));u(I(e,Ie),`${t}
+`,{mode:384});for(let[i,X]of Object.entries(f.files))u(I(e,i),X,{mode:384});for(let[i,X]of Object.entries(te))u(I(e,`ara-${i}`),oe(X),{mode:384});return{root:e,openboxConfig:I(e,"openbox","rc.xml"),start:f.start}}function k(e,D){return be(e.root,[...e.start,"openbox --reconfigure >/dev/null 2>&1 || true"],D)}function be(e,D,s){let d=[`ROOT=${JSON.stringify(e)}`,...D].join(`
+`);return new Promise((t)=>{let c=ne("/bin/sh",["-c",d],{stdio:"ignore",env:{...s,PATH:"/usr/bin:/bin"}}),n=setTimeout(()=>{c.kill(),t()},P);c.once("error",()=>{clearTimeout(n),t()}),c.once("exit",()=>{clearTimeout(n),t()})})}var je=2073600,Ue=320;function er(e,D){let s=Math.min(1,Math.sqrt(je/(e.width*e.height))),d=(t,c)=>Math.min(Math.floor(c/8)*8,Math.max(Ue,Math.round(t*s/8)*8));return{width:d(e.width,D.width),height:d(e.height,D.height)}}function _(e,D,s){return new Promise((d)=>ce(e,D,{env:s,encoding:"utf8",timeout:5000},(t,c)=>d(t?null:c)))}function le(e){let D=/current (\d+) x (\d+), maximum (\d+) x (\d+)/.exec(e),s=e.split(`
+`),d=s.findIndex((c)=>/^\S+ connected/.test(c));if(!D||d<0)return null;let t=[];for(let c of s.slice(d+1)){let n=/^\s+(\d+x\d+)\s/.exec(c);if(!n)break;t.push(n[1])}return{current:{width:Number(D[1]),height:Number(D[2])},maximum:{width:Number(D[3]),height:Number(D[4])},output:s[d].split(" ")[0],modes:t}}async function rr(e,D,s){if(e.display!==A)return null;let d={PATH:"/usr/bin:/bin",DISPLAY:e.display,XAUTHORITY:e.xauthority},t=(f)=>_("xrandr",f,d),c=le(await t(["--query"])??"");if(!c||c.maximum.width<=c.current.width&&c.maximum.height<=c.current.height)return null;let n=er(D,c.maximum);if(n.width===c.current.width&&n.height===c.current.height)return{size:n,changed:!1};let o=`${n.width}x${n.height}`;if(!c.modes.includes(o)){if(await t(["--newmode",o,"60",...[n.width,n.width,n.width,n.width,n.height,n.height,n.height,n.height].map(String)]),await t(["--addmode",c.output,o])===null)return null}return s(),await t(["--output",c.output,"--mode",o])===null?null:{size:n,changed:!0}}async function Dr(e,D){let s=a(),d=x({home:s});if(!d)return;let t=I(d.root,"display"),c=S(t,e,d.pulseaudio);await k(T(I(t,"theme"),e.display,D,s),c);let n=D.width-B*2,o=D.height-B-Y;await _("xdotool",["search","--onlyvisible","--class","Chromium","windowsize","%@",String(n),String(o),"windowmove","%@",String(B),String(B)],{...c,PATH:"/usr/bin:/bin"})}var K=Promise.resolve();function $r(e,D,s=()=>{}){let d=K.then(()=>rr(e,D,s));return K=d.then((t)=>t?.changed?Dr(e,t.size):void 0).catch(()=>{}),d.then((t)=>t?.size??null,()=>null)}function tr(e,D){if(e.display!==A)return Promise.resolve();let s=K.then(async()=>{let d=a(),t=x({home:d});if(!t)return;let c=I(t.root,"display"),n=I(c,"theme");if(pe(n)===D)return;let o=S(c,e,t.pulseaudio),f=le(await _("xrandr",["--query"],{PATH:"/usr/bin:/bin",DISPLAY:e.display,XAUTHORITY:e.xauthority})??"");await k(T(n,e.display,f?.current??R,d,D),o)});return K=s.catch(()=>{}),s.catch(()=>{})}async function jt(e,D={}){let s=D.now??Date.now,d=ve(e.payload,s());if(e.signal.throwIfAborted(),!d.video)throw new r("display_video_required","Reason desktops stream as video now; this request came without it.");let t=D.platform??process.platform;if(t!=="linux"&&t!=="darwin"&&t!=="win32")throw new r("display_video_unsupported","This machine does not serve desktop video.");let{video:c,look:n}=d,o=(D.video?.desktop??(t==="darwin"?async()=>Fn:t==="win32"?async()=>jn:async()=>{let f=await qe();if(n)await tr(f,n);return f}))();return await dr(e.signal,d,D,s,(f)=>Hn(f,{request:c,desktop:o,...d.viewer?{viewer:d.viewer}:{},viewerSameNetwork:d.viewer_same_network===!0},{resizeDesktop:$r,...D.video}),(f)=>Qt({type:"error",code:f}))}function dr(e,D,s,d,t,c){let n=d();return new Promise((o,f)=>{let i=null,X=!1,p=!1,w,F,L,q=!1,l=null,E=(b)=>{if(p)return;if(l)b=l.outcome;p=!0,clearTimeout(w),clearTimeout(F),e.removeEventListener("abort",O),L?.close();try{i?.close(1000,"display_session_over")}catch{}if("error"in b){f(b.error);return}o({reason:b.reason,...L?.summary(),duration_ms:Math.max(0,d()-n)})},C=()=>E({error:new r("display_relay_unavailable","Reason could not reach the desktop relay.")}),O=()=>{let b=e.reason;E({error:b instanceof r?b:new r("cancelled","Reason closed the desktop session.")})},M=()=>{if(!l||!i)return;let{outcome:b}=l,H=!("error"in b)?b.reason:b.error instanceof r?b.error.code:"display_unavailable";if(!l.told)try{i.send(c(H))}catch{}E(b)};if(L=t({get done(){return p||l!==null},get open(){return X&&!p&&l===null},get bufferedAmount(){return i?.bufferedAmount??0},send(b){if(p||l||!X||!i)return;try{i.send(b)}catch{E({reason:"relay_closed"})}},end:(b)=>{if(p||l)return;if(!("error"in b)&&q&&X){E(b);return}if(l={outcome:b,told:!("error"in b)&&X},q&&X)M()}}),p){L.close();return}if(e.aborted){O();return}e.addEventListener("abort",O,{once:!0}),w=setTimeout(()=>E({reason:"session_expired"}),Math.max(1,Date.parse(D.expires_at)-d())),F=setTimeout(()=>E({reason:"viewer_absent"}),s.viewerWaitMs??_e);try{i=(s.connect??Ir)(D.relay_url,(s.loadProxy??j)()?.url)}catch{C();return}i.binaryType="arraybuffer",i.onopen=()=>{if(p||!i)return;X=!0,L?.opened()},i.onmessage=(b)=>{if(p)return;let H=b.data,h=H instanceof ArrayBuffer?new Uint8Array(H):ArrayBuffer.isView(H)?new Uint8Array(H.buffer,H.byteOffset,H.byteLength):null;if(!h||h.byteLength===0)return;if(clearTimeout(F),q=!0,l){M();return}L?.received(h)},i.onclose=()=>{if(p)return;if(!X){C();return}E({reason:"relay_closed"})},i.onerror=()=>{if(p||X)return;C()}})}
 export{Ft,Vs,G,qe,jt};

package/bin/vm-hands/{vm-hands-entry-lite-xrqztkhv.js → vm-hands-entry-lite-wghmyfba.js}

@@ -1,4 +1,4 @@
 // @bun
 import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{readFileSync as c}from"fs";import{isAbsolute as l,normalize as i}from"path";var m="REASON_WORKER_DESKTOP_USER",u=null;function p(t,o){for(let s of o.split(`
-`)){let e=s.split(":");if(e.length<7||Number(e[2])!==t||!/^\d+$/.test(e[2])||!/^\d+$/.test(e[3]))continue;let n=e[5];if(!/^[a-z_][a-z0-9_-]*$/i.test(e[0])||!l(n)||i(n)!==n||n==="/")return null;return{username:e[0],uid:t,gid:Number(e[3]),home:n}}return null}function Gs(t={}){let o="value"in t?t.value:process.env[m];if(u=null,o===void 0||o==="")return null;let s=t.platform??process.platform,e="euid"in t?t.euid:process.geteuid?.(),n=/^[1-9]\d{0,9}$/.test(o)?Number(o):NaN,r=s==="linux"&&e===0&&Number.isSafeInteger(n)?p(n,(t.passwd??(()=>c("/etc/passwd","utf8")))()):null;if(!r||r.gid===0)throw Error("worker_desktop_user_invalid");return u=r,r}function K(){return u}function Ln(){return u?.home??a()}
-export{Gs,K,Ln};
+`)){let e=s.split(":");if(e.length<7||Number(e[2])!==t||!/^\d+$/.test(e[2])||!/^\d+$/.test(e[3]))continue;let n=e[5];if(!/^[a-z_][a-z0-9_-]*$/i.test(e[0])||!l(n)||i(n)!==n||n==="/")return null;return{username:e[0],uid:t,gid:Number(e[3]),home:n}}return null}function Gs(t={}){let o="value"in t?t.value:process.env[m];if(u=null,o===void 0||o==="")return null;let s=t.platform??process.platform,e="euid"in t?t.euid:process.geteuid?.(),n=/^[1-9]\d{0,9}$/.test(o)?Number(o):NaN,r=s==="linux"&&e===0&&Number.isSafeInteger(n)?p(n,(t.passwd??(()=>c("/etc/passwd","utf8")))()):null;if(!r||r.gid===0)throw Error("worker_desktop_user_invalid");return u=r,r}function K(){return u}function zn(){return u?.home??a()}
+export{Gs,K,zn};

package/bin/vm-hands/{vm-hands-entry-lite-60m9dvde.js → vm-hands-entry-lite-x8wjxgwr.js}

@@ -1,2 +1,2 @@
 // @bun
-import{ot,D}from"./vm-hands-entry-lite-tthgxny0.js";import{R}from"./vm-hands-entry-lite-a3p6xz53.js";import{_,rr}from"./vm-hands-entry-lite-4anjdcth.js";import{be}from"./vm-hands-entry-lite-yretc2th.js";function zi(e,i){let t=R(e,"REASON_API_URL")?.trim();if(!t)return rr(i);let n=new URL(t);if(n.protocol!=="https:"&&!(n.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(n.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return n.origin}function es(e){return R(e,"REASON_API_URL")?.trim()?zi(e,"production"):void 0}function ts(e){return R(e,"REASON_API_KEY")?.trim()||void 0}async function As(e,i){let t=e.env??process.env,n=ts(t);if(!n)return(e.getCredentials??ot)({apiOrigin:es(t),signal:i});let a=zi(t,e.channel??_({env:t})),o=await(e.fetchImpl??fetch)(a+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+n,accept:"application/json"},signal:i}),p=await o.json().catch(()=>({})),r=be(p)?p:{};if(!o.ok){let s=typeof r.detail==="string"?r.detail:typeof r.message==="string"?r.message:"API key authentication failed ("+o.status+")";throw new D(o.status,typeof r.error==="string"?r.error:"api_key_auth_failed",s)}if(typeof r.org_id!=="string"||!r.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let l=Array.isArray(r.scopes)?r.scopes.filter((s)=>typeof s==="string"):[];return{credentialKind:"api_key",apiOrigin:a,accessToken:n,orgId:r.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:l}}export{zi,es,ts,As};
+import{ot,D}from"./vm-hands-entry-lite-3mn5c8wd.js";import{R}from"./vm-hands-entry-lite-a3p6xz53.js";import{_,rr}from"./vm-hands-entry-lite-4anjdcth.js";import{be}from"./vm-hands-entry-lite-yretc2th.js";function zi(e,i){let t=R(e,"REASON_API_URL")?.trim();if(!t)return rr(i);let n=new URL(t);if(n.protocol!=="https:"&&!(n.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(n.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return n.origin}function es(e){return R(e,"REASON_API_URL")?.trim()?zi(e,"production"):void 0}function ts(e){return R(e,"REASON_API_KEY")?.trim()||void 0}async function As(e,i){let t=e.env??process.env,n=ts(t);if(!n)return(e.getCredentials??ot)({apiOrigin:es(t),signal:i});let a=zi(t,e.channel??_({env:t})),o=await(e.fetchImpl??fetch)(a+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+n,accept:"application/json"},signal:i}),p=await o.json().catch(()=>({})),r=be(p)?p:{};if(!o.ok){let s=typeof r.detail==="string"?r.detail:typeof r.message==="string"?r.message:"API key authentication failed ("+o.status+")";throw new D(o.status,typeof r.error==="string"?r.error:"api_key_auth_failed",s)}if(typeof r.org_id!=="string"||!r.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let l=Array.isArray(r.scopes)?r.scopes.filter((s)=>typeof s==="string"):[];return{credentialKind:"api_key",apiOrigin:a,accessToken:n,orgId:r.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:l}}export{zi,es,ts,As};

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,4 +1,4 @@
 // @bun
 import{ii,vt,si,ai,ci,Ii}from"./vm-hands-entry-lite-07apxfh8.js";import"./vm-hands-entry-lite-fxzadxz4.js";import{createHash as K,randomBytes as ge}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Qe,openSync as Oe,renameSync as Ze,rmSync as en,statSync as De,writeSync as Me,constants as H}from"fs";import{join as re}from"path";var nn=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:tn(e)}}function tn(e){let n=e.payload[si];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var W=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),V=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function L(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(L).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${L(e[n])}`).join(",")}}`}async function qi(e){let n=await crypto.subtle.importKey("pkcs8",V(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=V(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),g=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),h=K("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:g,fingerprint:h}}var sn=16;class pn{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;abandoned=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let g=this.bound.get(e);if(!g)return!1;if(g.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((h)=>setTimeout(h,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:nn,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:W(this.keys.signingSpki),env_public_key:W(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:W(ge(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(L(n)));return{...n,device_signature:W(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=W(ge(32)),g=Ii({method:"GET",pathAndQuery:ii,timestamp:i,nonce:s,challenge:e,bodySha256:K("sha256").update("").digest("hex")}),h=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(g)));return{t:"hello",timestamp:i,nonce:s,signature:W(rn(h)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let s of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(s))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(K("sha256").update(L({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((s)=>s.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=sn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((s)=>s.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let s,g,h=new Promise((m,S)=>{s=m,g=S});return h.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:h,resolve:s,reject:g}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(w){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(w,"the bind's kill-verify failed")}let i,s=new Promise((w)=>{i=w}),g=!1,h=!1,m=()=>{h=!0,i()},S=n.promise.then(()=>new Promise((w,I)=>{this.exclusive(async()=>{if(h){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}g=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();w()}catch(b){I(b)}await s})}));S.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:S,inTurn:()=>g,leave:m})}finally{m()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);if(this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","abandoned before its launch");s=!0;let{launchId:g,applied:h,readyData:m}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),S=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let w=null,I=null;if(e.env){let b=e.claim?.owner??{},R=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof b.device_id==="string"?b.device_id:"",rootId:e.claim?.root_id??""});w=this.hooks.installEnvironment(e.bind_id,R),I=typeof R.snapshot_id==="string"&&R.snapshot_id?R.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,R)}if(this.unbinding.has(e.bind_id)||this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:g,envInstalled:w!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:g,snapshot_revision:w,snapshot_id:I,layout:S,...m?{ready_data:m}:{},policy_digest:K("sha256").update(L({hands_confinement:h.hands_confinement??null,browser_egress:h.browser_egress??null})).digest("hex")}}catch(g){if(i)fe(i);if(s){let h=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(h);else await h()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(g,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}abandonBinding(e){if(!this.binding.has(e))return;this.abandoned.add(e),this.abandonWorkspaceGrant(e);try{this.hooks.abortExecutor?.(e)}catch{}}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),g=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${g}`,s),{snapshot_id:e.snapshotId,installed_revision:g,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:K("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(g){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw g}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",V(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),g=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),h=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(e.iv),additionalData:new TextEncoder().encode(n)},g,V(e.ct)).catch(i),m=JSON.parse(new TextDecoder().decode(h));if(!m||typeof m!=="object"||Array.isArray(m))throw new l("vm_hands_env_invalid","env not an object");return m}writeJobEnvRootOnly(e,n){let i=re(this.options.envRoot,`bind-${e}`);Qe(i,{mode:448});let s=De(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let g=n.variables&&typeof n.variables==="object"?n.variables:{},h=Object.entries(g).filter(([w,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(w)&&typeof I==="string").map(([w,I])=>`export ${w}='${String(I).replaceAll("'","'\\''")}'`).join(`
 `)+`
-`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),vn=3,wn=20000,bn=250,yn=2000;function je(e){let n=Math.min(bn*2**(e-1),yn);return Math.round(n/2+Math.random()*n/2)}var kn=5000;function Sn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var In=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Pn(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function En(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function Tn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Rn=1e4,An=1000;async function Wi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await xn(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<vn&&Date.now()-n<wn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function xn(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,An));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Rn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=In){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await En(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+kn,q=1,M=await f("hands.ready",se);while(Sn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===ai){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===vt)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?Tn(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(ci,{code:o}).catch(()=>{return}),Pn(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as Dn}from"fs";var On=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Mn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-rzjt088n.js");await h();return}z("parsed",{t0:Math.round(On)});let e="";try{e=Dn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-prqtcafp.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Mn();export{qi,pn,Wi};
+`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),vn=3,wn=20000,bn=250,yn=2000;function je(e){let n=Math.min(bn*2**(e-1),yn);return Math.round(n/2+Math.random()*n/2)}var kn=5000;function Sn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var In=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Pn(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function En(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function Tn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Rn=1e4,An=1000;async function Wi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await xn(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<vn&&Date.now()-n<wn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function xn(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,An));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Rn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=In){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await En(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+kn,q=1,M=await f("hands.ready",se);while(Sn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===ai){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===vt)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?Tn(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(ci,{code:o}).catch(()=>{return}),Pn(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as Dn}from"fs";var On=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Mn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-f2pye28r.js");await h();return}z("parsed",{t0:Math.round(On)});let e="";try{e=Dn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-7cwr0sys.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Mn();export{qi,pn,Wi};