@reason-machines/cli-linux-x64 0.2.554 → 0.2.556

package/bin/vm-hands/{vm-hands-entry-lite-1pp7czc0.js → vm-hands-entry-lite-g10p22dj.js}

@@ -1,5 +1,5 @@
 // @bun
-import{nt,Et,cr,on,xt,kt,Di,sn,Oi,Ni,Li}from"./vm-hands-entry-lite-fxzadxz4.js";import{Pe,sr,ni,wt,Go,oe,Ko,Jo,tt,Re,nn,oi,vt,li,ui,di,pi,hi,fi,mi,gi,_i,yi,wi,bi,vi,pe,Z,Te,q,Si,Ei,xi,ki,Ci,Ai,Pi,Ri,St,Ti}from"./vm-hands-entry-lite-07apxfh8.js";import{ue,X,I,N}from"./vm-hands-entry-lite-48rphbjm.js";import{P,Vt}from"./vm-hands-entry-lite-n7bd44rm.js";import{mr,eo,to,at,ro,no,io,oo,so,ao,yr,wr,br,wn,bn,vr,lo,vn,Sr,me,ge,Ot,Er,kr,Nt}from"./vm-hands-entry-lite-drggrrr8.js";import{O,T,b}from"./vm-hands-entry-lite-1yv5qqew.js";import{Xi,Yi,_n,Zi,yn,Qi,st,fr}from"./vm-hands-entry-lite-g8md08wv.js";import{K}from"./vm-hands-entry-lite-wghmyfba.js";import{Ue}from"./vm-hands-entry-lite-gje7xvy9.js";import{j}from"./vm-hands-entry-lite-dgfx0rbn.js";import{hr,gn,Ji}from"./vm-hands-entry-lite-ak0hd94p.js";import{xo,ko,ht,Co,Ao,Po,Ro,To,Io,Do}from"./vm-hands-entry-lite-2v4zh9ze.js";import{Rr,Ht,Tr,Tn,In}from"./vm-hands-entry-lite-0wsr8edk.js";import{Ft,qe,jt}from"./vm-hands-entry-lite-sqzryt00.js";import{Un,x,vo}from"./vm-hands-entry-lite-8mttvhef.js";import{So,Eo}from"./vm-hands-entry-lite-h78c4zxd.js";import{Bt,Pn,Rn}from"./vm-hands-entry-lite-jha299pc.js";import{ye,ho,fo}from"./vm-hands-entry-lite-bpamn7ny.js";import{be}from"./vm-hands-entry-lite-yretc2th.js";import{Mt}from"./vm-hands-entry-lite-yptpy066.js";import{Ee,Xt,Yt,Zt,E}from"./vm-hands-entry-lite-46pwqvpf.js";import{a,ie}from"./vm-hands-entry-lite-8dfw96ym.js";import{t,k,o,d,u,n,W,g,ee,s,i,Zo}from"./vm-hands-entry-lite-wzv13c8k.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{fe,Ne,Le,$e,ln}from"./vm-hands-entry-lite-tyem93c1.js";import{Me}from"./vm-hands-entry-lite-3gbf905c.js";import{request as Fl}from"http";import{request as Ul}from"https";import{lookup as Hl}from"dns/promises";import{isIP as jl}from"net";async function ql(e){let l=new URL(e.url);return await new Promise((c,p)=>{let m=(l.protocol==="https:"?Ul:Fl)(l,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:Di},(f)=>c({response:f,close:()=>{f.destroy(),m.destroy(),f.socket?.destroy()}}));m.once("error",p),m.once("timeout",()=>m.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),m.end(e.body)})}var es=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),Wl=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function ts(e,l=0){if(!e||typeof e!=="object"||l>3)return null;let c=e.code;if(typeof c==="string"){if(es.has(c))return"custom_endpoint_host_not_found";if(Wl.has(c))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(c))return"custom_endpoint_tls_failed"}for(let p of[...e instanceof AggregateError?e.errors:[],e.cause]){let m=ts(p,l+1);if(m)return m}return null}async function Vl(e,l){let c=ts(e),p=new URL(l).hostname.replace(/^\[|\]$/g,"");if(c!==null&&c!=="custom_endpoint_connection_failed"||jl(p)!==0)return c;let m;return await Promise.race([Hl(p).then(()=>!0,(h)=>!es.has(String(h?.code))),new Promise((h)=>{m=setTimeout(()=>h(!0),5000)})]).finally(()=>clearTimeout(m))?c:"custom_endpoint_host_not_found"}function zl(e){for(let l=42;;l++){if(l===127)l=256;let c=String.fromCodePoint(l);if(!e.includes(c))return c}}function Gl(e,l){let c=Buffer.from(e),p=Buffer.from(l),m=new Uint32Array(c.length);for(let h=1,y=0;h<c.length;h++){while(y&&c[h]!==c[y])y=m[y-1];if(c[h]===c[y])y++;m[h]=y}let f=0;return(h,y=!1)=>{let S=Buffer.allocUnsafe(h.length*p.length+f),w=0;for(let _ of h){while(f&&c[f]!==_){let v=m[f-1];w+=c.copy(S,w,0,f-v),f=v}if(c[f]===_){if(f++,f===c.length)w+=p.copy(S,w),f=0}else S[w++]=_}if(y)w+=c.copy(S,w,0,f),f=0;return S.subarray(0,w)}}async function rs(e){e.signal.throwIfAborted();let l=Oi.safeParse(e.payload);if(!l.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let c=l.data,p=Ni.parse(await e.credential(e.signal));if(!sn(c,{baseUrl:c.baseUrl,api:p.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let m,f,h=0,y=0,S=0,w=zl(p.apiKey),_=Gl(p.apiKey,w),v=async(C,A)=>{e.signal.throwIfAborted(),await new Promise((F,L)=>{let M=()=>{e.signal.removeEventListener("abort",M),L(e.signal.reason)};if(e.signal.addEventListener("abort",M,{once:!0}),e.signal.aborted){M();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(C,A))).then(()=>{e.signal.removeEventListener("abort",M),F()},(B)=>{e.signal.removeEventListener("abort",M),L(B)})})},R=async(C)=>{if(h+=C.length,h>cr)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let A=0;A<C.length;A+=Et){if(S>=on)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await v(`custom_endpoint.chunk.${S++}`,{eof:!1,data:C.subarray(A,A+Et).toString("base64")})}};try{let C=await ql({url:c.url,body:c.body,signal:e.signal,headers:{...c.headers,...p.api==="anthropic-messages"?{"x-api-key":p.apiKey}:{authorization:`Bearer ${p.apiKey}`}}});m=C.response,f=C.close;let A=m.statusCode??500;if(A>=300&&A<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(m.headers["content-encoding"]&&m.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let F={};for(let L of["content-type","retry-after","x-request-id","request-id"]){let M=m.headers[L];if(typeof M==="string")F[L]=M.replaceAll(p.apiKey,w).slice(0,4096)}await v("custom_endpoint.headers",{status:A,statusText:(m.statusMessage??"").replaceAll(p.apiKey,w).slice(0,256),headers:F});for await(let L of m){e.signal.throwIfAborted();let M=Buffer.isBuffer(L)?L:Buffer.from(L);if(y+=M.length,y>cr)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await R(_(M))}return await R(_(Buffer.alloc(0),!0)),await v(`custom_endpoint.chunk.${S}`,{eof:!0}),{bytes:h,chunks:S}}catch(C){if(e.signal.throwIfAborted(),C instanceof r)throw C;throw new r((m?null:await Vl(C,c.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{f?.()}}import{join as ls}from"path";function Yl(e,l){return e===ls(l,".ara","workspace")||e===ls(l,".reason","workspace")}function cs(e,l){let c=e.filter((p)=>Yl(p.path,l));return c.length===1?c[0].path:null}var Kl=/^[a-f0-9]{64}$/;var cn=32,Xl=/^\/[^\x00-\x1f\x7f\\]*$/;function Or(e){if(typeof e!=="string"||e.length>4096||!Xl.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((l)=>l!==""&&l!=="."&&l!=="..")}function Ir(e,l){let c=l==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!c)return e;let p=c[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${c[1].toUpperCase()}:${p?`/${p}`:""}`}function un(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let l=e;if(!Or(l.home)||!Array.isArray(l.roots)||l.roots.length>cn)return;let c=[];for(let p of l.roots){if(!p||typeof p!=="object"||Array.isArray(p))return;let{path_fingerprint:m,path:f}=p;if(typeof m!=="string"||!Kl.test(m)||!Or(f))return;c.push({path_fingerprint:m,path:f})}return{home:l.home,roots:c}}function Jl(e){let l=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&l?l:void 0}function Zl(e){return Jl(e)??e.email.toLowerCase()}function dn(e){let l=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return l?Zl({name:l[1],email:l[2]}):e.trim().toLowerCase()}var zt=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(l)=>`[${l.toLowerCase()}${l.toUpperCase()}]`),Ql=[...Ee.map((e)=>`/(${e.map(zt).join("/")})(/|$)`),...Xt.map((e)=>`/(${e.map(zt).join("/")})(/|$)`),...[...Yt].map((e)=>`/(${zt(e)})$`),`/${zt(".env.")}[^/]*$`,...Zt.map((e)=>`/[^/]*${zt(e)}$`)],us=`function localGithubSandboxProfile(root, temporary) {
+import{nt,Et,cr,on,xt,kt,Di,sn,Oi,Ni,Li}from"./vm-hands-entry-lite-fxzadxz4.js";import{Pe,sr,ni,wt,Go,oe,Ko,Jo,tt,Re,nn,oi,vt,li,ui,di,pi,hi,fi,mi,gi,_i,yi,wi,bi,vi,pe,Z,Te,q,Si,Ei,xi,ki,Ci,Ai,Pi,Ri,St,Ti}from"./vm-hands-entry-lite-07apxfh8.js";import{ue,X,I,N}from"./vm-hands-entry-lite-48rphbjm.js";import{P,Vt}from"./vm-hands-entry-lite-n7bd44rm.js";import{mr,eo,to,at,ro,no,io,oo,so,ao,yr,wr,br,wn,bn,vr,lo,vn,Sr,me,ge,Ot,Er,kr,Nt}from"./vm-hands-entry-lite-kmtvmzzh.js";import{O,T,b}from"./vm-hands-entry-lite-1yv5qqew.js";import{Xi,Yi,_n,Zi,yn,Qi,st,fr}from"./vm-hands-entry-lite-cmxsq8m2.js";import{K}from"./vm-hands-entry-lite-wghmyfba.js";import{Ue}from"./vm-hands-entry-lite-gje7xvy9.js";import{j}from"./vm-hands-entry-lite-dgfx0rbn.js";import{hr,gn,Ji}from"./vm-hands-entry-lite-ak0hd94p.js";import{xo,ko,ht,Co,Ao,Po,Ro,To,Io,Do}from"./vm-hands-entry-lite-2v4zh9ze.js";import{Rr,Ht,Tr,Tn,In}from"./vm-hands-entry-lite-0wsr8edk.js";import{Ft,qe,jt}from"./vm-hands-entry-lite-vd834e5j.js";import{Un,x,vo}from"./vm-hands-entry-lite-2c1tjew8.js";import{So,Eo}from"./vm-hands-entry-lite-eb0kphva.js";import{Bt,Pn,Rn}from"./vm-hands-entry-lite-v5d57d52.js";import{ye,ho,fo}from"./vm-hands-entry-lite-bpamn7ny.js";import{be}from"./vm-hands-entry-lite-yretc2th.js";import{Mt}from"./vm-hands-entry-lite-yptpy066.js";import{Ee,Xt,Yt,Zt,E}from"./vm-hands-entry-lite-46pwqvpf.js";import{a,ie}from"./vm-hands-entry-lite-8dfw96ym.js";import{t,k,o,d,u,n,W,g,ee,s,i,Zo}from"./vm-hands-entry-lite-wzv13c8k.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{fe,Ne,Le,$e,ln}from"./vm-hands-entry-lite-tyem93c1.js";import{Me}from"./vm-hands-entry-lite-3gbf905c.js";import{request as Fl}from"http";import{request as Ul}from"https";import{lookup as Hl}from"dns/promises";import{isIP as jl}from"net";async function ql(e){let l=new URL(e.url);return await new Promise((c,p)=>{let m=(l.protocol==="https:"?Ul:Fl)(l,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:Di},(f)=>c({response:f,close:()=>{f.destroy(),m.destroy(),f.socket?.destroy()}}));m.once("error",p),m.once("timeout",()=>m.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),m.end(e.body)})}var es=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),Wl=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function ts(e,l=0){if(!e||typeof e!=="object"||l>3)return null;let c=e.code;if(typeof c==="string"){if(es.has(c))return"custom_endpoint_host_not_found";if(Wl.has(c))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(c))return"custom_endpoint_tls_failed"}for(let p of[...e instanceof AggregateError?e.errors:[],e.cause]){let m=ts(p,l+1);if(m)return m}return null}async function Vl(e,l){let c=ts(e),p=new URL(l).hostname.replace(/^\[|\]$/g,"");if(c!==null&&c!=="custom_endpoint_connection_failed"||jl(p)!==0)return c;let m;return await Promise.race([Hl(p).then(()=>!0,(h)=>!es.has(String(h?.code))),new Promise((h)=>{m=setTimeout(()=>h(!0),5000)})]).finally(()=>clearTimeout(m))?c:"custom_endpoint_host_not_found"}function zl(e){for(let l=42;;l++){if(l===127)l=256;let c=String.fromCodePoint(l);if(!e.includes(c))return c}}function Gl(e,l){let c=Buffer.from(e),p=Buffer.from(l),m=new Uint32Array(c.length);for(let h=1,y=0;h<c.length;h++){while(y&&c[h]!==c[y])y=m[y-1];if(c[h]===c[y])y++;m[h]=y}let f=0;return(h,y=!1)=>{let S=Buffer.allocUnsafe(h.length*p.length+f),w=0;for(let _ of h){while(f&&c[f]!==_){let v=m[f-1];w+=c.copy(S,w,0,f-v),f=v}if(c[f]===_){if(f++,f===c.length)w+=p.copy(S,w),f=0}else S[w++]=_}if(y)w+=c.copy(S,w,0,f),f=0;return S.subarray(0,w)}}async function rs(e){e.signal.throwIfAborted();let l=Oi.safeParse(e.payload);if(!l.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let c=l.data,p=Ni.parse(await e.credential(e.signal));if(!sn(c,{baseUrl:c.baseUrl,api:p.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let m,f,h=0,y=0,S=0,w=zl(p.apiKey),_=Gl(p.apiKey,w),v=async(C,A)=>{e.signal.throwIfAborted(),await new Promise((F,L)=>{let M=()=>{e.signal.removeEventListener("abort",M),L(e.signal.reason)};if(e.signal.addEventListener("abort",M,{once:!0}),e.signal.aborted){M();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(C,A))).then(()=>{e.signal.removeEventListener("abort",M),F()},(B)=>{e.signal.removeEventListener("abort",M),L(B)})})},R=async(C)=>{if(h+=C.length,h>cr)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let A=0;A<C.length;A+=Et){if(S>=on)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await v(`custom_endpoint.chunk.${S++}`,{eof:!1,data:C.subarray(A,A+Et).toString("base64")})}};try{let C=await ql({url:c.url,body:c.body,signal:e.signal,headers:{...c.headers,...p.api==="anthropic-messages"?{"x-api-key":p.apiKey}:{authorization:`Bearer ${p.apiKey}`}}});m=C.response,f=C.close;let A=m.statusCode??500;if(A>=300&&A<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(m.headers["content-encoding"]&&m.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let F={};for(let L of["content-type","retry-after","x-request-id","request-id"]){let M=m.headers[L];if(typeof M==="string")F[L]=M.replaceAll(p.apiKey,w).slice(0,4096)}await v("custom_endpoint.headers",{status:A,statusText:(m.statusMessage??"").replaceAll(p.apiKey,w).slice(0,256),headers:F});for await(let L of m){e.signal.throwIfAborted();let M=Buffer.isBuffer(L)?L:Buffer.from(L);if(y+=M.length,y>cr)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await R(_(M))}return await R(_(Buffer.alloc(0),!0)),await v(`custom_endpoint.chunk.${S}`,{eof:!0}),{bytes:h,chunks:S}}catch(C){if(e.signal.throwIfAborted(),C instanceof r)throw C;throw new r((m?null:await Vl(C,c.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{f?.()}}import{join as ls}from"path";function Yl(e,l){return e===ls(l,".ara","workspace")||e===ls(l,".reason","workspace")}function cs(e,l){let c=e.filter((p)=>Yl(p.path,l));return c.length===1?c[0].path:null}var Kl=/^[a-f0-9]{64}$/;var cn=32,Xl=/^\/[^\x00-\x1f\x7f\\]*$/;function Or(e){if(typeof e!=="string"||e.length>4096||!Xl.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((l)=>l!==""&&l!=="."&&l!=="..")}function Ir(e,l){let c=l==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!c)return e;let p=c[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${c[1].toUpperCase()}:${p?`/${p}`:""}`}function un(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let l=e;if(!Or(l.home)||!Array.isArray(l.roots)||l.roots.length>cn)return;let c=[];for(let p of l.roots){if(!p||typeof p!=="object"||Array.isArray(p))return;let{path_fingerprint:m,path:f}=p;if(typeof m!=="string"||!Kl.test(m)||!Or(f))return;c.push({path_fingerprint:m,path:f})}return{home:l.home,roots:c}}function Jl(e){let l=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&l?l:void 0}function Zl(e){return Jl(e)??e.email.toLowerCase()}function dn(e){let l=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return l?Zl({name:l[1],email:l[2]}):e.trim().toLowerCase()}var zt=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(l)=>`[${l.toLowerCase()}${l.toUpperCase()}]`),Ql=[...Ee.map((e)=>`/(${e.map(zt).join("/")})(/|$)`),...Xt.map((e)=>`/(${e.map(zt).join("/")})(/|$)`),...[...Yt].map((e)=>`/(${zt(e)})$`),`/${zt(".env.")}[^/]*$`,...Zt.map((e)=>`/[^/]*${zt(e)}$`)],us=`function localGithubSandboxProfile(root, temporary) {
   return ['(version 1)','(deny default)','(import "system.sb")','(allow process-exec process-fork)',
     '(allow file-read* (subpath "/bin") (subpath "/sbin") (subpath "/usr/bin") (subpath "/usr/sbin") (subpath "/usr/libexec") (subpath "/usr/share") (subpath "/private/var/select") (literal "/private/var/db/xcode_select_link"))',
     '(allow file-read-metadata (path-ancestors "/opt/homebrew/bin") (path-ancestors "/usr/local/bin") (path-ancestors "/Library/Developer/CommandLineTools"))',

package/bin/vm-hands/{vm-hands-entry-lite-drggrrr8.js → vm-hands-entry-lite-kmtvmzzh.js}

@@ -1,5 +1,5 @@
 // @bun
-import{qt,j}from"./vm-hands-entry-lite-dgfx0rbn.js";import{ue,Ce,X,Ae,de,ir,et,Y,I,N,rn}from"./vm-hands-entry-lite-48rphbjm.js";import{Uo,ri}from"./vm-hands-entry-lite-4anjdcth.js";import{go,P,Ve,ve,Ge,ne,Ke,Ln,Se,Kt,ae,H,L,ce,jr,Hr,Mn}from"./vm-hands-entry-lite-n7bd44rm.js";import{Pe,oe,pe,Z,Te,q,Q}from"./vm-hands-entry-lite-07apxfh8.js";import{Lt,Pr,lt,V,O,T,b,Cn}from"./vm-hands-entry-lite-1yv5qqew.js";import{Cr,Ar,xn,uo,Ue,kn}from"./vm-hands-entry-lite-gje7xvy9.js";import{K}from"./vm-hands-entry-lite-wghmyfba.js";import{ji}from"./vm-hands-entry-lite-qd46yhvz.js";import{p,ze,$t,ut,po,_e,we}from"./vm-hands-entry-lite-bpamn7ny.js";import{v,h,mo}from"./vm-hands-entry-lite-h1qjggz0.js";import{E}from"./vm-hands-entry-lite-46pwqvpf.js";import{tr}from"./vm-hands-entry-lite-pg2czhxb.js";import{a,zo,qo,ie,Vo}from"./vm-hands-entry-lite-8dfw96ym.js";import{M,$i,Mi,Yo,y,t,k,At,o,d,u,n,c,g,ee,s,i}from"./vm-hands-entry-lite-wzv13c8k.js";import{Fi}from"./vm-hands-entry-lite-pzj5s203.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{Qo,se,Ui,C,Oe,$e,A}from"./vm-hands-entry-lite-tyem93c1.js";var Oi=()=>{let e={string:{unit:"characters",verb:"to have"},file:{unit:"bytes",verb:"to have"},array:{unit:"items",verb:"to have"},set:{unit:"items",verb:"to have"},map:{unit:"entries",verb:"to have"}};function l(w){return e[w]??null}let f={regex:"input",email:"email address",url:"URL",emoji:"emoji",uuid:"UUID",uuidv4:"UUIDv4",uuidv6:"UUIDv6",nanoid:"nanoid",guid:"GUID",cuid:"cuid",cuid2:"cuid2",ulid:"ULID",xid:"XID",ksuid:"KSUID",datetime:"ISO datetime",date:"ISO date",time:"ISO time",duration:"ISO duration",ipv4:"IPv4 address",ipv6:"IPv6 address",mac:"MAC address",cidrv4:"IPv4 range",cidrv6:"IPv6 range",base64:"base64-encoded string",base64url:"base64url-encoded string",json_string:"JSON string",e164:"E.164 number",jwt:"JWT",template_literal:"input"},_={nan:"NaN"};return(w)=>{switch(w.code){case"invalid_type":{let S=_[w.expected]??w.expected,x=Yo(w.input),W=_[x]??x;return`Invalid input: expected ${S}, received ${W}`}case"invalid_value":if(w.values.length===1)return`Invalid input: expected ${Mi(w.values[0])}`;return`Invalid option: expected one of ${$i(w.values,"|")}`;case"too_big":{let S=w.inclusive?"<=":"<",x=l(w.origin);if(x)return`Too big: expected ${w.origin??"value"} to have ${S}${w.maximum.toString()} ${x.unit??"elements"}`;return`Too big: expected ${w.origin??"value"} to be ${S}${w.maximum.toString()}`}case"too_small":{let S=w.inclusive?">=":">",x=l(w.origin);if(x)return`Too small: expected ${w.origin} to have ${S}${w.minimum.toString()} ${x.unit}`;return`Too small: expected ${w.origin} to be ${S}${w.minimum.toString()}`}case"invalid_format":{let S=w;if(S.format==="starts_with")return`Invalid string: must start with "${S.prefix}"`;if(S.format==="ends_with")return`Invalid string: must end with "${S.suffix}"`;if(S.format==="includes")return`Invalid string: must include "${S.includes}"`;if(S.format==="regex")return`Invalid string: must match pattern ${S.pattern}`;return`Invalid ${f[S.format]??w.format}`}case"not_multiple_of":return`Invalid number: must be a multiple of ${w.divisor}`;case"unrecognized_keys":return`Unrecognized key${w.keys.length>1?"s":""}: ${$i(w.keys,", ")}`;case"invalid_key":return`Invalid key in ${w.origin}`;case"invalid_union":if(w.options&&Array.isArray(w.options)&&w.options.length>0)return`Invalid discriminator value. Expected ${w.options.map((x)=>`'${x}'`).join(" | ")}`;return"Invalid input";case"invalid_element":return`Invalid value in ${w.origin}`;default:return"Invalid input"}}};function gn(){return{localeError:Oi()}}M(gn());class mt extends Error{}function No(e){let l;try{l=new URL(e)}catch{throw new mt("The proxy must be a URL like https://proxy.example.com:3128.")}if(l.protocol!=="https:"&&l.protocol!=="http:")throw new mt("The proxy URL must use the https or http scheme.");if(!l.hostname)throw new mt("The proxy URL must name a host.");if(l.port!==""&&Number(l.port)<1)throw new mt("The proxy URL must use a port between 1 and 65535.");if(l.pathname!==""&&l.pathname!=="/"||l.search||l.hash)throw new mt("The proxy URL must not carry a path, query, or fragment.");return l.toString()}import{createHash as xi}from"crypto";import{isAbsolute as Bo,join as jo,relative as Mo,resolve as Yt,sep as Wo}from"path";var Vt=t().min(1).refine(Bo,"absolute path required"),Lo=c({version:i(1),apiOrigin:At(),channel:s(["staging","production"]),stateDirectory:Vt,workspaceRoot:Vt,lifetime:s(["persistent","ephemeral"]),executionMode:s(["confined","host"]).default("confined"),name:t().min(1).max(160).default("Reason headless worker"),slots:o().int().min(1).max(4).default(1),shutdownGraceMs:o().int().min(0).max(300000).default(30000),proxy:c({version:i(qt),url:t().refine((e)=>{try{return No(e)===e}catch{return!1}},"invalid proxy URL"),caFile:Vt.optional()}).optional(),userChrome:d().optional(),cloudSessions:i(!0).optional(),localLogins:d().optional(),folders:u(Vt).min(1).max(31).optional()}),Pi=/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/,F=g("channel",[Lo,Lo.extend({channel:i("local-qa"),apiOrigin:t()})]).superRefine((e,l)=>{if(e.channel==="local-qa"){if(!Pi.test(e.apiOrigin))l.addIssue({code:"custom",message:"local QA worker requires an exact HTTPS trycloudflare.com quick-tunnel origin"})}else{let _=new URL(e.apiOrigin);if(_.origin!==e.apiOrigin||_.username||_.password||_.protocol!=="https:"&&!(_.protocol==="http:"&&ri(_.origin))||!ri(_.origin)&&!Uo(e.channel,_.origin))l.addIssue({code:"custom",message:"API origin must match channel (or loopback)"})}if(!je(e.workspaceRoot,e.stateDirectory))l.addIssue({code:"custom",message:"state and workspace must be disjoint"});let f=e.folders??[];if(new Set([e.workspaceRoot,...f]).size!==f.length+1||f.some((_)=>!je(_,e.stateDirectory)))l.addIssue({code:"custom",message:"folders must be distinct and disjoint from state"})});function m(e){return jo(e.stateDirectory,`headless-${e.channel}`)}function je(e,l){if(zr(l,e))return!1;return!zr(e,l)||E(jo(Wo,Mo(Yt(e),Yt(l))))}function zr(e,l){let f=Mo(Yt(e),Yt(l));return f===""||f!==".."&&!f.startsWith(`..${Wo}`)&&!Bo(f)}function te(e){let{proxy:l,userChrome:f,cloudSessions:_,localLogins:w,folders:S,...x}=e;return xi("sha256").update(JSON.stringify(x)).digest("hex")}var Ii=4,Ai=[2375,2376,9222,9229];function mr(e){let l=new Set(Ai);for(let f of e){let _=new URL(f);l.add(Number(_.port||(["https:","wss:"].includes(_.protocol)?443:80)))}return l}function Jr(){throw new r("preview_unavailable","The live Hands preview binding is unavailable or stale.")}var Ti=60000;function Fo(e){let l=new AbortController,f=new Map,_=(R)=>JSON.stringify([R.jobId,R.port]);function w(R){let B=e.authority.owner;if(l.signal.aborted||!e.isCurrent()||e.expiresAtMs<=Date.now()||R.organization_id!==B.organization_id||R.user_id!==B.user_id||R.device_id!==B.device_id)Jr()}function S(R){let B;try{B=e.environment.current()}catch{return null}return B.binding.target_generation===R.generation&&B.binding.target_fence_id===R.fenceId&&B.run_id===e.runId&&B.device_id===e.authority.owner.device_id&&B.root_id===e.authority.rootId?B:null}async function x(R,B,G){let U=await W(R,B,G);if(U!=="moved")return U;let D=await W(R,B,G);return D==="moved"?null:D}async function W(R,B,G){try{w(e.authority.owner);let U=e.identity();if(!U||G.aborted||R.expiresAtMs<=Date.now()||R.expiresAtMs>e.expiresAtMs)return null;let D=B.opened,re=D!==void 0&&U.generation>D.generation,J=S(U);if(re){if(J){if(J.revision<=D.revision||R.expiresAtMs>Date.parse(J.expires_at)||J.binding.target_revision!==D.attachmentRevision||J.binding.root_grant_revision!==D.grantRevision)return null;B.recoveringSinceMs=void 0}else if(Date.now()-(B.recoveringSinceMs??=Date.now())>Ti)return null}else if(!J||R.expiresAtMs>Date.parse(J.expires_at)||D&&(U.generation!==D.generation||U.fenceId!==D.fenceId))return null;let z=await e.inspect(R.jobId,G),fe=e.identity(),ke=fe&&S(fe);w(e.authority.owner);let be=J&&{generation:U.generation,fenceId:U.fenceId,snapshotId:J.snapshot_id,revision:J.revision,attachmentRevision:J.binding.target_revision,grantRevision:J.binding.root_grant_revision},Re=re?D:be;if(G.aborted||!fe)return null;if(fe.generation!==U.generation||fe.fenceId!==U.fenceId||ke?.snapshot_id!==J?.snapshot_id||ke?.revision!==J?.revision)return"moved";let Fe=z.ok&&z.job.environmentSnapshotId!==void 0&&z.job.environmentRevision!==void 0?{snapshotId:z.job.environmentSnapshotId,revision:z.job.environmentRevision}:null;if(!z.ok||z.generation!==U.generation||!Re||!Fe)return null;if((Fe.snapshotId!==Re.snapshotId||Fe.revision!==Re.revision)&&(re||!e.environment.carried(Fe.snapshotId,Fe.revision)))return null;if(!D&&U.generation===R.generation&&U.fenceId===R.fenceId)B.opened={...Re,...Fe};return{executorLaunchId:e.executorLaunchId,job:z.job,binding:{organizationId:e.authority.owner.organization_id,userId:e.authority.owner.user_id,deviceId:e.authority.owner.device_id,rootId:e.authority.rootId,runId:e.runId,attachmentRevision:Re.attachmentRevision,grantRevision:Re.grantRevision,generation:Re.generation,fenceId:Re.fenceId,jobId:z.job.jobId,port:R.port,expiresAtMs:R.expiresAtMs}}}catch{return null}}return{async open(R,B,G){w(B);let{binding:U,deviceRelayUrl:D}=ut(R);if(G.aborted||U.expiresAtMs<=Date.now()||U.expiresAtMs>Date.now()+p.lifetimeMs||new URL(D).origin!==e.authority.relayOrigin)Jr();let re=_(U),J=f.get(re);if(J){if(!ze(J.binding,U)||J.relay!==D)Jr();if(await J.opened,!await $t(()=>J.port.check())||G.aborted||J.abort.signal.aborted)Jr();return{opened:!0,binding:U}}if(f.size>=Ii)Jr();let z=new AbortController,fe={},ke=we({binding:U,deniedPorts:e.authority.deniedPorts,readCurrentJob:()=>x(U,fe,z.signal)}),be=()=>z.abort();if(G.addEventListener("abort",be,{once:!0}),l.signal.addEventListener("abort",be,{once:!0}),G.aborted||l.signal.aborted)be();let Re=_e({binding:U,deviceRelayUrl:D,port:ke,signal:z.signal}),Fe={binding:U,relay:D,abort:z,port:ke,opened:Re};f.set(re,Fe);let Xe=()=>{if(G.removeEventListener("abort",be),l.signal.removeEventListener("abort",be),f.get(re)===Fe)f.delete(re)};try{if((await Re).closed.then(Xe),G.removeEventListener("abort",be),w(B),z.signal.aborted||!await $t(()=>ke.check()))Jr();return{opened:!0,binding:U}}catch{z.abort(),Xe(),Jr()}},async close(R,B){w(B);let{binding:G}=po(R),U=f.get(_(G));if(!U||!ze(U.binding,G))Jr();return U.abort.abort(),await U.opened.then((D)=>D.closed,()=>{return}),{closed:!0,binding:G}},dispose(){l.abort();for(let R of f.values())R.abort.abort();f.clear()}}}import{WebSocket as Rn}from"ws";var $o=(e)=>("data"in e)?e.data.length:e.bytes,Ko=2*Ke;function ar(e){throw new r(e,"The bound Hands terminal is unavailable or its outcome is unconfirmed.")}var ht=(e)=>!["starting","running"].includes(e.state);function eo(e,l,f=Date.now()){let _=["relay_url","session_id","expires_at","cols","rows","pty","workspace"];if(Object.keys(e).length!==_.length||Object.keys(e).some((B)=>!_.includes(B))||!ae(l)||!ae(e.session_id)||typeof e.expires_at!=="string"||typeof e.relay_url!=="string"||e.relay_url.length>4096||![e.cols,e.rows].every((B)=>Number.isSafeInteger(B)&&Number(B)>=1&&Number(B)<=Se))ar("invalid_pty_request");let w=e.pty;if(!w||typeof w!=="object"||Array.isArray(w))ar("invalid_pty_request");let S=w;if(Object.keys(S).length!==2||S.version!==1||!ce(S.jobId))ar("invalid_pty_request");let x;try{x=new URL(e.relay_url)}catch{return ar("invalid_pty_request")}if(!["ws:","wss:"].includes(x.protocol)||x.username||x.password||x.hash||x.protocol==="ws:"&&!["127.0.0.1","[::1]","localhost"].includes(x.hostname))ar("invalid_pty_request");let W=Date.parse(e.expires_at);if(!Number.isSafeInteger(W)||W<=f)ar("invalid_pty_request");return{workspace:N(e.workspace)??ar("invalid_pty_request"),session:{jobId:S.jobId,sessionId:e.session_id,operationId:l,relayUrl:x.href,cols:Number(e.cols),rows:Number(e.rows),leaseExpiresAtMs:Math.min(W,f+43200000)}}}async function Go(e){let{session:l,binding:f}=e;if(f.assertCurrent(),e.signal.aborted||Date.now()>=l.leaseExpiresAtMs)ar("cancelled");let _=new Rn(l.relayUrl,{followRedirects:!1,perMessageDeflate:!1,maxPayload:ne}),w=new AbortController,S=()=>{},x=()=>{w.abort(),S()};e.signal.addEventListener("abort",x,{once:!0});let W=setTimeout(x,Math.max(1,l.leaseExpiresAtMs-Date.now())),R=[],B=0,G=0,U=0,D=!1,re=!1,J=!1,z,fe,ke,be=(le)=>{ke=new r(le,"Bound terminal input was refused."),x()};_.on("error",()=>be("pty_relay_unavailable")),_.on("close",x),_.on("message",(le,he)=>{if(w.signal.aborted)return;if(!re){be("pty_not_ready");return}let xe=Array.isArray(le)?Buffer.concat(le):le instanceof ArrayBuffer?Buffer.from(le):le;if(xe.length===0)return;let Je=R.at(-1),Le=he&&Je!==void 0&&"data"in Je&&Je.data.length+xe.length<=ne;if(xe.length>ne||B+xe.length>Ln){be("pty_input_backpressure");return}if(Le)Je.data=Buffer.concat([Je.data,xe]);else if(he)R.push({data:Buffer.from(xe)});else try{let Be=JSON.parse(xe.toString("utf8"));if(Be&&Be.t==="close"&&Object.keys(Be).length===1){J=!0,x();return}if(!Be||Be.t!=="resize"||Object.keys(Be).length!==3||![Be.cols,Be.rows].every((Ee)=>Number.isSafeInteger(Ee)&&Ee>=1&&Ee<=Se))throw Error("invalid_control");R.push({cols:Be.cols,rows:Be.rows,bytes:xe.length})}catch{be("invalid_pty_control");return}B+=xe.length,S()});function Re(le){return Mn(JSON.stringify({...f.scope,version:1,sessionId:l.sessionId,operationId:l.operationId,job:{...le,output:[],pty:le.pty?{...le.pty,output:[]}:void 0}}))}function Fe(le){if(!le.ok)ar(le.error);let he=le.job;if(le.generation!==f.scope.generation||he.jobId!==l.jobId||!he.pty||he.leaseExpiresAtMs>l.leaseExpiresAtMs||he.process&&he.process.executorLaunchId!==f.scope.executorLaunchId||he.process&&fe&&(he.process.pid!==fe.pid||he.process.processGroupId!==fe.processGroupId)||he.state!=="starting"&&(he.environmentRevision!==f.environment.revision||he.environmentSnapshotId!==f.environment.snapshotId))ar("pty_binding_changed");if(Re(he),he.process)fe??={...he.process};return he}async function Xe(le){f.assertCurrent();let he=await f.request(le,w.signal);if(f.assertCurrent(),w.signal.aborted)ar("cancelled");let xe=Fe(he);if(xe.inputSequence!==G)ar("job_input_sequence");if(!ht(xe)&&xe.leaseExpiresAtMs<=Date.now())ar("pty_binding_changed");return xe}function ye(le){if(f.assertCurrent(),w.signal.aborted||_.readyState!==Rn.OPEN||_.bufferedAmount+Buffer.byteLength(le)>Ko)ar("pty_output_backpressure");_.send(le)}function We(le){if(le.firstCursor>U+1)U=le.firstCursor-1;for(let he of le.pty.output){if(he.cursor<=U)continue;if(he.cursor!==U+1)ar("pty_output_gap");let xe=Buffer.from(he.dataBase64,"base64");if(_.bufferedAmount+xe.length>Ko)return!1;ye(xe),U=he.cursor}if(U!==le.nextCursor)ar("pty_output_gap");return!0}async function Ye(le,he){let xe;try{await Promise.race([e.emit(le,he),new Promise((Je,Le)=>{xe=setTimeout(()=>Le(new r("pty_event_unavailable","Terminal metadata delivery timed out.")),2000)})])}finally{clearTimeout(xe)}}async function De(){let le=AbortSignal.timeout(Kt),he=f.request({jobId:l.jobId,action:"cancel",input:{}},le),xe,Je=new Promise((Le,Be)=>{if(xe=()=>Be(new r("pty_cleanup_unconfirmed","Terminal cleanup acknowledgement was not observed within authority.")),le.addEventListener("abort",xe,{once:!0}),le.aborted)xe()});try{let Le=await Promise.race([he,Je]);if(le.aborted)ar("pty_cleanup_unconfirmed");return Fe(Le)}finally{le.removeEventListener("abort",xe)}}try{await new Promise((Le,Be)=>{let Ee=setTimeout(()=>{x(),Be(new r("pty_relay_unavailable","Terminal pairing timed out."))},5000),Me=()=>{clearTimeout(Ee),Be(new r("cancelled","Terminal pairing was cancelled."))};if(w.signal.addEventListener("abort",Me,{once:!0}),_.once("open",()=>{clearTimeout(Ee),w.signal.removeEventListener("abort",Me),Le()}),w.signal.aborted)Me()}),f.assertCurrent(),D=!0,z=await Xe({jobId:l.jobId,action:"start",input:{mode:"pty",cols:l.cols,rows:l.rows,leaseExpiresAtMs:l.leaseExpiresAtMs}});let le=Date.now()+5000;while(z.state==="starting"){if(Date.now()>=le)ar("pty_not_ready");await new Promise((Le)=>setTimeout(Le,25)),z=await Xe({jobId:l.jobId,action:"inspect",input:{after:U}})}if(z.state!=="running"||z.inputSequence!==0||z.leaseExpiresAtMs<=Date.now())ar("pty_not_ready");await Ye("pty.ready",Re(z)),re=!0,ye(JSON.stringify({t:"open",cols:z.pty.cols,rows:z.pty.rows,receipt:Re(z)}));let he=!1,xe=0,Je=!1;while(!w.signal.aborted){let Le=z.firstCursor>U+1,Be=We(z);if(ht(z)){if(Be)break}else if(Le)he=!0;else if(he&&Be&&Date.now()>=xe){he=!1,xe=Date.now()+1000;let{cols:Me,rows:rr}=z.pty;for(let or of[{cols:Me,rows:rr>1?rr-1:2},{cols:Me,rows:rr}]){if(ht(z))break;let Rr=++G;if(z=await Xe({jobId:l.jobId,action:"resize",input:{sequence:Rr,...or}}),z.inputSequence!==Rr)ar("job_input_sequence")}continue}let Ee=ht(z)||Je?void 0:R.shift();if(Ee){B-=$o(Ee);let Me=++G;try{z=await Xe("data"in Ee?{jobId:l.jobId,action:"input",input:{sequence:Me,dataBase64:Ee.data.toString("base64")}}:{jobId:l.jobId,action:"resize",input:{sequence:Me,cols:Ee.cols,rows:Ee.rows}})}catch(rr){if(!(rr instanceof r)||rr.code!=="job_input_backpressure")throw rr;G-=1,R.unshift(Ee),B+=$o(Ee),Je=!0;continue}if(z.inputSequence!==Me)ar("job_input_sequence")}else if(await new Promise((Me)=>{let rr=setTimeout(Me,Je||!Be?10:50);if(S=()=>{clearTimeout(rr),Me()},w.signal.aborted||!Je&&R.length)S()}),Je=!1,S=()=>{},!w.signal.aborted&&Be)try{z=await Xe({jobId:l.jobId,action:"inspect",input:{after:U}})}catch(Me){if(!J||!(Me instanceof r)||Me.code!=="cancelled")throw Me}}}catch(le){ke??=le}finally{if(re=!1,R.length=0,clearTimeout(W),e.signal.removeEventListener("abort",x),x(),D&&(!z||!ht(z)))try{z=await De()}catch{z=void 0}try{if(!z||!ht(z)||z.pty?.cleanup!=="confirmed")ar("pty_cleanup_unconfirmed");let le=Re(z);if(_.readyState===Rn.OPEN)await new Promise((he)=>{let xe=setTimeout(he,500);_.send(JSON.stringify({t:"exit",code:z.exitCode,receipt:le}),()=>{clearTimeout(xe),he()})});await Ye("pty.stopped",le)}catch(le){ke??=le}_.terminate()}if(ke)throw ke;if(e.signal.aborted)ar("cancelled");if(!z)ar("pty_cleanup_unconfirmed");return{receipt:Re(z)}}import{createHash as Di,randomUUID as An}from"crypto";import{spawnSync as es}from"child_process";import{closeSync as Jo,constants as On,fstatSync as Ci,fsyncSync as Hi,lstatSync as Ht,mkdirSync as Ni,mkdtempSync as rs,openSync as Xo,readFileSync as Li,readdirSync as ts,realpathSync as qr,rmSync as Pn,unlinkSync as Bi}from"fs";import{createConnection as Wi}from"net";import{dirname as zi,join as ot,sep as In}from"path";import{tmpdir as ns}from"os";var hr=new Map,Vr=new Map;function $r(e,l){return Di("sha256").update(JSON.stringify([e,l])).digest("hex")}function gt(e){try{Ni(e,{mode:448})}catch(f){if(!(f instanceof Error&&("code"in f)&&f.code==="EEXIST"))throw f}let l=Ht(e);if(!l.isDirectory()||l.isSymbolicLink()||!A(l)||qr(e)!==e)throw new r("hands_jobs_unavailable","Hands job state must be a private canonical directory.")}function Ki(e){let l;try{l=Ht(e)}catch(f){if(f instanceof Error&&"code"in f&&f.code==="ENOENT")return!1;throw f}return!l.isDirectory()||l.isSymbolicLink()||ts(e).length>0}function Gi(e){if(process.platform==="win32")return Ui();let l=e.map((f)=>{try{return qr(f)}catch{return f}});for(let f of[()=>Ui(),()=>qr("/dev/shm"),()=>qr(ns())]){let _;try{_=f()}catch{continue}if(!l.some((w)=>_===w||_.startsWith(w.endsWith(In)?w:w+In)))return _}throw new r("invalid_hands_workspace","A Session can't work in this computer's temporary folder itself; start it in a project folder inside it.")}function gr(e){let l=$r(e.root,e.runId),f=e.previousRuntimeDirectories?.find((x)=>Ki(ot(x,"jobs",l.slice(0,16))))??e.runtimeDirectory;gt(f);let _=ot(f,"jobs");gt(_);let w=ot(_,l.slice(0,16));if(e.maxScopes!==void 0){let x=ts(_);if(!Number.isSafeInteger(e.maxScopes)||e.maxScopes<1||x.length>e.maxScopes||!x.includes(l.slice(0,16))&&x.length>=e.maxScopes)throw new r("process_journal_capacity","Managed process receipt capacity is full; preserve uncertain jobs and reconcile their existing receipts before starting more work.")}gt(w);let S=rs(ot(Gi(e.folders??[]),"reason-j-"));try{return gt(S),{journalDirectory:w,scopeId:l,launchDirectory:S,socketPath:process.platform==="win32"?`\\\\.\\pipe\\reason-jobs-${An()}`:ot(S,"control.sock"),disposeSocket:()=>Pn(S,{recursive:!0,force:!0})}}catch(x){throw Pn(S,{recursive:!0,force:!0}),x}}var Ji=60000,Vi=5000;function qi(e){if(process.platform==="win32")return Yi(e);let l=es("ps",["-o","lstart=","-p",String(e)],{encoding:"utf8",timeout:2000,env:{...process.env,LC_ALL:"C",LANG:"C"}}),f=l.status===0?/^\w{3} (\w{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(l.stdout.trim()):null,_=f?"JanFebMarAprMayJunJulAugSepOctNovDec".indexOf(f[1]):-1;if(!f||_<0||_%3!==0)return null;let w=new Date(Number(f[6]),_/3,Number(f[2]),Number(f[3]),Number(f[4]),Number(f[5])).getTime();return Number.isFinite(w)?w:null}function Yi(e){let l=es(C("powershell"),["-NoProfile","-NonInteractive","-Command",`(Get-Process -Id ${e}).StartTime.ToUniversalTime().ToString('o')`],{encoding:"utf8",timeout:5000,windowsHide:!0,env:Oe()}),f=l.status===0?Date.parse(l.stdout.trim()):Number.NaN;return Number.isFinite(f)?f:null}function os(e,l={}){let f=ot(e.journalDirectory,"owner.lock"),_;try{_=Xo(f,On.O_RDONLY|On.O_NOFOLLOW)}catch{return null}try{let w=Ci(_);if(!w.isFile()||w.nlink!==1||!A(w)||w.size>4096)return null;let S=null;try{S=JSON.parse(Li(_,"utf8"))}catch{}let x;if(S===null){if((l.now??Date.now)()-w.mtimeMs<Ji)return null;x={reason:"never_written",executorLaunchId:null}}else{let{version:B,scopeId:G,pid:U,createdAtMs:D,executorLaunchId:re}=S;if(B!==1||G!==e.scopeId||typeof re!=="string"||typeof U!=="number"||!Number.isSafeInteger(U)||U<1||U===process.pid||typeof D!=="number"||!Number.isSafeInteger(D))return null;if(!(l.exists??((z)=>{try{return process.kill(z,0),!0}catch(fe){return!(fe instanceof Error&&("code"in fe)&&fe.code==="ESRCH")}}))(U))x={reason:"owner_exited",executorLaunchId:re};else{let z=(l.startedAtMs??qi)(U);if(z===null||z<=D+Vi)return null;x={reason:"pid_reused",executorLaunchId:re}}}let W=Ht(f);if(W.dev!==w.dev||W.ino!==w.ino)return null;Bi(f);let R=Xo(e.journalDirectory,On.O_RDONLY);try{Hi(R)}finally{Jo(R)}return x}catch{return null}finally{Jo(_)}}function ss(e){let l={...e,workspace:e.workspace&&Object.freeze({...e.workspace}),previewAuthority:e.previewAuthority&&Object.freeze({...e.previewAuthority,owner:Object.freeze({...e.previewAuthority.owner}),deniedPorts:new Set(e.previewAuthority.deniedPorts)})},f=$r(l.root,l.runId);if(hr.has(f)||l.operationId!==void 0&&Vr.has(l.operationId))throw new r("hands_jobs_busy","The Session already has a live Hands job supervisor.");let _={binding:l,key:f,terminals:new Map};if(l.previewAuthority&&l.environment)_.previews=Fo({authority:l.previewAuthority,runId:l.runId,expiresAtMs:l.expiresAtMs,executorLaunchId:l.executorLaunchId,environment:l.environment,isCurrent:()=>hr.get(_.key)===_,identity:()=>{try{return bt(l)}catch{return null}},inspect:(w,S)=>{if(hr.get(_.key)!==_)throw new r("preview_unavailable","The Hands supervisor is no longer current.");return is(l,{jobId:w,action:"inspect",input:{after:0}},S)}});if(hr.set(f,_),l.operationId!==void 0)Vr.set(l.operationId,_);return()=>{if(hr.get(_.key)===_)hr.delete(_.key);if(l.operationId!==void 0&&Vr.get(l.operationId)===_)Vr.delete(l.operationId);_.previews?.dispose();for(let w of _.terminals.values())w.abort()}}var Xi=5000,Zi=20;async function to(e){let l=(w)=>{throw new r("hands_rebind_unavailable",w)};if(!L(e.operationId)||!L(e.runId)||!L(e.fenceId)||!H(e.targetGeneration))l("Reason sent an invalid Hands rebind.");let f=Vr.get(e.operationId);if(!f||f.binding.root!==e.root)return l("No live Hands supervisor owns this operation.");for(let w=Date.now()+Xi;;){if(e.signal?.aborted)l("The Hands rebind was cancelled.");if(Vr.get(e.operationId)!==f)l("The Hands supervisor is no longer current.");let S=null;try{S=bt(f.binding)}catch{}if(S&&S.generation===e.targetGeneration&&S.fenceId===e.fenceId)break;if(S&&S.generation>e.targetGeneration||Date.now()>=w)l("The executor did not adopt this take.");await new Promise((x)=>setTimeout(x,Zi))}if(Vr.get(e.operationId)!==f||hr.get(f.key)!==f)l("The Hands supervisor is no longer current.");let _=$r(e.root,e.runId);if(f.key===_)return;if(hr.has(_))l("The taking run already has a live Hands job supervisor.");hr.delete(f.key);for(let w of f.terminals.values())w.abort();f.key=_,hr.set(_,f)}function at(e){let l="operationId"in e?Vr.get(e.operationId):hr.get($r(e.root,e.runId)),f=l&&l.binding.root===e.root?l.binding:void 0;if(!f?.environment||f.expiresAtMs<=Date.now())throw new r("environment_unavailable","No live Hands supervisor owns this environment.");return f.environment.install(e.payload)}async function ro(e){let l=hr.get($r(e.root,e.runId));if(!l?.previews||!e.owner)throw new r("preview_unavailable","No authenticated Hands supervisor owns this preview.");return l.previews.open(e.payload,e.owner,e.signal)}async function no(e){let l=hr.get($r(e.root,e.runId));if(!l?.previews||!e.owner||e.signal.aborted)throw new r("preview_unavailable","No authenticated Hands supervisor owns this preview.");return l.previews.close(e.payload,e.owner)}async function io(e){let l=$r(e.root,e.runId),f=hr.get(l),_=f?.binding,w=_?.runId,S=_?.previewAuthority,x=_?.environment,W=e.owner&&{...e.owner},R=e.authority&&{...e.authority},B=()=>{throw new r("pty_binding_unavailable","No current authenticated Hands scope owns this terminal.")};if(!f||!_||!S||!x||!W||!R||!_.workspace)return B();let G=Object.freeze({..._.workspace}),U=bt(_),D=x.current(),re=()=>{if(hr.get(l)!==f||W.organization_id!==S.owner.organization_id||W.user_id!==S.owner.user_id||W.device_id!==S.owner.device_id||e.deviceId!==S.owner.device_id||e.rootId!==S.rootId||I(e.workspace)!==I(G))B();let z=bt(_),fe=x.current();if(z.generation!==U.generation||z.fenceId!==U.fenceId||fe.run_id!==w||fe.device_id!==e.deviceId||fe.root_id!==e.rootId||fe.snapshot_id!==D.snapshot_id||fe.revision!==D.revision||fe.binding.target_generation!==U.generation||fe.binding.target_fence_id!==U.fenceId||R.device_id!==e.deviceId||R.binding!==fe.binding.kind||R.target_revision!==fe.binding.target_revision||R.root_grant_revision!==fe.binding.root_grant_revision||R.target_generation!==U.generation||R.target_fence_id!==U.fenceId)B()};if(re(),new URL(e.session.relayUrl).origin!==S.relayOrigin||f.terminals.has(e.session.jobId)||f.terminals.size>=4)return B();let J=new AbortController;f.terminals.set(e.session.jobId,J);try{return await Go({session:{...e.session,leaseExpiresAtMs:Math.min(e.session.leaseExpiresAtMs,U.expiresAtMs,Date.parse(D.expires_at))},signal:AbortSignal.any([e.signal,J.signal]),emit:e.emit,binding:{assertCurrent:re,environment:{revision:D.revision,snapshotId:D.snapshot_id},scope:{runId:e.runId,deviceId:e.deviceId,rootId:e.rootId,workspace:G,binding:D.binding.kind,targetRevision:D.binding.target_revision,rootGrantRevision:D.binding.root_grant_revision,generation:U.generation,fenceId:U.fenceId,executorLaunchId:U.executorLaunchId},request:(z,fe)=>_r(U,jr(JSON.stringify({...z,type:"job",version:2,generation:U.generation,id:An()})),fe)}})}finally{if(f.terminals.get(e.session.jobId)===J)f.terminals.delete(e.session.jobId)}}async function oo(e){if(ce(e.payload.jobId))throw new r("pty_binding_required","PTY jobs require the bound terminal capability.");let l=hr.get($r(e.root,e.runId))?.binding;if(!l||l.expiresAtMs<=Date.now())throw new r("hands_jobs_unavailable","No live Hands supervisor owns this Session and root.");return is(l,e.payload,e.signal)}var Qi=1e4,ea=20,ra=ve/2,ta=Ve/2,na=(e)=>e.output.reduce((l,f)=>l+f.text.length,0);async function is(e,l,f){if(Object.keys(l).some((B)=>!["jobId","action","input","waitForExitMs"].includes(B)))throw new r("invalid_payload","Unexpected job control field.");let{waitForExitMs:_,...w}=l;if(_!==void 0&&(w.action!=="start"||typeof w.input!=="object"||w.input===null||!("script"in w.input)||typeof _!=="number"||!Number.isSafeInteger(_)||_<1||_>Qi))throw new r("invalid_payload","Only a script start may wait for its job, within its bound.");let S=(B)=>{let G=bt(e);return _r(G,jr(JSON.stringify({...B,type:"job",version:2,generation:G.generation,id:An()})),f)},x=await S(w);if(_===void 0)return x;let W=Date.now()+_,R=x;while(R.ok&&["starting","running"].includes(R.job.state)&&R.job.output.length<ra&&na(R.job)<ta&&!f.aborted&&Date.now()<W){if(await new Promise((B)=>setTimeout(B,Math.min(ea,W-Date.now()))),f.aborted)break;try{let B=await S({jobId:w.jobId,action:"inspect",input:{after:0}});if(!B.ok)break;R=B}catch{break}}return R}function bt(e){if(e.expiresAtMs<=Date.now())throw new r("hands_jobs_unavailable","Hands authority expired.");let l=e.readIdentity?e.readIdentity():e;if(!l||!H(l.generation)||!L(l.fenceId)||l.generation<e.generation||l.generation===e.generation&&l.fenceId!==e.fenceId)throw new r("hands_jobs_unavailable","The live Hands fencing identity could not be verified.");return e.generation=l.generation,e.fenceId=l.fenceId,{...e}}function _r(e,l,f){if(f.aborted)return Promise.reject(new r("cancelled","Job control was cancelled."));return new Promise((_,w)=>{let S=Wi(e.socketPath),x="",W=!1,R,B=(U,D)=>{if(W)return;if(W=!0,clearTimeout(R),f.removeEventListener("abort",G),S.destroy(),U)w(U);else _(D)},G=()=>B(new r("cancelled","Job control waiter cancelled; inspect before retrying mutations."));f.addEventListener("abort",G,{once:!0}),S.setEncoding("utf8"),R=setTimeout(()=>B(new r("hands_job_result_unknown","Job control timed out; inspect before retrying mutations.")),Math.min(1e4,Math.max(1,e.expiresAtMs-Date.now()))),S.on("error",()=>B(new r("hands_job_result_unknown","Hands job control connection failed."))),S.once("connect",()=>S.write(JSON.stringify({version:1,scopeId:e.scopeId,fenceId:e.fenceId,executorLaunchId:e.executorLaunchId,request:l})+`
+import{qt,j}from"./vm-hands-entry-lite-dgfx0rbn.js";import{ue,Ce,X,Ae,de,ir,et,Y,I,N,rn}from"./vm-hands-entry-lite-48rphbjm.js";import{Uo,ri}from"./vm-hands-entry-lite-4anjdcth.js";import{go,P,Ve,ve,Ge,ne,Ke,Ln,Se,Kt,ae,H,L,ce,jr,Hr,Mn}from"./vm-hands-entry-lite-n7bd44rm.js";import{Pe,oe,pe,Z,Te,q,Q}from"./vm-hands-entry-lite-07apxfh8.js";import{Lt,Pr,lt,V,O,T,b,Cn}from"./vm-hands-entry-lite-1yv5qqew.js";import{Cr,Ar,xn,uo,Ue,kn}from"./vm-hands-entry-lite-gje7xvy9.js";import{K}from"./vm-hands-entry-lite-wghmyfba.js";import{ji}from"./vm-hands-entry-lite-qd46yhvz.js";import{p,ze,$t,ut,po,_e,we}from"./vm-hands-entry-lite-bpamn7ny.js";import{v,h,mo}from"./vm-hands-entry-lite-h1qjggz0.js";import{E}from"./vm-hands-entry-lite-46pwqvpf.js";import{tr}from"./vm-hands-entry-lite-1kdfzrj6.js";import{a,zo,qo,ie,Vo}from"./vm-hands-entry-lite-8dfw96ym.js";import{M,$i,Mi,Yo,y,t,k,At,o,d,u,n,c,g,ee,s,i}from"./vm-hands-entry-lite-wzv13c8k.js";import{Fi}from"./vm-hands-entry-lite-pzj5s203.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{Qo,se,Ui,C,Oe,$e,A}from"./vm-hands-entry-lite-tyem93c1.js";var Oi=()=>{let e={string:{unit:"characters",verb:"to have"},file:{unit:"bytes",verb:"to have"},array:{unit:"items",verb:"to have"},set:{unit:"items",verb:"to have"},map:{unit:"entries",verb:"to have"}};function l(w){return e[w]??null}let f={regex:"input",email:"email address",url:"URL",emoji:"emoji",uuid:"UUID",uuidv4:"UUIDv4",uuidv6:"UUIDv6",nanoid:"nanoid",guid:"GUID",cuid:"cuid",cuid2:"cuid2",ulid:"ULID",xid:"XID",ksuid:"KSUID",datetime:"ISO datetime",date:"ISO date",time:"ISO time",duration:"ISO duration",ipv4:"IPv4 address",ipv6:"IPv6 address",mac:"MAC address",cidrv4:"IPv4 range",cidrv6:"IPv6 range",base64:"base64-encoded string",base64url:"base64url-encoded string",json_string:"JSON string",e164:"E.164 number",jwt:"JWT",template_literal:"input"},_={nan:"NaN"};return(w)=>{switch(w.code){case"invalid_type":{let S=_[w.expected]??w.expected,x=Yo(w.input),W=_[x]??x;return`Invalid input: expected ${S}, received ${W}`}case"invalid_value":if(w.values.length===1)return`Invalid input: expected ${Mi(w.values[0])}`;return`Invalid option: expected one of ${$i(w.values,"|")}`;case"too_big":{let S=w.inclusive?"<=":"<",x=l(w.origin);if(x)return`Too big: expected ${w.origin??"value"} to have ${S}${w.maximum.toString()} ${x.unit??"elements"}`;return`Too big: expected ${w.origin??"value"} to be ${S}${w.maximum.toString()}`}case"too_small":{let S=w.inclusive?">=":">",x=l(w.origin);if(x)return`Too small: expected ${w.origin} to have ${S}${w.minimum.toString()} ${x.unit}`;return`Too small: expected ${w.origin} to be ${S}${w.minimum.toString()}`}case"invalid_format":{let S=w;if(S.format==="starts_with")return`Invalid string: must start with "${S.prefix}"`;if(S.format==="ends_with")return`Invalid string: must end with "${S.suffix}"`;if(S.format==="includes")return`Invalid string: must include "${S.includes}"`;if(S.format==="regex")return`Invalid string: must match pattern ${S.pattern}`;return`Invalid ${f[S.format]??w.format}`}case"not_multiple_of":return`Invalid number: must be a multiple of ${w.divisor}`;case"unrecognized_keys":return`Unrecognized key${w.keys.length>1?"s":""}: ${$i(w.keys,", ")}`;case"invalid_key":return`Invalid key in ${w.origin}`;case"invalid_union":if(w.options&&Array.isArray(w.options)&&w.options.length>0)return`Invalid discriminator value. Expected ${w.options.map((x)=>`'${x}'`).join(" | ")}`;return"Invalid input";case"invalid_element":return`Invalid value in ${w.origin}`;default:return"Invalid input"}}};function gn(){return{localeError:Oi()}}M(gn());class mt extends Error{}function No(e){let l;try{l=new URL(e)}catch{throw new mt("The proxy must be a URL like https://proxy.example.com:3128.")}if(l.protocol!=="https:"&&l.protocol!=="http:")throw new mt("The proxy URL must use the https or http scheme.");if(!l.hostname)throw new mt("The proxy URL must name a host.");if(l.port!==""&&Number(l.port)<1)throw new mt("The proxy URL must use a port between 1 and 65535.");if(l.pathname!==""&&l.pathname!=="/"||l.search||l.hash)throw new mt("The proxy URL must not carry a path, query, or fragment.");return l.toString()}import{createHash as xi}from"crypto";import{isAbsolute as Bo,join as jo,relative as Mo,resolve as Yt,sep as Wo}from"path";var Vt=t().min(1).refine(Bo,"absolute path required"),Lo=c({version:i(1),apiOrigin:At(),channel:s(["staging","production"]),stateDirectory:Vt,workspaceRoot:Vt,lifetime:s(["persistent","ephemeral"]),executionMode:s(["confined","host"]).default("confined"),name:t().min(1).max(160).default("Reason headless worker"),slots:o().int().min(1).max(4).default(1),shutdownGraceMs:o().int().min(0).max(300000).default(30000),proxy:c({version:i(qt),url:t().refine((e)=>{try{return No(e)===e}catch{return!1}},"invalid proxy URL"),caFile:Vt.optional()}).optional(),userChrome:d().optional(),cloudSessions:i(!0).optional(),localLogins:d().optional(),folders:u(Vt).min(1).max(31).optional()}),Pi=/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/,F=g("channel",[Lo,Lo.extend({channel:i("local-qa"),apiOrigin:t()})]).superRefine((e,l)=>{if(e.channel==="local-qa"){if(!Pi.test(e.apiOrigin))l.addIssue({code:"custom",message:"local QA worker requires an exact HTTPS trycloudflare.com quick-tunnel origin"})}else{let _=new URL(e.apiOrigin);if(_.origin!==e.apiOrigin||_.username||_.password||_.protocol!=="https:"&&!(_.protocol==="http:"&&ri(_.origin))||!ri(_.origin)&&!Uo(e.channel,_.origin))l.addIssue({code:"custom",message:"API origin must match channel (or loopback)"})}if(!je(e.workspaceRoot,e.stateDirectory))l.addIssue({code:"custom",message:"state and workspace must be disjoint"});let f=e.folders??[];if(new Set([e.workspaceRoot,...f]).size!==f.length+1||f.some((_)=>!je(_,e.stateDirectory)))l.addIssue({code:"custom",message:"folders must be distinct and disjoint from state"})});function m(e){return jo(e.stateDirectory,`headless-${e.channel}`)}function je(e,l){if(zr(l,e))return!1;return!zr(e,l)||E(jo(Wo,Mo(Yt(e),Yt(l))))}function zr(e,l){let f=Mo(Yt(e),Yt(l));return f===""||f!==".."&&!f.startsWith(`..${Wo}`)&&!Bo(f)}function te(e){let{proxy:l,userChrome:f,cloudSessions:_,localLogins:w,folders:S,...x}=e;return xi("sha256").update(JSON.stringify(x)).digest("hex")}var Ii=4,Ai=[2375,2376,9222,9229];function mr(e){let l=new Set(Ai);for(let f of e){let _=new URL(f);l.add(Number(_.port||(["https:","wss:"].includes(_.protocol)?443:80)))}return l}function Jr(){throw new r("preview_unavailable","The live Hands preview binding is unavailable or stale.")}var Ti=60000;function Fo(e){let l=new AbortController,f=new Map,_=(R)=>JSON.stringify([R.jobId,R.port]);function w(R){let B=e.authority.owner;if(l.signal.aborted||!e.isCurrent()||e.expiresAtMs<=Date.now()||R.organization_id!==B.organization_id||R.user_id!==B.user_id||R.device_id!==B.device_id)Jr()}function S(R){let B;try{B=e.environment.current()}catch{return null}return B.binding.target_generation===R.generation&&B.binding.target_fence_id===R.fenceId&&B.run_id===e.runId&&B.device_id===e.authority.owner.device_id&&B.root_id===e.authority.rootId?B:null}async function x(R,B,G){let U=await W(R,B,G);if(U!=="moved")return U;let D=await W(R,B,G);return D==="moved"?null:D}async function W(R,B,G){try{w(e.authority.owner);let U=e.identity();if(!U||G.aborted||R.expiresAtMs<=Date.now()||R.expiresAtMs>e.expiresAtMs)return null;let D=B.opened,re=D!==void 0&&U.generation>D.generation,J=S(U);if(re){if(J){if(J.revision<=D.revision||R.expiresAtMs>Date.parse(J.expires_at)||J.binding.target_revision!==D.attachmentRevision||J.binding.root_grant_revision!==D.grantRevision)return null;B.recoveringSinceMs=void 0}else if(Date.now()-(B.recoveringSinceMs??=Date.now())>Ti)return null}else if(!J||R.expiresAtMs>Date.parse(J.expires_at)||D&&(U.generation!==D.generation||U.fenceId!==D.fenceId))return null;let z=await e.inspect(R.jobId,G),fe=e.identity(),ke=fe&&S(fe);w(e.authority.owner);let be=J&&{generation:U.generation,fenceId:U.fenceId,snapshotId:J.snapshot_id,revision:J.revision,attachmentRevision:J.binding.target_revision,grantRevision:J.binding.root_grant_revision},Re=re?D:be;if(G.aborted||!fe)return null;if(fe.generation!==U.generation||fe.fenceId!==U.fenceId||ke?.snapshot_id!==J?.snapshot_id||ke?.revision!==J?.revision)return"moved";let Fe=z.ok&&z.job.environmentSnapshotId!==void 0&&z.job.environmentRevision!==void 0?{snapshotId:z.job.environmentSnapshotId,revision:z.job.environmentRevision}:null;if(!z.ok||z.generation!==U.generation||!Re||!Fe)return null;if((Fe.snapshotId!==Re.snapshotId||Fe.revision!==Re.revision)&&(re||!e.environment.carried(Fe.snapshotId,Fe.revision)))return null;if(!D&&U.generation===R.generation&&U.fenceId===R.fenceId)B.opened={...Re,...Fe};return{executorLaunchId:e.executorLaunchId,job:z.job,binding:{organizationId:e.authority.owner.organization_id,userId:e.authority.owner.user_id,deviceId:e.authority.owner.device_id,rootId:e.authority.rootId,runId:e.runId,attachmentRevision:Re.attachmentRevision,grantRevision:Re.grantRevision,generation:Re.generation,fenceId:Re.fenceId,jobId:z.job.jobId,port:R.port,expiresAtMs:R.expiresAtMs}}}catch{return null}}return{async open(R,B,G){w(B);let{binding:U,deviceRelayUrl:D}=ut(R);if(G.aborted||U.expiresAtMs<=Date.now()||U.expiresAtMs>Date.now()+p.lifetimeMs||new URL(D).origin!==e.authority.relayOrigin)Jr();let re=_(U),J=f.get(re);if(J){if(!ze(J.binding,U)||J.relay!==D)Jr();if(await J.opened,!await $t(()=>J.port.check())||G.aborted||J.abort.signal.aborted)Jr();return{opened:!0,binding:U}}if(f.size>=Ii)Jr();let z=new AbortController,fe={},ke=we({binding:U,deniedPorts:e.authority.deniedPorts,readCurrentJob:()=>x(U,fe,z.signal)}),be=()=>z.abort();if(G.addEventListener("abort",be,{once:!0}),l.signal.addEventListener("abort",be,{once:!0}),G.aborted||l.signal.aborted)be();let Re=_e({binding:U,deviceRelayUrl:D,port:ke,signal:z.signal}),Fe={binding:U,relay:D,abort:z,port:ke,opened:Re};f.set(re,Fe);let Xe=()=>{if(G.removeEventListener("abort",be),l.signal.removeEventListener("abort",be),f.get(re)===Fe)f.delete(re)};try{if((await Re).closed.then(Xe),G.removeEventListener("abort",be),w(B),z.signal.aborted||!await $t(()=>ke.check()))Jr();return{opened:!0,binding:U}}catch{z.abort(),Xe(),Jr()}},async close(R,B){w(B);let{binding:G}=po(R),U=f.get(_(G));if(!U||!ze(U.binding,G))Jr();return U.abort.abort(),await U.opened.then((D)=>D.closed,()=>{return}),{closed:!0,binding:G}},dispose(){l.abort();for(let R of f.values())R.abort.abort();f.clear()}}}import{WebSocket as Rn}from"ws";var $o=(e)=>("data"in e)?e.data.length:e.bytes,Ko=2*Ke;function ar(e){throw new r(e,"The bound Hands terminal is unavailable or its outcome is unconfirmed.")}var ht=(e)=>!["starting","running"].includes(e.state);function eo(e,l,f=Date.now()){let _=["relay_url","session_id","expires_at","cols","rows","pty","workspace"];if(Object.keys(e).length!==_.length||Object.keys(e).some((B)=>!_.includes(B))||!ae(l)||!ae(e.session_id)||typeof e.expires_at!=="string"||typeof e.relay_url!=="string"||e.relay_url.length>4096||![e.cols,e.rows].every((B)=>Number.isSafeInteger(B)&&Number(B)>=1&&Number(B)<=Se))ar("invalid_pty_request");let w=e.pty;if(!w||typeof w!=="object"||Array.isArray(w))ar("invalid_pty_request");let S=w;if(Object.keys(S).length!==2||S.version!==1||!ce(S.jobId))ar("invalid_pty_request");let x;try{x=new URL(e.relay_url)}catch{return ar("invalid_pty_request")}if(!["ws:","wss:"].includes(x.protocol)||x.username||x.password||x.hash||x.protocol==="ws:"&&!["127.0.0.1","[::1]","localhost"].includes(x.hostname))ar("invalid_pty_request");let W=Date.parse(e.expires_at);if(!Number.isSafeInteger(W)||W<=f)ar("invalid_pty_request");return{workspace:N(e.workspace)??ar("invalid_pty_request"),session:{jobId:S.jobId,sessionId:e.session_id,operationId:l,relayUrl:x.href,cols:Number(e.cols),rows:Number(e.rows),leaseExpiresAtMs:Math.min(W,f+43200000)}}}async function Go(e){let{session:l,binding:f}=e;if(f.assertCurrent(),e.signal.aborted||Date.now()>=l.leaseExpiresAtMs)ar("cancelled");let _=new Rn(l.relayUrl,{followRedirects:!1,perMessageDeflate:!1,maxPayload:ne}),w=new AbortController,S=()=>{},x=()=>{w.abort(),S()};e.signal.addEventListener("abort",x,{once:!0});let W=setTimeout(x,Math.max(1,l.leaseExpiresAtMs-Date.now())),R=[],B=0,G=0,U=0,D=!1,re=!1,J=!1,z,fe,ke,be=(le)=>{ke=new r(le,"Bound terminal input was refused."),x()};_.on("error",()=>be("pty_relay_unavailable")),_.on("close",x),_.on("message",(le,he)=>{if(w.signal.aborted)return;if(!re){be("pty_not_ready");return}let xe=Array.isArray(le)?Buffer.concat(le):le instanceof ArrayBuffer?Buffer.from(le):le;if(xe.length===0)return;let Je=R.at(-1),Le=he&&Je!==void 0&&"data"in Je&&Je.data.length+xe.length<=ne;if(xe.length>ne||B+xe.length>Ln){be("pty_input_backpressure");return}if(Le)Je.data=Buffer.concat([Je.data,xe]);else if(he)R.push({data:Buffer.from(xe)});else try{let Be=JSON.parse(xe.toString("utf8"));if(Be&&Be.t==="close"&&Object.keys(Be).length===1){J=!0,x();return}if(!Be||Be.t!=="resize"||Object.keys(Be).length!==3||![Be.cols,Be.rows].every((Ee)=>Number.isSafeInteger(Ee)&&Ee>=1&&Ee<=Se))throw Error("invalid_control");R.push({cols:Be.cols,rows:Be.rows,bytes:xe.length})}catch{be("invalid_pty_control");return}B+=xe.length,S()});function Re(le){return Mn(JSON.stringify({...f.scope,version:1,sessionId:l.sessionId,operationId:l.operationId,job:{...le,output:[],pty:le.pty?{...le.pty,output:[]}:void 0}}))}function Fe(le){if(!le.ok)ar(le.error);let he=le.job;if(le.generation!==f.scope.generation||he.jobId!==l.jobId||!he.pty||he.leaseExpiresAtMs>l.leaseExpiresAtMs||he.process&&he.process.executorLaunchId!==f.scope.executorLaunchId||he.process&&fe&&(he.process.pid!==fe.pid||he.process.processGroupId!==fe.processGroupId)||he.state!=="starting"&&(he.environmentRevision!==f.environment.revision||he.environmentSnapshotId!==f.environment.snapshotId))ar("pty_binding_changed");if(Re(he),he.process)fe??={...he.process};return he}async function Xe(le){f.assertCurrent();let he=await f.request(le,w.signal);if(f.assertCurrent(),w.signal.aborted)ar("cancelled");let xe=Fe(he);if(xe.inputSequence!==G)ar("job_input_sequence");if(!ht(xe)&&xe.leaseExpiresAtMs<=Date.now())ar("pty_binding_changed");return xe}function ye(le){if(f.assertCurrent(),w.signal.aborted||_.readyState!==Rn.OPEN||_.bufferedAmount+Buffer.byteLength(le)>Ko)ar("pty_output_backpressure");_.send(le)}function We(le){if(le.firstCursor>U+1)U=le.firstCursor-1;for(let he of le.pty.output){if(he.cursor<=U)continue;if(he.cursor!==U+1)ar("pty_output_gap");let xe=Buffer.from(he.dataBase64,"base64");if(_.bufferedAmount+xe.length>Ko)return!1;ye(xe),U=he.cursor}if(U!==le.nextCursor)ar("pty_output_gap");return!0}async function Ye(le,he){let xe;try{await Promise.race([e.emit(le,he),new Promise((Je,Le)=>{xe=setTimeout(()=>Le(new r("pty_event_unavailable","Terminal metadata delivery timed out.")),2000)})])}finally{clearTimeout(xe)}}async function De(){let le=AbortSignal.timeout(Kt),he=f.request({jobId:l.jobId,action:"cancel",input:{}},le),xe,Je=new Promise((Le,Be)=>{if(xe=()=>Be(new r("pty_cleanup_unconfirmed","Terminal cleanup acknowledgement was not observed within authority.")),le.addEventListener("abort",xe,{once:!0}),le.aborted)xe()});try{let Le=await Promise.race([he,Je]);if(le.aborted)ar("pty_cleanup_unconfirmed");return Fe(Le)}finally{le.removeEventListener("abort",xe)}}try{await new Promise((Le,Be)=>{let Ee=setTimeout(()=>{x(),Be(new r("pty_relay_unavailable","Terminal pairing timed out."))},5000),Me=()=>{clearTimeout(Ee),Be(new r("cancelled","Terminal pairing was cancelled."))};if(w.signal.addEventListener("abort",Me,{once:!0}),_.once("open",()=>{clearTimeout(Ee),w.signal.removeEventListener("abort",Me),Le()}),w.signal.aborted)Me()}),f.assertCurrent(),D=!0,z=await Xe({jobId:l.jobId,action:"start",input:{mode:"pty",cols:l.cols,rows:l.rows,leaseExpiresAtMs:l.leaseExpiresAtMs}});let le=Date.now()+5000;while(z.state==="starting"){if(Date.now()>=le)ar("pty_not_ready");await new Promise((Le)=>setTimeout(Le,25)),z=await Xe({jobId:l.jobId,action:"inspect",input:{after:U}})}if(z.state!=="running"||z.inputSequence!==0||z.leaseExpiresAtMs<=Date.now())ar("pty_not_ready");await Ye("pty.ready",Re(z)),re=!0,ye(JSON.stringify({t:"open",cols:z.pty.cols,rows:z.pty.rows,receipt:Re(z)}));let he=!1,xe=0,Je=!1;while(!w.signal.aborted){let Le=z.firstCursor>U+1,Be=We(z);if(ht(z)){if(Be)break}else if(Le)he=!0;else if(he&&Be&&Date.now()>=xe){he=!1,xe=Date.now()+1000;let{cols:Me,rows:rr}=z.pty;for(let or of[{cols:Me,rows:rr>1?rr-1:2},{cols:Me,rows:rr}]){if(ht(z))break;let Rr=++G;if(z=await Xe({jobId:l.jobId,action:"resize",input:{sequence:Rr,...or}}),z.inputSequence!==Rr)ar("job_input_sequence")}continue}let Ee=ht(z)||Je?void 0:R.shift();if(Ee){B-=$o(Ee);let Me=++G;try{z=await Xe("data"in Ee?{jobId:l.jobId,action:"input",input:{sequence:Me,dataBase64:Ee.data.toString("base64")}}:{jobId:l.jobId,action:"resize",input:{sequence:Me,cols:Ee.cols,rows:Ee.rows}})}catch(rr){if(!(rr instanceof r)||rr.code!=="job_input_backpressure")throw rr;G-=1,R.unshift(Ee),B+=$o(Ee),Je=!0;continue}if(z.inputSequence!==Me)ar("job_input_sequence")}else if(await new Promise((Me)=>{let rr=setTimeout(Me,Je||!Be?10:50);if(S=()=>{clearTimeout(rr),Me()},w.signal.aborted||!Je&&R.length)S()}),Je=!1,S=()=>{},!w.signal.aborted&&Be)try{z=await Xe({jobId:l.jobId,action:"inspect",input:{after:U}})}catch(Me){if(!J||!(Me instanceof r)||Me.code!=="cancelled")throw Me}}}catch(le){ke??=le}finally{if(re=!1,R.length=0,clearTimeout(W),e.signal.removeEventListener("abort",x),x(),D&&(!z||!ht(z)))try{z=await De()}catch{z=void 0}try{if(!z||!ht(z)||z.pty?.cleanup!=="confirmed")ar("pty_cleanup_unconfirmed");let le=Re(z);if(_.readyState===Rn.OPEN)await new Promise((he)=>{let xe=setTimeout(he,500);_.send(JSON.stringify({t:"exit",code:z.exitCode,receipt:le}),()=>{clearTimeout(xe),he()})});await Ye("pty.stopped",le)}catch(le){ke??=le}_.terminate()}if(ke)throw ke;if(e.signal.aborted)ar("cancelled");if(!z)ar("pty_cleanup_unconfirmed");return{receipt:Re(z)}}import{createHash as Di,randomUUID as An}from"crypto";import{spawnSync as es}from"child_process";import{closeSync as Jo,constants as On,fstatSync as Ci,fsyncSync as Hi,lstatSync as Ht,mkdirSync as Ni,mkdtempSync as rs,openSync as Xo,readFileSync as Li,readdirSync as ts,realpathSync as qr,rmSync as Pn,unlinkSync as Bi}from"fs";import{createConnection as Wi}from"net";import{dirname as zi,join as ot,sep as In}from"path";import{tmpdir as ns}from"os";var hr=new Map,Vr=new Map;function $r(e,l){return Di("sha256").update(JSON.stringify([e,l])).digest("hex")}function gt(e){try{Ni(e,{mode:448})}catch(f){if(!(f instanceof Error&&("code"in f)&&f.code==="EEXIST"))throw f}let l=Ht(e);if(!l.isDirectory()||l.isSymbolicLink()||!A(l)||qr(e)!==e)throw new r("hands_jobs_unavailable","Hands job state must be a private canonical directory.")}function Ki(e){let l;try{l=Ht(e)}catch(f){if(f instanceof Error&&"code"in f&&f.code==="ENOENT")return!1;throw f}return!l.isDirectory()||l.isSymbolicLink()||ts(e).length>0}function Gi(e){if(process.platform==="win32")return Ui();let l=e.map((f)=>{try{return qr(f)}catch{return f}});for(let f of[()=>Ui(),()=>qr("/dev/shm"),()=>qr(ns())]){let _;try{_=f()}catch{continue}if(!l.some((w)=>_===w||_.startsWith(w.endsWith(In)?w:w+In)))return _}throw new r("invalid_hands_workspace","A Session can't work in this computer's temporary folder itself; start it in a project folder inside it.")}function gr(e){let l=$r(e.root,e.runId),f=e.previousRuntimeDirectories?.find((x)=>Ki(ot(x,"jobs",l.slice(0,16))))??e.runtimeDirectory;gt(f);let _=ot(f,"jobs");gt(_);let w=ot(_,l.slice(0,16));if(e.maxScopes!==void 0){let x=ts(_);if(!Number.isSafeInteger(e.maxScopes)||e.maxScopes<1||x.length>e.maxScopes||!x.includes(l.slice(0,16))&&x.length>=e.maxScopes)throw new r("process_journal_capacity","Managed process receipt capacity is full; preserve uncertain jobs and reconcile their existing receipts before starting more work.")}gt(w);let S=rs(ot(Gi(e.folders??[]),"reason-j-"));try{return gt(S),{journalDirectory:w,scopeId:l,launchDirectory:S,socketPath:process.platform==="win32"?`\\\\.\\pipe\\reason-jobs-${An()}`:ot(S,"control.sock"),disposeSocket:()=>Pn(S,{recursive:!0,force:!0})}}catch(x){throw Pn(S,{recursive:!0,force:!0}),x}}var Ji=60000,Vi=5000;function qi(e){if(process.platform==="win32")return Yi(e);let l=es("ps",["-o","lstart=","-p",String(e)],{encoding:"utf8",timeout:2000,env:{...process.env,LC_ALL:"C",LANG:"C"}}),f=l.status===0?/^\w{3} (\w{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(l.stdout.trim()):null,_=f?"JanFebMarAprMayJunJulAugSepOctNovDec".indexOf(f[1]):-1;if(!f||_<0||_%3!==0)return null;let w=new Date(Number(f[6]),_/3,Number(f[2]),Number(f[3]),Number(f[4]),Number(f[5])).getTime();return Number.isFinite(w)?w:null}function Yi(e){let l=es(C("powershell"),["-NoProfile","-NonInteractive","-Command",`(Get-Process -Id ${e}).StartTime.ToUniversalTime().ToString('o')`],{encoding:"utf8",timeout:5000,windowsHide:!0,env:Oe()}),f=l.status===0?Date.parse(l.stdout.trim()):Number.NaN;return Number.isFinite(f)?f:null}function os(e,l={}){let f=ot(e.journalDirectory,"owner.lock"),_;try{_=Xo(f,On.O_RDONLY|On.O_NOFOLLOW)}catch{return null}try{let w=Ci(_);if(!w.isFile()||w.nlink!==1||!A(w)||w.size>4096)return null;let S=null;try{S=JSON.parse(Li(_,"utf8"))}catch{}let x;if(S===null){if((l.now??Date.now)()-w.mtimeMs<Ji)return null;x={reason:"never_written",executorLaunchId:null}}else{let{version:B,scopeId:G,pid:U,createdAtMs:D,executorLaunchId:re}=S;if(B!==1||G!==e.scopeId||typeof re!=="string"||typeof U!=="number"||!Number.isSafeInteger(U)||U<1||U===process.pid||typeof D!=="number"||!Number.isSafeInteger(D))return null;if(!(l.exists??((z)=>{try{return process.kill(z,0),!0}catch(fe){return!(fe instanceof Error&&("code"in fe)&&fe.code==="ESRCH")}}))(U))x={reason:"owner_exited",executorLaunchId:re};else{let z=(l.startedAtMs??qi)(U);if(z===null||z<=D+Vi)return null;x={reason:"pid_reused",executorLaunchId:re}}}let W=Ht(f);if(W.dev!==w.dev||W.ino!==w.ino)return null;Bi(f);let R=Xo(e.journalDirectory,On.O_RDONLY);try{Hi(R)}finally{Jo(R)}return x}catch{return null}finally{Jo(_)}}function ss(e){let l={...e,workspace:e.workspace&&Object.freeze({...e.workspace}),previewAuthority:e.previewAuthority&&Object.freeze({...e.previewAuthority,owner:Object.freeze({...e.previewAuthority.owner}),deniedPorts:new Set(e.previewAuthority.deniedPorts)})},f=$r(l.root,l.runId);if(hr.has(f)||l.operationId!==void 0&&Vr.has(l.operationId))throw new r("hands_jobs_busy","The Session already has a live Hands job supervisor.");let _={binding:l,key:f,terminals:new Map};if(l.previewAuthority&&l.environment)_.previews=Fo({authority:l.previewAuthority,runId:l.runId,expiresAtMs:l.expiresAtMs,executorLaunchId:l.executorLaunchId,environment:l.environment,isCurrent:()=>hr.get(_.key)===_,identity:()=>{try{return bt(l)}catch{return null}},inspect:(w,S)=>{if(hr.get(_.key)!==_)throw new r("preview_unavailable","The Hands supervisor is no longer current.");return is(l,{jobId:w,action:"inspect",input:{after:0}},S)}});if(hr.set(f,_),l.operationId!==void 0)Vr.set(l.operationId,_);return()=>{if(hr.get(_.key)===_)hr.delete(_.key);if(l.operationId!==void 0&&Vr.get(l.operationId)===_)Vr.delete(l.operationId);_.previews?.dispose();for(let w of _.terminals.values())w.abort()}}var Xi=5000,Zi=20;async function to(e){let l=(w)=>{throw new r("hands_rebind_unavailable",w)};if(!L(e.operationId)||!L(e.runId)||!L(e.fenceId)||!H(e.targetGeneration))l("Reason sent an invalid Hands rebind.");let f=Vr.get(e.operationId);if(!f||f.binding.root!==e.root)return l("No live Hands supervisor owns this operation.");for(let w=Date.now()+Xi;;){if(e.signal?.aborted)l("The Hands rebind was cancelled.");if(Vr.get(e.operationId)!==f)l("The Hands supervisor is no longer current.");let S=null;try{S=bt(f.binding)}catch{}if(S&&S.generation===e.targetGeneration&&S.fenceId===e.fenceId)break;if(S&&S.generation>e.targetGeneration||Date.now()>=w)l("The executor did not adopt this take.");await new Promise((x)=>setTimeout(x,Zi))}if(Vr.get(e.operationId)!==f||hr.get(f.key)!==f)l("The Hands supervisor is no longer current.");let _=$r(e.root,e.runId);if(f.key===_)return;if(hr.has(_))l("The taking run already has a live Hands job supervisor.");hr.delete(f.key);for(let w of f.terminals.values())w.abort();f.key=_,hr.set(_,f)}function at(e){let l="operationId"in e?Vr.get(e.operationId):hr.get($r(e.root,e.runId)),f=l&&l.binding.root===e.root?l.binding:void 0;if(!f?.environment||f.expiresAtMs<=Date.now())throw new r("environment_unavailable","No live Hands supervisor owns this environment.");return f.environment.install(e.payload)}async function ro(e){let l=hr.get($r(e.root,e.runId));if(!l?.previews||!e.owner)throw new r("preview_unavailable","No authenticated Hands supervisor owns this preview.");return l.previews.open(e.payload,e.owner,e.signal)}async function no(e){let l=hr.get($r(e.root,e.runId));if(!l?.previews||!e.owner||e.signal.aborted)throw new r("preview_unavailable","No authenticated Hands supervisor owns this preview.");return l.previews.close(e.payload,e.owner)}async function io(e){let l=$r(e.root,e.runId),f=hr.get(l),_=f?.binding,w=_?.runId,S=_?.previewAuthority,x=_?.environment,W=e.owner&&{...e.owner},R=e.authority&&{...e.authority},B=()=>{throw new r("pty_binding_unavailable","No current authenticated Hands scope owns this terminal.")};if(!f||!_||!S||!x||!W||!R||!_.workspace)return B();let G=Object.freeze({..._.workspace}),U=bt(_),D=x.current(),re=()=>{if(hr.get(l)!==f||W.organization_id!==S.owner.organization_id||W.user_id!==S.owner.user_id||W.device_id!==S.owner.device_id||e.deviceId!==S.owner.device_id||e.rootId!==S.rootId||I(e.workspace)!==I(G))B();let z=bt(_),fe=x.current();if(z.generation!==U.generation||z.fenceId!==U.fenceId||fe.run_id!==w||fe.device_id!==e.deviceId||fe.root_id!==e.rootId||fe.snapshot_id!==D.snapshot_id||fe.revision!==D.revision||fe.binding.target_generation!==U.generation||fe.binding.target_fence_id!==U.fenceId||R.device_id!==e.deviceId||R.binding!==fe.binding.kind||R.target_revision!==fe.binding.target_revision||R.root_grant_revision!==fe.binding.root_grant_revision||R.target_generation!==U.generation||R.target_fence_id!==U.fenceId)B()};if(re(),new URL(e.session.relayUrl).origin!==S.relayOrigin||f.terminals.has(e.session.jobId)||f.terminals.size>=4)return B();let J=new AbortController;f.terminals.set(e.session.jobId,J);try{return await Go({session:{...e.session,leaseExpiresAtMs:Math.min(e.session.leaseExpiresAtMs,U.expiresAtMs,Date.parse(D.expires_at))},signal:AbortSignal.any([e.signal,J.signal]),emit:e.emit,binding:{assertCurrent:re,environment:{revision:D.revision,snapshotId:D.snapshot_id},scope:{runId:e.runId,deviceId:e.deviceId,rootId:e.rootId,workspace:G,binding:D.binding.kind,targetRevision:D.binding.target_revision,rootGrantRevision:D.binding.root_grant_revision,generation:U.generation,fenceId:U.fenceId,executorLaunchId:U.executorLaunchId},request:(z,fe)=>_r(U,jr(JSON.stringify({...z,type:"job",version:2,generation:U.generation,id:An()})),fe)}})}finally{if(f.terminals.get(e.session.jobId)===J)f.terminals.delete(e.session.jobId)}}async function oo(e){if(ce(e.payload.jobId))throw new r("pty_binding_required","PTY jobs require the bound terminal capability.");let l=hr.get($r(e.root,e.runId))?.binding;if(!l||l.expiresAtMs<=Date.now())throw new r("hands_jobs_unavailable","No live Hands supervisor owns this Session and root.");return is(l,e.payload,e.signal)}var Qi=1e4,ea=20,ra=ve/2,ta=Ve/2,na=(e)=>e.output.reduce((l,f)=>l+f.text.length,0);async function is(e,l,f){if(Object.keys(l).some((B)=>!["jobId","action","input","waitForExitMs"].includes(B)))throw new r("invalid_payload","Unexpected job control field.");let{waitForExitMs:_,...w}=l;if(_!==void 0&&(w.action!=="start"||typeof w.input!=="object"||w.input===null||!("script"in w.input)||typeof _!=="number"||!Number.isSafeInteger(_)||_<1||_>Qi))throw new r("invalid_payload","Only a script start may wait for its job, within its bound.");let S=(B)=>{let G=bt(e);return _r(G,jr(JSON.stringify({...B,type:"job",version:2,generation:G.generation,id:An()})),f)},x=await S(w);if(_===void 0)return x;let W=Date.now()+_,R=x;while(R.ok&&["starting","running"].includes(R.job.state)&&R.job.output.length<ra&&na(R.job)<ta&&!f.aborted&&Date.now()<W){if(await new Promise((B)=>setTimeout(B,Math.min(ea,W-Date.now()))),f.aborted)break;try{let B=await S({jobId:w.jobId,action:"inspect",input:{after:0}});if(!B.ok)break;R=B}catch{break}}return R}function bt(e){if(e.expiresAtMs<=Date.now())throw new r("hands_jobs_unavailable","Hands authority expired.");let l=e.readIdentity?e.readIdentity():e;if(!l||!H(l.generation)||!L(l.fenceId)||l.generation<e.generation||l.generation===e.generation&&l.fenceId!==e.fenceId)throw new r("hands_jobs_unavailable","The live Hands fencing identity could not be verified.");return e.generation=l.generation,e.fenceId=l.fenceId,{...e}}function _r(e,l,f){if(f.aborted)return Promise.reject(new r("cancelled","Job control was cancelled."));return new Promise((_,w)=>{let S=Wi(e.socketPath),x="",W=!1,R,B=(U,D)=>{if(W)return;if(W=!0,clearTimeout(R),f.removeEventListener("abort",G),S.destroy(),U)w(U);else _(D)},G=()=>B(new r("cancelled","Job control waiter cancelled; inspect before retrying mutations."));f.addEventListener("abort",G,{once:!0}),S.setEncoding("utf8"),R=setTimeout(()=>B(new r("hands_job_result_unknown","Job control timed out; inspect before retrying mutations.")),Math.min(1e4,Math.max(1,e.expiresAtMs-Date.now()))),S.on("error",()=>B(new r("hands_job_result_unknown","Hands job control connection failed."))),S.once("connect",()=>S.write(JSON.stringify({version:1,scopeId:e.scopeId,fenceId:e.fenceId,executorLaunchId:e.executorLaunchId,request:l})+`
 `)),S.on("data",(U)=>{if(x+=U,Buffer.byteLength(x)>Ge)B(new r("hands_job_result_unknown","Hands job result exceeded its bound."))}),S.once("end",()=>{if(Date.now()>=e.expiresAtMs){B(new r("hands_job_result_unknown","Hands authority expired before the result was acknowledged."));return}try{let U=Hr(x.trim());if(U.id!==l.id||U.generation!==e.generation||U.ok&&U.job.jobId!==l.jobId)throw Error("identity");B(void 0,U)}catch{B(new r("hands_job_result_unknown","Hands job response identity or shape was invalid."))}}),S.once("close",()=>{if(!W)B(new r("hands_job_result_unknown","Hands job control closed before an acknowledged result."))})})}function Zo(e){let l=qr(e.root),f=e.authority,_=Date.parse(e.leaseUntil),w=()=>{if(e.signal.throwIfAborted(),!Number.isFinite(_)||_<=Date.now())throw Error("local_device_gh_lease_expired")};if(w(),f.readOnly&&f.generation===null)return{root:l,readOnly:!0,signal:e.signal,deadlineMs:_,assertCurrent:w};let S=$r(l,e.runId),x=hr.get(S),W=x?.binding;if(!W?.environment||!W.workspace||W.localGithubConfinement!==!0)throw Error("local_device_gh_confinement_unavailable");let R=W.environment.current(),B=()=>{w();let U=W.environment.current(),D=bt(W);if(hr.get(S)!==x||U.github_auth!=="local_gh"||U.run_id!==W.runId||f.runId!==e.runId||U.device_id!==f.deviceId||U.root_id!==f.rootId||String(U.binding.root_grant_revision)!==f.rootRevision||U.binding.target_generation!==f.generation||U.binding.target_fence_id!==f.fenceId||D.generation!==f.generation||D.fenceId!==f.fenceId||U.snapshot_id!==R.snapshot_id||U.revision!==R.revision)throw Error("local_device_gh_authority_changed")};B();let G=ie(l,W.workspace);return{root:G.boundary,signal:e.signal,deadlineMs:_,privateDirectory:zi(W.environment.path),repoPath:G.path,readOnly:f.readOnly,forbiddenSecretValues:Object.values(R.variables),secretNames:(U)=>Object.entries(R.variables).filter(([,D])=>D.trim()===U.trim()).map(([D])=>`variable ${D}`),assertCurrent:B}}async function so(e,l){let f=Pe.parse(e.request),_=oe.parse(e.authority);if(_.contributorRefresh&&f.kind==="read"&&_.readOnly)return l(Zo(e));let w=Boolean(_.contributorRefresh);if(w&&(_.merge||f.kind!=="pr_mutation"||f.mutation.action!=="edit"||typeof f.mutation.body!=="string"||f.mutation.title!==void 0||f.mutation.base!==void 0||_.readOnly||_.runId!==e.runId||_.repoFullName!==f.repoFullName))throw Error("local_device_gh_contributor_refresh_authority_invalid");if(f.kind!=="pr_merge"&&!w){if(_.merge)throw Error("local_device_gh_merge_authority_invalid");return l(Zo(e))}if(!w&&(!_.merge||_.readOnly||_.runId!==e.runId||_.repoFullName!==f.repoFullName||_.merge.source==="agent"&&(_.generation===null||_.fenceId===null)))throw Error("local_device_gh_merge_authority_invalid");let S=qr(e.root),x=Ht(S),W=Date.parse(e.leaseUntil);if(!Number.isFinite(W)||W<=Date.now())throw Error("local_device_gh_lease_expired");let R=qr(ns());if(R===S||R.startsWith(S+In))throw Error("local_device_gh_private_scope_unavailable");let B=rs(ot(R,"reason-gh-merge-"));try{gt(B);let G=()=>{if(e.signal.throwIfAborted(),Date.now()>=W)throw Error("local_device_gh_lease_expired");let U=Ht(e.root);if(U.isSymbolicLink()||U.dev!==x.dev||U.ino!==x.ino||qr(e.root)!==S)throw Error("local_device_gh_authority_changed");gt(B)};return G(),await l({root:S,readOnly:!1,privateDirectory:B,forbiddenSecretValues:[],signal:e.signal,deadlineMs:W,assertCurrent:G})}finally{Pn(B,{recursive:!0,force:!0})}}var ds=43200000;function wt(e){return Number.isSafeInteger(e)&&Math.abs(e)<=8640000000000000?e:null}function as(e){return e!==null&&typeof e==="object"&&!Array.isArray(e)}function cs(e,l){return Object.keys(e).length===l.length&&l.every((f)=>Object.hasOwn(e,f))}function ao(e){if(!as(e)||!cs(e,["version","outcome","clock_source","validation_now_ms","expiry_ms","remaining_ms","maximum_lifetime_ms","cli_artifact"])||e.version!==1||e.maximum_lifetime_ms!==43200000||typeof e.outcome!=="string"||!["accepted","parse","noncanonical","expired","over_cap"].includes(e.outcome)||typeof e.clock_source!=="string"||!["date_now","injected"].includes(e.clock_source))return null;for(let _ of["validation_now_ms","expiry_ms"]){let w=e[_];if(w!==null&&(typeof w!=="number"||wt(w)===null))return null}if(e.remaining_ms!==null&&(typeof e.remaining_ms!=="number"||!Number.isSafeInteger(e.remaining_ms)))return null;let l=typeof e.expiry_ms==="number"&&typeof e.validation_now_ms==="number"?e.expiry_ms-e.validation_now_ms:null;if(e.remaining_ms!==(l!==null&&Number.isSafeInteger(l)?l:null))return null;if(e.outcome==="parse"&&e.expiry_ms!==null)return null;if(e.outcome!=="parse"&&e.expiry_ms===null)return null;if(e.outcome==="expired"&&!(typeof l==="number"&&l<=0))return null;if(e.outcome==="over_cap"&&!(typeof l==="number"&&l>43200000))return null;if(e.outcome==="accepted"&&!(typeof l==="number"&&l>0&&l<=43200000))return null;let f=e.cli_artifact;if(!as(f)||!cs(f,["kind","status","sha256","observed_at_ms"])||f.observed_at_ms!==null&&(typeof f.observed_at_ms!=="number"||wt(f.observed_at_ms)===null))return null;if(f.kind==="entrypoint_file"){if(f.status!=="observed"||typeof f.sha256!=="string"||!/^[a-f0-9]{64}$/.test(f.sha256)||f.observed_at_ms===null)return null}else if(f.kind!=="unavailable"||f.sha256!==null||typeof f.status!=="string"||!["unsupported_entrypoint","read_failed","file_changed","size_limit","time_limit"].includes(f.status))return null;return e}var Tn=c({kind:s(["workspace_source","mcp_control"]),target_revision:o().int().nonnegative(),root_grant_revision:o().int().positive()}),ls=new RegExp(lt.tokenPattern),oa=c({token_url:At().max(2048),request_token:t().min(1).max(8192).regex(ls),aws_credentials_url:At().max(2048).nullable()});function us(e,l){let f=(_,w)=>{try{let S=new URL(_);return S.origin===new URL(l).origin&&S.pathname===w&&!S.username&&!S.password&&!S.search&&!S.hash}catch{return!1}};if(!ls.test(e.request_token)||!f(e.token_url,lt.tokenPath)||e.aws_credentials_url!==null&&!f(e.aws_credentials_url,lt.awsPath))return null;return{REASON_OIDC_TOKEN_URL:e.token_url,REASON_OIDC_REQUEST_TOKEN:e.request_token,...e.aws_credentials_url!==null?{AWS_CONTAINER_CREDENTIALS_FULL_URI:e.aws_credentials_url,AWS_CONTAINER_AUTHORIZATION_TOKEN:e.request_token}:{}}}function fs(e){return new TextEncoder().encode(e).byteLength}function sa(e){return fs(JSON.stringify(e)+`
 `)}var yr=c({version:i(1),snapshot_id:k(),revision:o().int().positive(),run_id:t().min(1).max(160),device_id:k(),root_id:k(),binding:Tn.extend({target_generation:o().int().positive(),target_fence_id:k()}),expires_at:y.datetime({offset:!0}),variables:ee(t().max(128).regex(Lt),t().refine((e)=>!e.includes("\x00")&&fs(e)<=V.valueBytes)).refine((e)=>Object.keys(e).length<=V.variables),github_auth:i("local_gh").optional(),git:c({base_url:At().max(2048),token:t().min(1).max(4096).regex(/^[A-Za-z0-9._~-]+$/),expires_at:y.datetime({offset:!0})}).nullable(),cloud_access:oa.optional()}).refine((e)=>e.github_auth!=="local_gh"||e.git===null,"conflicting git authority").refine((e)=>sa(e)<=V.snapshotBytes,"snapshot too large");import{spawn as ia}from"child_process";import{basename as aa,isAbsolute as Au}from"path";var ca=0,ps=120000,_s=15000,da=65536;function Dn(e=process.execPath,l=process.argv[1]){let f=aa(e),_=(f.startsWith("bun")||f.startsWith("node"))&&typeof l==="string"&&l.length>0;return{command:e,prefix:_?[l]:[]}}function co(e={}){let{command:l,prefix:f}=Dn(e.executablePath,e.sourceEntrypoint),_=e.spawnProcess??ia,w=e.now??Date.now,S=null,x=0,W=!1,R=(G)=>{try{G.kill("SIGKILL")}catch{}},B=()=>{if(W)return;if(S&&w()-x<ps-_s)return;if(S){let U=S;S=null,R(U)}let G;try{G=_(l,[...f,"__device","__hands-worker","--handoff-fd",String(ca)],{cwd:"/",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin"},shell:!1,stdio:["pipe","ignore","pipe"]})}catch{return}S=G,x=w(),G.on("error",()=>{if(S===G)S=null}),G.once("exit",(U,D)=>{if(S!==G)return;S=null,e.log?.("hands.worker_prespawn_exited",{exit_code:U,exit_signal:D})}),e.log?.("hands.worker_prespawned",{pid:G.pid??null})};return{arm:B,take(G){let U=S;if(!U||W)return null;let D=G.args.at(-1),re=G.options.env,J=G.options.cwd,z=[...f,"__device","__hands-worker","--config"];if(G.command!==l||G.args.length!==z.length+1||z.some((Re,Fe)=>G.args[Fe]!==Re)||typeof D!=="string"||!re||typeof J!=="string"||G.options.shell||JSON.stringify(G.options.stdio)!==JSON.stringify(["ignore","ignore","pipe"]))return null;S=null;let fe=U.stdin,ke={configPath:D,cwd:J,env:Object.fromEntries(Object.entries(re).filter((Re)=>typeof Re[1]==="string"))},be=JSON.stringify(ke);if(U.exitCode!==null||U.signalCode!==null||!fe||fe.destroyed||w()-x>=ps-_s||Buffer.byteLength(be,"utf8")>da)return R(U),null;return fe.on("error",()=>{return}),fe.end(be),U.once("exit",()=>{B()}),e.log?.("hands.worker_prespawn_taken",{pid:U.pid??null}),U},adopt(G){G.once("exit",()=>{B()})},close(){if(W=!0,S)R(S);S=null}}}import{accessSync as ma,constants as ha,statSync as ga}from"fs";import{homedir as ba,tmpdir as wa,userInfo as ya}from"os";import{delimiter as va,win32 as ka}from"path";var la=new Set(["ALL_PROXY","BUN_BE_BUN","BUN_OPTIONS","CURL_CA_BUNDLE","GIT_SSL_CAINFO","GRPC_DEFAULT_SSL_ROOTS_FILE_PATH","HTTPS_PROXY","HTTP_PROXY","NO_PROXY","NODE_EXTRA_CA_CERTS","NODE_OPTIONS","NODE_TLS_REJECT_UNAUTHORIZED","REQUESTS_CA_BUNDLE","SSLKEYLOGFILE","SSL_CERT_DIR","SSL_CERT_FILE","all_proxy","http_proxy","https_proxy","no_proxy"]);var ua=["BUN_CONFIG_","BUN_INSPECT","DYLD_","NODE_DEBUG"],fa=new Set(["BUN_INSTALL"]);var pa=/^--(?:max-old-space-size|max-semi-space-size|stack-size)=\d{1,9}$/;function _a(e){return(e??"").split(/\s+/).filter(Boolean).every((l)=>pa.test(l.replaceAll("_","-")))}function ms(e){return Object.keys(e).filter((l)=>la.has(l)&&!(l==="NODE_OPTIONS"&&_a(e[l]))||ua.some((f)=>l.startsWith(f))||l.startsWith("BUN_")&&!fa.has(l)).sort()}var Sa=new Set(["HOME","PATH","PWD","OLDPWD","SHLVL","_","TMPDIR","TMP","TEMP","SHELL","BASH_ENV","ENV","ZDOTDIR","PROMPT_COMMAND","IFS","CDPATH","GLOBIGNORE","SHELLOPTS","BASHOPTS","NODE_PATH"]),Ea=/^(?:ARA_|REASON_|PI_|GIT_|GH_|GITHUB_|LD_|DYLD_|BUN_|BASH_FUNC_|SSH_)/,Ra=/TOKEN|SECRET|PASSW|PASSPHRASE|CREDENTIAL|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|AUTH/i,Oa=/^[A-Za-z_][A-Za-z0-9_]*$/;function wr(e=process.env){let l=(w)=>{if(!(process.platform==="win32"?ka.isAbsolute(w):w.startsWith("/"))||/[\0\r\n]/.test(w)||w.length>32768)throw Error("invalid_host_execution_environment");return w};if(e.PATH!==void 0&&(/[\0\r\n]/.test(e.PATH)||e.PATH.length>32768))throw Error("invalid_host_execution_environment");let f=new Set(ms(e)),_=Object.fromEntries(Object.entries(e).filter((w)=>{let[S,x]=w;return typeof x==="string"&&x.length<=32768&&!x.includes("\x00")&&S.length<=128&&Oa.test(S)&&!f.has(S)&&!Sa.has(S)&&!Ea.test(S)&&!Ra.test(S)}).sort(([w],[S])=>w.localeCompare(S)).slice(0,512));return{home:l(e.HOME||(process.platform==="win32"?e.USERPROFILE:void 0)||ba()),path:((w)=>process.platform==="win32"?kn(w):w)(Ar(e.PATH??"").join(va)||Cr),temporaryDirectory:l(e.TMPDIR||e.TMP||e.TEMP||wa()),variables:_}}function br(e=process.env,l=()=>ya().shell){if(process.platform==="win32")return se();let f=(w)=>{if(!w||!/^\/[A-Za-z0-9._/-]*\/(?:bash|zsh)$/.test(w))return!1;try{return ma(w,ha.X_OK),ga(w).isFile()}catch{return!1}};if(f(e.SHELL))return e.SHELL;let _;try{_=l()}catch{_=void 0}return f(_)?_:"/bin/zsh"}import{readdir as xa}from"fs/promises";var Pa=15000;function wn(e){let l=e instanceof Error&&"code"in e?e.code:null;return l==="EPERM"||l==="EACCES"}function bn(e){return new r("folder_access_denied",`macOS blocked Reason from opening ${e}. Allow Reason in System Settings \u203A Privacy & Security \u203A Files and Folders `+"(or Full Disk Access), then restart the Reason app or worker on this Mac and try again: until it restarts it keeps the earlier refusal.")}async function hs(e,{timeoutMs:l=Pa,open:f=(_)=>xa(_)}={}){let _,w=new Promise((S)=>{_=setTimeout(()=>S("pending"),l)});try{if(await Promise.race([f(e).then(()=>"open"),w])==="pending")throw new r("folder_access_pending",`macOS is asking whether Reason may open ${e}. Answer the prompt on this Mac, then try again.`)}catch(S){if(wn(S))throw bn(e);if(S instanceof r)throw S}finally{clearTimeout(_)}}import{chmodSync as ic,closeSync as ac,constants as Kn,fstatSync as cc,lstatSync as Ns,openSync as dc,readSync as lc,realpathSync as Gn,unlinkSync as uc}from"fs";import{lookup as fc}from"dns/promises";import{createRequire as pc}from"module";import{request as _c}from"http";import{request as mc}from"https";import it from"net";import{platform as Ws}from"os";import{basename as hc,extname as gc,isAbsolute as Ls,relative as Jn,resolve as kt,sep as Vn}from"path";var gs=String.raw`
 async (roots) => {

package/bin/vm-hands/{vm-hands-entry-lite-ggyexab2.js → vm-hands-entry-lite-nbm3q38c.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Qe}from"./vm-hands-entry-lite-qdzbd077.js";import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{randomUUID as L}from"crypto";import{spawnSync as b}from"child_process";import{chmodSync as ee,cpSync as te,existsSync as x,lstatSync as A,mkdirSync as Y,readdirSync as ne,readFileSync as w,readlinkSync as re,realpathSync as T,renameSync as E,rmdirSync as ie,rmSync as g,symlinkSync as M,writeFileSync as oe}from"fs";import{dirname as I,join as u,relative as se,resolve as ce}from"path";var Yn="so.ara.cli",k=[Yn,"com.reasonmachines.cli"],F="5LJFSBRY2F";function Gr(e){return`(${e.map((t)=>`identifier "${t}"`).join(" or ")}) and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${F}"`}var G="ReasonBackgroundIdentity",$o="Contents/Helpers/ReasonPermissionTile",ae="so.ara.cli.permission-tile",Ne=Gr([ae,"com.reasonmachines.cli.permission-tile"]),v="AraBackgroundIdentity",ue="Reason",Ce=Gr(k),de=`anchor apple generic and (${k.map((e)=>`identifier "${e}"`).join(" or ")}) and certificate leaf[subject.OU] = "${F}"`;class h extends Error{code;constructor(e,t){super(t);this.code=e;this.name="MacOSBackgroundIdentityError"}}var R="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function le(e=a()){return u(e,"Library","Application Support","Reason","Background","Reason.app")}function O(e=a()){return u(e,"Library","Application Support","Ara","Background","Ara.app")}function fe(e){try{return A(e).isFile()}catch{return!1}}function D(e){return[G,v].map((t)=>u(e,"Contents","MacOS",t)).find(fe)??null}function d(e){try{if(!A(e).isDirectory())return!1;let t=w(u(e,"Contents","Info.plist"),"utf8");return k.some((n)=>t.includes(`<string>${n}</string>`))&&(t.includes(`<string>${ue}</string>`)||t.includes("<string>Ara</string>"))&&D(e)!==null}catch{return!1}}function Kr(e=a()){let t=le(e);if(!d(t))return null;try{let n=w(u(t,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(n)?.[1]??null}catch{return null}}function pe(e,t=a()){let n=Kr(t);return n===null||j(N(n.split(".")),N(e.split(/[.-]/).slice(0,3)))}var ge=1e4;function K(e,t){return b(e,[...t],{stdio:"ignore",timeout:ge}).status??1}var W=new Set;function H(e){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let t=(n)=>{try{return T(n)}catch{return ce(n)}};if(e!==void 0&&t(e)!==t(a()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var V=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.(?:ara|reason)(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,J=new Set(["ara","ara.exe","reason","reason.exe"]);function N(e){return e.map((t)=>Number(t))}function j(e,t){for(let n=0;n<3;n+=1)if(e[n]!==t[n])return e[n]<t[n];return!1}var ye=[0,2,161];function me(e){if(e===null)return!0;let t=ye,n=null;try{n=T(process.execPath)}catch{}return e.some((r)=>{let i=V.exec(r);if(i){let f=i[1]===void 0?i.slice(4,7):i.slice(1,4);return j(N(f),t)}let o=r.slice(r.lastIndexOf("/")+1);return J.has(o)&&r!==n&&r!==process.execPath})}function Ee(){let e=b("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(e.status!==0)return null;let t=[];for(let n of e.stdout.split(`
+import{Qe}from"./vm-hands-entry-lite-facs6ec3.js";import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{randomUUID as L}from"crypto";import{spawnSync as b}from"child_process";import{chmodSync as ee,cpSync as te,existsSync as x,lstatSync as A,mkdirSync as Y,readdirSync as ne,readFileSync as w,readlinkSync as re,realpathSync as T,renameSync as E,rmdirSync as ie,rmSync as g,symlinkSync as M,writeFileSync as oe}from"fs";import{dirname as I,join as u,relative as se,resolve as ce}from"path";var Yn="so.ara.cli",k=[Yn,"com.reasonmachines.cli"],F="5LJFSBRY2F";function Gr(e){return`(${e.map((t)=>`identifier "${t}"`).join(" or ")}) and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${F}"`}var G="ReasonBackgroundIdentity",$o="Contents/Helpers/ReasonPermissionTile",ae="so.ara.cli.permission-tile",Ne=Gr([ae,"com.reasonmachines.cli.permission-tile"]),v="AraBackgroundIdentity",ue="Reason",Ce=Gr(k),de=`anchor apple generic and (${k.map((e)=>`identifier "${e}"`).join(" or ")}) and certificate leaf[subject.OU] = "${F}"`;class h extends Error{code;constructor(e,t){super(t);this.code=e;this.name="MacOSBackgroundIdentityError"}}var R="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function le(e=a()){return u(e,"Library","Application Support","Reason","Background","Reason.app")}function O(e=a()){return u(e,"Library","Application Support","Ara","Background","Ara.app")}function fe(e){try{return A(e).isFile()}catch{return!1}}function D(e){return[G,v].map((t)=>u(e,"Contents","MacOS",t)).find(fe)??null}function d(e){try{if(!A(e).isDirectory())return!1;let t=w(u(e,"Contents","Info.plist"),"utf8");return k.some((n)=>t.includes(`<string>${n}</string>`))&&(t.includes(`<string>${ue}</string>`)||t.includes("<string>Ara</string>"))&&D(e)!==null}catch{return!1}}function Kr(e=a()){let t=le(e);if(!d(t))return null;try{let n=w(u(t,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(n)?.[1]??null}catch{return null}}function pe(e,t=a()){let n=Kr(t);return n===null||j(N(n.split(".")),N(e.split(/[.-]/).slice(0,3)))}var ge=1e4;function K(e,t){return b(e,[...t],{stdio:"ignore",timeout:ge}).status??1}var W=new Set;function H(e){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let t=(n)=>{try{return T(n)}catch{return ce(n)}};if(e!==void 0&&t(e)!==t(a()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var V=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.(?:ara|reason)(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,J=new Set(["ara","ara.exe","reason","reason.exe"]);function N(e){return e.map((t)=>Number(t))}function j(e,t){for(let n=0;n<3;n+=1)if(e[n]!==t[n])return e[n]<t[n];return!1}var ye=[0,2,161];function me(e){if(e===null)return!0;let t=ye,n=null;try{n=T(process.execPath)}catch{}return e.some((r)=>{let i=V.exec(r);if(i){let f=i[1]===void 0?i.slice(4,7):i.slice(1,4);return j(N(f),t)}let o=r.slice(r.lastIndexOf("/")+1);return J.has(o)&&r!==n&&r!==process.execPath})}function Ee(){let e=b("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(e.status!==0)return null;let t=[];for(let n of e.stdout.split(`
 `)){let r=/^\s*(\d+)\s+(\S.*)$/.exec(n);if(!r||Number(r[1])===process.pid)continue;let i=r[2].trimEnd(),o=i.slice(i.lastIndexOf("/")+1);if(!V.test(i)&&J.has(o)){let c=b("/usr/sbin/lsof",["-a","-p",r[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
 `).find((l)=>l.startsWith("n/"));if(c)i=c.slice(1)}t.push(i)}return t}function _e(e){if(H(e.home),!d(e.sourceApp))throw new h("identity_invalid","The packaged Reason background identity is missing or invalid.");let t=e.command??K,n=le(e.home),r=I(n);Y(r,{recursive:!0,mode:448}),ee(r,448);let i=T(e.sourceApp),o=null;try{o=T(n)}catch{}if(i!==o){let f=`${process.pid}.${L()}`,c=u(r,`.Reason.app.${f}.tmp`),l=u(r,`.Reason.app.${f}.old`),y=!1;try{if(te(i,c,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!d(c))throw new h("identity_invalid","The copied Reason background identity is invalid.");let _=e.releaseSigned?["--test-requirement",`=${de}`]:[];if(t("/usr/bin/codesign",["--verify","--strict",..._,c])!==0)throw new h("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let S=!1;for(let p=0;p<4;p+=1){let m=!1;try{E(n,l),m=!0,y=!0}catch(s){if(s.code!=="ENOENT")throw s}if(p===0)e.beforePublish?.();try{E(c,n),S=!0}catch(s){let Z=s.code;if(!["EEXIST","ENOTEMPTY"].includes(Z??""))throw s;if(m)g(l,{recursive:!0,force:!0}),y=!1;if(p===3)throw s;continue}if(m)g(l,{recursive:!0,force:!0}),y=!1;break}if(!S)throw Error("Could not publish Reason's background identity.")}catch(_){if(y&&!x(n)&&x(l))E(l,n);throw _}finally{g(c,{recursive:!0,force:!0}),g(l,{recursive:!0,force:!0})}}return z(n,e,{verified:i!==o}),n}function X(e){return u(I(e),".Reason.app.registered")}function q(e){try{let t=A(e);return t.isDirectory()?`${t.ino}:${t.birthtimeMs}`:null}catch{return null}}function C(e){let t=q(e);try{return t!==null&&w(X(e),"utf8")===t}catch{return!1}}function Q(e){if(d(e))return"bundle";try{if(A(u(e,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return A(u(e,"Contents","MacOS",v)).isSymbolicLink()?"retired":null}catch{return null}}function z(e,t,n={}){let r=t.command??K;if(!n.verified&&r("/usr/bin/codesign",["--verify","--strict",e])!==0)throw new h("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if(r(R,["-f",e])!==0)throw new h("identity_register_failed","Could not register Reason's macOS background identity.");let i=q(e);try{if(i)oe(X(e),i,{mode:384})}catch{}try{Se(e,t.home,r,t.runningExecutables??Ee)}catch(o){let f=o.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${f})
 `)}}function Se(e,t,n,r){let i=D(e);if(!i)return;let o=O(t),f=I(o),c=(s)=>u(s,"Contents","MacOS",v),l=se(I(c(o)),i),y=`${process.pid}.${L()}`,_=Q(o);if(_===null)return;let S=_==="bundle";if(S)n(R,["-u",o]);let p=u(f,`.Ara.app.${y}.old`);if(!W.has(o)&&!me(r())){if(!S)n(R,["-u",o]);try{E(o,p)}catch(s){if(s.code==="ENOENT")return;throw s}g(p,{recursive:!0,force:!0}),Ie(f);return}if(!S){if(re(c(o))===l)return;let s=`${c(o)}.${y}`;M(l,s);try{E(s,c(o))}finally{g(s,{force:!0})}return}let m=u(f,`.Ara.app.${y}.shim`);Y(I(c(m)),{recursive:!0}),M(l,c(m));try{try{E(o,p)}catch(s){if(s.code==="ENOENT")return;throw s}try{E(m,o)}catch(s){if(x(o))return;throw E(p,o),s}}finally{g(m,{recursive:!0,force:!0}),g(p,{recursive:!0,force:!0})}}function Ie(e){try{if(ne(e).some((n)=>n!==".DS_Store"))return;g(u(e,".DS_Store"),{force:!0}),ie(e)}catch{}}var B=new Map;function Zn(e=a()){let t=B.get(e);if(t)return t;if(process.platform!=="darwin")return[];let n=U(e);if(n===null&&x(I(le(e))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),n=U(e);if(n===null)return[];return B.set(e,n),n}function U(e){let t=le(e),n=O(e);if(!d(t)||!C(t))try{he({home:e,skipWhenSettled:!0})}catch{}let r=d(t)&&(C(t)||!d(n))?t:d(n)?n:null,i=r?D(r):null;if(!i)return null;if(r===n)W.add(n);let o=b(i,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return o.status===0&&o.stdout===`spawn

package/bin/vm-hands/{vm-hands-entry-lite-rp2twenv.js → vm-hands-entry-lite-nn8s6jny.js}

@@ -1,3 +1,3 @@
 // @bun
-import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{readdirSync as b,readFileSync as P}from"fs";import{userInfo as k}from"os";var ur="--vm-hands-op-runner-kind=person",dr="--vm-hands-op-runner-kind=surface",Rt="--vm-hands-surface-uid=",Tt="--vm-hands-surface-dir=",It=new Set(["automation.call.v1","display.stream.v1","preview.serve.v1"]);function R(t){let c=new Set([t]),l=[];try{l=b("/proc")}catch{}for(let o of l){if(!/^\d+$/.test(o))continue;try{let d=P(`/proc/${o}/stat`,"utf8");if(Number(d.slice(d.lastIndexOf(")")+2).split(" ")[3])===t)c.add(Number(o))}catch{}}for(let o of c)try{process.kill(o,"SIGKILL")}catch{}}var A=(t)=>{let c=globalThis.Bun;if(!c)throw new r("pty_unavailable","Reason terminals require the Bun runtime.");let l=c.spawn({cmd:[t.shell,...t.args],cwd:t.cwd,env:{...t.environment,TERM:"xterm-256color"},terminal:{cols:t.cols,rows:t.rows,data:(i,s)=>t.onData(s)}}),o=l.terminal,d=()=>{R(l.pid);try{o?.close()}catch{}};if(!o)throw d(),new r("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(i)=>o.write(i),resize:(i,s)=>o.resize(i,s),kill:d,exited:l.exited.then((i)=>typeof i==="number"?i:null,()=>null)}};function x(){let t=(()=>{try{return k().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...t?{USER:t,LOGNAME:t}:{}}}async function E(t){let[{localAutomationAvailable:c},{localDisplayReady:l},{localDisplayVideoAvailable:o},{probeWorkerPreview:d},y]=await Promise.all([import("./local-automation-c75g446p.js"),import("./local-display-session-hvbp46qx.js"),import("./local-display-video-yh6hfavd.js"),import("./worker-preview-readiness-gy36ejp9.js"),import("fs")]),i=AbortSignal.timeout(15000),s=null;try{y.mkdirSync(t,{recursive:!0,mode:448}),s=y.mkdtempSync(`${t}/probe-`);let[g,p,m]=await Promise.all([Promise.resolve().then(()=>c()).catch(()=>!1),l().catch(()=>!1),d(s,i).catch(()=>!1)]);return{t:"readiness",display_video:p&&await o().catch(()=>!1),lanes:{"automation.call.v1":g,"display.stream.v1":p,"preview.serve.v1":m,"tunnel.open":m,"tunnel.close":m}}}finally{if(s)y.rmSync(s,{recursive:!0,force:!0})}}async function vs(){let[{executeLocalOperation:t,spawnCaptured:c},{runLocalPtySession:l},{configureDesktopAccount:o,desktopAccount:d},{configureWorkerSandbox:y}]=await Promise.all([import("./local-capabilities-1kcxmz0s.js"),import("./local-pty-session-njd0tprg.js"),import("./desktop-account-t0afsge2.js"),import("./worker-sandbox-f1tfb3y0.js")]);y();let i=process.argv.includes(ur),s=process.argv.includes(dr),g=(a,e,u)=>c(a,e[0]==="-lic"?["-lc",...e.slice(1)]:e,u),p=(process.geteuid?.()??0)!==0;if(s){p=!1;let a=process.argv.find((e)=>e.startsWith(Rt))?.slice(Rt.length);if((process.geteuid?.()??-1)===0&&a)try{p=o({value:a})!==null&&d()!==null}catch{p=!1}}let m=new Map,v=new Map,f=(a)=>{try{process.send?.(a)}catch{}};if(process.on("message",(a)=>{let e=a;if(e?.t==="cancel"){m.get(e.id)?.abort();return}if(e?.t==="control"){let n=v.get(e.id);if(s&&n&&e.control&&typeof e.control.kind==="string")import("./local-managed-process-g6vsy02z.js").then(({controlManagedDeviceProcess:_})=>_(n,{kind:e.control.kind,payload:e.control.payload??{}})).catch(()=>!1);return}if(e?.t==="retire"){if(s&&typeof e.operation_id==="string"&&typeof e.status==="string")import("./local-managed-process-g6vsy02z.js").then(({retireManagedDeviceProcess:n})=>n(e.operation_id,e.status)).catch(()=>!1);return}if(e?.t!=="op")return;if(!p){f({t:"done",id:e.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let u=e.claim.capability;if(u==="pty.start"&&!i){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}if(It.has(u)!==s){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}let w=new AbortController;m.set(e.id,w),v.set(e.id,e.claim);let S=u==="pty.start"?{runPtySession:(n)=>l(n,{spawnPty:A,environment:x(),loadProxy:()=>null})}:{worker:e.worker,...u==="exec.full"?{spawnFullControl:g}:{}};t(e.state,e.claim,{...S,signal:w.signal,emit:(n)=>{let{deliverySignal:_,...h}=n;f({t:"event",id:e.id,event:h})}}).then((n)=>f({t:"done",id:e.id,completion:n}),(n)=>f({t:"done",id:e.id,completion:{status:"failed",error_code:n&&typeof n==="object"&&"code"in n&&typeof n.code==="string"?n.code:"vm_hands_op_failed"}})).finally(()=>{m.delete(e.id),v.delete(e.id)})}),process.on("disconnect",()=>process.exit(0)),s){let a=process.argv.find((u)=>u.startsWith(Tt))?.slice(Tt.length),e={t:"readiness",display_video:!1,lanes:{}};f(p&&a?await E(a).catch(()=>e):e)}await new Promise(()=>{})}
+import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{readdirSync as b,readFileSync as P}from"fs";import{userInfo as k}from"os";var ur="--vm-hands-op-runner-kind=person",dr="--vm-hands-op-runner-kind=surface",Rt="--vm-hands-surface-uid=",Tt="--vm-hands-surface-dir=",It=new Set(["automation.call.v1","display.stream.v1","preview.serve.v1"]);function R(t){let c=new Set([t]),l=[];try{l=b("/proc")}catch{}for(let o of l){if(!/^\d+$/.test(o))continue;try{let d=P(`/proc/${o}/stat`,"utf8");if(Number(d.slice(d.lastIndexOf(")")+2).split(" ")[3])===t)c.add(Number(o))}catch{}}for(let o of c)try{process.kill(o,"SIGKILL")}catch{}}var A=(t)=>{let c=globalThis.Bun;if(!c)throw new r("pty_unavailable","Reason terminals require the Bun runtime.");let l=c.spawn({cmd:[t.shell,...t.args],cwd:t.cwd,env:{...t.environment,TERM:"xterm-256color"},terminal:{cols:t.cols,rows:t.rows,data:(i,s)=>t.onData(s)}}),o=l.terminal,d=()=>{R(l.pid);try{o?.close()}catch{}};if(!o)throw d(),new r("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(i)=>o.write(i),resize:(i,s)=>o.resize(i,s),kill:d,exited:l.exited.then((i)=>typeof i==="number"?i:null,()=>null)}};function x(){let t=(()=>{try{return k().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...t?{USER:t,LOGNAME:t}:{}}}async function E(t){let[{localAutomationAvailable:c},{localDisplayReady:l},{localDisplayVideoAvailable:o},{probeWorkerPreview:d},y]=await Promise.all([import("./local-automation-y7zanv07.js"),import("./local-display-session-fnk3yjy0.js"),import("./local-display-video-9x1sc6t3.js"),import("./worker-preview-readiness-gy36ejp9.js"),import("fs")]),i=AbortSignal.timeout(15000),s=null;try{y.mkdirSync(t,{recursive:!0,mode:448}),s=y.mkdtempSync(`${t}/probe-`);let[g,p,m]=await Promise.all([Promise.resolve().then(()=>c()).catch(()=>!1),l().catch(()=>!1),d(s,i).catch(()=>!1)]);return{t:"readiness",display_video:p&&await o().catch(()=>!1),lanes:{"automation.call.v1":g,"display.stream.v1":p,"preview.serve.v1":m,"tunnel.open":m,"tunnel.close":m}}}finally{if(s)y.rmSync(s,{recursive:!0,force:!0})}}async function vs(){let[{executeLocalOperation:t,spawnCaptured:c},{runLocalPtySession:l},{configureDesktopAccount:o,desktopAccount:d},{configureWorkerSandbox:y}]=await Promise.all([import("./local-capabilities-rtcfcjzp.js"),import("./local-pty-session-njd0tprg.js"),import("./desktop-account-t0afsge2.js"),import("./worker-sandbox-f1tfb3y0.js")]);y();let i=process.argv.includes(ur),s=process.argv.includes(dr),g=(a,e,u)=>c(a,e[0]==="-lic"?["-lc",...e.slice(1)]:e,u),p=(process.geteuid?.()??0)!==0;if(s){p=!1;let a=process.argv.find((e)=>e.startsWith(Rt))?.slice(Rt.length);if((process.geteuid?.()??-1)===0&&a)try{p=o({value:a})!==null&&d()!==null}catch{p=!1}}let m=new Map,v=new Map,f=(a)=>{try{process.send?.(a)}catch{}};if(process.on("message",(a)=>{let e=a;if(e?.t==="cancel"){m.get(e.id)?.abort();return}if(e?.t==="control"){let n=v.get(e.id);if(s&&n&&e.control&&typeof e.control.kind==="string")import("./local-managed-process-x1dpdcbd.js").then(({controlManagedDeviceProcess:_})=>_(n,{kind:e.control.kind,payload:e.control.payload??{}})).catch(()=>!1);return}if(e?.t==="retire"){if(s&&typeof e.operation_id==="string"&&typeof e.status==="string")import("./local-managed-process-x1dpdcbd.js").then(({retireManagedDeviceProcess:n})=>n(e.operation_id,e.status)).catch(()=>!1);return}if(e?.t!=="op")return;if(!p){f({t:"done",id:e.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let u=e.claim.capability;if(u==="pty.start"&&!i){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}if(It.has(u)!==s){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}let w=new AbortController;m.set(e.id,w),v.set(e.id,e.claim);let S=u==="pty.start"?{runPtySession:(n)=>l(n,{spawnPty:A,environment:x(),loadProxy:()=>null})}:{worker:e.worker,...u==="exec.full"?{spawnFullControl:g}:{}};t(e.state,e.claim,{...S,signal:w.signal,emit:(n)=>{let{deliverySignal:_,...h}=n;f({t:"event",id:e.id,event:h})}}).then((n)=>f({t:"done",id:e.id,completion:n}),(n)=>f({t:"done",id:e.id,completion:{status:"failed",error_code:n&&typeof n==="object"&&"code"in n&&typeof n.code==="string"?n.code:"vm_hands_op_failed"}})).finally(()=>{m.delete(e.id),v.delete(e.id)})}),process.on("disconnect",()=>process.exit(0)),s){let a=process.argv.find((u)=>u.startsWith(Tt))?.slice(Tt.length),e={t:"readiness",display_video:!1,lanes:{}};f(p&&a?await E(a).catch(()=>e):e)}await new Promise(()=>{})}
 export{ur,dr,Rt,Tt,It,vs};

package/bin/vm-hands/{vm-hands-entry-lite-jha299pc.js → vm-hands-entry-lite-v5d57d52.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Je,wo,U,Xe,Jt,zr,x}from"./vm-hands-entry-lite-8mttvhef.js";import{K}from"./vm-hands-entry-lite-wghmyfba.js";import{ft}from"./vm-hands-entry-lite-2v4zh9ze.js";import{gt}from"./vm-hands-entry-lite-ggyexab2.js";import{qr}from"./vm-hands-entry-lite-h78c4zxd.js";import{Pt,Hi}from"./vm-hands-entry-lite-qd46yhvz.js";import{G,qe}from"./vm-hands-entry-lite-sqzryt00.js";import{xe,Jn}from"./vm-hands-entry-lite-6qq4f3v5.js";import{St}from"./vm-hands-entry-lite-07apxfh8.js";import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{C}from"./vm-hands-entry-lite-tyem93c1.js";import{spawn as v,spawnSync as st}from"child_process";import{createHash as it,randomUUID as ge}from"crypto";import{closeSync as at,copyFileSync as ae,existsSync as D,fstatSync as ct,mkdirSync as ce,openSync as lt,readdirSync as L,readFileSync as X,readlinkSync as ut,renameSync as he,rmSync as dt,statSync as pt,writeFileSync as mt}from"fs";import{connect as ht}from"net";import{tmpdir as B,userInfo as _e}from"os";import{basename as le,delimiter as _t,dirname as q,join as f}from"path";var z=`import { spawn, execFileSync } from "node:child_process";
+import{Je,wo,U,Xe,Jt,zr,x}from"./vm-hands-entry-lite-2c1tjew8.js";import{K}from"./vm-hands-entry-lite-wghmyfba.js";import{ft}from"./vm-hands-entry-lite-2v4zh9ze.js";import{gt}from"./vm-hands-entry-lite-nbm3q38c.js";import{qr}from"./vm-hands-entry-lite-eb0kphva.js";import{Pt,Hi}from"./vm-hands-entry-lite-qd46yhvz.js";import{G,qe}from"./vm-hands-entry-lite-vd834e5j.js";import{xe,Jn}from"./vm-hands-entry-lite-zr8r3xsa.js";import{St}from"./vm-hands-entry-lite-07apxfh8.js";import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{C}from"./vm-hands-entry-lite-tyem93c1.js";import{spawn as v,spawnSync as st}from"child_process";import{createHash as it,randomUUID as ge}from"crypto";import{closeSync as at,copyFileSync as ae,existsSync as D,fstatSync as ct,mkdirSync as ce,openSync as lt,readdirSync as L,readFileSync as X,readlinkSync as ut,renameSync as he,rmSync as dt,statSync as pt,writeFileSync as mt}from"fs";import{connect as ht}from"net";import{tmpdir as B,userInfo as _e}from"os";import{basename as le,delimiter as _t,dirname as q,join as f}from"path";var z=`import { spawn, execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
 import { tmpdir } from "node:os";

package/bin/vm-hands/{vm-hands-entry-lite-sqzryt00.js → vm-hands-entry-lite-vd834e5j.js}

@@ -1,5 +1,5 @@
 // @bun
-import{qn,Wn,Oo,Qt}from"./vm-hands-entry-lite-2v4zh9ze.js";import{Bn,Xe,bo,Fn,jn,Hn,Ur,x}from"./vm-hands-entry-lite-8mttvhef.js";import{Pt}from"./vm-hands-entry-lite-qd46yhvz.js";import{Ir}from"./vm-hands-entry-lite-0wsr8edk.js";import{j}from"./vm-hands-entry-lite-dgfx0rbn.js";import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ce,spawn as ne}from"child_process";import{randomBytes as he}from"crypto";import{chmodSync as Je,existsSync as ae,lstatSync as Qe,mkdirSync as Se,readFileSync as oe,rmSync as ie,writeFileSync as u}from"fs";import{connect as Te}from"net";import{join as I}from"path";var B=32,Y=76;var m="./desktop-wallpaper-fd8f2wb2.jpg";var v="./dock-browser-y53t41cx.png";var Z="./dock-files-cp52htdw.png";var V="./dock-terminal-1es514yq.png";var z="./grok-wallpaper-71zwn2pj.jpg";var W="./grok-dock-browser-pzw59wnd.png";var U="./grok-dock-files-eckq444x.png";var ee="./grok-dock-terminal-hcpz3e43.png";var re=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
+import{qn,Wn,Oo,Qt}from"./vm-hands-entry-lite-2v4zh9ze.js";import{Bn,Xe,bo,Fn,jn,Hn,Ur,x}from"./vm-hands-entry-lite-2c1tjew8.js";import{Pt}from"./vm-hands-entry-lite-qd46yhvz.js";import{Ir}from"./vm-hands-entry-lite-0wsr8edk.js";import{j}from"./vm-hands-entry-lite-dgfx0rbn.js";import{a}from"./vm-hands-entry-lite-8dfw96ym.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as ce,spawn as ne}from"child_process";import{randomBytes as he}from"crypto";import{chmodSync as Je,existsSync as ae,lstatSync as Qe,mkdirSync as Se,readFileSync as oe,rmSync as ie,writeFileSync as u}from"fs";import{connect as Te}from"net";import{join as I}from"path";var B=32,Y=76;var m="./desktop-wallpaper-fd8f2wb2.jpg";var v="./dock-browser-y53t41cx.png";var Z="./dock-files-cp52htdw.png";var V="./dock-terminal-1es514yq.png";var z="./grok-wallpaper-71zwn2pj.jpg";var W="./grok-dock-browser-pzw59wnd.png";var U="./grok-dock-files-eckq444x.png";var ee="./grok-dock-terminal-hcpz3e43.png";var re=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
 # The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
 # python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
 # Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE

package/bin/vm-hands/{vm-hands-entry-lite-x8wjxgwr.js → vm-hands-entry-lite-zqmv2sj8.js}

@@ -1,2 +1,2 @@
 // @bun
-import{ot,D}from"./vm-hands-entry-lite-3mn5c8wd.js";import{R}from"./vm-hands-entry-lite-a3p6xz53.js";import{_,rr}from"./vm-hands-entry-lite-4anjdcth.js";import{be}from"./vm-hands-entry-lite-yretc2th.js";function zi(e,i){let t=R(e,"REASON_API_URL")?.trim();if(!t)return rr(i);let n=new URL(t);if(n.protocol!=="https:"&&!(n.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(n.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return n.origin}function es(e){return R(e,"REASON_API_URL")?.trim()?zi(e,"production"):void 0}function ts(e){return R(e,"REASON_API_KEY")?.trim()||void 0}async function As(e,i){let t=e.env??process.env,n=ts(t);if(!n)return(e.getCredentials??ot)({apiOrigin:es(t),signal:i});let a=zi(t,e.channel??_({env:t})),o=await(e.fetchImpl??fetch)(a+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+n,accept:"application/json"},signal:i}),p=await o.json().catch(()=>({})),r=be(p)?p:{};if(!o.ok){let s=typeof r.detail==="string"?r.detail:typeof r.message==="string"?r.message:"API key authentication failed ("+o.status+")";throw new D(o.status,typeof r.error==="string"?r.error:"api_key_auth_failed",s)}if(typeof r.org_id!=="string"||!r.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let l=Array.isArray(r.scopes)?r.scopes.filter((s)=>typeof s==="string"):[];return{credentialKind:"api_key",apiOrigin:a,accessToken:n,orgId:r.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:l}}export{zi,es,ts,As};
+import{ot,D}from"./vm-hands-entry-lite-bcavepsx.js";import{R}from"./vm-hands-entry-lite-a3p6xz53.js";import{_,rr}from"./vm-hands-entry-lite-4anjdcth.js";import{be}from"./vm-hands-entry-lite-yretc2th.js";function zi(e,i){let t=R(e,"REASON_API_URL")?.trim();if(!t)return rr(i);let n=new URL(t);if(n.protocol!=="https:"&&!(n.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(n.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return n.origin}function es(e){return R(e,"REASON_API_URL")?.trim()?zi(e,"production"):void 0}function ts(e){return R(e,"REASON_API_KEY")?.trim()||void 0}async function As(e,i){let t=e.env??process.env,n=ts(t);if(!n)return(e.getCredentials??ot)({apiOrigin:es(t),signal:i});let a=zi(t,e.channel??_({env:t})),o=await(e.fetchImpl??fetch)(a+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+n,accept:"application/json"},signal:i}),p=await o.json().catch(()=>({})),r=be(p)?p:{};if(!o.ok){let s=typeof r.detail==="string"?r.detail:typeof r.message==="string"?r.message:"API key authentication failed ("+o.status+")";throw new D(o.status,typeof r.error==="string"?r.error:"api_key_auth_failed",s)}if(typeof r.org_id!=="string"||!r.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let l=Array.isArray(r.scopes)?r.scopes.filter((s)=>typeof s==="string"):[];return{credentialKind:"api_key",apiOrigin:a,accessToken:n,orgId:r.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:l}}export{zi,es,ts,As};

package/bin/vm-hands/{vm-hands-entry-lite-6qq4f3v5.js → vm-hands-entry-lite-zr8r3xsa.js}

@@ -1,5 +1,5 @@
 // @bun
-import{R}from"./vm-hands-entry-lite-a3p6xz53.js";import{_}from"./vm-hands-entry-lite-4anjdcth.js";import{Jr,ei,Xr,ti}from"./vm-hands-entry-lite-vj7xzb3y.js";import{Yn,er,Fo}from"./vm-hands-entry-lite-ggyexab2.js";import{C}from"./vm-hands-entry-lite-tyem93c1.js";import{spawnSync as y}from"child_process";import{createHash as ke,randomUUID as Se}from"crypto";import{chmodSync as we,existsSync as T,mkdirSync as $e,readdirSync as Ve,readFileSync as p,renameSync as ye,rmSync as u,statSync as ve,writeFileSync as be}from"fs";import{dirname as We,isAbsolute as q,join as g}from"path";import{spawnSync as de}from"child_process";import{readFileSync as me}from"fs";import{userInfo as D}from"os";import{join as fe}from"path";var ge="REASON_SCHEDULED_TASK";function H(r){return fe(r,"AppData","Local","Reason","Tasks")}function S(r){if(/[\0-\x1f\x7f"%]/.test(r))throw Error(`A background task cannot use a value with a double quote, percent sign or control character: ${r}`);return`'${r.replace(/['\u2018\u2019\u201a\u201b]/g,"$&$&")}'`}function M(r){if(!/^[A-Za-z0-9._-]+$/.test(r))throw Error(`Invalid Windows Scheduled Task name: ${r}`);return`$env:${ge}=${S(r)};`}function K(r){let e=Object.entries(r.environment).map(([t,i])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(t))throw Error(`Invalid Windows Scheduled Task environment name: ${t}`);return`$env:${t}=${S(i)};`}),n=`$global:LASTEXITCODE=1; & ${[r.program,...r.args].map(S).join(" ")} 2>&1 | ForEach-Object { Add-Content -LiteralPath ${S(r.log)} -Value $_.ToString() -Encoding UTF8 }; $c=$LASTEXITCODE;`;return[M(r.name),...e,"$ErrorActionPreference='Continue';",r.keepAlive?`do { ${n} if ($c) { Start-Sleep -Seconds 10 } } while ($c)`:`${n} exit $c`].join(" ")}function A(r){return r.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function pe(){let r=process.env.USERDOMAIN?.trim();return r?`${r}\\${D().username}`:D().username}function U(r){let e=A(r.user??pe()),n=r.schedule==="logon",t=r.schedule==="logon"?`<LogonTrigger><Enabled>true</Enabled><UserId>${e}</UserId></LogonTrigger>`:`<TimeTrigger><Repetition><Interval>PT${r.schedule.everyMinutes}M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition><StartBoundary>2026-01-01T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger>`,i=`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "${r.script}"`;return`<?xml version="1.0" encoding="UTF-16"?>
+import{R}from"./vm-hands-entry-lite-a3p6xz53.js";import{_}from"./vm-hands-entry-lite-4anjdcth.js";import{Jr,ei,Xr,ti}from"./vm-hands-entry-lite-vj7xzb3y.js";import{Yn,er,Fo}from"./vm-hands-entry-lite-nbm3q38c.js";import{C}from"./vm-hands-entry-lite-tyem93c1.js";import{spawnSync as y}from"child_process";import{createHash as ke,randomUUID as Se}from"crypto";import{chmodSync as we,existsSync as T,mkdirSync as $e,readdirSync as Ve,readFileSync as p,renameSync as ye,rmSync as u,statSync as ve,writeFileSync as be}from"fs";import{dirname as We,isAbsolute as q,join as g}from"path";import{spawnSync as de}from"child_process";import{readFileSync as me}from"fs";import{userInfo as D}from"os";import{join as fe}from"path";var ge="REASON_SCHEDULED_TASK";function H(r){return fe(r,"AppData","Local","Reason","Tasks")}function S(r){if(/[\0-\x1f\x7f"%]/.test(r))throw Error(`A background task cannot use a value with a double quote, percent sign or control character: ${r}`);return`'${r.replace(/['\u2018\u2019\u201a\u201b]/g,"$&$&")}'`}function M(r){if(!/^[A-Za-z0-9._-]+$/.test(r))throw Error(`Invalid Windows Scheduled Task name: ${r}`);return`$env:${ge}=${S(r)};`}function K(r){let e=Object.entries(r.environment).map(([t,i])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(t))throw Error(`Invalid Windows Scheduled Task environment name: ${t}`);return`$env:${t}=${S(i)};`}),n=`$global:LASTEXITCODE=1; & ${[r.program,...r.args].map(S).join(" ")} 2>&1 | ForEach-Object { Add-Content -LiteralPath ${S(r.log)} -Value $_.ToString() -Encoding UTF8 }; $c=$LASTEXITCODE;`;return[M(r.name),...e,"$ErrorActionPreference='Continue';",r.keepAlive?`do { ${n} if ($c) { Start-Sleep -Seconds 10 } } while ($c)`:`${n} exit $c`].join(" ")}function A(r){return r.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function pe(){let r=process.env.USERDOMAIN?.trim();return r?`${r}\\${D().username}`:D().username}function U(r){let e=A(r.user??pe()),n=r.schedule==="logon",t=r.schedule==="logon"?`<LogonTrigger><Enabled>true</Enabled><UserId>${e}</UserId></LogonTrigger>`:`<TimeTrigger><Repetition><Interval>PT${r.schedule.everyMinutes}M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition><StartBoundary>2026-01-01T00:00:00</StartBoundary><Enabled>true</Enabled></TimeTrigger>`,i=`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "${r.script}"`;return`<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
     <Description>${A(r.description)}</Description>

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,4 +1,4 @@
 // @bun
 import{ii,vt,si,ai,ci,Ii}from"./vm-hands-entry-lite-07apxfh8.js";import"./vm-hands-entry-lite-fxzadxz4.js";import{createHash as K,randomBytes as ge}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Qe,openSync as Oe,renameSync as Ze,rmSync as en,statSync as De,writeSync as Me,constants as H}from"fs";import{join as re}from"path";var nn=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:tn(e)}}function tn(e){let n=e.payload[si];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var W=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),V=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function L(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(L).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${L(e[n])}`).join(",")}}`}async function qi(e){let n=await crypto.subtle.importKey("pkcs8",V(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=V(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),g=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),h=K("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:g,fingerprint:h}}var sn=16;class pn{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;abandoned=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let g=this.bound.get(e);if(!g)return!1;if(g.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((h)=>setTimeout(h,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:nn,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:W(this.keys.signingSpki),env_public_key:W(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:W(ge(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(L(n)));return{...n,device_signature:W(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=W(ge(32)),g=Ii({method:"GET",pathAndQuery:ii,timestamp:i,nonce:s,challenge:e,bodySha256:K("sha256").update("").digest("hex")}),h=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(g)));return{t:"hello",timestamp:i,nonce:s,signature:W(rn(h)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let s of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(s))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(K("sha256").update(L({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((s)=>s.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=sn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((s)=>s.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let s,g,h=new Promise((m,S)=>{s=m,g=S});return h.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:h,resolve:s,reject:g}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(w){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(w,"the bind's kill-verify failed")}let i,s=new Promise((w)=>{i=w}),g=!1,h=!1,m=()=>{h=!0,i()},S=n.promise.then(()=>new Promise((w,I)=>{this.exclusive(async()=>{if(h){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}g=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();w()}catch(b){I(b)}await s})}));S.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:S,inTurn:()=>g,leave:m})}finally{m()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);if(this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","abandoned before its launch");s=!0;let{launchId:g,applied:h,readyData:m}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),S=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let w=null,I=null;if(e.env){let b=e.claim?.owner??{},R=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof b.device_id==="string"?b.device_id:"",rootId:e.claim?.root_id??""});w=this.hooks.installEnvironment(e.bind_id,R),I=typeof R.snapshot_id==="string"&&R.snapshot_id?R.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,R)}if(this.unbinding.has(e.bind_id)||this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:g,envInstalled:w!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:g,snapshot_revision:w,snapshot_id:I,layout:S,...m?{ready_data:m}:{},policy_digest:K("sha256").update(L({hands_confinement:h.hands_confinement??null,browser_egress:h.browser_egress??null})).digest("hex")}}catch(g){if(i)fe(i);if(s){let h=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(h);else await h()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(g,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}abandonBinding(e){if(!this.binding.has(e))return;this.abandoned.add(e),this.abandonWorkspaceGrant(e);try{this.hooks.abortExecutor?.(e)}catch{}}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),g=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${g}`,s),{snapshot_id:e.snapshotId,installed_revision:g,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:K("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(g){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw g}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",V(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),g=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),h=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(e.iv),additionalData:new TextEncoder().encode(n)},g,V(e.ct)).catch(i),m=JSON.parse(new TextDecoder().decode(h));if(!m||typeof m!=="object"||Array.isArray(m))throw new l("vm_hands_env_invalid","env not an object");return m}writeJobEnvRootOnly(e,n){let i=re(this.options.envRoot,`bind-${e}`);Qe(i,{mode:448});let s=De(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let g=n.variables&&typeof n.variables==="object"?n.variables:{},h=Object.entries(g).filter(([w,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(w)&&typeof I==="string").map(([w,I])=>`export ${w}='${String(I).replaceAll("'","'\\''")}'`).join(`
 `)+`
-`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),vn=3,wn=20000,bn=250,yn=2000;function je(e){let n=Math.min(bn*2**(e-1),yn);return Math.round(n/2+Math.random()*n/2)}var kn=5000;function Sn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var In=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Pn(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function En(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function Tn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Rn=1e4,An=1000;async function Wi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await xn(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<vn&&Date.now()-n<wn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function xn(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,An));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Rn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=In){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await En(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+kn,q=1,M=await f("hands.ready",se);while(Sn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===ai){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===vt)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?Tn(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(ci,{code:o}).catch(()=>{return}),Pn(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as Dn}from"fs";var On=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Mn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-f2pye28r.js");await h();return}z("parsed",{t0:Math.round(On)});let e="";try{e=Dn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-7cwr0sys.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Mn();export{qi,pn,Wi};
+`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),vn=3,wn=20000,bn=250,yn=2000;function je(e){let n=Math.min(bn*2**(e-1),yn);return Math.round(n/2+Math.random()*n/2)}var kn=5000;function Sn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var In=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function Pn(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function En(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function Tn(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Rn=1e4,An=1000;async function Wi(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await xn(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<vn&&Date.now()-n<wn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function xn(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,An));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Rn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=In){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await En(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+kn,q=1,M=await f("hands.ready",se);while(Sn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===ai){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===vt)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?Tn(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(ci,{code:o}).catch(()=>{return}),Pn(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as Dn}from"fs";var On=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Mn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-1c5tm7z7.js");await h();return}z("parsed",{t0:Math.round(On)});let e="";try{e=Dn(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-878w5rqz.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Mn();export{qi,pn,Wi};