@reason-machines/cli-linux-x64 0.2.563 → 0.2.565
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/reason +1 -1
- package/bin/vm-hands/{agent-network-3stvmqsj.js → agent-network-mnv1fm1c.js} +1 -1
- package/bin/vm-hands/{api-credentials-3wwkpts2.js → api-credentials-082cnpn9.js} +1 -1
- package/bin/vm-hands/{api-9xm5e4g9.js → api-sq672f51.js} +1 -1
- package/bin/vm-hands/{ask-relay-5f92e4c5.js → ask-relay-v5btnjvb.js} +2 -2
- package/bin/vm-hands/connect-cli-rxb3qtra.js +2 -0
- package/bin/vm-hands/{desktop-components-p0zx6qxg.js → desktop-components-099xyxmz.js} +1 -1
- package/bin/vm-hands/{local-automation-0a7enct8.js → local-automation-7pjd5nc1.js} +1 -1
- package/bin/vm-hands/{local-capabilities-d3ycjdyg.js → local-capabilities-ha0ey4zh.js} +1 -1
- package/bin/vm-hands/{local-display-session-pc85z6mg.js → local-display-session-0mkswxgk.js} +1 -1
- package/bin/vm-hands/local-display-video-c3fk87c5.js +2 -0
- package/bin/vm-hands/{local-managed-process-ka331rcr.js → local-managed-process-ahr2jync.js} +1 -1
- package/bin/vm-hands/{managed-runtime-nwj7cn7c.js → managed-runtime-shzb3tr3.js} +1 -1
- package/bin/vm-hands/{network-auto-update-tk104maa.js → network-auto-update-3m94436w.js} +2 -2
- package/bin/vm-hands/{network-sign-in-t9ng36rs.js → network-sign-in-xm79s170.js} +2 -2
- package/bin/vm-hands/{permissions-ywh8x4dq.js → permissions-scffy1px.js} +1 -1
- package/bin/vm-hands/{serve-service-43kmwskj.js → serve-service-grp91ybk.js} +1 -1
- package/bin/vm-hands/{status-ec366bs8.js → status-89999mdn.js} +3 -3
- package/bin/vm-hands/{version-6ys9zwbj.js → version-wyshazh7.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-srtqjjqb.js → vm-hands-entry-lite-1eyg750p.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-jgwjt10t.js → vm-hands-entry-lite-1xhpn3hw.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-d12hx1dk.js → vm-hands-entry-lite-34b4tws6.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-41nn0vbf.js → vm-hands-entry-lite-432khjd5.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-pe374cn6.js → vm-hands-entry-lite-6vnjgy77.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-0jy8mv4a.js → vm-hands-entry-lite-7r27208j.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-mn8rjpxq.js → vm-hands-entry-lite-af45ma9p.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-43bv9hf0.js → vm-hands-entry-lite-bsk184m7.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-1wxwsb3f.js → vm-hands-entry-lite-dy204qh4.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-61p78r72.js → vm-hands-entry-lite-gcqqnnze.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-vbqfmsd3.js → vm-hands-entry-lite-ncyrz48z.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-frg1b1rg.js → vm-hands-entry-lite-ngn4tafr.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-j8s2vqpf.js → vm-hands-entry-lite-pt19vacn.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-1w39j6vz.js → vm-hands-entry-lite-rqfhfp09.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-k4d5rhpw.js → vm-hands-entry-lite-sz7z1qby.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-zj9esd2g.js → vm-hands-entry-lite-t43bz0ey.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-thstg177.js → vm-hands-entry-lite-t86kt9jz.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-d431ffz0.js → vm-hands-entry-lite-tnj3483k.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
- package/bin/vm-hands/{vm-hands-executor-2ngwj96m.js → vm-hands-executor-kyb5t371.js} +1 -1
- package/bin/vm-hands/{vm-hands-op-runner-te2ze1e7.js → vm-hands-op-runner-gkt79hcp.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-09ehkm3c.js → vm-hands-runtime-tdr6j55n.js} +3 -3
- package/package.json +1 -1
- package/bin/vm-hands/connect-cli-d3dp0r1t.js +0 -2
- package/bin/vm-hands/local-display-video-40avbg94.js +0 -2
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{R,Pn}from"./vm-hands-entry-lite-z65xva21.js";import{w,ye,W,Cn,An,Cr}from"./vm-hands-entry-lite-33at6g06.js";import{Q,ve}from"./vm-hands-entry-lite-2qfmabqn.js";import{Ca,be,Aa,C,no,me}from"./vm-hands-entry-lite-
|
|
2
|
+
import{R,Pn}from"./vm-hands-entry-lite-z65xva21.js";import{w,ye,W,Cn,An,Cr}from"./vm-hands-entry-lite-33at6g06.js";import{Q,ve}from"./vm-hands-entry-lite-2qfmabqn.js";import{Ca,be,Aa,C,no,me}from"./vm-hands-entry-lite-7r27208j.js";import{g}from"./vm-hands-entry-lite-rqfhfp09.js";import{ut,Wn,ir}from"./vm-hands-entry-lite-tnj3483k.js";import{a,hn,Ht,vi,mt,fn,fr,mn,mr,Ut,ae,rt,Si,zt}from"./vm-hands-entry-lite-xfak34av.js";import{Nr,vs,Ss,pe,Xs,tr,jn}from"./vm-hands-entry-lite-fxptf351.js";import{Hr}from"./vm-hands-entry-lite-gxf2r5en.js";import{Ia,k,or,sr,ee,ar,lo,uo,Zr,dt,po,Qr,en,Gn,Kn,fo,mo,go,Jn}from"./vm-hands-entry-lite-pt19vacn.js";import{ti,ri,K,za,qa,oe,x,p,bo,ge,se,O,$t,Qe,rn,vo,E,_e,Za,Qa,ec,si,nn,pt,tc,Mt,on,Pe,J,nc,xo,Co,ic,et}from"./vm-hands-entry-lite-gcqqnnze.js";import{je}from"./vm-hands-entry-lite-s93f3pbv.js";import{cr,Ae,Da,tn,Oa,La}from"./vm-hands-entry-lite-ngry8nkq.js";import{ne}from"./vm-hands-entry-lite-997y1m1r.js";import{le,A,es,ts}from"./vm-hands-entry-lite-6vnjgy77.js";import{On,Nn,Hi,Fc}from"./vm-hands-entry-lite-t86kt9jz.js";import{kr,ue}from"./vm-hands-entry-lite-cc8hwgxc.js";import{Lt,ie,N,ro}from"./vm-hands-entry-lite-dy204qh4.js";import{Oi,ke,de,j,ze,ns,En,is,qe,Ni,Li,os,kn,Ie,ss,xn}from"./vm-hands-entry-lite-af45ma9p.js";import{F}from"./vm-hands-entry-lite-zp7chzcc.js";import{U,H,T}from"./vm-hands-entry-lite-qjrgvdbj.js";import{Zn,Ma,ja,wo,ei}from"./vm-hands-entry-lite-bsk184m7.js";import{ya}from"./vm-hands-entry-lite-sh4mqy93.js";import{_i}from"./vm-hands-entry-lite-3q2ng4e9.js";import{Mo}from"./vm-hands-entry-lite-432khjd5.js";import{Jt}from"./vm-hands-entry-lite-1eyg750p.js";import{hr,Oo,No,Lo}from"./vm-hands-entry-lite-1xhpn3hw.js";import{to}from"./vm-hands-entry-lite-284z7ct8.js";import{mi,cc}from"./vm-hands-entry-lite-b1vanmtv.js";import{u,b,m,y}from"./vm-hands-entry-lite-yg4dk99m.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{De,wt,cs,Sc,Ec,bt}from"./vm-hands-entry-lite-88dxn9b5.js";import{s,Et}from"./vm-hands-entry-lite-12ck5swp.js";import{Jc,Ji,I,t,V,zr,o,_,Rt,d,n,h,P,ul,c,i,Xi}from"./vm-hands-entry-lite-zpvr7wc6.js";import{va,Y,B}from"./vm-hands-entry-lite-pg7nnyc6.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{spawn as Du,spawnSync as Xw}from"child_process";import{closeSync as Mu,existsSync as Zw,mkdirSync as Qw,openSync as Tu,readdirSync as ey,realpathSync as Yr,rmSync as Xn}from"fs";import{hostname as ty}from"os";import{dirname as Bs,join as Bt,resolve as ry}from"path";var Jo={ENOENT:"native_enoent",EACCES:"native_permission_denied",EPERM:"native_permission_denied",ETIMEDOUT:"native_timeout",ECONNREFUSED:"native_network",ECONNRESET:"native_network",ENOTFOUND:"native_network",EAI_AGAIN:"native_network",ENETUNREACH:"native_network",EHOSTUNREACH:"native_network",EPIPE:"native_pipe_closed",ENOSPC:"native_disk_full",EMFILE:"native_too_many_files",EBUSY:"native_busy",E2BIG:"native_args_too_large"};function oc(e){if(!(e instanceof Error))return e===void 0||e===null?"native_no_error":"native_non_error";let l=e.code;if(typeof l==="string"&&Jo[l])return Jo[l];let v=e.message;if(e.name==="TimeoutError"||e.name==="AbortError")return"native_timeout";if(/No handler registered for /.test(v))return"ipc_handler_missing";if(/could not be cloned/i.test(v))return"ipc_clone_failed";if(/Render frame was disposed|Object has been destroyed|WebContents was destroyed/i.test(v))return"ipc_window_closed";let D=/\b(E[A-Z0-9]{2,15})\b/.exec(v)?.[1];if(D&&Jo[D])return Jo[D];if(/timed? ?out|timeout/i.test(v))return"native_timeout";if(/fetch failed|failed to fetch|network|socket hang up|getaddrinfo/i.test(v))return"native_network";if(e.name==="TypeError"&&v==="Load failed")return"native_network";if(/unexpected token|is not valid JSON|JSON\.parse|Unexpected end of JSON/i.test(v))return"native_unreadable_output";if(/keychain|secitem|errSec/i.test(v))return"native_keychain_error";if(/Error invoking remote method/.test(v))return"ipc_remote_error";switch(e.name){case"TypeError":return"native_type_error";case"RangeError":return"native_range_error";case"SyntaxError":return"native_unreadable_output"}return"native_unexpected"}import{createHash as Gu}from"crypto";import{unlinkSync as Yu}from"fs";import{platform as Xu}from"os";import{join as Zu}from"path";var ac=P("store",[h({version:i(1),store:i("keychain")}),h({version:i(1),store:i("file"),api_key:t().min(1).max(4096)})]),ln=(e)=>Zu(e,"api-key.json");function Fr(e){let l=Gu("sha256").update(`reason-connect-api-key
|
|
3
3
|
${e}`).digest("hex");return new mt(hn(),Xu(),l)}function ra(e,l,v=Fr(e)){try{v.deleteBinding(),v.createBinding(new TextEncoder().encode(l)),y(ln(e),{version:1,store:"keychain"});return}catch(D){if(!(D instanceof a))throw D}y(ln(e),{version:1,store:"file",api_key:l})}function lr(e,l=Fr(e)){if(!u(ln(e)))return null;let v=ac.parse(JSON.parse(m(ln(e))));if(v.store==="file")return v.api_key;try{let D=l.loadBinding();return D?new TextDecoder().decode(D):null}catch(D){if(!(D instanceof a))throw D;throw Error("worker_api_key_unreadable")}}function sc(e,l=Fr(e)){if(!u(ln(e)))return;if(ac.parse(JSON.parse(m(ln(e)))).store==="keychain")try{l.deleteBinding()}catch(v){if(!(v instanceof a))throw v}Yu(ln(e))}async function na(e,l){let v;try{v=await ir({env:{REASON_API_KEY:l,REASON_API_URL:e.apiOrigin},fetchImpl:oe(e.proxy)})}catch(D){if(D instanceof C&&(D.status===401||D.status===403))throw Error("worker_api_key_rejected");throw D}if(!v)throw Error("worker_api_key_rejected");if(!v.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return v}import{readdirSync as yf,renameSync as _f,rmSync as dn}from"fs";import{join as Pt}from"path";import{createHash as Qu}from"crypto";import{realpathSync as ef,statSync as tf,unlinkSync as Go}from"fs";import{platform as rf}from"os";import{join as Xt}from"path";function f(e){return{state:Xt(p(e),"device.json"),control:Xt(p(e),"control.json"),lock:Xt(p(e),"lifecycle.lock"),socket:Xt(p(e),"control.sock"),daemon:Xt(p(e),"daemon.json"),releaseCheck:Xt(p(e),"release-check.json"),updateDeferral:Xt(p(e),"update-deferral.json"),firstHeartbeat:Xt(p(e),"first-heartbeat.json")}}var nf=n({version:i(1),device_id:t().min(1).max(160),offer:Rt().optional(),enrollment_ms:o().int().nonnegative().max(tr).optional()});function lc(e,l,v){b(p(e),!0),y(f(e).firstHeartbeat,{version:1,device_id:l,...v.offer?{offer:v.offer}:{},...v.enrollmentMs!==void 0?{enrollment_ms:v.enrollmentMs}:{}})}function oa(e,l){let v=f(e).firstHeartbeat;try{if(!u(v))return null;let D=nf.safeParse(JSON.parse(m(v)));if(Go(v),!D.success||D.data.device_id!==l)return null;let M=jn(D.data.offer);return{...M?{offer:M}:{},...D.data.enrollment_ms!==void 0?{enrollmentMs:D.data.enrollment_ms}:{}}}catch{return null}}function xt(e,l=!1){b(p(e),l);let v=["local-device.key","local-device.binding","device.json"].filter((D)=>{let M=Xt(p(e),D);if(!u(M))return!1;return m(M),!0});return e.lifetime==="persistent"&&v.join()==="device.json"?ia(e):new fn(p(e))}function Yo(e,l){xt(e,!0),sf(e);let v=l??ia(e),D=new fn(p(e));try{v.deleteBinding(),v.deleteKey(),v.createFreshPublicKey()}catch(M){if(M instanceof a)return D;throw M}return D.deleteBinding(),D.deleteKey(),v}function ia(e){return new mt(hn(),rf(),of(e))}function of(e){let l=aa(e);return Qu("sha256").update(`reason-worker
|
|
4
4
|
${l?.directory??p(e)}`).digest("hex")}function ao(e,l){y(Xt(p(e),so),{version:1,directory:aa(e)?.directory??p(e),devicePublicKey:l})}var so="keychain-scope.json";function dc(e){return u(Xt(p(e),so))}var af=h({version:i(1),directory:t().min(1),devicePublicKey:t().min(1)});function aa(e){let l=Xt(p(e),so);if(!u(l))return null;let v=af.safeParse(JSON.parse(m(l))),D=f(e).state;if(!v.success||!u(D))return null;return JSON.parse(m(D))?.devicePublicKey===v.data.devicePublicKey?v.data:null}function sf(e){let l=Xt(p(e),so);if(!u(l))return;if(aa(e))try{let v=ia(e);v.deleteBinding(),v.deleteKey()}catch(v){if(!(v instanceof a))throw v}Go(l)}function Or(e){let l=ef(e.workspaceRoot);if(l!==e.workspaceRoot||!tf(l).isDirectory()||!ge(l,e.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function S(e){if(!u(p(e)))return null;let l=Ut(f(e).state,{proofStore:xt(e),repair:!1}),v=l!==null&&Cn(e.apiOrigin,l.apiOrigin),D=v?[O(e),O({...e,apiOrigin:l.apiOrigin})]:[O(e)];if(l&&(!D.includes(l.worker?.configDigest??"")||l.worker.lifetime!==e.lifetime||l.apiOrigin!==e.apiOrigin&&!v||l.roots.length>32||l.roots[0]?.path!==e.workspaceRoot||l.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return l}var uc=h({version:i(1),drained:_(),revoked:_()});function ft(e){let l=f(e).control;return u(l)?uc.parse(JSON.parse(m(l))):{version:1,drained:!1,revoked:!1}}function qt(e,l){y(f(e).control,uc.parse(l))}function Zt(e){let l=xt(e);l.deleteBinding(),l.deleteKey();let v=Xt(p(e),so);if(u(v))Go(v);let D=f(e).state;if(u(D))Go(D)}var cf=h({read:_(),write:_(),execute:_(),discover_environment:_(),expose_mcp:i(!1)}),sa=h({version:i(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:cf,execution_mode:c(["confined","host"]).default("confined")}),folders:d(h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),lf=n({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:i("p256"),protocol_version:i(2),roots:d(n({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:n({lifecycle:c(["persistent","ephemeral"]),expires_at:I.datetime({offset:!0})}),first_heartbeat:Rt().optional()}),ca=30000;class Rr extends Error{deviceRemoved;constructor(e){super("worker_enrollment_rejected");this.deviceRemoved=e}}async function df(e,l,v=fetch){let D=await v(`${e}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(l),redirect:"error",signal:AbortSignal.timeout(ca)});if(!D.ok){let M=D.status===409?await D.json().catch(()=>null):null;throw new Rr(M?.error==="device_revoked")}return D.json()}async function la(e,l,v,D){ne();let M=sa.parse(JSON.parse(m(l)));return Er(e,M,v,D)}async function Er(e,l,v,D=(L,z)=>df(L,z,oe(e.proxy)),M=performance.now()){let L=mc(e,l,v),z=await D(e.apiOrigin,{...L.request,enrollment_ticket:l.enrollment_ticket,code_verifier:l.code_verifier});return L.receipt(z,M)}async function fc(e,l,v,D,M=performance.now()){let L=mc(e,l,v),z=await D(L.request,l.code_verifier);return z===null?null:L.receipt(z,M)}function mc(e,l,v){if(ne(),l.root.execution_mode!==e.executionMode)throw Error("worker_enrollment_mode_mismatch");let D=zt([e.workspaceRoot],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(D.path!==e.workspaceRoot||D.pathFingerprint!==l.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let M=(e.folders??[]).map((G,ce)=>{let we=zt([G],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(we.path!==G||we.pathFingerprint!==l.folders?.[ce]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return we});if((l.folders?.length??0)!==M.length)throw Error("worker_enrollment_root_mismatch");let L=[{...D,label:"workspace"},...M],z;try{z=v.loadPublicKey()}catch{z=v.createFreshPublicKey()}return{request:{device_public_key:z,name:e.name,os:process.platform,architecture:process.arch,reason_runtime_version:g,bridge_version:g,protocol_version:2,capabilities:{supported_operations:[]},roots:L.map((G)=>({label:G.label,path_fingerprint:G.pathFingerprint,permissions:l.root.permissions}))},receipt(G,ce){let we=lf.parse(G);if(we.organization_id!==l.organization_id||we.roots.length!==L.length||we.roots.some((X,he)=>X.path_fingerprint!==L[he].pathFingerprint)||we.headless.lifecycle!==e.lifetime||Date.parse(we.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let te=jn(we.first_heartbeat);try{lc(e,we.device_id,{...te?{offer:te}:{},enrollmentMs:Math.min(tr,Math.max(0,Math.round(performance.now()-ce)))})}catch{}return{version:4,apiOrigin:e.apiOrigin,orgId:we.organization_id,deviceId:we.device_id,devicePublicKey:z,displayName:e.name,registeredAt:new Date().toISOString(),handsSlots:e.slots,worker:{configDigest:O(e),lifetime:e.lifetime,expiresAt:we.headless.expires_at},roots:we.roots.map((X,he)=>({id:X.id,label:X.label,path:L[he].path,pathFingerprint:X.path_fingerprint,permissions:l.root.permissions}))}}}}import{randomBytes as uf,randomUUID as ff}from"crypto";import{unlinkSync as mf}from"fs";import{join as pf}from"path";var pc=h({version:i(1),install_id:V(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),hf=n({enrollment_ticket:t().min(1).max(4096),expires_at:I.datetime({offset:!0}),device_kind:i("headless"),lifecycle:c(["persistent","ephemeral"]),device_expires_at:I.datetime({offset:!0})});function da(e){return hf.parse(e)}var gf=n({credentialKind:c(["oauth","api_key"]).optional(),apiOrigin:zr(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:I.datetime({offset:!0}),scopes:d(t().max(128)).max(128),orgId:t().min(1).max(160)});function jr(e){return Q(Pn("REASON_CLI_CHANNEL",e.channel),s())}async function qr(e,l=jr(e)){if(!u(l))return null;let v=gf.parse(JSON.parse(m(l)));if(!W(v.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(v.credentialKind==="api_key")return Date.parse(v.expiresAt)>Date.now()?v:null;let D=oe(e.proxy),M=Object.assign((z,re)=>D(z,{...re,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),L=await be({path:l,fetchImpl:M});if(L&&!W(L.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");return L}async function hc(e,l,v){if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let D=Kr(e);return D.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(D.request))}async function gc(e,l,v,D,M){let L=performance.now();if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let z=Kr(e),re=M?void 0:v.enrollHeadlessDevice?.bind(v);if(re){let G=await fc(e,z.direct(l.orgId),D,(ce,we)=>re({approval:z.request,code_verifier:we,registration:ce}).catch((te)=>{throw wf(te)}),L);if(G)return G}return Er(e,z.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(z.request)),D,M,L)}function wf(e){if(!(e instanceof C))return e;if(e.status===409)return new Rr(e.code==="device_revoked");if(e.status===410||e.status===401&&e.code==="invalid_enrollment_ticket"||e.status===403&&e.code==="grant_exceeded"||e.status===400&&e.code==="invalid_device_enrollment")return new Rr(!1);return e}var co=(e)=>pf(p(e),"enrollment-install.json");function wc(e){if(u(co(e)))mf(co(e))}function Kr(e,{stored:l=!0}={}){ne();let v=co(e),D=l&&u(v)?pc.parse(JSON.parse(m(v))):{version:1,install_id:ff(),fingerprint_key:uf(32).toString("hex")};if(l&&!u(v))y(v,D);let M={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},L=Buffer.from(D.fingerprint_key,"hex"),z=zt([e.workspaceRoot],M,L)[0];if(z.path!==e.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let re=(e.folders??[]).map((te)=>{let X=zt([te],M,L)[0];if(X.path!==te)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:X.pathFingerprint}}),G=Ca(),ce={install_id:D.install_id,code_challenge:G.challenge,lifecycle:e.lifetime,roots:[z.pathFingerprint,...re.map((te)=>te.path_fingerprint)].map((te)=>({path_fingerprint:te,permissions:M,execution_mode:e.executionMode}))},we=(te)=>({version:1,organization_id:te,code_verifier:G.verifier,root_fingerprint_key:D.fingerprint_key,root:{path_fingerprint:z.pathFingerprint,permissions:M,execution_mode:e.executionMode},...re.length?{folders:re}:{}});return{request:ce,saveInstall(te){b(p(te),!0),y(co(te),D)},complete(te,X){let he=da(X);if(he.lifecycle!==e.lifetime||Date.parse(he.expires_at)<=Date.now()||Date.parse(he.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...we(te),enrollment_ticket:he.enrollment_ticket}},direct:we}}function yc(e,l,v){let D=co(e);if(!u(D))throw Error("worker_folders_unavailable");let M=pc.parse(JSON.parse(m(D)));return zt([l],v,Buffer.from(M.fingerprint_key,"hex"))[0]}var Xo=8,ma=600000,kc=15000,bf=3600000,kf=new Set(["device_not_eligible","sign_in_not_eligible"]),_c=new Set(["device_revoked","invalid_device_credential"]),Zo=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,Dr=(e)=>Pt(p(e),"workspaces"),vc="account.json",ua=(e)=>u(Pt(e,vc));function Qt(e){let l;try{l=yf(Dr(e))}catch{return[]}return l.filter((v)=>Zo.test(v)).sort().map((v)=>{let D=Pt(Dr(e),v),M=Pt(D,"worker.json"),L=null;try{let z=x.safeParse(JSON.parse(m(M)));if(z.success&&z.data.stateDirectory===D)L=z.data}catch{}return{organizationId:v,directory:D,configPath:M,config:L,account:ua(D)}})}function Qo(e,l){let v=l.toLowerCase();if(!Zo.test(v))throw Error("worker_workspace_id_invalid");let D=x.parse({...e,stateDirectory:Pt(Dr(e),v)});return b(D.stateDirectory,!0),y(Pt(D.stateDirectory,vc),{version:1}),{config:D,configPath:Pt(D.stateDirectory,"worker.json")}}function ni(e,l){try{let{config:v,configPath:D}=Qo(e,l);b(p(v),!0),qt(v,{version:1,drained:!0,revoked:!0}),y(D,v)}catch{}}function ho(e,l){let v=l.toLowerCase(),D=null;try{D=S(e)?.orgId.toLowerCase()??null}catch{}return D===v||Qt(e).some((M)=>!M.account&&M.config!==null&&M.organizationId===v)}var fa=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function bc(e,l){let v=S(e);if(!v?.worker)throw Error("worker_identity_missing");ao(e,v.devicePublicKey),b(p(l),!0);for(let L of fa)dn(Pt(p(l),L),{force:!0});for(let L of fa){let z=Pt(p(e),L);if(u(z))_f(z,Pt(p(l),L))}let D=xt(l),M=Ut(f(l).state,{proofStore:D,repair:!1});if(!M?.worker)throw Error("worker_identity_missing");ae({...M,worker:{...M.worker,configDigest:O(l)}},f(l).state,{proofStore:D})}function pa(e){for(let l of Qt(e)){if(l.account)continue;try{if(l.config&&u(f(l.config).state))Zt(l.config)}catch{}dn(l.directory,{recursive:!0,force:!0})}dn(ga(e),{force:!0})}function oi(e,{prefer:l,keep:v,live:D=!1}){let M=Date.now(),L=(te)=>Number(Date.parse(te.worker?.expiresAt??"")>M+60000),re=Qt(e).flatMap((te)=>{if(!te.account||!te.config)return[];try{if(ft(te.config).revoked)return[];let X=S(te.config);return X&&X.orgId.toLowerCase()===te.organizationId&&(!D||L(X))?[{...te,config:te.config,state:X}]:[]}catch{return[]}}).sort((te,X)=>Number(X.organizationId===l)-Number(te.organizationId===l)||L(X.state)-L(te.state))[0];if(!re)return null;let G=null;try{G=ft(e).revoked?null:S(e)}catch{}let ce=G?.orgId.toLowerCase()??"";if(v&&G&&Zo.test(ce)&&ce!==re.organizationId){let te=Qo(e,ce);bc(e,te.config),y(te.configPath,te.config)}else if(u(p(e))){try{if(u(f(e).state))Zt(e)}catch{}for(let te of fa)dn(Pt(p(e),te),{force:!0})}pa(e);let we=x.parse({...re.config,stateDirectory:e.stateDirectory});return bc(re.config,we),y(Pt(e.stateDirectory,"worker.json"),we),dn(re.directory,{recursive:!0,force:!0}),we}var ha={before(e){for(let{config:l}of Qt(e))try{let v=l?S(l):null;if(l&&v)ao(l,v.devicePublicKey)}catch{}},after(e,l){for(let{organizationId:v,directory:D,configPath:M,config:L}of Qt(l)){if(L)continue;try{let z=x.parse(JSON.parse(m(M)));if(z.stateDirectory!==Pt(Dr(e),v))continue;let re=x.parse({...z,stateDirectory:D}),G=xt(re),ce=Ut(f(re).state,{proofStore:G,repair:!1});if(ce?.worker?.configDigest===O(z))ae({...ce,worker:{...ce.worker,configDigest:O(re)}},f(re).state,{proofStore:G});y(M,re)}catch{}}}},ga=(e)=>Pt(Dr(e),"listed.json");function Rc(e){try{let l=JSON.parse(m(ga(e))),v=l.names&&typeof l.names==="object"&&!Array.isArray(l.names)?Object.fromEntries(Object.entries(l.names).filter((M)=>typeof M[1]==="string")):{},D=l.refused&&typeof l.refused==="object"?l.refused:null;return{listed:l.listed===!0,reason:l.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(l.blocked)?l.blocked.filter((M)=>typeof M==="string"):[],names:v,...D&&typeof D.device==="string"&&typeof D.roots==="string"&&typeof D.at==="number"&&Number.isFinite(D.at)&&typeof D.count==="number"&&Number.isInteger(D.count)&&D.count>=1?{refused:{device:D.device,roots:D.roots,at:D.at,count:D.count}}:{}}}catch{return null}}function Pc(e,l){let v=Qt(e),D=v.filter((G)=>G.account),M=v.filter((G)=>!G.account),L=Rc(e),z=L&&!L.listed?L.reason:null,re=z||M.length===0&&L&&!L.listed?[]:M;if(D.length===0&&re.length===0&&(z||L&&!L.listed))return{workspaces:null,off:z};return{off:z,workspaces:[...D,...re].map(({organizationId:G,config:ce,account:we})=>{let te=!1,X=null,he=!1,Se=null;try{te=ce?ft(ce).revoked:!1,X=ce&&!te?S(ce):null;let Re=ce?rt(f(ce).daemon):null;he=l&&!!X&&Re?.state==="connected",Se=he?mn(Re,X):null}catch{}return{...Se?{permission_recovery:Se}:{},organization_id:G,device_id:X?.deviceId??null,name:L?.names?.[G]??null,root:X?.roots[0]?{id:X.roots[0].id,permissions:X.roots[0].permissions}:null,state:te?"removed":he?"connected":"not_running",blocked:!we&&!te&&!he&&(L?.blocked.includes(G)??!1),...we?{account:!0}:{}}})}}function Cc(e){let{config:l,state:v,client:D,signal:M}=e,L=e.log??(()=>{return}),z=e.intervalMs??ma,re=new Map,G=null,ce=!1,we=Rc(l)??{listed:!1,reason:null,blocked:[]},te=()=>v.roots.map((Ne)=>Ne.id).join(","),X=(Ne)=>{if(!Ne||Ne.device!==v.deviceId||Ne.roots!==te())return!1;let xe=Date.now();return xe>=Ne.at&&xe<Ne.at+Math.min(bf,z*2**Math.min(Ne.count-1,10))},he=(Ne)=>{let{folders:xe,...Le}=l,Ge=v.roots.slice(1).map((Ve)=>Ve.path);return x.parse({...Le,...Ge.length?{folders:Ge}:{},stateDirectory:Pt(Dr(l),Ne)})},Se=async(Ne)=>{let xe=re.get(Ne);if(!xe)return;xe.controller.abort(),await xe.done},Re=(Ne,xe=!1)=>{let Le=new AbortController,Ge=()=>Le.abort();if(M.addEventListener("abort",Ge,{once:!0}),M.aborted)Le.abort();let Ve={...Ne,controller:Le,claims:0,done:Promise.resolve(),account:xe};Ve.done=e.serve(Ne,Le.signal,(Je)=>{Ve.claims=Je}).then(()=>{return},(Je)=>{if(xe&&Je instanceof k&&Je.status===401&&_c.has(Je.code)){try{qt(Ne.config,{version:1,drained:!0,revoked:!0})}catch{}L(`Reason worker: workspace ${Ne.organizationId} (another account's) no longer accepts this computer (${Je.code}); run \`reason connect\` signed in as that account to connect it again
|
|
5
5
|
`)}else if(Je instanceof k&&Je.status===401&&_c.has(Je.code)){try{Zt(Ne.config)}catch{}L(`Reason worker: workspace ${Ne.organizationId} no longer accepts this computer
|
|
@@ -312,7 +312,7 @@ Usage:
|
|
|
312
312
|
`),host:v.host}),re=Ic({...z,log:(he)=>D.stderr.write(`${he}
|
|
313
313
|
`)}),{configPath:G}=re,ce=re.saved;if(!ce)return D.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let we=(he,Se)=>{let Re=Vs(v.home,v.channel),Ee;try{let Me=null;try{Me=Se.keep?null:S(ce)?.orgId.toLowerCase()??null}catch{}if(Ee=oi(ce,{prefer:Fo(v.home,v.channel,ce),...Se}),Ee&&Me)ni(Ee,Me)}finally{Re()}if(!Ee)return!1;ce=Ee;let Oe="";try{Oe=` (workspace ${S(Ee)?.orgId??"unknown"})`}catch{}return D.stderr.write(`Reason: ${he}; this computer goes on running Sessions for its other Reason account${Oe}.
|
|
314
314
|
`),!0};if(ft(ce).revoked&&!we("this computer's connection was removed from Reason",{keep:!1}))return D.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(ce.executionMode==="confined"||!Yn(ce)){let he=lr(ce.stateDirectory)??void 0,Se=he?null:Fo(v.home,v.channel,ce);if(!he&&!(Se&&ho(ce,Se)))we("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let te=ce.executionMode==="confined";if(te||!Yn(ce)){let he=lr(ce.stateDirectory)??void 0;if(D.stderr.write(te?Hu:`Reason: this computer's connection expired; renewing it with ${he?"its API key":"your login"}\u2026
|
|
315
|
-
`),await Us(x.parse({...ce,executionMode:"host"}),G,D,M,he)!==0)return D.stderr.write(he?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let X=new AbortController;if(!M.runWorker)import("./ask-relay-
|
|
315
|
+
`),await Us(x.parse({...ce,executionMode:"host"}),G,D,M,he)!==0)return D.stderr.write(he?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let X=new AbortController;if(!M.runWorker)import("./ask-relay-v5btnjvb.js").then(({runBackgroundAskRelay:he})=>he(X.signal,(Se)=>D.stderr.write(`${Se}
|
|
316
316
|
`))).catch(()=>{});try{for(;;){let he=lr(ce.stateDirectory)===null?{ownerWorkspaces:M.worker?.ownerWorkspaces??{}}:{},Se=M.runWorker?null:Fi({stateDirectory:ce.stateDirectory}),Re=!1,Ee;try{Ee=await(M.runWorker??Tr)(["start","--config",G],{deferOptionalLanes:!0,...M.worker,...he,ownComputer:!0,io:{stdout:D.stdout,stderr:D.stderr},onDeviceRevoked:()=>{Re=!0}})}finally{Se?.stop()}if(!Re)return Ee;if(!we("this computer's connection was removed from Reason",{keep:!1}))break}return Vi(v.home,v.channel,!0),D.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{X.abort()}}async function dy(e,l,v){let{io:D,options:M,home:L,channel:z,environment:re}=v;if(l&&await(M.controlWorker??St)(l,"status").catch(()=>null))throw new ct("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let G=fe(L,z,!0),ce=Bu({parsed:e,saved:l,stateDirectory:G,lifetime:"ephemeral",home:L,channel:z,options:M,environment:re}),we=Uu(ce,v.apiKey??(l?lr(l.stateDirectory)??void 0:void 0)),te=Bt(G,"worker.json");return b(G,!0),y(te,we),D.stdout.write($s(`Reason: connecting "${we.name}" while this command runs`,we,v.host.platform,["Connecting\u2026"])),(M.runWorker??Tr)(["start","--config",te],{...Fs(M.worker,v.apiKey),ownComputer:!0,io:{stdout:D.stdout,stderr:zi(D.stderr)},onStartup:(X)=>{if(X==="ready")D.stdout.write(`Connected. Start Sessions on "${we.name}" from Reason. Press Ctrl-C to stop.
|
|
317
317
|
`);M.worker?.onStartup?.(X)}})}function uy(e,l,v,D){if(v.platform!=="darwin")throw new ct("--keep-awake is for macOS.");if(!l)throw new ct("This computer is not connected to Reason. Run reason connect first.");b(p(l),!0),$c(f(l).daemon,e);let M=nr(f(l).daemon)==="battery_and_ac";return D.stdout.write(`Keep awake: ${M?"on (this Mac stays awake while it runs Sessions)":"off"}
|
|
318
318
|
`),0}var fy=n({root:n({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});async function Fu(e,l,v,D){let M=await(Fs(D.worker,v).enrollmentCredentials??qr)(e,jr(e));if(!M)throw Error("worker_session_login_required");if(!M.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let L=D.folderApi?.(M)??new me(M,{credentialsPath:jr(e),fetchImpl:oe(e.proxy)}),z=(re)=>re instanceof C&&re.status===404&&!["device_not_found","root_not_found"].includes(re.code);return{add:async(re)=>{let G=yc(e,re,{...l.roots[0].permissions,expose_mcp:!1}),ce=await L.addDeviceRoot(l.deviceId,{path_fingerprint:G.pathFingerprint,label:G.label,permissions:{...G.permissions,expose_mcp:!1}}).catch((te)=>{if(z(te))throw Error("worker_folders_unavailable");if(te instanceof C&&te.code==="root_limit_reached")throw new ct("This computer already has the most folders Reason allows (32).");throw te}),we=fy.parse(ce).root;if(we.path_fingerprint!==G.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...G,id:we.id,label:we.label}},remove:async(re)=>{await L.removeDeviceRoot(l.deviceId,re).catch((G)=>{if(z(G))throw Error("worker_folders_unavailable");if(!(G instanceof C&&G.code==="root_not_found"))throw G})}}}function ju(e,l,v){ae({...l,roots:v,handsSlots:e.slots,worker:{...l.worker,configDigest:O(e)}},f(e).state,{proofStore:xt(e)})}async function my(e,l,v,D){let{io:M,options:L,host:z}=D,re=l&&!D.apiKey&&lr(l.stateDirectory)===null?Fo(D.home,D.channel,l):null,G=l&&re&&Gr(l)&&!ho(l,re)?Qt(l).find((xe)=>xe.account&&xe.organizationId===re)??null:void 0;if(G===null)throw new ct("This computer is not connected for your account. Run reason connect first.");let ce=G?G.config:l,we=G?G.configPath:v,te=ce&&Gr(ce)&&!ft(ce).revoked?S(ce):null;if(!l||!ce||!te||ce.lifetime!=="persistent")throw new ct("This computer is not connected to Reason. Run reason connect first.");let X=e.addFolder!==void 0,he=X?e.addFolder:e.removeFolder,Se=L.cwd??process.cwd(),Re;try{Re=qi(Se,he)}catch(xe){if(X)throw new ct(xe instanceof Error?xe.message:String(xe));Re=ry(Se,he)}if(Re===ce.workspaceRoot)throw new ct(`${Re} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let Ee=ce.folders??[],Oe=te.roots.slice(1).find((xe)=>xe.path===Re);if(!X&&!Oe&&!Ee.includes(Re))throw new ct(`${Re} is not one of this computer's folders.`);if(X&&!ge(Re,ce.stateDirectory))throw new ct(`${Re} holds Reason's own settings.`);if(X&&!Oe&&Ee.length>=31)throw new ct("This computer already has the most folders Reason allows (32).");let Me=D.apiKey??lr(ce.stateDirectory)??void 0,Ce=await Fu(ce,te,Me,L),Te=te.roots.filter((xe)=>xe.path!==Re);if(X)Te=[...Te,await Ce.add(Re)];else if(Oe)await Ce.remove(Oe.id);ju(ce,te,Te);let We=X?[...Ee.filter((xe)=>xe!==Re),Re]:Ee.filter((xe)=>xe!==Re),{folders:$e,...Ue}=ce;if(y(we,x.parse({...Ue,...We.length?{folders:We}:{}})),!await(L.controlWorker??St)(l,"reload_roots").then(()=>!0,()=>!1))Ie(l,z,"connect");return M.stdout.write(X?`Added ${Re}. Sessions on "${ce.name}" may run in it.
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{rr,Br,Hn,Gi,Fr,jr,da,Ki,pa,ha,Hr}from"./vm-hands-entry-lite-gxf2r5en.js";import{Ct,Bn,bs,Or,Vc,Je,Gc,Kc,Qt,Xe,M,At,Es,Fn,ks,Lr,Ps,Rs,Ts,Is,Ds,Os,Ns,Ls,$s,Ms,Bs,Fs,js,ct,Le,Pt,xe,Hs,Us,zs,qs,Ws,Vs,Gs,Ks,$r,Js,Mr,Ys,Vi,Zs,Qs,ea,ta,ra,na,ia,oa,sa,aa,ca,la,ua}from"./vm-hands-entry-lite-fxptf351.js";import{at,Oe,X,te}from"./vm-hands-entry-lite-kbnxk71q.js";import{F,_n}from"./vm-hands-entry-lite-zp7chzcc.js";import{ni,Wa,Va,Qe,Ga,Ka,rn,Ja,Xa,Ya,oi,ai,ci,So,Eo,li,rc,ko,ui,Pe,J,sn,di,hi,et}from"./vm-hands-entry-lite-
|
|
2
|
+
import{rr,Br,Hn,Gi,Fr,jr,da,Ki,pa,ha,Hr}from"./vm-hands-entry-lite-gxf2r5en.js";import{Ct,Bn,bs,Or,Vc,Je,Gc,Kc,Qt,Xe,M,At,Es,Fn,ks,Lr,Ps,Rs,Ts,Is,Ds,Os,Ns,Ls,$s,Ms,Bs,Fs,js,ct,Le,Pt,xe,Hs,Us,zs,qs,Ws,Vs,Gs,Ks,$r,Js,Mr,Ys,Vi,Zs,Qs,ea,ta,ra,na,ia,oa,sa,aa,ca,la,ua}from"./vm-hands-entry-lite-fxptf351.js";import{at,Oe,X,te}from"./vm-hands-entry-lite-kbnxk71q.js";import{F,_n}from"./vm-hands-entry-lite-zp7chzcc.js";import{ni,Wa,Va,Qe,Ga,Ka,rn,Ja,Xa,Ya,oi,ai,ci,So,Eo,li,rc,ko,ui,Pe,J,sn,di,hi,et}from"./vm-hands-entry-lite-gcqqnnze.js";import{U,H,T}from"./vm-hands-entry-lite-qjrgvdbj.js";import{Ba,Fa,_o,Ha,yo,Ua,lr,Qn}from"./vm-hands-entry-lite-bsk184m7.js";import{ue}from"./vm-hands-entry-lite-cc8hwgxc.js";import{je}from"./vm-hands-entry-lite-s93f3pbv.js";import{Se}from"./vm-hands-entry-lite-xfak34av.js";import{Xn,Yn,$a}from"./vm-hands-entry-lite-ngry8nkq.js";import{Pc,Rc,Ar,Tc,Ic,Dc,Oc,Nc,Lc,$c}from"./vm-hands-entry-lite-13nx02p7.js";import{yi,pn,wi,Bo,Fo}from"./vm-hands-entry-lite-3q2ng4e9.js";import{un,jt,dn}from"./vm-hands-entry-lite-432khjd5.js";import{A,Qo}from"./vm-hands-entry-lite-6vnjgy77.js";import{xc,Cc}from"./vm-hands-entry-lite-t43bz0ey.js";import{vr}from"./vm-hands-entry-lite-chq0qx9f.js";import{Xo}from"./vm-hands-entry-lite-1eyg750p.js";import{hr,$o}from"./vm-hands-entry-lite-1xhpn3hw.js";import{tt,sc,ac}from"./vm-hands-entry-lite-b1vanmtv.js";import{ln}from"./vm-hands-entry-lite-q62g6sx0.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{vt,Rn,Tn,In,L}from"./vm-hands-entry-lite-fccn6s4j.js";import{s,Ge}from"./vm-hands-entry-lite-12ck5swp.js";import{t,V,o,_,d,n,we,P,$e,c,i,Yc}from"./vm-hands-entry-lite-zpvr7wc6.js";import{Y,Me,Dt,Be,Yi}from"./vm-hands-entry-lite-pg7nnyc6.js";import{Ot}from"./vm-hands-entry-lite-wnqqjsew.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{request as lc}from"http";import{request as cc}from"https";import{lookup as uc}from"dns/promises";import{isIP as dc}from"net";async function pc(e){let a=new URL(e.url);return await new Promise((l,u)=>{let p=(a.protocol==="https:"?cc:lc)(a,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:da},(m)=>l({response:m,close:()=>{m.destroy(),p.destroy(),m.socket?.destroy()}}));p.once("error",u),p.once("timeout",()=>p.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),p.end(e.body)})}var fi=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),mc=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function gi(e,a=0){if(!e||typeof e!=="object"||a>3)return null;let l=e.code;if(typeof l==="string"){if(fi.has(l))return"custom_endpoint_host_not_found";if(mc.has(l))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(l))return"custom_endpoint_tls_failed"}for(let u of[...e instanceof AggregateError?e.errors:[],e.cause]){let p=gi(u,a+1);if(p)return p}return null}async function fc(e,a){let l=gi(e),u=new URL(a).hostname.replace(/^\[|\]$/g,"");if(l!==null&&l!=="custom_endpoint_connection_failed"||dc(u)!==0)return l;let p;return await Promise.race([uc(u).then(()=>!0,(f)=>!fi.has(String(f?.code))),new Promise((f)=>{p=setTimeout(()=>f(!0),5000)})]).finally(()=>clearTimeout(p))?l:"custom_endpoint_host_not_found"}function hc(e){for(let a=42;;a++){if(a===127)a=256;let l=String.fromCodePoint(a);if(!e.includes(l))return l}}function gc(e,a){let l=Buffer.from(e),u=Buffer.from(a),p=new Uint32Array(l.length);for(let f=1,g=0;f<l.length;f++){while(g&&l[f]!==l[g])g=p[g-1];if(l[f]===l[g])g++;p[f]=g}let m=0;return(f,g=!1)=>{let b=Buffer.allocUnsafe(f.length*u.length+m),y=0;for(let h of f){while(m&&l[m]!==h){let w=p[m-1];y+=l.copy(b,y,0,m-w),m=w}if(l[m]===h){if(m++,m===l.length)y+=u.copy(b,y),m=0}else b[y++]=h}if(g)y+=l.copy(b,y,0,m),m=0;return b.subarray(0,y)}}async function _i(e){e.signal.throwIfAborted();let a=pa.safeParse(e.payload);if(!a.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let l=a.data,u=ha.parse(await e.credential(e.signal));if(!Ki(l,{baseUrl:l.baseUrl,api:u.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let p,m,f=0,g=0,b=0,y=hc(u.apiKey),h=gc(u.apiKey,y),w=async(v,R)=>{e.signal.throwIfAborted(),await new Promise((I,x)=>{let E=()=>{e.signal.removeEventListener("abort",E),x(e.signal.reason)};if(e.signal.addEventListener("abort",E,{once:!0}),e.signal.aborted){E();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(v,R))).then(()=>{e.signal.removeEventListener("abort",E),I()},(O)=>{e.signal.removeEventListener("abort",E),x(O)})})},S=async(v)=>{if(f+=v.length,f>Hn)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let R=0;R<v.length;R+=Br){if(b>=Gi)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await w(`custom_endpoint.chunk.${b++}`,{eof:!1,data:v.subarray(R,R+Br).toString("base64")})}};try{let v=await pc({url:l.url,body:l.body,signal:e.signal,headers:{...l.headers,...u.api==="anthropic-messages"?{"x-api-key":u.apiKey}:{authorization:`Bearer ${u.apiKey}`}}});p=v.response,m=v.close;let R=p.statusCode??500;if(R>=300&&R<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(p.headers["content-encoding"]&&p.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let I={};for(let x of["content-type","retry-after","x-request-id","request-id"]){let E=p.headers[x];if(typeof E==="string")I[x]=E.replaceAll(u.apiKey,y).slice(0,4096)}await w("custom_endpoint.headers",{status:R,statusText:(p.statusMessage??"").replaceAll(u.apiKey,y).slice(0,256),headers:I});for await(let x of p){e.signal.throwIfAborted();let E=Buffer.isBuffer(x)?x:Buffer.from(x);if(g+=E.length,g>Hn)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await S(h(E))}return await S(h(Buffer.alloc(0),!0)),await w(`custom_endpoint.chunk.${b}`,{eof:!0}),{bytes:f,chunks:b}}catch(v){if(e.signal.throwIfAborted(),v instanceof r)throw v;throw new r((p?null:await fc(v,l.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{m?.()}}import{join as bi}from"path";function _c(e,a){return e===bi(a,".ara","workspace")||e===bi(a,".reason","workspace")}function Si(e,a){let l=e.filter((u)=>_c(u.path,a));return l.length===1?l[0].path:null}var yc=/^[a-f0-9]{64}$/;var Yr=32,bc=/^\/[^\x00-\x1f\x7f\\]*$/;function tr(e){if(typeof e!=="string"||e.length>4096||!bc.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((a)=>a!==""&&a!=="."&&a!=="..")}function nr(e,a){let l=a==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!l)return e;let u=l[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${l[1].toUpperCase()}:${u?`/${u}`:""}`}function ir(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let a=e;if(!tr(a.home)||!Array.isArray(a.roots)||a.roots.length>Yr)return;let l=[];for(let u of a.roots){if(!u||typeof u!=="object"||Array.isArray(u))return;let{path_fingerprint:p,path:m}=u;if(typeof p!=="string"||!yc.test(p)||!tr(m))return;l.push({path_fingerprint:p,path:m})}return{home:a.home,roots:l}}function wc(e){let a=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&a?a:void 0}function Sc(e){return wc(e)??e.email.toLowerCase()}function Kr(e){let a=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return a?Sc({name:a[1],email:a[2]}):e.trim().toLowerCase()}var Lt=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(a)=>`[${a.toLowerCase()}${a.toUpperCase()}]`),vc=[...vt.map((e)=>`/(${e.map(Lt).join("/")})(/|$)`),...Rn.map((e)=>`/(${e.map(Lt).join("/")})(/|$)`),...[...Tn].map((e)=>`/(${Lt(e)})$`),`/${Lt(".env.")}[^/]*$`,...In.map((e)=>`/[^/]*${Lt(e)}$`)],vi=`function localGithubSandboxProfile(root, temporary) {
|
|
3
3
|
return ['(version 1)','(deny default)','(import "system.sb")','(allow process-exec process-fork)',
|
|
4
4
|
'(allow file-read* (subpath "/bin") (subpath "/sbin") (subpath "/usr/bin") (subpath "/usr/sbin") (subpath "/usr/libexec") (subpath "/usr/share") (subpath "/private/var/select") (literal "/private/var/db/xcode_select_link"))',
|
|
5
5
|
'(allow file-read-metadata (path-ancestors "/opt/homebrew/bin") (path-ancestors "/usr/local/bin") (path-ancestors "/Library/Developer/CommandLineTools"))',
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{$n}from"./vm-hands-entry-lite-
|
|
2
|
+
import{$n}from"./vm-hands-entry-lite-sz7z1qby.js";var g=$n.version,Ir=`reason-cli/${g}`,Hc=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function Il(r,c){if(!Hc.test(r)||!Hc.test(c))throw Error("cannot compare invalid CLI versions");let f=(t)=>{let e=t.indexOf("-");return e===-1?[t,void 0]:[t.slice(0,e),t.slice(e+1)]},[h,i]=f(r),[x,s]=f(c),u=h.split(".").map(BigInt),d=x.split(".").map(BigInt);for(let t=0;t<3;t+=1){if(u[t]===d[t])continue;return u[t]<d[t]?-1:1}if(i===void 0||s===void 0){if(i===s)return 0;return i===void 0?1:-1}let l=i.split("."),a=s.split("."),C=Math.max(l.length,a.length);for(let t=0;t<C;t+=1){let e=l[t],n=a[t];if(e===void 0||n===void 0){if(e===n)return 0;return e===void 0?-1:1}if(e===n)continue;let o=/^\d+$/.test(e),p=/^\d+$/.test(n);if(o&&p){let I=BigInt(e),m=BigInt(n);if(I===m)continue;return I<m?-1:1}if(o!==p)return o?-1:1;return e<n?-1:1}return 0}function ys(r=Bun.main){return r.startsWith("/$bunfs/")||/^B:[\\/]~BUN[\\/]/i.test(r)}
|
|
3
3
|
export{g,Ir,Hc,Il,ys};
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
var $n={name:"github-native-engineer-device-worker-production",version:"0.2.
|
|
2
|
+
var $n={name:"github-native-engineer-device-worker-production",version:"0.2.565",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@agentclientprotocol/sdk":"1.9.0","@anthropic-ai/sandbox-runtime":"^0.0.80","@earendil-works/pi-tui":"1.0.0","@reason/runtime-distribution":"workspace:*",diff:"8.0.4","open-browser-use-sdk":"0.1.42","playwright-core":"1.60.0",toml:"5.0.1",zod:"^4.4.3"},overrides:{"@hono/node-server":"^1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"^1.20.0","basic-ftp":"^6.2.1","@grpc/grpc-js":"^1.14.5",browserslist:"^4.28.8","engine.io":"^6.6.7","fast-uri":"^3.1.8",hono:"^4.13.7","ip-address":"^10.7.4",nanoid:"^3.3.18",dompurify:"^3.4.17",postcss:"^8.5.23",qs:"^6.16.0","shell-quote":"^1.11.0","socket.io-parser":"^4.2.7",tmp:"^0.2.7",toml:"^5.0.1",undici:"^8.10.2",ws:"^8.21.0","js-yaml":"^4.3.2","@modelcontextprotocol/sdk":"^1.31.0","proxy-addr":"^2.0.8","source-map-js":"^1.2.2"}};
|
|
3
3
|
export{$n};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Pr,Rr}from"./vm-hands-entry-lite-13nx02p7.js";import{g}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Pr,Rr}from"./vm-hands-entry-lite-13nx02p7.js";import{g}from"./vm-hands-entry-lite-rqfhfp09.js";import{Bc,st,Yt,Tr,Nn}from"./vm-hands-entry-lite-t86kt9jz.js";import{L}from"./vm-hands-entry-lite-fccn6s4j.js";import{s,Et}from"./vm-hands-entry-lite-12ck5swp.js";import{spawnSync as se}from"child_process";import{dirname as S}from"path";import{spawn as U}from"child_process";import{accessSync as H,constants as J}from"fs";import{basename as q,join as B}from"path";var d=null;function R(e){if(d===e)d=null;if(e.exitCode===null&&e.signalCode===null)e.kill("SIGTERM")}var Bi=(e,t)=>{if(d)R(d);let r=B(e,Bc);try{H(r,J.X_OK)}catch{return()=>{}}let n;try{n=U(r,["--app",e,"--name",q(e,".app"),"--permission",t==="screen"?"screen_recording":"accessibility"],{detached:!0,stdio:"ignore"})}catch{return()=>{}}return n.on("error",()=>{if(d===n)d=null}),n.once("exit",()=>{if(d===n)d=null}),n.unref(),d=n,()=>R(n)};import{chmodSync as K,existsSync as I,mkdirSync as V,readFileSync as Y,realpathSync as A,renameSync as X,statSync as _,writeFileSync as z}from"fs";import{dirname as v,isAbsolute as Q,join as Z,resolve as C,sep as w}from"path";function k(e=s()){return Z(Et(e),"reason","protected-path-grants.json")}var p=null;function ee(e){let t=JSON.parse(e);if(!Array.isArray(t?.grants))return[];return t.grants.flatMap((r)=>{let n=r;return n&&typeof n.path==="string"&&Q(n.path)&&(n.kind==="file"||n.kind==="folder")&&typeof n.grantedAt==="number"?[{path:n.path,kind:n.kind,grantedAt:n.grantedAt}]:[]})}function m(e=k()){try{let{mtimeMs:t}=_(e);if(p&&p.file===e&&p.mtimeMs===t)return p.grants;let r=ee(Y(e,"utf8"));return p={file:e,mtimeMs:t,grants:r},r}catch{return[]}}function te(e,t){return e.kind==="file"?t===e.path:t===e.path||t.startsWith(`${e.path}${w}`)}function ne(e,t){let r=C(e);return m(t).some((n)=>te(n,r))}function xc(e,t){return L(e)&&!ne(e,t)}function O(e,t){V(v(t),{recursive:!0,mode:448});let r=`${t}.${process.pid}.tmp`;z(r,`${JSON.stringify({version:1,grants:e},null,2)}
|
|
3
3
|
`,{mode:384}),K(r,384),X(r,t),p=null}function D(e,t=k(),r=Date.now()){if(!I(e))throw Error(`No file or folder at ${e}.`);let n=A(e),i=v(t);if(i===n||i.startsWith(`${n}${w}`)||n.startsWith(`${i}${w}`))throw Error("Reason's own configuration folder cannot be allowed.");let o={path:n,kind:_(n).isDirectory()?"folder":"file",grantedAt:r},a=m(t).filter((l)=>l.path!==n);return O([...a,o],t),o}function j(e,t=k()){let r=I(e)?A(e):C(e),n=m(t),i=n.filter((o)=>o.path!==r);if(i.length===n.length)return!1;return O(i,t),!0}function Cc(e,t,r){let n=t?"file-read* file-write*":"file-read*";return m(r).filter((i)=>i.path===e||i.path.startsWith(`${e}${w}`)).map((i)=>`(allow ${n} (${i.kind==="file"?"literal":"subpath"} ${JSON.stringify(i.path)}))`)}var G=`Reason permissions
|
|
4
4
|
|
|
5
5
|
Usage:
|
|
@@ -20,7 +20,7 @@ this Mac may open. Only you can change this list; Sessions cannot.
|
|
|
20
20
|
allow asks for each missing one, or the one named. macOS cannot ask for Full
|
|
21
21
|
Disk Access: allow disk opens its pane, shows the file to add in Finder and
|
|
22
22
|
waits until the worker has it.
|
|
23
|
-
`,b="x-apple.systempreferences:com.apple.preference.security",re="curl -fsSL https://reasonmachines.com/install.sh | bash",ie=180000,oe=2000,M=["screen","accessibility","disk"],x={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${b}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${b}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${b}?Privacy_AllFiles`}};function F(e){return e.executable}function ae(e,t){if(e==="computer_use_identity_missing")return`Reason's background identity is not installed (${e}); reinstall Reason: ${re}`;if(e==="computer_use_identity_outdated")return`Reason's background identity is outdated (${Yt(t)??"unknown"}; this CLI is ${g}) (${e}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${e}); run the installed \`reason\``}function sl(e=s()){let t=Tr(e);if(t.length>0)return{state:"ready",path:S(S(S(t[0]))),prefix:t};let r=Nn(t,e)??"computer_use_identity_unavailable";return{state:r,path:st(e),detail:ae(r,e)}}function E(){return{identity:()=>sl(),grants:(e)=>Pr(e),request:(e,t)=>Rr(e,t),worker:async()=>(await import("./status-
|
|
23
|
+
`,b="x-apple.systempreferences:com.apple.preference.security",re="curl -fsSL https://reasonmachines.com/install.sh | bash",ie=180000,oe=2000,M=["screen","accessibility","disk"],x={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${b}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${b}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${b}?Privacy_AllFiles`}};function F(e){return e.executable}function ae(e,t){if(e==="computer_use_identity_missing")return`Reason's background identity is not installed (${e}); reinstall Reason: ${re}`;if(e==="computer_use_identity_outdated")return`Reason's background identity is outdated (${Yt(t)??"unknown"}; this CLI is ${g}) (${e}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${e}); run the installed \`reason\``}function sl(e=s()){let t=Tr(e);if(t.length>0)return{state:"ready",path:S(S(S(t[0]))),prefix:t};let r=Nn(t,e)??"computer_use_identity_unavailable";return{state:r,path:st(e),detail:ae(r,e)}}function E(){return{identity:()=>sl(),grants:(e)=>Pr(e),request:(e,t)=>Rr(e,t),worker:async()=>(await import("./status-89999mdn.js")).connectionMacState(),open:(e)=>{se("/usr/bin/open",e,{stdio:"ignore",timeout:1e4})},tile:Bi,restartConnection:async()=>(await import("./connect-cli-rxb3qtra.js")).restartConnection(),sleep:(e)=>new Promise((t)=>setTimeout(t,e)),now:()=>Date.now()}}function N(e,t,r){if(e.state!=="ready"||!t)return"unknown";return t[r]?"granted":"missing"}async function Ac(e){let t=e.identity(),r=t.state==="ready"?await e.grants(t.prefix):null,n=await e.worker(),i=n?F(n):null,o=!i||n?.full_disk_access==="unknown"?"unknown":n?.full_disk_access==="granted"?"granted":"missing",a=(l,u,c)=>{let{label:f,purpose:y,level:h}=x[l];return{id:l,label:f,purpose:y,level:h,state:u,holder:c}};return{identity:{state:t.state,path:t.path,detail:t.state==="ready"?null:t.detail},worker_detail:i?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[a("screen",N(t,r,"screen"),t.path),a("accessibility",N(t,r,"accessibility"),t.path),a("disk",o,i)]}}function Rl(e){let t=e.identity.state==="ready"?null:e.identity.state,r=e.permissions.filter((o)=>o.state==="granted").length,n=[...t?[t]:[],...e.permissions.filter((o)=>o.state!=="granted"&&!(t&&o.id!=="disk")).map((o)=>`${o.label} ${o.state}`)],i=!t&&e.permissions.some((o)=>o.state==="missing");return`Permissions: ${r} of ${e.permissions.length}${n.length>0?` (${n.join(", ")})`:""}`+(i?" \u2014 reason permissions allow":n.length>0?" \u2014 reason permissions":"")}function ce(e){let t=[];if(e.identity.detail)t.push(e.identity.detail);t.push(`Reason: ${e.identity.path}`);let r=e.permissions.find((n)=>n.id==="disk");t.push(r?.holder?`Worker: ${r.holder}`:`Worker: ${e.worker_detail}`),t.push("");for(let n of e.permissions){let i=`${n.label}${n.level==="recommended"?" (recommended)":""}`;t.push(` ${n.id.padEnd(13)} ${n.state.padEnd(7)} ${i}: ${n.purpose}`)}if(e.permissions.some((n)=>n.state==="missing"))t.push("","Allow the missing ones: reason permissions allow");return`${t.join(`
|
|
24
24
|
`)}
|
|
25
25
|
`}async function T(e,t){let r=t.now()+ie;for(;;){if(await e())return!0;if(t.now()>=r)return!1;await t.sleep(oe)}}async function al(e,t){let r=t.host??E(),{io:n}=t,i=await Ac(r),o=i.permissions.filter((c)=>e.includes(c.id)&&c.state!=="granted");if(o.length===0)return n.stdout.write(`Reason permissions: ${e.map((c)=>x[c].label).join(", ")} already allowed.
|
|
26
26
|
`),0;let a=!1,l=!1,u=r.identity();for(let c of o){let{label:f,pane:y}=x[c.id];if(c.id!=="disk"){if(u.state!=="ready"){if(!a)n.stderr.write(`Reason permissions: ${u.detail}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{g}from"./vm-hands-entry-lite-
|
|
2
|
+
import{g}from"./vm-hands-entry-lite-rqfhfp09.js";import{s}from"./vm-hands-entry-lite-12ck5swp.js";import{randomUUID as P}from"crypto";import{spawnSync as b}from"child_process";import{chmodSync as z,cpSync as Z,existsSync as x,lstatSync as A,mkdirSync as L,readdirSync as ee,readFileSync as C,readlinkSync as te,realpathSync as T,renameSync as _,rmdirSync as ne,rmSync as y,symlinkSync as D,writeFileSync as re}from"fs";import{dirname as h,join as u,relative as ie,resolve as oe}from"path";var fs="so.ara.cli",w=[fs,"com.reasonmachines.cli"],Fi="5LJFSBRY2F";function ji(e){return`(${e.map((t)=>`identifier "${t}"`).join(" or ")}) and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${Fi}"`}var Y="ReasonBackgroundIdentity",Bc="Contents/Helpers/ReasonPermissionTile",se="so.ara.cli.permission-tile",be=ji([se,"com.reasonmachines.cli.permission-tile"]),k="AraBackgroundIdentity",ce="Reason",Ae=ji(w),ae=`anchor apple generic and (${w.map((e)=>`identifier "${e}"`).join(" or ")}) and certificate leaf[subject.OU] = "${Fi}"`;class St extends Error{code;constructor(e,t){super(t);this.code=e;this.name="MacOSBackgroundIdentityError"}}var On="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function st(e=s()){return u(e,"Library","Application Support","Reason","Background","Reason.app")}function O(e=s()){return u(e,"Library","Application Support","Ara","Background","Ara.app")}function ue(e){try{return A(e).isFile()}catch{return!1}}function v(e){return[Y,k].map((t)=>u(e,"Contents","MacOS",t)).find(ue)??null}function d(e){try{if(!A(e).isDirectory())return!1;let t=C(u(e,"Contents","Info.plist"),"utf8");return w.some((n)=>t.includes(`<string>${n}</string>`))&&(t.includes(`<string>${ce}</string>`)||t.includes("<string>Ara</string>"))&&v(e)!==null}catch{return!1}}function Yt(e=s()){let t=st(e);if(!d(t))return null;try{let n=C(u(t,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(n)?.[1]??null}catch{return null}}function ms(e,t=s()){let n=Yt(t);return n===null||V(R(n.split(".")),R(e.split(/[.-]/).slice(0,3)))}var le=1e4;function F(e,t){return b(e,[...t],{stdio:"ignore",timeout:le}).status??1}var G=new Set;function K(e){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let t=(n)=>{try{return T(n)}catch{return oe(n)}};if(e!==void 0&&t(e)!==t(s()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var W=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.(?:ara|reason)(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,H=new Set(["ara","ara.exe","reason","reason.exe"]);function R(e){return e.map((t)=>Number(t))}function V(e,t){for(let n=0;n<3;n+=1)if(e[n]!==t[n])return e[n]<t[n];return!1}var de=[0,2,161];function fe(e){if(e===null)return!0;let t=de,n=null;try{n=T(process.execPath)}catch{}return e.some((r)=>{let i=W.exec(r);if(i){let f=i[1]===void 0?i.slice(4,7):i.slice(1,4);return V(R(f),t)}let o=r.slice(r.lastIndexOf("/")+1);return H.has(o)&&r!==n&&r!==process.execPath})}function pe(){let e=b("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(e.status!==0)return null;let t=[];for(let n of e.stdout.split(`
|
|
3
3
|
`)){let r=/^\s*(\d+)\s+(\S.*)$/.exec(n);if(!r||Number(r[1])===process.pid)continue;let i=r[2].trimEnd(),o=i.slice(i.lastIndexOf("/")+1);if(!W.test(i)&&H.has(o)){let a=b("/usr/sbin/lsof",["-a","-p",r[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
|
|
4
4
|
`).find((l)=>l.startsWith("n/"));if(a)i=a.slice(1)}t.push(i)}return t}function gs(e){if(K(e.home),!d(e.sourceApp))throw new St("identity_invalid","The packaged Reason background identity is missing or invalid.");let t=e.command??F,n=st(e.home),r=h(n);L(r,{recursive:!0,mode:448}),z(r,448);let i=T(e.sourceApp),o=null;try{o=T(n)}catch{}if(i!==o){let f=`${process.pid}.${P()}`,a=u(r,`.Reason.app.${f}.tmp`),l=u(r,`.Reason.app.${f}.old`),m=!1;try{if(Z(i,a,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!d(a))throw new St("identity_invalid","The copied Reason background identity is invalid.");let S=e.releaseSigned?["--test-requirement",`=${ae}`]:[];if(t("/usr/bin/codesign",["--verify","--strict",...S,a])!==0)throw new St("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let I=!1;for(let p=0;p<4;p+=1){let E=!1;try{_(n,l),E=!0,m=!0}catch(c){if(c.code!=="ENOENT")throw c}if(p===0)e.beforePublish?.();try{_(a,n),I=!0}catch(c){let Q=c.code;if(!["EEXIST","ENOTEMPTY"].includes(Q??""))throw c;if(E)y(l,{recursive:!0,force:!0}),m=!1;if(p===3)throw c;continue}if(E)y(l,{recursive:!0,force:!0}),m=!1;break}if(!I)throw Error("Could not publish Reason's background identity.")}catch(S){if(m&&!x(n)&&x(l))_(l,n);throw S}finally{y(a,{recursive:!0,force:!0}),y(l,{recursive:!0,force:!0})}}return q(n,e,{verified:i!==o}),n}function J(e){return u(h(e),".Reason.app.registered")}function j(e){try{let t=A(e);return t.isDirectory()?`${t.ino}:${t.birthtimeMs}`:null}catch{return null}}function N(e){let t=j(e);try{return t!==null&&C(J(e),"utf8")===t}catch{return!1}}function X(e){if(d(e))return"bundle";try{if(A(u(e,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return A(u(e,"Contents","MacOS",k)).isSymbolicLink()?"retired":null}catch{return null}}function q(e,t,n={}){let r=t.command??F;if(!n.verified&&r("/usr/bin/codesign",["--verify","--strict",e])!==0)throw new St("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if(r(On,["-f",e])!==0)throw new St("identity_register_failed","Could not register Reason's macOS background identity.");let i=j(e);try{if(i)re(J(e),i,{mode:384})}catch{}try{ge(e,t.home,r,t.runningExecutables??pe)}catch(o){let f=o.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${f})
|
|
5
5
|
`)}}function ge(e,t,n,r){let i=v(e);if(!i)return;let o=O(t),f=h(o),a=(c)=>u(c,"Contents","MacOS",k),l=ie(h(a(o)),i),m=`${process.pid}.${P()}`,S=X(o);if(S===null)return;let I=S==="bundle";if(I)n(On,["-u",o]);let p=u(f,`.Ara.app.${m}.old`);if(!G.has(o)&&!fe(r())){if(!I)n(On,["-u",o]);try{_(o,p)}catch(c){if(c.code==="ENOENT")return;throw c}y(p,{recursive:!0,force:!0}),ye(f);return}if(!I){if(te(a(o))===l)return;let c=`${a(o)}.${m}`;D(l,c);try{_(c,a(o))}finally{y(c,{force:!0})}return}let E=u(f,`.Ara.app.${m}.shim`);L(h(a(E)),{recursive:!0}),D(l,a(E));try{try{_(o,p)}catch(c){if(c.code==="ENOENT")return;throw c}try{_(E,o)}catch(c){if(x(o))return;throw _(p,o),c}}finally{y(E,{recursive:!0,force:!0}),y(p,{recursive:!0,force:!0})}}function ye(e){try{if(ee(e).some((n)=>n!==".DS_Store"))return;y(u(e,".DS_Store"),{force:!0}),ne(e)}catch{}}var M=new Map;function _s(e=s()){let t=M.get(e);if(t)return t;if(process.platform!=="darwin")return[];let n=B(e);if(n===null&&x(h(st(e))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),n=B(e);if(n===null)return[];return M.set(e,n),n}function B(e){let t=st(e),n=O(e);if(!d(t)||!N(t))try{Hi({home:e,skipWhenSettled:!0})}catch{}let r=d(t)&&(N(t)||!d(n))?t:d(n)?n:null,i=r?v(r):null;if(!i)return null;if(r===n)G.add(n);let o=b(i,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return o.status===0&&o.stdout===`spawn
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{R}from"./vm-hands-entry-lite-z65xva21.js";import{w,Ve}from"./vm-hands-entry-lite-33at6g06.js";import{be,C}from"./vm-hands-entry-lite-
|
|
2
|
+
import{R}from"./vm-hands-entry-lite-z65xva21.js";import{w,Ve}from"./vm-hands-entry-lite-33at6g06.js";import{be,C}from"./vm-hands-entry-lite-7r27208j.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";function ut(e,i){let t=R(e,"REASON_API_URL")?.trim();if(!t)return Ve(i);let n=new URL(t);if(n.protocol!=="https:"&&!(n.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(n.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return n.origin}function el(e){return R(e,"REASON_API_URL")?.trim()?ut(e,"production"):void 0}function Wn(e){return R(e,"REASON_API_KEY")?.trim()||void 0}async function ir(e,i){let t=e.env??process.env,n=Wn(t);if(!n)return(e.getCredentials??be)({apiOrigin:el(t),signal:i});let a=ut(t,e.channel??w({env:t})),o=await(e.fetchImpl??fetch)(a+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+n,accept:"application/json"},signal:i}),p=await o.json().catch(()=>({})),r=q(p)?p:{};if(!o.ok){let s=typeof r.detail==="string"?r.detail:typeof r.message==="string"?r.message:"API key authentication failed ("+o.status+")";throw new C(o.status,typeof r.error==="string"?r.error:"api_key_auth_failed",s)}if(typeof r.org_id!=="string"||!r.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let l=Array.isArray(r.scopes)?r.scopes.filter((s)=>typeof s==="string"):[];return{credentialKind:"api_key",apiOrigin:a,accessToken:n,orgId:r.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:l}}export{ut,el,Wn,ir};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
2
|
import{At,Lr,xs,Cs,As,Mr}from"./vm-hands-entry-lite-fxptf351.js";import"./vm-hands-entry-lite-gxf2r5en.js";import{createHash as K,randomBytes as ge}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Qe,openSync as Oe,renameSync as Ze,rmSync as en,statSync as De,writeSync as Me,constants as H}from"fs";import{join as re}from"path";var nn=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:tn(e)}}function tn(e){let n=e.payload[xs];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var W=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),V=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function L(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(L).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${L(e[n])}`).join(",")}}`}async function Ra(e){let n=await crypto.subtle.importKey("pkcs8",V(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=V(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),g=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),h=K("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:g,fingerprint:h}}var sn=16;class ao{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;abandoned=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let g=this.bound.get(e);if(!g)return!1;if(g.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((h)=>setTimeout(h,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:nn,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:W(this.keys.signingSpki),env_public_key:W(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:W(ge(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(L(n)));return{...n,device_signature:W(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=W(ge(32)),g=Mr({method:"GET",pathAndQuery:At,timestamp:i,nonce:s,challenge:e,bodySha256:K("sha256").update("").digest("hex")}),h=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(g)));return{t:"hello",timestamp:i,nonce:s,signature:W(rn(h)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let s of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(s))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(K("sha256").update(L({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((s)=>s.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=sn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((s)=>s.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let s,g,h=new Promise((m,S)=>{s=m,g=S});return h.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:h,resolve:s,reject:g}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(w){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(w,"the bind's kill-verify failed")}let i,s=new Promise((w)=>{i=w}),g=!1,h=!1,m=()=>{h=!0,i()},S=n.promise.then(()=>new Promise((w,I)=>{this.exclusive(async()=>{if(h){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}g=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();w()}catch(b){I(b)}await s})}));S.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:S,inTurn:()=>g,leave:m})}finally{m()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);if(this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","abandoned before its launch");s=!0;let{launchId:g,applied:h,readyData:m}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),S=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let w=null,I=null;if(e.env){let b=e.claim?.owner??{},R=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof b.device_id==="string"?b.device_id:"",rootId:e.claim?.root_id??""});w=this.hooks.installEnvironment(e.bind_id,R),I=typeof R.snapshot_id==="string"&&R.snapshot_id?R.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,R)}if(this.unbinding.has(e.bind_id)||this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:g,envInstalled:w!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:g,snapshot_revision:w,snapshot_id:I,layout:S,...m?{ready_data:m}:{},policy_digest:K("sha256").update(L({hands_confinement:h.hands_confinement??null,browser_egress:h.browser_egress??null})).digest("hex")}}catch(g){if(i)fe(i);if(s){let h=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(h);else await h()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(g,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}abandonBinding(e){if(!this.binding.has(e))return;this.abandoned.add(e),this.abandonWorkspaceGrant(e);try{this.hooks.abortExecutor?.(e)}catch{}}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),g=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${g}`,s),{snapshot_id:e.snapshotId,installed_revision:g,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:K("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(g){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw g}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",V(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),g=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),h=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(e.iv),additionalData:new TextEncoder().encode(n)},g,V(e.ct)).catch(i),m=JSON.parse(new TextDecoder().decode(h));if(!m||typeof m!=="object"||Array.isArray(m))throw new l("vm_hands_env_invalid","env not an object");return m}writeJobEnvRootOnly(e,n){let i=re(this.options.envRoot,`bind-${e}`);Qe(i,{mode:448});let s=De(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let g=n.variables&&typeof n.variables==="object"?n.variables:{},h=Object.entries(g).filter(([w,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(w)&&typeof I==="string").map(([w,I])=>`export ${w}='${String(I).replaceAll("'","'\\''")}'`).join(`
|
|
3
3
|
`)+`
|
|
4
|
-
`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),pn=3,vn=20000,wn=250,bn=2000;function je(e){let n=Math.min(wn*2**(e-1),bn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function kn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var Sn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function In(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function Pn(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function En(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Tn=1e4,Rn=1000;async function Ta(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await An(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<pn&&Date.now()-n<vn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function An(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,Rn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Tn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=Sn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await Pn(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+yn,q=1,M=await f("hands.ready",se);while(kn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===Cs){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===Lr)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?En(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(As,{code:o}).catch(()=>{return}),In(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as On}from"fs";var xn=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Dn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-te2ze1e7.js");await h();return}z("parsed",{t0:Math.round(xn)});let e="";try{e=On(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-09ehkm3c.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Dn();export{Ra,ao,Ta};
|
|
4
|
+
`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),pn=3,vn=20000,wn=250,bn=2000;function je(e){let n=Math.min(wn*2**(e-1),bn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function kn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var Sn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function In(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function Pn(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function En(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Tn=1e4,Rn=1000;async function Ta(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await An(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<pn&&Date.now()-n<vn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function An(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,Rn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Tn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=Sn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await Pn(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+yn,q=1,M=await f("hands.ready",se);while(kn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===Cs){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===Lr)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?En(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(As,{code:o}).catch(()=>{return}),In(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as On}from"fs";var xn=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Dn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-gkt79hcp.js");await h();return}z("parsed",{t0:Math.round(xn)});let e="";try{e=On(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-tdr6j55n.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Dn();export{Ra,ao,Ta};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import"./vm-hands-entry-lite-fxptf351.js";import"./vm-hands-entry-lite-kbnxk71q.js";import"./vm-hands-entry-lite-zp7chzcc.js";import"./vm-hands-entry-lite-rxydyqke.js";import{Qe,nn,pi,et}from"./vm-hands-entry-lite-
|
|
2
|
+
import"./vm-hands-entry-lite-fxptf351.js";import"./vm-hands-entry-lite-kbnxk71q.js";import"./vm-hands-entry-lite-zp7chzcc.js";import"./vm-hands-entry-lite-rxydyqke.js";import{Qe,nn,pi,et}from"./vm-hands-entry-lite-gcqqnnze.js";import"./vm-hands-entry-lite-cc8hwgxc.js";import"./vm-hands-entry-lite-qjrgvdbj.js";import"./vm-hands-entry-lite-gxf2r5en.js";import"./vm-hands-entry-lite-sh4mqy93.js";import"./vm-hands-entry-lite-z65xva21.js";import"./vm-hands-entry-lite-s93f3pbv.js";import"./vm-hands-entry-lite-33at6g06.js";import"./vm-hands-entry-lite-xfak34av.js";import"./vm-hands-entry-lite-a3gq377t.js";import{zn,qn,Wr,Vr}from"./vm-hands-entry-lite-ncyrz48z.js";import"./vm-hands-entry-lite-b1vanmtv.js";import"./vm-hands-entry-lite-yg4dk99m.js";import"./vm-hands-entry-lite-88dxn9b5.js";import"./vm-hands-entry-lite-12ck5swp.js";import"./vm-hands-entry-lite-pg7nnyc6.js";import{spawn as Me}from"child_process";import{chmodSync as Le,chownSync as Te,existsSync as E,lstatSync as ee,mkdirSync as J,mkdtempSync as We,readdirSync as X,readFileSync as k,realpathSync as He,rmdirSync as pe,rmSync as ze,writeFileSync as B}from"fs";import{basename as Ue,dirname as Be,join as p}from"path";import{readFileSync as ae,readlinkSync as ce}from"fs";import{relative as Ne}from"path";var ue=16;function le(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function De(e){let r=[];for(let t of e.split(`
|
|
3
3
|
`)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:le(n[3]),mountPoint:le(n[4])})}return r}function Ae(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(De(m).filter((_)=>c(_.mountPoint)).map((_)=>[`${_.mountPoint}\x00${_.device}\x00${_.root}`,_.mountPoint])),l=o(r),d=o(t),b=(m)=>Ne(n,m)||".",R=[...l].filter(([m])=>!d.has(m)).map(([,m])=>b(m)),N=[...d].filter(([m])=>!l.has(m)).map(([,m])=>b(m));return{missing:R,extra:N,referenceCount:l.size,ownCount:d.size}}function de(e,r,t,n="/proc"){let c,o,l=null;try{c=ae(`${n}/1/mountinfo`,"utf8"),o=ae(`${n}/self/mountinfo`,"utf8")}catch(_){let O=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{l=ce(`${n}/1/ns/mnt`)===ce(`${n}/self/ns/mnt`)}catch{}let{missing:d,extra:b,referenceCount:R,ownCount:N}=Ae(e,c,o),m={reference_count:R,own_count:N,missing_count:d.length,extra_count:b.length,same_namespace:l};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ue)});if(d.length)throw r("vm_hands.mount_mismatch",{...m,missing:d.slice(0,ue)}),t(`${d.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var ve="/sys/fs/cgroup/reason-payload",L="vm-hands",Fe="/run/ara-srt/fallbacks.jsonl",oe="/reason-person",Ke="/reason-workload",je="surface",ne=5000,Ge=1e4,fe="__VM_HANDS_PROOF_DIR__",Ee="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,r){super(r);this.code=e}}function Ve(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new w("vm_hands_bind_invalid","bad bind id");return p(e,L,`b-${r.toLowerCase()}`)}var Je=5000,be=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Ze(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=p(Be(e),r.toLowerCase());return Ue(e).toLowerCase()===r.toLowerCase()?e:t}function yn(e){let r=e.cgroup??ve,t=e.init.layout.payload_uid,n=e.init.workload_ended!==!0,c=(s)=>U(s,oe)||n&&U(s,Ke),o=e.log??(()=>{}),l=(s)=>Ze(e.init.layout.session_root,s),d=new Map,b=new Map,R=0,N=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(R>s.length?0:R).split(`
|
|
4
4
|
`).filter(Boolean);R=s.length;let u=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(u.length)o("vm_hands.srt_server_starts",{count:u.length,elapsed_ms:u.slice(0,8)})}catch{}},m=null,_=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",x=()=>{m??=me()},P=0,F=()=>{try{let s=k(Fe,"utf8"),i=s.slice(P>s.length?0:P);P=s.length;let u=i.split(`
|
|
5
5
|
`).filter(Boolean).slice(0,1000);if(!u.length)return null;let f={},g=0;for(let S of u)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:u.length,codes:f,max_elapsed_ms:g}),{count:u.length,codes:f,max_elapsed_ms:g}}catch{return null}},I=(s,i,u)=>Ce(s,i,u),K=(s)=>(i,u,f)=>Me("/bin/sh",["-c",`echo $$ > ${be(p(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...u],f),Ce=K(p(r,L)),j=p(r,L,"probe"),W=(s)=>Ve(r,s),Oe=(s)=>{let i=W(s);try{J(i,{mode:493})}catch(u){if(!(u&&typeof u==="object"&&("code"in u)&&u.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},xe=(s)=>{try{pe(W(s))}catch{}},H=e.prespawn?nn({spawnProcess:I,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;H?.arm();let Y=H?setInterval(()=>{H.arm()},Je):null;Y?.unref?.();let q=new Set;async function G(s){let i=d.get(s);if(d.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:W,async startExecutor(s){if(x(),b.set(s.bindId,me()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await G(s.bindId);let{claim:i,bindId:u}=s,f=Oe(u),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,D=new Promise((a,v)=>{h=a,y=v}),A,C=new Promise((a)=>{A=a}),z=et({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(u,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...H?{takePrespawnedWorker:(a)=>{let v=H.take(a);if(!v?.pid)return v;try{return B(p(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:H.adopt}:{}}).then(()=>{A("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),A(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));if(d.set(u,{abort:S,done:z,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0}),q.delete(u))G(u).catch(()=>{return});let M=await D,V=M.executor_launch_id;if(typeof V!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:V,readyData:M,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return d.get(s)?.exited??new Promise(()=>{})},abortExecutor(s){if(!d.has(s)){q.add(s);return}G(s).catch(()=>{return})},freezeBind(s){let i=W(s);if(E(p(i,"cgroup.freeze")))B(p(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){if(s?.bindId)q.delete(s.bindId);let i=new Set(s?.keep??[]);if(await Ie(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&E(p(O,"cgroup.events")))N(),await re(O,Date.now()+ne,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ne;if(E(p(j,"cgroup.events"))){await re(j,s,"probe");try{pe(j)}catch{}}let i=ie(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Xe(r,i,s);let u=(g)=>{let S=ie(g);return S!==null&&S<=i},f=_e(t).filter((g)=>u(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...ge(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,p(r,L)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=he(m).filter((y)=>y!==process.pid&&!c(y)&&!U(y,"/reason-vm-hands")&&!U(y,S)&&!g.some((D)=>te(y,D)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:se(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:se(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(x(),!i.includes(fe))throw new w("vm_hands_probe_failed","probe names no proof directory");let u=e.proofParent??"/tmp/reason-vm-hands-proof";J(u,{mode:457,recursive:!0});let f=ee(u);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=We(p(u,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Te(g,t,t),Le(g,448);let h=ee(g).ino;try{J(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(fe,g).replaceAll(Ee,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),D="";y.stdout?.on("data",(C)=>{if(D.length<16384)D+=C.toString("utf8").slice(0,16384-D.length)});let A=await new Promise((C)=>{let z=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},Ge);y.once("error",()=>{clearTimeout(z),C(127)}),y.once("close",(M)=>{clearTimeout(z),C(M??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:A}),{exitCode:A,markers:D,proofDirInode:h}}finally{if(!S)ze(g,{recursive:!0,force:!0})}},restatLayout(s){let i=l(s),u=i===e.init.layout.session_root?e.init.layout.alias:p(i,"repo"),f="invalid";try{pi(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=ee(u);S=h.uid,g=f==="0:0:755"&&u===p(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&He(u)===u&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=l(s);try{de(i,o,(u)=>new w("vm_hands_mount_mismatch",u))}catch(u){if(i!==e.init.layout.session_root&&u instanceof w&&u.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw u}},installEnvironment(s,i){let u=d.get(s);if(!u)throw new w("environment_unavailable","no executor owns an environment");return Qe({root:e.root,operationId:u.operationId,payload:i}).installed_revision},async stop(){if(Y)clearInterval(Y);H?.close(),await Promise.all([...d.keys()].map((s)=>G(s)))}};function $e(){try{return X(p(r,L),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function Ie(s,i,u=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=tn();try{await sn();let S=Date.now()+ne,h=new Set($e().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=G(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(E(p(W(a),"cgroup.events")))await re(W(a),S,"bind");await v}let D=[...f].map((a)=>W(a).replace(/^\/sys\/fs\/cgroup/,"")),A=["/",...[r,p(r,L)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),z=(a)=>c(a)||D.some((v)=>U(a,v))||A.some((v)=>te(a,v)),M=u?[]:_e(t).filter((a)=>!z(a));if(M.length)throw o("vm_hands.kill_survivors",{pids:M.slice(0,16),beside:f.size,...ge(M)}),new w("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside a live bind`);let V=(a)=>!z(a)&&!U(a,"/reason-vm-hands")&&!U(a,C)&&!A.some((v)=>te(a,v));if(y!==null){let a=he(y).filter((v)=>v!==process.pid&&V(v));if(a.length)throw o("vm_hands.kill_strays",{strays:se(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),xe(a)}finally{g()}}}function ie(e,r="/proc"){try{let t=k(p(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function Se(e,r="/proc"){try{let t=k(p(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Xe(e,r,t){try{B(p(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=Pe(e).filter((o)=>ke(o,e)),c=new Set(n.filter((o)=>{let l=ie(o);return l!==null&&l<=r}));for(let o=!0;o;){o=!1;for(let l of n){if(c.has(l))continue;let d=Se(l);if(d!==null&&c.has(d))c.add(l),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(p(e,"cgroup.freeze"),"0")}catch{}}}function te(e,r,t="/proc"){try{return k(p(t,String(e),"cgroup"),"utf8").split(`
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{zn,qn,Wr,Vr,Gr,hl}from"./vm-hands-entry-lite-
|
|
2
|
+
import{zn,qn,Wr,Vr,Gr,hl}from"./vm-hands-entry-lite-ncyrz48z.js";export{zn as VM_HANDS_OP_RUNNER_PERSON_ARG,qn as VM_HANDS_OP_RUNNER_SURFACE_ARG,Vr as VM_HANDS_SURFACE_DIRECTORY_ARG,Gr as VM_HANDS_SURFACE_OPS,Wr as VM_HANDS_SURFACE_UID_ARG,hl as runVmHandsOpRunner};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{er}from"./vm-hands-entry-lite-fxptf351.js";import"./vm-hands-entry-lite-gxf2r5en.js";import{Gr}from"./vm-hands-entry-lite-
|
|
3
|
-
`,{mode:420}),o("srt_base_keyed",{})}catch{o("srt_base_keyed_skipped",{reason:"error"})}}function B(o,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof o.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(o.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==o.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((m)=>N(m,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[m,S]of[[a,!1],["/usr/local/bin",!0]]){let _=N(m);if((S?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),y=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:y}),u()})})}var Y=3000;function Re(o){if(!o||typeof o!=="object"||Array.isArray(o))return null;let n=o,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(o){j(o,{recursive:!0,mode:448});let n=te(o);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${o}`)}async function ce(o){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-
|
|
4
|
-
`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===o&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(o,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:o.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(o=process.platform,n="/proc/self/oom_score_adj"){if(o!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(o,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(o,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((r)=>setTimeout(()=>r(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:y},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-xma0330a.js"),import("./worker-sandbox-6kkhvryn.js")]);c();try{y({value:String(o.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,m=new Promise((e)=>{f=e}),S=m.then(()=>import("./vm-hands-executor-
|
|
2
|
+
import{er}from"./vm-hands-entry-lite-fxptf351.js";import"./vm-hands-entry-lite-gxf2r5en.js";import{Gr}from"./vm-hands-entry-lite-ncyrz48z.js";import{Ra,ao,Ta}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(o,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){o("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
|
|
3
|
+
`,{mode:420}),o("srt_base_keyed",{})}catch{o("srt_base_keyed_skipped",{reason:"error"})}}function B(o,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof o.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(o.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==o.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((m)=>N(m,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[m,S]of[[a,!1],["/usr/local/bin",!0]]){let _=N(m);if((S?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),y=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:y}),u()})})}var Y=3000;function Re(o){if(!o||typeof o!=="object"||Array.isArray(o))return null;let n=o,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(o){j(o,{recursive:!0,mode:448});let n=te(o);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${o}`)}async function ce(o){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-wyshazh7.js"),import("./hands-worker-source-8pe7yv0m.js"),import("./network-contract-nkwcf4r9.js"),import("./device-workspace-4bj43nxq.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-pck5har9.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:er,execution_eligible:!0,instance_generation:o.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(o,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...o.lanes},...o.probing?{probing:X.filter((t)=>o.lanes[t]!==!0)}:{},...o.displayVideo?{displayVideo:!0}:{}}}function _e(o,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=o.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let y=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of y)l[c]=s.operation_constraints[c];return{...o,capabilities:{...a,supported_operations:["hands.connect",...I,...y],operation_constraints:l}}}function pe(o){for(let n of G("/etc/passwd","utf8").split(`
|
|
4
|
+
`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===o&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(o,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:o.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(o=process.platform,n="/proc/self/oom_score_adj"){if(o!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(o,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(o,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((r)=>setTimeout(()=>r(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:y},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-xma0330a.js"),import("./worker-sandbox-6kkhvryn.js")]);c();try{y({value:String(o.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,m=new Promise((e)=>{f=e}),S=m.then(()=>import("./vm-hands-executor-kyb5t371.js")).then(({createVmHandsExecutor:e})=>{let r=e({init:o,root:V,runtimeDirectory:O,apiOrigin:o.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(o,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),r}),_=(e)=>async(...r)=>(await S)[e](...r),x=null;S.then((e)=>{x=(r)=>e.executorExited(r)});let g={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};S.then((e)=>{g.restatLayout=(r)=>e.restatLayout(r),g.verifyMounts=(r)=>e.verifyMounts(r),g.installEnvironment=(r,d)=>e.installEnvironment(r,d),g.freezeBind=(r)=>e.freezeBind(r),g.abortExecutor=(r)=>e.abortExecutor(r),g.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await Ra(o),C=new ao(o,q,g,{envRoot:W}),M=ce(o),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-ha0ey4zh.js")]).then(([e,r])=>{K=()=>_e(e,r.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=m.then(()=>import("./vm-hands-executor-kyb5t371.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:r,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:o.layout.payload_uid,payloadGid:pe(o.layout.payload_uid),bindCgroup:(i)=>r(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let r=Date.now()+le;while(C.settingUp&&Date.now()<r)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await Ta({apiOrigin:o.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:r,bindId:d,signal:i,emit:E})=>{let k=fe(o,r);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(r.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(r.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=r.capability==="pty.start"&&e==="person"&&!r.authority;if(de.has(String(r.capability))&&!Z||r.capability==="ports.list"){let{executeLocalOperation:p}=await import("./local-capabilities-ha0ey4zh.js");return p(k,r,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Gr.has(String(r.capability))){if(w.lanes[String(r.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(r.attempt_id),claim:r,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(r.attempt_id),claim:r,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:r})=>Gr.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:r.kind,payload:r.payload??{}}})??!1),opCompleted:({claim:e,status:r,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:r}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,r)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,r)},onTurn:(e,r)=>{if(r)u.set(e,r);else u.delete(e)}}),await(await S).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};
|