@reason-machines/cli-linux-x64 0.2.567 → 0.2.568

package/bin/vm-hands/{vm-hands-entry-lite-298kzt93.js → vm-hands-entry-lite-mzw2vcah.js}

@@ -1,5 +1,5 @@
 // @bun
-import{R,Rn}from"./vm-hands-entry-lite-ys4jhf7n.js";import{w,ye,W,An,Pn,Cr}from"./vm-hands-entry-lite-0xfme8gg.js";import{Q,ve}from"./vm-hands-entry-lite-4kb5rq3d.js";import{Aa,be,Pa,C,io,me}from"./vm-hands-entry-lite-3r063pb4.js";import{g}from"./vm-hands-entry-lite-crjaacc2.js";import{ut,Vn,ir}from"./vm-hands-entry-lite-dzdjwa06.js";import{a,fn,Ht,Si,mt,mn,fr,gn,mr,Ut,ae,rt,Ei,zt}from"./vm-hands-entry-lite-1as6h9ed.js";import{Nr,Ss,Es,pe,Ys,tr,Hn}from"./vm-hands-entry-lite-vvhfaxpd.js";import{Hr}from"./vm-hands-entry-lite-1cdtev4n.js";import{Da,k,or,sr,ee,ar,uo,po,Zr,dt,ho,Qr,en,Kn,Jn,mo,go,_o,Xn}from"./vm-hands-entry-lite-rmcdfbkk.js";import{ri,ni,K,qa,Wa,oe,x,p,vo,ge,se,O,$t,Qe,rn,So,E,_e,Qa,ec,tc,ai,nn,pt,rc,Mt,on,Pe,J,ic,Co,Ao,an,et}from"./vm-hands-entry-lite-cy8yc9gb.js";import{je}from"./vm-hands-entry-lite-732hnx41.js";import{cr,Ae,Oa,tn,Na,$a}from"./vm-hands-entry-lite-bqs4pkyb.js";import{ne}from"./vm-hands-entry-lite-7aeqbfc8.js";import{le,A,ts,rs}from"./vm-hands-entry-lite-vedb5r12.js";import{Nn,Ln,Ui,Fc}from"./vm-hands-entry-lite-tv5mcw97.js";import{kr,ue}from"./vm-hands-entry-lite-t2rhwchw.js";import{Lt,ie,N,no}from"./vm-hands-entry-lite-n5jyzccm.js";import{Ni,ke,de,j,ze,is,kn,os,qe,Li,$i,ss,xn,Ie,as,Cn}from"./vm-hands-entry-lite-zaj1vnnd.js";import{F}from"./vm-hands-entry-lite-bc9zq8gx.js";import{U,H,T}from"./vm-hands-entry-lite-bbjsnjct.js";import{Qn,Ba,Ha,bo,ti}from"./vm-hands-entry-lite-6g9we34r.js";import{wa}from"./vm-hands-entry-lite-t3k90kdn.js";import{yi}from"./vm-hands-entry-lite-3594pdj0.js";import{Bo}from"./vm-hands-entry-lite-9gn7k5rp.js";import{Jt}from"./vm-hands-entry-lite-b3mfma12.js";import{hr,No,Lo,$o}from"./vm-hands-entry-lite-07wr95rz.js";import{ro}from"./vm-hands-entry-lite-kankyeep.js";import{gi,cc}from"./vm-hands-entry-lite-sxnvhzy5.js";import{u,b,m,y}from"./vm-hands-entry-lite-2927z566.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{De,wt,ls,Sc,Ec,bt}from"./vm-hands-entry-lite-peyr9y6z.js";import{s,Et}from"./vm-hands-entry-lite-tzv8s0e7.js";import{Jc,Xi,I,t,V,zr,o,_,Rt,d,n,h,P,ul,c,i,Yi}from"./vm-hands-entry-lite-bt6skt4h.js";import{Sa,Y,B}from"./vm-hands-entry-lite-04nx5y4f.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{spawn as Du,spawnSync as Xw}from"child_process";import{closeSync as Mu,existsSync as Zw,mkdirSync as Qw,openSync as Tu,readdirSync as ey,realpathSync as Yr,rmSync as Zn}from"fs";import{hostname as ty}from"os";import{dirname as Bs,join as Bt,resolve as ry}from"path";var Yo={ENOENT:"native_enoent",EACCES:"native_permission_denied",EPERM:"native_permission_denied",ETIMEDOUT:"native_timeout",ECONNREFUSED:"native_network",ECONNRESET:"native_network",ENOTFOUND:"native_network",EAI_AGAIN:"native_network",ENETUNREACH:"native_network",EHOSTUNREACH:"native_network",EPIPE:"native_pipe_closed",ENOSPC:"native_disk_full",EMFILE:"native_too_many_files",EBUSY:"native_busy",E2BIG:"native_args_too_large"};function oc(e){if(!(e instanceof Error))return e===void 0||e===null?"native_no_error":"native_non_error";let l=e.code;if(typeof l==="string"&&Yo[l])return Yo[l];let v=e.message;if(e.name==="TimeoutError"||e.name==="AbortError")return"native_timeout";if(/No handler registered for /.test(v))return"ipc_handler_missing";if(/could not be cloned/i.test(v))return"ipc_clone_failed";if(/Render frame was disposed|Object has been destroyed|WebContents was destroyed/i.test(v))return"ipc_window_closed";let D=/\b(E[A-Z0-9]{2,15})\b/.exec(v)?.[1];if(D&&Yo[D])return Yo[D];if(/timed? ?out|timeout/i.test(v))return"native_timeout";if(/fetch failed|failed to fetch|network|socket hang up|getaddrinfo/i.test(v))return"native_network";if(e.name==="TypeError"&&v==="Load failed")return"native_network";if(/unexpected token|is not valid JSON|JSON\.parse|Unexpected end of JSON/i.test(v))return"native_unreadable_output";if(/keychain|secitem|errSec/i.test(v))return"native_keychain_error";if(/Error invoking remote method/.test(v))return"ipc_remote_error";switch(e.name){case"TypeError":return"native_type_error";case"RangeError":return"native_range_error";case"SyntaxError":return"native_unreadable_output"}return"native_unexpected"}import{createHash as Gu}from"crypto";import{unlinkSync as Yu}from"fs";import{platform as Xu}from"os";import{join as Zu}from"path";var ac=P("store",[h({version:i(1),store:i("keychain")}),h({version:i(1),store:i("file"),api_key:t().min(1).max(4096)})]),dn=(e)=>Zu(e,"api-key.json");function Fr(e){let l=Gu("sha256").update(`reason-connect-api-key
+import{R,Rn}from"./vm-hands-entry-lite-ys4jhf7n.js";import{w,ye,W,An,Pn,Cr}from"./vm-hands-entry-lite-0xfme8gg.js";import{Q,ve}from"./vm-hands-entry-lite-4kb5rq3d.js";import{Aa,be,Pa,C,io,me}from"./vm-hands-entry-lite-dhn0fs5e.js";import{g}from"./vm-hands-entry-lite-n9277v11.js";import{ut,Vn,ir}from"./vm-hands-entry-lite-8s5n4wps.js";import{a,fn,Ht,Si,mt,mn,fr,gn,mr,Ut,ae,rt,Ei,zt}from"./vm-hands-entry-lite-1as6h9ed.js";import{Nr,Ss,Es,pe,Ys,tr,Hn}from"./vm-hands-entry-lite-vvhfaxpd.js";import{Hr}from"./vm-hands-entry-lite-1cdtev4n.js";import{Da,k,or,sr,ee,ar,uo,po,Zr,dt,ho,Qr,en,Kn,Jn,mo,go,_o,Xn}from"./vm-hands-entry-lite-rpf4t8r4.js";import{ri,ni,K,qa,Wa,oe,x,p,vo,ge,se,O,$t,Qe,rn,So,E,_e,Qa,ec,tc,ai,nn,pt,rc,Mt,on,Pe,J,ic,Co,Ao,an,et}from"./vm-hands-entry-lite-mktndd2r.js";import{je}from"./vm-hands-entry-lite-732hnx41.js";import{cr,Ae,Oa,tn,Na,$a}from"./vm-hands-entry-lite-bqs4pkyb.js";import{ne}from"./vm-hands-entry-lite-7aeqbfc8.js";import{le,A,ts,rs}from"./vm-hands-entry-lite-9meg54bs.js";import{Nn,Ln,Ui,Fc}from"./vm-hands-entry-lite-2qh3rat2.js";import{kr,ue}from"./vm-hands-entry-lite-t2rhwchw.js";import{Lt,ie,N,no}from"./vm-hands-entry-lite-h5x725z8.js";import{Ni,ke,de,j,ze,is,kn,os,qe,Li,$i,ss,xn,Ie,as,Cn}from"./vm-hands-entry-lite-ezkb7f6j.js";import{F}from"./vm-hands-entry-lite-bc9zq8gx.js";import{U,H,T}from"./vm-hands-entry-lite-bbjsnjct.js";import{Qn,Ba,Ha,bo,ti}from"./vm-hands-entry-lite-7jmt3q38.js";import{wa}from"./vm-hands-entry-lite-t3k90kdn.js";import{yi}from"./vm-hands-entry-lite-3594pdj0.js";import{Bo}from"./vm-hands-entry-lite-jm9jpj77.js";import{Jt}from"./vm-hands-entry-lite-ksfd234v.js";import{hr,No,Lo,$o}from"./vm-hands-entry-lite-kzygj0q8.js";import{ro}from"./vm-hands-entry-lite-kankyeep.js";import{gi,cc}from"./vm-hands-entry-lite-sxnvhzy5.js";import{u,b,m,y}from"./vm-hands-entry-lite-2927z566.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{De,wt,ls,Sc,Ec,bt}from"./vm-hands-entry-lite-peyr9y6z.js";import{s,Et}from"./vm-hands-entry-lite-tzv8s0e7.js";import{Jc,Xi,I,t,V,zr,o,_,Rt,d,n,h,P,ul,c,i,Yi}from"./vm-hands-entry-lite-bt6skt4h.js";import{Sa,Y,B}from"./vm-hands-entry-lite-04nx5y4f.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{spawn as Du,spawnSync as Xw}from"child_process";import{closeSync as Mu,existsSync as Zw,mkdirSync as Qw,openSync as Tu,readdirSync as ey,realpathSync as Yr,rmSync as Zn}from"fs";import{hostname as ty}from"os";import{dirname as Bs,join as Bt,resolve as ry}from"path";var Yo={ENOENT:"native_enoent",EACCES:"native_permission_denied",EPERM:"native_permission_denied",ETIMEDOUT:"native_timeout",ECONNREFUSED:"native_network",ECONNRESET:"native_network",ENOTFOUND:"native_network",EAI_AGAIN:"native_network",ENETUNREACH:"native_network",EHOSTUNREACH:"native_network",EPIPE:"native_pipe_closed",ENOSPC:"native_disk_full",EMFILE:"native_too_many_files",EBUSY:"native_busy",E2BIG:"native_args_too_large"};function oc(e){if(!(e instanceof Error))return e===void 0||e===null?"native_no_error":"native_non_error";let l=e.code;if(typeof l==="string"&&Yo[l])return Yo[l];let v=e.message;if(e.name==="TimeoutError"||e.name==="AbortError")return"native_timeout";if(/No handler registered for /.test(v))return"ipc_handler_missing";if(/could not be cloned/i.test(v))return"ipc_clone_failed";if(/Render frame was disposed|Object has been destroyed|WebContents was destroyed/i.test(v))return"ipc_window_closed";let D=/\b(E[A-Z0-9]{2,15})\b/.exec(v)?.[1];if(D&&Yo[D])return Yo[D];if(/timed? ?out|timeout/i.test(v))return"native_timeout";if(/fetch failed|failed to fetch|network|socket hang up|getaddrinfo/i.test(v))return"native_network";if(e.name==="TypeError"&&v==="Load failed")return"native_network";if(/unexpected token|is not valid JSON|JSON\.parse|Unexpected end of JSON/i.test(v))return"native_unreadable_output";if(/keychain|secitem|errSec/i.test(v))return"native_keychain_error";if(/Error invoking remote method/.test(v))return"ipc_remote_error";switch(e.name){case"TypeError":return"native_type_error";case"RangeError":return"native_range_error";case"SyntaxError":return"native_unreadable_output"}return"native_unexpected"}import{createHash as Gu}from"crypto";import{unlinkSync as Yu}from"fs";import{platform as Xu}from"os";import{join as Zu}from"path";var ac=P("store",[h({version:i(1),store:i("keychain")}),h({version:i(1),store:i("file"),api_key:t().min(1).max(4096)})]),dn=(e)=>Zu(e,"api-key.json");function Fr(e){let l=Gu("sha256").update(`reason-connect-api-key
 ${e}`).digest("hex");return new mt(fn(),Xu(),l)}function na(e,l,v=Fr(e)){try{v.deleteBinding(),v.createBinding(new TextEncoder().encode(l)),y(dn(e),{version:1,store:"keychain"});return}catch(D){if(!(D instanceof a))throw D}y(dn(e),{version:1,store:"file",api_key:l})}function lr(e,l=Fr(e)){if(!u(dn(e)))return null;let v=ac.parse(JSON.parse(m(dn(e))));if(v.store==="file")return v.api_key;try{let D=l.loadBinding();return D?new TextDecoder().decode(D):null}catch(D){if(!(D instanceof a))throw D;throw Error("worker_api_key_unreadable")}}function sc(e,l=Fr(e)){if(!u(dn(e)))return;if(ac.parse(JSON.parse(m(dn(e)))).store==="keychain")try{l.deleteBinding()}catch(v){if(!(v instanceof a))throw v}Yu(dn(e))}async function oa(e,l){let v;try{v=await ir({env:{REASON_API_KEY:l,REASON_API_URL:e.apiOrigin},fetchImpl:oe(e.proxy)})}catch(D){if(D instanceof C&&(D.status===401||D.status===403))throw Error("worker_api_key_rejected");throw D}if(!v)throw Error("worker_api_key_rejected");if(!v.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return v}import{readdirSync as yf,renameSync as _f,rmSync as un}from"fs";import{join as Pt}from"path";import{createHash as Qu}from"crypto";import{realpathSync as ef,statSync as tf,unlinkSync as Xo}from"fs";import{platform as rf}from"os";import{join as Xt}from"path";function f(e){return{state:Xt(p(e),"device.json"),control:Xt(p(e),"control.json"),lock:Xt(p(e),"lifecycle.lock"),socket:Xt(p(e),"control.sock"),daemon:Xt(p(e),"daemon.json"),releaseCheck:Xt(p(e),"release-check.json"),updateDeferral:Xt(p(e),"update-deferral.json"),firstHeartbeat:Xt(p(e),"first-heartbeat.json")}}var nf=n({version:i(1),device_id:t().min(1).max(160),offer:Rt().optional(),enrollment_ms:o().int().nonnegative().max(tr).optional()});function lc(e,l,v){b(p(e),!0),y(f(e).firstHeartbeat,{version:1,device_id:l,...v.offer?{offer:v.offer}:{},...v.enrollmentMs!==void 0?{enrollment_ms:v.enrollmentMs}:{}})}function ia(e,l){let v=f(e).firstHeartbeat;try{if(!u(v))return null;let D=nf.safeParse(JSON.parse(m(v)));if(Xo(v),!D.success||D.data.device_id!==l)return null;let M=Hn(D.data.offer);return{...M?{offer:M}:{},...D.data.enrollment_ms!==void 0?{enrollmentMs:D.data.enrollment_ms}:{}}}catch{return null}}function xt(e,l=!1){b(p(e),l);let v=["local-device.key","local-device.binding","device.json"].filter((D)=>{let M=Xt(p(e),D);if(!u(M))return!1;return m(M),!0});return e.lifetime==="persistent"&&v.join()==="device.json"?aa(e):new mn(p(e))}function Zo(e,l){xt(e,!0),sf(e);let v=l??aa(e),D=new mn(p(e));try{v.deleteBinding(),v.deleteKey(),v.createFreshPublicKey()}catch(M){if(M instanceof a)return D;throw M}return D.deleteBinding(),D.deleteKey(),v}function aa(e){return new mt(fn(),rf(),of(e))}function of(e){let l=sa(e);return Qu("sha256").update(`reason-worker
 ${l?.directory??p(e)}`).digest("hex")}function co(e,l){y(Xt(p(e),lo),{version:1,directory:sa(e)?.directory??p(e),devicePublicKey:l})}var lo="keychain-scope.json";function dc(e){return u(Xt(p(e),lo))}var af=h({version:i(1),directory:t().min(1),devicePublicKey:t().min(1)});function sa(e){let l=Xt(p(e),lo);if(!u(l))return null;let v=af.safeParse(JSON.parse(m(l))),D=f(e).state;if(!v.success||!u(D))return null;return JSON.parse(m(D))?.devicePublicKey===v.data.devicePublicKey?v.data:null}function sf(e){let l=Xt(p(e),lo);if(!u(l))return;if(sa(e))try{let v=aa(e);v.deleteBinding(),v.deleteKey()}catch(v){if(!(v instanceof a))throw v}Xo(l)}function Or(e){let l=ef(e.workspaceRoot);if(l!==e.workspaceRoot||!tf(l).isDirectory()||!ge(l,e.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function S(e){if(!u(p(e)))return null;let l=Ut(f(e).state,{proofStore:xt(e),repair:!1}),v=l!==null&&An(e.apiOrigin,l.apiOrigin),D=v?[O(e),O({...e,apiOrigin:l.apiOrigin})]:[O(e)];if(l&&(!D.includes(l.worker?.configDigest??"")||l.worker.lifetime!==e.lifetime||l.apiOrigin!==e.apiOrigin&&!v||l.roots.length>32||l.roots[0]?.path!==e.workspaceRoot||l.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return l}var uc=h({version:i(1),drained:_(),revoked:_()});function ft(e){let l=f(e).control;return u(l)?uc.parse(JSON.parse(m(l))):{version:1,drained:!1,revoked:!1}}function qt(e,l){y(f(e).control,uc.parse(l))}function Zt(e){let l=xt(e);l.deleteBinding(),l.deleteKey();let v=Xt(p(e),lo);if(u(v))Xo(v);let D=f(e).state;if(u(D))Xo(D)}var cf=h({read:_(),write:_(),execute:_(),discover_environment:_(),expose_mcp:i(!1)}),ca=h({version:i(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:cf,execution_mode:c(["confined","host"]).default("confined")}),folders:d(h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),lf=n({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:i("p256"),protocol_version:i(2),roots:d(n({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:n({lifecycle:c(["persistent","ephemeral"]),expires_at:I.datetime({offset:!0})}),first_heartbeat:Rt().optional()}),la=30000;class Rr extends Error{deviceRemoved;constructor(e){super("worker_enrollment_rejected");this.deviceRemoved=e}}async function df(e,l,v=fetch){let D=await v(`${e}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(l),redirect:"error",signal:AbortSignal.timeout(la)});if(!D.ok){let M=D.status===409?await D.json().catch(()=>null):null;throw new Rr(M?.error==="device_revoked")}return D.json()}async function da(e,l,v,D){ne();let M=ca.parse(JSON.parse(m(l)));return Er(e,M,v,D)}async function Er(e,l,v,D=(L,z)=>df(L,z,oe(e.proxy)),M=performance.now()){let L=mc(e,l,v),z=await D(e.apiOrigin,{...L.request,enrollment_ticket:l.enrollment_ticket,code_verifier:l.code_verifier});return L.receipt(z,M)}async function fc(e,l,v,D,M=performance.now()){let L=mc(e,l,v),z=await D(L.request,l.code_verifier);return z===null?null:L.receipt(z,M)}function mc(e,l,v){if(ne(),l.root.execution_mode!==e.executionMode)throw Error("worker_enrollment_mode_mismatch");let D=zt([e.workspaceRoot],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(D.path!==e.workspaceRoot||D.pathFingerprint!==l.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let M=(e.folders??[]).map((G,ce)=>{let we=zt([G],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(we.path!==G||we.pathFingerprint!==l.folders?.[ce]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return we});if((l.folders?.length??0)!==M.length)throw Error("worker_enrollment_root_mismatch");let L=[{...D,label:"workspace"},...M],z;try{z=v.loadPublicKey()}catch{z=v.createFreshPublicKey()}return{request:{device_public_key:z,name:e.name,os:process.platform,architecture:process.arch,reason_runtime_version:g,bridge_version:g,protocol_version:2,capabilities:{supported_operations:[]},roots:L.map((G)=>({label:G.label,path_fingerprint:G.pathFingerprint,permissions:l.root.permissions}))},receipt(G,ce){let we=lf.parse(G);if(we.organization_id!==l.organization_id||we.roots.length!==L.length||we.roots.some((X,he)=>X.path_fingerprint!==L[he].pathFingerprint)||we.headless.lifecycle!==e.lifetime||Date.parse(we.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let te=Hn(we.first_heartbeat);try{lc(e,we.device_id,{...te?{offer:te}:{},enrollmentMs:Math.min(tr,Math.max(0,Math.round(performance.now()-ce)))})}catch{}return{version:4,apiOrigin:e.apiOrigin,orgId:we.organization_id,deviceId:we.device_id,devicePublicKey:z,displayName:e.name,registeredAt:new Date().toISOString(),handsSlots:e.slots,worker:{configDigest:O(e),lifetime:e.lifetime,expiresAt:we.headless.expires_at},roots:we.roots.map((X,he)=>({id:X.id,label:X.label,path:L[he].path,pathFingerprint:X.path_fingerprint,permissions:l.root.permissions}))}}}}import{randomBytes as uf,randomUUID as ff}from"crypto";import{unlinkSync as mf}from"fs";import{join as pf}from"path";var pc=h({version:i(1),install_id:V(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),hf=n({enrollment_ticket:t().min(1).max(4096),expires_at:I.datetime({offset:!0}),device_kind:i("headless"),lifecycle:c(["persistent","ephemeral"]),device_expires_at:I.datetime({offset:!0})});function ua(e){return hf.parse(e)}var gf=n({credentialKind:c(["oauth","api_key"]).optional(),apiOrigin:zr(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:I.datetime({offset:!0}),scopes:d(t().max(128)).max(128),orgId:t().min(1).max(160)});function jr(e){return Q(Rn("REASON_CLI_CHANNEL",e.channel),s())}async function qr(e,l=jr(e)){if(!u(l))return null;let v=gf.parse(JSON.parse(m(l)));if(!W(v.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(v.credentialKind==="api_key")return Date.parse(v.expiresAt)>Date.now()?v:null;let D=oe(e.proxy),M=Object.assign((z,re)=>D(z,{...re,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),L=await be({path:l,fetchImpl:M});if(L&&!W(L.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");return L}async function hc(e,l,v){if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let D=Kr(e);return D.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(D.request))}async function gc(e,l,v,D,M){let L=performance.now();if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let z=Kr(e),re=M?void 0:v.enrollHeadlessDevice?.bind(v);if(re){let G=await fc(e,z.direct(l.orgId),D,(ce,we)=>re({approval:z.request,code_verifier:we,registration:ce}).catch((te)=>{throw wf(te)}),L);if(G)return G}return Er(e,z.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(z.request)),D,M,L)}function wf(e){if(!(e instanceof C))return e;if(e.status===409)return new Rr(e.code==="device_revoked");if(e.status===410||e.status===401&&e.code==="invalid_enrollment_ticket"||e.status===403&&e.code==="grant_exceeded"||e.status===400&&e.code==="invalid_device_enrollment")return new Rr(!1);return e}var fo=(e)=>pf(p(e),"enrollment-install.json");function wc(e){if(u(fo(e)))mf(fo(e))}function Kr(e,{stored:l=!0}={}){ne();let v=fo(e),D=l&&u(v)?pc.parse(JSON.parse(m(v))):{version:1,install_id:ff(),fingerprint_key:uf(32).toString("hex")};if(l&&!u(v))y(v,D);let M={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},L=Buffer.from(D.fingerprint_key,"hex"),z=zt([e.workspaceRoot],M,L)[0];if(z.path!==e.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let re=(e.folders??[]).map((te)=>{let X=zt([te],M,L)[0];if(X.path!==te)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:X.pathFingerprint}}),G=Aa(),ce={install_id:D.install_id,code_challenge:G.challenge,lifecycle:e.lifetime,roots:[z.pathFingerprint,...re.map((te)=>te.path_fingerprint)].map((te)=>({path_fingerprint:te,permissions:M,execution_mode:e.executionMode}))},we=(te)=>({version:1,organization_id:te,code_verifier:G.verifier,root_fingerprint_key:D.fingerprint_key,root:{path_fingerprint:z.pathFingerprint,permissions:M,execution_mode:e.executionMode},...re.length?{folders:re}:{}});return{request:ce,saveInstall(te){b(p(te),!0),y(fo(te),D)},complete(te,X){let he=ua(X);if(he.lifecycle!==e.lifetime||Date.parse(he.expires_at)<=Date.now()||Date.parse(he.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...we(te),enrollment_ticket:he.enrollment_ticket}},direct:we}}function yc(e,l,v){let D=fo(e);if(!u(D))throw Error("worker_folders_unavailable");let M=pc.parse(JSON.parse(m(D)));return zt([l],v,Buffer.from(M.fingerprint_key,"hex"))[0]}var Qo=8,pa=600000,kc=15000,bf=3600000,kf=new Set(["device_not_eligible","sign_in_not_eligible"]),_c=new Set(["device_revoked","invalid_device_credential"]),ei=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,Dr=(e)=>Pt(p(e),"workspaces"),vc="account.json",fa=(e)=>u(Pt(e,vc));function Qt(e){let l;try{l=yf(Dr(e))}catch{return[]}return l.filter((v)=>ei.test(v)).sort().map((v)=>{let D=Pt(Dr(e),v),M=Pt(D,"worker.json"),L=null;try{let z=x.safeParse(JSON.parse(m(M)));if(z.success&&z.data.stateDirectory===D)L=z.data}catch{}return{organizationId:v,directory:D,configPath:M,config:L,account:fa(D)}})}function oi(e,l){let v=l.toLowerCase();if(!ei.test(v))throw Error("worker_workspace_id_invalid");let D=x.parse({...e,stateDirectory:Pt(Dr(e),v)});return b(D.stateDirectory,!0),y(Pt(D.stateDirectory,vc),{version:1}),{config:D,configPath:Pt(D.stateDirectory,"worker.json")}}function ii(e,l){try{let{config:v,configPath:D}=oi(e,l);b(p(v),!0),qt(v,{version:1,drained:!0,revoked:!0}),y(D,v)}catch{}}function wo(e,l){let v=l.toLowerCase(),D=null;try{D=S(e)?.orgId.toLowerCase()??null}catch{}return D===v||Qt(e).some((M)=>!M.account&&M.config!==null&&M.organizationId===v)}var ma=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function bc(e,l){let v=S(e);if(!v?.worker)throw Error("worker_identity_missing");co(e,v.devicePublicKey),b(p(l),!0);for(let L of ma)un(Pt(p(l),L),{force:!0});for(let L of ma){let z=Pt(p(e),L);if(u(z))_f(z,Pt(p(l),L))}let D=xt(l),M=Ut(f(l).state,{proofStore:D,repair:!1});if(!M?.worker)throw Error("worker_identity_missing");ae({...M,worker:{...M.worker,configDigest:O(l)}},f(l).state,{proofStore:D})}function ha(e){for(let l of Qt(e)){if(l.account)continue;try{if(l.config&&u(f(l.config).state))Zt(l.config)}catch{}un(l.directory,{recursive:!0,force:!0})}un(ya(e),{force:!0})}function si(e,{prefer:l,keep:v,live:D=!1}){let M=Date.now(),L=(te)=>Number(Date.parse(te.worker?.expiresAt??"")>M+60000),re=Qt(e).flatMap((te)=>{if(!te.account||!te.config)return[];try{if(ft(te.config).revoked)return[];let X=S(te.config);return X&&X.orgId.toLowerCase()===te.organizationId&&(!D||L(X))?[{...te,config:te.config,state:X}]:[]}catch{return[]}}).sort((te,X)=>Number(X.organizationId===l)-Number(te.organizationId===l)||L(X.state)-L(te.state))[0];if(!re)return null;let G=null;try{G=ft(e).revoked?null:S(e)}catch{}let ce=G?.orgId.toLowerCase()??"";if(v&&G&&ei.test(ce)&&ce!==re.organizationId){let te=oi(e,ce);bc(e,te.config),y(te.configPath,te.config)}else if(u(p(e))){try{if(u(f(e).state))Zt(e)}catch{}for(let te of ma)un(Pt(p(e),te),{force:!0})}ha(e);let we=x.parse({...re.config,stateDirectory:e.stateDirectory});return bc(re.config,we),y(Pt(e.stateDirectory,"worker.json"),we),un(re.directory,{recursive:!0,force:!0}),we}var ga={before(e){for(let{config:l}of Qt(e))try{let v=l?S(l):null;if(l&&v)co(l,v.devicePublicKey)}catch{}},after(e,l){for(let{organizationId:v,directory:D,configPath:M,config:L}of Qt(l)){if(L)continue;try{let z=x.parse(JSON.parse(m(M)));if(z.stateDirectory!==Pt(Dr(e),v))continue;let re=x.parse({...z,stateDirectory:D}),G=xt(re),ce=Ut(f(re).state,{proofStore:G,repair:!1});if(ce?.worker?.configDigest===O(z))ae({...ce,worker:{...ce.worker,configDigest:O(re)}},f(re).state,{proofStore:G});y(M,re)}catch{}}}},ya=(e)=>Pt(Dr(e),"listed.json");function Rc(e){try{let l=JSON.parse(m(ya(e))),v=l.names&&typeof l.names==="object"&&!Array.isArray(l.names)?Object.fromEntries(Object.entries(l.names).filter((M)=>typeof M[1]==="string")):{},D=l.refused&&typeof l.refused==="object"?l.refused:null;return{listed:l.listed===!0,reason:l.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(l.blocked)?l.blocked.filter((M)=>typeof M==="string"):[],names:v,...D&&typeof D.device==="string"&&typeof D.roots==="string"&&typeof D.at==="number"&&Number.isFinite(D.at)&&typeof D.count==="number"&&Number.isInteger(D.count)&&D.count>=1?{refused:{device:D.device,roots:D.roots,at:D.at,count:D.count}}:{}}}catch{return null}}function Pc(e,l){let v=Qt(e),D=v.filter((G)=>G.account),M=v.filter((G)=>!G.account),L=Rc(e),z=L&&!L.listed?L.reason:null,re=z||M.length===0&&L&&!L.listed?[]:M;if(D.length===0&&re.length===0&&(z||L&&!L.listed))return{workspaces:null,off:z};return{off:z,workspaces:[...D,...re].map(({organizationId:G,config:ce,account:we})=>{let te=!1,X=null,he=!1,Se=null;try{te=ce?ft(ce).revoked:!1,X=ce&&!te?S(ce):null;let Re=ce?rt(f(ce).daemon):null;he=l&&!!X&&Re?.state==="connected",Se=he?gn(Re,X):null}catch{}return{...Se?{permission_recovery:Se}:{},organization_id:G,device_id:X?.deviceId??null,name:L?.names?.[G]??null,root:X?.roots[0]?{id:X.roots[0].id,permissions:X.roots[0].permissions}:null,state:te?"removed":he?"connected":"not_running",blocked:!we&&!te&&!he&&(L?.blocked.includes(G)??!1),...we?{account:!0}:{}}})}}function Cc(e){let{config:l,state:v,client:D,signal:M}=e,L=e.log??(()=>{return}),z=e.intervalMs??pa,re=new Map,G=null,ce=!1,we=Rc(l)??{listed:!1,reason:null,blocked:[]},te=()=>v.roots.map((Ne)=>Ne.id).join(","),X=(Ne)=>{if(!Ne||Ne.device!==v.deviceId||Ne.roots!==te())return!1;let xe=Date.now();return xe>=Ne.at&&xe<Ne.at+Math.min(bf,z*2**Math.min(Ne.count-1,10))},he=(Ne)=>{let{folders:xe,...Le}=l,Ge=v.roots.slice(1).map((Ve)=>Ve.path);return x.parse({...Le,...Ge.length?{folders:Ge}:{},stateDirectory:Pt(Dr(l),Ne)})},Se=async(Ne)=>{let xe=re.get(Ne);if(!xe)return;xe.controller.abort(),await xe.done},Re=(Ne,xe=!1)=>{let Le=new AbortController,Ge=()=>Le.abort();if(M.addEventListener("abort",Ge,{once:!0}),M.aborted)Le.abort();let Ve={...Ne,controller:Le,claims:0,done:Promise.resolve(),account:xe};Ve.done=e.serve(Ne,Le.signal,(Je)=>{Ve.claims=Je}).then(()=>{return},(Je)=>{if(xe&&Je instanceof k&&Je.status===401&&_c.has(Je.code)){try{qt(Ne.config,{version:1,drained:!0,revoked:!0})}catch{}L(`Reason worker: workspace ${Ne.organizationId} (another account's) no longer accepts this computer (${Je.code}); run \`reason connect\` signed in as that account to connect it again
 `)}else if(Je instanceof k&&Je.status===401&&_c.has(Je.code)){try{Zt(Ne.config)}catch{}L(`Reason worker: workspace ${Ne.organizationId} no longer accepts this computer
@@ -312,7 +312,7 @@ Usage:
 `),host:v.host}),re=Ic({...z,log:(he)=>D.stderr.write(`${he}
 `)}),{configPath:G}=re,ce=re.saved;if(!ce)return D.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let we=(he,Se)=>{let Re=Vs(v.home,v.channel),Ee;try{let Me=null;try{Me=Se.keep?null:S(ce)?.orgId.toLowerCase()??null}catch{}if(Ee=si(ce,{prefer:qo(v.home,v.channel,ce),...Se}),Ee&&Me)ii(Ee,Me)}finally{Re()}if(!Ee)return!1;ce=Ee;let Oe="";try{Oe=` (workspace ${S(Ee)?.orgId??"unknown"})`}catch{}return D.stderr.write(`Reason: ${he}; this computer goes on running Sessions for its other Reason account${Oe}.
 `),!0};if(ft(ce).revoked&&!we("this computer's connection was removed from Reason",{keep:!1}))return D.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(ce.executionMode==="confined"||!Yn(ce)){let he=lr(ce.stateDirectory)??void 0,Se=he?null:qo(v.home,v.channel,ce);if(!he&&!(Se&&wo(ce,Se)))we("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let te=ce.executionMode==="confined";if(te||!Yn(ce)){let he=lr(ce.stateDirectory)??void 0;if(D.stderr.write(te?Hu:`Reason: this computer's connection expired; renewing it with ${he?"its API key":"your login"}\u2026
-`),await Us(x.parse({...ce,executionMode:"host"}),G,D,M,he)!==0)return D.stderr.write(he?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let X=new AbortController;if(!M.runWorker)import("./ask-relay-c0v30hh6.js").then(({runBackgroundAskRelay:he})=>he(X.signal,(Se)=>D.stderr.write(`${Se}
+`),await Us(x.parse({...ce,executionMode:"host"}),G,D,M,he)!==0)return D.stderr.write(he?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let X=new AbortController;if(!M.runWorker)import("./ask-relay-hfa5kzxn.js").then(({runBackgroundAskRelay:he})=>he(X.signal,(Se)=>D.stderr.write(`${Se}
 `))).catch(()=>{});try{for(;;){let he=lr(ce.stateDirectory)===null?{ownerWorkspaces:M.worker?.ownerWorkspaces??{}}:{},Se=M.runWorker?null:qi({stateDirectory:ce.stateDirectory}),Re=!1,Ee;try{Ee=await(M.runWorker??Tr)(["start","--config",G],{deferOptionalLanes:!0,...M.worker,...he,ownComputer:!0,io:{stdout:D.stdout,stderr:D.stderr},onDeviceRevoked:()=>{Re=!0}})}finally{Se?.stop()}if(!Re)return Ee;if(!we("this computer's connection was removed from Reason",{keep:!1}))break}return Gi(v.home,v.channel,!0),D.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{X.abort()}}async function dy(e,l,v){let{io:D,options:M,home:L,channel:z,environment:re}=v;if(l&&await(M.controlWorker??St)(l,"status").catch(()=>null))throw new ct("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let G=fe(L,z,!0),ce=Bu({parsed:e,saved:l,stateDirectory:G,lifetime:"ephemeral",home:L,channel:z,options:M,environment:re}),we=Uu(ce,v.apiKey??(l?lr(l.stateDirectory)??void 0:void 0)),te=Bt(G,"worker.json");return b(G,!0),y(te,we),D.stdout.write($s(`Reason: connecting "${we.name}" while this command runs`,we,v.host.platform,["Connecting\u2026"])),(M.runWorker??Tr)(["start","--config",te],{...Fs(M.worker,v.apiKey),ownComputer:!0,io:{stdout:D.stdout,stderr:Vi(D.stderr)},onStartup:(X)=>{if(X==="ready")D.stdout.write(`Connected. Start Sessions on "${we.name}" from Reason. Press Ctrl-C to stop.
 `);M.worker?.onStartup?.(X)}})}function uy(e,l,v,D){if(v.platform!=="darwin")throw new ct("--keep-awake is for macOS.");if(!l)throw new ct("This computer is not connected to Reason. Run reason connect first.");b(p(l),!0),$c(f(l).daemon,e);let M=nr(f(l).daemon)==="battery_and_ac";return D.stdout.write(`Keep awake: ${M?"on (this Mac stays awake while it runs Sessions)":"off"}
 `),0}var fy=n({root:n({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});async function Fu(e,l,v,D){let M=await(Fs(D.worker,v).enrollmentCredentials??qr)(e,jr(e));if(!M)throw Error("worker_session_login_required");if(!M.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let L=D.folderApi?.(M)??new me(M,{credentialsPath:jr(e),fetchImpl:oe(e.proxy)}),z=(re)=>re instanceof C&&re.status===404&&!["device_not_found","root_not_found"].includes(re.code);return{add:async(re)=>{let G=yc(e,re,{...l.roots[0].permissions,expose_mcp:!1}),ce=await L.addDeviceRoot(l.deviceId,{path_fingerprint:G.pathFingerprint,label:G.label,permissions:{...G.permissions,expose_mcp:!1}}).catch((te)=>{if(z(te))throw Error("worker_folders_unavailable");if(te instanceof C&&te.code==="root_limit_reached")throw new ct("This computer already has the most folders Reason allows (32).");throw te}),we=fy.parse(ce).root;if(we.path_fingerprint!==G.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...G,id:we.id,label:we.label}},remove:async(re)=>{await L.removeDeviceRoot(l.deviceId,re).catch((G)=>{if(z(G))throw Error("worker_folders_unavailable");if(!(G instanceof C&&G.code==="root_not_found"))throw G})}}}function ju(e,l,v){ae({...l,roots:v,handsSlots:e.slots,worker:{...l.worker,configDigest:O(e)}},f(e).state,{proofStore:xt(e)})}async function my(e,l,v,D){let{io:M,options:L,host:z}=D,re=l&&!D.apiKey&&lr(l.stateDirectory)===null?qo(D.home,D.channel,l):null,G=l&&re&&Gr(l)&&!wo(l,re)?Qt(l).find((xe)=>xe.account&&xe.organizationId===re)??null:void 0;if(G===null)throw new ct("This computer is not connected for your account. Run reason connect first.");let ce=G?G.config:l,we=G?G.configPath:v,te=ce&&Gr(ce)&&!ft(ce).revoked?S(ce):null;if(!l||!ce||!te||ce.lifetime!=="persistent")throw new ct("This computer is not connected to Reason. Run reason connect first.");let X=e.addFolder!==void 0,he=X?e.addFolder:e.removeFolder,Se=L.cwd??process.cwd(),Re;try{Re=Ki(Se,he)}catch(xe){if(X)throw new ct(xe instanceof Error?xe.message:String(xe));Re=ry(Se,he)}if(Re===ce.workspaceRoot)throw new ct(`${Re} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let Ee=ce.folders??[],Oe=te.roots.slice(1).find((xe)=>xe.path===Re);if(!X&&!Oe&&!Ee.includes(Re))throw new ct(`${Re} is not one of this computer's folders.`);if(X&&!ge(Re,ce.stateDirectory))throw new ct(`${Re} holds Reason's own settings.`);if(X&&!Oe&&Ee.length>=31)throw new ct("This computer already has the most folders Reason allows (32).");let Me=D.apiKey??lr(ce.stateDirectory)??void 0,Ce=await Fu(ce,te,Me,L),Te=te.roots.filter((xe)=>xe.path!==Re);if(X)Te=[...Te,await Ce.add(Re)];else if(Oe)await Ce.remove(Oe.id);ju(ce,te,Te);let We=X?[...Ee.filter((xe)=>xe!==Re),Re]:Ee.filter((xe)=>xe!==Re),{folders:$e,...Ue}=ce;if(y(we,x.parse({...Ue,...We.length?{folders:We}:{}})),!await(L.controlWorker??St)(l,"reload_roots").then(()=>!0,()=>!1))Ie(l,z,"connect");return M.stdout.write(X?`Added ${Re}. Sessions on "${ce.name}" may run in it.

package/bin/vm-hands/{vm-hands-entry-lite-crjaacc2.js → vm-hands-entry-lite-n9277v11.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Mn}from"./vm-hands-entry-lite-dtw6cj95.js";var g=Mn.version,Ir=`reason-cli/${g}`,Hc=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function Il(r,c){if(!Hc.test(r)||!Hc.test(c))throw Error("cannot compare invalid CLI versions");let f=(t)=>{let e=t.indexOf("-");return e===-1?[t,void 0]:[t.slice(0,e),t.slice(e+1)]},[h,i]=f(r),[x,s]=f(c),u=h.split(".").map(BigInt),d=x.split(".").map(BigInt);for(let t=0;t<3;t+=1){if(u[t]===d[t])continue;return u[t]<d[t]?-1:1}if(i===void 0||s===void 0){if(i===s)return 0;return i===void 0?1:-1}let l=i.split("."),a=s.split("."),C=Math.max(l.length,a.length);for(let t=0;t<C;t+=1){let e=l[t],n=a[t];if(e===void 0||n===void 0){if(e===n)return 0;return e===void 0?-1:1}if(e===n)continue;let o=/^\d+$/.test(e),p=/^\d+$/.test(n);if(o&&p){let I=BigInt(e),m=BigInt(n);if(I===m)continue;return I<m?-1:1}if(o!==p)return o?-1:1;return e<n?-1:1}return 0}function bs(r=Bun.main){return r.startsWith("/$bunfs/")||/^B:[\\/]~BUN[\\/]/i.test(r)}
+import{Mn}from"./vm-hands-entry-lite-fp3gaa2c.js";var g=Mn.version,Ir=`reason-cli/${g}`,Hc=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function Il(r,c){if(!Hc.test(r)||!Hc.test(c))throw Error("cannot compare invalid CLI versions");let f=(t)=>{let e=t.indexOf("-");return e===-1?[t,void 0]:[t.slice(0,e),t.slice(e+1)]},[h,i]=f(r),[x,s]=f(c),u=h.split(".").map(BigInt),d=x.split(".").map(BigInt);for(let t=0;t<3;t+=1){if(u[t]===d[t])continue;return u[t]<d[t]?-1:1}if(i===void 0||s===void 0){if(i===s)return 0;return i===void 0?1:-1}let l=i.split("."),a=s.split("."),C=Math.max(l.length,a.length);for(let t=0;t<C;t+=1){let e=l[t],n=a[t];if(e===void 0||n===void 0){if(e===n)return 0;return e===void 0?-1:1}if(e===n)continue;let o=/^\d+$/.test(e),p=/^\d+$/.test(n);if(o&&p){let I=BigInt(e),m=BigInt(n);if(I===m)continue;return I<m?-1:1}if(o!==p)return o?-1:1;return e<n?-1:1}return 0}function bs(r=Bun.main){return r.startsWith("/$bunfs/")||/^B:[\\/]~BUN[\\/]/i.test(r)}
 export{g,Ir,Hc,Il,bs};

package/bin/vm-hands/{vm-hands-entry-lite-xd393rm3.js → vm-hands-entry-lite-rd7bm9we.js}

@@ -1,7 +1,7 @@
 // @bun
 import{oo}from"./vm-hands-entry-lite-r131db1f.js";import{spawnSync as p}from"child_process";import{createHash as de}from"crypto";import{chmodSync as ge,closeSync as pe,existsSync as w,linkSync as me,lstatSync as fe,mkdirSync as Q,mkdtempSync as he,openSync as we,readdirSync as ye,readFileSync as Ee,readSync as ke,realpathSync as Ne,renameSync as E,rmSync as k,statSync as Y,symlinkSync as W,writeFileSync as I}from"fs";import{connect as Se}from"net";import{homedir as f}from"os";import{basename as Z,dirname as R,join as u}from"path";import{inflateRawSync as be}from"zlib";var oe=new Set(["<","\u02C2","\u1438","\u2039","\u3008","\u276C","\u276E","\u2770","\u16B2","\u2D66","\uD800\uDF2D","\uD81A\uDEEC","\uD834\uDE36","\u27E8","\u27EA","\u29FC","\u3008","\u300A","\uFE64","\uFF1C"]),D=(e)=>e===" "||e==="\t"||e===`
 `||e==="\f"||e==="\r",ie=(e)=>e.length===1&&e>="!"&&e<="~",G=(e)=>e.length===1&&/[A-Za-z]/.test(e);function J(e){let n=Array.from(e),t=(r)=>{let s=r+Math.min(n.length-r,64),o=r;while(o<s&&(D(n[o])||n[o]==="/"))o+=1;let i=o-r,a=[];while(o<s&&!D(n[o])&&n[o]!==">"&&n[o]!=="\uFF1E")a.push(n[o++]);return i+a.length===s-r&&n.length-r>64||!a.every(ie)||ae(a)};return n.map((r,s)=>oe.has(r)&&t(s+1)?"[":r).join("")}function ae(e){let n=1;for(let t of e){let r=t==="0"?"o":t==="3"?"e":t==="4"||t==="@"?"a":t==="5"||t==="$"?"s":G(t)?t.toLowerCase():t,s="reason".indexOf(r),o=s<0?0:1<<s;if(n=1|(G(t)?0:n)|(n&o)<<1,n&64)return!0}return!1}var ce=/[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/g;function U(e){return J(e.replace(ce," ").replace(/[\u2028\u2029]/g," "))}var le=["CLAUDECODE","CLAUDE_CODE_SESSION_ID","CODEX_THREAD_ID","CODEX_SESSION_ID","GROK_SESSION_ID","GROK_WORKSPACE_ROOT","GEMINI_CLI","CURSOR_AGENT","OPENCODE","COPILOT_CLI","COPILOT_AGENT_SESSION_ID","AI_AGENT"];function ue(e=process.env,n=Boolean(process.stderr.isTTY)){let t=le.some((r)=>e[r]!==void 0)||Object.keys(e).some((r)=>r.startsWith("CODEX_SANDBOX"))||Boolean(e.REASON_NETWORK_AGENT)||Boolean(e.TINCAN_AGENT);return n&&!t}function Fe(e,n=ue()){return n?e:U(e)}class Ce extends Error{}var m="reason-network",g="0.12.11",_e={"aarch64-apple-darwin":"4626279ee457d15566bcee47ba11ce270d545bd1137c48208e0df3878606197b","x86_64-apple-darwin":"17ea926bce47913882c7b3ba0ae42d03694a7720518ee726e4ae3028bb293f62","aarch64-unknown-linux-musl":"3bc31d0db0263ac27020ac4598415e3e16cfb672d6a9a9ca093775d300ef4fc2","x86_64-unknown-linux-musl":"0ab91ac33af6704f4836bbedc5b55bed4b0a9fdfdc8da1a1d16db8a07d2fc1c4","aarch64-pc-windows-msvc":"91c4c06ebbae929af5494efe9b506b6abc8bdd2989c5d246515bc5133932e5bd","x86_64-pc-windows-msvc":"ff01324b27ebcac0f698df59d2fdc8ef6e3094ead09210c6fa39238cd4cdbee7"},Re="https://reasonmachines.com/cli/engine",N="REASON_AGENT_NETWORK_BIN";function ve(e=process.platform,n=process.arch){let t=n==="arm64"?"aarch64":n==="x64"?"x86_64":null,r=e==="darwin"?"apple-darwin":e==="linux"?"unknown-linux-musl":e==="win32"?"pc-windows-msvc":null;return t&&r?`${t}-${r}`:null}function ee(e){return`${m}-${e}${e.endsWith("-windows-msvc")?".zip":".tar.gz"}`}function xe(e){let n=_e[e];return n?{url:`${Re}/${g}/${ee(e)}`,sha256:n}:null}function A(e){let n=p(e,["--version"],{encoding:"utf8",timeout:5000}),[t,r]=n.status===0?n.stdout.trim().split(/\s+/):[];return t===m?r??null:null}function _(e,n){let t=e.split(".").map(Number),r=n.split(".").map(Number);for(let s=0;s<3;s+=1)if((t[s]??0)!==(r[s]??0))return(t[s]??0)>(r[s]??0);return!0}function S(e=f(),n=process.platform){return u(e,".reason","bin",`${m}${n==="win32"?".exe":""}`)}var v=process.platform==="win32"?`~\\.local\\bin\\${m}.exe`:`~/.local/bin/${m}`;async function Te(e=process.env,n=()=>{}){if(e[N])return e[N];let t=S(),r=T(),s=r?.path===t&&y(t)===r.fingerprint?r:null,o=s?.kept,i=M(e)?null:$e(o);if(s?.version===g&&!i)return t;let a=w(t)?A(t):null;if(i){let c=A(i.path),d=a&&_(a,g)?a:g;if(!c||!_(d,c)){if(c)n(`Reason Network: ${v} (${c}) is newer than the version \`reason network\` keeps up to date (${d}), so it was left as it is.`);o=i.fingerprint,i=null}}if(s?.version===g&&!i)return F(t,o);if(!a||!_(a,g))await ne(t);let l=p(t,["setup",...M(e)?["--no-service"]:[]],{env:await C(e),encoding:"utf8",timeout:60000});if(l.status!==0){let c=b((l.stderr||l.stdout||"").trim().split(`
-`).pop()??"");if(s)return B(f(),{...s,fingerprint:y(t)??s.fingerprint,...o?{kept:o}:{}}),n(i?`Reason Network: couldn't move your agents off ${v}${c?` (${c})`:""}; they keep using it. Run reason network to try again.`:`Reason Network: couldn't finish setting up on this computer${c?` (${c})`:""}. Run reason network to try again.`),t;throw new Ce(`Couldn't connect this computer's agents to the network${c?` (${c})`:""}. Run reason network to try again.`)}if(i)o=Pe(i,t,n);return F(t,o),p(t,["stop"],{env:e,stdio:"ignore",timeout:15000}),t}function $e(e){let n=u(f(),".local","bin",Z(S())),t;try{t=fe(n)}catch{return null}let r=`${t.size}:${t.mtimeMs}:${t.ino}`;if(!t.isFile()||r===e)return null;try{let s=Y(S());if(s.ino===t.ino&&s.dev===t.dev)return null}catch{}try{let s=Buffer.alloc(2),o=we(n,"r");try{ke(o,s,0,2,0)}finally{pe(o)}if(s.toString("latin1")==="#!")return null}catch{return null}return{path:n,fingerprint:r}}function Pe(e,n,t){let r=`${e.path}.reason-${process.pid}`;try{if(k(r,{force:!0}),process.platform==="win32"){try{W(n,r,"file")}catch{me(n,r)}te(r,e.path,"win32")}else W(n,r),E(r,e.path);t(`Reason Network: your agents on this computer now use the version \`reason network\` keeps up to date (${v} points to it). Restart a running agent to pick it up.`);return}catch(s){return k(r,{force:!0}),t(`Reason Network: your agents on this computer now use the version \`reason network\` keeps up to date, but ${v} couldn't be pointed to it (${s instanceof Error?s.message:String(s)}). Remove that copy so it can't take them back.`),e.fingerprint}}async function fl(e={}){let n=e.env??process.env,t=e.home??f(),r=S(t),s=T(t);if(n[N]||s?.path!==r||y(r)!==s.fingerprint)return!1;if(s.version===g)return!1;let o=A(r);if(o&&_(o,g))return!1;return await ne(r),B(t,{...s,fingerprint:y(r)??""}),e.beforeRestart?.(),p(r,["stop"],{env:n,stdio:"ignore",timeout:15000}),!0}async function C(e){if(e[j])return e;try{let{defaultWorkerServiceHost:n,workerServiceLauncher:t}=await import("./serve-service-k3mpxpj6.js");return{...e,[j]:t(n(f()),e)}}catch{return e}}var j="REASON_NETWORK_REASON_BIN";function M(e=process.env){return Boolean(e.REASON_NETWORK_NO_SERVICE||e.TINCAN_NO_SERVICE)}var L=(e)=>u(e,".reason","ask-engine.json");function y(e){try{let n=Y(e);return`${n.size}:${n.mtimeMs}:${n.ino}`}catch{return null}}function ml(e=f()){return T(e)?.version??null}function T(e=f()){try{let n=JSON.parse(Ee(L(e),"utf8"));if(typeof n.path!=="string"||typeof n.fingerprint!=="string"||typeof n.version!=="string")return null;return{path:n.path,fingerprint:n.fingerprint,version:n.version,...typeof n.kept==="string"?{kept:n.kept}:{}}}catch{return null}}function B(e,n){Q(R(L(e)),{recursive:!0}),I(L(e),JSON.stringify(n))}function F(e,n){let t=y(e);if(t)B(f(),{path:e,fingerprint:t,version:g,...n?{kept:n}:{}});return e}async function ne(e){let n=ve(),t=n?xe(n):null;if(!n||!t)throw new Ce(`Reason Network runs on macOS, Linux and Windows (arm64 or x64); this is ${process.platform} ${process.arch}.`);let{url:r,sha256:s}=t,o;try{let a=await fetch(r,{signal:AbortSignal.timeout(120000)});if(!a.ok)throw Error(`HTTP ${a.status}`);o=Buffer.from(await a.arrayBuffer())}catch(a){let l=a instanceof Error&&a.name==="TimeoutError"?"no download within 2 minutes":a instanceof Error?a.message.replace(/\.$/,""):String(a);throw new Ce(`Couldn't download Reason Network from ${new URL(r).host} (${l}). Check the connection and run reason network again.`)}if(de("sha256").update(o).digest("hex")!==s)throw new Ce("The Reason Network download didn't match its checksum, so it wasn't installed.");Oe(o,n,e)}var H="Couldn't unpack the Reason Network download.";function Oe(e,n,t,r=process.platform){Q(R(t),{recursive:!0});let s=he(u(R(t),".reason-engine-"));try{let o=u(s,m);if(ee(n).endsWith(".zip"))o=u(s,`${m}.exe`),I(o,Ie(e,`${m}.exe`));else{I(u(s,"engine.tar.gz"),e);let i=p("tar",["--no-same-owner","-xzf",u(s,"engine.tar.gz"),"-C",s],{encoding:"utf8"});if(i.status!==0||!w(o)){let a=(i.stderr??"").trim().split(`
+`).pop()??"");if(s)return B(f(),{...s,fingerprint:y(t)??s.fingerprint,...o?{kept:o}:{}}),n(i?`Reason Network: couldn't move your agents off ${v}${c?` (${c})`:""}; they keep using it. Run reason network to try again.`:`Reason Network: couldn't finish setting up on this computer${c?` (${c})`:""}. Run reason network to try again.`),t;throw new Ce(`Couldn't connect this computer's agents to the network${c?` (${c})`:""}. Run reason network to try again.`)}if(i)o=Pe(i,t,n);return F(t,o),p(t,["stop"],{env:e,stdio:"ignore",timeout:15000}),t}function $e(e){let n=u(f(),".local","bin",Z(S())),t;try{t=fe(n)}catch{return null}let r=`${t.size}:${t.mtimeMs}:${t.ino}`;if(!t.isFile()||r===e)return null;try{let s=Y(S());if(s.ino===t.ino&&s.dev===t.dev)return null}catch{}try{let s=Buffer.alloc(2),o=we(n,"r");try{ke(o,s,0,2,0)}finally{pe(o)}if(s.toString("latin1")==="#!")return null}catch{return null}return{path:n,fingerprint:r}}function Pe(e,n,t){let r=`${e.path}.reason-${process.pid}`;try{if(k(r,{force:!0}),process.platform==="win32"){try{W(n,r,"file")}catch{me(n,r)}te(r,e.path,"win32")}else W(n,r),E(r,e.path);t(`Reason Network: your agents on this computer now use the version \`reason network\` keeps up to date (${v} points to it). Restart a running agent to pick it up.`);return}catch(s){return k(r,{force:!0}),t(`Reason Network: your agents on this computer now use the version \`reason network\` keeps up to date, but ${v} couldn't be pointed to it (${s instanceof Error?s.message:String(s)}). Remove that copy so it can't take them back.`),e.fingerprint}}async function fl(e={}){let n=e.env??process.env,t=e.home??f(),r=S(t),s=T(t);if(n[N]||s?.path!==r||y(r)!==s.fingerprint)return!1;if(s.version===g)return!1;let o=A(r);if(o&&_(o,g))return!1;return await ne(r),B(t,{...s,fingerprint:y(r)??""}),e.beforeRestart?.(),p(r,["stop"],{env:n,stdio:"ignore",timeout:15000}),!0}async function C(e){if(e[j])return e;try{let{defaultWorkerServiceHost:n,workerServiceLauncher:t}=await import("./serve-service-19s965ze.js");return{...e,[j]:t(n(f()),e)}}catch{return e}}var j="REASON_NETWORK_REASON_BIN";function M(e=process.env){return Boolean(e.REASON_NETWORK_NO_SERVICE||e.TINCAN_NO_SERVICE)}var L=(e)=>u(e,".reason","ask-engine.json");function y(e){try{let n=Y(e);return`${n.size}:${n.mtimeMs}:${n.ino}`}catch{return null}}function ml(e=f()){return T(e)?.version??null}function T(e=f()){try{let n=JSON.parse(Ee(L(e),"utf8"));if(typeof n.path!=="string"||typeof n.fingerprint!=="string"||typeof n.version!=="string")return null;return{path:n.path,fingerprint:n.fingerprint,version:n.version,...typeof n.kept==="string"?{kept:n.kept}:{}}}catch{return null}}function B(e,n){Q(R(L(e)),{recursive:!0}),I(L(e),JSON.stringify(n))}function F(e,n){let t=y(e);if(t)B(f(),{path:e,fingerprint:t,version:g,...n?{kept:n}:{}});return e}async function ne(e){let n=ve(),t=n?xe(n):null;if(!n||!t)throw new Ce(`Reason Network runs on macOS, Linux and Windows (arm64 or x64); this is ${process.platform} ${process.arch}.`);let{url:r,sha256:s}=t,o;try{let a=await fetch(r,{signal:AbortSignal.timeout(120000)});if(!a.ok)throw Error(`HTTP ${a.status}`);o=Buffer.from(await a.arrayBuffer())}catch(a){let l=a instanceof Error&&a.name==="TimeoutError"?"no download within 2 minutes":a instanceof Error?a.message.replace(/\.$/,""):String(a);throw new Ce(`Couldn't download Reason Network from ${new URL(r).host} (${l}). Check the connection and run reason network again.`)}if(de("sha256").update(o).digest("hex")!==s)throw new Ce("The Reason Network download didn't match its checksum, so it wasn't installed.");Oe(o,n,e)}var H="Couldn't unpack the Reason Network download.";function Oe(e,n,t,r=process.platform){Q(R(t),{recursive:!0});let s=he(u(R(t),".reason-engine-"));try{let o=u(s,m);if(ee(n).endsWith(".zip"))o=u(s,`${m}.exe`),I(o,Ie(e,`${m}.exe`));else{I(u(s,"engine.tar.gz"),e);let i=p("tar",["--no-same-owner","-xzf",u(s,"engine.tar.gz"),"-C",s],{encoding:"utf8"});if(i.status!==0||!w(o)){let a=(i.stderr??"").trim().split(`
 `).slice(-3).join("; "),l=i.error?`tar failed: ${i.error.message}`:i.signal?`tar was stopped by ${i.signal}`:i.status!==0?`tar exited ${i.status}${a?`: ${a}`:""}`:`no ${m} in it`;throw new Ce(`Couldn't unpack the Reason Network download (${l}).`)}}ge(o,493),te(o,t,r)}finally{k(s,{recursive:!0,force:!0})}}function Ie(e,n){let t=e.lastIndexOf(Buffer.from("PK\x05\x06","latin1"));if(t<0||t+22>e.length)throw new Ce(H);let r=e.readUInt32LE(t+16);for(let s=e.readUInt16LE(t+10);s>0;s-=1){if(r+46>e.length||e.readUInt32LE(r)!==33639248)break;let o=e.readUInt16LE(r+28);if(e.toString("utf8",r+46,r+46+o)===n){let i=e.readUInt16LE(r+10),a=e.readUInt32LE(r+20),l=e.readUInt32LE(r+24),c=e.readUInt32LE(r+42);if(c+30>e.length||e.readUInt32LE(c)!==67324752)break;let d=c+30+e.readUInt16LE(c+26)+e.readUInt16LE(c+28);if(d+a>e.length)break;let h=e.subarray(d,d+a),P;try{P=i===0?Buffer.from(h):i===8?be(h):Buffer.alloc(0)}catch{break}if(i!==0&&i!==8||P.length!==l)break;return P}r+=46+o+e.readUInt16LE(r+30)+e.readUInt16LE(r+32)}throw new Ce(H)}function te(e,n,t){if(t!=="win32"||!w(n)){E(e,n);return}let r=R(n),s=(i)=>i.startsWith(`${Z(n)}.`)&&i.endsWith(".old");for(let i of ye(r).filter(s))try{k(u(r,i),{force:!0})}catch{}let o=`${n}.${process.pid}-${Date.now()}.old`;E(n,o);try{E(e,n)}catch(i){throw E(o,n),i}try{k(o,{force:!0})}catch{}}function Ae(e=process.env,n=f()){let t=e.REASON_NETWORK_HOME?.trim()||e.TINCAN_HOME?.trim();if(t)return t;let r=u(n,".reason","network"),s=u(n,".tincan");return!K(r)&&K(s)?s:r}var K=(e)=>w(u(e,"network.db"))||w(u(e,"tincan.db"));function Me(e,n=process.platform,t=Ne.native){let r=w(u(e,"network.db"))||!w(u(e,"tincan.db"));if(n==="win32"){let o=e;try{o=t(e),o=o.startsWith("\\\\?\\")?o.slice(4):o.startsWith("\\\\")?`UNC\\${o.slice(2)}`:o}catch{}return`\\\\.\\pipe\\${r?"reason-network":"tincan"}-${z(o)}`}let s=u(e,r?"network.sock":"tincan.sock");if(Buffer.byteLength(s)<100)return s;return u("/tmp",`${r?"reason-network":"tincan"}-${process.getuid?.()??0}`,`${z(s)}.sock`)}function z(e){let n=0xcbf29ce484222325n;for(let t of Buffer.from(e))n=BigInt.asUintN(64,(n^BigInt(t))*0x100000001b3n);return n.toString(16).padStart(16,"0")}class Xr extends Error{code;constructor(e,n){super(e);this.code=n}}function Qi(e){return e instanceof Xr&&/isn't registered/.test(e.message)}var re="not_in_team",se=15000,Le=new Set(["who","team","inbox","unread","held"]),Be=90000,De="Reason Network on this computer closed the connection";class x{socket;nextId=1;buffer="";pending=new Map;closed=null;hungUp=!1;constructor(e){this.socket=e;e.setEncoding("utf8"),e.on("data",(t)=>this.read(t));let n=(t)=>{this.closed=t;for(let r of this.pending.values())r.reject(t);this.pending.clear()};e.on("error",(t)=>n(t)),e.on("close",()=>n(Error(this.hungUp?"the connection to Reason Network on this computer was closed here":De)))}static open(e){return new Promise((n,t)=>{let r=Se(e);r.once("connect",()=>n(new x(r))),r.once("error",t)})}read(e){this.buffer+=e;let n=this.buffer.indexOf(`
 `);while(n>=0){let t=this.buffer.slice(0,n);if(this.buffer=this.buffer.slice(n+1),n=this.buffer.indexOf(`
 `),!t.trim())continue;let r;try{r=JSON.parse(t)}catch{continue}if(typeof r.id!=="number")continue;let s=this.pending.get(r.id);if(!s)continue;if(this.pending.delete(r.id),r.ok){s.resolve(r.result);continue}let o=r.error??"Reason Network on this computer refused the request",i=typeof r.code==="string"?r.code:/not (in|connected to) a team/i.test(o)?re:null;s.reject(new Xr(b(o),i))}}call(e,n={},t=se){if(this.closed)return Promise.reject(this.closed);let r=this.nextId++;return this.socket.write(`${JSON.stringify({id:r,op:e,...n})}

package/bin/vm-hands/{vm-hands-entry-lite-rmcdfbkk.js → vm-hands-entry-lite-rpf4t8r4.js}

@@ -1,5 +1,5 @@
 // @bun
-import{rr,Br,Un,Ki,Fr,jr,pa,Ji,ha,fa,Hr}from"./vm-hands-entry-lite-1cdtev4n.js";import{Ct,Fn,vs,Or,Vc,Je,Gc,Kc,Qt,Xe,M,At,ks,jn,xs,Lr,Rs,Ts,Is,Ds,Os,Ns,Ls,$s,Ms,Bs,Fs,js,Hs,ct,Le,Pt,xe,Us,zs,qs,Ws,Vs,Gs,Ks,Js,$r,Xs,Mr,Zs,Gi,Qs,ea,ta,ra,na,ia,oa,sa,aa,ca,la,ua,da}from"./vm-hands-entry-lite-vvhfaxpd.js";import{at,Oe,X,te}from"./vm-hands-entry-lite-hpw27zfb.js";import{F,yn}from"./vm-hands-entry-lite-bc9zq8gx.js";import{ii,Va,Ga,Qe,Ka,Ja,rn,Xa,Ya,Za,si,ci,li,Eo,ko,ui,nc,xo,di,Pe,J,sn,pi,fi,et}from"./vm-hands-entry-lite-cy8yc9gb.js";import{U,H,T}from"./vm-hands-entry-lite-bbjsnjct.js";import{Fa,ja,yo,Ua,wo,za,lr,ei}from"./vm-hands-entry-lite-6g9we34r.js";import{ue}from"./vm-hands-entry-lite-t2rhwchw.js";import{je}from"./vm-hands-entry-lite-732hnx41.js";import{Se}from"./vm-hands-entry-lite-1as6h9ed.js";import{Yn,Zn,Ma}from"./vm-hands-entry-lite-bqs4pkyb.js";import{Pc,Rc,Ar,Tc,Ic,Dc,Oc,Nc,Lc,$c}from"./vm-hands-entry-lite-hh0kba1y.js";import{wi,hn,bi,Fo,jo}from"./vm-hands-entry-lite-3594pdj0.js";import{dn,jt,pn}from"./vm-hands-entry-lite-9gn7k5rp.js";import{A,es}from"./vm-hands-entry-lite-vedb5r12.js";import{xc,Cc}from"./vm-hands-entry-lite-ax2w9ywb.js";import{vr}from"./vm-hands-entry-lite-g0bpdyfz.js";import{Yo}from"./vm-hands-entry-lite-b3mfma12.js";import{hr,Mo}from"./vm-hands-entry-lite-07wr95rz.js";import{tt,sc,ac}from"./vm-hands-entry-lite-sxnvhzy5.js";import{un}from"./vm-hands-entry-lite-chve4vmh.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{vt,Tn,In,Dn,L}from"./vm-hands-entry-lite-hpe54h0b.js";import{s,Ge}from"./vm-hands-entry-lite-tzv8s0e7.js";import{t,V,o,_,d,n,we,P,$e,c,i,Yc}from"./vm-hands-entry-lite-bt6skt4h.js";import{Y,Me,Dt,Be,Zi}from"./vm-hands-entry-lite-04nx5y4f.js";import{Ot}from"./vm-hands-entry-lite-wnqqjsew.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{request as lc}from"http";import{request as cc}from"https";import{lookup as uc}from"dns/promises";import{isIP as dc}from"net";async function pc(e){let a=new URL(e.url);return await new Promise((l,u)=>{let p=(a.protocol==="https:"?cc:lc)(a,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:pa},(m)=>l({response:m,close:()=>{m.destroy(),p.destroy(),m.socket?.destroy()}}));p.once("error",u),p.once("timeout",()=>p.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),p.end(e.body)})}var mi=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),mc=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function hi(e,a=0){if(!e||typeof e!=="object"||a>3)return null;let l=e.code;if(typeof l==="string"){if(mi.has(l))return"custom_endpoint_host_not_found";if(mc.has(l))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(l))return"custom_endpoint_tls_failed"}for(let u of[...e instanceof AggregateError?e.errors:[],e.cause]){let p=hi(u,a+1);if(p)return p}return null}async function fc(e,a){let l=hi(e),u=new URL(a).hostname.replace(/^\[|\]$/g,"");if(l!==null&&l!=="custom_endpoint_connection_failed"||dc(u)!==0)return l;let p;return await Promise.race([uc(u).then(()=>!0,(f)=>!mi.has(String(f?.code))),new Promise((f)=>{p=setTimeout(()=>f(!0),5000)})]).finally(()=>clearTimeout(p))?l:"custom_endpoint_host_not_found"}function hc(e){for(let a=42;;a++){if(a===127)a=256;let l=String.fromCodePoint(a);if(!e.includes(l))return l}}function gc(e,a){let l=Buffer.from(e),u=Buffer.from(a),p=new Uint32Array(l.length);for(let f=1,g=0;f<l.length;f++){while(g&&l[f]!==l[g])g=p[g-1];if(l[f]===l[g])g++;p[f]=g}let m=0;return(f,g=!1)=>{let b=Buffer.allocUnsafe(f.length*u.length+m),y=0;for(let h of f){while(m&&l[m]!==h){let w=p[m-1];y+=l.copy(b,y,0,m-w),m=w}if(l[m]===h){if(m++,m===l.length)y+=u.copy(b,y),m=0}else b[y++]=h}if(g)y+=l.copy(b,y,0,m),m=0;return b.subarray(0,y)}}async function gi(e){e.signal.throwIfAborted();let a=ha.safeParse(e.payload);if(!a.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let l=a.data,u=fa.parse(await e.credential(e.signal));if(!Ji(l,{baseUrl:l.baseUrl,api:u.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let p,m,f=0,g=0,b=0,y=hc(u.apiKey),h=gc(u.apiKey,y),w=async(v,R)=>{e.signal.throwIfAborted(),await new Promise((I,x)=>{let E=()=>{e.signal.removeEventListener("abort",E),x(e.signal.reason)};if(e.signal.addEventListener("abort",E,{once:!0}),e.signal.aborted){E();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(v,R))).then(()=>{e.signal.removeEventListener("abort",E),I()},(O)=>{e.signal.removeEventListener("abort",E),x(O)})})},S=async(v)=>{if(f+=v.length,f>Un)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let R=0;R<v.length;R+=Br){if(b>=Ki)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await w(`custom_endpoint.chunk.${b++}`,{eof:!1,data:v.subarray(R,R+Br).toString("base64")})}};try{let v=await pc({url:l.url,body:l.body,signal:e.signal,headers:{...l.headers,...u.api==="anthropic-messages"?{"x-api-key":u.apiKey}:{authorization:`Bearer ${u.apiKey}`}}});p=v.response,m=v.close;let R=p.statusCode??500;if(R>=300&&R<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(p.headers["content-encoding"]&&p.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let I={};for(let x of["content-type","retry-after","x-request-id","request-id"]){let E=p.headers[x];if(typeof E==="string")I[x]=E.replaceAll(u.apiKey,y).slice(0,4096)}await w("custom_endpoint.headers",{status:R,statusText:(p.statusMessage??"").replaceAll(u.apiKey,y).slice(0,256),headers:I});for await(let x of p){e.signal.throwIfAborted();let E=Buffer.isBuffer(x)?x:Buffer.from(x);if(g+=E.length,g>Un)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await S(h(E))}return await S(h(Buffer.alloc(0),!0)),await w(`custom_endpoint.chunk.${b}`,{eof:!0}),{bytes:f,chunks:b}}catch(v){if(e.signal.throwIfAborted(),v instanceof r)throw v;throw new r((p?null:await fc(v,l.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{m?.()}}import{join as _i}from"path";function _c(e,a){return e===_i(a,".ara","workspace")||e===_i(a,".reason","workspace")}function yi(e,a){let l=e.filter((u)=>_c(u.path,a));return l.length===1?l[0].path:null}var yc=/^[a-f0-9]{64}$/;var Yr=32,bc=/^\/[^\x00-\x1f\x7f\\]*$/;function tr(e){if(typeof e!=="string"||e.length>4096||!bc.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((a)=>a!==""&&a!=="."&&a!=="..")}function nr(e,a){let l=a==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!l)return e;let u=l[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${l[1].toUpperCase()}:${u?`/${u}`:""}`}function ir(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let a=e;if(!tr(a.home)||!Array.isArray(a.roots)||a.roots.length>Yr)return;let l=[];for(let u of a.roots){if(!u||typeof u!=="object"||Array.isArray(u))return;let{path_fingerprint:p,path:m}=u;if(typeof p!=="string"||!yc.test(p)||!tr(m))return;l.push({path_fingerprint:p,path:m})}return{home:a.home,roots:l}}function wc(e){let a=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&a?a:void 0}function Sc(e){return wc(e)??e.email.toLowerCase()}function Kr(e){let a=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return a?Sc({name:a[1],email:a[2]}):e.trim().toLowerCase()}var Lt=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(a)=>`[${a.toLowerCase()}${a.toUpperCase()}]`),vc=[...vt.map((e)=>`/(${e.map(Lt).join("/")})(/|$)`),...Tn.map((e)=>`/(${e.map(Lt).join("/")})(/|$)`),...[...In].map((e)=>`/(${Lt(e)})$`),`/${Lt(".env.")}[^/]*$`,...Dn.map((e)=>`/[^/]*${Lt(e)}$`)],Si=`function localGithubSandboxProfile(root, temporary) {
+import{rr,Br,Un,Ki,Fr,jr,pa,Ji,ha,fa,Hr}from"./vm-hands-entry-lite-1cdtev4n.js";import{Ct,Fn,vs,Or,Vc,Je,Gc,Kc,Qt,Xe,M,At,ks,jn,xs,Lr,Rs,Ts,Is,Ds,Os,Ns,Ls,$s,Ms,Bs,Fs,js,Hs,ct,Le,Pt,xe,Us,zs,qs,Ws,Vs,Gs,Ks,Js,$r,Xs,Mr,Zs,Gi,Qs,ea,ta,ra,na,ia,oa,sa,aa,ca,la,ua,da}from"./vm-hands-entry-lite-vvhfaxpd.js";import{at,Oe,X,te}from"./vm-hands-entry-lite-hpw27zfb.js";import{F,yn}from"./vm-hands-entry-lite-bc9zq8gx.js";import{ii,Va,Ga,Qe,Ka,Ja,rn,Xa,Ya,Za,si,ci,li,Eo,ko,ui,nc,xo,di,Pe,J,sn,pi,fi,et}from"./vm-hands-entry-lite-mktndd2r.js";import{U,H,T}from"./vm-hands-entry-lite-bbjsnjct.js";import{Fa,ja,yo,Ua,wo,za,lr,ei}from"./vm-hands-entry-lite-7jmt3q38.js";import{ue}from"./vm-hands-entry-lite-t2rhwchw.js";import{je}from"./vm-hands-entry-lite-732hnx41.js";import{Se}from"./vm-hands-entry-lite-1as6h9ed.js";import{Yn,Zn,Ma}from"./vm-hands-entry-lite-bqs4pkyb.js";import{Pc,Rc,Ar,Tc,Ic,Dc,Oc,Nc,Lc,$c}from"./vm-hands-entry-lite-hh0kba1y.js";import{wi,hn,bi,Fo,jo}from"./vm-hands-entry-lite-3594pdj0.js";import{dn,jt,pn}from"./vm-hands-entry-lite-jm9jpj77.js";import{A,es}from"./vm-hands-entry-lite-9meg54bs.js";import{xc,Cc}from"./vm-hands-entry-lite-bcz4qpp6.js";import{vr}from"./vm-hands-entry-lite-g0bpdyfz.js";import{Yo}from"./vm-hands-entry-lite-ksfd234v.js";import{hr,Mo}from"./vm-hands-entry-lite-kzygj0q8.js";import{tt,sc,ac}from"./vm-hands-entry-lite-sxnvhzy5.js";import{un}from"./vm-hands-entry-lite-chve4vmh.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{vt,Tn,In,Dn,L}from"./vm-hands-entry-lite-hpe54h0b.js";import{s,Ge}from"./vm-hands-entry-lite-tzv8s0e7.js";import{t,V,o,_,d,n,we,P,$e,c,i,Yc}from"./vm-hands-entry-lite-bt6skt4h.js";import{Y,Me,Dt,Be,Zi}from"./vm-hands-entry-lite-04nx5y4f.js";import{Ot}from"./vm-hands-entry-lite-wnqqjsew.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{request as lc}from"http";import{request as cc}from"https";import{lookup as uc}from"dns/promises";import{isIP as dc}from"net";async function pc(e){let a=new URL(e.url);return await new Promise((l,u)=>{let p=(a.protocol==="https:"?cc:lc)(a,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:pa},(m)=>l({response:m,close:()=>{m.destroy(),p.destroy(),m.socket?.destroy()}}));p.once("error",u),p.once("timeout",()=>p.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),p.end(e.body)})}var mi=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),mc=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function hi(e,a=0){if(!e||typeof e!=="object"||a>3)return null;let l=e.code;if(typeof l==="string"){if(mi.has(l))return"custom_endpoint_host_not_found";if(mc.has(l))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(l))return"custom_endpoint_tls_failed"}for(let u of[...e instanceof AggregateError?e.errors:[],e.cause]){let p=hi(u,a+1);if(p)return p}return null}async function fc(e,a){let l=hi(e),u=new URL(a).hostname.replace(/^\[|\]$/g,"");if(l!==null&&l!=="custom_endpoint_connection_failed"||dc(u)!==0)return l;let p;return await Promise.race([uc(u).then(()=>!0,(f)=>!mi.has(String(f?.code))),new Promise((f)=>{p=setTimeout(()=>f(!0),5000)})]).finally(()=>clearTimeout(p))?l:"custom_endpoint_host_not_found"}function hc(e){for(let a=42;;a++){if(a===127)a=256;let l=String.fromCodePoint(a);if(!e.includes(l))return l}}function gc(e,a){let l=Buffer.from(e),u=Buffer.from(a),p=new Uint32Array(l.length);for(let f=1,g=0;f<l.length;f++){while(g&&l[f]!==l[g])g=p[g-1];if(l[f]===l[g])g++;p[f]=g}let m=0;return(f,g=!1)=>{let b=Buffer.allocUnsafe(f.length*u.length+m),y=0;for(let h of f){while(m&&l[m]!==h){let w=p[m-1];y+=l.copy(b,y,0,m-w),m=w}if(l[m]===h){if(m++,m===l.length)y+=u.copy(b,y),m=0}else b[y++]=h}if(g)y+=l.copy(b,y,0,m),m=0;return b.subarray(0,y)}}async function gi(e){e.signal.throwIfAborted();let a=ha.safeParse(e.payload);if(!a.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let l=a.data,u=fa.parse(await e.credential(e.signal));if(!Ji(l,{baseUrl:l.baseUrl,api:u.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let p,m,f=0,g=0,b=0,y=hc(u.apiKey),h=gc(u.apiKey,y),w=async(v,R)=>{e.signal.throwIfAborted(),await new Promise((I,x)=>{let E=()=>{e.signal.removeEventListener("abort",E),x(e.signal.reason)};if(e.signal.addEventListener("abort",E,{once:!0}),e.signal.aborted){E();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(v,R))).then(()=>{e.signal.removeEventListener("abort",E),I()},(O)=>{e.signal.removeEventListener("abort",E),x(O)})})},S=async(v)=>{if(f+=v.length,f>Un)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let R=0;R<v.length;R+=Br){if(b>=Ki)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await w(`custom_endpoint.chunk.${b++}`,{eof:!1,data:v.subarray(R,R+Br).toString("base64")})}};try{let v=await pc({url:l.url,body:l.body,signal:e.signal,headers:{...l.headers,...u.api==="anthropic-messages"?{"x-api-key":u.apiKey}:{authorization:`Bearer ${u.apiKey}`}}});p=v.response,m=v.close;let R=p.statusCode??500;if(R>=300&&R<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(p.headers["content-encoding"]&&p.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let I={};for(let x of["content-type","retry-after","x-request-id","request-id"]){let E=p.headers[x];if(typeof E==="string")I[x]=E.replaceAll(u.apiKey,y).slice(0,4096)}await w("custom_endpoint.headers",{status:R,statusText:(p.statusMessage??"").replaceAll(u.apiKey,y).slice(0,256),headers:I});for await(let x of p){e.signal.throwIfAborted();let E=Buffer.isBuffer(x)?x:Buffer.from(x);if(g+=E.length,g>Un)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await S(h(E))}return await S(h(Buffer.alloc(0),!0)),await w(`custom_endpoint.chunk.${b}`,{eof:!0}),{bytes:f,chunks:b}}catch(v){if(e.signal.throwIfAborted(),v instanceof r)throw v;throw new r((p?null:await fc(v,l.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{m?.()}}import{join as _i}from"path";function _c(e,a){return e===_i(a,".ara","workspace")||e===_i(a,".reason","workspace")}function yi(e,a){let l=e.filter((u)=>_c(u.path,a));return l.length===1?l[0].path:null}var yc=/^[a-f0-9]{64}$/;var Yr=32,bc=/^\/[^\x00-\x1f\x7f\\]*$/;function tr(e){if(typeof e!=="string"||e.length>4096||!bc.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((a)=>a!==""&&a!=="."&&a!=="..")}function nr(e,a){let l=a==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!l)return e;let u=l[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${l[1].toUpperCase()}:${u?`/${u}`:""}`}function ir(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let a=e;if(!tr(a.home)||!Array.isArray(a.roots)||a.roots.length>Yr)return;let l=[];for(let u of a.roots){if(!u||typeof u!=="object"||Array.isArray(u))return;let{path_fingerprint:p,path:m}=u;if(typeof p!=="string"||!yc.test(p)||!tr(m))return;l.push({path_fingerprint:p,path:m})}return{home:a.home,roots:l}}function wc(e){let a=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&a?a:void 0}function Sc(e){return wc(e)??e.email.toLowerCase()}function Kr(e){let a=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return a?Sc({name:a[1],email:a[2]}):e.trim().toLowerCase()}var Lt=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(a)=>`[${a.toLowerCase()}${a.toUpperCase()}]`),vc=[...vt.map((e)=>`/(${e.map(Lt).join("/")})(/|$)`),...Tn.map((e)=>`/(${e.map(Lt).join("/")})(/|$)`),...[...In].map((e)=>`/(${Lt(e)})$`),`/${Lt(".env.")}[^/]*$`,...Dn.map((e)=>`/[^/]*${Lt(e)}$`)],Si=`function localGithubSandboxProfile(root, temporary) {
   return ['(version 1)','(deny default)','(import "system.sb")','(allow process-exec process-fork)',
     '(allow file-read* (subpath "/bin") (subpath "/sbin") (subpath "/usr/bin") (subpath "/usr/sbin") (subpath "/usr/libexec") (subpath "/usr/share") (subpath "/private/var/select") (literal "/private/var/db/xcode_select_link"))',
     '(allow file-read-metadata (path-ancestors "/opt/homebrew/bin") (path-ancestors "/usr/local/bin") (path-ancestors "/Library/Developer/CommandLineTools"))',

package/bin/vm-hands/{vm-hands-entry-lite-dfphra23.js → vm-hands-entry-lite-y2vqwds4.js}

@@ -1,4 +1,4 @@
 // @bun
-import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{mkdirSync as R,readdirSync as A,readFileSync as k,realpathSync as x}from"fs";import{userInfo as E}from"os";var qn="--vm-hands-op-runner-kind=person",Wn="--vm-hands-op-runner-kind=surface",Wr="--vm-hands-surface-uid=",Vr="--vm-hands-surface-dir=",C="/sys/fs/cgroup/reason-person/desktop",Gr=new Set(["automation.call.v1","display.stream.v1","preview.serve.v1"]);function D(t){let a=new Set([t]),l=[];try{l=A("/proc")}catch{}for(let n of l){if(!/^\d+$/.test(n))continue;try{let o=k(`/proc/${n}/stat`,"utf8");if(Number(o.slice(o.lastIndexOf(")")+2).split(" ")[3])===t)a.add(Number(n))}catch{}}for(let n of a)try{process.kill(n,"SIGKILL")}catch{}}var H=(t)=>{let a=globalThis.Bun;if(!a)throw new r("pty_unavailable","Reason terminals require the Bun runtime.");let l=a.spawn({cmd:[t.shell,...t.args],cwd:t.cwd,env:{...t.environment,TERM:"xterm-256color"},terminal:{cols:t.cols,rows:t.rows,data:(c,d)=>t.onData(d)}}),n=l.terminal,o=()=>{D(l.pid);try{n?.close()}catch{}};if(!n)throw o(),new r("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(c)=>n.write(c),resize:(c,d)=>n.resize(c,d),kill:o,exited:l.exited.then((c)=>typeof c==="number"?c:null,()=>null)}};function O(){let t=(()=>{try{return E().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...t?{USER:t,LOGNAME:t}:{}}}async function L(t){let[{localAutomationAvailable:a},{localDisplayReady:l},{localDisplayVideoAvailable:n},{probeWorkerPreview:o},m]=await Promise.all([import("./local-automation-3mdhfw08.js"),import("./local-display-session-r6s0wghh.js"),import("./local-display-video-61peg1pj.js"),import("./worker-preview-readiness-w4zy5g2p.js"),import("fs")]),c=AbortSignal.timeout(15000),d=null;try{m.mkdirSync(t,{recursive:!0,mode:448}),d=m.mkdtempSync(`${t}/probe-`);let[w,u,v]=await Promise.all([Promise.resolve().then(()=>a()).catch(()=>!1),l().catch(()=>!1),o(d,c).catch(()=>!1)]);return{t:"readiness",display_video:u&&await n().catch(()=>!1),lanes:{"automation.call.v1":w,"display.stream.v1":u,"preview.serve.v1":v,"tunnel.open":v,"tunnel.close":v}}}finally{if(d)m.rmSync(d,{recursive:!0,force:!0})}}function N(t){let a="";try{a=k("/proc/self/cgroup","utf8").split(`
-`).find((o)=>o.startsWith("0::"))?.slice(3)??""}catch{return null}if(!/^\/reason-person\/vm-hands\/[A-Za-z0-9._-]+$/.test(a))return null;if(!t)return null;let l=[t.xvnc,t.xvfb,t.openbox,t.x11vnc,t.pulseaudio,t.browser,"/usr/bin/dbus-daemon","/bin/dbus-daemon"].flatMap((o)=>{try{return o?[x(o)]:[]}catch{return[]}}),n={join:`/sys/fs/cgroup${a}/desktop`,keep:C,programs:[...new Set(l)]};for(let o of[n.join,n.keep])try{R(o,{mode:493})}catch(m){if(m.code!=="EEXIST")return null}return n}async function hl(){let[{executeLocalOperation:t,spawnCaptured:a},{runLocalPtySession:l},{configureDesktopAccount:n,desktopAccount:o},{configureWorkerSandbox:m},{configureDesktopPlacement:c},{readDesktopComponents:d}]=await Promise.all([import("./local-capabilities-6e0gkrqq.js"),import("./local-pty-session-w0yhjdvz.js"),import("./desktop-account-d1g1m6yb.js"),import("./worker-sandbox-2trfs79b.js"),import("./desktop-delegate-4hb0163k.js"),import("./desktop-components-7ngf8byq.js")]);m();let w=process.argv.includes(qn),u=process.argv.includes(Wn),v=(i,e,p)=>a(i,e[0]==="-lic"?["-lc",...e.slice(1)]:e,p),y=(process.geteuid?.()??0)!==0;if(u){y=!1;let i=process.argv.find((e)=>e.startsWith(Wr))?.slice(Wr.length);if((process.geteuid?.()??-1)===0&&i)try{y=n({value:i})!==null&&o()!==null}catch{y=!1}}let S=new Map,_=new Map,f=(i)=>{try{process.send?.(i)}catch{}};if(u&&y){let i=o()?.home,e=i?N(d({home:i})):null;c(e&&{...e,log:(p,g)=>f({t:"log",event:p,fields:g})})}if(process.on("message",(i)=>{let e=i;if(e?.t==="cancel"){S.get(e.id)?.abort();return}if(e?.t==="control"){let s=_.get(e.id);if(u&&s&&e.control&&typeof e.control.kind==="string")import("./local-managed-process-p8xd7m5f.js").then(({controlManagedDeviceProcess:h})=>h(s,{kind:e.control.kind,payload:e.control.payload??{}})).catch(()=>!1);return}if(e?.t==="retire"){if(u&&typeof e.operation_id==="string"&&typeof e.status==="string")import("./local-managed-process-p8xd7m5f.js").then(({retireManagedDeviceProcess:s})=>s(e.operation_id,e.status)).catch(()=>!1);return}if(e?.t!=="op")return;if(!y){f({t:"done",id:e.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let p=e.claim.capability;if(p==="pty.start"&&!w){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}if(Gr.has(p)!==u){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}let g=new AbortController;S.set(e.id,g),_.set(e.id,e.claim);let b=p==="pty.start"?{runPtySession:(s)=>l(s,{spawnPty:H,environment:O(),loadProxy:()=>null})}:{worker:e.worker,...p==="exec.full"?{spawnFullControl:v}:{}};t(e.state,e.claim,{...b,signal:g.signal,emit:(s)=>{let{deliverySignal:h,...P}=s;f({t:"event",id:e.id,event:P})}}).then((s)=>f({t:"done",id:e.id,completion:s}),(s)=>f({t:"done",id:e.id,completion:{status:"failed",error_code:s&&typeof s==="object"&&"code"in s&&typeof s.code==="string"?s.code:"vm_hands_op_failed"}})).finally(()=>{S.delete(e.id),_.delete(e.id)})}),process.on("disconnect",()=>process.exit(0)),u){let i=process.argv.find((p)=>p.startsWith(Vr))?.slice(Vr.length),e={t:"readiness",display_video:!1,lanes:{}};f(y&&i?await L(i).catch(()=>e):e)}await new Promise(()=>{})}
+import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{mkdirSync as R,readdirSync as A,readFileSync as k,realpathSync as x}from"fs";import{userInfo as E}from"os";var qn="--vm-hands-op-runner-kind=person",Wn="--vm-hands-op-runner-kind=surface",Wr="--vm-hands-surface-uid=",Vr="--vm-hands-surface-dir=",C="/sys/fs/cgroup/reason-person/desktop",Gr=new Set(["automation.call.v1","display.stream.v1","preview.serve.v1"]);function D(t){let a=new Set([t]),l=[];try{l=A("/proc")}catch{}for(let n of l){if(!/^\d+$/.test(n))continue;try{let o=k(`/proc/${n}/stat`,"utf8");if(Number(o.slice(o.lastIndexOf(")")+2).split(" ")[3])===t)a.add(Number(n))}catch{}}for(let n of a)try{process.kill(n,"SIGKILL")}catch{}}var H=(t)=>{let a=globalThis.Bun;if(!a)throw new r("pty_unavailable","Reason terminals require the Bun runtime.");let l=a.spawn({cmd:[t.shell,...t.args],cwd:t.cwd,env:{...t.environment,TERM:"xterm-256color"},terminal:{cols:t.cols,rows:t.rows,data:(c,d)=>t.onData(d)}}),n=l.terminal,o=()=>{D(l.pid);try{n?.close()}catch{}};if(!n)throw o(),new r("pty_unavailable","Reason could not allocate a pseudo-terminal.");return{write:(c)=>n.write(c),resize:(c,d)=>n.resize(c,d),kill:o,exited:l.exited.then((c)=>typeof c==="number"?c:null,()=>null)}};function O(){let t=(()=>{try{return E().username}catch{return}})();return{PATH:process.env.PATH,HOME:process.env.HOME,SHELL:process.env.SHELL,LANG:"C.UTF-8",...t?{USER:t,LOGNAME:t}:{}}}async function L(t){let[{localAutomationAvailable:a},{localDisplayReady:l},{localDisplayVideoAvailable:n},{probeWorkerPreview:o},m]=await Promise.all([import("./local-automation-fxdb4ynz.js"),import("./local-display-session-8b2hx1k6.js"),import("./local-display-video-511qjgmq.js"),import("./worker-preview-readiness-w4zy5g2p.js"),import("fs")]),c=AbortSignal.timeout(15000),d=null;try{m.mkdirSync(t,{recursive:!0,mode:448}),d=m.mkdtempSync(`${t}/probe-`);let[w,u,v]=await Promise.all([Promise.resolve().then(()=>a()).catch(()=>!1),l().catch(()=>!1),o(d,c).catch(()=>!1)]);return{t:"readiness",display_video:u&&await n().catch(()=>!1),lanes:{"automation.call.v1":w,"display.stream.v1":u,"preview.serve.v1":v,"tunnel.open":v,"tunnel.close":v}}}finally{if(d)m.rmSync(d,{recursive:!0,force:!0})}}function N(t){let a="";try{a=k("/proc/self/cgroup","utf8").split(`
+`).find((o)=>o.startsWith("0::"))?.slice(3)??""}catch{return null}if(!/^\/reason-person\/vm-hands\/[A-Za-z0-9._-]+$/.test(a))return null;if(!t)return null;let l=[t.xvnc,t.xvfb,t.openbox,t.x11vnc,t.pulseaudio,t.browser,"/usr/bin/dbus-daemon","/bin/dbus-daemon"].flatMap((o)=>{try{return o?[x(o)]:[]}catch{return[]}}),n={join:`/sys/fs/cgroup${a}/desktop`,keep:C,programs:[...new Set(l)]};for(let o of[n.join,n.keep])try{R(o,{mode:493})}catch(m){if(m.code!=="EEXIST")return null}return n}async function hl(){let[{executeLocalOperation:t,spawnCaptured:a},{runLocalPtySession:l},{configureDesktopAccount:n,desktopAccount:o},{configureWorkerSandbox:m},{configureDesktopPlacement:c},{readDesktopComponents:d}]=await Promise.all([import("./local-capabilities-8fgrfpj4.js"),import("./local-pty-session-w0yhjdvz.js"),import("./desktop-account-d1g1m6yb.js"),import("./worker-sandbox-2trfs79b.js"),import("./desktop-delegate-4hb0163k.js"),import("./desktop-components-577haqrs.js")]);m();let w=process.argv.includes(qn),u=process.argv.includes(Wn),v=(i,e,p)=>a(i,e[0]==="-lic"?["-lc",...e.slice(1)]:e,p),y=(process.geteuid?.()??0)!==0;if(u){y=!1;let i=process.argv.find((e)=>e.startsWith(Wr))?.slice(Wr.length);if((process.geteuid?.()??-1)===0&&i)try{y=n({value:i})!==null&&o()!==null}catch{y=!1}}let S=new Map,_=new Map,f=(i)=>{try{process.send?.(i)}catch{}};if(u&&y){let i=o()?.home,e=i?N(d({home:i})):null;c(e&&{...e,log:(p,g)=>f({t:"log",event:p,fields:g})})}if(process.on("message",(i)=>{let e=i;if(e?.t==="cancel"){S.get(e.id)?.abort();return}if(e?.t==="control"){let s=_.get(e.id);if(u&&s&&e.control&&typeof e.control.kind==="string")import("./local-managed-process-h0fypn67.js").then(({controlManagedDeviceProcess:h})=>h(s,{kind:e.control.kind,payload:e.control.payload??{}})).catch(()=>!1);return}if(e?.t==="retire"){if(u&&typeof e.operation_id==="string"&&typeof e.status==="string")import("./local-managed-process-h0fypn67.js").then(({retireManagedDeviceProcess:s})=>s(e.operation_id,e.status)).catch(()=>!1);return}if(e?.t!=="op")return;if(!y){f({t:"done",id:e.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let p=e.claim.capability;if(p==="pty.start"&&!w){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}if(Gr.has(p)!==u){f({t:"done",id:e.id,completion:{status:"failed",error_code:"capability_not_granted"}});return}let g=new AbortController;S.set(e.id,g),_.set(e.id,e.claim);let b=p==="pty.start"?{runPtySession:(s)=>l(s,{spawnPty:H,environment:O(),loadProxy:()=>null})}:{worker:e.worker,...p==="exec.full"?{spawnFullControl:v}:{}};t(e.state,e.claim,{...b,signal:g.signal,emit:(s)=>{let{deliverySignal:h,...P}=s;f({t:"event",id:e.id,event:P})}}).then((s)=>f({t:"done",id:e.id,completion:s}),(s)=>f({t:"done",id:e.id,completion:{status:"failed",error_code:s&&typeof s==="object"&&"code"in s&&typeof s.code==="string"?s.code:"vm_hands_op_failed"}})).finally(()=>{S.delete(e.id),_.delete(e.id)})}),process.on("disconnect",()=>process.exit(0)),u){let i=process.argv.find((p)=>p.startsWith(Vr))?.slice(Vr.length),e={t:"readiness",display_video:!1,lanes:{}};f(y&&i?await L(i).catch(()=>e):e)}await new Promise(()=>{})}
 export{qn,Wn,Wr,Vr,Gr,hl};

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,4 +1,4 @@
 // @bun
 import{At,Lr,Cs,As,Ps,Mr}from"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import{createHash as K,randomBytes as ge}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Qe,openSync as Oe,renameSync as Ze,rmSync as en,statSync as De,writeSync as Me,constants as H}from"fs";import{join as re}from"path";var nn=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:tn(e)}}function tn(e){let n=e.payload[Cs];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var W=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),V=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function L(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(L).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${L(e[n])}`).join(",")}}`}async function Ta(e){let n=await crypto.subtle.importKey("pkcs8",V(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=V(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),g=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),h=K("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:g,fingerprint:h}}var sn=16;class co{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;abandoned=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let g=this.bound.get(e);if(!g)return!1;if(g.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((h)=>setTimeout(h,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:nn,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:W(this.keys.signingSpki),env_public_key:W(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:W(ge(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(L(n)));return{...n,device_signature:W(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=W(ge(32)),g=Mr({method:"GET",pathAndQuery:At,timestamp:i,nonce:s,challenge:e,bodySha256:K("sha256").update("").digest("hex")}),h=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(g)));return{t:"hello",timestamp:i,nonce:s,signature:W(rn(h)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let s of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(s))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(K("sha256").update(L({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((s)=>s.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=sn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((s)=>s.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let s,g,h=new Promise((m,S)=>{s=m,g=S});return h.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:h,resolve:s,reject:g}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(w){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(w,"the bind's kill-verify failed")}let i,s=new Promise((w)=>{i=w}),g=!1,h=!1,m=()=>{h=!0,i()},S=n.promise.then(()=>new Promise((w,I)=>{this.exclusive(async()=>{if(h){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}g=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();w()}catch(b){I(b)}await s})}));S.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:S,inTurn:()=>g,leave:m})}finally{m()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);if(this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","abandoned before its launch");s=!0;let{launchId:g,applied:h,readyData:m}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),S=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let w=null,I=null;if(e.env){let b=e.claim?.owner??{},R=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof b.device_id==="string"?b.device_id:"",rootId:e.claim?.root_id??""});w=this.hooks.installEnvironment(e.bind_id,R),I=typeof R.snapshot_id==="string"&&R.snapshot_id?R.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,R)}if(this.unbinding.has(e.bind_id)||this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:g,envInstalled:w!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:g,snapshot_revision:w,snapshot_id:I,layout:S,...m?{ready_data:m}:{},policy_digest:K("sha256").update(L({hands_confinement:h.hands_confinement??null,browser_egress:h.browser_egress??null})).digest("hex")}}catch(g){if(i)fe(i);if(s){let h=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(h);else await h()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(g,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}abandonBinding(e){if(!this.binding.has(e))return;this.abandoned.add(e),this.abandonWorkspaceGrant(e);try{this.hooks.abortExecutor?.(e)}catch{}}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),g=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${g}`,s),{snapshot_id:e.snapshotId,installed_revision:g,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:K("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(g){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw g}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",V(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),g=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),h=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(e.iv),additionalData:new TextEncoder().encode(n)},g,V(e.ct)).catch(i),m=JSON.parse(new TextDecoder().decode(h));if(!m||typeof m!=="object"||Array.isArray(m))throw new l("vm_hands_env_invalid","env not an object");return m}writeJobEnvRootOnly(e,n){let i=re(this.options.envRoot,`bind-${e}`);Qe(i,{mode:448});let s=De(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let g=n.variables&&typeof n.variables==="object"?n.variables:{},h=Object.entries(g).filter(([w,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(w)&&typeof I==="string").map(([w,I])=>`export ${w}='${String(I).replaceAll("'","'\\''")}'`).join(`
 `)+`
-`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),pn=3,vn=20000,wn=250,bn=2000;function je(e){let n=Math.min(wn*2**(e-1),bn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function kn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var Sn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function In(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function Pn(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function En(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Tn=1e4,Rn=1000;async function Ia(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await An(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<pn&&Date.now()-n<vn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function An(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,Rn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Tn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=Sn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await Pn(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+yn,q=1,M=await f("hands.ready",se);while(kn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===As){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===Lr)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?En(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(Ps,{code:o}).catch(()=>{return}),In(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as On}from"fs";var xn=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Dn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-6r390v3d.js");await h();return}z("parsed",{t0:Math.round(xn)});let e="";try{e=On(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-z9m50n9p.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Dn();export{Ta,co,Ia};
+`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),pn=3,vn=20000,wn=250,bn=2000;function je(e){let n=Math.min(wn*2**(e-1),bn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function kn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var Sn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function In(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function Pn(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function En(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Tn=1e4,Rn=1000;async function Ia(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await An(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<pn&&Date.now()-n<vn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function An(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,Rn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Tn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=Sn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await Pn(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+yn,q=1,M=await f("hands.ready",se);while(kn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===As){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===Lr)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?En(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(Ps,{code:o}).catch(()=>{return}),In(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as On}from"fs";var xn=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Dn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-nr4ncs4p.js");await h();return}z("parsed",{t0:Math.round(xn)});let e="";try{e=On(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-qvy5s122.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Dn();export{Ta,co,Ia};

package/bin/vm-hands/{vm-hands-executor-31ea40aw.js → vm-hands-executor-xd8v5v0e.js}

@@ -1,5 +1,5 @@
 // @bun
-import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-h7f5a5mb.js";import{Qe,nn,hi,an,et}from"./vm-hands-entry-lite-cy8yc9gb.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-bbjsnjct.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import{qn,Wn,Wr,Vr}from"./vm-hands-entry-lite-dfphra23.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-04nx5y4f.js";import{spawn as Me}from"child_process";import{chmodSync as Le,chownSync as Te,existsSync as E,lstatSync as ee,mkdirSync as J,mkdtempSync as We,readdirSync as X,readFileSync as k,realpathSync as He,rmdirSync as pe,rmSync as ze,writeFileSync as B}from"fs";import{basename as Ue,dirname as Be,join as p}from"path";import{readFileSync as ae,readlinkSync as ce}from"fs";import{relative as Ne}from"path";var ue=16;function le(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function De(e){let r=[];for(let t of e.split(`
+import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-h7f5a5mb.js";import{Qe,nn,hi,an,et}from"./vm-hands-entry-lite-mktndd2r.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-bbjsnjct.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import{qn,Wn,Wr,Vr}from"./vm-hands-entry-lite-y2vqwds4.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-04nx5y4f.js";import{spawn as Me}from"child_process";import{chmodSync as Le,chownSync as Te,existsSync as E,lstatSync as ee,mkdirSync as J,mkdtempSync as We,readdirSync as X,readFileSync as k,realpathSync as He,rmdirSync as pe,rmSync as ze,writeFileSync as B}from"fs";import{basename as Ue,dirname as Be,join as p}from"path";import{readFileSync as ae,readlinkSync as ce}from"fs";import{relative as Ne}from"path";var ue=16;function le(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function De(e){let r=[];for(let t of e.split(`
 `)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:le(n[3]),mountPoint:le(n[4])})}return r}function Ae(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(De(m).filter((_)=>c(_.mountPoint)).map((_)=>[`${_.mountPoint}\x00${_.device}\x00${_.root}`,_.mountPoint])),l=o(r),d=o(t),b=(m)=>Ne(n,m)||".",R=[...l].filter(([m])=>!d.has(m)).map(([,m])=>b(m)),N=[...d].filter(([m])=>!l.has(m)).map(([,m])=>b(m));return{missing:R,extra:N,referenceCount:l.size,ownCount:d.size}}function de(e,r,t,n="/proc"){let c,o,l=null;try{c=ae(`${n}/1/mountinfo`,"utf8"),o=ae(`${n}/self/mountinfo`,"utf8")}catch(_){let O=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{l=ce(`${n}/1/ns/mnt`)===ce(`${n}/self/ns/mnt`)}catch{}let{missing:d,extra:b,referenceCount:R,ownCount:N}=Ae(e,c,o),m={reference_count:R,own_count:N,missing_count:d.length,extra_count:b.length,same_namespace:l};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ue)});if(d.length)throw r("vm_hands.mount_mismatch",{...m,missing:d.slice(0,ue)}),t(`${d.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var ve="/sys/fs/cgroup/reason-payload",L="vm-hands",Fe="/run/ara-srt/fallbacks.jsonl",oe="/reason-person",Ke="/reason-workload",je="surface",ne=5000,Ge=1e4,fe="__VM_HANDS_PROOF_DIR__",Ee="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,r){super(r);this.code=e}}function Ve(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new w("vm_hands_bind_invalid","bad bind id");return p(e,L,`b-${r.toLowerCase()}`)}var Je=5000,be=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Ze(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=p(Be(e),r.toLowerCase());return Ue(e).toLowerCase()===r.toLowerCase()?e:t}function wn(e){let r=e.cgroup??ve,t=e.init.layout.payload_uid,n=e.init.workload_ended!==!0,c=(s)=>U(s,oe)||n&&U(s,Ke),o=e.log??(()=>{}),l=(s)=>Ze(e.init.layout.session_root,s),d=new Map,b=new Map,R=0,N=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(R>s.length?0:R).split(`
 `).filter(Boolean);R=s.length;let u=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(u.length)o("vm_hands.srt_server_starts",{count:u.length,elapsed_ms:u.slice(0,8)})}catch{}},m=null,_=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",x=()=>{m??=me()},P=0,F=()=>{try{let s=k(Fe,"utf8"),i=s.slice(P>s.length?0:P);P=s.length;let u=i.split(`
 `).filter(Boolean).slice(0,1000);if(!u.length)return null;let f={},g=0;for(let S of u)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:u.length,codes:f,max_elapsed_ms:g}),{count:u.length,codes:f,max_elapsed_ms:g}}catch{return null}},I=(s,i,u)=>Ce(s,i,u),K=(s)=>(i,u,f)=>Me("/bin/sh",["-c",`echo $$ > ${be(p(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...u],f),Ce=K(p(r,L)),j=p(r,L,"probe"),W=(s)=>Ve(r,s),Oe=(s)=>{let i=W(s);try{J(i,{mode:493})}catch(u){if(!(u&&typeof u==="object"&&("code"in u)&&u.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},xe=(s)=>{try{pe(W(s))}catch{}},H=e.prespawn?nn({spawnProcess:I,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;H?.arm();let Y=H?setInterval(()=>{H.arm()},Je):null;Y?.unref?.();let q=new Set;async function G(s){let i=d.get(s);if(d.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:W,async startExecutor(s){if(x(),b.set(s.bindId,me()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await G(s.bindId);let{claim:i,bindId:u}=s,f=Oe(u),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,D=new Promise((a,v)=>{h=a,y=v}),A,C=new Promise((a)=>{A=a}),z=et({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(u,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...H?{takePrespawnedWorker:(a)=>{let v=H.take(a);if(!v?.pid)return v;try{return B(p(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:H.adopt}:{}}).then(()=>{A("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),A(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));if(d.set(u,{abort:S,done:z,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0}),q.delete(u))G(u).catch(()=>{return});let M=await D,V=M.executor_launch_id;if(typeof V!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:V,readyData:M,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return d.get(s)?.exited??new Promise(()=>{})},abortExecutor(s){if(!d.has(s)){q.add(s);return}G(s).catch(()=>{return})},freezeBind(s){let i=W(s);if(E(p(i,"cgroup.freeze")))B(p(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){if(s?.bindId)q.delete(s.bindId);let i=new Set(s?.keep??[]);if(await Ie(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&E(p(O,"cgroup.events")))N(),await re(O,Date.now()+ne,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ne;if(E(p(j,"cgroup.events"))){await re(j,s,"probe");try{pe(j)}catch{}}let i=ie(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Xe(r,i,s);let u=(g)=>{let S=ie(g);return S!==null&&S<=i},f=_e(t).filter((g)=>u(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...ge(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,p(r,L)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=he(m).filter((y)=>y!==process.pid&&!c(y)&&!U(y,"/reason-vm-hands")&&!U(y,S)&&!g.some((D)=>te(y,D)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:se(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:se(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(x(),!i.includes(fe))throw new w("vm_hands_probe_failed","probe names no proof directory");let u=e.proofParent??"/tmp/reason-vm-hands-proof";J(u,{mode:457,recursive:!0});let f=ee(u);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=We(p(u,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Te(g,t,t),Le(g,448);let h=ee(g).ino;try{J(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(fe,g).replaceAll(Ee,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]});an();let D="";y.stdout?.on("data",(C)=>{if(D.length<16384)D+=C.toString("utf8").slice(0,16384-D.length)});let A=await new Promise((C)=>{let z=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},Ge);y.once("error",()=>{clearTimeout(z),C(127)}),y.once("close",(M)=>{clearTimeout(z),C(M??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:A}),{exitCode:A,markers:D,proofDirInode:h}}finally{if(!S)ze(g,{recursive:!0,force:!0})}},restatLayout(s){let i=l(s),u=i===e.init.layout.session_root?e.init.layout.alias:p(i,"repo"),f="invalid";try{hi(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=ee(u);S=h.uid,g=f==="0:0:755"&&u===p(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&He(u)===u&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=l(s);try{de(i,o,(u)=>new w("vm_hands_mount_mismatch",u))}catch(u){if(i!==e.init.layout.session_root&&u instanceof w&&u.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw u}},installEnvironment(s,i){let u=d.get(s);if(!u)throw new w("environment_unavailable","no executor owns an environment");return Qe({root:e.root,operationId:u.operationId,payload:i}).installed_revision},async stop(){if(Y)clearInterval(Y);H?.close(),await Promise.all([...d.keys()].map((s)=>G(s)))}};function $e(){try{return X(p(r,L),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function Ie(s,i,u=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=tn();try{await sn();let S=Date.now()+ne,h=new Set($e().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=G(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(E(p(W(a),"cgroup.events")))await re(W(a),S,"bind");await v}let D=[...f].map((a)=>W(a).replace(/^\/sys\/fs\/cgroup/,"")),A=["/",...[r,p(r,L)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),z=(a)=>c(a)||D.some((v)=>U(a,v))||A.some((v)=>te(a,v)),M=u?[]:_e(t).filter((a)=>!z(a));if(M.length)throw o("vm_hands.kill_survivors",{pids:M.slice(0,16),beside:f.size,...ge(M)}),new w("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside a live bind`);let V=(a)=>!z(a)&&!U(a,"/reason-vm-hands")&&!U(a,C)&&!A.some((v)=>te(a,v));if(y!==null){let a=he(y).filter((v)=>v!==process.pid&&V(v));if(a.length)throw o("vm_hands.kill_strays",{strays:se(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),xe(a)}finally{g()}}}function ie(e,r="/proc"){try{let t=k(p(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function Se(e,r="/proc"){try{let t=k(p(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Xe(e,r,t){try{B(p(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=Pe(e).filter((o)=>ke(o,e)),c=new Set(n.filter((o)=>{let l=ie(o);return l!==null&&l<=r}));for(let o=!0;o;){o=!1;for(let l of n){if(c.has(l))continue;let d=Se(l);if(d!==null&&c.has(d))c.add(l),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(p(e,"cgroup.freeze"),"0")}catch{}}}function te(e,r,t="/proc"){try{return k(p(t,String(e),"cgroup"),"utf8").split(`

package/bin/vm-hands/{vm-hands-op-runner-6r390v3d.js → vm-hands-op-runner-nr4ncs4p.js}

@@ -1,2 +1,2 @@
 // @bun
-import{qn,Wn,Wr,Vr,Gr,hl}from"./vm-hands-entry-lite-dfphra23.js";export{qn as VM_HANDS_OP_RUNNER_PERSON_ARG,Wn as VM_HANDS_OP_RUNNER_SURFACE_ARG,Vr as VM_HANDS_SURFACE_DIRECTORY_ARG,Gr as VM_HANDS_SURFACE_OPS,Wr as VM_HANDS_SURFACE_UID_ARG,hl as runVmHandsOpRunner};
+import{qn,Wn,Wr,Vr,Gr,hl}from"./vm-hands-entry-lite-y2vqwds4.js";export{qn as VM_HANDS_OP_RUNNER_PERSON_ARG,Wn as VM_HANDS_OP_RUNNER_SURFACE_ARG,Vr as VM_HANDS_SURFACE_DIRECTORY_ARG,Gr as VM_HANDS_SURFACE_OPS,Wr as VM_HANDS_SURFACE_UID_ARG,hl as runVmHandsOpRunner};

package/bin/vm-hands/vm-hands-runtime-qvy5s122.js

@@ -0,0 +1,4 @@
+// @bun
+import{er}from"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import{Gr}from"./vm-hands-entry-lite-y2vqwds4.js";import{Ta,co,Ia}from"./vm-hands-entry-lite.js";import{spawn as te}from"child_process";import{createHash as re}from"crypto";import{lstatSync as T,mkdirSync as z,readFileSync as X,statSync as J,writeFileSync as q}from"fs";var x="/run/reason-vm-hands",U="/run/reason-vm-hands/env",H="/run/reason-vm-hands/surface",L="/home/runner/.reason/workspace",oe=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,B="/sys/fs/cgroup/reason-srt",se=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],ae=65536,ie=21600000;function ce(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;z(n,{recursive:!0,mode:448});let t=T(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}q(`${n}/base-keyed`,`1
+`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}var de="/run/ara-srt/starts.jsonl",ue=5;function Y(){try{let r=J(de);return`${r.size}:${r.mtimeMs}`}catch{return""}}function j(r,n){let t=(d)=>{n("srt_warm_skipped",{reason:d});let a=Promise.resolve();return{done:a,listening:a}};if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>ae||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let i;try{let d=T(B);if(!d.isDirectory()||d.uid!==0||(d.mode&18)!==0)return t("cgroup_unsafe");let a=se.find((k)=>T(k,{throwIfNoEntry:!1})!==void 0);if(!a)return t("cgroup_or_exec_missing");i=a;for(let[k,N]of[[i,!1],["/usr/local/bin",!0]]){let w=T(k);if((N?!w.isDirectory():!w.isFile())||w.uid!==0||(w.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),m=Y(),_=re("sha256").update(s).digest("hex"),E=`${x}/srt-base-settings.json`;try{q(E,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let y=te("/bin/sh",["-c",`echo $$ > ${B}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",i,"--settings",E,"--idle-ms",String(ie),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"}),S=null,R=new Promise((d)=>{y.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),d()}),y.once("close",(a)=>{n(a===0?"srt_warm_done":"srt_warm_failed",{exit_code:a,warm_ms:Math.round(performance.now()-l),...S!==null?{after_ms:S}:{},settings_sha256:_}),d()})}),g=!1,b=new Promise((d)=>{R.then(()=>{g=!0,d()});let a=()=>{if(g)return;if(Y()!==m){S=Math.round(performance.now()-l),d();return}setTimeout(a,ue)};a()});return{done:R,listening:b}}var G=3000;function Ne(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:i}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&oe.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!i&&typeof i.key_id==="string"&&Number.isSafeInteger(i.expires_at_ms)&&typeof i.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function M(r){z(r,{recursive:!0,mode:448});let n=J(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function le(r){let[{CLI_VERSION:n},t,s,i]=await Promise.all([import("./version-avq09c5d.js"),import("./hands-worker-source-8a4kh44t.js"),import("./network-contract-ht0psj5j.js"),import("./device-workspace-8941tdsy.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-9r62swp0.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:er,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:i.REASON_WORKSPACE_BASE,workspace_layout:i.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var P=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],Q=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],_e=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),pe=60000,fe=30000;function Z(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(P.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:Q.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function ge(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:L,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:Z(t,H)}),i=r.capabilities,l={...i.operation_constraints};for(let _ of P)l[_]={...s.operation_constraints?.[_]??{},ready:!0,execution_mode:s.operation_constraints?.[_]?.execution_mode??"host"};let m=Q.filter((_)=>s.operation_constraints?.[_]!==void 0);for(let _ of m)l[_]=s.operation_constraints[_];return{...r,capabilities:{...i,supported_operations:["hands.connect",...P,...m],operation_constraints:l}}}function we(r){for(let n of X("/etc/passwd","utf8").split(`
+`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function me(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:L,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function ye(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=X(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function Oe(r,n){let t=ye();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});M(x),M(U),M(H),ce(n);let s=j(r,n),i=!1,l=async(e="done")=>{if(!await Promise.race([s[e].then(()=>!0),new Promise((u)=>setTimeout(()=>u(!1),G).unref?.())]))i=!0,n("srt_warm_late",{wait_ms:G})},[{configureDesktopAccount:m},{configureWorkerSandbox:_}]=await Promise.all([import("./desktop-account-d1g1m6yb.js"),import("./worker-sandbox-2trfs79b.js")]);_();try{m({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let E=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>E.abort());let y=new Map,S,R=new Promise((e)=>{S=e}),g=R.then(()=>import("./vm-hands-executor-xd8v5v0e.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:L,runtimeDirectory:x,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{i=!1,s=j(r,n)},srtWarmLate:()=>i,forward:(u,c,h)=>y.get(u)?.(c,h)??Promise.reject(Error("vm_hands_not_bound")),log:(u,c)=>n(u,c)});return n("executor_loaded"),o}),b=(e)=>async(...o)=>(await g)[e](...o),d=null;g.then((e)=>{d=(o)=>e.executorExited(o)});let a={startExecutor:async(...e)=>(await l(),b("startExecutor")(...e)),killAndVerifyPayload:b("killAndVerifyPayload"),killProbe:b("killProbe"),runProbe:async(...e)=>(await l("listening"),b("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>d?d(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};g.then((e)=>{a.restatLayout=(o)=>e.restatLayout(o),a.verifyMounts=(o)=>e.verifyMounts(o),a.installEnvironment=(o,u)=>e.installEnvironment(o,u),a.freezeBind=(o)=>e.freezeBind(o),a.abortExecutor=(o)=>e.abortExecutor(o),a.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let k=await Ta(r),N=new co(r,k,a,{envRoot:U}),w=le(r),f={probing:!0,lanes:{},displayVideo:!1},W=null,K=null,ee=Promise.all([w,import("./local-capabilities-8fgrfpj4.js")]).then(([e,o])=>{K=()=>ge(e,o.capabilityInventoryForRoots,f),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),D,O=(e)=>{clearTimeout(D),f=e,W?.()},v=R.then(()=>import("./vm-hands-executor-xd8v5v0e.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:u})=>e({payloadUid:r.layout.payload_uid,payloadGid:we(r.layout.payload_uid),bindCgroup:(c)=>o(u,c),surfaceDirectory:H,onSurfaceReadiness:(c)=>{if(c)O({probing:!1,lanes:c.lanes??{},displayVideo:c.display_video===!0});else if(f.probing)O({probing:!1,lanes:{},displayVideo:!1})},log:(c,h)=>n(c,h)})).catch(()=>null);v.then((e)=>e?.warm("person")),v.then(async(e)=>{if(!e){O({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+fe;while(N.settingUp&&Date.now()<o)await new Promise((u)=>setTimeout(u,250));D=setTimeout(()=>{if(f.probing)O({probing:!1,lanes:{},displayVideo:!1})},pe),D.unref?.(),e.warm("surface")}),n("agent_ready"),await Ia({apiOrigin:r.api_origin,agent:N,signal:E.signal,heartbeat:async()=>K?.()??await w,onHeartbeatNow:(e)=>{W=e},executeOp:async({kind:e,claim:o,bindId:u,signal:c,emit:h})=>{let A=me(r,o);if(!A)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:x,readiness:{...Object.fromEntries(P.map((p)=>[p,!0])),"tunnel.open":f.lanes["tunnel.open"]===!0,"tunnel.close":f.lanes["tunnel.close"]===!0}},V=(p)=>{let I=typeof p.kind==="string"?p.kind:"";if(I)h({kind:I,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let ne=o.capability==="pty.start"&&e==="person"&&!o.authority;if(_e.has(String(o.capability))&&!ne||o.capability==="ports.list"){let{executeLocalOperation:p}=await import("./local-capabilities-8fgrfpj4.js");return p(A,o,{worker:F,signal:c,emit:(I)=>V(I)})}let C=await v;if(!C)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Gr.has(String(o.capability))){if(f.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return C.run("surface",{id:String(o.attempt_id),claim:o,state:A,worker:Z(f,H)},V,c)}return C.run(e,{id:String(o.attempt_id),claim:o,state:A,worker:F},V,c,u)},controlOp:async({claim:e,control:o})=>Gr.has(String(e.capability))&&((await v)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:u})=>{if(u&&e.capability==="preview.serve.v1")v.then((c)=>c?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")S();n(e,o)},onTurn:(e,o)=>{if(o)y.set(e,o);else y.delete(e)}}),await(await g).stop(),(await v)?.stop()}export{Ne as parseVmHandsInit,Oe as runVmHands};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-x64",
-  "version": "0.2.567",
+  "version": "0.2.568",
   "description": "Reason CLI native binary for linux-x64",
   "os": [
     "linux"

package/bin/vm-hands/connect-cli-jc4m755k.js

@@ -1,2 +0,0 @@
-// @bun
-import{fe,eo,gl,_l,to,yl,wl}from"./vm-hands-entry-lite-298kzt93.js";import"./vm-hands-entry-lite-kankyeep.js";import"./vm-hands-entry-lite-7aeqbfc8.js";import"./vm-hands-entry-lite-n5jyzccm.js";import"./vm-hands-entry-lite-dzdjwa06.js";import"./vm-hands-entry-lite-3r063pb4.js";import"./vm-hands-entry-lite-r131db1f.js";import"./vm-hands-entry-lite-4kb5rq3d.js";import"./vm-hands-entry-lite-rmcdfbkk.js";import"./vm-hands-entry-lite-bqs4pkyb.js";import"./vm-hands-entry-lite-6g9we34r.js";import"./vm-hands-entry-lite-cy8yc9gb.js";import"./vm-hands-entry-lite-bbjsnjct.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-07wr95rz.js";import"./vm-hands-entry-lite-9gn7k5rp.js";import"./vm-hands-entry-lite-3594pdj0.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-b3mfma12.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-vedb5r12.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-zaj1vnnd.js";import"./vm-hands-entry-lite-8twdd0ff.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-ax2w9ywb.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-tv5mcw97.js";import"./vm-hands-entry-lite-crjaacc2.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{eo as computerDisconnected,fe as connectionDirectory,to as connectionReport,yl as restartConnection,wl as restartConnectionWhenIdle,gl as runConnectCli,_l as runDisconnectCli};

package/bin/vm-hands/local-display-video-61peg1pj.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ko,Jo,Xo,Yo,Jt}from"./vm-hands-entry-lite-b3mfma12.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-vedb5r12.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-ax2w9ywb.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-tv5mcw97.js";import"./vm-hands-entry-lite-crjaacc2.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";export{Ko as MAC_SCREEN,Jo as WINDOWS_SCREEN,Xo as createDisplayVideoLane,Jt as localDisplayVideoAvailable,Yo as simulatorVideoFfmpeg};

package/bin/vm-hands/vm-hands-runtime-z9m50n9p.js

@@ -1,4 +0,0 @@
-// @bun
-import{er}from"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import{Gr}from"./vm-hands-entry-lite-dfphra23.js";import{Ta,co,Ia}from"./vm-hands-entry-lite.js";import{spawn as ee}from"child_process";import{createHash as ne}from"crypto";import{lstatSync as N,mkdirSync as j,readFileSync as G,statSync as te,writeFileSync as z}from"fs";var O="/run/reason-vm-hands",W="/run/reason-vm-hands/env",A="/run/reason-vm-hands/surface",V="/home/runner/.reason/workspace",re=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,U="/sys/fs/cgroup/reason-srt",oe=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],se=65536,ae=21600000;function ie(o,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;j(n,{recursive:!0,mode:448});let t=N(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){o("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}z(`${n}/base-keyed`,`1
-`,{mode:420}),o("srt_base_keyed",{})}catch{o("srt_base_keyed_skipped",{reason:"error"})}}function B(o,n){let t=(u)=>(n("srt_warm_skipped",{reason:u}),Promise.resolve());if(typeof o.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(o.srt_base_settings,"base64");if(s.length===0||s.length>se||s.toString("base64")!==o.srt_base_settings)return t("settings_invalid");let a;try{let u=N(U);if(!u.isDirectory()||u.uid!==0||(u.mode&18)!==0)return t("cgroup_unsafe");let f=oe.find((m)=>N(m,{throwIfNoEntry:!1})!==void 0);if(!f)return t("cgroup_or_exec_missing");a=f;for(let[m,S]of[[a,!1],["/usr/local/bin",!0]]){let _=N(m);if((S?!_.isDirectory():!_.isFile())||_.uid!==0||(_.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),y=ne("sha256").update(s).digest("hex"),c=`${O}/srt-base-settings.json`;try{z(c,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let v=ee("/bin/sh",["-c",`echo $$ > ${U}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",a,"--settings",c,"--idle-ms",String(ae),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((u)=>{v.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),u()}),v.once("close",(f)=>{n(f===0?"srt_warm_done":"srt_warm_failed",{exit_code:f,warm_ms:Math.round(performance.now()-l),settings_sha256:y}),u()})})}var Y=3000;function Re(o){if(!o||typeof o!=="object"||Array.isArray(o))return null;let n=o,{layout:t,device_key:s,credential:a}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&re.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!a&&typeof a.key_id==="string"&&Number.isSafeInteger(a.expires_at_ms)&&typeof a.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function D(o){j(o,{recursive:!0,mode:448});let n=te(o);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${o}`)}async function ce(o){let[{CLI_VERSION:n},t,s,a]=await Promise.all([import("./version-41q9twfs.js"),import("./hands-worker-source-8a4kh44t.js"),import("./network-contract-ht0psj5j.js"),import("./device-workspace-8941tdsy.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-9r62swp0.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:er,execution_eligible:!0,instance_generation:o.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:a.REASON_WORKSPACE_BASE,workspace_layout:a.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var I=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],X=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],de=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),ue=60000,le=30000;function J(o,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(I.map((t)=>[t,!0])),...o.lanes},...o.probing?{probing:X.filter((t)=>o.lanes[t]!==!0)}:{},...o.displayVideo?{displayVideo:!0}:{}}}function _e(o,n,t){let s=n([{id:"vm-hands",label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:J(t,A)}),a=o.capabilities,l={...a.operation_constraints};for(let c of I)l[c]={...s.operation_constraints?.[c]??{},ready:!0,execution_mode:s.operation_constraints?.[c]?.execution_mode??"host"};let y=X.filter((c)=>s.operation_constraints?.[c]!==void 0);for(let c of y)l[c]=s.operation_constraints[c];return{...o,capabilities:{...a,supported_operations:["hands.connect",...I,...y],operation_constraints:l}}}function pe(o){for(let n of G("/etc/passwd","utf8").split(`
-`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===o&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function fe(o,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:o.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:V,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function we(o=process.platform,n="/proc/self/oom_score_adj"){if(o!=="linux")return null;let t;try{t=G(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function ke(o,n){let t=we();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});D(O),D(W),D(A),ie(n);let s=B(o,n),a=!1,l=async()=>{if(!await Promise.race([s.then(()=>!0),new Promise((r)=>setTimeout(()=>r(!1),Y).unref?.())]))a=!0,n("srt_warm_late",{wait_ms:Y})},[{configureDesktopAccount:y},{configureWorkerSandbox:c}]=await Promise.all([import("./desktop-account-d1g1m6yb.js"),import("./worker-sandbox-2trfs79b.js")]);c();try{y({value:String(o.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let v=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>v.abort());let u=new Map,f,m=new Promise((e)=>{f=e}),S=m.then(()=>import("./vm-hands-executor-31ea40aw.js")).then(({createVmHandsExecutor:e})=>{let r=e({init:o,root:V,runtimeDirectory:O,apiOrigin:o.api_origin,prespawn:!0,onSrtReset:()=>{a=!1,s=B(o,n)},srtWarmLate:()=>a,forward:(d,i,E)=>u.get(d)?.(i,E)??Promise.reject(Error("vm_hands_not_bound")),log:(d,i)=>n(d,i)});return n("executor_loaded"),r}),_=(e)=>async(...r)=>(await S)[e](...r),x=null;S.then((e)=>{x=(r)=>e.executorExited(r)});let g={startExecutor:async(...e)=>(await l(),_("startExecutor")(...e)),killAndVerifyPayload:_("killAndVerifyPayload"),killProbe:_("killProbe"),runProbe:async(...e)=>(await l(),_("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>x?x(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};S.then((e)=>{g.restatLayout=(r)=>e.restatLayout(r),g.verifyMounts=(r)=>e.verifyMounts(r),g.installEnvironment=(r,d)=>e.installEnvironment(r,d),g.freezeBind=(r)=>e.freezeBind(r),g.abortExecutor=(r)=>e.abortExecutor(r),g.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let q=await Ta(o),C=new co(o,q,g,{envRoot:W}),M=ce(o),w={probing:!0,lanes:{},displayVideo:!1},L=null,K=null,Q=Promise.all([M,import("./local-capabilities-6e0gkrqq.js")]).then(([e,r])=>{K=()=>_e(e,r.capabilityInventoryForRoots,w),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),H,R=(e)=>{clearTimeout(H),w=e,L?.()},b=m.then(()=>import("./vm-hands-executor-31ea40aw.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:r,VM_HANDS_PAYLOAD_CGROUP:d})=>e({payloadUid:o.layout.payload_uid,payloadGid:pe(o.layout.payload_uid),bindCgroup:(i)=>r(d,i),surfaceDirectory:A,onSurfaceReadiness:(i)=>{if(i)R({probing:!1,lanes:i.lanes??{},displayVideo:i.display_video===!0});else if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},log:(i,E)=>n(i,E)})).catch(()=>null);b.then((e)=>e?.warm("person")),b.then(async(e)=>{if(!e){R({probing:!1,lanes:{},displayVideo:!1});return}let r=Date.now()+le;while(C.settingUp&&Date.now()<r)await new Promise((d)=>setTimeout(d,250));H=setTimeout(()=>{if(w.probing)R({probing:!1,lanes:{},displayVideo:!1})},ue),H.unref?.(),e.warm("surface")}),n("agent_ready"),await Ia({apiOrigin:o.api_origin,agent:C,signal:v.signal,heartbeat:async()=>K?.()??await M,onHeartbeatNow:(e)=>{L=e},executeOp:async({kind:e,claim:r,bindId:d,signal:i,emit:E})=>{let k=fe(o,r);if(!k)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:O,readiness:{...Object.fromEntries(I.map((p)=>[p,!0])),"tunnel.open":w.lanes["tunnel.open"]===!0,"tunnel.close":w.lanes["tunnel.close"]===!0}},T=(p)=>{let h=typeof p.kind==="string"?p.kind:"";if(h)E({kind:h,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(r.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(r.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let Z=r.capability==="pty.start"&&e==="person"&&!r.authority;if(de.has(String(r.capability))&&!Z||r.capability==="ports.list"){let{executeLocalOperation:p}=await import("./local-capabilities-6e0gkrqq.js");return p(k,r,{worker:F,signal:i,emit:(h)=>T(h)})}let P=await b;if(!P)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Gr.has(String(r.capability))){if(w.lanes[String(r.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return P.run("surface",{id:String(r.attempt_id),claim:r,state:k,worker:J(w,A)},T,i)}return P.run(e,{id:String(r.attempt_id),claim:r,state:k,worker:F},T,i,d)},controlOp:async({claim:e,control:r})=>Gr.has(String(e.capability))&&((await b)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:r.kind,payload:r.payload??{}}})??!1),opCompleted:({claim:e,status:r,acknowledged:d})=>{if(d&&e.capability==="preview.serve.v1")b.then((i)=>i?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:r}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,r)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")f();n(e,r)},onTurn:(e,r)=>{if(r)u.set(e,r);else u.delete(e)}}),await(await S).stop(),(await b)?.stop()}export{Re as parseVmHandsInit,ke as runVmHands};