@reason-machines/cli-linux-x64 0.2.568 → 0.2.569
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/reason +1 -1
- package/bin/vm-hands/agent-network-wnhby2hh.js +2 -0
- package/bin/vm-hands/{api-credentials-ntpwt7rg.js → api-credentials-5av6jdtt.js} +1 -1
- package/bin/vm-hands/api-j7g5mxg0.js +2 -0
- package/bin/vm-hands/{ask-relay-hfa5kzxn.js → ask-relay-q93yfzy6.js} +2 -2
- package/bin/vm-hands/connect-cli-fn0ek2c4.js +2 -0
- package/bin/vm-hands/{credentials-nfx99zxr.js → credentials-gwh93z0q.js} +1 -1
- package/bin/vm-hands/{custom-endpoint-device-5047vdn3.js → custom-endpoint-device-yvjz40qq.js} +1 -1
- package/bin/vm-hands/{desktop-components-577haqrs.js → desktop-components-gsqad6xm.js} +1 -1
- package/bin/vm-hands/{hands-worker-source-8a4kh44t.js → hands-worker-source-j4yz7x6h.js} +1 -1
- package/bin/vm-hands/{install-receipt-rckwjqmt.js → install-receipt-7hvy0181.js} +1 -1
- package/bin/vm-hands/local-automation-zjrnxdh7.js +2 -0
- package/bin/vm-hands/local-capabilities-ka01z0mb.js +2 -0
- package/bin/vm-hands/local-display-session-vbsgwq8z.js +2 -0
- package/bin/vm-hands/local-display-video-yb4bh3t9.js +2 -0
- package/bin/vm-hands/local-managed-process-52qasdaq.js +2 -0
- package/bin/vm-hands/{local-pty-session-w0yhjdvz.js → local-pty-session-hnxtqd5m.js} +1 -1
- package/bin/vm-hands/{managed-runtime-e4cj6r2s.js → managed-runtime-80xhqysb.js} +1 -1
- package/bin/vm-hands/{network-auto-update-8f2745gk.js → network-auto-update-3036s9xr.js} +2 -2
- package/bin/vm-hands/{network-contract-ht0psj5j.js → network-contract-3jfjnv65.js} +1 -1
- package/bin/vm-hands/{network-sign-in-s00679q9.js → network-sign-in-dx5eg0xz.js} +1 -1
- package/bin/vm-hands/{permissions-74rj58e1.js → permissions-8egc93sd.js} +1 -1
- package/bin/vm-hands/{reason-hands-protocol-9r62swp0.js → reason-hands-protocol-wz7z9pzz.js} +1 -1
- package/bin/vm-hands/{serve-service-19s965ze.js → serve-service-cdfwh6pg.js} +1 -1
- package/bin/vm-hands/{status-099b2ec1.js → status-0td77s7a.js} +6 -6
- package/bin/vm-hands/{version-avq09c5d.js → version-6m3prwm9.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-vvhfaxpd.js → vm-hands-entry-lite-1bdtt81g.js} +3 -3
- package/bin/vm-hands/{vm-hands-entry-lite-9meg54bs.js → vm-hands-entry-lite-2dx59pgq.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-mzw2vcah.js → vm-hands-entry-lite-2zf4bqx9.js} +86 -86
- package/bin/vm-hands/{vm-hands-entry-lite-bcz4qpp6.js → vm-hands-entry-lite-3929hmh0.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-r131db1f.js → vm-hands-entry-lite-39anhpg6.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-mktndd2r.js → vm-hands-entry-lite-5ypg0t3q.js} +14 -14
- package/bin/vm-hands/{vm-hands-entry-lite-1as6h9ed.js → vm-hands-entry-lite-73tecmk2.js} +4 -4
- package/bin/vm-hands/{vm-hands-entry-lite-8s5n4wps.js → vm-hands-entry-lite-7vg80fmc.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-y2vqwds4.js → vm-hands-entry-lite-8tjr2pqm.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-n9277v11.js → vm-hands-entry-lite-9c0g9ykw.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-0xfme8gg.js → vm-hands-entry-lite-a4fn6ye1.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-7jmt3q38.js → vm-hands-entry-lite-bpc8z6p7.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-dhn0fs5e.js → vm-hands-entry-lite-cr3hypam.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-jm9jpj77.js → vm-hands-entry-lite-d7gepm66.js} +11 -11
- package/bin/vm-hands/{vm-hands-entry-lite-vha0pf8k.js → vm-hands-entry-lite-ea3cts1t.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-4kb5rq3d.js → vm-hands-entry-lite-hnsdwskm.js} +3 -3
- package/bin/vm-hands/{vm-hands-entry-lite-3594pdj0.js → vm-hands-entry-lite-htrswrf0.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-bbjsnjct.js → vm-hands-entry-lite-jjv6s3mx.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite-kc8p21xt.js +10 -0
- package/bin/vm-hands/{vm-hands-entry-lite-ezkb7f6j.js → vm-hands-entry-lite-kvxf67qp.js} +7 -7
- package/bin/vm-hands/{vm-hands-entry-lite-1cdtev4n.js → vm-hands-entry-lite-mkvey48j.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-bt6skt4h.js → vm-hands-entry-lite-n31pta3n.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-bc9zq8gx.js → vm-hands-entry-lite-n6q8033g.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-rpf4t8r4.js → vm-hands-entry-lite-nrr68p5x.js} +14 -14
- package/bin/vm-hands/{vm-hands-entry-lite-fp3gaa2c.js → vm-hands-entry-lite-nsaa15dt.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-kzygj0q8.js → vm-hands-entry-lite-p0gtjbkp.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-2qh3rat2.js → vm-hands-entry-lite-qb0tvsw7.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-h5x725z8.js → vm-hands-entry-lite-sqp59sgh.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-ksfd234v.js → vm-hands-entry-lite-x81fqstd.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-8twdd0ff.js → vm-hands-entry-lite-yqzy5wp8.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite.js +2 -2
- package/bin/vm-hands/{vm-hands-executor-xd8v5v0e.js → vm-hands-executor-n3q4gj7p.js} +1 -1
- package/bin/vm-hands/{vm-hands-op-runner-nr4ncs4p.js → vm-hands-op-runner-jtd2nfyk.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-qvy5s122.js → vm-hands-runtime-912jvj9s.js} +3 -3
- package/package.json +1 -1
- package/bin/vm-hands/agent-network-dw7yrrwt.js +0 -2
- package/bin/vm-hands/api-xvjq0bka.js +0 -2
- package/bin/vm-hands/connect-cli-2ja7aj4w.js +0 -2
- package/bin/vm-hands/local-automation-fxdb4ynz.js +0 -2
- package/bin/vm-hands/local-capabilities-8fgrfpj4.js +0 -2
- package/bin/vm-hands/local-display-session-8b2hx1k6.js +0 -2
- package/bin/vm-hands/local-display-video-511qjgmq.js +0 -2
- package/bin/vm-hands/local-managed-process-h0fypn67.js +0 -2
- package/bin/vm-hands/vm-hands-entry-lite-rd7bm9we.js +0 -10
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
var Mn={name:"github-native-engineer-device-worker-production",version:"0.2.
|
|
2
|
+
var Mn={name:"github-native-engineer-device-worker-production",version:"0.2.569",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@agentclientprotocol/sdk":"1.9.0","@anthropic-ai/sandbox-runtime":"^0.0.80","@earendil-works/pi-tui":"1.0.0","@reason/runtime-distribution":"workspace:*",diff:"8.0.4","open-browser-use-sdk":"0.1.42","playwright-core":"1.60.0",toml:"5.0.1",zod:"^4.4.3"},overrides:{"@hono/node-server":"^1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"^1.20.0","basic-ftp":"^6.2.1","@grpc/grpc-js":"^1.14.5",browserslist:"^4.28.8","engine.io":"^6.6.7","fast-uri":"^3.1.8",hono:"^4.13.7","ip-address":"^10.7.4",nanoid:"^3.3.18",dompurify:"^3.4.17",postcss:"^8.5.23",qs:"^6.16.0","shell-quote":"^1.11.0","socket.io-parser":"^4.2.7",tmp:"^0.2.7",toml:"^5.0.1",undici:"^8.10.2",ws:"^8.21.0","js-yaml":"^4.3.2","@modelcontextprotocol/sdk":"^1.31.0","proxy-addr":"^2.0.8","source-map-js":"^1.2.2"}};
|
|
3
3
|
export{Mn};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Xt,yc,le,Sr,Er,A}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Xt,yc,le,Sr,Er,A}from"./vm-hands-entry-lite-2dx59pgq.js";import{ue}from"./vm-hands-entry-lite-t2rhwchw.js";import{Rr}from"./vm-hands-entry-lite-hh0kba1y.js";import{Tr}from"./vm-hands-entry-lite-qb0tvsw7.js";import{Fi}from"./vm-hands-entry-lite-3929hmh0.js";import{Ue,wr,br,Zo}from"./vm-hands-entry-lite-g0bpdyfz.js";import{Kt}from"./vm-hands-entry-lite-x81fqstd.js";import{qr,va}from"./vm-hands-entry-lite-t3k90kdn.js";import{Te,jt}from"./vm-hands-entry-lite-d7gepm66.js";import{de,ze}from"./vm-hands-entry-lite-kvxf67qp.js";import{$r}from"./vm-hands-entry-lite-1bdtt81g.js";import{s}from"./vm-hands-entry-lite-tzv8s0e7.js";import{B}from"./vm-hands-entry-lite-04nx5y4f.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{spawn as S,spawnSync as De}from"child_process";import{createHash as Le,randomUUID as re}from"crypto";import{closeSync as $e,copyFileSync as J,existsSync as C,fstatSync as Be,mkdirSync as z,openSync as We,readdirSync as N,readFileSync as W,readlinkSync as qe,renameSync as ne,rmSync as Fe,statSync as He,writeFileSync as Ge}from"fs";import{connect as je}from"net";import{tmpdir as P,userInfo as ie}from"os";import{basename as V,delimiter as Xe,dirname as M,join as m}from"path";var q=`import { spawn, execFileSync } from "node:child_process";
|
|
3
3
|
import { createHash, randomUUID } from "node:crypto";
|
|
4
4
|
import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
|
|
5
5
|
import { tmpdir } from "node:os";
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{g}from"./vm-hands-entry-lite-
|
|
2
|
+
import{g}from"./vm-hands-entry-lite-9c0g9ykw.js";import{s}from"./vm-hands-entry-lite-tzv8s0e7.js";import{randomUUID as P}from"crypto";import{spawnSync as b}from"child_process";import{chmodSync as z,cpSync as Z,existsSync as x,lstatSync as A,mkdirSync as L,readdirSync as ee,readFileSync as C,readlinkSync as te,realpathSync as T,renameSync as _,rmdirSync as ne,rmSync as y,symlinkSync as D,writeFileSync as re}from"fs";import{dirname as h,join as u,relative as ie,resolve as oe}from"path";var ms="so.ara.cli",w=[ms,"com.reasonmachines.cli"],ji="5LJFSBRY2F";function Hi(e){return`(${e.map((t)=>`identifier "${t}"`).join(" or ")}) and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${ji}"`}var Y="ReasonBackgroundIdentity",Bc="Contents/Helpers/ReasonPermissionTile",se="so.ara.cli.permission-tile",be=Hi([se,"com.reasonmachines.cli.permission-tile"]),k="AraBackgroundIdentity",ce="Reason",Ae=Hi(w),ae=`anchor apple generic and (${w.map((e)=>`identifier "${e}"`).join(" or ")}) and certificate leaf[subject.OU] = "${ji}"`;class St extends Error{code;constructor(e,t){super(t);this.code=e;this.name="MacOSBackgroundIdentityError"}}var Nn="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function st(e=s()){return u(e,"Library","Application Support","Reason","Background","Reason.app")}function O(e=s()){return u(e,"Library","Application Support","Ara","Background","Ara.app")}function ue(e){try{return A(e).isFile()}catch{return!1}}function v(e){return[Y,k].map((t)=>u(e,"Contents","MacOS",t)).find(ue)??null}function d(e){try{if(!A(e).isDirectory())return!1;let t=C(u(e,"Contents","Info.plist"),"utf8");return w.some((n)=>t.includes(`<string>${n}</string>`))&&(t.includes(`<string>${ce}</string>`)||t.includes("<string>Ara</string>"))&&v(e)!==null}catch{return!1}}function Yt(e=s()){let t=st(e);if(!d(t))return null;try{let n=C(u(t,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(n)?.[1]??null}catch{return null}}function gs(e,t=s()){let n=Yt(t);return n===null||V(R(n.split(".")),R(e.split(/[.-]/).slice(0,3)))}var le=1e4;function F(e,t){return b(e,[...t],{stdio:"ignore",timeout:le}).status??1}var G=new Set;function K(e){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let t=(n)=>{try{return T(n)}catch{return oe(n)}};if(e!==void 0&&t(e)!==t(s()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var W=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.(?:ara|reason)(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,H=new Set(["ara","ara.exe","reason","reason.exe"]);function R(e){return e.map((t)=>Number(t))}function V(e,t){for(let n=0;n<3;n+=1)if(e[n]!==t[n])return e[n]<t[n];return!1}var de=[0,2,161];function fe(e){if(e===null)return!0;let t=de,n=null;try{n=T(process.execPath)}catch{}return e.some((r)=>{let i=W.exec(r);if(i){let f=i[1]===void 0?i.slice(4,7):i.slice(1,4);return V(R(f),t)}let o=r.slice(r.lastIndexOf("/")+1);return H.has(o)&&r!==n&&r!==process.execPath})}function pe(){let e=b("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(e.status!==0)return null;let t=[];for(let n of e.stdout.split(`
|
|
3
3
|
`)){let r=/^\s*(\d+)\s+(\S.*)$/.exec(n);if(!r||Number(r[1])===process.pid)continue;let i=r[2].trimEnd(),o=i.slice(i.lastIndexOf("/")+1);if(!W.test(i)&&H.has(o)){let a=b("/usr/sbin/lsof",["-a","-p",r[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
|
|
4
4
|
`).find((l)=>l.startsWith("n/"));if(a)i=a.slice(1)}t.push(i)}return t}function _s(e){if(K(e.home),!d(e.sourceApp))throw new St("identity_invalid","The packaged Reason background identity is missing or invalid.");let t=e.command??F,n=st(e.home),r=h(n);L(r,{recursive:!0,mode:448}),z(r,448);let i=T(e.sourceApp),o=null;try{o=T(n)}catch{}if(i!==o){let f=`${process.pid}.${P()}`,a=u(r,`.Reason.app.${f}.tmp`),l=u(r,`.Reason.app.${f}.old`),m=!1;try{if(Z(i,a,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!d(a))throw new St("identity_invalid","The copied Reason background identity is invalid.");let S=e.releaseSigned?["--test-requirement",`=${ae}`]:[];if(t("/usr/bin/codesign",["--verify","--strict",...S,a])!==0)throw new St("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let I=!1;for(let p=0;p<4;p+=1){let E=!1;try{_(n,l),E=!0,m=!0}catch(c){if(c.code!=="ENOENT")throw c}if(p===0)e.beforePublish?.();try{_(a,n),I=!0}catch(c){let Q=c.code;if(!["EEXIST","ENOTEMPTY"].includes(Q??""))throw c;if(E)y(l,{recursive:!0,force:!0}),m=!1;if(p===3)throw c;continue}if(E)y(l,{recursive:!0,force:!0}),m=!1;break}if(!I)throw Error("Could not publish Reason's background identity.")}catch(S){if(m&&!x(n)&&x(l))_(l,n);throw S}finally{y(a,{recursive:!0,force:!0}),y(l,{recursive:!0,force:!0})}}return q(n,e,{verified:i!==o}),n}function J(e){return u(h(e),".Reason.app.registered")}function j(e){try{let t=A(e);return t.isDirectory()?`${t.ino}:${t.birthtimeMs}`:null}catch{return null}}function N(e){let t=j(e);try{return t!==null&&C(J(e),"utf8")===t}catch{return!1}}function X(e){if(d(e))return"bundle";try{if(A(u(e,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return A(u(e,"Contents","MacOS",k)).isSymbolicLink()?"retired":null}catch{return null}}function q(e,t,n={}){let r=t.command??F;if(!n.verified&&r("/usr/bin/codesign",["--verify","--strict",e])!==0)throw new St("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if(r(Nn,["-f",e])!==0)throw new St("identity_register_failed","Could not register Reason's macOS background identity.");let i=j(e);try{if(i)re(J(e),i,{mode:384})}catch{}try{ge(e,t.home,r,t.runningExecutables??pe)}catch(o){let f=o.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${f})
|
|
5
5
|
`)}}function ge(e,t,n,r){let i=v(e);if(!i)return;let o=O(t),f=h(o),a=(c)=>u(c,"Contents","MacOS",k),l=ie(h(a(o)),i),m=`${process.pid}.${P()}`,S=X(o);if(S===null)return;let I=S==="bundle";if(I)n(Nn,["-u",o]);let p=u(f,`.Ara.app.${m}.old`);if(!G.has(o)&&!fe(r())){if(!I)n(Nn,["-u",o]);try{_(o,p)}catch(c){if(c.code==="ENOENT")return;throw c}y(p,{recursive:!0,force:!0}),ye(f);return}if(!I){if(te(a(o))===l)return;let c=`${a(o)}.${m}`;D(l,c);try{_(c,a(o))}finally{y(c,{force:!0})}return}let E=u(f,`.Ara.app.${m}.shim`);L(h(a(E)),{recursive:!0}),D(l,a(E));try{try{_(o,p)}catch(c){if(c.code==="ENOENT")return;throw c}try{_(E,o)}catch(c){if(x(o))return;throw _(p,o),c}}finally{y(E,{recursive:!0,force:!0}),y(p,{recursive:!0,force:!0})}}function ye(e){try{if(ee(e).some((n)=>n!==".DS_Store"))return;y(u(e,".DS_Store"),{force:!0}),ne(e)}catch{}}var M=new Map;function ys(e=s()){let t=M.get(e);if(t)return t;if(process.platform!=="darwin")return[];let n=B(e);if(n===null&&x(h(st(e))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),n=B(e);if(n===null)return[];return M.set(e,n),n}function B(e){let t=st(e),n=O(e);if(!d(t)||!N(t))try{Ui({home:e,skipWhenSettled:!0})}catch{}let r=d(t)&&(N(t)||!d(n))?t:d(n)?n:null,i=r?v(r):null;if(!i)return null;if(r===n)G.add(n);let o=b(i,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return o.status===0&&o.stdout===`spawn
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{R}from"./vm-hands-entry-lite-ys4jhf7n.js";import{ji,Hi,St,Yt,gs,_s}from"./vm-hands-entry-lite-
|
|
2
|
+
import{R}from"./vm-hands-entry-lite-ys4jhf7n.js";import{ji,Hi,St,Yt,gs,_s}from"./vm-hands-entry-lite-qb0tvsw7.js";import{uc,dc}from"./vm-hands-entry-lite-chve4vmh.js";import{Ii,Di,vn,yr,l,mc,Oi,gc,Sn,Gt,En}from"./vm-hands-entry-lite-sb1xtqxr.js";import{s}from"./vm-hands-entry-lite-tzv8s0e7.js";import{G}from"./vm-hands-entry-lite-04nx5y4f.js";import{randomUUID as L}from"crypto";import{chmodSync as Z,closeSync as J,constants as C,existsSync as S,fstatSync as ke,lstatSync as h,mkdirSync as q,openSync as Ie,readFileSync as K,readdirSync as re,readlinkSync as w,realpathSync as x,renameSync as k,rmSync as T,statSync as V,symlinkSync as Q,unlinkSync as p,writeFileSync as U}from"fs";import{basename as H,dirname as E,isAbsolute as je,join as m,relative as We,resolve as M,sep as me}from"path";import{spawnSync as ee}from"child_process";import{createRequire as Te}from"module";var ae=1,xe=1,Xe=128,Qe=65536,Qc="https://reasonmachines.com/api/runtime-manifest-v2",et=30000,tt=600000,Ee=1e4,nt=60000,rt=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var Me=/^[a-z0-9_.-]{1,80}$/,it=64,at="so.ara.device-broker",Pe=[at,"com.reasonmachines.device-broker"],Ln=Hi(Pe),we=["com.apple.security.cs.allow-jit","com.apple.security.cs.allow-unsigned-executable-memory"],ot=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function W(e){if(e?.aborted)throw new l("update_cancelled","Managed runtime update request was cancelled.")}function fe(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function ge(e,t,n=[]){let r=new Set([...t,...n]);return t.every((i)=>(i in e))&&Object.keys(e).every((i)=>r.has(i))}function b(e){return typeof e==="string"&&rt.test(e)}function De(e){return typeof e==="string"&&!Number.isNaN(Date.parse(e))&&new Date(e).toISOString()===e}function st(e){return yr.includes(e)}function P(e){q(e,{recursive:!0,mode:448}),Z(e,448)}function Oe(e,t){P(E(e));let n=`${e}.${process.pid}.${L()}.tmp`;try{U(n,t,{mode:384,flag:"wx"}),Z(n,384),k(n,e)}finally{if(S(n))p(n)}}function Lt(e={}){if((e.platform??process.platform)!=="darwin")throw new l("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let n=e.environment??process.env,r=R(n,"REASON_CLI_CHANNEL")==="staging",i=r?R(n,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,o=e.root!==void 0||Boolean(i&&je(i))?null:m(e.home??s(),"Library","Application Support"),c=e.root??(o?m(o,r?"Reason Staging":"Reason","CLI"):i);return{executableName:"reason",root:c,...o?{legacyRoot:m(o,"Ara",...r?["staging","runtime"]:["runtime"])}:{},versions:m(c,"versions"),current:m(c,"current"),previous:m(c,"previous"),brokerLock:m(c,"broker.lock"),transitionLock:m(c,"transition.lock"),lifecycleEvents:m(c,"lifecycle-events")}}function bl(e){let t=e.legacyRoot;if(!t)return null;return{root:t,versions:m(t,"versions"),current:m(t,"current"),previous:m(t,"previous"),brokerLock:m(t,"broker.lock"),transitionLock:m(t,"transition.lock"),lifecycleEvents:m(t,"lifecycle-events")}}function F(e,t){if(!b(t))throw new l("invalid_version","Invalid managed Reason runtime version.");let n=m(e.versions,t,"ara");if(!e.executableName)return n;let r=m(e.versions,t,e.executableName),i=(c)=>{try{return h(c),!0}catch(d){if(d.code==="ENOENT")return!1;throw d}},a=i(n),o=i(r);if(a&&o)throw new l("installed_artifact_mismatch","Ambiguous managed runtime executable layout.");return a?n:r}function oe(e,t){if(!b(t))throw new l("invalid_version","Invalid managed Reason runtime version.");return _e(F(e,t))}function _e(e){return m(E(e),H(e)==="reason"?Di:Ii)}function Ce(e,t){if(!b(e)||!b(t))throw new l("invalid_version","Invalid managed Reason runtime version.");let[n,r]=e.split("-",2),[i,a]=t.split("-",2),o=n.split(".").map(Number),c=i.split(".").map(Number);for(let _=0;_<3;_+=1){let g=o[_]-c[_];if(g!==0)return g<0?-1:1}if(r===void 0||a===void 0){if(r===a)return 0;return r===void 0?1:-1}let d=r.split("."),u=a.split("."),f=Math.max(d.length,u.length);for(let _=0;_<f;_+=1){let g=d[_],y=u[_];if(g===void 0||y===void 0){if(g===y)return 0;return g===void 0?-1:1}if(g===y)continue;let v=/^\d+$/.test(g),A=/^\d+$/.test(y);if(v&&A)return Number(g)<Number(y)?-1:1;if(v!==A)return v?-1:1;return g<y?-1:1}return 0}function ct(e=process.arch){let t=`darwin-${e}`;if(!st(t))throw new l("unsupported_architecture","The managed Reason runtime supports only Apple Silicon and Intel Macs.");return t}function Re(e){return[...e.matchAll(/<key>\s*([^<]+?)\s*<\/key>/g)].map((t)=>t[1].trim())}function pe(e){let t=e.match(/^CodeDirectory .*$/gm)??[];return t.length>0&&t.every((n)=>(/ flags=0x[0-9a-f]+\(([^)]*)\)(?: |$)/.exec(n)?.[1]?.split(/[ ,]+/).filter(Boolean)??[]).includes("runtime"))}function lt(e){let t=`TeamIdentifier=${ji}`,n=Pe.map((a)=>`Identifier=${a}`),r=Re(e.brokerEntitlements),i=Re(e.credentialLibraryEntitlements);if(!e.brokerDetail.split(`
|
|
3
3
|
`).includes(t)||!e.brokerDetail.split(`
|
|
4
4
|
`).some((a)=>n.includes(a))||!pe(e.brokerDetail)||r.length!==we.length||we.some((a)=>!new RegExp(`<key>\\s*${a.replaceAll(".","\\.")}\\s*</key>\\s*<true\\s*/>`).test(e.brokerEntitlements)))throw new l("invalid_code_signature","Managed runtime broker has an invalid Reason signature, identifier, or entitlement set.");if(!e.credentialLibraryDetail.split(`
|
|
5
5
|
`).includes(t)||!pe(e.credentialLibraryDetail)||i.length!==0)throw new l("invalid_code_signature","Managed runtime credential library has an invalid signature or entitlement.")}function D(e,t){let n=ee("/usr/bin/codesign",e,{stdio:["ignore","pipe","pipe"]});if(n.status!==0)throw new l("invalid_code_signature",t);return[new TextDecoder().decode(n.stdout??new Uint8Array),new TextDecoder().decode(n.stderr??new Uint8Array)].join("")}var ye=(e,t)=>{D(["--verify","--strict","--verbose=2",e],"Managed runtime broker code signature is invalid."),D(["--verify","--strict","--verbose=2",t],"Managed runtime credential library code signature is invalid."),lt({brokerDetail:D(["-d","--verbose=4",e],"Managed runtime broker signer could not be inspected."),brokerEntitlements:D(["-d","--entitlements",":-",e],"Managed runtime broker entitlements could not be inspected."),credentialLibraryDetail:D(["-d","--verbose=4",t],"Managed runtime credential library signer could not be inspected."),credentialLibraryEntitlements:D(["-d","--entitlements",":-",t],"Managed runtime credential library entitlements could not be inspected.")})};async function dt(e,t,n){let r=e.headers.get("content-length");if(r!==null){let f=Number(r);if(!Number.isSafeInteger(f)||f<0||f>t)throw new l("response_too_large","Managed runtime response exceeded its size limit.")}if(!e.body){let f=new Uint8Array(await e.arrayBuffer());if(f.byteLength>t)throw new l("response_too_large","Managed runtime response exceeded its size limit.");return f}let i=e.body.getReader(),a=[],o=0,c=()=>{if(!n)return i.read();return new Promise((f,_)=>{let g=()=>{n.removeEventListener("abort",g),i.cancel(n.reason).catch(()=>{}),_(n.reason??new DOMException("Aborted","AbortError"))};if(n.aborted){g();return}n.addEventListener("abort",g,{once:!0}),i.read().then((y)=>{n.removeEventListener("abort",g),f(y)},(y)=>{n.removeEventListener("abort",g),_(y)})})};try{while(!0){let f=await c();if(f.done)break;if(o+=f.value.byteLength,o>t)throw await i.cancel(),new l("response_too_large","Managed runtime response exceeded its size limit.");a.push(f.value)}}finally{try{i.releaseLock()}catch{}}let d=new Uint8Array(o),u=0;for(let f of a)d.set(f,u),u+=f.byteLength;return d}async function Yr(e){let t;try{t=new URL(e.url)}catch{throw new l("invalid_update_url","Managed runtime update URL is invalid.")}if(t.protocol!=="https:"||t.username||t.password||t.hash)throw new l("invalid_update_url","Managed runtime update URL must use HTTPS.");let n=new AbortController,r,i=()=>{r??="caller",n.abort(e.signal?.reason)};if(e.signal?.aborted)i();else e.signal?.addEventListener("abort",i,{once:!0});let a=setTimeout(()=>{r??="timeout",n.abort(Error("managed runtime fetch timed out"))},e.timeoutMs),o=(c,d)=>{if(c instanceof l)return c;if(r==="caller")return new l("update_cancelled","Managed runtime update request was cancelled.");if(r==="timeout")return new l("update_fetch_timeout","Managed runtime update request timed out.");return new l("update_fetch_failed",d)};try{let c;try{if(c=await e.fetchImpl(t,{headers:{accept:e.accept},signal:n.signal}),n.signal.aborted)throw o(n.signal.reason,"Managed runtime update request was cancelled.")}catch(d){throw o(d,"Managed runtime update request failed.")}if(!c.ok)throw new l("update_http_error","Managed runtime update request was rejected.");if(c.url&&new URL(c.url).protocol!=="https:")throw new l("insecure_redirect","Managed runtime update redirected to an insecure URL.");try{let d=await dt(c,e.maximumBytes,n.signal);if(n.signal.aborted)throw o(n.signal.reason,"Managed runtime update response was cancelled.");return d}catch(d){throw o(d,"Managed runtime update response failed.")}}finally{clearTimeout(a),e.signal?.removeEventListener("abort",i)}}async function Ve(e,t,n=Ee,r){let i=typeof n==="number"?n:Ee,a=typeof n==="number"?r:n;if(a?.aborted)return!1;let o=await uc([e,"--version"],{timeoutMs:i,...a?{signal:a}:{}});return o.exitCode===0&&o.stdout.trim().replace(/^v/,"")===t}async function ut(e){let t=!1,n=null,r=null,i=(a)=>{try{N(e.paths,a,{now:e.now})}catch{}};try{let a=e.home??s();if(!gs(e.manifest.version,a))return{status:"current"};r=Yt(a);let o=await Yr({url:new URL(mc,e.manifest.artifacts[e.target].broker.url).toString(),maximumBytes:vn,fetchImpl:async(g,y)=>{let v=await e.fetchImpl(g,y);return t=v.status===404,v},timeoutMs:e.timeoutMs,accept:"application/json",signal:e.signal}),{manifest:c}=gc(new TextDecoder().decode(o),e.trustedKeys);if(c.version!==e.manifest.version||c.published_at!==e.manifest.published_at)throw new l("identity_manifest_mismatch","Background identity manifest names another release.");let d=c.artifacts[e.target],u=await Yr({url:d.url,maximumBytes:d.size_bytes,fetchImpl:e.fetchImpl,timeoutMs:e.timeoutMs,accept:"application/octet-stream",signal:e.signal});Gt(u,d),P(e.workDirectory),n=m(e.workDirectory,`.identity-${process.pid}-${L()}`),q(n,{mode:448});let f=m(n,"identity.tgz");if(U(f,u,{mode:384,flag:"wx"}),ee("/usr/bin/tar",["-xzf",f,"-C",n],{stdio:"ignore",timeout:60000}).status!==0)throw new l("identity_extract_failed","Background identity archive could not be extracted.");return _s({sourceApp:m(n,"Reason.app"),home:a,releaseSigned:!0,...e.command?{command:e.command}:{}}),i({event:"identity.refresh_completed",runtime_version:e.manifest.version,...r?{from_version:r}:{},to_version:e.manifest.version}),{status:"installed"}}catch(a){if(t)return{status:"unpublished"};let o=a instanceof l||a instanceof St?a.code:"identity_install_failed";return process.stderr.write(`Reason background identity: identity_update_failed (${o})
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{D,On,ps,Pr,hs,fs}from"./vm-hands-entry-lite-hh0kba1y.js";import{wc,bc,A,Qo}from"./vm-hands-entry-lite-
|
|
2
|
+
import{D,On,ps,Pr,hs,fs}from"./vm-hands-entry-lite-hh0kba1y.js";import{wc,bc,A,Qo}from"./vm-hands-entry-lite-2dx59pgq.js";import{Ue}from"./vm-hands-entry-lite-g0bpdyfz.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{execFile as xt,spawn as _e}from"child_process";import{existsSync as vt}from"fs";import{connect as Et}from"net";function dt(){let e=new Set,t=null,s=(n)=>({holder:t?.viewer??null,you:t===n,same_user:Boolean(t?.viewer&&n.viewer&&t.viewer.user_id===n.viewer.user_id)}),i=()=>{for(let n of e)n.notify(s(n))};return{join(n){return e.add(n),n.notify(s(n)),()=>{if(!e.delete(n))return;if(t!==n)return;t=null,i()}},claim(n){if(t===n||!e.has(n))return;t=n,i()}}}var Ce=dt();import{spawn as pt}from"child_process";import{existsSync as ft}from"fs";import{connect as mt}from"net";import{join as j}from"path";var ze="reason_desktop",N={sampleRate:48000,channels:2,codec:"opus"},ht=5000,yt=107,gt=262144,Go=(e)=>j(e,"native"),Kt=(e)=>`unix:${e}`;function he(e,t=1000){if(!ft(e))return Promise.resolve(!1);return new Promise((s)=>{let i=mt({path:e}),n=(l)=>{i.destroy(),s(l)};i.setTimeout(t,()=>n(!1)),i.once("error",()=>n(!1)),i.once("close",()=>n(!1)),i.once("connect",()=>n(!0))})}async function _c(e,t){if(!t)return null;let s=Go(e);if(Buffer.byteLength(s)>yt||/["'\\\s]/.test(s))return null;try{if(await he(s))return s;let i=pt(t,["--daemonize=no","--system=no","--use-pid-file=no","--exit-idle-time=-1","--disallow-exit=yes","--realtime=no","--high-priority=no","--disallow-module-loading=yes","--log-level=warning",`--log-target=file:${j(e,"pulseaudio.log")}`,"-n",`--load=module-native-protocol-unix socket="${s}" auth-anonymous=1 auth-cookie-enabled=0`,`--load=module-null-sink sink_name=${ze} rate=${N.sampleRate} channels=${N.channels} sink_properties=device.description=Reason_desktop`],{detached:!0,stdio:"ignore",env:{HOME:e,PATH:"/usr/bin:/bin",XDG_RUNTIME_DIR:e,PULSE_RUNTIME_PATH:j(e,"runtime"),PULSE_STATE_PATH:j(e,"state")}});Ue(i.pid);let n=!1;i.once("error",()=>{n=!0}),i.once("exit",()=>{n=!0}),i.unref();let l=Date.now()+ht;while(Date.now()<l){if(await he(s))return s;if(n)return await he(s)?s:null;await new Promise((c)=>setTimeout(c,50))}if(!n)i.kill("SIGKILL");return null}catch{return null}}function Oe(){let{sampleRate:e,channels:t}=N;return["-hide_banner","-loglevel","error","-nostdin","-fflags","nobuffer","-f","pulse","-sample_rate",String(e),"-channels",String(t),"-fragment_size",String(e*t*2/50),"-i",`${ze}.monitor`,"-vn","-ac",String(t),"-ar",String(e),"-c:a","libopus","-b:a","64k","-application","lowdelay","-frame_duration","20","-flush_packets","1","-page_duration","20000","-f","ogg","pipe:1"]}var bt=[79,103,103,83],wt=Buffer.from("OpusHead"),_t=Buffer.from("OpusTags"),Be=(e,t)=>e.byteLength>=t.byteLength&&t.every((s,i)=>e[i]===s);class ye extends Error{constructor(e){super(e);this.name="OggProtocolError"}}class ge{buffer=new Uint8Array(0);partial=[];partialBytes=0;push(e){let t=new Uint8Array(this.buffer.byteLength+e.byteLength);t.set(this.buffer),t.set(e,this.buffer.byteLength);let s=[],i=0;while(t.byteLength-i>=27){if(bt.some((b,f)=>t[i+f]!==b)||t[i+4]!==0)throw new ye("invalid_page");let n=(t[i+5]&1)!==0,l=t[i+26];if(t.byteLength-i<27+l)break;let c=t.subarray(i+27,i+27+l),h=c.reduce((b,f)=>b+f,0),g=27+l+h;if(t.byteLength-i<g)break;if(!n&&this.partialBytes>0)this.resetPartial();let m=n&&this.partialBytes===0,p=i+27+l,w=p;for(let b of c){if(p+=b,b===255)continue;if(this.appendPartial(t.subarray(w,p),m),w=p,!m){let f=this.takePartial();if(f.byteLength>0&&!Be(f,wt)&&!Be(f,_t))s.push(f)}m=!1,this.resetPartial()}if(w<p)this.appendPartial(t.subarray(w,p),m);i+=g}return this.buffer=t.slice(i),s}appendPartial(e,t){if(t||e.byteLength===0)return;if(this.partialBytes+=e.byteLength,this.partialBytes>gt)throw new ye("packet_too_large");this.partial.push(e.slice())}takePartial(){if(this.partial.length===1)return this.partial[0];let e=new Uint8Array(this.partialBytes),t=0;for(let s of this.partial)e.set(s,t),t+=s.byteLength;return e}resetPartial(){this.partial=[],this.partialBytes=0}}import{spawn as kt}from"child_process";var Ve=1048576,St=String.raw`
|
|
3
3
|
import gi, json, os, sys
|
|
4
4
|
gi.require_version("Gtk", "3.0")
|
|
5
5
|
from gi.repository import Gtk, Gdk, GLib
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{xr,w}from"./vm-hands-entry-lite-
|
|
2
|
+
import{xr,w}from"./vm-hands-entry-lite-a4fn6ye1.js";import{De}from"./vm-hands-entry-lite-peyr9y6z.js";import{chmodSync as Y,existsSync as R,mkdirSync as X,readlinkSync as C,readFileSync as S,renameSync as Q,unlinkSync as Z,writeFileSync as nn}from"fs";import{homedir as u}from"os";import{basename as _,dirname as h,isAbsolute as p,join as o,normalize as b,relative as A,resolve as O}from"path";var c=3,N=1,P=2,D=1,x=1,T="Reason may read and write files and run commands in this signed-in OS account, subject to saved restrictions and operating system permissions.",ol="Reason may later execute on this computer inside a Reason sandbox, limited to folders explicitly attached by the user.",L=[ol,"Ara may later execute on this computer inside an Ara sandbox, limited to folders explicitly attached by the user."];function M(n){return typeof n==="string"&&L.includes(n)}var F=["future_device","updates_only","cli_only"];function f(n){return typeof n==="string"&&F.some((t)=>t===n)}function B(n=process.env,t=u()){return n.XDG_CONFIG_HOME?.trim()||o(t,".config")}function ot(n=process.env,t=u()){let r=w({env:n}),e=B(n,t);return o(e,De(e).state==="kept"?"ara":"reason",...r==="staging"?["staging"]:[],"installation.json")}function a(n){return typeof n==="string"&&n.trim().length>0}var U=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;function V(n){return typeof n==="string"&&U.test(n)}function l(n){return a(n)&&p(n)&&b(n)===n}function y(n){if(!n||typeof n!=="object"||Array.isArray(n))return!1;let t=n;return l(t.path)&&(t.role==="launcher"&&(t.kind==="file"||t.kind==="symlink")||t.role==="worker_root"&&t.kind==="directory"||t.role==="alias"&&t.kind==="symlink"&&l(t.target))}function vc(n){return n==="staging"?["reason-staging","ara-staging"]:["reason","ara"]}var Pl=["reason","ara"];function cs(n){let t=n.owned_paths.filter((e)=>e.role==="launcher").map((e)=>e.path),[r]=vc(n.channel);return t.find((e)=>_(e)===r)??t[0]??null}function g(n){let[t,r]=vc(n.channel==="staging"?"staging":"production"),e=[[t,r],[r,t]];return n.owned_paths?.every((i)=>i.role!=="alias"||n.installer==="shell"&&e.some(([s,v])=>i.path===o(n.install_dir,s)&&i.target===o(n.install_dir,v))&&n.owned_paths?.some((s)=>s.role==="launcher"&&s.path===i.target))??!1}function d(n,t){try{return O(h(n),C(n))===t}catch{return!1}}function Mi(n){let t=_(n),r=t==="ara"?"reason":t==="ara-staging"?"reason-staging":null;if(!r)return n;let e=o(h(n),r);return d(e,n)||d(n,e)?e:n}function m(n,t){let r=A(n,t);return r.length>0&&!r.startsWith("..")&&!p(r)}function I(n){if(n===null)return!0;if(!n||typeof n!=="object"||Array.isArray(n))return!1;let t=n;return(t.kind==="shell_profile"||t.kind==="windows_user_path")&&a(t.location)&&a(t.value)&&(typeof t.added_by_installer==="boolean"||typeof t.added_by_ara==="boolean")&&(t.added_by_installer===void 0||typeof t.added_by_installer==="boolean")&&(t.added_by_ara===void 0||typeof t.added_by_ara==="boolean")}function E(n,t){if(t===null)return n==="cli_only";if(!t||typeof t!=="object"||Array.isArray(t))return!1;let r=t;if(r.version!==D||!a(r.recorded_at))return!1;if(n==="future_device")return r.decision==="authorized"&&M(r.scope);return r.scope===null&&r.decision===(n==="updates_only"?"ask":"disabled")}function K(n){if(!n||typeof n!=="object"||Array.isArray(n))return null;let t=n;if(t.schema_version!==N||!xr.includes(t.channel)||t.install_method!=="curl"||t.installer!=="shell"&&t.installer!=="powershell"||!a(t.installed_at)||!a(t.version)||!a(t.target)||!l(t.install_dir)||!Array.isArray(t.owned_paths)||!t.owned_paths.every(y)||!t.owned_paths.every((r)=>m(t.install_dir,r.path))||!g(t)||!I(t.path_entry))return null;return{...t,schema_version:c,installation_id:null,background_mode:"cli_only",device_consent:null}}function z(n){if(!n||typeof n!=="object"||Array.isArray(n))return null;let t=n;if(t.schema_version!==P||!k(t)||!f(t.background_mode)||!E(t.background_mode,t.device_consent))return null;return{...t,schema_version:c,installation_id:null}}function k(n){return xr.includes(n.channel)&&(n.install_method==="curl"&&(n.installer==="shell"||n.installer==="powershell")||n.install_method==="desktop"&&n.installer==="desktop"&&Array.isArray(n.owned_paths)&&n.owned_paths.length===0&&n.path_entry===null)&&a(n.installed_at)&&a(n.version)&&a(n.target)&&l(n.install_dir)&&Array.isArray(n.owned_paths)&&n.owned_paths.every(y)&&n.owned_paths.every((t)=>m(n.install_dir,t.path))&&g(n)&&I(n.path_entry)}function G(n){let t=K(n);if(t)return t;let r=z(n);if(r)return r;if(!n||typeof n!=="object"||Array.isArray(n))return null;let e=n;if(e.schema_version!==c||!V(e.installation_id)||!k(e)||!f(e.background_mode)||!E(e.background_mode,e.device_consent)||e.desktop_account_access!==void 0&&(e.desktop_account_access===null||typeof e.desktop_account_access!=="object"||Array.isArray(e.desktop_account_access)||e.desktop_account_access.version!==x||e.desktop_account_access.scope!==T||!a(e.desktop_account_access.recorded_at)||!Number.isFinite(Date.parse(e.desktop_account_access.recorded_at))))return null;return e}function We(n=ot()){if(!R(n))return null;try{return G(JSON.parse(S(n,"utf8")))}catch{return null}}export{ol,ot,vc,Pl,cs,Mi,We};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{At,Lr,Cs,As,Ps,Mr}from"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import{createHash as K,randomBytes as ge}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Qe,openSync as Oe,renameSync as Ze,rmSync as en,statSync as De,writeSync as Me,constants as H}from"fs";import{join as re}from"path";var nn=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:tn(e)}}function tn(e){let n=e.payload[Cs];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var W=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),V=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function L(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(L).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${L(e[n])}`).join(",")}}`}async function Ta(e){let n=await crypto.subtle.importKey("pkcs8",V(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=V(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),g=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),h=K("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:g,fingerprint:h}}var sn=16;class co{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;abandoned=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let g=this.bound.get(e);if(!g)return!1;if(g.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((h)=>setTimeout(h,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:nn,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:W(this.keys.signingSpki),env_public_key:W(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:W(ge(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(L(n)));return{...n,device_signature:W(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=W(ge(32)),g=Mr({method:"GET",pathAndQuery:At,timestamp:i,nonce:s,challenge:e,bodySha256:K("sha256").update("").digest("hex")}),h=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(g)));return{t:"hello",timestamp:i,nonce:s,signature:W(rn(h)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let s of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(s))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(K("sha256").update(L({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((s)=>s.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=sn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((s)=>s.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let s,g,h=new Promise((m,S)=>{s=m,g=S});return h.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:h,resolve:s,reject:g}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(w){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(w,"the bind's kill-verify failed")}let i,s=new Promise((w)=>{i=w}),g=!1,h=!1,m=()=>{h=!0,i()},S=n.promise.then(()=>new Promise((w,I)=>{this.exclusive(async()=>{if(h){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}g=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();w()}catch(b){I(b)}await s})}));S.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:S,inTurn:()=>g,leave:m})}finally{m()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);if(this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","abandoned before its launch");s=!0;let{launchId:g,applied:h,readyData:m}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),S=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let w=null,I=null;if(e.env){let b=e.claim?.owner??{},R=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof b.device_id==="string"?b.device_id:"",rootId:e.claim?.root_id??""});w=this.hooks.installEnvironment(e.bind_id,R),I=typeof R.snapshot_id==="string"&&R.snapshot_id?R.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,R)}if(this.unbinding.has(e.bind_id)||this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:g,envInstalled:w!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:g,snapshot_revision:w,snapshot_id:I,layout:S,...m?{ready_data:m}:{},policy_digest:K("sha256").update(L({hands_confinement:h.hands_confinement??null,browser_egress:h.browser_egress??null})).digest("hex")}}catch(g){if(i)fe(i);if(s){let h=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(h);else await h()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(g,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}abandonBinding(e){if(!this.binding.has(e))return;this.abandoned.add(e),this.abandonWorkspaceGrant(e);try{this.hooks.abortExecutor?.(e)}catch{}}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),g=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${g}`,s),{snapshot_id:e.snapshotId,installed_revision:g,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:K("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(g){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw g}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",V(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),g=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),h=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(e.iv),additionalData:new TextEncoder().encode(n)},g,V(e.ct)).catch(i),m=JSON.parse(new TextDecoder().decode(h));if(!m||typeof m!=="object"||Array.isArray(m))throw new l("vm_hands_env_invalid","env not an object");return m}writeJobEnvRootOnly(e,n){let i=re(this.options.envRoot,`bind-${e}`);Qe(i,{mode:448});let s=De(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let g=n.variables&&typeof n.variables==="object"?n.variables:{},h=Object.entries(g).filter(([w,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(w)&&typeof I==="string").map(([w,I])=>`export ${w}='${String(I).replaceAll("'","'\\''")}'`).join(`
|
|
2
|
+
import{At,Lr,Cs,As,Ps,Mr}from"./vm-hands-entry-lite-1bdtt81g.js";import"./vm-hands-entry-lite-mkvey48j.js";import{createHash as K,randomBytes as ge}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Qe,openSync as Oe,renameSync as Ze,rmSync as en,statSync as De,writeSync as Me,constants as H}from"fs";import{join as re}from"path";var nn=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:tn(e)}}function tn(e){let n=e.payload[Cs];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var W=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),V=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function L(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(L).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${L(e[n])}`).join(",")}}`}async function Ta(e){let n=await crypto.subtle.importKey("pkcs8",V(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=V(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),g=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),h=K("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:g,fingerprint:h}}var sn=16;class co{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;abandoned=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let g=this.bound.get(e);if(!g)return!1;if(g.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((h)=>setTimeout(h,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:nn,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:W(this.keys.signingSpki),env_public_key:W(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:W(ge(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(L(n)));return{...n,device_signature:W(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=W(ge(32)),g=Mr({method:"GET",pathAndQuery:At,timestamp:i,nonce:s,challenge:e,bodySha256:K("sha256").update("").digest("hex")}),h=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(g)));return{t:"hello",timestamp:i,nonce:s,signature:W(rn(h)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let s of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(s))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(K("sha256").update(L({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((s)=>s.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=sn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((s)=>s.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let s,g,h=new Promise((m,S)=>{s=m,g=S});return h.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:h,resolve:s,reject:g}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(w){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(w,"the bind's kill-verify failed")}let i,s=new Promise((w)=>{i=w}),g=!1,h=!1,m=()=>{h=!0,i()},S=n.promise.then(()=>new Promise((w,I)=>{this.exclusive(async()=>{if(h){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}g=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();w()}catch(b){I(b)}await s})}));S.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:S,inTurn:()=>g,leave:m})}finally{m()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);if(this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","abandoned before its launch");s=!0;let{launchId:g,applied:h,readyData:m}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),S=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let w=null,I=null;if(e.env){let b=e.claim?.owner??{},R=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof b.device_id==="string"?b.device_id:"",rootId:e.claim?.root_id??""});w=this.hooks.installEnvironment(e.bind_id,R),I=typeof R.snapshot_id==="string"&&R.snapshot_id?R.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,R)}if(this.unbinding.has(e.bind_id)||this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:g,envInstalled:w!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:g,snapshot_revision:w,snapshot_id:I,layout:S,...m?{ready_data:m}:{},policy_digest:K("sha256").update(L({hands_confinement:h.hands_confinement??null,browser_egress:h.browser_egress??null})).digest("hex")}}catch(g){if(i)fe(i);if(s){let h=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(h);else await h()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(g,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}abandonBinding(e){if(!this.binding.has(e))return;this.abandoned.add(e),this.abandonWorkspaceGrant(e);try{this.hooks.abortExecutor?.(e)}catch{}}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),g=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${g}`,s),{snapshot_id:e.snapshotId,installed_revision:g,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:K("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(g){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw g}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",V(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),g=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),h=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(e.iv),additionalData:new TextEncoder().encode(n)},g,V(e.ct)).catch(i),m=JSON.parse(new TextDecoder().decode(h));if(!m||typeof m!=="object"||Array.isArray(m))throw new l("vm_hands_env_invalid","env not an object");return m}writeJobEnvRootOnly(e,n){let i=re(this.options.envRoot,`bind-${e}`);Qe(i,{mode:448});let s=De(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let g=n.variables&&typeof n.variables==="object"?n.variables:{},h=Object.entries(g).filter(([w,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(w)&&typeof I==="string").map(([w,I])=>`export ${w}='${String(I).replaceAll("'","'\\''")}'`).join(`
|
|
3
3
|
`)+`
|
|
4
|
-
`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),pn=3,vn=20000,wn=250,bn=2000;function je(e){let n=Math.min(wn*2**(e-1),bn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function kn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var Sn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function In(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function Pn(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function En(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Tn=1e4,Rn=1000;async function Ia(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await An(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<pn&&Date.now()-n<vn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function An(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,Rn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Tn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=Sn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await Pn(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+yn,q=1,M=await f("hands.ready",se);while(kn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===As){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===Lr)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?En(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(Ps,{code:o}).catch(()=>{return}),In(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as On}from"fs";var xn=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Dn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-nr4ncs4p.js");await h();return}z("parsed",{t0:Math.round(xn)});let e="";try{e=On(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-qvy5s122.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Dn();export{Ta,co,Ia};
|
|
4
|
+
`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),pn=3,vn=20000,wn=250,bn=2000;function je(e){let n=Math.min(wn*2**(e-1),bn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function kn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var Sn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function In(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function Pn(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function En(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Tn=1e4,Rn=1000;async function Ia(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await An(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<pn&&Date.now()-n<vn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function An(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,Rn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Tn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=Sn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await Pn(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+yn,q=1,M=await f("hands.ready",se);while(kn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===As){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===Lr)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?En(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(Ps,{code:o}).catch(()=>{return}),In(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as On}from"fs";var xn=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Dn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-jtd2nfyk.js");await h();return}z("parsed",{t0:Math.round(xn)});let e="";try{e=On(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-912jvj9s.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Dn();export{Ta,co,Ia};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import"./vm-hands-entry-lite-
|
|
2
|
+
import"./vm-hands-entry-lite-1bdtt81g.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-n6q8033g.js";import"./vm-hands-entry-lite-h7f5a5mb.js";import{Qe,nn,hi,an,et}from"./vm-hands-entry-lite-5ypg0t3q.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-jjv6s3mx.js";import"./vm-hands-entry-lite-mkvey48j.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-a4fn6ye1.js";import"./vm-hands-entry-lite-73tecmk2.js";import"./vm-hands-entry-lite-dh87ysh2.js";import{qn,Wn,Wr,Vr}from"./vm-hands-entry-lite-8tjr2pqm.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-04nx5y4f.js";import{spawn as Me}from"child_process";import{chmodSync as Le,chownSync as Te,existsSync as E,lstatSync as ee,mkdirSync as J,mkdtempSync as We,readdirSync as X,readFileSync as k,realpathSync as He,rmdirSync as pe,rmSync as ze,writeFileSync as B}from"fs";import{basename as Ue,dirname as Be,join as p}from"path";import{readFileSync as ae,readlinkSync as ce}from"fs";import{relative as Ne}from"path";var ue=16;function le(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function De(e){let r=[];for(let t of e.split(`
|
|
3
3
|
`)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:le(n[3]),mountPoint:le(n[4])})}return r}function Ae(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(De(m).filter((_)=>c(_.mountPoint)).map((_)=>[`${_.mountPoint}\x00${_.device}\x00${_.root}`,_.mountPoint])),l=o(r),d=o(t),b=(m)=>Ne(n,m)||".",R=[...l].filter(([m])=>!d.has(m)).map(([,m])=>b(m)),N=[...d].filter(([m])=>!l.has(m)).map(([,m])=>b(m));return{missing:R,extra:N,referenceCount:l.size,ownCount:d.size}}function de(e,r,t,n="/proc"){let c,o,l=null;try{c=ae(`${n}/1/mountinfo`,"utf8"),o=ae(`${n}/self/mountinfo`,"utf8")}catch(_){let O=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{l=ce(`${n}/1/ns/mnt`)===ce(`${n}/self/ns/mnt`)}catch{}let{missing:d,extra:b,referenceCount:R,ownCount:N}=Ae(e,c,o),m={reference_count:R,own_count:N,missing_count:d.length,extra_count:b.length,same_namespace:l};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ue)});if(d.length)throw r("vm_hands.mount_mismatch",{...m,missing:d.slice(0,ue)}),t(`${d.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var ve="/sys/fs/cgroup/reason-payload",L="vm-hands",Fe="/run/ara-srt/fallbacks.jsonl",oe="/reason-person",Ke="/reason-workload",je="surface",ne=5000,Ge=1e4,fe="__VM_HANDS_PROOF_DIR__",Ee="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,r){super(r);this.code=e}}function Ve(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new w("vm_hands_bind_invalid","bad bind id");return p(e,L,`b-${r.toLowerCase()}`)}var Je=5000,be=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Ze(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=p(Be(e),r.toLowerCase());return Ue(e).toLowerCase()===r.toLowerCase()?e:t}function wn(e){let r=e.cgroup??ve,t=e.init.layout.payload_uid,n=e.init.workload_ended!==!0,c=(s)=>U(s,oe)||n&&U(s,Ke),o=e.log??(()=>{}),l=(s)=>Ze(e.init.layout.session_root,s),d=new Map,b=new Map,R=0,N=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(R>s.length?0:R).split(`
|
|
4
4
|
`).filter(Boolean);R=s.length;let u=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(u.length)o("vm_hands.srt_server_starts",{count:u.length,elapsed_ms:u.slice(0,8)})}catch{}},m=null,_=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",x=()=>{m??=me()},P=0,F=()=>{try{let s=k(Fe,"utf8"),i=s.slice(P>s.length?0:P);P=s.length;let u=i.split(`
|
|
5
5
|
`).filter(Boolean).slice(0,1000);if(!u.length)return null;let f={},g=0;for(let S of u)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:u.length,codes:f,max_elapsed_ms:g}),{count:u.length,codes:f,max_elapsed_ms:g}}catch{return null}},I=(s,i,u)=>Ce(s,i,u),K=(s)=>(i,u,f)=>Me("/bin/sh",["-c",`echo $$ > ${be(p(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...u],f),Ce=K(p(r,L)),j=p(r,L,"probe"),W=(s)=>Ve(r,s),Oe=(s)=>{let i=W(s);try{J(i,{mode:493})}catch(u){if(!(u&&typeof u==="object"&&("code"in u)&&u.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},xe=(s)=>{try{pe(W(s))}catch{}},H=e.prespawn?nn({spawnProcess:I,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;H?.arm();let Y=H?setInterval(()=>{H.arm()},Je):null;Y?.unref?.();let q=new Set;async function G(s){let i=d.get(s);if(d.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:W,async startExecutor(s){if(x(),b.set(s.bindId,me()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await G(s.bindId);let{claim:i,bindId:u}=s,f=Oe(u),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,D=new Promise((a,v)=>{h=a,y=v}),A,C=new Promise((a)=>{A=a}),z=et({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(u,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...H?{takePrespawnedWorker:(a)=>{let v=H.take(a);if(!v?.pid)return v;try{return B(p(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:H.adopt}:{}}).then(()=>{A("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),A(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));if(d.set(u,{abort:S,done:z,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0}),q.delete(u))G(u).catch(()=>{return});let M=await D,V=M.executor_launch_id;if(typeof V!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:V,readyData:M,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return d.get(s)?.exited??new Promise(()=>{})},abortExecutor(s){if(!d.has(s)){q.add(s);return}G(s).catch(()=>{return})},freezeBind(s){let i=W(s);if(E(p(i,"cgroup.freeze")))B(p(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){if(s?.bindId)q.delete(s.bindId);let i=new Set(s?.keep??[]);if(await Ie(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&E(p(O,"cgroup.events")))N(),await re(O,Date.now()+ne,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ne;if(E(p(j,"cgroup.events"))){await re(j,s,"probe");try{pe(j)}catch{}}let i=ie(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Xe(r,i,s);let u=(g)=>{let S=ie(g);return S!==null&&S<=i},f=_e(t).filter((g)=>u(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...ge(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,p(r,L)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=he(m).filter((y)=>y!==process.pid&&!c(y)&&!U(y,"/reason-vm-hands")&&!U(y,S)&&!g.some((D)=>te(y,D)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:se(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:se(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(x(),!i.includes(fe))throw new w("vm_hands_probe_failed","probe names no proof directory");let u=e.proofParent??"/tmp/reason-vm-hands-proof";J(u,{mode:457,recursive:!0});let f=ee(u);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=We(p(u,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Te(g,t,t),Le(g,448);let h=ee(g).ino;try{J(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(fe,g).replaceAll(Ee,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]});an();let D="";y.stdout?.on("data",(C)=>{if(D.length<16384)D+=C.toString("utf8").slice(0,16384-D.length)});let A=await new Promise((C)=>{let z=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},Ge);y.once("error",()=>{clearTimeout(z),C(127)}),y.once("close",(M)=>{clearTimeout(z),C(M??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:A}),{exitCode:A,markers:D,proofDirInode:h}}finally{if(!S)ze(g,{recursive:!0,force:!0})}},restatLayout(s){let i=l(s),u=i===e.init.layout.session_root?e.init.layout.alias:p(i,"repo"),f="invalid";try{hi(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=ee(u);S=h.uid,g=f==="0:0:755"&&u===p(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&He(u)===u&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=l(s);try{de(i,o,(u)=>new w("vm_hands_mount_mismatch",u))}catch(u){if(i!==e.init.layout.session_root&&u instanceof w&&u.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw u}},installEnvironment(s,i){let u=d.get(s);if(!u)throw new w("environment_unavailable","no executor owns an environment");return Qe({root:e.root,operationId:u.operationId,payload:i}).installed_revision},async stop(){if(Y)clearInterval(Y);H?.close(),await Promise.all([...d.keys()].map((s)=>G(s)))}};function $e(){try{return X(p(r,L),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function Ie(s,i,u=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=tn();try{await sn();let S=Date.now()+ne,h=new Set($e().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=G(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(E(p(W(a),"cgroup.events")))await re(W(a),S,"bind");await v}let D=[...f].map((a)=>W(a).replace(/^\/sys\/fs\/cgroup/,"")),A=["/",...[r,p(r,L)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),z=(a)=>c(a)||D.some((v)=>U(a,v))||A.some((v)=>te(a,v)),M=u?[]:_e(t).filter((a)=>!z(a));if(M.length)throw o("vm_hands.kill_survivors",{pids:M.slice(0,16),beside:f.size,...ge(M)}),new w("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside a live bind`);let V=(a)=>!z(a)&&!U(a,"/reason-vm-hands")&&!U(a,C)&&!A.some((v)=>te(a,v));if(y!==null){let a=he(y).filter((v)=>v!==process.pid&&V(v));if(a.length)throw o("vm_hands.kill_strays",{strays:se(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),xe(a)}finally{g()}}}function ie(e,r="/proc"){try{let t=k(p(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function Se(e,r="/proc"){try{let t=k(p(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Xe(e,r,t){try{B(p(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=Pe(e).filter((o)=>ke(o,e)),c=new Set(n.filter((o)=>{let l=ie(o);return l!==null&&l<=r}));for(let o=!0;o;){o=!1;for(let l of n){if(c.has(l))continue;let d=Se(l);if(d!==null&&c.has(d))c.add(l),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(p(e,"cgroup.freeze"),"0")}catch{}}}function te(e,r,t="/proc"){try{return k(p(t,String(e),"cgroup"),"utf8").split(`
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{qn,Wn,Wr,Vr,Gr,hl}from"./vm-hands-entry-lite-
|
|
2
|
+
import{qn,Wn,Wr,Vr,Gr,hl}from"./vm-hands-entry-lite-8tjr2pqm.js";export{qn as VM_HANDS_OP_RUNNER_PERSON_ARG,Wn as VM_HANDS_OP_RUNNER_SURFACE_ARG,Vr as VM_HANDS_SURFACE_DIRECTORY_ARG,Gr as VM_HANDS_SURFACE_OPS,Wr as VM_HANDS_SURFACE_UID_ARG,hl as runVmHandsOpRunner};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{er}from"./vm-hands-entry-lite-
|
|
3
|
-
`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}var de="/run/ara-srt/starts.jsonl",ue=5;function Y(){try{let r=J(de);return`${r.size}:${r.mtimeMs}`}catch{return""}}function j(r,n){let t=(d)=>{n("srt_warm_skipped",{reason:d});let a=Promise.resolve();return{done:a,listening:a}};if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>ae||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let i;try{let d=T(B);if(!d.isDirectory()||d.uid!==0||(d.mode&18)!==0)return t("cgroup_unsafe");let a=se.find((k)=>T(k,{throwIfNoEntry:!1})!==void 0);if(!a)return t("cgroup_or_exec_missing");i=a;for(let[k,N]of[[i,!1],["/usr/local/bin",!0]]){let w=T(k);if((N?!w.isDirectory():!w.isFile())||w.uid!==0||(w.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),m=Y(),_=re("sha256").update(s).digest("hex"),E=`${x}/srt-base-settings.json`;try{q(E,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let y=te("/bin/sh",["-c",`echo $$ > ${B}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",i,"--settings",E,"--idle-ms",String(ie),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"}),S=null,R=new Promise((d)=>{y.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),d()}),y.once("close",(a)=>{n(a===0?"srt_warm_done":"srt_warm_failed",{exit_code:a,warm_ms:Math.round(performance.now()-l),...S!==null?{after_ms:S}:{},settings_sha256:_}),d()})}),g=!1,b=new Promise((d)=>{R.then(()=>{g=!0,d()});let a=()=>{if(g)return;if(Y()!==m){S=Math.round(performance.now()-l),d();return}setTimeout(a,ue)};a()});return{done:R,listening:b}}var G=3000;function Ne(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:i}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&oe.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!i&&typeof i.key_id==="string"&&Number.isSafeInteger(i.expires_at_ms)&&typeof i.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function M(r){z(r,{recursive:!0,mode:448});let n=J(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function le(r){let[{CLI_VERSION:n},t,s,i]=await Promise.all([import("./version-
|
|
4
|
-
`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function me(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:L,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function ye(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=X(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function Oe(r,n){let t=ye();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});M(x),M(U),M(H),ce(n);let s=j(r,n),i=!1,l=async(e="done")=>{if(!await Promise.race([s[e].then(()=>!0),new Promise((u)=>setTimeout(()=>u(!1),G).unref?.())]))i=!0,n("srt_warm_late",{wait_ms:G})},[{configureDesktopAccount:m},{configureWorkerSandbox:_}]=await Promise.all([import("./desktop-account-d1g1m6yb.js"),import("./worker-sandbox-2trfs79b.js")]);_();try{m({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let E=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>E.abort());let y=new Map,S,R=new Promise((e)=>{S=e}),g=R.then(()=>import("./vm-hands-executor-
|
|
2
|
+
import{er}from"./vm-hands-entry-lite-1bdtt81g.js";import"./vm-hands-entry-lite-mkvey48j.js";import{Gr}from"./vm-hands-entry-lite-8tjr2pqm.js";import{Ta,co,Ia}from"./vm-hands-entry-lite.js";import{spawn as te}from"child_process";import{createHash as re}from"crypto";import{lstatSync as T,mkdirSync as z,readFileSync as X,statSync as J,writeFileSync as q}from"fs";var x="/run/reason-vm-hands",U="/run/reason-vm-hands/env",H="/run/reason-vm-hands/surface",L="/home/runner/.reason/workspace",oe=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,B="/sys/fs/cgroup/reason-srt",se=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],ae=65536,ie=21600000;function ce(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;z(n,{recursive:!0,mode:448});let t=T(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}q(`${n}/base-keyed`,`1
|
|
3
|
+
`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}var de="/run/ara-srt/starts.jsonl",ue=5;function Y(){try{let r=J(de);return`${r.size}:${r.mtimeMs}`}catch{return""}}function j(r,n){let t=(d)=>{n("srt_warm_skipped",{reason:d});let a=Promise.resolve();return{done:a,listening:a}};if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>ae||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let i;try{let d=T(B);if(!d.isDirectory()||d.uid!==0||(d.mode&18)!==0)return t("cgroup_unsafe");let a=se.find((k)=>T(k,{throwIfNoEntry:!1})!==void 0);if(!a)return t("cgroup_or_exec_missing");i=a;for(let[k,N]of[[i,!1],["/usr/local/bin",!0]]){let w=T(k);if((N?!w.isDirectory():!w.isFile())||w.uid!==0||(w.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),m=Y(),_=re("sha256").update(s).digest("hex"),E=`${x}/srt-base-settings.json`;try{q(E,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let y=te("/bin/sh",["-c",`echo $$ > ${B}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",i,"--settings",E,"--idle-ms",String(ie),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"}),S=null,R=new Promise((d)=>{y.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),d()}),y.once("close",(a)=>{n(a===0?"srt_warm_done":"srt_warm_failed",{exit_code:a,warm_ms:Math.round(performance.now()-l),...S!==null?{after_ms:S}:{},settings_sha256:_}),d()})}),g=!1,b=new Promise((d)=>{R.then(()=>{g=!0,d()});let a=()=>{if(g)return;if(Y()!==m){S=Math.round(performance.now()-l),d();return}setTimeout(a,ue)};a()});return{done:R,listening:b}}var G=3000;function Ne(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:i}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&oe.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!i&&typeof i.key_id==="string"&&Number.isSafeInteger(i.expires_at_ms)&&typeof i.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function M(r){z(r,{recursive:!0,mode:448});let n=J(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function le(r){let[{CLI_VERSION:n},t,s,i]=await Promise.all([import("./version-6m3prwm9.js"),import("./hands-worker-source-j4yz7x6h.js"),import("./network-contract-3jfjnv65.js"),import("./device-workspace-8941tdsy.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-wz7z9pzz.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:er,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:i.REASON_WORKSPACE_BASE,workspace_layout:i.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var P=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],Q=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],_e=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),pe=60000,fe=30000;function Z(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(P.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:Q.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function ge(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:L,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:Z(t,H)}),i=r.capabilities,l={...i.operation_constraints};for(let _ of P)l[_]={...s.operation_constraints?.[_]??{},ready:!0,execution_mode:s.operation_constraints?.[_]?.execution_mode??"host"};let m=Q.filter((_)=>s.operation_constraints?.[_]!==void 0);for(let _ of m)l[_]=s.operation_constraints[_];return{...r,capabilities:{...i,supported_operations:["hands.connect",...P,...m],operation_constraints:l}}}function we(r){for(let n of X("/etc/passwd","utf8").split(`
|
|
4
|
+
`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function me(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:L,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function ye(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=X(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function Oe(r,n){let t=ye();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});M(x),M(U),M(H),ce(n);let s=j(r,n),i=!1,l=async(e="done")=>{if(!await Promise.race([s[e].then(()=>!0),new Promise((u)=>setTimeout(()=>u(!1),G).unref?.())]))i=!0,n("srt_warm_late",{wait_ms:G})},[{configureDesktopAccount:m},{configureWorkerSandbox:_}]=await Promise.all([import("./desktop-account-d1g1m6yb.js"),import("./worker-sandbox-2trfs79b.js")]);_();try{m({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let E=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>E.abort());let y=new Map,S,R=new Promise((e)=>{S=e}),g=R.then(()=>import("./vm-hands-executor-n3q4gj7p.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:L,runtimeDirectory:x,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{i=!1,s=j(r,n)},srtWarmLate:()=>i,forward:(u,c,h)=>y.get(u)?.(c,h)??Promise.reject(Error("vm_hands_not_bound")),log:(u,c)=>n(u,c)});return n("executor_loaded"),o}),b=(e)=>async(...o)=>(await g)[e](...o),d=null;g.then((e)=>{d=(o)=>e.executorExited(o)});let a={startExecutor:async(...e)=>(await l(),b("startExecutor")(...e)),killAndVerifyPayload:b("killAndVerifyPayload"),killProbe:b("killProbe"),runProbe:async(...e)=>(await l("listening"),b("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>d?d(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};g.then((e)=>{a.restatLayout=(o)=>e.restatLayout(o),a.verifyMounts=(o)=>e.verifyMounts(o),a.installEnvironment=(o,u)=>e.installEnvironment(o,u),a.freezeBind=(o)=>e.freezeBind(o),a.abortExecutor=(o)=>e.abortExecutor(o),a.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let k=await Ta(r),N=new co(r,k,a,{envRoot:U}),w=le(r),f={probing:!0,lanes:{},displayVideo:!1},W=null,K=null,ee=Promise.all([w,import("./local-capabilities-ka01z0mb.js")]).then(([e,o])=>{K=()=>ge(e,o.capabilityInventoryForRoots,f),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),D,O=(e)=>{clearTimeout(D),f=e,W?.()},v=R.then(()=>import("./vm-hands-executor-n3q4gj7p.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:u})=>e({payloadUid:r.layout.payload_uid,payloadGid:we(r.layout.payload_uid),bindCgroup:(c)=>o(u,c),surfaceDirectory:H,onSurfaceReadiness:(c)=>{if(c)O({probing:!1,lanes:c.lanes??{},displayVideo:c.display_video===!0});else if(f.probing)O({probing:!1,lanes:{},displayVideo:!1})},log:(c,h)=>n(c,h)})).catch(()=>null);v.then((e)=>e?.warm("person")),v.then(async(e)=>{if(!e){O({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+fe;while(N.settingUp&&Date.now()<o)await new Promise((u)=>setTimeout(u,250));D=setTimeout(()=>{if(f.probing)O({probing:!1,lanes:{},displayVideo:!1})},pe),D.unref?.(),e.warm("surface")}),n("agent_ready"),await Ia({apiOrigin:r.api_origin,agent:N,signal:E.signal,heartbeat:async()=>K?.()??await w,onHeartbeatNow:(e)=>{W=e},executeOp:async({kind:e,claim:o,bindId:u,signal:c,emit:h})=>{let A=me(r,o);if(!A)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:x,readiness:{...Object.fromEntries(P.map((p)=>[p,!0])),"tunnel.open":f.lanes["tunnel.open"]===!0,"tunnel.close":f.lanes["tunnel.close"]===!0}},V=(p)=>{let I=typeof p.kind==="string"?p.kind:"";if(I)h({kind:I,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let ne=o.capability==="pty.start"&&e==="person"&&!o.authority;if(_e.has(String(o.capability))&&!ne||o.capability==="ports.list"){let{executeLocalOperation:p}=await import("./local-capabilities-ka01z0mb.js");return p(A,o,{worker:F,signal:c,emit:(I)=>V(I)})}let C=await v;if(!C)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Gr.has(String(o.capability))){if(f.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return C.run("surface",{id:String(o.attempt_id),claim:o,state:A,worker:Z(f,H)},V,c)}return C.run(e,{id:String(o.attempt_id),claim:o,state:A,worker:F},V,c,u)},controlOp:async({claim:e,control:o})=>Gr.has(String(e.capability))&&((await v)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:u})=>{if(u&&e.capability==="preview.serve.v1")v.then((c)=>c?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")S();n(e,o)},onTurn:(e,o)=>{if(o)y.set(e,o);else y.delete(e)}}),await(await g).stop(),(await v)?.stop()}export{Ne as parseVmHandsInit,Oe as runVmHands};
|
package/package.json
CHANGED
|
@@ -1,2 +0,0 @@
|
|
|
1
|
-
// @bun
|
|
2
|
-
import{C,io,me}from"./vm-hands-entry-lite-dhn0fs5e.js";import"./vm-hands-entry-lite-r131db1f.js";import"./vm-hands-entry-lite-4kb5rq3d.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{C as ApiError,me as ReasonApi,io as createMachineEnrollmentTicketWithToken};
|
|
@@ -1,2 +0,0 @@
|
|
|
1
|
-
// @bun
|
|
2
|
-
import{fe,eo,gl,_l,to,yl,wl}from"./vm-hands-entry-lite-mzw2vcah.js";import"./vm-hands-entry-lite-kankyeep.js";import"./vm-hands-entry-lite-7aeqbfc8.js";import"./vm-hands-entry-lite-h5x725z8.js";import"./vm-hands-entry-lite-8s5n4wps.js";import"./vm-hands-entry-lite-dhn0fs5e.js";import"./vm-hands-entry-lite-r131db1f.js";import"./vm-hands-entry-lite-4kb5rq3d.js";import"./vm-hands-entry-lite-rpf4t8r4.js";import"./vm-hands-entry-lite-bqs4pkyb.js";import"./vm-hands-entry-lite-7jmt3q38.js";import"./vm-hands-entry-lite-mktndd2r.js";import"./vm-hands-entry-lite-bbjsnjct.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-kzygj0q8.js";import"./vm-hands-entry-lite-jm9jpj77.js";import"./vm-hands-entry-lite-3594pdj0.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-ksfd234v.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-9meg54bs.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-ezkb7f6j.js";import"./vm-hands-entry-lite-8twdd0ff.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-bcz4qpp6.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-2qh3rat2.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{eo as computerDisconnected,fe as connectionDirectory,to as connectionReport,yl as restartConnection,wl as restartConnectionWhenIdle,gl as runConnectCli,_l as runDisconnectCli};
|
|
@@ -1,2 +0,0 @@
|
|
|
1
|
-
// @bun
|
|
2
|
-
import{hr,No,Lo,$o,Cl,Mo}from"./vm-hands-entry-lite-kzygj0q8.js";import"./vm-hands-entry-lite-jm9jpj77.js";import"./vm-hands-entry-lite-3594pdj0.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-ksfd234v.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-9meg54bs.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-ezkb7f6j.js";import"./vm-hands-entry-lite-8twdd0ff.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-bcz4qpp6.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-2qh3rat2.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{Lo as ensureLocalBrowser,hr as localAutomationAvailable,$o as localBrowserProfile,No as localUserChromeHost,Cl as runAutomationCallLocally,Mo as runLocalAutomation};
|
|
@@ -1,2 +0,0 @@
|
|
|
1
|
-
// @bun
|
|
2
|
-
import{Qr,en,fo,Kn,tl,rl,Jn,mo,go,_o,Xn}from"./vm-hands-entry-lite-rpf4t8r4.js";import"./vm-hands-entry-lite-bqs4pkyb.js";import"./vm-hands-entry-lite-7jmt3q38.js";import"./vm-hands-entry-lite-mktndd2r.js";import"./vm-hands-entry-lite-bbjsnjct.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-kzygj0q8.js";import"./vm-hands-entry-lite-jm9jpj77.js";import"./vm-hands-entry-lite-3594pdj0.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-ksfd234v.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-9meg54bs.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-ezkb7f6j.js";import"./vm-hands-entry-lite-8twdd0ff.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-bcz4qpp6.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-2qh3rat2.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";export{r as LocalCapabilityError,Qr as SHORT_REQUEST_CAPABILITIES,mo as capabilityInventoryForRoots,en as confinedExecutionShell,Kn as defaultLocalCommandRunner,go as deliverLocalHandsEnvironment,Jn as enrolledRootPaths,Xn as executeLocalOperation,_o as rebindLocalHandsControl,tl as runFileCapability,rl as runTransferCapability,fo as spawnCaptured};
|
|
@@ -1,2 +0,0 @@
|
|
|
1
|
-
// @bun
|
|
2
|
-
import{dn,Bo,Te,jt,pn}from"./vm-hands-entry-lite-jm9jpj77.js";import"./vm-hands-entry-lite-3594pdj0.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-ksfd234v.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-9meg54bs.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-bcz4qpp6.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-2qh3rat2.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{jt as ensureLinuxDesktop,dn as localDisplayAvailable,Bo as localDisplayReady,Te as privateDirectory,pn as runLocalDisplayStream};
|