@reason-machines/cli-linux-x64 0.2.568 → 0.2.570

package/bin/vm-hands/vm-hands-entry-lite.js

@@ -1,4 +1,4 @@
 // @bun
-import{At,Lr,Cs,As,Ps,Mr}from"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import{createHash as K,randomBytes as ge}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Qe,openSync as Oe,renameSync as Ze,rmSync as en,statSync as De,writeSync as Me,constants as H}from"fs";import{join as re}from"path";var nn=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:tn(e)}}function tn(e){let n=e.payload[Cs];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var W=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),V=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function L(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(L).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${L(e[n])}`).join(",")}}`}async function Ta(e){let n=await crypto.subtle.importKey("pkcs8",V(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=V(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),g=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),h=K("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:g,fingerprint:h}}var sn=16;class co{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;abandoned=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let g=this.bound.get(e);if(!g)return!1;if(g.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((h)=>setTimeout(h,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:nn,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:W(this.keys.signingSpki),env_public_key:W(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:W(ge(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(L(n)));return{...n,device_signature:W(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=W(ge(32)),g=Mr({method:"GET",pathAndQuery:At,timestamp:i,nonce:s,challenge:e,bodySha256:K("sha256").update("").digest("hex")}),h=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(g)));return{t:"hello",timestamp:i,nonce:s,signature:W(rn(h)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let s of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(s))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(K("sha256").update(L({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((s)=>s.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=sn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((s)=>s.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let s,g,h=new Promise((m,S)=>{s=m,g=S});return h.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:h,resolve:s,reject:g}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(w){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(w,"the bind's kill-verify failed")}let i,s=new Promise((w)=>{i=w}),g=!1,h=!1,m=()=>{h=!0,i()},S=n.promise.then(()=>new Promise((w,I)=>{this.exclusive(async()=>{if(h){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}g=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();w()}catch(b){I(b)}await s})}));S.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:S,inTurn:()=>g,leave:m})}finally{m()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);if(this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","abandoned before its launch");s=!0;let{launchId:g,applied:h,readyData:m}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),S=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let w=null,I=null;if(e.env){let b=e.claim?.owner??{},R=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof b.device_id==="string"?b.device_id:"",rootId:e.claim?.root_id??""});w=this.hooks.installEnvironment(e.bind_id,R),I=typeof R.snapshot_id==="string"&&R.snapshot_id?R.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,R)}if(this.unbinding.has(e.bind_id)||this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:g,envInstalled:w!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:g,snapshot_revision:w,snapshot_id:I,layout:S,...m?{ready_data:m}:{},policy_digest:K("sha256").update(L({hands_confinement:h.hands_confinement??null,browser_egress:h.browser_egress??null})).digest("hex")}}catch(g){if(i)fe(i);if(s){let h=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(h);else await h()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(g,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}abandonBinding(e){if(!this.binding.has(e))return;this.abandoned.add(e),this.abandonWorkspaceGrant(e);try{this.hooks.abortExecutor?.(e)}catch{}}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),g=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${g}`,s),{snapshot_id:e.snapshotId,installed_revision:g,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:K("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(g){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw g}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",V(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),g=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),h=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(e.iv),additionalData:new TextEncoder().encode(n)},g,V(e.ct)).catch(i),m=JSON.parse(new TextDecoder().decode(h));if(!m||typeof m!=="object"||Array.isArray(m))throw new l("vm_hands_env_invalid","env not an object");return m}writeJobEnvRootOnly(e,n){let i=re(this.options.envRoot,`bind-${e}`);Qe(i,{mode:448});let s=De(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let g=n.variables&&typeof n.variables==="object"?n.variables:{},h=Object.entries(g).filter(([w,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(w)&&typeof I==="string").map(([w,I])=>`export ${w}='${String(I).replaceAll("'","'\\''")}'`).join(`
+import{At,Lr,Cs,As,Ps,Mr}from"./vm-hands-entry-lite-6dkjbe2b.js";import"./vm-hands-entry-lite-pnx4zgd6.js";import{createHash as K,randomBytes as ge}from"crypto";import{closeSync as Ae,fsyncSync as xe,mkdirSync as Qe,openSync as Oe,renameSync as Ze,rmSync as en,statSync as De,writeSync as Me,constants as H}from"fs";import{join as re}from"path";var nn=1;var oe=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function pe(e){if(e.environment!==void 0||e.payload.environment!==void 0)throw new l("vm_hands_bind_invalid","bind carries a plaintext environment");if(e.payload.vm_hands_env_deferred===!0&&e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","split bind carries an environment");return e.environment_sealed!==void 0}function Te(e,n){let{payload:i,authority:s}=e;if(!i||typeof i!=="object"||Array.isArray(i)||!s||typeof s!=="object"||Array.isArray(s)||!n.deviceId||!n.rootId||i.run_id!==n.runId||i.device_id!==n.deviceId||s.device_id!==n.deviceId||i.root_id!==n.rootId||n.snapshotId!==void 0&&i.snapshot_id!==n.snapshotId)throw new l("vm_hands_env_invalid","environment does not match this Hands");return i}function ve(e){if(e.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not a hands.connect claim");let n=e.payload;return{kind:"vm_hands.bind",v:1,bind_id:e.attempt_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,run_id:e.run_id,session_id:typeof n.workspace_id==="string"&&oe.test(n.workspace_id)?n.workspace_id:e.run_id,brain_generation:n.target_generation,fence_id:n.target_fence_id,lease_until:e.lease_until,policy:{agent_profile:"",confinement_key:String(n.hands_confinement??""),browser_egress:n.browser_egress??null,policy_digest:n.vm_hands_policy_digest},cwd:typeof n.cwd==="string"?n.cwd:"",claim:e,env:pe(e)?e.environment_sealed:null,workspace_deferred:tn(e)}}function tn(e){let n=e.payload[Cs];if(n===void 0)return!1;if(n!==!0||e.payload.vm_hands_env_deferred!==!0||e.environment_sealed!==void 0)throw new l("vm_hands_bind_invalid","a pre-bind must be environment-less");return!0}class l extends Error{code;constructor(e,n){super(n);this.code=e}}function Re(e,n){if(e instanceof l)return e;let i=e&&typeof e==="object"&&"code"in e&&typeof e.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(e.code)?e.code:"vm_hands_bind_failed";return new l(i,n)}var W=(e)=>Buffer.from(e instanceof Uint8Array?e:new Uint8Array(e)).toString("base64url"),V=(e)=>new Uint8Array(Buffer.from(e,"base64url"));function L(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(L).join(",")}]`;return`{${Object.keys(e).sort().map((n)=>`${JSON.stringify(n)}:${L(e[n])}`).join(",")}}`}async function Ta(e){let n=await crypto.subtle.importKey("pkcs8",V(e.device_key.pkcs8),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),i=V(e.device_key.spki),s=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!1,["deriveKey"]),g=new Uint8Array(await crypto.subtle.exportKey("spki",s.publicKey)),h=K("sha256").update(i).digest("base64url");return{signing:{privateKey:n},agreement:s,signingSpki:i,agreementSpki:g,fingerprint:h}}var sn=16;class co{init;keys;hooks;options;identity="identity_free";lastBrainGeneration=new Map;rebindableGeneration=new Map;bound=new Map;binding=new Map;unbinding=new Set;abandoned=new Set;servedRun=!1;bootKillPending=!1;unverified=new Set;unverifiedTeardowns=new Map;grants=new Map;structural=Promise.resolve();exclusive(e){let n=this.structural.then(e,e);return this.structural=n.catch(()=>{return}),n}constructor(e,n,i,s){this.init=e;this.keys=n;this.hooks=i;this.options=s;if(!oe.test(e.workspace_id)&&!/^ws-[a-z0-9]{8,64}$/.test(e.workspace_id))throw new l("vm_hands_layout_invalid","bad workspace id");if(!Number.isSafeInteger(e.instance_generation)||e.instance_generation<1)throw new l("vm_hands_layout_invalid","bad generation")}get phase(){if(this.identity==="identity_free")return"identity_free";if(this.unbinding.size)return"unbinding";return this.bound.size||this.binding.size?"bound":"registered"}isBoundRun(e){for(let n of this.bound.values())if(n.runId===e)return!0;return!1}bindIdForRun(e){for(let n of this.bound.values())if(n.runId===e)return n.bindId;return null}get liveBindIds(){return[...new Set([...this.bound.keys(),...this.binding.keys(),...this.unbinding])]}get liveSessionIds(){return[...new Set([...this.bound.values()].map((e)=>e.sessionId.toLowerCase()))]}get settingUp(){return this.binding.size>0}async environmentInstalled(e,n,i){for(let s=Date.now()+n;;){let g=this.bound.get(e);if(!g)return!1;if(g.envInstalled)return!0;if(Date.now()>=s||i?.aborted)return!1;await new Promise((h)=>setTimeout(h,25))}}canSpawn(e){for(let n of this.bound.values())if(n.runId===e)return n.envInstalled;return!1}async registerFrame(e){if(this.identity!=="identity_free")throw new l("vm_hands_register_twice","already registered");if(typeof e!=="string"||e.length<16||e.length>256)throw new l("vm_hands_challenge_invalid","bad register challenge");let n={challenge:e,t:"register",v:nn,workspace_id:this.init.workspace_id,instance_generation:this.init.instance_generation,credential:this.init.credential,device_public_key:W(this.keys.signingSpki),env_public_key:W(this.keys.agreementSpki),key_fingerprint:this.keys.fingerprint,manifest_digest:this.init.manifest_digest,nonce:W(ge(32)),timestamp_ms:(this.options.now??Date.now)(),vm_hands_attest_hold:!0},i=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new TextEncoder().encode(L(n)));return{...n,device_signature:W(i)}}async helloFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","hello before register");let i=String((this.options.now??Date.now)()),s=W(ge(32)),g=Mr({method:"GET",pathAndQuery:At,timestamp:i,nonce:s,challenge:e,bodySha256:K("sha256").update("").digest("hex")}),h=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},this.keys.signing.privateKey,new Uint8Array(g)));return{t:"hello",timestamp:i,nonce:s,signature:W(rn(h)),...n?{vm_hands_previous_connection:n}:{}}}registered(){if(this.identity!=="identity_free")throw new l("vm_hands_register_unexpected","registered twice");this.identity="registered"}async bind(e){if(this.identity!=="registered")throw new l("vm_hands_not_registered","bind before register");if(e.kind!=="vm_hands.bind"||e.v!==1)throw new l("vm_hands_bind_invalid","bad bind");for(let s of[e.bind_id,e.attempt_id,e.run_id,e.session_id,e.fence_id])if(!oe.test(s))throw new l("vm_hands_bind_invalid","bad id");let n=this.lastBrainGeneration.get(e.run_id)??0;if(!Number.isSafeInteger(e.brain_generation)||e.brain_generation<n||e.brain_generation===n&&this.rebindableGeneration.get(e.run_id)!==n)throw new l("vm_hands_generation_stale","brain generation not strictly higher");if(e.env&&(e.env.aad!==e.bind_id||e.env.alg!=="ECDH-P256+A256GCM"))throw new l("vm_hands_bind_invalid","bad env envelope");if(!/^[0-9a-f]{64}$/.test(e.policy.policy_digest))throw new l("vm_hands_bind_invalid","bad policy or nonce");if(K("sha256").update(L({hands_confinement:e.policy.confinement_key||null,browser_egress:e.policy.browser_egress??null})).digest("hex")!==e.policy.policy_digest)throw new l("vm_hands_policy_mismatch","policy digest does not match the claim");if(this.liveBindIds.includes(e.bind_id)||[...this.bound.values()].some((s)=>s.runId===e.run_id)||[...this.binding.values()].includes(e.run_id))throw new l("vm_hands_busy","this run already holds a bind here");if(this.liveBindIds.length>=sn)throw new l("vm_hands_busy","every bind slot is held");if([...this.grants.values()].some((s)=>s.sessionId===e.session_id))throw new l("vm_hands_busy","a bind of this Session waits for its workspace beside the setup");if(this.lastBrainGeneration.set(e.run_id,e.brain_generation),this.rebindableGeneration.delete(e.run_id),this.binding.set(e.bind_id,e.run_id),e.workspace_deferred){let s,g,h=new Promise((m,S)=>{s=m,g=S});return h.catch(()=>{return}),this.grants.set(e.bind_id,{sessionId:e.session_id,promise:h,resolve:s,reject:g}),this.setUpDeferred(e)}return this.exclusive(()=>this.setUp(e))}liveCgroupBindsBut(e){return[...new Set([...this.bound.keys(),...this.binding.keys()])].filter((n)=>n!==e)}async setUpDeferred(e){let n=this.grants.get(e.bind_id);try{await this.exclusive(()=>this.prepareBind(e))}catch(w){throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(w,"the bind's kill-verify failed")}let i,s=new Promise((w)=>{i=w}),g=!1,h=!1,m=()=>{h=!0,i()},S=n.promise.then(()=>new Promise((w,I)=>{this.exclusive(async()=>{if(h){I(new l("vm_hands_bind_lost","the pre-bind ended before its turn"));return}g=!0;try{if(this.unverified.size>0)await this.hooks.killAndVerifyPayload({keep:[...this.liveCgroupBindsBut(e.bind_id),e.bind_id]}),this.unverified.clear();w()}catch(b){I(b)}await s})}));S.catch(()=>{return});try{return await this.setUp(e,{workspaceGrant:S,inTurn:()=>g,leave:m})}finally{m()}}async prepareBind(e){if(this.bootKillPending&&!this.servedRun){try{await this.hooks.killProbe()}catch{throw new l("vm_hands_kill_unverified","the boot's scoped kill did not verify")}this.bootKillPending=!1}let n=this.liveCgroupBindsBut(e.bind_id);if(this.unverified.size>0)await this.hooks.killAndVerifyPayload(n.length?{keep:n}:void 0),this.unverified.clear();this.servedRun=!0}async setUp(e,n){let i=null,s=!1;try{if(!n)await this.prepareBind(e);if(this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","abandoned before its launch");s=!0;let{launchId:g,applied:h,readyData:m}=await this.hooks.startExecutor({bindId:e.bind_id,sessionId:e.session_id,policyDigest:e.policy.policy_digest,confinementKey:e.policy.confinement_key,browserEgress:e.policy.browser_egress,cwd:e.cwd,claim:e.claim,...n?{workspaceGrant:n.workspaceGrant}:{}}),S=this.hooks.restatLayout(e.session_id);this.hooks.verifyMounts?.(e.session_id);let w=null,I=null;if(e.env){let b=e.claim?.owner??{},R=Te(await this.openSealed(e.env,e.bind_id),{runId:e.run_id,deviceId:typeof b.device_id==="string"?b.device_id:"",rootId:e.claim?.root_id??""});w=this.hooks.installEnvironment(e.bind_id,R),I=typeof R.snapshot_id==="string"&&R.snapshot_id?R.snapshot_id:null,i=this.writeJobEnvRootOnly(e.bind_id,R)}if(this.unbinding.has(e.bind_id)||this.abandoned.has(e.bind_id))throw new l("vm_hands_bind_lost","unbound while binding");return this.bound.set(e.bind_id,{bindId:e.bind_id,runId:e.run_id,sessionId:e.session_id,brainGeneration:e.brain_generation,policyDigest:e.policy.policy_digest,launchId:g,envInstalled:w!==null,rootId:e.claim?.root_id??"",envDirectory:i}),this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),{bind_id:e.bind_id,attempt_id:e.attempt_id,attempt_token:e.attempt_token,launch_id:g,snapshot_revision:w,snapshot_id:I,layout:S,...m?{ready_data:m}:{},policy_digest:K("sha256").update(L({hands_confinement:h.hands_confinement??null,browser_egress:h.browser_egress??null})).digest("hex")}}catch(g){if(i)fe(i);if(s){let h=()=>this.hooks.killAndVerifyPayload({bindId:e.bind_id,keep:this.liveCgroupBindsBut(e.bind_id),own:!0}).catch(()=>{this.unverified.add(e.bind_id)});if(n&&!n.inTurn())n.leave(),await this.exclusive(h);else await h()}throw this.binding.delete(e.bind_id),this.grants.delete(e.bind_id),this.abandoned.delete(e.bind_id),this.rebindableGeneration.set(e.run_id,e.brain_generation),Re(g,"executor refused the bind")}}grantWorkspace(e){let n=this.grants.get(e);if(!n)throw new l("vm_hands_not_binding","no pre-bind waits for a workspace grant");n.resolve()}abandonWorkspaceGrant(e){this.grants.get(e)?.reject(new l("vm_hands_bind_lost","the pre-bind ended before its workspace grant"))}abandonBinding(e){if(!this.binding.has(e))return;this.abandoned.add(e),this.abandonWorkspaceGrant(e);try{this.hooks.abortExecutor?.(e)}catch{}}async deliverEnvironment(e){let n=this.bound.get(e.attemptId);if(!n||this.unbinding.has(e.attemptId))throw new l("vm_hands_not_bound","environment delivered while not bound");if(!oe.test(e.attemptId)||typeof e.snapshotId!=="string"||!e.snapshotId||e.snapshotId.length>128||e.snapshotId.includes("/"))throw new l("vm_hands_env_invalid","bad snapshot id");let i=`${e.attemptId}/${e.snapshotId}`;if(e.sealed?.alg!=="ECDH-P256+A256GCM"||e.sealed.aad!==i)throw new l("vm_hands_env_invalid","bad env envelope");let s=Te(await this.openSealed(e.sealed,i),{runId:n.runId,deviceId:e.deviceId,rootId:n.rootId,snapshotId:e.snapshotId}),g=this.hooks.installEnvironment(n.bindId,s);if(n.envInstalled=!0,n.envDirectory)fe(n.envDirectory);return n.envDirectory=null,n.envDirectory=this.writeJobEnvRootOnly(`${n.bindId}-r${g}`,s),{snapshot_id:e.snapshotId,installed_revision:g,installed:!0}}async attestFrame(e,n){if(this.identity==="identity_free")throw new l("vm_hands_not_registered","attest before register");if(!e||e.length>65536)throw new l("vm_hands_attest_invalid","no probe script");return this.exclusive(async()=>{if(this.liveBindIds.length)throw new l("vm_hands_attest_invalid","attest beside a bind");let i=await this.hooks.runProbe({nonce:n,script:e});try{await this.hooks.killProbe()}catch{this.bootKillPending=!0}return{t:"attest",nonce:n,exit_code:i.exitCode,markers:i.markers,proof_dir_inode:i.proofDirInode,script_sha256:K("sha256").update(e).digest("hex")}})}executorExited(e){return this.hooks.executorExited?.(e)??new Promise(()=>{})}async boundRefused(e){await this.unbind(e)}async unbind(e){let n=this.bound.get(e)??null;if(this.unbinding.add(e),this.bound.delete(e),this.abandonWorkspaceGrant(e),n)try{this.hooks.freezeBind?.(e)}catch{}return this.exclusive(()=>this.tearDown(e,n))}async retryUnbind(e){if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.exclusive(async()=>{if(!this.unverifiedTeardowns.has(e))throw new l("vm_hands_unbind_unknown","no unverified unbind of this bind");return this.tearDown(e,this.unverifiedTeardowns.get(e)??null,!0)})}async tearDown(e,n,i=!1){try{this.bound.delete(e);let s=this.liveCgroupBindsBut(e);try{await this.hooks.killAndVerifyPayload({bindId:e,keep:s})}catch(g){if(this.unverified.add(e),!this.unverifiedTeardowns.has(e))this.unverifiedTeardowns.set(e,n);throw g}if(this.unverified.delete(e),!s.length&&!i)this.unverified.clear();if(n?.envDirectory)fe(n.envDirectory);if(this.unverifiedTeardowns.delete(e),n&&this.lastBrainGeneration.get(n.runId)===n.brainGeneration)this.rebindableGeneration.set(n.runId,n.brainGeneration);return{bind_id:n?e:null,killed_verified:!0,shredded:!0,srt_fallbacks:s.length||i?null:this.hooks.takeSrtFallbacks?.()??null}}finally{this.unbinding.delete(e)}}async openSealed(e,n){let i=()=>{throw new l("vm_hands_env_invalid","env did not decrypt")},s=await crypto.subtle.importKey("spki",V(e.epk),{name:"ECDH",namedCurve:"P-256"},!1,[]).catch(i),g=await crypto.subtle.deriveKey({name:"ECDH",public:s},this.keys.agreement.privateKey,{name:"AES-GCM",length:256},!1,["decrypt"]),h=await crypto.subtle.decrypt({name:"AES-GCM",iv:V(e.iv),additionalData:new TextEncoder().encode(n)},g,V(e.ct)).catch(i),m=JSON.parse(new TextDecoder().decode(h));if(!m||typeof m!=="object"||Array.isArray(m))throw new l("vm_hands_env_invalid","env not an object");return m}writeJobEnvRootOnly(e,n){let i=re(this.options.envRoot,`bind-${e}`);Qe(i,{mode:448});let s=De(i);if(!s.isDirectory()||(s.mode&63)!==0||s.uid!==(process.getuid?.()??-1))throw new l("vm_hands_env_dir_unsafe","env directory is not root's 0700");let g=n.variables&&typeof n.variables==="object"?n.variables:{},h=Object.entries(g).filter(([w,I])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(w)&&typeof I==="string").map(([w,I])=>`export ${w}='${String(I).replaceAll("'","'\\''")}'`).join(`
 `)+`
-`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),pn=3,vn=20000,wn=250,bn=2000;function je(e){let n=Math.min(wn*2**(e-1),bn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function kn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var Sn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function In(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function Pn(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function En(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Tn=1e4,Rn=1000;async function Ia(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await An(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<pn&&Date.now()-n<vn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function An(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,Rn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Tn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=Sn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await Pn(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+yn,q=1,M=await f("hands.ready",se);while(kn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===As){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===Lr)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?En(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(Ps,{code:o}).catch(()=>{return}),In(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as On}from"fs";var xn=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Dn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-nr4ncs4p.js");await h();return}z("parsed",{t0:Math.round(xn)});let e="";try{e=On(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-qvy5s122.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Dn();export{Ta,co,Ia};
+`,m=re(i,`.job.env.${ge(8).toString("hex")}`),S=Oe(m,H.O_WRONLY|H.O_CREAT|H.O_EXCL|H.O_NOFOLLOW,384);try{Me(S,h),xe(S)}finally{Ae(S)}return Ze(m,re(i,"job.env")),i}}function fe(e){try{let n=re(e,"job.env"),i=De(n).size,s=Oe(n,H.O_WRONLY|H.O_NOFOLLOW);try{Me(s,Buffer.alloc(i)),xe(s)}finally{Ae(s)}}catch{}en(e,{recursive:!0,force:!0})}function rn(e){if(e.length!==64)throw new l("vm_hands_signature_invalid","unexpected ECDSA signature length");let n=(g)=>{let h=0;while(h<g.length-1&&g[h]===0)h++;let m=g.subarray(h),S=m[0]&128?Uint8Array.of(0,...m):m;return Uint8Array.of(2,S.length,...S)},i=n(e.subarray(0,32)),s=n(e.subarray(32));return Uint8Array.of(48,i.length+s.length,...i,...s)}import{randomUUID as on}from"crypto";var an="/app/local-runtime/session?register=vm_hands_v1",dn="/app/local-runtime",Be=25000,we=20000,cn=500,ln=1e4,$e=5000,un=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),_n="preview.serve.v1",mn=60000,be=75000,hn=2000,gn=1e4,fn=new Set(["vm_hands_no_register","vm_hands_register_failed"]),pn=3,vn=20000,wn=250,bn=2000;function je(e){let n=Math.min(wn*2**(e-1),bn);return Math.round(n/2+Math.random()*n/2)}var yn=5000;function kn(e){return e>=500||e===408||e===429}var ae=20000;function Ce(e,n){return typeof e==="string"&&/^[A-Za-z0-9._:-]{1,160}$/.test(e)?e:n}class B extends Error{}var Sn=64,qe=[1000,2000,4000,8000,15000,30000,60000,120000];function Ue(e){let n=e&&typeof e==="object"&&"code"in e?e.code:null;return typeof n==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(n)?n:"vm_hands_unbind_failed"}function In(e,n,i,s,g){let h=i.turn.claim.attempt_id,m=e.healing??=new Set;if(m.has(h))return;m.add(h);let S=i.turn.claim.operation_id;(async()=>{for(let[w,I]of qe.entries()){if(s.aborted)return;if(await new Promise((b)=>{let R=setTimeout(b,I);R.unref?.(),s.addEventListener("abort",()=>{clearTimeout(R),b()},{once:!0})}),s.aborted)return;try{let b=await n.retryUnbind(h);g("vm_hands.unbind_healed",{operation_id:S,attempt:w+1}),e.receipts.push({...i,unbound:b}),e.flushReceipts?.();return}catch(b){let R=Ue(b);if(g("vm_hands.unbind_unverified",{operation_id:S,code:R,attempt:w+1}),R==="vm_hands_unbind_unknown")return}}g("vm_hands.unbind_heal_exhausted",{operation_id:S,attempts:qe.length})})().finally(()=>m.delete(h))}async function Ge(e,n){let i=[...e.modelOps.get(n)??[]];for(let s of i)s.abort.abort();await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))])}async function Pn(e,n){let i=[...e.personTerminals].filter((s)=>s.session===null||s.session===n);for(let s of i)s.abort.abort();if(i.length)await Promise.race([Promise.all(i.map((s)=>s.settled)),new Promise((s)=>setTimeout(s,$e))]);return i.length}function En(e){let n=e.payload,i=n?.workspace?.kind==="managed"?n.workspace.workspaceId:void 0;return typeof i==="string"&&/^[0-9a-f-]{36}$/i.test(i)?i.toLowerCase():null}async function J(e,n,i){return await Ge(e,i),n.unbind(i)}function de(e){for(let n of e.outbox?.splice(0)??[])n.reject(Error("vm_hands_attempt_ended"))}var Ne=15000,Tn=1e4,Rn=1000;async function Ia(e){let n=Date.now(),i={deviceId:null,connection:null,turns:new Map,lostAt:0,receipts:[],attest:"pending",attestWaiters:[],modelOps:new Map,personTerminals:new Set,bindsStarting:new Map},s=e.log??(()=>{}),g=async(S)=>{for(let[w,I]of[...i.turns]){i.turns.delete(w),e.onTurn?.(w,null),de(I);let b=await J(i,e.agent,w).catch(()=>null);if(b)i.receipts.push({turn:I,failure:"vm_hands_bind_lost",unbound:b});s("vm_hands.bound_dropped",{reason:S})}},h=0,m=0;try{for(let S=0;!e.signal.aborted;S++){let w=await An(e,i).catch((b)=>{if(b instanceof l&&i.deviceId===null&&b.code==="vm_hands_no_session"&&Date.now()-n<gn)return{closeCode:0,closeReason:"vm_hands_no_session"};if(b instanceof l&&i.deviceId===null&&fn.has(b.code)&&h<pn&&Date.now()-n<vn)return h++,m=je(h),s("vm_hands.register_retry",{attempt:h,code:b.code,delay_ms:m}),{closeCode:0,closeReason:"vm_hands_register_retry"};if(b instanceof l&&i.deviceId===null)throw b;return{closeCode:0,closeReason:b instanceof Error?b.message:String(b)}});if(s("vm_hands.session_closed",{close_code:w.closeCode,reason:w.closeReason.slice(0,120),registered:i.deviceId!==null}),w.closeCode===4401||i.attest==="refused")return;if(e.signal.aborted)return;if(i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline");if(i.served)i.served=!1,S=0;let I=w.closeReason==="drain_reconnect"?0:w.closeReason==="vm_hands_register_retry"?m:w.closeReason==="vm_hands_no_session"?Math.min(250*2**Math.min(S,5),2000):i.turns.size?Math.min(250*2**Math.min(S,5),5000,Math.max(0,i.lostAt+be-Date.now())):Math.min(500*2**S,30000);if(await new Promise((b)=>setTimeout(b,I)),i.turns.size&&Date.now()-i.lostAt>=be)await g("reconnect_deadline")}}finally{await g("session_ended")}}async function An(e,n){let i=n.deviceId,s=e.log??(()=>{}),g=i?`/app/local-runtime/session?device_id=${encodeURIComponent(i)}`:an,h=`${e.apiOrigin.replace(/^http/,"ws")}${g}`,m=new WebSocket(h),S=0,w="",I=new Map,b=[],R=null,ce=new Promise((t)=>{m.onclose=(a)=>{S=a.code,w=a.reason;for(let r of I.values())r.reject(new B(`session closed ${a.code}`));for(let r of n.attestWaiters.splice(0))r(!1);I.clear(),t()}});m.onmessage=(t)=>{let a;try{a=JSON.parse(String(t.data))}catch{m.close(4400);return}if(a.t==="res"){let r=a;I.get(r.id)?.resolve({status:r.status,body:r.body}),I.delete(r.id);return}if(a.t==="reconnect"){let r=Math.max(0,Math.min(Number(a.after_ms)||0,Rn));s("vm_hands.drain_reconnect",{after_ms:r}),setTimeout(()=>{try{m.close(4001,"drain_reconnect")}catch{}},r).unref?.();return}if(!R?.(a))b.push(a)};let Y=(t,a)=>new Promise((r,o)=>{let u=b.findIndex((f)=>t.includes(f.t));if(u>=0){r(b.splice(u,1)[0]);return}let p=setTimeout(()=>{R=null,o(new l("vm_hands_no_register",`no ${t.join("/")} in ${a} ms`))},a);R=(f)=>{if(!t.includes(f.t))return!1;return clearTimeout(p),R=null,r(f),!0}}),X=(t)=>m.send(JSON.stringify(t)),C=(t,a)=>new Promise((r,o)=>{if(m.readyState!==WebSocket.OPEN){o(new B("session closed"));return}let u=on(),p=typeof a.wait_ms==="number"?a.wait_ms:0,f=setTimeout(()=>{if(!I.delete(u))return;o(new B(`no answer to ${t.split("/").pop()} in ${p+Ne} ms`)),m.close(4000,"request_timeout")},p+Ne);I.set(u,{reject:(c)=>{clearTimeout(f),o(c)},resolve:({status:c,body:d})=>{clearTimeout(f);let _=null;try{_=d?JSON.parse(d):null}catch{}r({status:c,json:_})}}),X({t:"req",id:u,path:`${dn}${t}`,body:JSON.stringify(a)})}),ye=()=>m.close(1001,"stopping");e.signal.addEventListener("abort",ye,{once:!0});let le,Q=new Map,Z=new Map,ue=!1,_e=new Set,me=Promise.resolve(),ke=()=>{te().catch(()=>{return})},ee=!1;try{await new Promise((c,d)=>{let _=setTimeout(()=>d(Error("session open timeout")),Tn);m.onopen=()=>{clearTimeout(_),s("vm_hands.ws_open",{}),c()},m.onerror=()=>{clearTimeout(_),d(Error("session socket error"))}});let t=await Y(["challenge"],5000);s("vm_hands.challenge",{});let a=[],r=null,o;if(i){X(await e.agent.helloFrame(t.challenge,n.connection));let c=await Y(["ready"],1e4);if(typeof c.vm_hands_connection==="string")n.connection=c.vm_hands_connection;if(o={device_id:i,...c.cadence?{cadence:c.cadence}:{}},typeof c.vm_hands_probe_script==="string"){if(r=c.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.reconnected",{device_id:i});let d=Array.isArray(c.vm_hands_binds)?c.vm_hands_binds:c.vm_hands_bind?[c.vm_hands_bind]:[];for(let[_,y]of[...n.turns]){if(d.some((A)=>A&&A.operation_id===y.claim.operation_id&&A.attempt_id===y.claim.attempt_id)){a.push(y),s("vm_hands.bound_resumed",{operation_id:y.claim.operation_id});continue}n.turns.delete(_),e.onTurn?.(_,null),de(y);let P=await J(n,e.agent,_).catch((A)=>ne(A,y,"vm_hands_bind_lost"));if(P)n.receipts.push({turn:y,failure:"vm_hands_bind_lost",unbound:P});s("vm_hands.bound_dropped",{reason:"not_named_on_reconnect"})}}else{X(await e.agent.registerFrame(t.challenge)),s("vm_hands.register_sent",{});let c=await Promise.race([Y(["registered","register_refused"],1e4),ce.then(()=>{throw new l(w==="register_failed"?"vm_hands_register_failed":"vm_hands_register_closed","session closed before the register was answered")})]);if(c.t==="register_refused")throw new l(c.code,"register refused");e.agent.registered();let d=c;if(o=d,n.deviceId=d.device_id,typeof d.vm_hands_connection==="string")n.connection=d.vm_hands_connection;if(typeof d.vm_hands_probe_script==="string"){if(r=d.vm_hands_probe_script,ee=!0,e.agent.phase==="registered"&&!n.turns.size)n.attest="pending"}n.served=!0,s("vm_hands.registered",{device_id:o.device_id})}let u=async()=>{let c=await C("/heartbeat",await e.heartbeat());if(c.status>=300)throw Error(`heartbeat ${c.status}`)};await u();let p=o.cadence?.presence_interval_ms??30000;if(le=setInterval(()=>{u().catch(()=>m.close())},p),e.onHeartbeatNow?.(()=>{u().catch(()=>m.close())}),n.request=C,ce.then(()=>{if(n.request===C)n.request=null}),r&&n.attest!=="accepted"&&e.agent.phase==="registered"&&!n.turns.size)He(r,t.challenge);let f=(c,d)=>{Z.set(c,d().catch(async(_)=>{if(await Se(_,c),_ instanceof B)m.close();else await te().catch(()=>{return})}).finally(()=>{Z.delete(c)}))};n.flushReceipts=ke;try{await te();for(let c of a)c.flush=()=>Ie(c),c.flush(),f(c.claim.attempt_id,()=>Pe(c));while(!e.signal.aborted&&m.readyState===WebSocket.OPEN){let c=await C("/operations/claim",{wait_ms:Math.min(o.cadence?.claim_wait_ms??Be,Be)});if(c.status===204||!c.json)continue;if(c.status>=300)throw Error(`claim ${c.status}`);let d=c.json;if(d.capability==="hands.connect"){if(Z.has(d.attempt_id)){O({claim:d,eventSeq:0}).complete("failed",{error_code:"vm_hands_busy"}).catch(()=>{return});continue}f(d.attempt_id,()=>ze(d))}else Ve(d).catch(()=>{return})}}catch(c){await Se(c,null)}}finally{if(le)clearInterval(le);e.signal.removeEventListener("abort",ye);for(let t of n.turns.values())t.flush=null;if(n.flushReceipts===ke)n.flushReceipts=null;m.close(),await ce,await Promise.all([...Z.values()]);for(let t of e.agent.liveBindIds){if(n.turns.has(t))continue;let a=Q.get(t),r=a?{...a,eventSeq:a.eventSeq+1}:null,o=await J(n,e.agent,t).catch((u)=>r?ne(u,r,"vm_hands_bind_lost"):null);if(o&&r)n.receipts.push({turn:r,failure:"vm_hands_bind_lost",unbound:o});s("vm_hands.bound_dropped",{reason:"bound_after_loss"})}}return{closeCode:S,closeReason:w};async function Se(t,a){if(t instanceof B){if(!ue&&n.turns.size)n.lostAt=Date.now();ue=!0}else{let r=a!==null?[a]:[...new Set([...n.turns.keys(),...e.agent.liveBindIds])];if(a===null)ue=!0;for(let o of r){let u=n.turns.get(o);if(n.turns.delete(o),u)de(u),e.onTurn?.(o,null);if(e.agent.liveBindIds.includes(o)){let p=Q.get(o)??u,f=p?{...p,eventSeq:p.eventSeq+1}:null,c=await J(n,e.agent,o).catch((d)=>f?ne(d,f,"vm_hands_bind_lost"):null);if(c&&f)n.receipts.push({turn:f,failure:"vm_hands_bind_lost",unbound:c})}}}s("vm_hands.session_lost",{error:t instanceof Error?t.message:String(t),bound_kept:n.turns.size})}function O(t,a=C){let r=a,o=t.claim,u={attempt_id:o.attempt_id,attempt_token:o.attempt_token},p=encodeURIComponent(o.operation_id);return{fence:u,op:p,complete:(c,d={})=>r(`/operations/${p}/complete`,{...u,status:c,...d}),emit:(c,d)=>{let _=(t.chain??Promise.resolve()).catch(()=>{return}).then(()=>f(c,d));return t.chain=_,_}};async function f(c,d){let _=t.eventSeq,y=(x)=>r(`/operations/${p}/events`,{...u,event_seq_start:x,events:[{kind:c,payload:{sequence:x,capability:String(o.capability??"hands.connect"),data:d}}]}),P=_,A=await y(P),D=A.status===409?A.json?.expected_event_seq:void 0;if(typeof D==="number"&&D>=0&&D!==_)P=D,A=await y(P);if(A.status<300)t.eventSeq=P+1;return A}}function We(t){return(a,r)=>new Promise((o,u)=>{if(n.turns.get(t.claim.attempt_id)!==t){u(Error("vm_hands_attempt_ended"));return}if(t.outbox??=[],t.outbox.length>=Sn){u(Error("vm_hands_outbox_full"));return}t.outbox.push({kind:a,data:r,resolve:o,reject:u}),t.flush?.()})}function Ie(t){if(_e.has(t))return;_e.add(t),(async()=>{try{while(t.outbox?.length&&n.turns.get(t.claim.attempt_id)===t&&m.readyState===WebSocket.OPEN){let a=t.outbox[0],r;try{r=await O(t).emit(a.kind,a.data)}catch(o){if(o instanceof B)return;r={status:500}}if(t.outbox.shift(),r.status<300)a.resolve();else a.reject(Error(`${a.kind} refused ${r.status}`))}}finally{_e.delete(t)}})()}async function He(t,a){try{let r=await e.agent.attestFrame(t,a);if(m.readyState!==WebSocket.OPEN)return;X(r);let o=await Y(["attested","attest_refused"],15000);n.attest=o.t==="attested"?"accepted":"refused";for(let u of n.attestWaiters.splice(0))u(n.attest==="accepted");if(s("vm_hands.attest",{result:n.attest,exit_code:r.exit_code,...o.t==="attest_refused"?{code:String(o.code??"")}:{}}),n.attest==="refused")m.close(4401,"attest_refused")}catch(r){s("vm_hands.attest_failed",{code:r instanceof l?r.code:"probe_error"});for(let o of n.attestWaiters.splice(0))o(!1);if(n.attest!=="accepted")m.close(4000,"attest_unanswered")}}async function ze(t){let a=ee&&n.attest==="pending",r=t.vm_hands_attest,o=r;if(n.attest==="refused"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(o==="accepted"){if(!a&&n.attest!=="accepted"){n.attest="accepted";for(let k of n.attestWaiters.splice(0))k(!0)}}else if(o!=="pending"||!a&&n.attest!=="accepted"){s("vm_hands.claim_attest_refused",{said:typeof r==="string"?r.slice(0,16):typeof r,local:n.attest}),await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}if(n.attest!=="accepted"){let k=Date.parse(t.lease_until)-Date.now()-5000,j=Math.max(0,Math.min(ae,Number.isFinite(k)?k:ae));if(!await new Promise((E)=>{let T=setTimeout(()=>E(!1),j);n.attestWaiters.push((G)=>{clearTimeout(T),E(G)})})){await O({claim:t,eventSeq:0}).complete("failed",{error_code:"vm_hands_unattested"}).catch(()=>{return});return}}let u={claim:t,eventSeq:0},{complete:p,emit:f}=O(u),c;try{if(t.capability!=="hands.connect")throw new l("vm_hands_bind_invalid","not hands.connect");c=!pe(t)}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_invalid"});return}let d,_=null,y=!1,P,A=new Promise((k)=>{P=k}),D=(()=>{try{return ve(t).session_id.toLowerCase()}catch{return String(t.run_id)}})();n.bindsStarting.set(D,(n.bindsStarting.get(D)??0)+1);try{let k=await Pn(n,D);if(k)s("vm_hands.person_terminals_closed",{count:k});let j=ve(t),v=e.agent.bind(j);if(j.workspace_deferred){y=!0;let E={value:!1};_=Fe(u,()=>y,E),Ke(u,_,E,()=>y,A)}d=await v}catch(k){s("vm_hands.bind_refused",{code:k instanceof l?k.code:"unexpected"}),await p("failed",{error_code:k instanceof l?k.code:"vm_hands_bind_failed"});return}finally{y=!1,P();let k=(n.bindsStarting.get(D)??1)-1;if(k>0)n.bindsStarting.set(D,k);else n.bindsStarting.delete(D)}let x=_?await _:-1,U={...d.ready_data??e.readyData({launchId:d.launch_id,claim:t})};if(c)delete U.environment_installed;let ie=!c&&d.snapshot_revision!==null&&d.snapshot_id!==null?{environment_installed:{snapshot_id:d.snapshot_id,installed_revision:d.snapshot_revision}}:{};Q.set(t.attempt_id,{claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:-1});let se={...U,...ie,vm_hands:{layout:d.layout,policy_digest:d.policy_digest,launch_id:d.launch_id}},F=Date.now()+yn,q=1,M=await f("hands.ready",se);while(kn(M.status)&&!e.signal.aborted){let k=je(q);if(Date.now()+k>=F)break;await new Promise((j)=>setTimeout(j,k)),q++,M=await f("hands.ready",se)}if(q>1)s("vm_hands.ready_retried",{attempts:q,status_class:`${Math.floor(M.status/100)}xx`});if(Q.delete(t.attempt_id),M.status>=300){await Ge(n,t.attempt_id),await e.agent.boundRefused(t.attempt_id),await p("failed",{error_code:Ce(M.json?.error,"vm_hands_probe_failed")});return}let N={claim:t,launchId:d.launch_id,readyData:U,eventSeq:u.eventSeq,ackSeq:x};n.turns.set(t.attempt_id,N),N.flush=()=>Ie(N),e.onTurn?.(t.attempt_id,We(N)),await Pe(N)}async function Fe(t,a,r){let{fence:o,op:u}=O(t),p=t.claim.attempt_id,f=-1;try{for(;;){let c=await C(`/operations/${u}/heartbeat`,{...o,control_ack_seq:f,wait_ms:we});if(!a())return f;if(c.status>=300)return e.agent.abandonWorkspaceGrant(p),f;let d=(c.json?.controls??[]).slice().sort((_,y)=>_.seq-y.seq);for(let _ of d){if(_.seq<=f)continue;if(f=_.seq,_.kind===As){if(s("vm_hands.workspace_granted",{}),e.agent.grantWorkspace(p),r)r.value=!0;return f}return s("vm_hands.workspace_grant_abandoned",{control:/^[a-z][a-z0-9._-]{0,63}$/.test(_.kind)?_.kind:"other"}),e.agent.abandonWorkspaceGrant(p),f}}}catch{return e.agent.abandonWorkspaceGrant(p),f}}async function Ke(t,a,r,o,u){let p=await a;if(!r.value)return;let{fence:f,op:c}=O(t);while(o()){if(await Promise.race([u,new Promise((P)=>setTimeout(P,cn))]),!o())return;let d=await C(`/operations/${c}/heartbeat`,{...f,control_ack_seq:p,wait_ms:0}).catch(()=>null);if(!d||!o())return;let _=d.json?.controls??[];if(d.status>=400&&d.status<500&&d.status!==429||_.some((P)=>P.seq>p&&(P.kind==="operation.cancel"||P.kind==="cancel"))){s("vm_hands.pre_bind_abandoned",{status_class:`${Math.floor(d.status/100)}xx`}),e.agent.abandonBinding(t.claim.attempt_id);return}}}async function Pe(t){let{fence:a,op:r}=O(t),o=null,u=null,p=e.agent.executorExited(t.claim.attempt_id).then((f)=>(u=f,null));e:for(;;){let f=await Promise.race([p,C(`/operations/${r}/heartbeat`,{...a,control_ack_seq:t.ackSeq,wait_ms:we})]);if(!f){o="vm_hands_executor_exited",s("vm_hands.executor_exited",{reason:u});break}if(f.status>=300)break;let c=(f.json?.controls??[]).slice().sort((d,_)=>d.seq-_.seq);for(let d of c){if(d.seq<=t.ackSeq)continue;if(d.kind==="operation.cancel"||d.kind==="cancel"){t.ackSeq=d.seq;break e}if(d.kind===Lr)try{await Je(t,d.payload??{})}catch(_){if(_ instanceof B)throw _;o=_ instanceof l?_.code:"environment_unavailable";let y=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"&&/^[a-z][a-z0-9_]{2,63}$/.test(_.code)?_.code:null;s("vm_hands.environment_refused",{code:o,cause:y});break e}t.ackSeq=d.seq}}await Le(t,o)}async function he(t,a){let r=Date.now()+mn;for(;;){let o=n.request;if(o)try{return await o(t,a)}catch(u){if(!(u instanceof B))throw u}if(Date.now()>=r||e.signal.aborted)throw new B("kept operation has no live session");await new Promise((u)=>setTimeout(u,500))}}async function Ve(t){let a=t,r={claim:a,eventSeq:0},o=String(t.capability??""),u=o===_n,{complete:p,emit:f,fence:c,op:d}={...O(r,he)},_=t.vm_hands_origin==="person"?"person":"model";if(!e.executeOp){await p("failed",{error_code:"vm_hands_op_unsupported"});return}if(t.vm_hands_attest==="accepted"&&n.attest==="pending"&&!(ee&&n.attest==="pending")){n.attest="accepted";for(let v of n.attestWaiters.splice(0))v(!0)}if(n.attest!=="accepted"){let v=Date.parse(String(t.lease_until??""))-Date.now()-5000,E=n.attest==="refused"?0:Math.max(0,Math.min(ae,Number.isFinite(v)?v:ae));if(!(E>0&&await new Promise((G)=>{let Ye=setTimeout(()=>G(!1),E);n.attestWaiters.push((Xe)=>{clearTimeout(Ye),G(Xe)})}))){await p("failed",{error_code:"vm_hands_unattested"});return}}let y=e.agent.bindIdForRun(a.run_id);if(_==="model"&&y===null){await p("failed",{error_code:"vm_hands_not_bound"});return}let P=o==="pty.start"&&_==="person"&&!t.authority,A=P?En(t):null;if(P&&((v)=>v===null?e.agent.liveBindIds.length>0||n.bindsStarting.size>0:e.agent.liveSessionIds.includes(v)||n.bindsStarting.has(v))(A)){await p("failed",{error_code:"vm_hands_bound"});return}if(un.has(o)&&!P&&e.agent.liveBindIds.length===0){await p("failed",{error_code:"vm_hands_not_bound"});return}let x=new AbortController,U=()=>x.abort();e.signal.addEventListener("abort",U,{once:!0});let ie,se=new Promise((v)=>{ie=v}),F={abort:x,settled:se},q=P?{...F,session:A}:null;if(q)n.personTerminals.add(q);if(_==="model"&&y&&o!=="preview.serve.v1"){let v=n.modelOps.get(y)??new Set;v.add(F),n.modelOps.set(y,v),await e.agent.environmentInstalled(y,hn,x.signal)}let M=-1,N=!1,k=!1,j=u?void 0:setInterval(()=>{if(k)return;k=!0,he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:0}).then((v)=>{if(v.status>=300){x.abort();return}let E=v.json?.controls??[];for(let T of E)if(M=Math.max(M,T.seq),T.kind==="operation.cancel"||T.kind==="cancel")x.abort()},()=>x.abort()).finally(()=>{k=!1})},ln);if(u)(async()=>{while(!N&&!x.signal.aborted){let v;try{v=await he(`/operations/${d}/heartbeat`,{...c,control_ack_seq:M,wait_ms:we})}catch{x.abort();return}if(N)return;if(v.status>=300){x.abort();return}let E=(v.json?.controls??[]).slice().sort((T,G)=>T.seq-G.seq);for(let T of E){if(T.seq<=M)continue;if(T.kind==="operation.cancel"||T.kind==="cancel")x.abort();else await e.controlOp?.({claim:t,control:T}).catch(()=>!1);M=T.seq}}})();try{let v=await e.executeOp({kind:_,claim:t,..._==="model"&&y?{bindId:y}:{},signal:x.signal,emit:async(T)=>{await f(T.kind,T.data??{})}}),E=await p(v.status,{...v.result?{result:v.result}:{},...v.error_code?{error_code:Ce(v.error_code,"vm_hands_op_failed")}:{}});e.opCompleted?.({claim:t,status:v.status,acknowledged:E.status<300}),s("vm_hands.op",{capability:o,kind:_,status:v.status,code:v.error_code??null,...E.status>=300?{complete_status:E.status,complete_error:String(E.json?.error??"").slice(0,64)}:{}})}finally{if(N=!0,clearInterval(j),e.signal.removeEventListener("abort",U),y)n.modelOps.get(y)?.delete(F);if(q)n.personTerminals.delete(q);ie()}}async function Le(t,a){let r=t.claim.attempt_id;if(n.turns.get(r)===t)n.turns.delete(r);e.onTurn?.(r,null),de(t);let o=await J(n,e.agent,r).catch((u)=>ne(u,t,a));if(!o)return;n.receipts.push({turn:t,failure:a,unbound:o}),await te()}function ne(t,a,r){let o=Ue(t);return s("vm_hands.unbind_unverified",{operation_id:a.claim.operation_id,code:o,attempt:0}),O(a).emit(Ps,{code:o}).catch(()=>{return}),In(n,e.agent,{turn:a,failure:r},e.signal,s),null}function te(){return me=me.then(Ee,Ee),me}async function Ee(){while(n.receipts.length){let{turn:t,failure:a,unbound:r}=n.receipts[0],{complete:o,emit:u}=O(t);try{if(await u("hands.stopped",{...t.readyData,reason_code:a?"failed":"cancelled",killed_verified:r.killed_verified,shredded:r.shredded,...r.srt_fallbacks?{vm_hands_srt_fallbacks:r.srt_fallbacks}:{}}),a)await o("failed",{error_code:a});else await o("cancelled",{error_code:"driver_stopped"})}catch(p){if(p instanceof B)return}n.receipts.shift()}}async function Je(t,a){let{fence:r,op:o}=O(t),u=a.snapshot_id;if(a.version!==1||typeof u!=="string"||Object.keys(a).length!==2)throw new l("vm_hands_env_invalid","invalid environment delivery");let p=await C(`/operations/${o}/environment`,{...r,snapshot_id:u}),f=p.json?.environment_sealed;if(p.status!==200||!f||p.json?.payload!==void 0)throw new l("vm_hands_env_invalid","environment not delivered sealed");let c=await e.agent.deliverEnvironment({attemptId:t.claim.attempt_id,snapshotId:u,deviceId:n.deviceId??"",sealed:f});if((await C(`/operations/${o}/environment-ack`,{...r,...c})).status>=300)throw new l("vm_hands_env_ack_refused","environment ack refused")}}import{readFileSync as On}from"fs";var xn=performance.now();delete process.env.BUN_BE_BUN;var z=(e,n={})=>console.log(JSON.stringify({stage:e,ms:Math.round(performance.now()),...n}));async function Dn(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:h}=await import("./vm-hands-op-runner-86zndw34.js");await h();return}z("parsed",{t0:Math.round(xn)});let e="";try{e=On(3,"utf8")}catch{}z("fd3_read",{bytes:e.length});let n=null;if(e.trim())try{n=JSON.parse(e)}catch{n=null}if(!n||typeof n!=="object"||Array.isArray(n))z(e.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:i,runVmHands:s}=await import("./vm-hands-runtime-ad8q3cjr.js"),g=i(n);if(!g)z("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});try{await s(g,z)}catch(h){let m=h&&typeof h==="object"&&"code"in h&&typeof h.code==="string"?h.code:"error";throw z("failed",{code:m}),h}process.exit(0)}Dn();export{Ta,co,Ia};

package/bin/vm-hands/{vm-hands-executor-xd8v5v0e.js → vm-hands-executor-e75we703.js}

@@ -1,5 +1,5 @@
 // @bun
-import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-h7f5a5mb.js";import{Qe,nn,hi,an,et}from"./vm-hands-entry-lite-mktndd2r.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-bbjsnjct.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import{qn,Wn,Wr,Vr}from"./vm-hands-entry-lite-y2vqwds4.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-04nx5y4f.js";import{spawn as Me}from"child_process";import{chmodSync as Le,chownSync as Te,existsSync as E,lstatSync as ee,mkdirSync as J,mkdtempSync as We,readdirSync as X,readFileSync as k,realpathSync as He,rmdirSync as pe,rmSync as ze,writeFileSync as B}from"fs";import{basename as Ue,dirname as Be,join as p}from"path";import{readFileSync as ae,readlinkSync as ce}from"fs";import{relative as Ne}from"path";var ue=16;function le(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function De(e){let r=[];for(let t of e.split(`
+import"./vm-hands-entry-lite-6dkjbe2b.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-sk4qxvzq.js";import"./vm-hands-entry-lite-h7f5a5mb.js";import{Qe,nn,hi,an,et}from"./vm-hands-entry-lite-7x2dnf35.js";import"./vm-hands-entry-lite-cg84jcgd.js";import"./vm-hands-entry-lite-13pzgnj9.js";import"./vm-hands-entry-lite-pnx4zgd6.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-a4fn6ye1.js";import"./vm-hands-entry-lite-ttemn34n.js";import"./vm-hands-entry-lite-dh87ysh2.js";import{qn,Wn,Wr,Vr}from"./vm-hands-entry-lite-vgwm0t9m.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-04nx5y4f.js";import{spawn as Me}from"child_process";import{chmodSync as Le,chownSync as Te,existsSync as E,lstatSync as ee,mkdirSync as J,mkdtempSync as We,readdirSync as X,readFileSync as k,realpathSync as He,rmdirSync as pe,rmSync as ze,writeFileSync as B}from"fs";import{basename as Ue,dirname as Be,join as p}from"path";import{readFileSync as ae,readlinkSync as ce}from"fs";import{relative as Ne}from"path";var ue=16;function le(e){return e.replace(/\\([0-7]{3})/g,(r,t)=>String.fromCharCode(Number.parseInt(t,8)))}function De(e){let r=[];for(let t of e.split(`
 `)){let n=t.split(" ");if(n.length<10||!/^\d+:\d+$/.test(n[2]))continue;r.push({device:n[2],root:le(n[3]),mountPoint:le(n[4])})}return r}function Ae(e,r,t){let n=e.replace(/\/+$/,"")||"/",c=(m)=>n==="/"||m===n||m.startsWith(`${n}/`),o=(m)=>new Map(De(m).filter((_)=>c(_.mountPoint)).map((_)=>[`${_.mountPoint}\x00${_.device}\x00${_.root}`,_.mountPoint])),l=o(r),d=o(t),b=(m)=>Ne(n,m)||".",R=[...l].filter(([m])=>!d.has(m)).map(([,m])=>b(m)),N=[...d].filter(([m])=>!l.has(m)).map(([,m])=>b(m));return{missing:R,extra:N,referenceCount:l.size,ownCount:d.size}}function de(e,r,t,n="/proc"){let c,o,l=null;try{c=ae(`${n}/1/mountinfo`,"utf8"),o=ae(`${n}/self/mountinfo`,"utf8")}catch(_){let O=_&&typeof _==="object"&&"code"in _&&typeof _.code==="string"?_.code:"unreadable";r("vm_hands.mount_check_unavailable",{code:O});return}try{l=ce(`${n}/1/ns/mnt`)===ce(`${n}/self/ns/mnt`)}catch{}let{missing:d,extra:b,referenceCount:R,ownCount:N}=Ae(e,c,o),m={reference_count:R,own_count:N,missing_count:d.length,extra_count:b.length,same_namespace:l};if(b.length)r("vm_hands.mount_extra",{...m,extra:b.slice(0,ue)});if(d.length)throw r("vm_hands.mount_mismatch",{...m,missing:d.slice(0,ue)}),t(`${d.length} mount(s) under the Session root are missing from vm-hands' namespace`)}var ve="/sys/fs/cgroup/reason-payload",L="vm-hands",Fe="/run/ara-srt/fallbacks.jsonl",oe="/reason-person",Ke="/reason-workload",je="surface",ne=5000,Ge=1e4,fe="__VM_HANDS_PROOF_DIR__",Ee="__VM_HANDS_PROBE_NONCE__";class w extends Error{code;constructor(e,r){super(r);this.code=e}}function Ve(e,r){if(!/^[0-9a-f-]{36}$/i.test(r))throw new w("vm_hands_bind_invalid","bad bind id");return p(e,L,`b-${r.toLowerCase()}`)}var Je=5000,be=(e)=>`'${e.replaceAll("'","'\\''")}'`;function Ze(e,r){if(!r||!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(r))return e;let t=p(Be(e),r.toLowerCase());return Ue(e).toLowerCase()===r.toLowerCase()?e:t}function wn(e){let r=e.cgroup??ve,t=e.init.layout.payload_uid,n=e.init.workload_ended!==!0,c=(s)=>U(s,oe)||n&&U(s,Ke),o=e.log??(()=>{}),l=(s)=>Ze(e.init.layout.session_root,s),d=new Map,b=new Map,R=0,N=()=>{try{let s=k("/run/ara-srt/starts.jsonl","utf8"),i=s.slice(R>s.length?0:R).split(`
 `).filter(Boolean);R=s.length;let u=i.map((f)=>{try{return Number(JSON.parse(f).elapsed_ms)||0}catch{return 0}});if(u.length)o("vm_hands.srt_server_starts",{count:u.length,elapsed_ms:u.slice(0,8)})}catch{}},m=null,_=!1,O=e.srtCgroup??"/sys/fs/cgroup/reason-srt",x=()=>{m??=me()},P=0,F=()=>{try{let s=k(Fe,"utf8"),i=s.slice(P>s.length?0:P);P=s.length;let u=i.split(`
 `).filter(Boolean).slice(0,1000);if(!u.length)return null;let f={},g=0;for(let S of u)try{let h=JSON.parse(S),y=typeof h.code==="string"&&/^[a-z_]{1,40}$/.test(h.code)?h.code:"other";if(f[y]=(f[y]??0)+1,typeof h.elapsed_ms==="number")g=Math.max(g,h.elapsed_ms)}catch{f.unparsed=(f.unparsed??0)+1}return o("vm_hands.srt_fallbacks",{count:u.length,codes:f,max_elapsed_ms:g}),{count:u.length,codes:f,max_elapsed_ms:g}}catch{return null}},I=(s,i,u)=>Ce(s,i,u),K=(s)=>(i,u,f)=>Me("/bin/sh",["-c",`echo $$ > ${be(p(s,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",i,...u],f),Ce=K(p(r,L)),j=p(r,L,"probe"),W=(s)=>Ve(r,s),Oe=(s)=>{let i=W(s);try{J(i,{mode:493})}catch(u){if(!(u&&typeof u==="object"&&("code"in u)&&u.code==="EEXIST"))throw new w("vm_hands_bind_failed","bind cgroup")}return i},xe=(s)=>{try{pe(W(s))}catch{}},H=e.prespawn?nn({spawnProcess:I,...e.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:e.relayDependencies.sourceEntrypoint}:{},log:(s,i)=>o(s,i??{})}):null;H?.arm();let Y=H?setInterval(()=>{H.arm()},Je):null;Y?.unref?.();let q=new Set;async function G(s){let i=d.get(s);if(d.delete(s),!i)return;i.abort.abort(),await i.done}return{bindCgroup:W,async startExecutor(s){if(x(),b.set(s.bindId,me()),_=!0,!s.claim)throw new w("vm_hands_bind_invalid","an executor needs the claim it serves");await G(s.bindId);let{claim:i,bindId:u}=s,f=Oe(u),g=i.owner;if(!g||typeof g.device_id!=="string"||typeof i.root_id!=="string")throw new w("vm_hands_bind_invalid","claim without its owner Device or root");let S=new AbortController,h,y,D=new Promise((a,v)=>{h=a,y=v}),A,C=new Promise((a)=>{A=a}),z=et({headless:!0,hostExecution:!0,runtimeDirectory:e.runtimeDirectory,managedPty:{version:1,startupVerified:!0},deviceIdentity:{deviceId:g.device_id,rootId:i.root_id,apiOrigin:e.apiOrigin},claimOwner:i.owner,root:e.root,runId:i.run_id,operationId:i.operation_id,attemptId:i.attempt_id,payload:Object.fromEntries(Object.entries(i.payload).filter(([a])=>!a.startsWith("vm_hands_"))),signal:S.signal,...s.workspaceGrant?{workspaceGrant:s.workspaceGrant}:{},emitEvent:async(a,v)=>{if(a==="hands.ready"){h(v);return}if(a==="hands.started"||a==="hands.stopped"||a==="hands.failed")return;await e.forward(u,a,v)}},{...e.relayDependencies,spawnWorker:(a)=>K(f)(a.command,a.args,a.options),...H?{takePrespawnedWorker:(a)=>{let v=H.take(a);if(!v?.pid)return v;try{return B(p(f,"cgroup.procs"),String(v.pid)),v}catch{try{v.kill("SIGKILL")}catch{}return null}},adoptSpawnedWorker:H.adopt}:{}}).then(()=>{A("executor_stopped")},(a)=>{let v=a&&typeof a==="object"&&"code"in a?String(a.code):"executor_failed";y(new w(v,a instanceof Error?a.message:String(a))),A(v)}).finally(()=>y(new w("vm_hands_executor_exited","executor ended before it was ready")));if(d.set(u,{abort:S,done:z,exited:C,operationId:i.operation_id,runId:i.run_id,expiresAtMs:Date.parse(String(i.payload.expires_at??""))||0}),q.delete(u))G(u).catch(()=>{return});let M=await D,V=M.executor_launch_id;if(typeof V!=="string")throw new w("vm_hands_bind_failed","executor ready without a launch id");return{launchId:V,readyData:M,applied:{hands_confinement:typeof i.payload.hands_confinement==="string"?i.payload.hands_confinement:null,browser_egress:i.payload.browser_egress??null}}},takeSrtFallbacks:F,executorExited(s){return d.get(s)?.exited??new Promise(()=>{})},abortExecutor(s){if(!d.has(s)){q.add(s);return}G(s).catch(()=>{return})},freezeBind(s){let i=W(s);if(E(p(i,"cgroup.freeze")))B(p(i,"cgroup.freeze"),"1")},async killAndVerifyPayload(s){if(s?.bindId)q.delete(s.bindId);let i=new Set(s?.keep??[]);if(await Ie(s?.bindId??null,i,s?.own===!0),i.size)return;if((_||e.srtWarmLate?.()===!0)&&E(p(O,"cgroup.events")))N(),await re(O,Date.now()+ne,"srt"),e.onSrtReset?.();_=!1},async killProbe(){let s=Date.now()+ne;if(E(p(j,"cgroup.events"))){await re(j,s,"probe");try{pe(j)}catch{}}let i=ie(process.pid);if(i===null)throw new w("vm_hands_kill_unverified","agent start time unreadable");await Xe(r,i,s);let u=(g)=>{let S=ie(g);return S!==null&&S<=i},f=_e(t).filter((g)=>u(g)&&!c(g));if(f.length)throw o("vm_hands.kill_survivors",{pids:f.slice(0,16),at:"attest",...ge(f)}),new w("vm_hands_kill_unverified",`${f.length} payload-uid process(es) from before this agent`);if(m!==null){let g=[r,p(r,L)].map((y)=>y.replace(/^\/sys\/fs\/cgroup/,"")),S=O.replace(/^\/sys\/fs\/cgroup/,""),h=he(m).filter((y)=>y!==process.pid&&!c(y)&&!U(y,"/reason-vm-hands")&&!U(y,S)&&!g.some((D)=>te(y,D)));if(h.length&&_)throw o("vm_hands.kill_strays",{strays:se(h),at:"attest"}),new w("vm_hands_kill_unverified",`${h.length} process(es) the run started survived it`);if(h.length)o("vm_hands.attest_concurrent",{processes:se(h),count:h.length});m=null}},async runProbe({nonce:s,script:i}){if(x(),!i.includes(fe))throw new w("vm_hands_probe_failed","probe names no proof directory");let u=e.proofParent??"/tmp/reason-vm-hands-proof";J(u,{mode:457,recursive:!0});let f=ee(u);if(f.isSymbolicLink()||!f.isDirectory()||f.uid!==(process.getuid?.()??-1)||(f.mode&4095)!==457)throw new w("vm_hands_probe_failed","proof parent is not root's 0711 directory");let g=We(p(u,"p-")),S=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(g)||!/^[A-Za-z0-9_-]{1,128}$/.test(s))throw new w("vm_hands_probe_failed","proof directory path or nonce");Te(g,t,t),Le(g,448);let h=ee(g).ino;try{J(j,{mode:493})}catch(C){if(!(C&&typeof C==="object"&&("code"in C)&&C.code==="EEXIST"))throw new w("vm_hands_probe_failed","probe cgroup")}let y=K(j)("/bin/bash",["-c",i.replaceAll(fe,g).replaceAll(Ee,s)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]});an();let D="";y.stdout?.on("data",(C)=>{if(D.length<16384)D+=C.toString("utf8").slice(0,16384-D.length)});let A=await new Promise((C)=>{let z=setTimeout(()=>{S=!0,y.kill("SIGKILL"),C(124)},Ge);y.once("error",()=>{clearTimeout(z),C(127)}),y.once("close",(M)=>{clearTimeout(z),C(M??1)})});return o("vm_hands.probe",{nonce_len:s.length,exit_code:A}),{exitCode:A,markers:D,proofDirInode:h}}finally{if(!S)ze(g,{recursive:!0,force:!0})}},restatLayout(s){let i=l(s),u=i===e.init.layout.session_root?e.init.layout.alias:p(i,"repo"),f="invalid";try{hi(i),f="0:0:755"}catch{}let g=!1,S=-1;try{let h=ee(u);S=h.uid,g=f==="0:0:755"&&u===p(i,"repo")&&!h.isSymbolicLink()&&h.isDirectory()&&He(u)===u&&h.uid===t}catch{}return{root_mode:f,alias_ok:g,owner_uid:S}},verifyMounts(s){let i=l(s);try{de(i,o,(u)=>new w("vm_hands_mount_mismatch",u))}catch(u){if(i!==e.init.layout.session_root&&u instanceof w&&u.code==="vm_hands_mount_mismatch"){o("vm_hands.member_mount_mismatch_served",{});return}throw u}},installEnvironment(s,i){let u=d.get(s);if(!u)throw new w("environment_unavailable","no executor owns an environment");return Qe({root:e.root,operationId:u.operationId,payload:i}).installed_revision},async stop(){if(Y)clearInterval(Y);H?.close(),await Promise.all([...d.keys()].map((s)=>G(s)))}};function $e(){try{return X(p(r,L),{withFileTypes:!0}).filter((s)=>s.isDirectory()&&/^b-[0-9a-f-]{36}$/.test(s.name)).map((s)=>s.name)}catch{return[]}}async function Ie(s,i,u=!1){let f=new Set([...i].map((S)=>S.toLowerCase())),g=tn();try{await sn();let S=Date.now()+ne,h=new Set($e().filter((a)=>!f.has(a.slice(2))).map((a)=>a.slice(2)));if(s)h.add(s.toLowerCase());let y=null;for(let a of h){let v=G(a).catch(()=>{return}),Q=b.get(a);if(Q!==void 0)y=y===null?Q:Math.min(y,Q);if(E(p(W(a),"cgroup.events")))await re(W(a),S,"bind");await v}let D=[...f].map((a)=>W(a).replace(/^\/sys\/fs\/cgroup/,"")),A=["/",...[r,p(r,L)].map((a)=>a.replace(/^\/sys\/fs\/cgroup/,""))],C=O.replace(/^\/sys\/fs\/cgroup/,""),z=(a)=>c(a)||D.some((v)=>U(a,v))||A.some((v)=>te(a,v)),M=u?[]:_e(t).filter((a)=>!z(a));if(M.length)throw o("vm_hands.kill_survivors",{pids:M.slice(0,16),beside:f.size,...ge(M)}),new w("vm_hands_kill_unverified",`${M.length} payload-uid process(es) outside a live bind`);let V=(a)=>!z(a)&&!U(a,"/reason-vm-hands")&&!U(a,C)&&!A.some((v)=>te(a,v));if(y!==null){let a=he(y).filter((v)=>v!==process.pid&&V(v));if(a.length)throw o("vm_hands.kill_strays",{strays:se(a),beside:f.size}),new w("vm_hands_kill_unverified",`${a.length} process(es) the run started survived it`)}for(let a of h)b.delete(a),xe(a)}finally{g()}}}function ie(e,r="/proc"){try{let t=k(p(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[19]);return Number.isFinite(n)?n:null}catch{return null}}function Se(e,r="/proc"){try{let t=k(p(r,String(e),"stat"),"utf8"),n=Number(t.slice(t.lastIndexOf(")")+2).split(" ")[1]);return Number.isFinite(n)?n:null}catch{return null}}async function Xe(e,r,t){try{B(p(e,"cgroup.freeze"),"1")}catch(n){throw new w("vm_hands_kill_unverified",`payload cgroup.freeze: ${n instanceof Error?n.message:String(n)}`)}try{for(;;){let n=Pe(e).filter((o)=>ke(o,e)),c=new Set(n.filter((o)=>{let l=ie(o);return l!==null&&l<=r}));for(let o=!0;o;){o=!1;for(let l of n){if(c.has(l))continue;let d=Se(l);if(d!==null&&c.has(d))c.add(l),o=!0}}if(c.size===0)return;if(Date.now()>t)throw new w("vm_hands_kill_unverified",`${c.size} previous-boot process(es) survived`);for(let o of c)try{process.kill(o,"SIGKILL")}catch{}await new Promise((o)=>setTimeout(o,10))}}finally{try{B(p(e,"cgroup.freeze"),"0")}catch{}}}function te(e,r,t="/proc"){try{return k(p(t,String(e),"cgroup"),"utf8").split(`

package/bin/vm-hands/{vm-hands-op-runner-nr4ncs4p.js → vm-hands-op-runner-86zndw34.js}

@@ -1,2 +1,2 @@
 // @bun
-import{qn,Wn,Wr,Vr,Gr,hl}from"./vm-hands-entry-lite-y2vqwds4.js";export{qn as VM_HANDS_OP_RUNNER_PERSON_ARG,Wn as VM_HANDS_OP_RUNNER_SURFACE_ARG,Vr as VM_HANDS_SURFACE_DIRECTORY_ARG,Gr as VM_HANDS_SURFACE_OPS,Wr as VM_HANDS_SURFACE_UID_ARG,hl as runVmHandsOpRunner};
+import{qn,Wn,Wr,Vr,Gr,hl}from"./vm-hands-entry-lite-vgwm0t9m.js";export{qn as VM_HANDS_OP_RUNNER_PERSON_ARG,Wn as VM_HANDS_OP_RUNNER_SURFACE_ARG,Vr as VM_HANDS_SURFACE_DIRECTORY_ARG,Gr as VM_HANDS_SURFACE_OPS,Wr as VM_HANDS_SURFACE_UID_ARG,hl as runVmHandsOpRunner};

package/bin/vm-hands/{vm-hands-runtime-qvy5s122.js → vm-hands-runtime-ad8q3cjr.js}

@@ -1,4 +1,4 @@
 // @bun
-import{er}from"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import{Gr}from"./vm-hands-entry-lite-y2vqwds4.js";import{Ta,co,Ia}from"./vm-hands-entry-lite.js";import{spawn as te}from"child_process";import{createHash as re}from"crypto";import{lstatSync as T,mkdirSync as z,readFileSync as X,statSync as J,writeFileSync as q}from"fs";var x="/run/reason-vm-hands",U="/run/reason-vm-hands/env",H="/run/reason-vm-hands/surface",L="/home/runner/.reason/workspace",oe=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,B="/sys/fs/cgroup/reason-srt",se=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],ae=65536,ie=21600000;function ce(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;z(n,{recursive:!0,mode:448});let t=T(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}q(`${n}/base-keyed`,`1
-`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}var de="/run/ara-srt/starts.jsonl",ue=5;function Y(){try{let r=J(de);return`${r.size}:${r.mtimeMs}`}catch{return""}}function j(r,n){let t=(d)=>{n("srt_warm_skipped",{reason:d});let a=Promise.resolve();return{done:a,listening:a}};if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>ae||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let i;try{let d=T(B);if(!d.isDirectory()||d.uid!==0||(d.mode&18)!==0)return t("cgroup_unsafe");let a=se.find((k)=>T(k,{throwIfNoEntry:!1})!==void 0);if(!a)return t("cgroup_or_exec_missing");i=a;for(let[k,N]of[[i,!1],["/usr/local/bin",!0]]){let w=T(k);if((N?!w.isDirectory():!w.isFile())||w.uid!==0||(w.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),m=Y(),_=re("sha256").update(s).digest("hex"),E=`${x}/srt-base-settings.json`;try{q(E,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let y=te("/bin/sh",["-c",`echo $$ > ${B}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",i,"--settings",E,"--idle-ms",String(ie),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"}),S=null,R=new Promise((d)=>{y.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),d()}),y.once("close",(a)=>{n(a===0?"srt_warm_done":"srt_warm_failed",{exit_code:a,warm_ms:Math.round(performance.now()-l),...S!==null?{after_ms:S}:{},settings_sha256:_}),d()})}),g=!1,b=new Promise((d)=>{R.then(()=>{g=!0,d()});let a=()=>{if(g)return;if(Y()!==m){S=Math.round(performance.now()-l),d();return}setTimeout(a,ue)};a()});return{done:R,listening:b}}var G=3000;function Ne(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:i}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&oe.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!i&&typeof i.key_id==="string"&&Number.isSafeInteger(i.expires_at_ms)&&typeof i.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function M(r){z(r,{recursive:!0,mode:448});let n=J(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function le(r){let[{CLI_VERSION:n},t,s,i]=await Promise.all([import("./version-avq09c5d.js"),import("./hands-worker-source-8a4kh44t.js"),import("./network-contract-ht0psj5j.js"),import("./device-workspace-8941tdsy.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-9r62swp0.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:er,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:i.REASON_WORKSPACE_BASE,workspace_layout:i.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var P=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],Q=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],_e=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),pe=60000,fe=30000;function Z(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(P.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:Q.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function ge(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:L,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:Z(t,H)}),i=r.capabilities,l={...i.operation_constraints};for(let _ of P)l[_]={...s.operation_constraints?.[_]??{},ready:!0,execution_mode:s.operation_constraints?.[_]?.execution_mode??"host"};let m=Q.filter((_)=>s.operation_constraints?.[_]!==void 0);for(let _ of m)l[_]=s.operation_constraints[_];return{...r,capabilities:{...i,supported_operations:["hands.connect",...P,...m],operation_constraints:l}}}function we(r){for(let n of X("/etc/passwd","utf8").split(`
-`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function me(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:L,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function ye(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=X(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function Oe(r,n){let t=ye();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});M(x),M(U),M(H),ce(n);let s=j(r,n),i=!1,l=async(e="done")=>{if(!await Promise.race([s[e].then(()=>!0),new Promise((u)=>setTimeout(()=>u(!1),G).unref?.())]))i=!0,n("srt_warm_late",{wait_ms:G})},[{configureDesktopAccount:m},{configureWorkerSandbox:_}]=await Promise.all([import("./desktop-account-d1g1m6yb.js"),import("./worker-sandbox-2trfs79b.js")]);_();try{m({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let E=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>E.abort());let y=new Map,S,R=new Promise((e)=>{S=e}),g=R.then(()=>import("./vm-hands-executor-xd8v5v0e.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:L,runtimeDirectory:x,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{i=!1,s=j(r,n)},srtWarmLate:()=>i,forward:(u,c,h)=>y.get(u)?.(c,h)??Promise.reject(Error("vm_hands_not_bound")),log:(u,c)=>n(u,c)});return n("executor_loaded"),o}),b=(e)=>async(...o)=>(await g)[e](...o),d=null;g.then((e)=>{d=(o)=>e.executorExited(o)});let a={startExecutor:async(...e)=>(await l(),b("startExecutor")(...e)),killAndVerifyPayload:b("killAndVerifyPayload"),killProbe:b("killProbe"),runProbe:async(...e)=>(await l("listening"),b("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>d?d(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};g.then((e)=>{a.restatLayout=(o)=>e.restatLayout(o),a.verifyMounts=(o)=>e.verifyMounts(o),a.installEnvironment=(o,u)=>e.installEnvironment(o,u),a.freezeBind=(o)=>e.freezeBind(o),a.abortExecutor=(o)=>e.abortExecutor(o),a.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let k=await Ta(r),N=new co(r,k,a,{envRoot:U}),w=le(r),f={probing:!0,lanes:{},displayVideo:!1},W=null,K=null,ee=Promise.all([w,import("./local-capabilities-8fgrfpj4.js")]).then(([e,o])=>{K=()=>ge(e,o.capabilityInventoryForRoots,f),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),D,O=(e)=>{clearTimeout(D),f=e,W?.()},v=R.then(()=>import("./vm-hands-executor-xd8v5v0e.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:u})=>e({payloadUid:r.layout.payload_uid,payloadGid:we(r.layout.payload_uid),bindCgroup:(c)=>o(u,c),surfaceDirectory:H,onSurfaceReadiness:(c)=>{if(c)O({probing:!1,lanes:c.lanes??{},displayVideo:c.display_video===!0});else if(f.probing)O({probing:!1,lanes:{},displayVideo:!1})},log:(c,h)=>n(c,h)})).catch(()=>null);v.then((e)=>e?.warm("person")),v.then(async(e)=>{if(!e){O({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+fe;while(N.settingUp&&Date.now()<o)await new Promise((u)=>setTimeout(u,250));D=setTimeout(()=>{if(f.probing)O({probing:!1,lanes:{},displayVideo:!1})},pe),D.unref?.(),e.warm("surface")}),n("agent_ready"),await Ia({apiOrigin:r.api_origin,agent:N,signal:E.signal,heartbeat:async()=>K?.()??await w,onHeartbeatNow:(e)=>{W=e},executeOp:async({kind:e,claim:o,bindId:u,signal:c,emit:h})=>{let A=me(r,o);if(!A)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:x,readiness:{...Object.fromEntries(P.map((p)=>[p,!0])),"tunnel.open":f.lanes["tunnel.open"]===!0,"tunnel.close":f.lanes["tunnel.close"]===!0}},V=(p)=>{let I=typeof p.kind==="string"?p.kind:"";if(I)h({kind:I,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let ne=o.capability==="pty.start"&&e==="person"&&!o.authority;if(_e.has(String(o.capability))&&!ne||o.capability==="ports.list"){let{executeLocalOperation:p}=await import("./local-capabilities-8fgrfpj4.js");return p(A,o,{worker:F,signal:c,emit:(I)=>V(I)})}let C=await v;if(!C)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Gr.has(String(o.capability))){if(f.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return C.run("surface",{id:String(o.attempt_id),claim:o,state:A,worker:Z(f,H)},V,c)}return C.run(e,{id:String(o.attempt_id),claim:o,state:A,worker:F},V,c,u)},controlOp:async({claim:e,control:o})=>Gr.has(String(e.capability))&&((await v)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:u})=>{if(u&&e.capability==="preview.serve.v1")v.then((c)=>c?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")S();n(e,o)},onTurn:(e,o)=>{if(o)y.set(e,o);else y.delete(e)}}),await(await g).stop(),(await v)?.stop()}export{Ne as parseVmHandsInit,Oe as runVmHands};
+import{er}from"./vm-hands-entry-lite-6dkjbe2b.js";import"./vm-hands-entry-lite-pnx4zgd6.js";import{Gr}from"./vm-hands-entry-lite-vgwm0t9m.js";import{Ta,co,Ia}from"./vm-hands-entry-lite.js";import{spawn as te}from"child_process";import{createHash as re}from"crypto";import{lstatSync as T,mkdirSync as z,readFileSync as X,statSync as J,writeFileSync as q}from"fs";var x="/run/reason-vm-hands",U="/run/reason-vm-hands/env",H="/run/reason-vm-hands/surface",L="/home/runner/.reason/workspace",oe=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,B="/sys/fs/cgroup/reason-srt",se=["/usr/local/bin/reason-srt-exec","/usr/local/bin/ara-srt-exec"],ae=65536,ie=21600000;function ce(r,n="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;z(n,{recursive:!0,mode:448});let t=T(n);if(!t.isDirectory()||t.uid!==0||(t.mode&63)!==0){r("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}q(`${n}/base-keyed`,`1
+`,{mode:420}),r("srt_base_keyed",{})}catch{r("srt_base_keyed_skipped",{reason:"error"})}}var de="/run/ara-srt/starts.jsonl",ue=5;function Y(){try{let r=J(de);return`${r.size}:${r.mtimeMs}`}catch{return""}}function j(r,n){let t=(d)=>{n("srt_warm_skipped",{reason:d});let a=Promise.resolve();return{done:a,listening:a}};if(typeof r.srt_base_settings!=="string")return t("no_settings");let s=Buffer.from(r.srt_base_settings,"base64");if(s.length===0||s.length>ae||s.toString("base64")!==r.srt_base_settings)return t("settings_invalid");let i;try{let d=T(B);if(!d.isDirectory()||d.uid!==0||(d.mode&18)!==0)return t("cgroup_unsafe");let a=se.find((k)=>T(k,{throwIfNoEntry:!1})!==void 0);if(!a)return t("cgroup_or_exec_missing");i=a;for(let[k,N]of[[i,!1],["/usr/local/bin",!0]]){let w=T(k);if((N?!w.isDirectory():!w.isFile())||w.uid!==0||(w.mode&18)!==0)return t("srt_exec_unsafe")}}catch{return t("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return t("not_root");let l=performance.now(),m=Y(),_=re("sha256").update(s).digest("hex"),E=`${x}/srt-base-settings.json`;try{q(E,s,{mode:384,flag:"w"})}catch{return t("settings_write")}let y=te("/bin/sh",["-c",`echo $$ > ${B}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",i,"--settings",E,"--idle-ms",String(ie),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"}),S=null,R=new Promise((d)=>{y.once("error",()=>{n("srt_warm_failed",{reason:"spawn"}),d()}),y.once("close",(a)=>{n(a===0?"srt_warm_done":"srt_warm_failed",{exit_code:a,warm_ms:Math.round(performance.now()-l),...S!==null?{after_ms:S}:{},settings_sha256:_}),d()})}),g=!1,b=new Promise((d)=>{R.then(()=>{g=!0,d()});let a=()=>{if(g)return;if(Y()!==m){S=Math.round(performance.now()-l),d();return}setTimeout(a,ue)};a()});return{done:R,listening:b}}var G=3000;function Ne(r){if(!r||typeof r!=="object"||Array.isArray(r))return null;let n=r,{layout:t,device_key:s,credential:i}=n;return typeof n.workspace_id==="string"&&Number.isSafeInteger(n.instance_generation)&&typeof n.api_origin==="string"&&oe.test(n.api_origin)&&typeof n.manifest_digest==="string"&&!!i&&typeof i.key_id==="string"&&Number.isSafeInteger(i.expires_at_ms)&&typeof i.signature==="string"&&!!t&&typeof t.session_root==="string"&&typeof t.alias==="string"&&Number.isSafeInteger(t.payload_uid)&&typeof t.kind==="string"&&!!s&&typeof s.pkcs8==="string"&&typeof s.spki==="string"?n:null}function M(r){z(r,{recursive:!0,mode:448});let n=J(r);if(!n.isDirectory()||(n.mode&63)!==0||n.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${r}`)}async function le(r){let[{CLI_VERSION:n},t,s,i]=await Promise.all([import("./version-w7r1n5k3.js"),import("./hands-worker-source-vd87swg4.js"),import("./network-contract-8fjtkgma.js"),import("./device-workspace-8941tdsy.js")]),{REASON_HANDS_PROTOCOL_VERSION:l}=await import("./reason-hands-protocol-yga8dh1m.js");return{reason_runtime_version:n,bridge_version:n,protocol_version:er,execution_eligible:!0,instance_generation:r.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:s.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:s.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:s.HANDS_SESSION_GROUP,worker_version:t.REASON_HANDS_WORKER_VERSION,protocol_version:l,worker_artifact_sha256:t.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:t.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:i.REASON_WORKSPACE_BASE,workspace_layout:i.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:s.HANDS_ENVIRONMENT_DELIVERY,[s.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:s.HANDS_ENVIRONMENT_AT_CLAIM,[s.HANDS_CLOUD_ACCESS_KEY]:s.HANDS_CLOUD_ACCESS,[s.HANDS_LARGE_ENVIRONMENT_KEY]:s.HANDS_LARGE_ENVIRONMENT,[s.HANDS_CONFINEMENT_KEY]:s.HANDS_CONFINEMENT,[s.HANDS_JOBS_USER_KEY]:s.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var P=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control"],Q=["automation.call.v1","display.stream.v1","preview.serve.v1","tunnel.open","tunnel.close"],_e=new Set(["pty.start","jobs.control","tunnel.open","tunnel.close"]),pe=60000,fe=30000;function Z(r,n){return{executionMode:"unsandboxed",runtimeDirectory:n,readiness:{...Object.fromEntries(P.map((t)=>[t,!0])),...r.lanes},...r.probing?{probing:Q.filter((t)=>r.lanes[t]!==!0)}:{},...r.displayVideo?{displayVideo:!0}:{}}}function ge(r,n,t){let s=n([{id:"vm-hands",label:"workspace",path:L,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:Z(t,H)}),i=r.capabilities,l={...i.operation_constraints};for(let _ of P)l[_]={...s.operation_constraints?.[_]??{},ready:!0,execution_mode:s.operation_constraints?.[_]?.execution_mode??"host"};let m=Q.filter((_)=>s.operation_constraints?.[_]!==void 0);for(let _ of m)l[_]=s.operation_constraints[_];return{...r,capabilities:{...i,supported_operations:["hands.connect",...P,...m],operation_constraints:l}}}function we(r){for(let n of X("/etc/passwd","utf8").split(`
+`)){let t=n.split(":");if(t.length>=4&&Number(t[2])===r&&/^\d+$/.test(t[3]??"")&&Number(t[3])>0)return Number(t[3])}throw Error("vm_hands_payload_account_unavailable")}function me(r,n){let t=n.owner;if(!t||typeof t.organization_id!=="string"||typeof t.device_id!=="string"||typeof n.root_id!=="string")return null;return{version:4,apiOrigin:r.api_origin,orgId:t.organization_id,deviceId:t.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:n.root_id,label:"workspace",path:L,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}function ye(r=process.platform,n="/proc/self/oom_score_adj"){if(r!=="linux")return null;let t;try{t=X(n,"utf8").trim()}catch{return{value:"unreadable"}}if(!/^-?\d+$/.test(t))return{value:"unreadable"};let s=Number(t);return s<0?{value:s}:null}async function Oe(r,n){let t=ye();if(t)n("vm_hands.oom_protected",{code:"vm_hands_oom_protected",value:t.value}),await new Promise(()=>{setInterval(()=>{return},1073741824)});M(x),M(U),M(H),ce(n);let s=j(r,n),i=!1,l=async(e="done")=>{if(!await Promise.race([s[e].then(()=>!0),new Promise((u)=>setTimeout(()=>u(!1),G).unref?.())]))i=!0,n("srt_warm_late",{wait_ms:G})},[{configureDesktopAccount:m},{configureWorkerSandbox:_}]=await Promise.all([import("./desktop-account-15zym6ze.js"),import("./worker-sandbox-6aepsk73.js")]);_();try{m({value:String(r.layout.payload_uid)})}catch{n("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let E=new AbortController;for(let e of["SIGTERM","SIGINT"])process.on(e,()=>E.abort());let y=new Map,S,R=new Promise((e)=>{S=e}),g=R.then(()=>import("./vm-hands-executor-e75we703.js")).then(({createVmHandsExecutor:e})=>{let o=e({init:r,root:L,runtimeDirectory:x,apiOrigin:r.api_origin,prespawn:!0,onSrtReset:()=>{i=!1,s=j(r,n)},srtWarmLate:()=>i,forward:(u,c,h)=>y.get(u)?.(c,h)??Promise.reject(Error("vm_hands_not_bound")),log:(u,c)=>n(u,c)});return n("executor_loaded"),o}),b=(e)=>async(...o)=>(await g)[e](...o),d=null;g.then((e)=>{d=(o)=>e.executorExited(o)});let a={startExecutor:async(...e)=>(await l(),b("startExecutor")(...e)),killAndVerifyPayload:b("killAndVerifyPayload"),killProbe:b("killProbe"),runProbe:async(...e)=>(await l("listening"),b("runProbe")(...e)),restatLayout:(e)=>{throw Error("replaced below")},verifyMounts:(e)=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:(e)=>d?d(e):new Promise(()=>{}),takeSrtFallbacks:()=>null};g.then((e)=>{a.restatLayout=(o)=>e.restatLayout(o),a.verifyMounts=(o)=>e.verifyMounts(o),a.installEnvironment=(o,u)=>e.installEnvironment(o,u),a.freezeBind=(o)=>e.freezeBind(o),a.abortExecutor=(o)=>e.abortExecutor(o),a.takeSrtFallbacks=()=>e.takeSrtFallbacks?.()??null});let k=await Ta(r),N=new co(r,k,a,{envRoot:U}),w=le(r),f={probing:!0,lanes:{},displayVideo:!1},W=null,K=null,ee=Promise.all([w,import("./local-capabilities-q9jvmztz.js")]).then(([e,o])=>{K=()=>ge(e,o.capabilityInventoryForRoots,f),n("device_ops_loaded")}).catch((e)=>n("device_ops_unavailable",{error:e instanceof Error?e.name:"error"})),D,O=(e)=>{clearTimeout(D),f=e,W?.()},v=R.then(()=>import("./vm-hands-executor-e75we703.js")).then(({createVmHandsOpRunners:e,vmHandsBindCgroup:o,VM_HANDS_PAYLOAD_CGROUP:u})=>e({payloadUid:r.layout.payload_uid,payloadGid:we(r.layout.payload_uid),bindCgroup:(c)=>o(u,c),surfaceDirectory:H,onSurfaceReadiness:(c)=>{if(c)O({probing:!1,lanes:c.lanes??{},displayVideo:c.display_video===!0});else if(f.probing)O({probing:!1,lanes:{},displayVideo:!1})},log:(c,h)=>n(c,h)})).catch(()=>null);v.then((e)=>e?.warm("person")),v.then(async(e)=>{if(!e){O({probing:!1,lanes:{},displayVideo:!1});return}let o=Date.now()+fe;while(N.settingUp&&Date.now()<o)await new Promise((u)=>setTimeout(u,250));D=setTimeout(()=>{if(f.probing)O({probing:!1,lanes:{},displayVideo:!1})},pe),D.unref?.(),e.warm("surface")}),n("agent_ready"),await Ia({apiOrigin:r.api_origin,agent:N,signal:E.signal,heartbeat:async()=>K?.()??await w,onHeartbeatNow:(e)=>{W=e},executeOp:async({kind:e,claim:o,bindId:u,signal:c,emit:h})=>{let A=me(r,o);if(!A)return{status:"failed",error_code:"vm_hands_bind_invalid"};let F={executionMode:"unsandboxed",runtimeDirectory:x,readiness:{...Object.fromEntries(P.map((p)=>[p,!0])),"tunnel.open":f.lanes["tunnel.open"]===!0,"tunnel.close":f.lanes["tunnel.close"]===!0}},V=(p)=>{let I=typeof p.kind==="string"?p.kind:"";if(I)h({kind:I,...p.data&&typeof p.data==="object"?{data:p.data}:{}})};if(o.capability==="exec.full"&&e!=="person")return{status:"failed",error_code:"capability_not_granted"};if(o.capability==="automation.call.v1"&&e!=="model")return{status:"failed",error_code:"capability_not_granted"};let ne=o.capability==="pty.start"&&e==="person"&&!o.authority;if(_e.has(String(o.capability))&&!ne||o.capability==="ports.list"){let{executeLocalOperation:p}=await import("./local-capabilities-q9jvmztz.js");return p(A,o,{worker:F,signal:c,emit:(I)=>V(I)})}let C=await v;if(!C)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};if(Gr.has(String(o.capability))){if(f.lanes[String(o.capability)]!==!0)return{status:"failed",error_code:"capability_unavailable"};return C.run("surface",{id:String(o.attempt_id),claim:o,state:A,worker:Z(f,H)},V,c)}return C.run(e,{id:String(o.attempt_id),claim:o,state:A,worker:F},V,c,u)},controlOp:async({claim:e,control:o})=>Gr.has(String(e.capability))&&((await v)?.notify("surface",{t:"control",id:String(e.attempt_id),control:{kind:o.kind,payload:o.payload??{}}})??!1),opCompleted:({claim:e,status:o,acknowledged:u})=>{if(u&&e.capability==="preview.serve.v1")v.then((c)=>c?.notify("surface",{t:"retire",operation_id:String(e.operation_id),status:o}))},readyData:({launchId:e})=>({executor_launch_id:e}),log:(e,o)=>{if(e==="vm_hands.registered"||e==="vm_hands.reconnected")S();n(e,o)},onTurn:(e,o)=>{if(o)y.set(e,o);else y.delete(e)}}),await(await g).stop(),(await v)?.stop()}export{Ne as parseVmHandsInit,Oe as runVmHands};

package/bin/vm-hands/{worker-sandbox-2trfs79b.js → worker-sandbox-6aepsk73.js}

@@ -1,2 +1,2 @@
 // @bun
-import{ne}from"./vm-hands-entry-lite-7aeqbfc8.js";import"./vm-hands-entry-lite-bqs4pkyb.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{ne as configureWorkerSandbox};
+import{ie}from"./vm-hands-entry-lite-ck130wm6.js";import"./vm-hands-entry-lite-bqs4pkyb.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{ie as configureWorkerSandbox};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reason-machines/cli-linux-x64",
-  "version": "0.2.568",
+  "version": "0.2.570",
   "description": "Reason CLI native binary for linux-x64",
   "os": [
     "linux"

package/bin/vm-hands/agent-network-dw7yrrwt.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ce,fl,ml,Xr,Qi,Nt}from"./vm-hands-entry-lite-rd7bm9we.js";import"./vm-hands-entry-lite-r131db1f.js";export{Nt as AgentNetwork,Ce as AgentNetworkUnavailable,Xr as DaemonRefusal,ml as installedEngineVersion,fl as refreshEngine,Qi as sessionForgotten};

package/bin/vm-hands/api-xvjq0bka.js

@@ -1,2 +0,0 @@
-// @bun
-import{C,io,me}from"./vm-hands-entry-lite-dhn0fs5e.js";import"./vm-hands-entry-lite-r131db1f.js";import"./vm-hands-entry-lite-4kb5rq3d.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{C as ApiError,me as ReasonApi,io as createMachineEnrollmentTicketWithToken};

package/bin/vm-hands/connect-cli-2ja7aj4w.js

@@ -1,2 +0,0 @@
-// @bun
-import{fe,eo,gl,_l,to,yl,wl}from"./vm-hands-entry-lite-mzw2vcah.js";import"./vm-hands-entry-lite-kankyeep.js";import"./vm-hands-entry-lite-7aeqbfc8.js";import"./vm-hands-entry-lite-h5x725z8.js";import"./vm-hands-entry-lite-8s5n4wps.js";import"./vm-hands-entry-lite-dhn0fs5e.js";import"./vm-hands-entry-lite-r131db1f.js";import"./vm-hands-entry-lite-4kb5rq3d.js";import"./vm-hands-entry-lite-rpf4t8r4.js";import"./vm-hands-entry-lite-bqs4pkyb.js";import"./vm-hands-entry-lite-7jmt3q38.js";import"./vm-hands-entry-lite-mktndd2r.js";import"./vm-hands-entry-lite-bbjsnjct.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-kzygj0q8.js";import"./vm-hands-entry-lite-jm9jpj77.js";import"./vm-hands-entry-lite-3594pdj0.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-ksfd234v.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-9meg54bs.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-ezkb7f6j.js";import"./vm-hands-entry-lite-8twdd0ff.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-bcz4qpp6.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-2qh3rat2.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{eo as computerDisconnected,fe as connectionDirectory,to as connectionReport,yl as restartConnection,wl as restartConnectionWhenIdle,gl as runConnectCli,_l as runDisconnectCli};

package/bin/vm-hands/desktop-account-d1g1m6yb.js

@@ -1,2 +0,0 @@
-// @bun
-import{kr,ue,ns}from"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";export{kr as configureDesktopAccount,ue as desktopAccount,ns as desktopHome};

package/bin/vm-hands/desktop-components-577haqrs.js

@@ -1,2 +0,0 @@
-// @bun
-import{Sr,Er,A,Qo,es,ts,rs}from"./vm-hands-entry-lite-9meg54bs.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-bcz4qpp6.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-2qh3rat2.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";export{Sr as USER_CHROME_SOCKET_DIR,Er as desktopPaths,rs as desktopProfileAction,Qo as desktopVideoIdentity,es as downloadVerified,ts as keepDesktopMinimal,A as readDesktopComponents};

package/bin/vm-hands/local-automation-fxdb4ynz.js

@@ -1,2 +0,0 @@
-// @bun
-import{hr,No,Lo,$o,Cl,Mo}from"./vm-hands-entry-lite-kzygj0q8.js";import"./vm-hands-entry-lite-jm9jpj77.js";import"./vm-hands-entry-lite-3594pdj0.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-ksfd234v.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-9meg54bs.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-ezkb7f6j.js";import"./vm-hands-entry-lite-8twdd0ff.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-bcz4qpp6.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-2qh3rat2.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{Lo as ensureLocalBrowser,hr as localAutomationAvailable,$o as localBrowserProfile,No as localUserChromeHost,Cl as runAutomationCallLocally,Mo as runLocalAutomation};

package/bin/vm-hands/local-capabilities-8fgrfpj4.js

@@ -1,2 +0,0 @@
-// @bun
-import{Qr,en,fo,Kn,tl,rl,Jn,mo,go,_o,Xn}from"./vm-hands-entry-lite-rpf4t8r4.js";import"./vm-hands-entry-lite-bqs4pkyb.js";import"./vm-hands-entry-lite-7jmt3q38.js";import"./vm-hands-entry-lite-mktndd2r.js";import"./vm-hands-entry-lite-bbjsnjct.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-kzygj0q8.js";import"./vm-hands-entry-lite-jm9jpj77.js";import"./vm-hands-entry-lite-3594pdj0.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-ksfd234v.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-9meg54bs.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-ezkb7f6j.js";import"./vm-hands-entry-lite-8twdd0ff.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-bcz4qpp6.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-2qh3rat2.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";export{r as LocalCapabilityError,Qr as SHORT_REQUEST_CAPABILITIES,mo as capabilityInventoryForRoots,en as confinedExecutionShell,Kn as defaultLocalCommandRunner,go as deliverLocalHandsEnvironment,Jn as enrolledRootPaths,Xn as executeLocalOperation,_o as rebindLocalHandsControl,tl as runFileCapability,rl as runTransferCapability,fo as spawnCaptured};

package/bin/vm-hands/local-display-session-8b2hx1k6.js

@@ -1,2 +0,0 @@
-// @bun
-import{dn,Bo,Te,jt,pn}from"./vm-hands-entry-lite-jm9jpj77.js";import"./vm-hands-entry-lite-3594pdj0.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-ksfd234v.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-9meg54bs.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-bcz4qpp6.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-2qh3rat2.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{jt as ensureLinuxDesktop,dn as localDisplayAvailable,Bo as localDisplayReady,Te as privateDirectory,pn as runLocalDisplayStream};

package/bin/vm-hands/local-display-video-511qjgmq.js

@@ -1,2 +0,0 @@
-// @bun
-import{Ko,Jo,Xo,Yo,Jt}from"./vm-hands-entry-lite-ksfd234v.js";import"./vm-hands-entry-lite-g0bpdyfz.js";import"./vm-hands-entry-lite-9meg54bs.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-bcz4qpp6.js";import"./vm-hands-entry-lite-hh0kba1y.js";import"./vm-hands-entry-lite-2qh3rat2.js";import"./vm-hands-entry-lite-n9277v11.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";export{Ko as MAC_SCREEN,Jo as WINDOWS_SCREEN,Xo as createDisplayVideoLane,Jt as localDisplayVideoAvailable,Yo as simulatorVideoFfmpeg};

package/bin/vm-hands/local-managed-process-h0fypn67.js

@@ -1,2 +0,0 @@
-// @bun
-import{lr,ei,bo,ti}from"./vm-hands-entry-lite-7jmt3q38.js";import"./vm-hands-entry-lite-mktndd2r.js";import"./vm-hands-entry-lite-bbjsnjct.js";import"./vm-hands-entry-lite-sxnvhzy5.js";import"./vm-hands-entry-lite-732hnx41.js";import"./vm-hands-entry-lite-2927z566.js";import"./vm-hands-entry-lite-1as6h9ed.js";import"./vm-hands-entry-lite-dh87ysh2.js";import"./vm-hands-entry-lite-bc9zq8gx.js";import"./vm-hands-entry-lite-t2rhwchw.js";import"./vm-hands-entry-lite-peyr9y6z.js";import"./vm-hands-entry-lite-0xfme8gg.js";import"./vm-hands-entry-lite-ys4jhf7n.js";import"./vm-hands-entry-lite-tzv8s0e7.js";import"./vm-hands-entry-lite-hpw27zfb.js";import"./vm-hands-entry-lite-vvhfaxpd.js";import"./vm-hands-entry-lite-1cdtev4n.js";import"./vm-hands-entry-lite-t3k90kdn.js";import"./vm-hands-entry-lite-04nx5y4f.js";import"./vm-hands-entry-lite-h7f5a5mb.js";export{lr as ManagedProcessStoppedError,bo as controlManagedDeviceProcess,ti as retireManagedDeviceProcess,ei as runManagedDeviceProcess};

package/bin/vm-hands/vm-hands-entry-lite-rd7bm9we.js

@@ -1,10 +0,0 @@
-// @bun
-import{oo}from"./vm-hands-entry-lite-r131db1f.js";import{spawnSync as p}from"child_process";import{createHash as de}from"crypto";import{chmodSync as ge,closeSync as pe,existsSync as w,linkSync as me,lstatSync as fe,mkdirSync as Q,mkdtempSync as he,openSync as we,readdirSync as ye,readFileSync as Ee,readSync as ke,realpathSync as Ne,renameSync as E,rmSync as k,statSync as Y,symlinkSync as W,writeFileSync as I}from"fs";import{connect as Se}from"net";import{homedir as f}from"os";import{basename as Z,dirname as R,join as u}from"path";import{inflateRawSync as be}from"zlib";var oe=new Set(["<","\u02C2","\u1438","\u2039","\u3008","\u276C","\u276E","\u2770","\u16B2","\u2D66","\uD800\uDF2D","\uD81A\uDEEC","\uD834\uDE36","\u27E8","\u27EA","\u29FC","\u3008","\u300A","\uFE64","\uFF1C"]),D=(e)=>e===" "||e==="\t"||e===`
-`||e==="\f"||e==="\r",ie=(e)=>e.length===1&&e>="!"&&e<="~",G=(e)=>e.length===1&&/[A-Za-z]/.test(e);function J(e){let n=Array.from(e),t=(r)=>{let s=r+Math.min(n.length-r,64),o=r;while(o<s&&(D(n[o])||n[o]==="/"))o+=1;let i=o-r,a=[];while(o<s&&!D(n[o])&&n[o]!==">"&&n[o]!=="\uFF1E")a.push(n[o++]);return i+a.length===s-r&&n.length-r>64||!a.every(ie)||ae(a)};return n.map((r,s)=>oe.has(r)&&t(s+1)?"[":r).join("")}function ae(e){let n=1;for(let t of e){let r=t==="0"?"o":t==="3"?"e":t==="4"||t==="@"?"a":t==="5"||t==="$"?"s":G(t)?t.toLowerCase():t,s="reason".indexOf(r),o=s<0?0:1<<s;if(n=1|(G(t)?0:n)|(n&o)<<1,n&64)return!0}return!1}var ce=/[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/g;function U(e){return J(e.replace(ce," ").replace(/[\u2028\u2029]/g," "))}var le=["CLAUDECODE","CLAUDE_CODE_SESSION_ID","CODEX_THREAD_ID","CODEX_SESSION_ID","GROK_SESSION_ID","GROK_WORKSPACE_ROOT","GEMINI_CLI","CURSOR_AGENT","OPENCODE","COPILOT_CLI","COPILOT_AGENT_SESSION_ID","AI_AGENT"];function ue(e=process.env,n=Boolean(process.stderr.isTTY)){let t=le.some((r)=>e[r]!==void 0)||Object.keys(e).some((r)=>r.startsWith("CODEX_SANDBOX"))||Boolean(e.REASON_NETWORK_AGENT)||Boolean(e.TINCAN_AGENT);return n&&!t}function Fe(e,n=ue()){return n?e:U(e)}class Ce extends Error{}var m="reason-network",g="0.12.11",_e={"aarch64-apple-darwin":"4626279ee457d15566bcee47ba11ce270d545bd1137c48208e0df3878606197b","x86_64-apple-darwin":"17ea926bce47913882c7b3ba0ae42d03694a7720518ee726e4ae3028bb293f62","aarch64-unknown-linux-musl":"3bc31d0db0263ac27020ac4598415e3e16cfb672d6a9a9ca093775d300ef4fc2","x86_64-unknown-linux-musl":"0ab91ac33af6704f4836bbedc5b55bed4b0a9fdfdc8da1a1d16db8a07d2fc1c4","aarch64-pc-windows-msvc":"91c4c06ebbae929af5494efe9b506b6abc8bdd2989c5d246515bc5133932e5bd","x86_64-pc-windows-msvc":"ff01324b27ebcac0f698df59d2fdc8ef6e3094ead09210c6fa39238cd4cdbee7"},Re="https://reasonmachines.com/cli/engine",N="REASON_AGENT_NETWORK_BIN";function ve(e=process.platform,n=process.arch){let t=n==="arm64"?"aarch64":n==="x64"?"x86_64":null,r=e==="darwin"?"apple-darwin":e==="linux"?"unknown-linux-musl":e==="win32"?"pc-windows-msvc":null;return t&&r?`${t}-${r}`:null}function ee(e){return`${m}-${e}${e.endsWith("-windows-msvc")?".zip":".tar.gz"}`}function xe(e){let n=_e[e];return n?{url:`${Re}/${g}/${ee(e)}`,sha256:n}:null}function A(e){let n=p(e,["--version"],{encoding:"utf8",timeout:5000}),[t,r]=n.status===0?n.stdout.trim().split(/\s+/):[];return t===m?r??null:null}function _(e,n){let t=e.split(".").map(Number),r=n.split(".").map(Number);for(let s=0;s<3;s+=1)if((t[s]??0)!==(r[s]??0))return(t[s]??0)>(r[s]??0);return!0}function S(e=f(),n=process.platform){return u(e,".reason","bin",`${m}${n==="win32"?".exe":""}`)}var v=process.platform==="win32"?`~\\.local\\bin\\${m}.exe`:`~/.local/bin/${m}`;async function Te(e=process.env,n=()=>{}){if(e[N])return e[N];let t=S(),r=T(),s=r?.path===t&&y(t)===r.fingerprint?r:null,o=s?.kept,i=M(e)?null:$e(o);if(s?.version===g&&!i)return t;let a=w(t)?A(t):null;if(i){let c=A(i.path),d=a&&_(a,g)?a:g;if(!c||!_(d,c)){if(c)n(`Reason Network: ${v} (${c}) is newer than the version \`reason network\` keeps up to date (${d}), so it was left as it is.`);o=i.fingerprint,i=null}}if(s?.version===g&&!i)return F(t,o);if(!a||!_(a,g))await ne(t);let l=p(t,["setup",...M(e)?["--no-service"]:[]],{env:await C(e),encoding:"utf8",timeout:60000});if(l.status!==0){let c=b((l.stderr||l.stdout||"").trim().split(`
-`).pop()??"");if(s)return B(f(),{...s,fingerprint:y(t)??s.fingerprint,...o?{kept:o}:{}}),n(i?`Reason Network: couldn't move your agents off ${v}${c?` (${c})`:""}; they keep using it. Run reason network to try again.`:`Reason Network: couldn't finish setting up on this computer${c?` (${c})`:""}. Run reason network to try again.`),t;throw new Ce(`Couldn't connect this computer's agents to the network${c?` (${c})`:""}. Run reason network to try again.`)}if(i)o=Pe(i,t,n);return F(t,o),p(t,["stop"],{env:e,stdio:"ignore",timeout:15000}),t}function $e(e){let n=u(f(),".local","bin",Z(S())),t;try{t=fe(n)}catch{return null}let r=`${t.size}:${t.mtimeMs}:${t.ino}`;if(!t.isFile()||r===e)return null;try{let s=Y(S());if(s.ino===t.ino&&s.dev===t.dev)return null}catch{}try{let s=Buffer.alloc(2),o=we(n,"r");try{ke(o,s,0,2,0)}finally{pe(o)}if(s.toString("latin1")==="#!")return null}catch{return null}return{path:n,fingerprint:r}}function Pe(e,n,t){let r=`${e.path}.reason-${process.pid}`;try{if(k(r,{force:!0}),process.platform==="win32"){try{W(n,r,"file")}catch{me(n,r)}te(r,e.path,"win32")}else W(n,r),E(r,e.path);t(`Reason Network: your agents on this computer now use the version \`reason network\` keeps up to date (${v} points to it). Restart a running agent to pick it up.`);return}catch(s){return k(r,{force:!0}),t(`Reason Network: your agents on this computer now use the version \`reason network\` keeps up to date, but ${v} couldn't be pointed to it (${s instanceof Error?s.message:String(s)}). Remove that copy so it can't take them back.`),e.fingerprint}}async function fl(e={}){let n=e.env??process.env,t=e.home??f(),r=S(t),s=T(t);if(n[N]||s?.path!==r||y(r)!==s.fingerprint)return!1;if(s.version===g)return!1;let o=A(r);if(o&&_(o,g))return!1;return await ne(r),B(t,{...s,fingerprint:y(r)??""}),e.beforeRestart?.(),p(r,["stop"],{env:n,stdio:"ignore",timeout:15000}),!0}async function C(e){if(e[j])return e;try{let{defaultWorkerServiceHost:n,workerServiceLauncher:t}=await import("./serve-service-19s965ze.js");return{...e,[j]:t(n(f()),e)}}catch{return e}}var j="REASON_NETWORK_REASON_BIN";function M(e=process.env){return Boolean(e.REASON_NETWORK_NO_SERVICE||e.TINCAN_NO_SERVICE)}var L=(e)=>u(e,".reason","ask-engine.json");function y(e){try{let n=Y(e);return`${n.size}:${n.mtimeMs}:${n.ino}`}catch{return null}}function ml(e=f()){return T(e)?.version??null}function T(e=f()){try{let n=JSON.parse(Ee(L(e),"utf8"));if(typeof n.path!=="string"||typeof n.fingerprint!=="string"||typeof n.version!=="string")return null;return{path:n.path,fingerprint:n.fingerprint,version:n.version,...typeof n.kept==="string"?{kept:n.kept}:{}}}catch{return null}}function B(e,n){Q(R(L(e)),{recursive:!0}),I(L(e),JSON.stringify(n))}function F(e,n){let t=y(e);if(t)B(f(),{path:e,fingerprint:t,version:g,...n?{kept:n}:{}});return e}async function ne(e){let n=ve(),t=n?xe(n):null;if(!n||!t)throw new Ce(`Reason Network runs on macOS, Linux and Windows (arm64 or x64); this is ${process.platform} ${process.arch}.`);let{url:r,sha256:s}=t,o;try{let a=await fetch(r,{signal:AbortSignal.timeout(120000)});if(!a.ok)throw Error(`HTTP ${a.status}`);o=Buffer.from(await a.arrayBuffer())}catch(a){let l=a instanceof Error&&a.name==="TimeoutError"?"no download within 2 minutes":a instanceof Error?a.message.replace(/\.$/,""):String(a);throw new Ce(`Couldn't download Reason Network from ${new URL(r).host} (${l}). Check the connection and run reason network again.`)}if(de("sha256").update(o).digest("hex")!==s)throw new Ce("The Reason Network download didn't match its checksum, so it wasn't installed.");Oe(o,n,e)}var H="Couldn't unpack the Reason Network download.";function Oe(e,n,t,r=process.platform){Q(R(t),{recursive:!0});let s=he(u(R(t),".reason-engine-"));try{let o=u(s,m);if(ee(n).endsWith(".zip"))o=u(s,`${m}.exe`),I(o,Ie(e,`${m}.exe`));else{I(u(s,"engine.tar.gz"),e);let i=p("tar",["--no-same-owner","-xzf",u(s,"engine.tar.gz"),"-C",s],{encoding:"utf8"});if(i.status!==0||!w(o)){let a=(i.stderr??"").trim().split(`
-`).slice(-3).join("; "),l=i.error?`tar failed: ${i.error.message}`:i.signal?`tar was stopped by ${i.signal}`:i.status!==0?`tar exited ${i.status}${a?`: ${a}`:""}`:`no ${m} in it`;throw new Ce(`Couldn't unpack the Reason Network download (${l}).`)}}ge(o,493),te(o,t,r)}finally{k(s,{recursive:!0,force:!0})}}function Ie(e,n){let t=e.lastIndexOf(Buffer.from("PK\x05\x06","latin1"));if(t<0||t+22>e.length)throw new Ce(H);let r=e.readUInt32LE(t+16);for(let s=e.readUInt16LE(t+10);s>0;s-=1){if(r+46>e.length||e.readUInt32LE(r)!==33639248)break;let o=e.readUInt16LE(r+28);if(e.toString("utf8",r+46,r+46+o)===n){let i=e.readUInt16LE(r+10),a=e.readUInt32LE(r+20),l=e.readUInt32LE(r+24),c=e.readUInt32LE(r+42);if(c+30>e.length||e.readUInt32LE(c)!==67324752)break;let d=c+30+e.readUInt16LE(c+26)+e.readUInt16LE(c+28);if(d+a>e.length)break;let h=e.subarray(d,d+a),P;try{P=i===0?Buffer.from(h):i===8?be(h):Buffer.alloc(0)}catch{break}if(i!==0&&i!==8||P.length!==l)break;return P}r+=46+o+e.readUInt16LE(r+30)+e.readUInt16LE(r+32)}throw new Ce(H)}function te(e,n,t){if(t!=="win32"||!w(n)){E(e,n);return}let r=R(n),s=(i)=>i.startsWith(`${Z(n)}.`)&&i.endsWith(".old");for(let i of ye(r).filter(s))try{k(u(r,i),{force:!0})}catch{}let o=`${n}.${process.pid}-${Date.now()}.old`;E(n,o);try{E(e,n)}catch(i){throw E(o,n),i}try{k(o,{force:!0})}catch{}}function Ae(e=process.env,n=f()){let t=e.REASON_NETWORK_HOME?.trim()||e.TINCAN_HOME?.trim();if(t)return t;let r=u(n,".reason","network"),s=u(n,".tincan");return!K(r)&&K(s)?s:r}var K=(e)=>w(u(e,"network.db"))||w(u(e,"tincan.db"));function Me(e,n=process.platform,t=Ne.native){let r=w(u(e,"network.db"))||!w(u(e,"tincan.db"));if(n==="win32"){let o=e;try{o=t(e),o=o.startsWith("\\\\?\\")?o.slice(4):o.startsWith("\\\\")?`UNC\\${o.slice(2)}`:o}catch{}return`\\\\.\\pipe\\${r?"reason-network":"tincan"}-${z(o)}`}let s=u(e,r?"network.sock":"tincan.sock");if(Buffer.byteLength(s)<100)return s;return u("/tmp",`${r?"reason-network":"tincan"}-${process.getuid?.()??0}`,`${z(s)}.sock`)}function z(e){let n=0xcbf29ce484222325n;for(let t of Buffer.from(e))n=BigInt.asUintN(64,(n^BigInt(t))*0x100000001b3n);return n.toString(16).padStart(16,"0")}class Xr extends Error{code;constructor(e,n){super(e);this.code=n}}function Qi(e){return e instanceof Xr&&/isn't registered/.test(e.message)}var re="not_in_team",se=15000,Le=new Set(["who","team","inbox","unread","held"]),Be=90000,De="Reason Network on this computer closed the connection";class x{socket;nextId=1;buffer="";pending=new Map;closed=null;hungUp=!1;constructor(e){this.socket=e;e.setEncoding("utf8"),e.on("data",(t)=>this.read(t));let n=(t)=>{this.closed=t;for(let r of this.pending.values())r.reject(t);this.pending.clear()};e.on("error",(t)=>n(t)),e.on("close",()=>n(Error(this.hungUp?"the connection to Reason Network on this computer was closed here":De)))}static open(e){return new Promise((n,t)=>{let r=Se(e);r.once("connect",()=>n(new x(r))),r.once("error",t)})}read(e){this.buffer+=e;let n=this.buffer.indexOf(`
-`);while(n>=0){let t=this.buffer.slice(0,n);if(this.buffer=this.buffer.slice(n+1),n=this.buffer.indexOf(`
-`),!t.trim())continue;let r;try{r=JSON.parse(t)}catch{continue}if(typeof r.id!=="number")continue;let s=this.pending.get(r.id);if(!s)continue;if(this.pending.delete(r.id),r.ok){s.resolve(r.result);continue}let o=r.error??"Reason Network on this computer refused the request",i=typeof r.code==="string"?r.code:/not (in|connected to) a team/i.test(o)?re:null;s.reject(new Xr(b(o),i))}}call(e,n={},t=se){if(this.closed)return Promise.reject(this.closed);let r=this.nextId++;return this.socket.write(`${JSON.stringify({id:r,op:e,...n})}
-`),new Promise((s,o)=>{let i=setTimeout(()=>{this.pending.delete(r),o(Error(`Reason Network on this computer didn't answer ${e} within ${Math.round(t/1000)}s`))},t);this.pending.set(r,{resolve:(a)=>{clearTimeout(i),s(a)},reject:(a)=>{clearTimeout(i),o(a)}})})}get isClosed(){return this.closed!==null}close(){this.hungUp=!0,this.socket.end()}}var O=/^(Claude Code|Grok|Codex) \u00B7 (.*)$/,Ge={"Claude Code":"claude-code",Grok:"grok",Codex:"codex"},Je=/^ask-[0-9a-f]{6}$/;function V(e){return{id:e.id,from:e.from,fromAgent:e.from_agent,to:e.to,replyTo:e.reply_to,body:e.body,sentAt:e.sent_at}}function q(e){return{person:e.person,machine:e.machine,isMe:e.is_me,online:e.online,link:e.link,rttMs:e.rtt_ms}}class Nt{engine;env;connection=null;waits=new Set;constructor(e,n){this.engine=e;this.env=n}static async open(e=process.env,n){return new Nt(await Te(e,n),e)}static openInstalled(e=process.env){if(e[N])return new Nt(e[N],e);let n=S(),t=T();return t?.path===n&&y(n)===t.fingerprint?new Nt(n,e):null}socketPath(){return Me(Ae(this.env))}async open(){try{return await x.open(this.socketPath())}catch{return p(this.engine,["who","--json"],{env:this.env,stdio:"ignore",timeout:15000}),await x.open(this.socketPath())}}async call(e,n={},t){if(!this.connection||this.connection.isClosed)this.connection=await this.open();try{return await this.connection.call(e,n,t)}catch(r){if(!/closed|ECONNRESET|EPIPE/.test(String(r)))throw r;if(this.connection=await this.open(),!Le.has(e))throw r;return await this.connection.call(e,n)}}async waitOn(e,n){let t=await this.open();this.waits.add(t);try{return await t.call(e,n,n.wait_secs*1000+se)}finally{this.waits.delete(t),t.close()}}close(){this.connection?.close(),this.connection=null;for(let e of this.waits)e.close();this.waits.clear()}async team(){try{let{team_id:e,messages:n,...t}=await this.call("team"),r=t.machines.find((o)=>o.is_me)?.endpoint,s=Array.isArray(n)?n.flatMap((o)=>{let i=oo.safeParse(o);return i.success?[i.data]:[]}):null;return{...t,...typeof e==="string"&&e?{teamId:e}:{},machines:t.machines.map(q),...typeof r==="string"&&r?{endpoint:r}:{},...s?{messageCounts:s}:{}}}catch(e){if(e instanceof Xr&&e.code===re)return null;throw e}}async snapshot(e={}){let n=await this.call("who",{all:Boolean(e.all),...e.filter?{filter:e.filter}:{}}),t=new Set(n.sessions.filter((s)=>O.test(s.doing??"")).map((s)=>`${s.person}/${s.machine}:${s.cwd}`)),r=n.sessions.filter((s)=>e.all||!Je.test(s.name)).filter((s)=>O.test(s.doing??"")||!t.has(`${s.person}/${s.machine}:${s.cwd}`)).map((s)=>{let o=O.exec(s.doing??"");return{address:s.address,name:s.name,person:s.person,machine:s.machine,agent:o?Ge[o[1]]:s.agent,cwd:s.cwd,repo:s.repo,branch:s.branch,status:o?o[2]==="ready for work"?"idle":o[2]==="stopped"?"offline":"busy":s.status,since:s.since,doing:o?o[2]:s.doing,isMe:s.is_me,worker:Boolean(o),tier:s.tier??null}});return{team:n.team,person:n.person,machine:n.machine,machines:n.machines.map(q),sessions:r}}async send(e,n,t={}){if(!t.from)await this.call("hook",{agent:"cli",event:"stop",session_id:"terminal",name:"terminal",cwd:process.cwd(),mail:!1});let r=await this.call("send",{from:t.from??"cli:terminal",to:e,body:n,...t.replyTo?{reply_to:t.replyTo}:{},wake:t.wake??!0,...t.notify?{notify:!0}:{}});return{ids:r.ids,recipients:r.recipients.map((s)=>s.address),deliveries:r.recipients.map((s)=>({address:s.address,state:s.state,note:s.note??""}))}}async session(e,n={}){let t=n.agent??"cli",r=(a,l={})=>this.call("hook",{agent:t,event:a,session_id:e,name:e,cwd:process.cwd(),mail:!1,...l}),s=await r("stop"),o=`${t}:${e}`,i=s.address??e;return{name:e,get address(){return i},next:async(a)=>(await this.waitOn("inbox",{key:o,wait_secs:a,peek:!0})).messages.map(V),ack:async(a)=>{if(a.length)await this.call("delivered",{key:o,ids:a})},busy:async(a)=>{if(await r("prompt"),a)await r("doing",{doing:a})},idle:async(a)=>{if(await r("stop"),a)await r("doing",{doing:a})},doing:async(a)=>{await r("doing",{doing:a})},end:async()=>{await r("end")},rename:async(a)=>{i=(await this.call("set_status",{key:o,name:a})).address},send:(a,l,c,d)=>this.send(a,l,{from:o,...c?{replyTo:c}:{},...d?.notify?{notify:!0}:{}})}}async inbox(e={}){let t=(await this.waitOn("inbox",{key:"cli:terminal",wait_secs:e.waitSeconds??0,peek:!0}).catch((r)=>{if(/isn't registered/.test(String(r)))return{messages:[]};throw r})).messages.map(V);if(t.length&&!e.peek)await this.call("delivered",{key:"cli:terminal",ids:t.map((r)=>r.id)});return t}async link(e={}){return await this.call("link",{new:Boolean(e.new)})}async changeTeam(e,n){try{return await this.call(e,n,Be)}finally{this.close()}}async changeOntoTeam(e,n){try{await this.changeTeam(e,n)}catch(t){if(!/closed|ECONNRESET|EPIPE/.test(String(t)))throw t;if(await this.team())return;await this.changeTeam(e,n)}}async createTeam(e,n){await this.changeOntoTeam("create_team",{name:e,person:n})}async join(e,n){await this.changeOntoTeam("join",{ticket:e,person:n})}async leave(){return await this.changeTeam("leave",{force:!0})}async remove(e){return await this.call("remove",{who:e})}endpoint(){let e=p(this.engine,["endpoint"],{encoding:"utf8",env:this.env,timeout:30000}),n=e.status===0?e.stdout.trim():"";if(!n)throw new Ce(`Reason Network on this computer couldn't say its endpoint${X(e)}.`);return n}async enterTeam(e,n,t){let r=t?{proof:t}:{},[s,o]="create"in e?["create_team",{name:e.create,person:n,...r}]:["join",{ticket:e.join,person:n,...r}],i=null;for(let a=0;a<2&&!i?.person;a+=1)try{i=await this.changeTeam(s,o)}catch(l){let c=String(l),d=l instanceof Xr&&l.code?l.code:/\(same_account_needs_owner\)/.test(c)?"same_account_needs_owner":/already in this team/.test(c)?"name_taken":null;if(d==="same_account_needs_owner")return{state:"needs_owner"};if(d==="name_taken")return{state:"name_taken"};if(!/closed|ECONNRESET|EPIPE/.test(c))throw l;let h=await this.team();if(h)i={name:h.name,person:h.person,machine:h.machine}}if(!i?.person)throw new Ce("Reason Network on this computer didn't join the team. Run reason network again.");return{state:"entered",teamId:i.team_id??"",teamName:i.team_name||i.name||"",person:i.person??n,machine:i.machine??""}}async setupAgents(){this.close();let e=p(this.engine,["setup",...M(this.env)?["--no-service"]:[]],{encoding:"utf8",env:await C(this.env),timeout:60000});if(e.status!==0)throw new Ce(`Couldn't connect this computer's agents to the network${X(e)}.`);return[...e.stdout.matchAll(/^ {2}([^:\n]+): (?!skipped)/gm)].map((n)=>n[1]).filter((n)=>n!=="service")}async setup(e,n={}){return this.passthrough(["setup",...e],n,await C(this.env))}passthrough(e,n={},t=this.env){this.close();let r=p(this.engine,e,{stdio:["inherit","pipe",n.person?"inherit":"pipe"],encoding:"utf8",env:t});if(!n.quiet||r.status!==0)process.stdout.write(Fe(b(r.stdout??""))),process.stderr.write(Fe(b(r.stderr??"")));return r.status??1}}function X(e){let n=b(((e.stderr||e.stdout)??"").trim().split(`
-`).pop()??"");return n?` (${n})`:""}function b(e){return e.replace(/not in a team yet:[^\n]*/g,"this computer isn't on a network yet: run `reason network`").replace(/`tincan (\w+)/g,"`reason network $1").replace(/\btincan (who|send|inbox|invite|join|team|link|setup|doctor|remove|leave|listen)\b/g,"reason network $1").replace(/(?<![\w./-])tincan(?![\w./-])/gi,"Reason Network")}
-export{Fe,Ce,fl,ml,Xr,Qi,Nt};