@provos/ironcurtain 0.1.0

package/dist/config/index.d.ts

@@ -0,0 +1,25 @@
+import type { IronCurtainConfig, MCPServerConfig } from './types.js';
+import type { CompiledPolicyFile, ToolAnnotationsFile } from '../pipeline/types.js';
+/**
+ * Computes the list of protected paths that the policy engine should
+ * prevent agents from modifying. When the active generated dir differs
+ * from the package-bundled dir, both are protected.
+ */
+export declare function computeProtectedPaths(opts: {
+    constitutionPath: string;
+    generatedDir: string;
+    packageGeneratedDir: string;
+    mcpServersPath: string;
+    auditLogPath: string;
+}): string[];
+export declare function loadConfig(): IronCurtainConfig;
+/**
+ * Extracts domain allowlists from MCP server sandbox network configurations.
+ * Filters out the `*` wildcard since it means "no domain restriction".
+ * Returns a map from server name to its list of restricted domains.
+ */
+export declare function extractServerDomainAllowlists(mcpServers: Record<string, MCPServerConfig>): Map<string, string[]>;
+export declare function loadGeneratedPolicy(generatedDir: string, fallbackDir?: string): {
+    compiledPolicy: CompiledPolicyFile;
+    toolAnnotations: ToolAnnotationsFile;
+};

package/dist/config/index.js

@@ -0,0 +1,151 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getIronCurtainHome, getUserGeneratedDir } from './paths.js';
+import { resolveRealPath } from '../types/argument-roles.js';
+import { loadUserConfig } from './user-config.js';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+/**
+ * Returns the user-local generated dir if it contains compiled-policy.json,
+ * otherwise falls back to the package-bundled generated dir.
+ */
+function resolveGeneratedDir(packageGeneratedDir) {
+    const userDir = getUserGeneratedDir();
+    if (existsSync(resolve(userDir, 'compiled-policy.json'))) {
+        return userDir;
+    }
+    return packageGeneratedDir;
+}
+/**
+ * Computes the list of protected paths that the policy engine should
+ * prevent agents from modifying. When the active generated dir differs
+ * from the package-bundled dir, both are protected.
+ */
+export function computeProtectedPaths(opts) {
+    const paths = [
+        resolveRealPath(opts.constitutionPath),
+        resolveRealPath(opts.generatedDir),
+        resolveRealPath(opts.mcpServersPath),
+        resolveRealPath(opts.auditLogPath),
+    ];
+    if (opts.generatedDir !== opts.packageGeneratedDir) {
+        paths.push(resolveRealPath(opts.packageGeneratedDir));
+    }
+    return paths;
+}
+export function loadConfig() {
+    const userConfig = loadUserConfig();
+    const auditLogPath = process.env.AUDIT_LOG_PATH ?? './audit.jsonl';
+    // Default to a path under the IronCurtain home directory.
+    // In practice, the session factory overrides this per-session,
+    // so this default is a fallback for non-session usage (e.g., pipeline).
+    const defaultAllowedDir = resolve(getIronCurtainHome(), 'sandbox');
+    const allowedDirectory = process.env.ALLOWED_DIRECTORY ?? defaultAllowedDir;
+    const mcpServersPath = resolve(__dirname, 'mcp-servers.json');
+    const mcpServers = JSON.parse(readFileSync(mcpServersPath, 'utf-8'));
+    // Sync the filesystem server's allowed directory with the configured value.
+    // The mcp-servers.json ships with a default path that may differ from
+    // the ALLOWED_DIRECTORY environment variable.
+    const fsServer = mcpServers['filesystem'];
+    if (fsServer) {
+        const defaultDir = '/tmp/ironcurtain-sandbox';
+        const dirIndex = fsServer.args.indexOf(defaultDir);
+        if (dirIndex !== -1) {
+            fsServer.args[dirIndex] = allowedDirectory;
+        }
+    }
+    // Resolve node_modules/ relative paths to absolute paths.
+    // Bundled MCP servers reference binaries via node_modules/ which only works
+    // from the dev checkout root. After npm install, deps may be hoisted to a
+    // parent node_modules/, so we walk up from the package root to find them.
+    const packageRoot = resolve(__dirname, '..', '..');
+    for (const config of Object.values(mcpServers)) {
+        if (config.command.startsWith('node_modules/')) {
+            config.command = resolveNodeModulesPath(config.command, packageRoot);
+        }
+        for (let i = 0; i < config.args.length; i++) {
+            if (config.args[i].startsWith('node_modules/')) {
+                config.args[i] = resolveNodeModulesPath(config.args[i], packageRoot);
+            }
+        }
+    }
+    const constitutionPath = resolve(__dirname, 'constitution.md');
+    const packageGeneratedDir = resolve(__dirname, 'generated');
+    const generatedDir = resolveGeneratedDir(packageGeneratedDir);
+    const protectedPaths = computeProtectedPaths({
+        constitutionPath,
+        generatedDir,
+        packageGeneratedDir,
+        mcpServersPath,
+        auditLogPath,
+    });
+    return {
+        auditLogPath,
+        allowedDirectory,
+        mcpServers,
+        protectedPaths,
+        generatedDir,
+        constitutionPath,
+        agentModelId: userConfig.agentModelId,
+        escalationTimeoutSeconds: userConfig.escalationTimeoutSeconds,
+        userConfig,
+    };
+}
+/**
+ * Extracts domain allowlists from MCP server sandbox network configurations.
+ * Filters out the `*` wildcard since it means "no domain restriction".
+ * Returns a map from server name to its list of restricted domains.
+ */
+export function extractServerDomainAllowlists(mcpServers) {
+    const allowlists = new Map();
+    for (const [serverName, config] of Object.entries(mcpServers)) {
+        if (config.sandbox && typeof config.sandbox === 'object' && config.sandbox.network && typeof config.sandbox.network === 'object') {
+            const domains = config.sandbox.network.allowedDomains.filter(d => d !== '*');
+            if (domains.length > 0) {
+                allowlists.set(serverName, domains);
+            }
+        }
+    }
+    return allowlists;
+}
+export function loadGeneratedPolicy(generatedDir, fallbackDir) {
+    const compiledPolicy = JSON.parse(readGeneratedFile(generatedDir, 'compiled-policy.json', fallbackDir));
+    const toolAnnotations = JSON.parse(readGeneratedFile(generatedDir, 'tool-annotations.json', fallbackDir));
+    return { compiledPolicy, toolAnnotations };
+}
+/**
+ * Reads a generated artifact file, trying the primary dir first then the fallback.
+ */
+function readGeneratedFile(generatedDir, filename, fallbackDir) {
+    const primaryPath = resolve(generatedDir, filename);
+    if (existsSync(primaryPath)) {
+        return readFileSync(primaryPath, 'utf-8');
+    }
+    if (fallbackDir) {
+        const fallbackPath = resolve(fallbackDir, filename);
+        if (existsSync(fallbackPath)) {
+            return readFileSync(fallbackPath, 'utf-8');
+        }
+    }
+    // Neither primary nor fallback exist -- read primary to throw with a clear path
+    return readFileSync(primaryPath, 'utf-8');
+}
+/**
+ * Resolves a node_modules/ relative path by walking up from startDir.
+ * Handles npm's dependency hoisting where packages may live in a parent node_modules/.
+ */
+function resolveNodeModulesPath(relativePath, startDir) {
+    let dir = startDir;
+    for (;;) {
+        const candidate = resolve(dir, relativePath);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    // Fallback: assume it's directly under the package root
+    return resolve(startDir, relativePath);
+}
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;GAGG;AACH,SAAS,mBAAmB,CAAC,mBAA2B;IACtD,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,KAAK,GAAG;QACZ,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACtC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC;QACpC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;IACnE,0DAA0D;IAC1D,+DAA+D;IAC/D,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAE5E,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAoC,IAAI,CAAC,KAAK,CAC5D,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CACtC,CAAC;IAEF,4EAA4E;IAC5E,sEAAsE;IACtE,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,0BAA0B,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,gBAAgB;QAChB,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,gBAAgB;QAChB,UAAU;QACV,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;QAC7D,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,UAA2C;IAE3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjI,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC7E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,WAAoB;IAI5E,MAAM,cAAc,GAAuB,IAAI,CAAC,KAAK,CACnD,iBAAiB,CAAC,YAAY,EAAE,sBAAsB,EAAE,WAAW,CAAC,CACrE,CAAC;IACF,MAAM,eAAe,GAAwB,IAAI,CAAC,KAAK,CACrD,iBAAiB,CAAC,YAAY,EAAE,uBAAuB,EAAE,WAAW,CAAC,CACtE,CAAC;IACF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,QAAgB,EAAE,WAAoB;IACrF,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,YAAoB,EAAE,QAAgB;IACpE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,OAAO,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACzC,CAAC"}

package/dist/config/mcp-servers.json

@@ -0,0 +1,22 @@
+{
+  "filesystem": {
+    "command": "npx",
+    "args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp/ironcurtain-sandbox"],
+    "sandbox": false
+  },
+  "git": {
+    "command": "node",
+    "args": ["node_modules/.bin/git-mcp-server"],
+    "env": {
+      "MCP_TRANSPORT_TYPE": "stdio"
+    },
+    "sandbox": {
+      "filesystem": {
+        "denyRead": ["~/.gnupg", "~/.aws"]
+      },
+      "network": {
+        "allowedDomains": ["github.com", "*.github.com", "gitlab.com", "*.gitlab.com"]
+      }
+    }
+  }
+}

package/dist/config/model-provider.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Multi-provider model resolution.
+ *
+ * Parses qualified model ID strings ("provider:model-id") and creates
+ * LanguageModel instances using the appropriate AI SDK provider package.
+ *
+ * Provider packages are dynamically imported so that only the packages
+ * for providers actually in use need to be installed.
+ *
+ * Adding a new provider requires:
+ * 1. Adding the identifier to ProviderId
+ * 2. Adding a case to createLanguageModel()
+ * 3. Optionally adding a key field to UserConfig
+ * 4. Installing the @ai-sdk/<provider> package
+ */
+import type { LanguageModelV3 } from '@ai-sdk/provider';
+import type { ResolvedUserConfig } from './user-config.js';
+/** Supported LLM provider identifiers. */
+export type ProviderId = 'anthropic' | 'google' | 'openai';
+/**
+ * Parsed model specifier. A "qualified model ID" has the form
+ * "provider:model-name". A bare model ID defaults to Anthropic.
+ */
+export interface ParsedModelId {
+    readonly provider: ProviderId;
+    readonly modelId: string;
+}
+/**
+ * Parses a qualified model ID string into provider and model components.
+ *
+ * Format: "provider:model-id" or just "model-id" (defaults to anthropic).
+ *
+ * @throws Error if the provider prefix is not recognized or model ID is empty
+ */
+export declare function parseModelId(qualifiedId: string): ParsedModelId;
+/**
+ * Creates a LanguageModel from a qualified model ID and user config.
+ *
+ * Provider packages are dynamically imported so that only the packages
+ * for providers actually in use need to be installed.
+ *
+ * API key validation is deferred to the first API call -- the AI SDK
+ * providers give better error messages than we could produce here.
+ *
+ * @param qualifiedId - Model specifier like "anthropic:claude-sonnet-4-6"
+ * @param config - Resolved user config for API key lookup
+ * @returns A LanguageModelV3 instance ready for use with generateText()
+ */
+export declare function createLanguageModel(qualifiedId: string, config: ResolvedUserConfig): Promise<LanguageModelV3>;

package/dist/config/model-provider.js

@@ -0,0 +1,78 @@
+/**
+ * Multi-provider model resolution.
+ *
+ * Parses qualified model ID strings ("provider:model-id") and creates
+ * LanguageModel instances using the appropriate AI SDK provider package.
+ *
+ * Provider packages are dynamically imported so that only the packages
+ * for providers actually in use need to be installed.
+ *
+ * Adding a new provider requires:
+ * 1. Adding the identifier to ProviderId
+ * 2. Adding a case to createLanguageModel()
+ * 3. Optionally adding a key field to UserConfig
+ * 4. Installing the @ai-sdk/<provider> package
+ */
+/** Default provider when no prefix is specified. */
+const DEFAULT_PROVIDER = 'anthropic';
+/** Known provider identifiers for validation. */
+const KNOWN_PROVIDERS = new Set(['anthropic', 'google', 'openai']);
+/**
+ * Parses a qualified model ID string into provider and model components.
+ *
+ * Format: "provider:model-id" or just "model-id" (defaults to anthropic).
+ *
+ * @throws Error if the provider prefix is not recognized or model ID is empty
+ */
+export function parseModelId(qualifiedId) {
+    const colonIndex = qualifiedId.indexOf(':');
+    if (colonIndex === -1) {
+        return { provider: DEFAULT_PROVIDER, modelId: qualifiedId };
+    }
+    const prefix = qualifiedId.substring(0, colonIndex);
+    const modelId = qualifiedId.substring(colonIndex + 1);
+    if (!KNOWN_PROVIDERS.has(prefix)) {
+        const known = [...KNOWN_PROVIDERS].sort().join(', ');
+        throw new Error(`Unknown model provider "${prefix}" in "${qualifiedId}". ` +
+            `Supported providers: ${known}`);
+    }
+    if (!modelId) {
+        throw new Error(`Empty model ID in "${qualifiedId}". ` +
+            `Expected format: "provider:model-id"`);
+    }
+    return { provider: prefix, modelId };
+}
+/**
+ * Creates a LanguageModel from a qualified model ID and user config.
+ *
+ * Provider packages are dynamically imported so that only the packages
+ * for providers actually in use need to be installed.
+ *
+ * API key validation is deferred to the first API call -- the AI SDK
+ * providers give better error messages than we could produce here.
+ *
+ * @param qualifiedId - Model specifier like "anthropic:claude-sonnet-4-6"
+ * @param config - Resolved user config for API key lookup
+ * @returns A LanguageModelV3 instance ready for use with generateText()
+ */
+export async function createLanguageModel(qualifiedId, config) {
+    const { provider, modelId } = parseModelId(qualifiedId);
+    switch (provider) {
+        case 'anthropic': {
+            const { createAnthropic } = await import('@ai-sdk/anthropic');
+            const apiKey = config.anthropicApiKey || undefined;
+            return createAnthropic({ apiKey })(modelId);
+        }
+        case 'google': {
+            const { createGoogleGenerativeAI } = await import('@ai-sdk/google');
+            const apiKey = config.googleApiKey || undefined;
+            return createGoogleGenerativeAI({ apiKey })(modelId);
+        }
+        case 'openai': {
+            const { createOpenAI } = await import('@ai-sdk/openai');
+            const apiKey = config.openaiApiKey || undefined;
+            return createOpenAI({ apiKey })(modelId);
+        }
+    }
+}
+//# sourceMappingURL=model-provider.js.map

package/dist/config/model-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-provider.js","sourceRoot":"","sources":["../../src/config/model-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,oDAAoD;AACpD,MAAM,gBAAgB,GAAe,WAAW,CAAC;AAEjD,iDAAiD;AACjD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAW3E;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE5C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAEtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,SAAS,WAAW,KAAK;YAC1D,wBAAwB,KAAK,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,sBAAsB,WAAW,KAAK;YACtC,sCAAsC,CACvC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAoB,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,MAA0B;IAE1B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAExD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,IAAI,SAAS,CAAC;YACnD,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC;YAChD,OAAO,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC;YAChD,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/config/paths.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Returns the IronCurtain home directory.
+ * Defaults to ~/.ironcurtain, overridable via IRONCURTAIN_HOME env var.
+ */
+export declare function getIronCurtainHome(): string;
+/**
+ * Returns the sessions base directory: {home}/sessions/
+ */
+export declare function getSessionsDir(): string;
+/**
+ * Returns the session directory for a given session ID:
+ *   {home}/sessions/{sessionId}/
+ */
+export declare function getSessionDir(sessionId: string): string;
+/**
+ * Returns the sandbox directory for a given session:
+ *   {home}/sessions/{sessionId}/sandbox/
+ */
+export declare function getSessionSandboxDir(sessionId: string): string;
+/**
+ * Returns the escalation IPC directory for a given session:
+ *   {home}/sessions/{sessionId}/escalations/
+ */
+export declare function getSessionEscalationDir(sessionId: string): string;
+/**
+ * Returns the audit log path for a given session:
+ *   {home}/sessions/{sessionId}/audit.jsonl
+ */
+export declare function getSessionAuditLogPath(sessionId: string): string;
+/**
+ * Returns the session log path for a given session:
+ *   {home}/sessions/{sessionId}/session.log
+ */
+export declare function getSessionLogPath(sessionId: string): string;
+/**
+ * Returns the LLM interaction log path for a given session:
+ *   {home}/sessions/{sessionId}/llm-interactions.jsonl
+ */
+export declare function getSessionLlmLogPath(sessionId: string): string;
+/**
+ * Returns the user config file path: {home}/config.json
+ */
+export declare function getUserConfigPath(): string;
+/**
+ * Returns the logs directory: {home}/logs/
+ */
+export declare function getLogsDir(): string;
+/**
+ * Returns the user constitution file path: {home}/constitution-user.md
+ * User policy customizations live in this file, separate from the
+ * base constitution (which is version-controlled).
+ */
+export declare function getUserConstitutionPath(): string;
+/**
+ * Returns the user-local generated artifacts directory: {home}/generated/
+ * Pipeline commands write here; runtime reads from here first, falling back
+ * to the package-bundled defaults in dist/config/generated/.
+ */
+export declare function getUserGeneratedDir(): string;

package/dist/config/paths.js

@@ -0,0 +1,96 @@
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+/**
+ * Returns the IronCurtain home directory.
+ * Defaults to ~/.ironcurtain, overridable via IRONCURTAIN_HOME env var.
+ */
+export function getIronCurtainHome() {
+    return process.env.IRONCURTAIN_HOME ?? resolve(homedir(), '.ironcurtain');
+}
+/**
+ * Returns the sessions base directory: {home}/sessions/
+ */
+export function getSessionsDir() {
+    return resolve(getIronCurtainHome(), 'sessions');
+}
+/**
+ * Validates that a session ID contains only safe characters
+ * (alphanumeric, hyphens, underscores) to prevent path traversal.
+ */
+function validateSessionId(sessionId) {
+    if (!/^[a-zA-Z0-9_-]+$/.test(sessionId)) {
+        throw new Error(`Invalid session ID: ${sessionId}`);
+    }
+}
+/**
+ * Returns the session directory for a given session ID:
+ *   {home}/sessions/{sessionId}/
+ */
+export function getSessionDir(sessionId) {
+    validateSessionId(sessionId);
+    return resolve(getSessionsDir(), sessionId);
+}
+/**
+ * Returns the sandbox directory for a given session:
+ *   {home}/sessions/{sessionId}/sandbox/
+ */
+export function getSessionSandboxDir(sessionId) {
+    return resolve(getSessionDir(sessionId), 'sandbox');
+}
+/**
+ * Returns the escalation IPC directory for a given session:
+ *   {home}/sessions/{sessionId}/escalations/
+ */
+export function getSessionEscalationDir(sessionId) {
+    return resolve(getSessionDir(sessionId), 'escalations');
+}
+/**
+ * Returns the audit log path for a given session:
+ *   {home}/sessions/{sessionId}/audit.jsonl
+ */
+export function getSessionAuditLogPath(sessionId) {
+    return resolve(getSessionDir(sessionId), 'audit.jsonl');
+}
+/**
+ * Returns the session log path for a given session:
+ *   {home}/sessions/{sessionId}/session.log
+ */
+export function getSessionLogPath(sessionId) {
+    return resolve(getSessionDir(sessionId), 'session.log');
+}
+/**
+ * Returns the LLM interaction log path for a given session:
+ *   {home}/sessions/{sessionId}/llm-interactions.jsonl
+ */
+export function getSessionLlmLogPath(sessionId) {
+    return resolve(getSessionDir(sessionId), 'llm-interactions.jsonl');
+}
+/**
+ * Returns the user config file path: {home}/config.json
+ */
+export function getUserConfigPath() {
+    return resolve(getIronCurtainHome(), 'config.json');
+}
+/**
+ * Returns the logs directory: {home}/logs/
+ */
+export function getLogsDir() {
+    return resolve(getIronCurtainHome(), 'logs');
+}
+/**
+ * Returns the user constitution file path: {home}/constitution-user.md
+ * User policy customizations live in this file, separate from the
+ * base constitution (which is version-controlled).
+ */
+export function getUserConstitutionPath() {
+    return resolve(getIronCurtainHome(), 'constitution-user.md');
+}
+/**
+ * Returns the user-local generated artifacts directory: {home}/generated/
+ * Pipeline commands write here; runtime reads from here first, falling back
+ * to the package-bundled defaults in dist/config/generated/.
+ */
+export function getUserGeneratedDir() {
+    return resolve(getIronCurtainHome(), 'generated');
+}
+//# sourceMappingURL=paths.js.map

package/dist/config/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,cAAc,EAAE,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC"}

package/dist/config/types.d.ts

@@ -0,0 +1,89 @@
+import type { ResolvedUserConfig } from './user-config.js';
+/**
+ * Network access configuration for a sandboxed MCP server.
+ *
+ * Invariant: when `allowedDomains` is empty, no network access is permitted.
+ * `deniedDomains` takes precedence and is checked first.
+ */
+export interface SandboxNetworkConfig {
+    /** Domains the server may connect to. Supports wildcards (e.g., "*.github.com"). */
+    readonly allowedDomains: string[];
+    /** Domains explicitly blocked even if they match an allowed pattern. */
+    readonly deniedDomains?: string[];
+}
+/**
+ * Filesystem access configuration for a sandboxed MCP server.
+ *
+ * Invariant: `allowWrite` always includes the session sandbox directory
+ * (injected at runtime, not specified here). Paths listed here are
+ * *additional* write-allowed directories beyond the sandbox.
+ *
+ * Reads are allowed by default. Use `denyRead` to block sensitive
+ * paths like ~/.ssh or ~/.gnupg.
+ */
+export interface SandboxFilesystemConfig {
+    /** Additional directories the server may write to, beyond the session sandbox. */
+    readonly allowWrite?: string[];
+    /** Directories the server may not read. */
+    readonly denyRead?: string[];
+    /** Directories the server may not write to, even within allowed paths. */
+    readonly denyWrite?: string[];
+}
+/**
+ * Per-server sandbox configuration.
+ *
+ * Discriminated on presence/shape:
+ * - `false`: server opts out of sandboxing entirely
+ * - `object`: server is sandboxed with the specified overrides
+ * - `undefined` (omitted): server is sandboxed with restrictive defaults
+ *   (session sandbox write-only, no network)
+ */
+export type ServerSandboxConfig = false | {
+    /** Filesystem restrictions beyond the automatic session sandbox directory. */
+    readonly filesystem?: SandboxFilesystemConfig;
+    /**
+     * Network access. `false` means no network (default).
+     * An object specifies allowed/denied domains.
+     */
+    readonly network?: false | SandboxNetworkConfig;
+};
+export interface MCPServerConfig {
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+    /** OS-level sandbox configuration. Omit for restrictive defaults, `false` to opt out. */
+    sandbox?: ServerSandboxConfig;
+}
+/**
+ * Controls behavior when sandbox-runtime is unavailable on the current
+ * platform (e.g., Windows, Linux without bubblewrap).
+ *
+ * - "enforce": refuse to start servers that require sandboxing
+ * - "warn": log a warning and start the server without sandbox (default)
+ */
+export type SandboxAvailabilityPolicy = 'enforce' | 'warn';
+export interface IronCurtainConfig {
+    auditLogPath: string;
+    allowedDirectory: string;
+    mcpServers: Record<string, MCPServerConfig>;
+    protectedPaths: string[];
+    generatedDir: string;
+    constitutionPath: string;
+    /** Per-session escalation directory for file-based IPC with the proxy. Optional for backward compatibility. */
+    escalationDir?: string;
+    /** Per-session log file path for capturing child process output. Optional for backward compatibility. */
+    sessionLogPath?: string;
+    /** Per-session LLM interaction log path. When set, all LLM calls are logged to this JSONL file. */
+    llmLogPath?: string;
+    /** AI SDK model ID for the interactive agent (e.g. 'anthropic:claude-sonnet-4-6'). */
+    agentModelId: string;
+    /** Escalation timeout in seconds (30-600). Controls how long to wait for human approval. */
+    escalationTimeoutSeconds: number;
+    /** Resolved user configuration. Provides API keys for model resolution. */
+    userConfig: ResolvedUserConfig;
+    /**
+     * Controls behavior when OS-level sandboxing is unavailable.
+     * Default: "warn" -- log and continue without sandbox.
+     */
+    sandboxPolicy?: SandboxAvailabilityPolicy;
+}

package/dist/config/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":""}