@provos/ironcurtain 0.10.0 → 0.12.0

package/README.md

@@ -56,7 +56,7 @@ See [SANDBOXING.md](SANDBOXING.md) for the full architecture with diagrams, laye
 ### Prerequisites
 
 - Node.js 22+ (required by `isolated-vm`; maximum Node 25)
-- Docker — not required but **strongly recommended** for Docker Agent Mode, which provides the strongest isolation
+- Docker — not required but **strongly recommended** for Docker Agent Mode, which provides the strongest isolation. On macOS 26+ (Apple silicon), [Apple `container`](https://github.com/apple/container) works as an alternative backend (VM per container; used automatically when its services are running — see `containerRuntime` in `ironcurtain config`)
 - An API key for at least one LLM provider (Anthropic, Google, or OpenAI)
 
 ### Install
@@ -85,7 +85,7 @@ export ANTHROPIC_API_KEY=sk-ant-...
 
 You can also place keys in a `.env` file in the project root (loaded automatically via `dotenv`), or add them to `~/.ironcurtain/config.json` via `ironcurtain config`. Environment variables take precedence over config file values. Supported: `ANTHROPIC_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, `OPENAI_API_KEY`.
 
-**2. Run the first-start wizard** (runs automatically on first `ironcurtain start`, or explicitly):
+**2. Run the first-start wizard** (run this explicitly before using the recommended mux path; it also runs automatically on first non-mux `ironcurtain start`):
 
 ```bash
 ironcurtain setup
@@ -114,20 +114,43 @@ ironcurtain mux
 
 See [DEVELOPER_GUIDE.md](DEVELOPER_GUIDE.md) for the full walkthrough: input modes, trusted input security model, escalation workflow, and keyboard reference.
 
-### Builtin agent (no Docker required)
+### Non-mux sessions
 
-For quick tasks or environments without Docker, IronCurtain's builtin agent runs entirely locally in a V8 sandbox:
+Use `ironcurtain start` for quick one-shot tasks, scripts, or when you explicitly want the local builtin agent. For normal interactive Docker-agent work, use `ironcurtain mux`.
 
 ```bash
-ironcurtain start                                    # Interactive multi-turn session
 ironcurtain start "Summarize the files in ./src"     # Single-shot mode
-ironcurtain start -w ./my-project "Fix the tests"    # Workspace mode
+ironcurtain start -w ./my-project "Fix the tests"    # Single-shot workspace mode
+ironcurtain start --agent builtin                    # Local builtin REPL, no Docker
 ironcurtain start --persona my-assistant "Check my email"  # Use a persona
 ```
 
 ### Other running modes
 
-IronCurtain also supports PTY mode, session resume (`--resume <session-id>`), a Signal messaging transport for mobile approval, and a daemon mode for scheduled cron jobs. See [RUNNING_MODES.md](RUNNING_MODES.md) for details.
+IronCurtain also supports session resume (`--resume <session-id>`), a legacy raw PTY/debug mode, a Signal messaging transport for mobile approval, and a daemon mode for scheduled cron jobs. The daemon has an optional [web UI](DAEMON.md#web-ui) (`--web-ui`) for browser-based monitoring and escalation handling. See [RUNNING_MODES.md](RUNNING_MODES.md) for details.
+
+### Multi-agent workflows
+
+IronCurtain orchestrates multiple AI agents through structured workflows. The bundled **vulnerability discovery** workflow hunts memory-safety and logic bugs in native code through a tiered harness pipeline (Tier 1 isolated function → Tier 2 multi-component → Tier 3 full build) with libFuzzer/AFL++ coverage gating, hypothesis-driven `discover`/`triage` states, and a final human report-review gate. The **design-and-code** workflow runs plan / design / implement / review cycles, also with human gates. Each agent runs in its own Docker container with role-specific policy boundaries; the engine manages state transitions, artifact passing, and crash-resume checkpointing automatically. Open source, runs entirely on your machine, enforces per-agent security policies via the constitution-based policy engine, and works with any Docker-containerized agent — comparable in scope to Amazon Kiro and Google Jules for coding tasks, but with first-class security and an extensible workflow definition format.
+
+![Vuln-discovery state machine in the IronCurtain web UI](packages/web-ui/docs/workflow-state-machine.png)
+
+**The web UI is the intended interface for workflow runs.** Start the daemon, open the printed URL, and drive runs from the Workflows page — the state-machine graph above is live, the agent-message timeline streams with markdown rendering, gate reviews include a workspace + artifact browser, and past runs stay listed.
+
+```bash
+ironcurtain daemon --web-ui
+```
+
+CLI access is available for scripting, automation, and debugging:
+
+```bash
+ironcurtain workflow start vuln-discovery \
+  "Find memory-safety bugs in libical" --workspace ~/src/libical
+ironcurtain workflow start design-and-code \
+  "Build a REST API with authentication"
+```
+
+See [WORKFLOWS.md](WORKFLOWS.md) for the full documentation.
 
 ## Customizing Your Policy
 
@@ -161,6 +184,12 @@ ironcurtain start --persona my-assistant "Check my calendar"
 
 In mux mode, `/new my-assistant` spawns a tab using that persona. Personas can also be assigned to cron jobs. See [DAEMON.md](DAEMON.md) for scheduled job configuration.
 
+Personas can also be managed from the [web UI](DAEMON.md#persona-policy-management) — browse, create, edit constitutions, and compile policies with live progress. Because a policy is a security boundary, the web UI's mutation controls are read-only unless the daemon is started with `--allow-policy-mutation` (off by default).
+
+### Skills
+
+Drop SKILL.md packages under `~/.ironcurtain/skills/<name>/` to make purpose-specific guidance (helper scripts, deterministic checks, domain knowledge) available to every Docker agent session. The merged set is staged into a per-bundle host directory and bind-mounted **read-only** into the container at the path the active agent's native discovery walks — Claude Code is pointed at the staging dir via `--add-dir`, Goose scans `~/.config/goose/skills/<name>/SKILL.md`. The agent discovers them automatically and decides when to read them based on each skill's frontmatter description. The SKILL.md _format_ is the open standard adopted by Claude Code, Goose, and Codex; only the _discovery path_ differs per agent. Workflows can ship per-state skills inside the workflow package — see [WORKFLOWS.md](WORKFLOWS.md#skills).
+
 ## Policy: Constitution → Enforcement
 
 You write intent in plain English; IronCurtain compiles it into deterministic rules:
@@ -223,6 +252,7 @@ IronCurtain stores configuration and session data in `~/.ironcurtain/`:
 ├── constitution-user.md     # Your policy customizations (generated by customize-policy)
 ├── generated/               # User-compiled policy artifacts (overrides package defaults)
 ├── personas/                # Persona directories (constitution, policy, workspace, memory)
+├── skills/                  # User-global SKILL.md packages, mounted into every Docker session
 ├── jobs/                    # Cron job definitions, workspaces, and run records
 ├── sessions/
 │   └── {sessionId}/
@@ -230,8 +260,28 @@ IronCurtain stores configuration and session data in `~/.ironcurtain/`:
 │       ├── escalations/     # File-based IPC for human approval
 │       ├── audit.jsonl      # Per-session audit log
 │       └── session.log      # Diagnostics
+└── workflow-runs/           # Shared-container workflow runs (see below)
 ```
 
+Single-session runs (`ironcurtain start`, mux tabs, cron jobs) write under `sessions/`. Shared-container workflow runs write under `workflow-runs/` instead — see the next section.
+
+### Workflow run layout
+
+A workflow definition can opt in to a shared Docker container by setting `settings.sharedContainer: true` in its YAML. In that mode every agent state runs inside the same long-lived container and shares one policy engine instance; between states the orchestrator hot-swaps the active policy so each persona sees its own rules. All artifacts for the run land in a single tree:
+
+```
+~/.ironcurtain/workflow-runs/<workflowId>/
+├── audit.jsonl              # Persona-tagged append-only audit
+├── messages.jsonl           # Orchestrator message log
+├── workspace/               # Agent workspace (filesystem MCP root)
+├── bundle/                  # Shared container support (claude-state, orientation, sockets, escalations, system-prompt.txt)
+├── states/
+│   └── <stateId>.<visitCount>/   # session.log + session-metadata.json per invocation
+└── proxy-control.sock       # Coordinator UDS for policy hot-swap
+```
+
+No per-session entries are created under `~/.ironcurtain/sessions/` for a shared-container workflow run. User-visible commands (`ironcurtain workflow start|resume|inspect|list`) are unchanged. See [WORKFLOWS.md](WORKFLOWS.md) for authoring workflow definitions and the full lifecycle.
+
 Edit configuration interactively:
 
 ```bash
@@ -240,17 +290,19 @@ ironcurtain config
 
 Key configuration areas: models and API keys, resource budgets (token/step/time/cost limits), auto-approve escalations, web search provider, audit redaction, and memory server LLM settings. See [CONFIG.md](CONFIG.md) for the full reference.
 
+To route LLM traffic through a gateway like LiteLLM or OpenRouter (in both Code Mode and Docker Agent Mode), see [MODEL_ROUTING.md](MODEL_ROUTING.md).
+
 ## Built-in Capabilities
 
 IronCurtain ships with six pre-configured MCP servers. All tool calls (except memory) are governed by your compiled policy.
 
-| Server               | Tools | Key capabilities                                                                                                  |
-| -------------------- | ----- | ----------------------------------------------------------------------------------------------------------------- |
-| **Filesystem**       | 14    | Read, write, edit, search files; directory tree; move; diff calculation                                           |
-| **Git**              | 28    | Full git workflow: status, diff, log, commit, branch, push/pull/fetch, clone, stash, blame                        |
-| **Fetch**            | 2     | HTTP GET with HTML-to-markdown conversion; web search (Brave, Tavily, SerpAPI)                                    |
-| **GitHub**           | 41    | Issues, PRs, code search, reviews via `ghcr.io/github/github-mcp-server`; requires a GitHub personal access token |
-| **Google Workspace** | 128   | Gmail, Calendar, Drive, Docs, Sheets — requires OAuth setup via `ironcurtain auth`                                |
+| Server               | Tools | Key capabilities                                                                                                                                  |
+| -------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Filesystem**       | 14    | Read, write, edit, search files; directory tree; move; diff calculation                                                                           |
+| **Git**              | 28    | Full git workflow: status, diff, log, commit, branch, push/pull/fetch, clone, stash, blame                                                        |
+| **Fetch**            | 2     | HTTP GET with HTML-to-markdown conversion; web search (Brave, Tavily, SerpAPI)                                                                    |
+| **GitHub**           | 41    | Issues, PRs, code search, reviews via `ghcr.io/github/github-mcp-server`; requires a GitHub personal access token                                 |
+| **Google Workspace** | 128   | Gmail, Calendar, Drive, Docs, Sheets — requires OAuth setup via `ironcurtain auth`                                                                |
 | **Memory**           | 5     | Persistent semantic memory with hybrid vector+keyword search, LLM summarization, and automatic compaction. Enabled for persona and cron sessions. |
 
 Read-only operations are allowed by default policy; mutations (writes, pushes, PR creation) escalate for human approval. Tools use `server.tool` naming (e.g., `filesystem.read_file`, `memory.recall`). See [ADDING_MCP_SERVERS.md](ADDING_MCP_SERVERS.md) to add your own.
@@ -330,6 +382,8 @@ src/
 ├── daemon/                     # Unified daemon (Signal + cron scheduler, control socket)
 ├── cron/                       # Cron job management (scheduler, job store, git sync, policy)
 ├── docker/                     # Docker agent mode, PTY session, MITM proxy, registry proxy
+├── workflow/                   # Multi-agent workflow engine (orchestrator, state machine, gates)
+├── web-ui/                     # Web UI backend (JSON-RPC dispatch, event bus, workflow manager)
 ├── servers/                    # Built-in MCP servers (fetch, web search providers)
 └── types/                      # Shared type definitions
 packages/

package/dist/auth/oauth-provider.js

@@ -7,6 +7,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { getOAuthDir } from '../config/paths.js';
+import { isPlainObject } from '../utils/is-plain-object.js';
 // ---------------------------------------------------------------------------
 // Credential loading
 // ---------------------------------------------------------------------------
@@ -66,8 +67,4 @@ function extractClientCredentials(parsed, filePath) {
     }
     return { clientId, clientSecret };
 }
-/** Type guard for non-null, non-array objects. */
-function isPlainObject(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
 //# sourceMappingURL=oauth-provider.js.map

package/dist/auth/oauth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAgDjD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA6B;IACjE,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC1D,OAAO,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,QAAgB;IACzD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,KAAK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,MAAe,EAAE,QAAgB;IACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,0BAA0B,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAE7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED,kDAAkD;AAClD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAgD5D,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA6B;IACjE,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC1D,OAAO,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,QAAgB;IACzD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,KAAK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,MAAe,EAAE,QAAgB;IACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,0BAA0B,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAE7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC"}

package/dist/cli-help.d.ts

@@ -4,6 +4,7 @@
  * Provides a declarative CommandSpec interface and formatting utilities
  * so every subcommand produces consistent, aligned help output.
  */
+import { parseArgs } from 'node:util';
 export interface CommandOption {
     /** The long flag name, without dashes (e.g., 'agent'). */
     readonly flag: string;
@@ -61,3 +62,14 @@ export declare function printHelp(spec: CommandSpec): void;
 export declare function checkHelp(values: {
     help?: boolean;
 }, spec: CommandSpec): boolean;
+/**
+ * Strict `parseArgs` for leaf subcommands. Forces `strict: true` so an unknown
+ * option (or a missing value for a string option) is rejected rather than
+ * silently swallowed. On a parse error, prints the message plus a usage hint
+ * referencing `commandName` (e.g. `ironcurtain daemon`) and exits 1.
+ *
+ * Routers that forward unrecognized flags to a deeper parser must keep using
+ * `parseArgs({ strict: false })` directly — this helper is for leaves that
+ * actually consume their flags.
+ */
+export declare function parseArgsStrict(config: Omit<Parameters<typeof parseArgs>[0], 'strict'>, commandName: string): ReturnType<typeof parseArgs>;

package/dist/cli-help.js

@@ -4,6 +4,7 @@
  * Provides a declarative CommandSpec interface and formatting utilities
  * so every subcommand produces consistent, aligned help output.
  */
+import { parseArgs } from 'node:util';
 // ---------------------------------------------------------------------------
 // Formatting
 // ---------------------------------------------------------------------------
@@ -99,4 +100,24 @@ export function checkHelp(values, spec) {
     printHelp(spec);
     return true;
 }
+/**
+ * Strict `parseArgs` for leaf subcommands. Forces `strict: true` so an unknown
+ * option (or a missing value for a string option) is rejected rather than
+ * silently swallowed. On a parse error, prints the message plus a usage hint
+ * referencing `commandName` (e.g. `ironcurtain daemon`) and exits 1.
+ *
+ * Routers that forward unrecognized flags to a deeper parser must keep using
+ * `parseArgs({ strict: false })` directly — this helper is for leaves that
+ * actually consume their flags.
+ */
+export function parseArgsStrict(config, commandName) {
+    try {
+        return parseArgs({ ...config, strict: true });
+    }
+    catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        process.stderr.write(`Run \`${commandName} --help\` for usage.\n`);
+        process.exit(1);
+    }
+}
 //# sourceMappingURL=cli-help.js.map

package/dist/cli-help.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgCH,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,iFAAiF;AACjF,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa;IACtC,OAAO,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,QAAQ,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,sDAAsD;QACtD,2DAA2D;QAC3D,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAuD;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,2BAA2B;IAE1D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS;IACT,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAEpD,QAAQ;IACR,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,cAAc;IACd,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,UAAU;IACV,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,WAAW;IACX,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAiB;IACzC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAA0B,EAAE,IAAiB;IACrE,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAgCtC,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,iFAAiF;AACjF,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa;IACtC,OAAO,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,QAAQ,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,sDAAsD;QACtD,2DAA2D;QAC3D,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAuD;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,2BAA2B;IAE1D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS;IACT,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAEpD,QAAQ;IACR,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,cAAc;IACd,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,UAAU;IACV,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,WAAW;IACX,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAiB;IACzC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAA0B,EAAE,IAAiB;IACrE,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAuD,EACvD,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,WAAW,wBAAwB,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/cli.js

@@ -17,9 +17,9 @@ const topLevelSpec = {
     description: 'Secure agent runtime with policy-driven tool mediation',
     usage: ['ironcurtain <command> [options]'],
     subcommands: [
-        { name: 'start [task]', description: 'Run the agent (interactive or single-shot)' },
+        { name: 'start [task]', description: 'Run a one-shot or non-mux agent session' },
         { name: 'daemon', description: 'Unified Signal + cron daemon' },
-        { name: 'mux', description: 'Terminal multiplexer for PTY sessions (requires node-pty)' },
+        { name: 'mux', description: 'Recommended interactive Docker-agent terminal' },
         { name: 'escalation-listener', description: 'Aggregate escalation notifications from PTY sessions' },
         { name: 'bot', description: "Alias for 'daemon' (backward compatible)" },
         { name: 'persona', description: 'Manage personas (named policy profiles)' },
@@ -31,6 +31,9 @@ const topLevelSpec = {
         { name: 'refresh-lists', description: 'Re-resolve dynamic lists without full recompilation' },
         { name: 'customize-policy', description: 'Customize your policy via LLM-assisted conversation' },
         { name: 'config', description: 'Edit configuration interactively' },
+        { name: 'workflow', description: 'Run multi-agent workflows (start, resume, inspect)' },
+        { name: 'observe', description: 'Watch live LLM token output for running sessions' },
+        { name: 'doctor', description: 'Diagnose installation, credentials, and MCP server health' },
         { name: 'help', description: 'Show this help message' },
     ],
     options: [
@@ -38,12 +41,14 @@ const topLevelSpec = {
         { flag: 'version', short: 'v', description: 'Show version number' },
     ],
     examples: [
-        'ironcurtain start "Summarize files in ."       # Single-shot task',
-        'ironcurtain start                              # Interactive session',
-        'ironcurtain start --resume <session-id>        # Resume a session',
+        'ironcurtain mux                                # Recommended interactive session',
+        'ironcurtain mux --agent claude-code            # Interactive Docker: Claude Code',
+        'ironcurtain start "Summarize files in ."       # Single-shot/non-mux task',
+        'ironcurtain start --agent builtin              # Local builtin REPL',
+        'ironcurtain start --resume <session-id>        # Resume a non-mux session',
         'ironcurtain start -w ./my-project "Fix bugs"   # Work in existing directory',
         'ironcurtain start --agent claude-code "task"   # Docker: Claude Code',
-        'ironcurtain start --pty                        # PTY mode',
+        'ironcurtain start --agent codex "task"         # Docker: Codex CLI',
         'ironcurtain daemon                             # Start the daemon',
         'ironcurtain daemon list-jobs                   # List scheduled jobs',
         'ironcurtain compile-policy                     # Compile policy',
@@ -77,6 +82,26 @@ if (!subcommand || subcommand === 'help') {
     printSpecHelp(topLevelSpec);
     process.exit(0);
 }
+// Commands that require the V8 sandbox. We check early to catch Node version
+// mismatches (like Node 25) or stale native module builds before importing heavy dependencies.
+// `compile-policy` is the offline policy pipeline and never instantiates the V8 sandbox.
+const requiresSandbox = ['start', 'daemon', 'bot', 'workflow'];
+if (requiresSandbox.includes(subcommand)) {
+    const { checkSandboxViability } = await import('./utils/preflight-checks.js');
+    const result = await checkSandboxViability();
+    if (!result.ok) {
+        const chalk = (await import('chalk')).default;
+        // Use process.stderr.write rather than console.error because the logger
+        // (src/logger.ts) monkey-patches console.* to redirect into the session log
+        // file. Writing directly to stderr keeps fatal errors visible on the terminal.
+        process.stderr.write(`\n${chalk.bold(chalk.red('Fatal Error:'))} ${result.message}\n`);
+        if (result.details) {
+            process.stderr.write(chalk.dim(result.details) + '\n');
+        }
+        process.stderr.write(chalk.dim('Run `ironcurtain doctor` for a full diagnostic.\n\n'));
+        process.exit(1);
+    }
+}
 switch (subcommand) {
     case 'start': {
         const { main } = await import('./index.js');
@@ -159,6 +184,21 @@ switch (subcommand) {
         await listenerMain();
         break;
     }
+    case 'workflow': {
+        const { main: workflowMain } = await import('./workflow/workflow-command.js');
+        await workflowMain(process.argv.slice(3));
+        break;
+    }
+    case 'observe': {
+        const { runObserveCommand } = await import('./observe/observe-command.js');
+        await runObserveCommand(process.argv.slice(3));
+        break;
+    }
+    case 'doctor': {
+        const { runDoctorCommand } = await import('./doctor/doctor-command.js');
+        await runDoctorCommand(process.argv.slice(3));
+        break;
+    }
     case 'setup-signal': {
         if (checkHelp({ help: process.argv.includes('--help') || process.argv.includes('-h') }, setupSignalSpec))
             break;

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,aAAa,EAAoB,MAAM,eAAe,CAAC;AAExF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,YAAY,GAAgB;IAChC,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,CAAC,iCAAiC,CAAC;IAC1C,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,4CAA4C,EAAE;QACnF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;QAC/D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,2DAA2D,EAAE;QACzF,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,sDAAsD,EAAE;QACpG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACxE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAC3E,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,gEAAgE,EAAE;QAC/F,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC1E,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAChF,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,gEAAgE,EAAE;QACzG,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,oDAAoD,EAAE;QAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAChG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;QACnE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,EAAE;KACxD;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE;QACnE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE;KACpE;IACD,QAAQ,EAAE;QACR,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,6EAA6E;QAC7E,sEAAsE;QACtE,2DAA2D;QAC3D,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;KACzE;CACF,CAAC;AAEF,MAAM,eAAe,GAAgB;IACnC,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,yCAAyC;IACtD,KAAK,EAAE,CAAC,oCAAoC,CAAC;IAC7C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;CACjF,CAAC;AAEF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,+EAA+E;AAC/E,wEAAwE;AACxE,gDAAgD;AAChD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACzC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,SAAS,CAAC,CAAC,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM;IACR,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,CAAC;QACZ,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAClE,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC5D,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,kDAAkD;YAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;YAAE,MAAM;QAChH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,aAAa,EAAoB,MAAM,eAAe,CAAC;AAExF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,YAAY,GAAgB;IAChC,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,CAAC,iCAAiC,CAAC;IAC1C,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAChF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;QAC/D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,+CAA+C,EAAE;QAC7E,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,sDAAsD,EAAE;QACpG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACxE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAC3E,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,gEAAgE,EAAE;QAC/F,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC1E,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAChF,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,gEAAgE,EAAE;QACzG,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,oDAAoD,EAAE;QAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAChG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;QACnE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,oDAAoD,EAAE;QACvF,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACpF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2DAA2D,EAAE;QAC5F,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,EAAE;KACxD;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE;QACnE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE;KACpE;IACD,QAAQ,EAAE;QACR,kFAAkF;QAClF,kFAAkF;QAClF,2EAA2E;QAC3E,qEAAqE;QACrE,2EAA2E;QAC3E,6EAA6E;QAC7E,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;KACzE;CACF,CAAC;AAEF,MAAM,eAAe,GAAgB;IACnC,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,yCAAyC;IACtD,KAAK,EAAE,CAAC,oCAAoC,CAAC;IAC7C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;CACjF,CAAC;AAEF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,+EAA+E;AAC/E,wEAAwE;AACxE,gDAAgD;AAChD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACzC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,+FAA+F;AAC/F,yFAAyF;AACzF,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AAC/D,IAAI,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;IACzC,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9C,wEAAwE;QACxE,4EAA4E;QAC5E,+EAA+E;QAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,SAAS,CAAC,CAAC,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM;IACR,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,CAAC;QACZ,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAClE,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC5D,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,kDAAkD;YAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,UAAU,CAAC,CAAC,CAAC;QAChB,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC9E,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM;IACR,CAAC;IACD,KAAK,SAAS,CAAC,CAAC,CAAC;QACf,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;YAAE,MAAM;QAChH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/config/agent-model-guard.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Guard against the common `--model <agent-name>` slip.
+ *
+ * `--agent` selects the agent (claude-code / goose / codex); `--model` only
+ * overrides the LLM model ID. Passing an agent name to `--model` silently runs
+ * the wrong (default) agent with a bogus model override, so the CLI entry
+ * points (`start`, `mux`) reject it up front rather than launching the wrong
+ * thing.
+ *
+ * Pure and side-effect free: returns a user-facing error message when `model`
+ * is actually an agent name, otherwise `null`. Callers print it and exit in
+ * their own style.
+ */
+export declare function modelFlagMisusedAsAgent(model: string | undefined): string | null;

package/dist/config/agent-model-guard.js

@@ -0,0 +1,24 @@
+import { DOCKER_AGENTS } from './user-config.js';
+/**
+ * Guard against the common `--model <agent-name>` slip.
+ *
+ * `--agent` selects the agent (claude-code / goose / codex); `--model` only
+ * overrides the LLM model ID. Passing an agent name to `--model` silently runs
+ * the wrong (default) agent with a bogus model override, so the CLI entry
+ * points (`start`, `mux`) reject it up front rather than launching the wrong
+ * thing.
+ *
+ * Pure and side-effect free: returns a user-facing error message when `model`
+ * is actually an agent name, otherwise `null`. Callers print it and exit in
+ * their own style.
+ */
+export function modelFlagMisusedAsAgent(model) {
+    if (model === undefined)
+        return null;
+    if (!DOCKER_AGENTS.includes(model))
+        return null;
+    return (`"${model}" is an agent, not a model. Did you mean --agent ${model}?\n` +
+        `--agent selects the agent (${DOCKER_AGENTS.join(', ')}); ` +
+        `--model only overrides the LLM model ID (e.g. --model claude-opus-4-8).`);
+}
+//# sourceMappingURL=agent-model-guard.js.map

package/dist/config/agent-model-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-model-guard.js","sourceRoot":"","sources":["../../src/config/agent-model-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,CACL,IAAI,KAAK,oDAAoD,KAAK,KAAK;QACvE,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QAC3D,yEAAyE,CAC1E,CAAC;AACJ,CAAC"}