@provos/ironcurtain 0.11.0 → 0.12.0

package/dist/docker/agent-adapter.d.ts

@@ -15,6 +15,8 @@ import type { AuthMethod } from './oauth-credentials.js';
  * between container and host in both directions.
  */
 export declare const CONTAINER_WORKSPACE_DIR = "/workspace";
+/** Workflow package helper scripts are mounted read-only at this path. */
+export declare const CONTAINER_SCRIPTS_DIR = "/workflow-scripts";
 /**
  * Structured response from an agent adapter, carrying both the
  * text response and optional cost/usage metadata reported by the agent.
@@ -260,8 +262,10 @@ export interface AgentAdapter {
      *
      * @param exitCode - the container's exit code
      * @param stdout - captured stdout from the container
+     * @param stderr - captured stderr from the container, useful for CLIs that
+     *   report non-zero errors there instead of stdout
      */
-    extractResponse(exitCode: number, stdout: string): AgentResponse;
+    extractResponse(exitCode: number, stdout: string, stderr?: string): AgentResponse;
     /**
      * Returns the Docker container command for PTY mode.
      * When provided, the container runs this command directly instead of

package/dist/docker/agent-adapter.js

@@ -11,6 +11,8 @@
  * between container and host in both directions.
  */
 export const CONTAINER_WORKSPACE_DIR = '/workspace';
+/** Workflow package helper scripts are mounted read-only at this path. */
+export const CONTAINER_SCRIPTS_DIR = '/workflow-scripts';
 /**
  * Human-readable description of a transient-failure kind, used in
  * user-facing terminal-status text and error messages. Centralized so

package/dist/docker/agent-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-adapter.js","sourceRoot":"","sources":["../../src/docker/agent-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAuFpD;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAA0B;IACrE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,qBAAqB;YACxB,OAAO,+DAA+D,CAAC;QACzE,KAAK,cAAc;YACjB,OAAO,2DAA2D,CAAC;IACvE,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-adapter.js","sourceRoot":"","sources":["../../src/docker/agent-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAuFzD;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAA0B;IACrE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,qBAAqB;YACxB,OAAO,+DAA+D,CAAC;QACzE,KAAK,cAAc;YACjB,OAAO,2DAA2D,CAAC;IACvE,CAAC;AACH,CAAC"}

package/dist/docker/agent-registry.js

@@ -41,5 +41,10 @@ export async function registerBuiltinAdapters(userConfig) {
         const gooseAdapter = createGooseAdapter(userConfig);
         registry.set(gooseAdapter.id, gooseAdapter);
     }
+    if (!registry.has('codex')) {
+        const { createCodexAdapter } = await import('./adapters/codex.js');
+        const codexAdapter = createCodexAdapter();
+        registry.set(codexAdapter.id, codexAdapter);
+    }
 }
 //# sourceMappingURL=agent-registry.js.map

package/dist/docker/agent-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-registry.js","sourceRoot":"","sources":["../../src/docker/agent-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,EAAW;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,gBAAgB,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAA+B;IAC3E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAwB,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC9E,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAC9D,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAkB,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpD,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-registry.js","sourceRoot":"","sources":["../../src/docker/agent-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,EAAW;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,gBAAgB,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAA+B;IAC3E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAwB,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC9E,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAC9D,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAkB,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpD,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAkB,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;QAC1C,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/docker/apple-container-manager.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Apple `container` CLI wrapper implementing the ContainerRuntime interface.
+ *
+ * Peer implementation to docker-manager.ts for macOS 26+ on Apple silicon
+ * (see docs/designs/apple-container-runtime.md). Each container runs in its
+ * own lightweight VM; networking uses host-only vmnet networks instead of
+ * Docker's bridge + sidecar arrangement.
+ *
+ * This module is the only place allowed to spawn the `container` binary,
+ * always via execFile with argument arrays (no shell strings).
+ *
+ * CLI semantics verified against `container` 1.0.0:
+ *   - `create`/`start`/`exec`/`stop`/`delete` mirror the Docker verbs;
+ *     `--init`, `--cap-drop ALL`, `--label`, `--cpus`/`--memory`, `--user`,
+ *     `--entrypoint`, `-t` all exist with Docker-compatible meanings.
+ *   - `inspect` family returns JSON only (no Go templates); shapes are
+ *     parsed below (`AppleContainerInspect` / `AppleImageInspect`).
+ *   - `network create --internal` creates a host-only vmnet network and
+ *     duplicate creation fails with "already exists" on stderr.
+ *   - Inspecting a missing container/image exits non-zero.
+ *   - No `--add-host`, no `--restart`, no restartable `network connect`:
+ *     those configs throw instead of being silently dropped.
+ */
+import type { ContainerRuntime, DockerContainerConfig } from './types.js';
+import type { DockerAvailability } from './docker-probe.js';
+import { type ExecFileFn, type CreateDockerManagerOptions } from './docker-manager.js';
+/** Host facts consulted by the availability probe; injectable for tests. */
+export interface AppleContainerHostInfo {
+    readonly platform: string;
+    readonly arch: string;
+    /** Darwin kernel release, e.g. "25.5.0" (macOS 26.5). */
+    readonly release: string;
+}
+/**
+ * Availability probe for the Apple container runtime. Mirrors the shape of
+ * `checkDockerAvailable` so mode selection can treat backends uniformly.
+ */
+export declare function checkAppleContainerAvailable(execFileFn?: ExecFileFn, host?: AppleContainerHostInfo): Promise<DockerAvailability>;
+/**
+ * Builds the `container create` argument list from a container config.
+ * Exported for testing.
+ *
+ * Configs that encode Docker-only mechanisms (`extraHosts`, `restartPolicy`,
+ * `network: 'none'`) throw rather than being silently dropped: they only
+ * occur on the Docker-specific topologies, and reaching here with one set
+ * means a wiring bug, not a portable request.
+ */
+export declare function buildAppleCreateArgs(config: DockerContainerConfig): string[];
+export declare function createAppleContainerManager(execFileFn?: ExecFileFn, availabilityProbe?: (execFileFn?: ExecFileFn) => Promise<DockerAvailability>, spawnOpts?: CreateDockerManagerOptions): ContainerRuntime;

package/dist/docker/apple-container-manager.js

@@ -0,0 +1,464 @@
+/**
+ * Apple `container` CLI wrapper implementing the ContainerRuntime interface.
+ *
+ * Peer implementation to docker-manager.ts for macOS 26+ on Apple silicon
+ * (see docs/designs/apple-container-runtime.md). Each container runs in its
+ * own lightweight VM; networking uses host-only vmnet networks instead of
+ * Docker's bridge + sidecar arrangement.
+ *
+ * This module is the only place allowed to spawn the `container` binary,
+ * always via execFile with argument arrays (no shell strings).
+ *
+ * CLI semantics verified against `container` 1.0.0:
+ *   - `create`/`start`/`exec`/`stop`/`delete` mirror the Docker verbs;
+ *     `--init`, `--cap-drop ALL`, `--label`, `--cpus`/`--memory`, `--user`,
+ *     `--entrypoint`, `-t` all exist with Docker-compatible meanings.
+ *   - `inspect` family returns JSON only (no Go templates); shapes are
+ *     parsed below (`AppleContainerInspect` / `AppleImageInspect`).
+ *   - `network create --internal` creates a host-only vmnet network and
+ *     duplicate creation fails with "already exists" on stderr.
+ *   - Inspecting a missing container/image exits non-zero.
+ *   - No `--add-host`, no `--restart`, no restartable `network connect`:
+ *     those configs throw instead of being silently dropped.
+ */
+import { arch, platform, release } from 'node:os';
+import * as logger from '../logger.js';
+import { isExecError, isExecTimeout } from '../utils/exec-error.js';
+import { defaultExecFile, DEFAULT_EXEC_TIMEOUT_MS, PULL_IDLE_TIMEOUT_MS, BUILD_IDLE_TIMEOUT_MS, IRONCURTAIN_LABEL_BUNDLE, IRONCURTAIN_LABEL_WORKFLOW, IRONCURTAIN_LABEL_SCOPE, makeRunStreamed, } from './docker-manager.js';
+import { createDockerProgressSink } from './docker-progress-sink.js';
+/** Grace period for `container stop` before the runtime kills the VM. */
+const STOP_TIMEOUT_SECONDS = 10;
+/** Minimum supported `container` CLI major version (1.0.0 stability line). */
+const MIN_MAJOR_VERSION = 1;
+/**
+ * Minimum Darwin kernel major for macOS 26. The `container network`
+ * commands this backend depends on do not function on macOS 15 (Darwin 24).
+ */
+const MIN_DARWIN_MAJOR = 25;
+function firstInspectEntry(stdout) {
+    const parsed = JSON.parse(stdout);
+    return parsed[0];
+}
+/** Digests appear both bare and `sha256:`-prefixed; compare normalized. */
+function normalizeDigest(digest) {
+    return digest.startsWith('sha256:') ? digest.slice('sha256:'.length) : digest;
+}
+/** Rejects with a consistent "feature is Docker-only" error for unsupported runtime ops. */
+function unsupported(feature) {
+    return Promise.reject(new Error(`apple-container does not support ${feature}; use the Docker backend`));
+}
+function currentHostInfo() {
+    return { platform: platform(), arch: arch(), release: release() };
+}
+/**
+ * Availability probe for the Apple container runtime. Mirrors the shape of
+ * `checkDockerAvailable` so mode selection can treat backends uniformly.
+ */
+export async function checkAppleContainerAvailable(execFileFn = defaultExecFile, host = currentHostInfo()) {
+    if (host.platform !== 'darwin' || host.arch !== 'arm64') {
+        return {
+            available: false,
+            reason: 'apple-container requires macOS on Apple silicon',
+            detailedMessage: 'The Apple container runtime only runs on Apple silicon Macs.',
+        };
+    }
+    const darwinMajor = Number.parseInt(host.release.split('.')[0] ?? '0', 10);
+    if (darwinMajor < MIN_DARWIN_MAJOR) {
+        return {
+            available: false,
+            reason: 'apple-container requires macOS 26 or later',
+            detailedMessage: 'The `container network` commands this backend depends on do not function before macOS 26. ' +
+                'Upgrade macOS or use the Docker backend.',
+        };
+    }
+    let versionLine;
+    try {
+        const { stdout } = await execFileFn('container', ['--version'], { timeout: 10_000 });
+        versionLine = stdout.trim();
+    }
+    catch {
+        return {
+            available: false,
+            reason: 'container CLI not installed',
+            detailedMessage: 'The `container` binary was not found. Install it from https://github.com/apple/container/releases ' +
+                'and start its services with `container system start`.',
+        };
+    }
+    const match = /version\s+(\d+)\.(\d+)\.(\d+)/.exec(versionLine);
+    const major = match ? Number.parseInt(match[1], 10) : 0;
+    if (!match || major < MIN_MAJOR_VERSION) {
+        return {
+            available: false,
+            reason: `container CLI too old (need >= ${MIN_MAJOR_VERSION}.0.0)`,
+            detailedMessage: `Found "${versionLine}" but IronCurtain requires the ${MIN_MAJOR_VERSION}.0.0 stability line. ` +
+                'Upgrade from https://github.com/apple/container/releases.',
+        };
+    }
+    try {
+        await execFileFn('container', ['system', 'status'], { timeout: 10_000 });
+    }
+    catch {
+        return {
+            available: false,
+            reason: 'container services not running',
+            detailedMessage: 'The container apiserver is not running. Start it with `container system start`.',
+        };
+    }
+    return { available: true };
+}
+/**
+ * Builds the `container create` argument list from a container config.
+ * Exported for testing.
+ *
+ * Configs that encode Docker-only mechanisms (`extraHosts`, `restartPolicy`,
+ * `network: 'none'`) throw rather than being silently dropped: they only
+ * occur on the Docker-specific topologies, and reaching here with one set
+ * means a wiring bug, not a portable request.
+ */
+export function buildAppleCreateArgs(config) {
+    if (config.extraHosts && config.extraHosts.length > 0) {
+        throw new Error('apple-container does not support extra host mappings (--add-host); use a host-only network');
+    }
+    if (config.restartPolicy) {
+        throw new Error('apple-container does not support restart policies');
+    }
+    if (config.network === 'none') {
+        throw new Error("apple-container has no '--network=none'; use an --internal (host-only) network");
+    }
+    const args = ['create'];
+    args.push('--name', config.name);
+    args.push('--network', config.network);
+    // Reap-and-forward init for the workload, same rationale as Docker's
+    // --init (zombie children under `sleep infinity`; see docker-manager.ts).
+    // vminitd is the VM's PID 1 regardless; this adds the in-container init.
+    args.push('--init');
+    // Security: drop all capabilities, then selectively re-add. Inside the
+    // per-container VM this guards the workload, not the host boundary.
+    args.push('--cap-drop', 'ALL');
+    for (const cap of config.capAdd ?? []) {
+        args.push('--cap-add', cap);
+    }
+    for (const port of config.ports ?? []) {
+        args.push('--publish', port);
+    }
+    // Same present-or-absent label contract as buildCreateArgs (docker).
+    if (config.bundleLabel !== undefined) {
+        args.push('--label', `${IRONCURTAIN_LABEL_BUNDLE}=${config.bundleLabel}`);
+    }
+    if (config.workflowLabel !== undefined) {
+        args.push('--label', `${IRONCURTAIN_LABEL_WORKFLOW}=${config.workflowLabel}`);
+    }
+    if (config.scopeLabel !== undefined) {
+        args.push('--label', `${IRONCURTAIN_LABEL_SCOPE}=${config.scopeLabel}`);
+    }
+    if (config.resources?.memoryMb) {
+        args.push('--memory', `${config.resources.memoryMb}M`);
+    }
+    if (config.resources?.cpus) {
+        args.push('--cpus', String(config.resources.cpus));
+    }
+    for (const mount of config.mounts) {
+        // `--mount` is the only syntax with an explicit readonly option. Its
+        // comma/equals-separated format has no escaping, so reject paths that
+        // would corrupt it rather than emit a wrong mount.
+        if (/[,=]/.test(mount.source) || /[,=]/.test(mount.target)) {
+            throw new Error(`mount path contains ',' or '=' which the --mount format cannot escape: ${mount.source}`);
+        }
+        const readonlySuffix = mount.readonly ? ',readonly' : '';
+        args.push('--mount', `source=${mount.source},target=${mount.target}${readonlySuffix}`);
+    }
+    for (const [key, value] of Object.entries(config.env)) {
+        args.push('-e', `${key}=${value}`);
+    }
+    if (config.entrypoint !== undefined) {
+        args.push('--entrypoint', config.entrypoint);
+    }
+    if (config.tty) {
+        args.push('-t');
+    }
+    if (config.user !== undefined) {
+        args.push('--user', config.user);
+    }
+    args.push(config.image);
+    args.push(...config.command);
+    return args;
+}
+export function createAppleContainerManager(execFileFn, availabilityProbe = checkAppleContainerAvailable, spawnOpts) {
+    const exec = execFileFn ?? defaultExecFile;
+    const streamOpts = {
+        spawn: spawnOpts?.spawn,
+        stdoutSink: spawnOpts?.stdoutSink,
+        stderrSink: spawnOpts?.stderrSink,
+    };
+    const progressSinkFactory = spawnOpts?.progressSinkFactory ?? createDockerProgressSink;
+    const runStreamed = makeRunStreamed('container', streamOpts, progressSinkFactory);
+    const inspectContainer = async (nameOrId, timeout) => {
+        const { stdout } = await exec('container', ['inspect', nameOrId], { timeout });
+        return firstInspectEntry(stdout);
+    };
+    return {
+        async preflight(image) {
+            const status = await availabilityProbe(execFileFn);
+            if (!status.available) {
+                throw new Error(`Apple container runtime is not available. ${status.detailedMessage}`);
+            }
+            try {
+                await exec('container', ['image', 'inspect', image], { timeout: 10_000 });
+            }
+            catch {
+                throw new Error(`Container image not found: ${image}. Build it first.`);
+            }
+        },
+        async create(config) {
+            const args = buildAppleCreateArgs(config);
+            const { stdout } = await exec('container', args, { timeout: 60_000 });
+            return stdout.trim();
+        },
+        async start(nameOrId) {
+            await exec('container', ['start', nameOrId], { timeout: 60_000 });
+        },
+        async exec(nameOrId, command, timeoutMs, execUser) {
+            const timeout = timeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS;
+            // Same --user resolution contract as the Docker implementation (see
+            // ContainerRuntime.exec JSDoc): undefined → 'codespace', null → omit.
+            const resolvedUser = execUser === undefined ? 'codespace' : execUser;
+            const userArgs = resolvedUser === null ? [] : ['--user', resolvedUser];
+            try {
+                const { stdout, stderr } = await exec('container', ['exec', ...userArgs, nameOrId, ...command], {
+                    timeout,
+                    maxBuffer: 50 * 1024 * 1024,
+                });
+                return { exitCode: 0, stdout, stderr };
+            }
+            catch (err) {
+                if (isExecError(err)) {
+                    if (isExecTimeout(err)) {
+                        logger.warn(`[apple-container-manager] exec timed out after ${timeout}ms (killed=${String(err.killed)}, ` +
+                            `signal=${err.signal ?? 'none'}): container exec ${nameOrId} ${command[0] ?? ''}`);
+                    }
+                    return {
+                        exitCode: typeof err.code === 'number' ? err.code : 1,
+                        stdout: err.stdout,
+                        stderr: err.stderr,
+                    };
+                }
+                throw err;
+            }
+        },
+        async stop(nameOrId) {
+            try {
+                await exec('container', ['stop', '--time', String(STOP_TIMEOUT_SECONDS), nameOrId], {
+                    timeout: (STOP_TIMEOUT_SECONDS + 5) * 1000,
+                });
+            }
+            catch {
+                // Container may already be stopped
+            }
+        },
+        async remove(nameOrId) {
+            try {
+                await exec('container', ['delete', '--force', nameOrId], { timeout: 30_000 });
+            }
+            catch {
+                // Container may already be removed
+            }
+        },
+        async isRunning(nameOrId) {
+            try {
+                const entry = await inspectContainer(nameOrId, 5_000);
+                return entry?.status?.state === 'running';
+            }
+            catch {
+                return false;
+            }
+        },
+        async imageExists(image) {
+            try {
+                await exec('container', ['image', 'inspect', image], { timeout: 10_000 });
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        async buildImage(tag, dockerfilePath, contextDir, labels) {
+            const args = ['build', '--progress', 'plain', '-t', tag, '-f', dockerfilePath];
+            if (labels) {
+                for (const [key, value] of Object.entries(labels)) {
+                    args.push('--label', `${key}=${value}`);
+                }
+            }
+            args.push(contextDir);
+            try {
+                await runStreamed({
+                    operation: 'container build',
+                    args,
+                    idleTimeoutMs: BUILD_IDLE_TIMEOUT_MS,
+                });
+            }
+            catch (err) {
+                // The BuildKit builder VM currently requires Rosetta; surface the
+                // one-command fix instead of the raw virtualization error.
+                const message = err instanceof Error ? err.message : String(err);
+                if (message.includes('Rosetta is not installed')) {
+                    throw new Error(`container build failed: the BuildKit builder VM requires Rosetta. ` +
+                        `Install it with \`softwareupdate --install-rosetta --agree-to-license\` and retry.\n${message}`, { cause: err });
+                }
+                throw err;
+            }
+        },
+        async getImageLabel(image, label) {
+            try {
+                const { stdout } = await exec('container', ['image', 'inspect', image], { timeout: 10_000 });
+                const entry = firstInspectEntry(stdout);
+                for (const variant of entry?.variants ?? []) {
+                    const value = variant.config?.config?.Labels?.[label];
+                    if (value !== undefined)
+                        return value;
+                }
+                return undefined;
+            }
+            catch {
+                return undefined;
+            }
+        },
+        // Workflow snapshot/image management (commit, removeImage, listImages,
+        // inspectImage) is Docker-only. The orchestrator's snapshot paths call
+        // createDockerManager() directly, so these are never reached on the
+        // apple-container backend; reject loudly rather than degrade silently.
+        commit: () => unsupported('image commit (workflow snapshots)'),
+        removeImage: () => unsupported('image removal'),
+        listImages: () => unsupported('image listing'),
+        inspectImage: () => unsupported('image inspection'),
+        async getContainerLabel(container, label) {
+            try {
+                const entry = await inspectContainer(container, 5_000);
+                return entry?.configuration?.labels?.[label];
+            }
+            catch {
+                return undefined;
+            }
+        },
+        async createNetwork(name, options) {
+            if (options?.gateway) {
+                throw new Error('apple-container networks do not support an explicit gateway; the runtime assigns it');
+            }
+            try {
+                const args = ['network', 'create'];
+                if (options?.internal)
+                    args.push('--internal');
+                if (options?.subnet)
+                    args.push('--subnet', options.subnet);
+                args.push(name);
+                await exec('container', args, { timeout: 30_000 });
+            }
+            catch (err) {
+                if (isExecError(err) && err.stderr.includes('already exists'))
+                    return;
+                throw err;
+            }
+        },
+        async removeNetwork(name) {
+            try {
+                await exec('container', ['network', 'delete', name], { timeout: 30_000 });
+            }
+            catch {
+                // Ignore errors -- network may already be removed
+            }
+        },
+        async pullImage(image) {
+            await runStreamed({
+                operation: 'container pull',
+                args: ['image', 'pull', '--progress', 'plain', image],
+                idleTimeoutMs: PULL_IDLE_TIMEOUT_MS,
+            });
+        },
+        async getImageId(nameOrId) {
+            // Try as image first (returns the image's own digest)
+            try {
+                const { stdout } = await exec('container', ['image', 'inspect', nameOrId], { timeout: 5_000 });
+                const id = firstInspectEntry(stdout)?.id;
+                if (id)
+                    return normalizeDigest(id);
+            }
+            catch {
+                // Not an image - fall through to container inspection
+            }
+            // Try as container (returns the digest of the image it was created from)
+            try {
+                const entry = await inspectContainer(nameOrId, 5_000);
+                const digest = entry?.configuration?.image?.descriptor?.digest;
+                return digest ? normalizeDigest(digest) : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        },
+        async getNetworkGateway(name) {
+            try {
+                const { stdout } = await exec('container', ['network', 'inspect', name], { timeout: 10_000 });
+                const entry = firstInspectEntry(stdout);
+                return entry?.status?.ipv4Gateway;
+            }
+            catch {
+                return undefined;
+            }
+        },
+        connectNetwork() {
+            // Only the Docker tcp-sidecar topology attaches a running container
+            // to a second network; the host-only topology never needs it.
+            return Promise.reject(new Error('apple-container does not support connecting a container to additional networks'));
+        },
+        async getContainerIp(containerId, network) {
+            // The address may not be assigned immediately after start; retry
+            // briefly, mirroring the Docker implementation.
+            const maxAttempts = 5;
+            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+                const entry = await inspectContainer(containerId, 10_000);
+                const attachment = entry?.status?.networks?.find((n) => n.network === network);
+                const cidr = attachment?.ipv4Address;
+                if (cidr) {
+                    const ip = cidr.split('/')[0];
+                    if (ip)
+                        return ip;
+                }
+                if (attempt < maxAttempts) {
+                    await new Promise((r) => setTimeout(r, 200));
+                }
+            }
+            throw new Error(`No IP address found for container ${containerId} on network ${network}`);
+        },
+        async containerExists(nameOrId) {
+            try {
+                // `container inspect` exits non-zero when the container does not
+                // exist, for both running and stopped containers otherwise.
+                await exec('container', ['inspect', nameOrId], { timeout: 5_000 });
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        async removeStaleContainer(name) {
+            const exists = await this.containerExists(name);
+            if (!exists)
+                return false;
+            // Verify the container belongs to IronCurtain before removing it,
+            // same `ironcurtain.bundle` ownership check as the Docker backend.
+            const label = await this.getContainerLabel(name, IRONCURTAIN_LABEL_BUNDLE);
+            if (!label) {
+                logger.warn(`Container "${name}" exists but lacks ${IRONCURTAIN_LABEL_BUNDLE} label; skipping removal`);
+                return false;
+            }
+            logger.warn(`Removing stale container "${name}" from a previous session`);
+            await this.stop(name);
+            await this.remove(name);
+            // Verify removal succeeded (remove() swallows errors)
+            if (await this.containerExists(name)) {
+                throw new Error(`Failed to remove stale container "${name}"`);
+            }
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=apple-container-manager.js.map

package/dist/docker/apple-container-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-container-manager.js","sourceRoot":"","sources":["../../src/docker/apple-container-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,eAAe,EAEf,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,EACvB,eAAe,GAEhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;GAGG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAsB5B,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAc,CAAC;IAC/C,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAChF,CAAC;AAED,4FAA4F;AAC5F,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,OAAO,0BAA0B,CAAC,CAAC,CAAC;AAC1G,CAAC;AAUD,SAAS,eAAe;IACtB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAyB,eAAe,EACxC,OAA+B,eAAe,EAAE;IAEhD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACxD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,iDAAiD;YACzD,eAAe,EAAE,8DAA8D;SAChF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,WAAW,GAAG,gBAAgB,EAAE,CAAC;QACnC,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,4CAA4C;YACpD,eAAe,EACb,4FAA4F;gBAC5F,0CAA0C;SAC7C,CAAC;IACJ,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,6BAA6B;YACrC,eAAe,EACb,oGAAoG;gBACpG,uDAAuD;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,IAAI,KAAK,GAAG,iBAAiB,EAAE,CAAC;QACxC,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kCAAkC,iBAAiB,OAAO;YAClE,eAAe,EACb,UAAU,WAAW,kCAAkC,iBAAiB,uBAAuB;gBAC/F,2DAA2D;SAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,gCAAgC;YACxC,eAAe,EAAE,iFAAiF;SACnG,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA6B;IAChE,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAExB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvC,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEpB,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,qEAAqE;IACrE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,0BAA0B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,uBAAuB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,qEAAqE;QACrE,sEAAsE;QACtE,mDAAmD;QACnD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,0EAA0E,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAE7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,UAAuB,EACvB,oBAA8E,4BAA4B,EAC1G,SAAsC;IAEtC,MAAM,IAAI,GAAG,UAAU,IAAI,eAAe,CAAC;IAC3C,MAAM,UAAU,GAAG;QACjB,KAAK,EAAE,SAAS,EAAE,KAAK;QACvB,UAAU,EAAE,SAAS,EAAE,UAAU;QACjC,UAAU,EAAE,SAAS,EAAE,UAAU;KAClC,CAAC;IACF,MAAM,mBAAmB,GAAG,SAAS,EAAE,mBAAmB,IAAI,wBAAwB,CAAC;IACvF,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAElF,MAAM,gBAAgB,GAAG,KAAK,EAAE,QAAgB,EAAE,OAAe,EAA8C,EAAE;QAC/G,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,iBAAiB,CAAC,MAAM,CAAsC,CAAC;IACxE,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,KAAa;YAC3B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;YACzF,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,mBAAmB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAA6B;YACxC,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,QAAgB;YAC1B,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,IAAI,CACR,QAAgB,EAChB,OAA0B,EAC1B,SAAkB,EAClB,QAAwB;YAExB,MAAM,OAAO,GAAG,SAAS,IAAI,uBAAuB,CAAC;YACrD,oEAAoE;YACpE,sEAAsE;YACtE,MAAM,YAAY,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACrE,MAAM,QAAQ,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,QAAQ,EAAE,YAAY,CAAW,CAAC;YAClF,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,EAAE;oBAC9F,OAAO;oBACP,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;iBAC5B,CAAC,CAAC;gBACH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACzC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrB,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvB,MAAM,CAAC,IAAI,CACT,kDAAkD,OAAO,cAAc,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI;4BAC3F,UAAU,GAAG,CAAC,MAAM,IAAI,MAAM,qBAAqB,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CACpF,CAAC;oBACJ,CAAC;oBACD,OAAO;wBACL,QAAQ,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBACrD,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;qBACnB,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,QAAgB;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,EAAE;oBAClF,OAAO,EAAE,CAAC,oBAAoB,GAAG,CAAC,CAAC,GAAG,IAAI;iBAC3C,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,QAAgB;YAC3B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAgB;YAC9B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACtD,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC1E,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CACd,GAAW,EACX,cAAsB,EACtB,UAAkB,EAClB,MAA+B;YAE/B,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;YAC/E,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC;oBAChB,SAAS,EAAE,iBAAiB;oBAC5B,IAAI;oBACJ,aAAa,EAAE,qBAAqB;iBACrC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,kEAAkE;gBAClE,2DAA2D;gBAC3D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,KAAK,CACb,oEAAoE;wBAClE,uFAAuF,OAAO,EAAE,EAClG,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,KAAa;YAC9C,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7F,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAkC,CAAC;gBACzE,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;oBAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;oBACtD,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,KAAK,CAAC;gBACxC,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,MAAM,EAAE,GAAoB,EAAE,CAAC,WAAW,CAAC,mCAAmC,CAAC;QAC/E,WAAW,EAAE,GAAqB,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC;QACjE,UAAU,EAAE,GAAwC,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC;QACnF,YAAY,EAAE,GAAyC,EAAE,CAAC,WAAW,CAAC,kBAAkB,CAAC;QAEzF,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,KAAa;YACtD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,OAAmE;YAEnE,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACnC,IAAI,OAAO,EAAE,QAAQ;oBAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,MAAM;oBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBAAE,OAAO;gBACtE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,IAAY;YAC9B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,KAAa;YAC3B,MAAM,WAAW,CAAC;gBAChB,SAAS,EAAE,gBAAgB;gBAC3B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC;gBACrD,aAAa,EAAE,oBAAoB;aACpC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,QAAgB;YAC/B,sDAAsD;YACtD,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/F,MAAM,EAAE,GAAI,iBAAiB,CAAC,MAAM,CAAmC,EAAE,EAAE,CAAC;gBAC5E,IAAI,EAAE;oBAAE,OAAO,eAAe,CAAC,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;YAED,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC;gBAC/D,OAAO,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,IAAY;YAClC,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC9F,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAsD,CAAC;gBAC7F,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,cAAc;YACZ,oEAAoE;YACpE,8DAA8D;YAC9D,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAC5F,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,OAAe;YACvD,iEAAiE;YACjE,gDAAgD;YAChD,MAAM,WAAW,GAAG,CAAC,CAAC;YACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAC1D,MAAM,UAAU,GAAG,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;gBAC/E,MAAM,IAAI,GAAG,UAAU,EAAE,WAAW,CAAC;gBACrC,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC9B,IAAI,EAAE;wBAAE,OAAO,EAAE,CAAC;gBACpB,CAAC;gBAED,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;oBAC1B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,eAAe,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,QAAgB;YACpC,IAAI,CAAC;gBACH,iEAAiE;gBACjE,4DAA4D;gBAC5D,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,IAAY;YACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAE1B,kEAAkE;YAClE,mEAAmE;YACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;YAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,sBAAsB,wBAAwB,0BAA0B,CAAC,CAAC;gBACxG,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,2BAA2B,CAAC,CAAC;YAC1E,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAExB,sDAAsD;YACtD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/docker/code-mode-proxy.d.ts

@@ -57,5 +57,16 @@ export interface CodeModeProxyOptions {
     readonly config: IronCurtainConfig;
     /** Listen mode: 'uds' (default) or 'tcp'. TCP mode uses OS-assigned port. */
     readonly listenMode?: 'uds' | 'tcp';
+    /**
+     * TCP bind address. Defaults to 127.0.0.1 (the tcp-sidecar topology,
+     * where Docker Desktop forwards `host.docker.internal` to loopback).
+     * The tcp-hostonly topology binds 0.0.0.0 — the vmnet gateway interface
+     * does not exist until the first container attaches — and MUST pair
+     * that with `allowRemoteAddress` to keep the unauthenticated MCP
+     * endpoint off the LAN. Ignored in UDS mode.
+     */
+    readonly bindHost?: string;
+    /** Connection-source filter forwarded to the TCP transport. Ignored in UDS mode. */
+    readonly allowRemoteAddress?: (remoteAddress: string | undefined) => boolean;
 }
 export declare function createCodeModeProxy(options: CodeModeProxyOptions): DockerProxy;

package/dist/docker/code-mode-proxy.js

@@ -113,7 +113,9 @@ export function createCodeModeProxy(options) {
             });
             // 3. Start the transport
             if (useTcp) {
-                transport = new TcpServerTransport('127.0.0.1', 0);
+                transport = new TcpServerTransport(options.bindHost ?? '127.0.0.1', 0, {
+                    allowRemoteAddress: options.allowRemoteAddress,
+                });
             }
             else {
                 transport = new UdsServerTransport(options.socketPath);

package/dist/docker/code-mode-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"code-mode-proxy.js","sourceRoot":"","sources":["../../src/docker/code-mode-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,OAAO,EAAiB,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA+CxC,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;IAE5C,IAAI,SAAS,GAAkB,IAAI,CAAC,CAAC,uDAAuD;IAC5F,IAAI,SAAS,GAAmD,IAAI,CAAC;IAErE,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAE9B,IAAI,IAAI;YACN,IAAI,SAAS,YAAY,kBAAkB,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,OAAO,SAAS,CAAC,IAAI,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,KAAK;YACT,sEAAsE;YACtE,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEzC,+DAA+D;YAC/D,SAAS,GAAG,IAAI,MAAM,CAAE,uDAAuD;YAC7E,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,EACnD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;YAEF,mGAAmG;YACnG,SAAS,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC/D,KAAK,EAAE;oBACL;wBACE,IAAI,EAAE,cAAc;wBACpB,WAAW,EACT,+CAA+C;4BAC/C,yCAAyC;4BACzC,qCAAqC;4BACrC,+CAA+C;wBACjD,WAAW,EAAE;4BACX,IAAI,EAAE,QAAiB;4BACvB,UAAU,EAAE;gCACV,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,4BAA4B;iCAC1C;6BACF;4BACD,QAAQ,EAAE,CAAC,MAAM,CAAC;yBACnB;qBACF;iBACF;aACF,CAAC,CAAC,CAAC;YAEJ,SAAS,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAC3C,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBACzE,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAA0C,CAAC;gBACvE,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtC,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;wBACrE,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;oBACzD,MAAM,KAAK,GAAa,EAAE,CAAC;oBAE3B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpB,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBAClC,CAAC;yBAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACtC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,CAAC;yBAAM,CAAC;wBACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC9C,CAAC;oBAED,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;qBACtD,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;6BAC7E;yBACF;wBACD,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,yBAAyB;YACzB,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAED,WAAW;YACT,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC;QAED,mBAAmB;YACjB,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;gBACxB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,0EAA0E;YAC1E,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"code-mode-proxy.js","sourceRoot":"","sources":["../../src/docker/code-mode-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,OAAO,EAAiB,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA0DxC,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;IAE5C,IAAI,SAAS,GAAkB,IAAI,CAAC,CAAC,uDAAuD;IAC5F,IAAI,SAAS,GAAmD,IAAI,CAAC;IAErE,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAE9B,IAAI,IAAI;YACN,IAAI,SAAS,YAAY,kBAAkB,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,OAAO,SAAS,CAAC,IAAI,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,KAAK;YACT,sEAAsE;YACtE,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEzC,+DAA+D;YAC/D,SAAS,GAAG,IAAI,MAAM,CAAE,uDAAuD;YAC7E,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,EACnD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;YAEF,mGAAmG;YACnG,SAAS,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC/D,KAAK,EAAE;oBACL;wBACE,IAAI,EAAE,cAAc;wBACpB,WAAW,EACT,+CAA+C;4BAC/C,yCAAyC;4BACzC,qCAAqC;4BACrC,+CAA+C;wBACjD,WAAW,EAAE;4BACX,IAAI,EAAE,QAAiB;4BACvB,UAAU,EAAE;gCACV,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,4BAA4B;iCAC1C;6BACF;4BACD,QAAQ,EAAE,CAAC,MAAM,CAAC;yBACnB;qBACF;iBACF;aACF,CAAC,CAAC,CAAC;YAEJ,SAAS,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAC3C,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBACzE,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAA0C,CAAC;gBACvE,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtC,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;wBACrE,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;oBACzD,MAAM,KAAK,GAAa,EAAE,CAAC;oBAE3B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpB,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBAClC,CAAC;yBAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACtC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,CAAC;yBAAM,CAAC;wBACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC9C,CAAC;oBAED,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;qBACtD,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;6BAC7E;yBACF;wBACD,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,yBAAyB;YACzB,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC,EAAE;oBACrE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;iBAC/C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAED,WAAW;YACT,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC;QAED,mBAAmB;YACjB,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;gBACxB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,0EAA0E;YAC1E,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}