@provos/ironcurtain 0.11.0 → 0.13.0

package/dist/docker/adapters/claude-code.js

@@ -11,11 +11,26 @@
  * 1. Code Mode instructions (from session/prompts.ts) for tool discovery
  * 2. Docker environment context explaining workspace, host access, and policy
  */
+import { OPENROUTER_BASE_URL, OPENROUTER_HOST } from '../../config/user-config.js';
 import { parseModelId } from '../../config/model-provider.js';
+import { makeOpenRouterProviderForProfile, openRouterCredential, resolveMappedModel } from '../openrouter.js';
 import { anthropicProvider, claudePlatformProvider, anthropicOAuthProvider, claudePlatformOAuthProvider, } from '../provider-config.js';
 import { buildSystemPrompt } from '../../session/prompts.js';
 import { buildResizePtyScript, buildCheckPtySizeScript, buildNetworkSection, buildPolicySection, buildAttributionSection, } from './shared-scripts.js';
 const CLAUDE_CODE_IMAGE = 'ironcurtain-claude-code:latest';
+/**
+ * Claude Code streaming-watchdog tuning vars forwarded from the host env into
+ * the container when set (see `buildEnv`). Curated allowlist — these govern
+ * the idle-stream abort ("Response stalled mid-stream", issue #367) and let it
+ * be exercised against the MITM stream-delay knob without rebuilding the image.
+ */
+const WATCHDOG_ENV_PASSTHROUGH = [
+    'CLAUDE_STREAM_IDLE_TIMEOUT_MS',
+    'CLAUDE_ENABLE_STREAM_WATCHDOG',
+    'CLAUDE_ENABLE_BYTE_WATCHDOG',
+    'API_FORCE_IDLE_TIMEOUT',
+    'API_TIMEOUT_MS',
+];
 /**
  * Container path used as the parent for Claude Code's skill discovery.
  * Claude Code's `--add-dir <path>` flag scans `<path>/.claude/skills/`,
@@ -84,6 +99,10 @@ export function createClaudeCodeAdapter(userConfig) {
         async getImage() {
             return CLAUDE_CODE_IMAGE;
         },
+        // Claude Code is installed unpinned in the image; log the resolved version
+        // at infra prep so a silent minor bump (which can change subagent semantics
+        // — issue #367) is visible.
+        versionProbe: ['claude', '--version'],
         // Generates MCP config file passed via --mcp-config on the command line.
         // socketPath is either a UDS path or a TCP host:port address.
         generateMcpConfig(socketPath) {
@@ -193,21 +212,103 @@ exit $STATUS
             const dockerPrompt = buildDockerEnvironmentPrompt(context);
             return `${codeModePrompt}\n${dockerPrompt}`;
         },
-        getProviders(authKind) {
+        getProviders(config, authKind) {
+            const profile = config.activeProviderProfile;
+            if (profile?.type === 'openrouter') {
+                // OpenRouter routing: the single bearer-auth provider replaces both
+                // the Anthropic API and telemetry providers (and the OAuth pair). No
+                // api.anthropic.com host is allowlisted (decision B); Claude Code's
+                // telemetry calls are simply blocked at CONNECT.
+                return [makeOpenRouterProviderForProfile('messages', profile, 'claude-code')];
+            }
             if (authKind === 'oauth') {
                 return [anthropicOAuthProvider, claudePlatformOAuthProvider];
             }
             return [anthropicProvider, claudePlatformProvider];
         },
+        detectCredential(config) {
+            // B2a/B2b: an OpenRouter-only user has no Anthropic OAuth/API key, so the
+            // generic detectAuthMethod() would throw. openRouterCredential reports an
+            // api-key AuthMethod for a keyed OpenRouter profile (authKind ⇒ 'apikey'),
+            // { kind: 'none' } for an empty-key profile (feeds m5), and `undefined`
+            // for a native profile — DEFERRING to detectAuthMethod() and preserving
+            // today's OAuth+API-key detection byte-for-byte.
+            return openRouterCredential(config);
+        },
         buildEnv(config, fakeKeys) {
             const env = {
                 CLAUDE_CODE_DISABLE_UPDATE_CHECK: '1',
                 // Node.js does not use the system CA store -- must set this explicitly
                 NODE_EXTRA_CA_CERTS: '/usr/local/share/ca-certificates/ironcurtain-ca.crt',
+                // Force subagents (Agent/Task tool) and `run_in_background` to run in the
+                // FOREGROUND (synchronously), disabling auto-backgrounding. As of Claude
+                // Code v2.1.198 subagents run in the *background* by default: the tool
+                // returns immediately and the parent is "notified automatically when it
+                // completes" via a persistent supervisor that re-fires the session. We
+                // invoke `claude -p` as a one-shot subprocess with no such supervisor, so
+                // when a workflow agent (e.g. vuln-discovery `analyze`) fans out to
+                // parallel subagents, the turn never receives their completions and stalls
+                // ("Response stalled mid-stream" / no `agent_status` block). This env var
+                // restores the pre-2.1.198 synchronous behavior, which the FSM's
+                // one-turn=one-result model requires. See docs/en/env-vars.
+                CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '1',
+                // Disable the streaming idle watchdog (on by default since Claude
+                // Code v2.1.196). Behind the MITM proxy, long tool-use turns and
+                // SSE re-buffering trip the watchdog's idle threshold, which
+                // aborts the request with "API Error: Response stalled
+                // mid-stream" — the actual root cause of issue #367 (PR #372's
+                // background-task fix alone did not resolve it). Turning the
+                // watchdog off restores the pre-2.1.196 behavior; the workflow
+                // orchestrator already enforces its own wall-clock/step budgets.
+                CLAUDE_ENABLE_STREAM_WATCHDOG: '0',
             };
+            // DEBUG / operability (issue #367 watchdog harness): forward a curated
+            // allowlist of Claude Code streaming-watchdog tuning vars from the host
+            // env into the container when set. Lets the streaming idle watchdog be
+            // exercised against the MITM stream-delay knob (see stream-delay.ts)
+            // without rebuilding the image. No-op unless the host sets them.
+            for (const key of WATCHDOG_ENV_PASSTHROUGH) {
+                const value = process.env[key];
+                if (value !== undefined)
+                    env[key] = value;
+            }
             if (modelId) {
                 env.IRONCURTAIN_MODEL = modelId;
             }
+            const profile = config.activeProviderProfile;
+            if (profile?.type === 'openrouter') {
+                // B2c: OpenRouter mode auth-var exclusivity. Claude Code sends its
+                // credential as `Authorization: Bearer` ONLY when it comes from
+                // ANTHROPIC_AUTH_TOKEN (not ANTHROPIC_API_KEY, which is sent as
+                // x-api-key). We therefore inject the sentinel via ANTHROPIC_AUTH_TOKEN
+                // and set NEITHER CLAUDE_CODE_OAUTH_TOKEN NOR IRONCURTAIN_API_KEY — even
+                // when host OAuth creds exist (OpenRouter overrides OAuth detection).
+                const fakeKey = fakeKeys.get(OPENROUTER_HOST);
+                if (!fakeKey) {
+                    throw new Error(`No fake key generated for ${OPENROUTER_HOST} — cannot configure Claude Code OpenRouter authentication`);
+                }
+                env.ANTHROPIC_BASE_URL = OPENROUTER_BASE_URL;
+                env.ANTHROPIC_AUTH_TOKEN = fakeKey;
+                // Suppress Anthropic-only pre-release beta fields (e.g. context_management)
+                // that non-Anthropic upstreams reject (§4.3 belt; the MITM strips too).
+                env.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS = '1';
+                // m2: per-tier model hints for the agent's own context budgeting /
+                // [1m] handling. The MITM does the authoritative remap; these are hints
+                // only. Each resolves as perAgent['claude-code'] ?? glob-map(probe) ??
+                // omit (the DEFAULT_MODEL_MAP *sonnet*/*opus*/*haiku* globs match these
+                // probe strings).
+                const perAgent = profile.perAgent['claude-code'];
+                const sonnet = perAgent ?? resolveMappedModel('claude-sonnet', profile.modelMap);
+                const opus = perAgent ?? resolveMappedModel('claude-opus', profile.modelMap);
+                const haiku = perAgent ?? resolveMappedModel('claude-haiku', profile.modelMap);
+                if (sonnet !== undefined)
+                    env.ANTHROPIC_DEFAULT_SONNET_MODEL = sonnet;
+                if (opus !== undefined)
+                    env.ANTHROPIC_DEFAULT_OPUS_MODEL = opus;
+                if (haiku !== undefined)
+                    env.ANTHROPIC_DEFAULT_HAIKU_MODEL = haiku;
+                return env;
+            }
             const fakeKey = fakeKeys.get('api.anthropic.com');
             if (!fakeKey) {
                 throw new Error('No fake key generated for api.anthropic.com — cannot configure Claude Code authentication');
@@ -264,6 +365,13 @@ exit $STATUS
                 const hardFailure = stdout.trim().length === 0;
                 return { text: `Agent exited with code ${exitCode}.\n\nOutput:\n${stdout}`, hardFailure };
             }
+            if (stdout.trim().length === 0) {
+                return {
+                    text: 'Claude Code exited without producing output. Check the session log for startup failures ' +
+                        '(for example, exhausted Docker storage).',
+                    hardFailure: true,
+                };
+            }
             return parseClaudeCodeJson(stdout);
         },
         buildPtyCommand(_systemPrompt, ptySockPath, ptyPort) {

package/dist/docker/adapters/claude-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/docker/adapters/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AACtD,MAAM,0BAA0B,GAAG,GAAG,oBAAoB,iBAAiB,CAAC;AAE5E,SAAS,4BAA4B,CAAC,OAA2B;IAC/D,OAAO;;mBAEU,OAAO,CAAC,YAAY;;;;;;;;4BAQX,OAAO,CAAC,YAAY;;;SAGvC,OAAO,CAAC,YAAY;;oBAET,OAAO,CAAC,YAAY;;;;0BAId,OAAO,CAAC,YAAY;UACpC,OAAO,CAAC,YAAY;;EAE5B,mBAAmB,CAAC,sCAAsC,CAAC;;;;;;;;;;;;EAY3D,kBAAkB,CAAC,kCAAkC,CAAC;;EAEtD,uBAAuB,EAAE;CAC1B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAA+B;IACrE,MAAM,OAAO,GAAG,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAErG,OAAO;QACL,EAAE,EAAE,aAAwB;QAC5B,WAAW,EAAE,aAAa;QAC1B,MAAM,EAAE;YACN,aAAa,EAAE,0BAA0B;YACzC,SAAS,EAAE,CAAC,WAAW,EAAE,oBAAoB,CAAC;YAC9C,MAAM,EAAE,EAAE,sBAAsB,EAAE,oBAAoB,EAAE;SACzD;QAED,iGAAiG;QACjG,KAAK,CAAC,QAAQ;YACZ,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,yEAAyE;QACzE,8DAA8D;QAC9D,iBAAiB,CAAC,UAAkB;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG;gBAChB,UAAU,EAAE;oBACV,WAAW,EAAE;wBACX,OAAO,EAAE,OAAO;wBAChB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,gBAAgB,UAAU,EAAE,CAAC;qBACvF;iBACF;aACF,CAAC;YAEF,OAAO;gBACL;oBACE,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;iBAC5C;aACF,CAAC;QACJ,CAAC;QAED,wBAAwB;YACtB,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,4DAA4D;YAC5D,EAAE;YACF,4DAA4D;YAC5D,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,iEAAiE;YACjE,gEAAgE;YAChE,sEAAsE;YACtE,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCzB,CAAC;YAEI,uFAAuF;YACvF,MAAM,YAAY,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YAE1D,OAAO;gBACL,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC9D,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC7D,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE;aACrE,CAAC;QACJ,CAAC;QAED,YAAY,CACV,OAAe,EACf,YAAoB,EACpB,OAIC;YAED,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,qEAAqE;YACrE,oCAAoC;YACpC,MAAM,GAAG,GAAG;gBACV,QAAQ;gBACR,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU;gBAC/C,OAAO,CAAC,SAAS;gBACjB,gCAAgC;gBAChC,iBAAiB;gBACjB,MAAM;gBACN,cAAc;gBACd,yCAAyC;gBACzC,wBAAwB;gBACxB,YAAY;aACb,CAAC;YACF,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACvG,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACxC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,iBAAiB,CAAC,OAA2B;YAC3C,iFAAiF;YACjF,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YAEzF,yEAAyE;YACzE,MAAM,YAAY,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;YAE3D,OAAO,GAAG,cAAc,KAAK,YAAY,EAAE,CAAC;QAC9C,CAAC;QAED,YAAY,CAAC,QAAyB;YACpC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACzB,OAAO,CAAC,sBAAsB,EAAE,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,QAAQ,CAAC,MAAyB,EAAE,QAAqC;YACvE,MAAM,GAAG,GAA2B;gBAClC,gCAAgC,EAAE,GAAG;gBACrC,uEAAuE;gBACvE,mBAAmB,EAAE,qDAAqD;aAC3E,CAAC;YAEF,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC;YAClC,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;YAC/G,CAAC;YAED,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxC,gEAAgE;gBAChE,0EAA0E;gBAC1E,GAAG,CAAC,uBAAuB,GAAG,OAAO,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,wEAAwE;gBACxE,GAAG,CAAC,mBAAmB,GAAG,OAAO,CAAC;YACpC,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC;QAED,eAAe,CAAC,QAAgB,EAAE,MAAc;YAC9C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,+DAA+D;gBAC/D,2DAA2D;gBAC3D,wDAAwD;gBACxD,iEAAiE;gBACjE,kEAAkE;gBAClE,iCAAiC;gBACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzF,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC;gBAC7D,CAAC;gBACD,4DAA4D;gBAC5D,8DAA8D;gBAC9D,gEAAgE;gBAChE,+DAA+D;gBAC/D,6DAA6D;gBAC7D,iDAAiD;gBACjD,MAAM,aAAa,GAAG,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACzF,MAAM,kBAAkB,GAAG,CAAC,IAA0B,EAAE,UAAkB,EAAiB,EAAE,CAAC,CAAC;oBAC7F,IAAI,EAAE,aAAa;oBACnB,gBAAgB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;iBACvC,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC9E,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,kBAAkB,CAAC,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC9E,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,kBAAkB,CAAC,qBAAqB,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;gBACzE,CAAC;gBACD,gEAAgE;gBAChE,oEAAoE;gBACpE,gEAAgE;gBAChE,+DAA+D;gBAC/D,mBAAmB;gBACnB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;gBAC/C,OAAO,EAAE,IAAI,EAAE,0BAA0B,QAAQ,iBAAiB,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC;YAC5F,CAAC;YACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,eAAe,CACb,aAAqB,EACrB,WAA+B,EAC/B,OAA2B;YAE3B,gDAAgD;YAChD,MAAM,SAAS,GAAG,WAAW;gBAC3B,CAAC,CAAC,eAAe,WAAW,OAAO,CAAC,YAAY;gBAChD,CAAC,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC,YAAY;YAEnD,2EAA2E;YAC3E,0EAA0E;YAC1E,yEAAyE;YACzE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,oEAAoE,CAAC,CAAC;QACpG,CAAC;QAED,0BAA0B;YACxB,OAAO;gBACL,WAAW,EAAE,cAAc;gBAC3B,kBAAkB,EAAE,0BAA0B;gBAC9C,IAAI,EAAE;oBACJ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,sCAAsC;iBAC3E;gBACD,WAAW,EAAE,CAAC,YAAY,CAAC;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,kEAAkE,CAAC;AAE7F,uGAAuG;AACvG,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,4BAA4B,CACnC,MAA+B,EAC/B,MAAc;IAEd,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,UAAU,GAAG,UAAU,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAAC,MAA+B,EAAE,MAAc;IAC7E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,YAAY,GAAI,KAAiC,CAAC,aAAa,CAAC;IACtE,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;IACtC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,MAA+B,EAAE,MAAc;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/E,MAAM,IAAI,GACR,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAClG,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;QAC1G,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/docker/adapters/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAeH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG;IAC/B,+BAA+B;IAC/B,+BAA+B;IAC/B,6BAA6B;IAC7B,wBAAwB;IACxB,gBAAgB;CACR,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AACtD,MAAM,0BAA0B,GAAG,GAAG,oBAAoB,iBAAiB,CAAC;AAE5E,SAAS,4BAA4B,CAAC,OAA2B;IAC/D,OAAO;;mBAEU,OAAO,CAAC,YAAY;;;;;;;;4BAQX,OAAO,CAAC,YAAY;;;SAGvC,OAAO,CAAC,YAAY;;oBAET,OAAO,CAAC,YAAY;;;;0BAId,OAAO,CAAC,YAAY;UACpC,OAAO,CAAC,YAAY;;EAE5B,mBAAmB,CAAC,sCAAsC,CAAC;;;;;;;;;;;;EAY3D,kBAAkB,CAAC,kCAAkC,CAAC;;EAEtD,uBAAuB,EAAE;CAC1B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAA+B;IACrE,MAAM,OAAO,GAAG,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAErG,OAAO;QACL,EAAE,EAAE,aAAwB;QAC5B,WAAW,EAAE,aAAa;QAC1B,MAAM,EAAE;YACN,aAAa,EAAE,0BAA0B;YACzC,SAAS,EAAE,CAAC,WAAW,EAAE,oBAAoB,CAAC;YAC9C,MAAM,EAAE,EAAE,sBAAsB,EAAE,oBAAoB,EAAE;SACzD;QAED,iGAAiG;QACjG,KAAK,CAAC,QAAQ;YACZ,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,4BAA4B;QAC5B,YAAY,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;QAErC,yEAAyE;QACzE,8DAA8D;QAC9D,iBAAiB,CAAC,UAAkB;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG;gBAChB,UAAU,EAAE;oBACV,WAAW,EAAE;wBACX,OAAO,EAAE,OAAO;wBAChB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,gBAAgB,UAAU,EAAE,CAAC;qBACvF;iBACF;aACF,CAAC;YAEF,OAAO;gBACL;oBACE,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;iBAC5C;aACF,CAAC;QACJ,CAAC;QAED,wBAAwB;YACtB,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,4DAA4D;YAC5D,EAAE;YACF,4DAA4D;YAC5D,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,iEAAiE;YACjE,gEAAgE;YAChE,sEAAsE;YACtE,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCzB,CAAC;YAEI,uFAAuF;YACvF,MAAM,YAAY,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,eAAe,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YAE1D,OAAO;gBACL,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC9D,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC7D,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE;aACrE,CAAC;QACJ,CAAC;QAED,YAAY,CACV,OAAe,EACf,YAAoB,EACpB,OAIC;YAED,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,qEAAqE;YACrE,oCAAoC;YACpC,MAAM,GAAG,GAAG;gBACV,QAAQ;gBACR,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU;gBAC/C,OAAO,CAAC,SAAS;gBACjB,gCAAgC;gBAChC,iBAAiB;gBACjB,MAAM;gBACN,cAAc;gBACd,yCAAyC;gBACzC,wBAAwB;gBACxB,YAAY;aACb,CAAC;YACF,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACvG,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACxC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,iBAAiB,CAAC,OAA2B;YAC3C,iFAAiF;YACjF,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YAEzF,yEAAyE;YACzE,MAAM,YAAY,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;YAE3D,OAAO,GAAG,cAAc,KAAK,YAAY,EAAE,CAAC;QAC9C,CAAC;QAED,YAAY,CAAC,MAAyB,EAAE,QAAyB;YAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC;YAC7C,IAAI,OAAO,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnC,oEAAoE;gBACpE,qEAAqE;gBACrE,oEAAoE;gBACpE,iDAAiD;gBACjD,OAAO,CAAC,gCAAgC,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACzB,OAAO,CAAC,sBAAsB,EAAE,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,gBAAgB,CAAC,MAAyB;YACxC,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,wEAAwE;YACxE,wEAAwE;YACxE,iDAAiD;YACjD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,QAAQ,CAAC,MAAyB,EAAE,QAAqC;YACvE,MAAM,GAAG,GAA2B;gBAClC,gCAAgC,EAAE,GAAG;gBACrC,uEAAuE;gBACvE,mBAAmB,EAAE,qDAAqD;gBAC1E,0EAA0E;gBAC1E,yEAAyE;gBACzE,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,0EAA0E;gBAC1E,oEAAoE;gBACpE,2EAA2E;gBAC3E,0EAA0E;gBAC1E,iEAAiE;gBACjE,4DAA4D;gBAC5D,oCAAoC,EAAE,GAAG;gBACzC,kEAAkE;gBAClE,iEAAiE;gBACjE,6DAA6D;gBAC7D,uDAAuD;gBACvD,+DAA+D;gBAC/D,6DAA6D;gBAC7D,+DAA+D;gBAC/D,iEAAiE;gBACjE,6BAA6B,EAAE,GAAG;aACnC,CAAC;YAEF,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,iEAAiE;YACjE,KAAK,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC5C,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC;YAClC,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC;YAC7C,IAAI,OAAO,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnC,mEAAmE;gBACnE,gEAAgE;gBAChE,gEAAgE;gBAChE,wEAAwE;gBACxE,yEAAyE;gBACzE,sEAAsE;gBACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,6BAA6B,eAAe,2DAA2D,CACxG,CAAC;gBACJ,CAAC;gBACD,GAAG,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;gBAC7C,GAAG,CAAC,oBAAoB,GAAG,OAAO,CAAC;gBACnC,4EAA4E;gBAC5E,wEAAwE;gBACxE,GAAG,CAAC,sCAAsC,GAAG,GAAG,CAAC;gBACjD,mEAAmE;gBACnE,wEAAwE;gBACxE,uEAAuE;gBACvE,wEAAwE;gBACxE,kBAAkB;gBAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,QAAQ,IAAI,kBAAkB,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACjF,MAAM,IAAI,GAAG,QAAQ,IAAI,kBAAkB,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC7E,MAAM,KAAK,GAAG,QAAQ,IAAI,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC/E,IAAI,MAAM,KAAK,SAAS;oBAAE,GAAG,CAAC,8BAA8B,GAAG,MAAM,CAAC;gBACtE,IAAI,IAAI,KAAK,SAAS;oBAAE,GAAG,CAAC,4BAA4B,GAAG,IAAI,CAAC;gBAChE,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,6BAA6B,GAAG,KAAK,CAAC;gBACnE,OAAO,GAAG,CAAC;YACb,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;YAC/G,CAAC;YAED,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxC,gEAAgE;gBAChE,0EAA0E;gBAC1E,GAAG,CAAC,uBAAuB,GAAG,OAAO,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,wEAAwE;gBACxE,GAAG,CAAC,mBAAmB,GAAG,OAAO,CAAC;YACpC,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC;QAED,eAAe,CAAC,QAAgB,EAAE,MAAc;YAC9C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,+DAA+D;gBAC/D,2DAA2D;gBAC3D,wDAAwD;gBACxD,iEAAiE;gBACjE,kEAAkE;gBAClE,iCAAiC;gBACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzF,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC;gBAC7D,CAAC;gBACD,4DAA4D;gBAC5D,8DAA8D;gBAC9D,gEAAgE;gBAChE,+DAA+D;gBAC/D,6DAA6D;gBAC7D,iDAAiD;gBACjD,MAAM,aAAa,GAAG,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACzF,MAAM,kBAAkB,GAAG,CAAC,IAA0B,EAAE,UAAkB,EAAiB,EAAE,CAAC,CAAC;oBAC7F,IAAI,EAAE,aAAa;oBACnB,gBAAgB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;iBACvC,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC9E,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,kBAAkB,CAAC,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC9E,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,kBAAkB,CAAC,qBAAqB,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;gBACzE,CAAC;gBACD,gEAAgE;gBAChE,oEAAoE;gBACpE,gEAAgE;gBAChE,+DAA+D;gBAC/D,mBAAmB;gBACnB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;gBAC/C,OAAO,EAAE,IAAI,EAAE,0BAA0B,QAAQ,iBAAiB,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC;YAC5F,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACL,IAAI,EACF,0FAA0F;wBAC1F,0CAA0C;oBAC5C,WAAW,EAAE,IAAI;iBAClB,CAAC;YACJ,CAAC;YACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,eAAe,CACb,aAAqB,EACrB,WAA+B,EAC/B,OAA2B;YAE3B,gDAAgD;YAChD,MAAM,SAAS,GAAG,WAAW;gBAC3B,CAAC,CAAC,eAAe,WAAW,OAAO,CAAC,YAAY;gBAChD,CAAC,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC,YAAY;YAEnD,2EAA2E;YAC3E,0EAA0E;YAC1E,yEAAyE;YACzE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,oEAAoE,CAAC,CAAC;QACpG,CAAC;QAED,0BAA0B;YACxB,OAAO;gBACL,WAAW,EAAE,cAAc;gBAC3B,kBAAkB,EAAE,0BAA0B;gBAC9C,IAAI,EAAE;oBACJ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,sCAAsC;iBAC3E;gBACD,WAAW,EAAE,CAAC,YAAY,CAAC;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,kEAAkE,CAAC;AAE7F,uGAAuG;AACvG,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,4BAA4B,CACnC,MAA+B,EAC/B,MAAc;IAEd,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,UAAU,GAAG,UAAU,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAAC,MAA+B,EAAE,MAAc;IAC7E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,YAAY,GAAI,KAAiC,CAAC,aAAa,CAAC;IACtE,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;IACtC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,MAA+B,EAAE,MAAc;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/E,MAAM,IAAI,GACR,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAClG,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;QAC1G,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACjC,CAAC"}

package/dist/docker/adapters/codex.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Codex CLI adapter for Docker Agent Mode.
+ *
+ * Runs OpenAI Codex CLI non-interactively through the same container,
+ * MCP proxy, and MITM fake-token path as other Docker agents. The adapter
+ * uses Codex's ChatGPT OAuth/access-token flow, not OPENAI_API_KEY.
+ */
+import type { AgentAdapter } from '../agent-adapter.js';
+import type { ResolvedUserConfig } from '../../config/user-config.js';
+/**
+ * @param userConfig - Resolved user config, accepted for factory-signature
+ *   symmetry with the other adapters (m3). Codex reads no non-profile field
+ *   from it today; the ACTIVE PROFILE is read from the per-session stamped
+ *   `config.activeProviderProfile` at method-call time, never captured here
+ *   (§9 F1 — a factory-captured profile would leak across the process-global
+ *   registry's cached instance).
+ */
+export declare function createCodexAdapter(userConfig?: ResolvedUserConfig): AgentAdapter;

package/dist/docker/adapters/codex.js

@@ -0,0 +1,376 @@
+/**
+ * Codex CLI adapter for Docker Agent Mode.
+ *
+ * Runs OpenAI Codex CLI non-interactively through the same container,
+ * MCP proxy, and MITM fake-token path as other Docker agents. The adapter
+ * uses Codex's ChatGPT OAuth/access-token flow, not OPENAI_API_KEY.
+ */
+import { DEFAULT_GLM_SLUG, OPENROUTER_API_V1, OPENROUTER_HOST } from '../../config/user-config.js';
+import { buildSystemPrompt } from '../../session/prompts.js';
+import { codexAuthProvider, codexChatGptProvider } from '../provider-config.js';
+import { makeOpenRouterProviderForProfile, openRouterCredential, resolveMappedModel } from '../openrouter.js';
+import { loadCodexOAuthCredentials } from '../oauth-credentials.js';
+import { parseModelId } from '../../config/model-provider.js';
+import { buildAttributionSection, buildCheckPtySizeScript, buildNetworkSection, buildPolicySection, buildResizePtyScript, } from './shared-scripts.js';
+const CODEX_IMAGE = 'ironcurtain-codex:latest';
+const CODEX_FAKE_ID_TOKEN = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.' +
+    'eyJlbWFpbCI6Imlyb25jdXJ0YWluQGV4YW1wbGUuaW52YWxpZCIsImh0dHBzOi8vYXBpLm9wZW5haS5jb20vYXV0aCI6eyJjaGF0Z3B0X3BsYW5fdHlwZSI6InBybyIsImNoYXRncHRfdXNlcl9pZCI6Imlyb25jdXJ0YWluLXVzZXIiLCJjaGF0Z3B0X2FjY291bnRfaWQiOiJpcm9uY3VydGFpbi1hY2NvdW50IiwiY2hhdGdwdF9hY2NvdW50X2lzX2ZlZHJhbXAiOmZhbHNlfX0.' +
+    'c2ln';
+function tomlString(value) {
+    return JSON.stringify(value);
+}
+function buildCodexDockerEnvironmentPrompt(context) {
+    return `## Docker Environment
+
+### Workspace (\`${context.workspaceDir}\`)
+This is your workspace inside the container. You have full access here.
+For local file operations inside ${context.workspaceDir}, use your built-in shell tools.
+
+### External Operations (MCP tools)
+Use the IronCurtain MCP server for operations that require external access:
+- Network requests (HTTP fetches, web searches, API calls)
+- Git remote operations (clone, push, pull, fetch)
+- Reading files outside ${context.workspaceDir}
+
+After cloning a repo or writing files via MCP tools, use your built-in
+tools for subsequent file operations.
+
+${buildNetworkSection('the IronCurtain MCP tools')}
+${buildPolicySection('MCP tool call')}
+${buildAttributionSection()}`;
+}
+function buildStartScript() {
+    return `#!/bin/bash
+if [ -n "$IRONCURTAIN_INITIAL_COLS" ] && [ -n "$IRONCURTAIN_INITIAL_ROWS" ]; then
+  stty cols "$IRONCURTAIN_INITIAL_COLS" rows "$IRONCURTAIN_INITIAL_ROWS" 2>/dev/null
+fi
+cd /workspace
+
+MODEL_ARGS=()
+if [ -n "$IRONCURTAIN_MODEL" ]; then
+  MODEL_ARGS=(--model "$IRONCURTAIN_MODEL")
+fi
+
+exec codex --ask-for-approval never --sandbox danger-full-access "\${MODEL_ARGS[@]}" --cd /workspace
+`;
+}
+/**
+ * Codex slug under an openrouter-type profile (D2). Codex has NO native model
+ * field in IronCurtain config, so the slug is `perAgent.codex`, else the
+ * `DEFAULT_GLM_SLUG` run through the profile's `modelMap` — never an unmapped
+ * passthrough (a non-matching map falls back to `DEFAULT_GLM_SLUG`).
+ *
+ * Applying the map here is what keeps `config.toml`'s `model` consistent with
+ * the model the MITM rewriter actually serves: the rewriter (D1) re-globs
+ * whatever Codex sends, so without the same map the container would budget its
+ * context window for one model while being routed to another.
+ */
+function codexSlugFor(profile) {
+    return profile.perAgent.codex ?? resolveMappedModel(DEFAULT_GLM_SLUG, profile.modelMap) ?? DEFAULT_GLM_SLUG;
+}
+/**
+ * Builds the Codex `config.toml` string. Under an openrouter-type profile the
+ * two root keys (`model`, `model_provider`) are PREPENDED before the first
+ * `[table]` (TOML is order-sensitive — root keys must precede any table header,
+ * §4.6/B1), and the `[model_providers.openrouter]` table is APPENDED.
+ */
+function buildCodexToml(connectTarget, profile) {
+    const rootKeys = ['cli_auth_credentials_store = "file"', 'project_doc_fallback_filenames = ["CLAUDE.md"]'];
+    const openrouterRootKeys = profile
+        ? [`model = ${tomlString(codexSlugFor(profile))}`, 'model_provider = "openrouter"']
+        : [];
+    const openrouterProviderTable = profile
+        ? [
+            '',
+            '[model_providers.openrouter]',
+            `base_url = ${tomlString(OPENROUTER_API_V1)}`,
+            'env_key = "OPENROUTER_API_KEY"',
+            'wire_api = "responses"',
+        ]
+        : [];
+    return [
+        ...openrouterRootKeys,
+        ...rootKeys,
+        '',
+        '[projects."/workspace"]',
+        'trust_level = "trusted"',
+        ...openrouterProviderTable,
+        '',
+        '[mcp_servers.ironcurtain]',
+        'command = "socat"',
+        `args = ["STDIO", ${tomlString(connectTarget)}]`,
+        'startup_timeout_sec = 20',
+        'tool_timeout_sec = 600',
+        'default_tools_approval_mode = "auto"',
+        '',
+    ].join('\n');
+}
+/**
+ * @param userConfig - Resolved user config, accepted for factory-signature
+ *   symmetry with the other adapters (m3). Codex reads no non-profile field
+ *   from it today; the ACTIVE PROFILE is read from the per-session stamped
+ *   `config.activeProviderProfile` at method-call time, never captured here
+ *   (§9 F1 — a factory-captured profile would leak across the process-global
+ *   registry's cached instance).
+ */
+// eslint-disable-next-line @typescript-eslint/no-unused-vars -- userConfig kept for factory-signature symmetry (m3)
+export function createCodexAdapter(userConfig) {
+    return {
+        id: 'codex',
+        displayName: 'Codex CLI',
+        credentialHelpText: 'No Codex OAuth credentials found. Run `codex login` on the host; OPENAI_API_KEY is not required.',
+        // eslint-disable-next-line @typescript-eslint/require-await -- interface requires Promise return
+        async getImage() {
+            return CODEX_IMAGE;
+        },
+        generateMcpConfig(socketPath, config) {
+            const isTcp = socketPath.includes(':');
+            const connectTarget = isTcp ? `TCP:${socketPath}` : `UNIX-CONNECT:${socketPath}`;
+            const profile = config.activeProviderProfile;
+            const openrouterProfile = profile?.type === 'openrouter' ? profile : undefined;
+            const toml = buildCodexToml(connectTarget, openrouterProfile);
+            return [{ path: 'codex-config.toml', content: toml }];
+        },
+        generateOrientationFiles() {
+            return [
+                { path: 'start-codex.sh', content: buildStartScript(), mode: 0o755 },
+                { path: 'resize-pty.sh', content: buildResizePtyScript('codex'), mode: 0o755 },
+                { path: 'check-pty-size.sh', content: buildCheckPtySizeScript('codex'), mode: 0o755 },
+            ];
+        },
+        buildCommand(message, systemPrompt, options) {
+            const prompt = `${systemPrompt}\n\n---\n\nUser request:\n${message}`;
+            const cmd = ['codex', '--ask-for-approval', 'never', '--sandbox', 'danger-full-access'];
+            if (options.modelOverride) {
+                cmd.push('--model', parseModelId(options.modelOverride).modelId);
+            }
+            cmd.push('exec', '--json', '--skip-git-repo-check', '--cd', '/workspace', prompt);
+            return cmd;
+        },
+        buildSystemPrompt(context) {
+            const codeModePrompt = buildSystemPrompt(context.serverListings, context.hostSandboxDir);
+            const dockerPrompt = buildCodexDockerEnvironmentPrompt(context);
+            return `${codeModePrompt}\n${dockerPrompt}`;
+        },
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars -- authKind kept for adapter interface symmetry
+        getProviders(config, _authKind) {
+            const profile = config.activeProviderProfile;
+            if (profile?.type === 'openrouter') {
+                // Codex speaks the Responses wire format; the bearer OpenRouter provider
+                // replaces the ChatGPT OAuth providers entirely.
+                return [makeOpenRouterProviderForProfile('responses', profile, 'codex')];
+            }
+            return [codexChatGptProvider, codexAuthProvider];
+        },
+        buildEnv(config, fakeKeys) {
+            const profile = config.activeProviderProfile;
+            if (profile?.type === 'openrouter') {
+                // OpenRouter mode: Codex reads OPENROUTER_API_KEY (referenced by the
+                // generated config.toml's env_key). Drop the Codex OAuth token env
+                // entirely — the ChatGPT auth flow is not used here.
+                const fakeKey = fakeKeys.get(OPENROUTER_HOST);
+                if (!fakeKey) {
+                    throw new Error(`No fake key generated for ${OPENROUTER_HOST} — cannot configure Codex OpenRouter authentication`);
+                }
+                return {
+                    CODEX_HOME: '/home/codespace/.codex',
+                    OPENROUTER_API_KEY: fakeKey,
+                    CODEX_CA_CERTIFICATE: '/usr/local/share/ca-certificates/ironcurtain-ca.crt',
+                    SSL_CERT_FILE: '/etc/ssl/certs/ca-certificates.crt',
+                    RUST_LOG: 'error',
+                };
+            }
+            const fakeToken = fakeKeys.get('chatgpt.com');
+            if (!fakeToken) {
+                throw new Error('No fake token generated for chatgpt.com — cannot configure Codex authentication');
+            }
+            return {
+                CODEX_HOME: '/home/codespace/.codex',
+                IRONCURTAIN_CODEX_ACCESS_TOKEN: fakeToken,
+                IRONCURTAIN_CODEX_ID_TOKEN: CODEX_FAKE_ID_TOKEN,
+                IRONCURTAIN_CODEX_ACCOUNT_ID: 'ironcurtain-account',
+                CODEX_CA_CERTIFICATE: '/usr/local/share/ca-certificates/ironcurtain-ca.crt',
+                SSL_CERT_FILE: '/etc/ssl/certs/ca-certificates.crt',
+                RUST_LOG: 'error',
+            };
+        },
+        /**
+         * NOTE on quota / transient-failure handling and the assumed Codex
+         * envelope schema.
+         *
+         * Codex `exec --json` emits a JSONL event stream, one JSON object per
+         * line. The happy path carries `item.completed` events whose `item.type`
+         * is `agent_message` (the model's text). We CANNOT confirm Codex's exact
+         * failure-event schema from the repo, so detection is intentionally
+         * conservative and generic (see `scanCodexEvents`):
+         *
+         *   - A top-level event is treated as a failure when its `type` ends in
+         *     `.failed` (e.g. `turn.failed`) or equals `error`, OR when its
+         *     `item.type` is `error`. We pull a human-readable message from the
+         *     event's / item's `error.message`, `message`, or `text` field.
+         *   - From that failure message (plus the non-zero-exit stderr/stdout on
+         *     the error path), `withFailureSignal` does narrow, string-based
+         *     matching: a rate-limit / usage-limit / quota / HTTP-429 hit sets
+         *     `quotaExhausted` (the orchestrator pauses-and-resumes instead of
+         *     burning the run); anything else error-shaped sets a transient
+         *     `degenerate_response` failure.
+         *
+         * Detection is deliberately narrow so it cannot misfire on normal
+         * output: the happy-path return value below is byte-identical to the
+         * previous implementation (last `agent_message`, else raw stdout). See
+         * the Claude Code adapter (`adapters/claude-code.ts`) for the canonical
+         * contract and `AgentResponse.quotaExhausted` / `transientFailure` in
+         * `../agent-adapter.ts` for the interface requirement.
+         */
+        extractResponse(exitCode, stdout, stderr) {
+            const clean = stdout.trim();
+            const scan = scanCodexEvents(clean);
+            if (exitCode !== 0) {
+                const errorOutput = [clean, stderr?.trim()].filter((part) => part && part.length > 0).join('\n\n');
+                const baseText = `Codex exited with code ${exitCode}.\n\nOutput:\n${errorOutput}`;
+                // Combine any in-band failure message with the raw error output so a
+                // 429 surfaced either in-band OR only in stderr/stdout is detected.
+                const probe = [scan.errorMessage, clean, stderr].filter((p) => p && p.length > 0).join('\n');
+                return withFailureSignal({ text: baseText }, probe);
+            }
+            // Exit 0: prefer the model's final message. If none is present but the
+            // stream carried a failure event, describe the failure (and attach the
+            // structured signal) instead of dumping a raw JSONL line.
+            if (scan.finalMessage) {
+                return { text: scan.finalMessage };
+            }
+            if (scan.errorMessage) {
+                return withFailureSignal({ text: `Codex reported an error:\n\n${scan.errorMessage}` }, scan.errorMessage);
+            }
+            return { text: clean };
+        },
+        buildPtyCommand(_systemPrompt, ptySockPath, ptyPort) {
+            const listenArg = ptySockPath ? `UNIX-LISTEN:${ptySockPath},fork` : `TCP-LISTEN:${ptyPort},reuseaddr`;
+            return ['socat', listenArg, 'EXEC:/etc/ironcurtain/start-codex.sh,pty,setsid,ctty,stderr,rawer'];
+        },
+        detectCredential(config) {
+            // OpenRouter mode: credential presence is the profile's non-empty apiKey
+            // (no `codex login` needed); empty ⇒ 'none' (feeds m5). Native ⇒ undefined,
+            // so fall through to Codex ChatGPT OAuth detection.
+            const openRouter = openRouterCredential(config);
+            if (openRouter)
+                return openRouter;
+            const credentials = loadCodexOAuthCredentials();
+            if (!credentials)
+                return { kind: 'none' };
+            return {
+                kind: 'oauth',
+                credentials: {
+                    accessToken: credentials.accessToken,
+                    refreshToken: credentials.refreshToken,
+                    expiresAt: credentials.expiresAt,
+                },
+                source: 'file',
+            };
+        },
+        getConversationStateConfig() {
+            return {
+                hostDirName: 'codex-state',
+                containerMountPath: '/home/codespace/.codex/',
+                seed: [
+                    { path: 'sessions/', content: '' },
+                    { path: 'logs/', content: '' },
+                ],
+                resumeFlags: [],
+            };
+        },
+    };
+}
+/**
+ * Single-pass scan over the Codex `exec --json` JSONL stream.
+ *
+ * Collects the last `agent_message` text and the first detected
+ * failure/error message. Malformed/truncated lines are skipped (the JSONL
+ * stream can be truncated when a process is killed), so a valid
+ * `agent_message` on a later line is still recovered.
+ */
+function scanCodexEvents(stdout) {
+    if (stdout.length === 0)
+        return { finalMessage: null, errorMessage: null };
+    let lastAgentMessage = null;
+    let errorMessage = null;
+    for (const line of stdout.split(/\r?\n/)) {
+        if (line.trim().length === 0)
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!parsed || typeof parsed !== 'object')
+            continue;
+        const event = parsed;
+        const item = event.item && typeof event.item === 'object' ? event.item : undefined;
+        if (item && item.type === 'agent_message' && typeof item.text === 'string') {
+            lastAgentMessage = item.text;
+        }
+        if (errorMessage === null) {
+            errorMessage = extractCodexErrorMessage(event, item);
+        }
+    }
+    return { finalMessage: lastAgentMessage?.trim() || null, errorMessage };
+}
+/**
+ * Recognizes a Codex failure/error envelope generically (the exact schema
+ * is not confirmable from the repo): a top-level `type` ending in `.failed`
+ * or equal to `error`, or an item whose `type` is `error`. Returns a
+ * best-effort human-readable message, or null when the event is not a
+ * failure shape.
+ */
+function extractCodexErrorMessage(event, item) {
+    const eventType = typeof event.type === 'string' ? event.type : undefined;
+    const isEventFailure = eventType !== undefined && (eventType.endsWith('.failed') || eventType === 'error');
+    const isItemFailure = item !== undefined && item.type === 'error';
+    if (!isEventFailure && !isItemFailure)
+        return null;
+    return pickErrorMessage(event) ?? (item ? pickErrorMessage(item) : undefined) ?? eventType ?? 'unknown Codex error';
+}
+/** Pulls a message string from an `error.message` / `message` / `text` field. */
+function pickErrorMessage(obj) {
+    const nested = obj.error;
+    if (nested && typeof nested === 'object') {
+        const msg = nested.message;
+        if (typeof msg === 'string' && msg.length > 0)
+            return msg;
+    }
+    if (typeof obj.message === 'string' && obj.message.length > 0)
+        return obj.message;
+    if (typeof obj.text === 'string' && obj.text.length > 0)
+        return obj.text;
+    return undefined;
+}
+/** Narrow, case-insensitive substring matches for upstream quota/rate-limit. */
+const QUOTA_PROBE_PATTERNS = [
+    /\b429\b/,
+    /rate.?limit/i,
+    /usage.?limit/i,
+    /\bquota\b/i,
+    /too many requests/i,
+];
+/**
+ * Best-effort classification of a Codex error string into a structured
+ * signal. Quota / rate-limit / 429 hits map to `quotaExhausted`; any other
+ * non-empty error string maps to a transient `degenerate_response`.
+ * Returns the response unchanged when `probe` is empty.
+ *
+ * Detection is intentionally string-based and narrow so it cannot misfire
+ * on normal model output (only reached when a failure event was detected or
+ * the process exited non-zero).
+ */
+function withFailureSignal(response, probe) {
+    const trimmed = probe.trim();
+    if (trimmed.length === 0)
+        return response;
+    if (QUOTA_PROBE_PATTERNS.some((re) => re.test(trimmed))) {
+        return { ...response, quotaExhausted: { rawMessage: trimmed } };
+    }
+    return { ...response, transientFailure: { kind: 'degenerate_response', rawMessage: trimmed } };
+}
+//# sourceMappingURL=codex.js.map

package/dist/docker/adapters/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/docker/adapters/codex.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,gCAAgC,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,MAAM,mBAAmB,GACvB,sCAAsC;IACtC,8RAA8R;IAC9R,MAAM,CAAC;AAET,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,iCAAiC,CAAC,OAA2B;IACpE,OAAO;;mBAEU,OAAO,CAAC,YAAY;;mCAEJ,OAAO,CAAC,YAAY;;;;;;0BAM7B,OAAO,CAAC,YAAY;;;;;EAK5C,mBAAmB,CAAC,2BAA2B,CAAC;EAChD,kBAAkB,CAAC,eAAe,CAAC;EACnC,uBAAuB,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;;;;;;;;;;;;CAYR,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,OAAkC;IACtD,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,aAAqB,EAAE,OAA8C;IAC3F,MAAM,QAAQ,GAAG,CAAC,qCAAqC,EAAE,gDAAgD,CAAC,CAAC;IAC3G,MAAM,kBAAkB,GAAG,OAAO;QAChC,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,+BAA+B,CAAC;QACnF,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,uBAAuB,GAAG,OAAO;QACrC,CAAC,CAAC;YACE,EAAE;YACF,8BAA8B;YAC9B,cAAc,UAAU,CAAC,iBAAiB,CAAC,EAAE;YAC7C,gCAAgC;YAChC,wBAAwB;SACzB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,GAAG,kBAAkB;QACrB,GAAG,QAAQ;QACX,EAAE;QACF,yBAAyB;QACzB,yBAAyB;QACzB,GAAG,uBAAuB;QAC1B,EAAE;QACF,2BAA2B;QAC3B,mBAAmB;QACnB,oBAAoB,UAAU,CAAC,aAAa,CAAC,GAAG;QAChD,0BAA0B;QAC1B,wBAAwB;QACxB,sCAAsC;QACtC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,oHAAoH;AACpH,MAAM,UAAU,kBAAkB,CAAC,UAA+B;IAChE,OAAO;QACL,EAAE,EAAE,OAAkB;QACtB,WAAW,EAAE,WAAW;QACxB,kBAAkB,EAChB,kGAAkG;QAEpG,iGAAiG;QACjG,KAAK,CAAC,QAAQ;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,iBAAiB,CAAC,UAAkB,EAAE,MAAyB;YAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,gBAAgB,UAAU,EAAE,CAAC;YAEjF,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC;YAC7C,MAAM,iBAAiB,GAAG,OAAO,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;YAE9D,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,wBAAwB;YACtB,OAAO;gBACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;gBACpE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC9E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;aACtF,CAAC;QACJ,CAAC;QAED,YAAY,CACV,OAAe,EACf,YAAoB,EACpB,OAIC;YAED,MAAM,MAAM,GAAG,GAAG,YAAY,6BAA6B,OAAO,EAAE,CAAC;YACrE,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC;YACxF,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC;YACnE,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YAClF,OAAO,GAAG,CAAC;QACb,CAAC;QAED,iBAAiB,CAAC,OAA2B;YAC3C,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YACzF,MAAM,YAAY,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;YAChE,OAAO,GAAG,cAAc,KAAK,YAAY,EAAE,CAAC;QAC9C,CAAC;QAED,6GAA6G;QAC7G,YAAY,CAAC,MAAyB,EAAE,SAA0B;YAChE,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC;YAC7C,IAAI,OAAO,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnC,yEAAyE;gBACzE,iDAAiD;gBACjD,OAAO,CAAC,gCAAgC,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAED,QAAQ,CAAC,MAAyB,EAAE,QAAqC;YACvE,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC;YAC7C,IAAI,OAAO,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnC,qEAAqE;gBACrE,mEAAmE;gBACnE,qDAAqD;gBACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,6BAA6B,eAAe,qDAAqD,CAClG,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,UAAU,EAAE,wBAAwB;oBACpC,kBAAkB,EAAE,OAAO;oBAC3B,oBAAoB,EAAE,qDAAqD;oBAC3E,aAAa,EAAE,oCAAoC;oBACnD,QAAQ,EAAE,OAAO;iBAClB,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YACrG,CAAC;YAED,OAAO;gBACL,UAAU,EAAE,wBAAwB;gBACpC,8BAA8B,EAAE,SAAS;gBACzC,0BAA0B,EAAE,mBAAmB;gBAC/C,4BAA4B,EAAE,qBAAqB;gBACnD,oBAAoB,EAAE,qDAAqD;gBAC3E,aAAa,EAAE,oCAAoC;gBACnD,QAAQ,EAAE,OAAO;aAClB,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,eAAe,CAAC,QAAgB,EAAE,MAAc,EAAE,MAAe;YAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YAEpC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnG,MAAM,QAAQ,GAAG,0BAA0B,QAAQ,iBAAiB,WAAW,EAAE,CAAC;gBAClF,qEAAqE;gBACrE,oEAAoE;gBACpE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC;YAED,uEAAuE;YACvE,uEAAuE;YACvE,0DAA0D;YAC1D,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,+BAA+B,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5G,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzB,CAAC;QAED,eAAe,CACb,aAAqB,EACrB,WAA+B,EAC/B,OAA2B;YAE3B,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,eAAe,WAAW,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,YAAY,CAAC;YACtG,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,mEAAmE,CAAC,CAAC;QACnG,CAAC;QAED,gBAAgB,CAAC,MAAyB;YACxC,yEAAyE;YACzE,4EAA4E;YAC5E,oDAAoD;YACpD,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;YAClC,MAAM,WAAW,GAAG,yBAAyB,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE;oBACX,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,SAAS,EAAE,WAAW,CAAC,SAAS;iBACjC;gBACD,MAAM,EAAE,MAAM;aACf,CAAC;QACJ,CAAC;QAED,0BAA0B;YACxB,OAAO;gBACL,WAAW,EAAE,aAAa;gBAC1B,kBAAkB,EAAE,yBAAyB;gBAC7C,IAAI,EAAE;oBACJ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;oBAClC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;iBAC/B;gBACD,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAaD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAE3E,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,MAAM,KAAK,GAAG,MAAiC,CAAC;QAEhD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,IAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhH,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3E,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/B,CAAC;QAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,YAAY,GAAG,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,YAAY,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,KAA8B,EAC9B,IAAyC;IAEzC,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,cAAc,GAAG,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC,CAAC;IAC3G,MAAM,aAAa,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;IAClE,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEnD,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,qBAAqB,CAAC;AACtH,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,GAA4B;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;IACzB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,GAAG,GAAI,MAAkC,CAAC,OAAO,CAAC;QACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAClF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,oBAAoB,GAAsB;IAC9C,SAAS;IACT,cAAc;IACd,eAAe;IACf,YAAY;IACZ,oBAAoB;CACrB,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,QAAuB,EAAE,KAAa;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;AACjG,CAAC"}