@provos/ironcurtain 0.11.0 → 0.13.0

package/dist/docker/adapters/goose.js

@@ -17,8 +17,10 @@
  * - Provider-specific credential detection (not Anthropic-only)
  */
 import { randomBytes } from 'node:crypto';
+import { DEFAULT_GLM_SLUG, OPENROUTER_HOST } from '../../config/user-config.js';
 import { anthropicProvider, openaiProvider, googleProvider } from '../provider-config.js';
 import { buildSystemPrompt } from '../../session/prompts.js';
+import { makeOpenRouterProviderForProfile, openRouterCredential, resolveMappedModel } from '../openrouter.js';
 import { resolveApiKeyForProvider } from '../../config/model-provider.js';
 import { buildResizePtyScript, buildCheckPtySizeScript, buildNetworkSection, buildPolicySection, buildAttributionSection, } from './shared-scripts.js';
 const GOOSE_IMAGE = 'ironcurtain-goose:latest';
@@ -219,12 +221,40 @@ export function createGooseAdapter(userConfig) {
             return `${codeModePrompt}\n${dockerPrompt}`;
         },
         // eslint-disable-next-line @typescript-eslint/no-unused-vars -- interface requires authKind parameter
-        getProviders(_authKind) {
+        getProviders(config, _authKind) {
+            const profile = config.activeProviderProfile;
+            if (profile?.type === 'openrouter') {
+                // OpenRouter routing replaces the single native provider. Goose speaks
+                // the OpenAI chat wire format.
+                return [makeOpenRouterProviderForProfile('chat', profile, 'goose')];
+            }
             // Goose uses exactly one provider based on user config.
             // The authKind parameter is ignored because Goose does not support OAuth.
             return [getProviderConfig(gooseProvider)];
         },
-        buildEnv(_config, fakeKeys) {
+        buildEnv(config, fakeKeys) {
+            const profile = config.activeProviderProfile;
+            if (profile?.type === 'openrouter') {
+                // OpenRouter mode: Goose's native OpenRouter provider. The provider
+                // union used inside the adapter widens to 'openrouter' (the config-level
+                // GOOSE_PROVIDERS enum is unchanged — routing is driven by the active
+                // profile, not gooseProvider). GOOSE_MODEL is the resolved slug (D2):
+                // perAgent.goose ?? glob-map(gooseModel) ?? DEFAULT_GLM_SLUG.
+                const fakeKey = fakeKeys.get(OPENROUTER_HOST);
+                if (!fakeKey) {
+                    throw new Error(`No fake key generated for ${OPENROUTER_HOST}`);
+                }
+                const gooseSlug = profile.perAgent.goose ?? resolveMappedModel(gooseModel, profile.modelMap) ?? DEFAULT_GLM_SLUG;
+                return {
+                    GOOSE_PROVIDER: 'openrouter',
+                    GOOSE_MODEL: gooseSlug,
+                    GOOSE_MODE: 'auto',
+                    GOOSE_MAX_TURNS: '200',
+                    OPENROUTER_API_KEY: fakeKey,
+                    SSL_CERT_FILE: '/etc/ssl/certs/ca-certificates.crt',
+                    SSL_CERT_DIR: '/etc/ssl/certs',
+                };
+            }
             const env = {
                 GOOSE_PROVIDER: gooseProvider,
                 GOOSE_MODEL: gooseModel,
@@ -292,6 +322,12 @@ export function createGooseAdapter(userConfig) {
             return ['socat', listenArg, 'EXEC:/etc/ironcurtain/start-goose.sh,pty,setsid,ctty,stderr,rawer'];
         },
         detectCredential(config) {
+            // OpenRouter mode: credential presence is the profile's non-empty apiKey;
+            // empty ⇒ 'none' (feeds m5). Native ⇒ undefined, so fall through to the
+            // goose provider's API-key detection.
+            const openRouter = openRouterCredential(config);
+            if (openRouter)
+                return openRouter;
             const key = resolveApiKeyForProvider(gooseProvider, config.userConfig);
             if (key)
                 return { kind: 'apikey', key };

package/dist/docker/adapters/goose.js.map

@@ -1 +1 @@
-{"version":3,"file":"goose.js","sourceRoot":"","sources":["../../../src/docker/adapters/goose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM1C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,oDAAoD;AACpD,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAEpD,gEAAgE;AAEhE;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuB;IACvD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,iBAAiB,CAAC;QAC3B,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,gEAAgE;AAEhE;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,yFAAyF;IACzF,sGAAsG;IACtG,OAAO,IAAI,CAAC,OAAO,CAAC,2DAA2D,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,QAAQ,GAAI,MAAiC,CAAC,QAAQ,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,GAAG,GAAG,CAA0C,CAAC;QACvD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC1C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAC1C,MAAM,IAAI,GAAG,CAAuC,CAAC;YACrD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,gEAAgE;AAEhE;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,SAAS,GAAG,yBAAyB,CAAC;IAE1C,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,SAAS,GAAG,GAAG,yBAAyB,IAAI,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,gEAAgE;AAEhE,SAAS,iCAAiC,CAAC,OAA2B;IACpE,OAAO;;mBAEU,OAAO,CAAC,YAAY;;mCAEJ,OAAO,CAAC,YAAY;;;;;;0BAM7B,OAAO,CAAC,YAAY;;;;;EAK5C,mBAAmB,CAAC,2BAA2B,CAAC;EAChD,kBAAkB,CAAC,eAAe,CAAC;EACnC,uBAAuB,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED,gEAAgE;AAEhE,SAAS,gBAAgB;IACvB,OAAO;;;;;;;;;;CAUR,CAAC;AACF,CAAC;AAED,gEAAgE;AAEhE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA+B;IAChE,MAAM,aAAa,GAAkB,UAAU,EAAE,aAAa,IAAI,WAAW,CAAC;IAC9E,MAAM,UAAU,GAAW,UAAU,EAAE,UAAU,IAAI,0BAA0B,CAAC;IAEhF,MAAM,kBAAkB,GACtB,wCAAwC,aAAa,KAAK;QAC1D,kDAAkD;QAClD,yDAAyD;QACzD,8BAA8B,CAAC;IAEjC,MAAM,OAAO,GAAiB;QAC5B,EAAE,EAAE,OAAkB;QACtB,WAAW,EAAE,OAAO;QACpB,kBAAkB;QAClB,wEAAwE;QACxE,6CAA6C;QAC7C,MAAM,EAAE,EAAE,aAAa,EAAE,sCAAsC,EAAE;QAEjE,iGAAiG;QACjG,KAAK,CAAC,QAAQ;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,iBAAiB,CAAC,UAAkB;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,gBAAgB,UAAU,EAAE,CAAC;YAEjF,MAAM,IAAI,GAAG;gBACX,gCAAgC;gBAChC,aAAa;gBACb,gBAAgB;gBAChB,+BAA+B;gBAC/B,iBAAiB;gBACjB,mBAAmB;gBACnB,gBAAgB;gBAChB,WAAW;gBACX,eAAe;gBACf,WAAW,aAAa,EAAE;gBAC1B,kBAAkB;gBAClB,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEb,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,wBAAwB;YACtB,OAAO;gBACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;gBACpE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC9E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;aACtF,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,gDAAgD;QAChD,YAAY,CACV,OAAe,EACf,YAAoB;QACpB,6DAA6D;QAC7D,QAIC;YAED,MAAM,YAAY,GAAG,GAAG,YAAY,6BAA6B,OAAO,EAAE,CAAC;YAC3E,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;YAElD,OAAO;gBACL,SAAS;gBACT,IAAI;gBACJ,uDAAuD;oBACrD,sCAAsC;oBACtC,4BAA4B,SAAS,MAAM,YAAY,KAAK,SAAS,IAAI;oBACzE,uEAAuE;aAC1E,CAAC;QACJ,CAAC;QAED,iBAAiB,CAAC,OAA2B;YAC3C,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YACzF,MAAM,YAAY,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;YAChE,OAAO,GAAG,cAAc,KAAK,YAAY,EAAE,CAAC;QAC9C,CAAC;QAED,sGAAsG;QACtG,YAAY,CAAC,SAA0B;YACrC,wDAAwD;YACxD,0EAA0E;YAC1E,OAAO,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,QAAQ,CAAC,OAA0B,EAAE,QAAqC;YACxE,MAAM,GAAG,GAA2B;gBAClC,cAAc,EAAE,aAAa;gBAC7B,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,MAAM;gBAClB,eAAe,EAAE,KAAK;gBACtB,oDAAoD;gBACpD,sDAAsD;gBACtD,aAAa,EAAE,oCAAoC;gBACnD,YAAY,EAAE,gBAAgB;aAC/B,CAAC;YAEF,MAAM,YAAY,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC;YAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,QAAQ,aAAa,EAAE,CAAC;gBACtB,KAAK,WAAW;oBACd,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC;oBAChC,MAAM;gBACR,KAAK,QAAQ;oBACX,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC;oBAC7B,MAAM;gBACR,KAAK,QAAQ;oBACX,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC;oBAC7B,MAAM;YACV,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC;QAED;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,eAAe,CAAC,QAAgB,EAAE,MAAc;YAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAEhC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,OAAO,EAAE,IAAI,EAAE,0BAA0B,QAAQ,iBAAiB,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACrF,CAAC;YAED,iEAAiE;YACjE,6DAA6D;YAC7D,8DAA8D;YAC9D,mEAAmE;YACnE,iEAAiE;YACjE,uDAAuD;YACvD,OAAO,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,CAAC;QAED,eAAe,CACb,aAAqB,EACrB,WAA+B,EAC/B,OAA2B;YAE3B,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,eAAe,WAAW,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,YAAY,CAAC;YAEtG,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,mEAAmE,CAAC,CAAC;QACnG,CAAC;QAED,gBAAgB,CAAC,MAAyB;YACxC,MAAM,GAAG,GAAG,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACvE,IAAI,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"goose.js","sourceRoot":"","sources":["../../../src/docker/adapters/goose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM1C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,oDAAoD;AACpD,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAEpD,gEAAgE;AAEhE;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuB;IACvD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,iBAAiB,CAAC;QAC3B,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,gEAAgE;AAEhE;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,yFAAyF;IACzF,sGAAsG;IACtG,OAAO,IAAI,CAAC,OAAO,CAAC,2DAA2D,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,QAAQ,GAAI,MAAiC,CAAC,QAAQ,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,GAAG,GAAG,CAA0C,CAAC;QACvD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC1C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAC1C,MAAM,IAAI,GAAG,CAAuC,CAAC;YACrD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,gEAAgE;AAEhE;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,SAAS,GAAG,yBAAyB,CAAC;IAE1C,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,SAAS,GAAG,GAAG,yBAAyB,IAAI,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,gEAAgE;AAEhE,SAAS,iCAAiC,CAAC,OAA2B;IACpE,OAAO;;mBAEU,OAAO,CAAC,YAAY;;mCAEJ,OAAO,CAAC,YAAY;;;;;;0BAM7B,OAAO,CAAC,YAAY;;;;;EAK5C,mBAAmB,CAAC,2BAA2B,CAAC;EAChD,kBAAkB,CAAC,eAAe,CAAC;EACnC,uBAAuB,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED,gEAAgE;AAEhE,SAAS,gBAAgB;IACvB,OAAO;;;;;;;;;;CAUR,CAAC;AACF,CAAC;AAED,gEAAgE;AAEhE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA+B;IAChE,MAAM,aAAa,GAAkB,UAAU,EAAE,aAAa,IAAI,WAAW,CAAC;IAC9E,MAAM,UAAU,GAAW,UAAU,EAAE,UAAU,IAAI,0BAA0B,CAAC;IAEhF,MAAM,kBAAkB,GACtB,wCAAwC,aAAa,KAAK;QAC1D,kDAAkD;QAClD,yDAAyD;QACzD,8BAA8B,CAAC;IAEjC,MAAM,OAAO,GAAiB;QAC5B,EAAE,EAAE,OAAkB;QACtB,WAAW,EAAE,OAAO;QACpB,kBAAkB;QAClB,wEAAwE;QACxE,6CAA6C;QAC7C,MAAM,EAAE,EAAE,aAAa,EAAE,sCAAsC,EAAE;QAEjE,iGAAiG;QACjG,KAAK,CAAC,QAAQ;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,iBAAiB,CAAC,UAAkB;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,gBAAgB,UAAU,EAAE,CAAC;YAEjF,MAAM,IAAI,GAAG;gBACX,gCAAgC;gBAChC,aAAa;gBACb,gBAAgB;gBAChB,+BAA+B;gBAC/B,iBAAiB;gBACjB,mBAAmB;gBACnB,gBAAgB;gBAChB,WAAW;gBACX,eAAe;gBACf,WAAW,aAAa,EAAE;gBAC1B,kBAAkB;gBAClB,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEb,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,wBAAwB;YACtB,OAAO;gBACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;gBACpE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC9E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;aACtF,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,gDAAgD;QAChD,YAAY,CACV,OAAe,EACf,YAAoB;QACpB,6DAA6D;QAC7D,QAIC;YAED,MAAM,YAAY,GAAG,GAAG,YAAY,6BAA6B,OAAO,EAAE,CAAC;YAC3E,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;YAElD,OAAO;gBACL,SAAS;gBACT,IAAI;gBACJ,uDAAuD;oBACrD,sCAAsC;oBACtC,4BAA4B,SAAS,MAAM,YAAY,KAAK,SAAS,IAAI;oBACzE,uEAAuE;aAC1E,CAAC;QACJ,CAAC;QAED,iBAAiB,CAAC,OAA2B;YAC3C,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YACzF,MAAM,YAAY,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;YAChE,OAAO,GAAG,cAAc,KAAK,YAAY,EAAE,CAAC;QAC9C,CAAC;QAED,sGAAsG;QACtG,YAAY,CAAC,MAAyB,EAAE,SAA0B;YAChE,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC;YAC7C,IAAI,OAAO,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnC,uEAAuE;gBACvE,+BAA+B;gBAC/B,OAAO,CAAC,gCAAgC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,wDAAwD;YACxD,0EAA0E;YAC1E,OAAO,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,QAAQ,CAAC,MAAyB,EAAE,QAAqC;YACvE,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC;YAC7C,IAAI,OAAO,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnC,oEAAoE;gBACpE,yEAAyE;gBACzE,sEAAsE;gBACtE,sEAAsE;gBACtE,8DAA8D;gBAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC;gBACjG,OAAO;oBACL,cAAc,EAAE,YAAY;oBAC5B,WAAW,EAAE,SAAS;oBACtB,UAAU,EAAE,MAAM;oBAClB,eAAe,EAAE,KAAK;oBACtB,kBAAkB,EAAE,OAAO;oBAC3B,aAAa,EAAE,oCAAoC;oBACnD,YAAY,EAAE,gBAAgB;iBAC/B,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAA2B;gBAClC,cAAc,EAAE,aAAa;gBAC7B,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,MAAM;gBAClB,eAAe,EAAE,KAAK;gBACtB,oDAAoD;gBACpD,sDAAsD;gBACtD,aAAa,EAAE,oCAAoC;gBACnD,YAAY,EAAE,gBAAgB;aAC/B,CAAC;YAEF,MAAM,YAAY,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC;YAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,QAAQ,aAAa,EAAE,CAAC;gBACtB,KAAK,WAAW;oBACd,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC;oBAChC,MAAM;gBACR,KAAK,QAAQ;oBACX,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC;oBAC7B,MAAM;gBACR,KAAK,QAAQ;oBACX,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC;oBAC7B,MAAM;YACV,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC;QAED;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,eAAe,CAAC,QAAgB,EAAE,MAAc;YAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAEhC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,OAAO,EAAE,IAAI,EAAE,0BAA0B,QAAQ,iBAAiB,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACrF,CAAC;YAED,iEAAiE;YACjE,6DAA6D;YAC7D,8DAA8D;YAC9D,mEAAmE;YACnE,iEAAiE;YACjE,uDAAuD;YACvD,OAAO,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,CAAC;QAED,eAAe,CACb,aAAqB,EACrB,WAA+B,EAC/B,OAA2B;YAE3B,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,eAAe,WAAW,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,YAAY,CAAC;YAEtG,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,mEAAmE,CAAC,CAAC;QACnG,CAAC;QAED,gBAAgB,CAAC,MAAyB;YACxC,0EAA0E;YAC1E,wEAAwE;YACxE,sCAAsC;YACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;YAClC,MAAM,GAAG,GAAG,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACvE,IAAI,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/docker/agent-adapter.d.ts

@@ -15,6 +15,8 @@ import type { AuthMethod } from './oauth-credentials.js';
  * between container and host in both directions.
  */
 export declare const CONTAINER_WORKSPACE_DIR = "/workspace";
+/** Workflow package helper scripts are mounted read-only at this path. */
+export declare const CONTAINER_SCRIPTS_DIR = "/workflow-scripts";
 /**
  * Structured response from an agent adapter, carrying both the
  * text response and optional cost/usage metadata reported by the agent.
@@ -190,13 +192,25 @@ export interface AgentAdapter {
      * May trigger a build if the image doesn't exist yet.
      */
     getImage(): Promise<string>;
+    /**
+     * Command that prints the installed agent CLI version, run against the built
+     * image via {@link ContainerRuntime.probeImageVersion} (e.g.
+     * `['claude', '--version']`). The agent CLI is installed UNPINNED in the image,
+     * so infra prep logs the resolved version to surface silent drift on rebuild
+     * (issue #367). Omit to skip version logging for this adapter.
+     */
+    readonly versionProbe?: readonly string[];
     /**
      * Generates the MCP client configuration file that tells
      * the agent how to connect to IronCurtain's proxy.
      *
      * @param socketPath - container-side UDS path (e.g., /run/ironcurtain/proxy.sock)
+     * @param config - per-session config. Codex reads `config.activeProviderProfile`
+     *   to decide whether to emit the OpenRouter TOML root keys + provider table
+     *   (§9.2). The profile MUST come from the per-session stamped `config`, never
+     *   from a factory-captured value (§9 F1).
      */
-    generateMcpConfig(socketPath: string): AgentConfigFile[];
+    generateMcpConfig(socketPath: string, config: IronCurtainConfig): AgentConfigFile[];
     /**
      * Generates orientation documents that teach the agent about
      * the MCP-mediated environment.
@@ -233,10 +247,14 @@ export interface AgentAdapter {
      * The MITM proxy uses these to build the host allowlist,
      * generate fake API keys, swap keys in requests, and filter endpoints.
      *
+     * @param config - per-session config. Adapters read `config.activeProviderProfile`
+     *   to decide whether to return the OpenRouter provider or the native providers.
+     *   The profile MUST come from the per-session stamped `config`, never from a
+     *   factory-captured value (§9 F1).
      * @param authKind - When 'oauth', returns providers configured for bearer
      *   token injection instead of header-based API key injection.
      */
-    getProviders(authKind?: DockerAuthKind): readonly ProviderConfig[];
+    getProviders(config: IronCurtainConfig, authKind?: DockerAuthKind): readonly ProviderConfig[];
     /**
      * Constructs environment variables for the container.
      * Receives fake keys instead of real keys -- the real keys never
@@ -260,8 +278,10 @@ export interface AgentAdapter {
      *
      * @param exitCode - the container's exit code
      * @param stdout - captured stdout from the container
+     * @param stderr - captured stderr from the container, useful for CLIs that
+     *   report non-zero errors there instead of stdout
      */
-    extractResponse(exitCode: number, stdout: string): AgentResponse;
+    extractResponse(exitCode: number, stdout: string, stderr?: string): AgentResponse;
     /**
      * Returns the Docker container command for PTY mode.
      * When provided, the container runs this command directly instead of
@@ -276,10 +296,18 @@ export interface AgentAdapter {
     buildPtyCommand?(systemPrompt: string, ptySockPath: string | undefined, ptyPort: number | undefined): readonly string[];
     /**
      * Detects available credentials for this agent.
-     * When not implemented, prepareDockerInfrastructure() falls back to
-     * detectAuthMethod() (Anthropic OAuth + API key detection).
+     *
+     * When not implemented — OR when it returns `undefined` —
+     * prepareDockerInfrastructure() falls back to detectAuthMethod()
+     * (Anthropic OAuth + API key detection). Returning `undefined` lets an
+     * adapter handle only a subset of cases (e.g. Claude Code returns an
+     * api-key AuthMethod for an OpenRouter-only profile via B2a, but returns
+     * `undefined` for a native profile to preserve today's OAuth+API-key
+     * detection path). Returning `{ kind: 'none' }` is a DEFINITIVE "no
+     * credentials" that makes infra prep throw — distinct from the
+     * fall-through `undefined`.
      */
-    detectCredential?(config: IronCurtainConfig): AuthMethod;
+    detectCredential?(config: IronCurtainConfig): AuthMethod | undefined;
     /**
      * Error message to show when no credentials are detected.
      * When not set, the default Anthropic-oriented message is used.

package/dist/docker/agent-adapter.js

@@ -11,6 +11,8 @@
  * between container and host in both directions.
  */
 export const CONTAINER_WORKSPACE_DIR = '/workspace';
+/** Workflow package helper scripts are mounted read-only at this path. */
+export const CONTAINER_SCRIPTS_DIR = '/workflow-scripts';
 /**
  * Human-readable description of a transient-failure kind, used in
  * user-facing terminal-status text and error messages. Centralized so

package/dist/docker/agent-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-adapter.js","sourceRoot":"","sources":["../../src/docker/agent-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAuFpD;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAA0B;IACrE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,qBAAqB;YACxB,OAAO,+DAA+D,CAAC;QACzE,KAAK,cAAc;YACjB,OAAO,2DAA2D,CAAC;IACvE,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-adapter.js","sourceRoot":"","sources":["../../src/docker/agent-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAuFzD;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAA0B;IACrE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,qBAAqB;YACxB,OAAO,+DAA+D,CAAC;QACzE,KAAK,cAAc;YACjB,OAAO,2DAA2D,CAAC;IACvE,CAAC;AACH,CAAC"}

package/dist/docker/agent-registry.js

@@ -41,5 +41,10 @@ export async function registerBuiltinAdapters(userConfig) {
         const gooseAdapter = createGooseAdapter(userConfig);
         registry.set(gooseAdapter.id, gooseAdapter);
     }
+    if (!registry.has('codex')) {
+        const { createCodexAdapter } = await import('./adapters/codex.js');
+        const codexAdapter = createCodexAdapter(userConfig);
+        registry.set(codexAdapter.id, codexAdapter);
+    }
 }
 //# sourceMappingURL=agent-registry.js.map

package/dist/docker/agent-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-registry.js","sourceRoot":"","sources":["../../src/docker/agent-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,EAAW;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,gBAAgB,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAA+B;IAC3E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAwB,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC9E,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAC9D,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAkB,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpD,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-registry.js","sourceRoot":"","sources":["../../src/docker/agent-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,EAAW;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,gBAAgB,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAA+B;IAC3E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAwB,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC9E,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAC9D,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAkB,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpD,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAkB,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpD,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/docker/apple-container-manager.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Apple `container` CLI wrapper implementing the ContainerRuntime interface.
+ *
+ * Peer implementation to docker-manager.ts for macOS 26+ on Apple silicon
+ * (see docs/designs/apple-container-runtime.md). Each container runs in its
+ * own lightweight VM; networking uses host-only vmnet networks instead of
+ * Docker's bridge + sidecar arrangement.
+ *
+ * This module is the only place allowed to spawn the `container` binary,
+ * always via execFile with argument arrays (no shell strings).
+ *
+ * CLI semantics verified against `container` 1.0.0:
+ *   - `create`/`start`/`exec`/`stop`/`delete` mirror the Docker verbs;
+ *     `--init`, `--cap-drop ALL`, `--label`, `--cpus`/`--memory`, `--user`,
+ *     `--entrypoint`, `-t` all exist with Docker-compatible meanings.
+ *   - `inspect` family returns JSON only (no Go templates); shapes are
+ *     parsed below (`AppleContainerInspect` / `AppleImageInspect`).
+ *   - `network create --internal` creates a host-only vmnet network and
+ *     duplicate creation fails with "already exists" on stderr.
+ *   - Inspecting a missing container/image exits non-zero.
+ *   - No `--add-host`, no `--restart`, no restartable `network connect`:
+ *     those configs throw instead of being silently dropped.
+ */
+import type { ContainerRuntime, DockerContainerConfig } from './types.js';
+import type { DockerAvailability } from './docker-probe.js';
+import { type ExecFileFn, type CreateDockerManagerOptions } from './docker-manager.js';
+/** Host facts consulted by the availability probe; injectable for tests. */
+export interface AppleContainerHostInfo {
+    readonly platform: string;
+    readonly arch: string;
+    /** Darwin kernel release, e.g. "25.5.0" (macOS 26.5). */
+    readonly release: string;
+}
+/**
+ * Availability probe for the Apple container runtime. Mirrors the shape of
+ * `checkDockerAvailable` so mode selection can treat backends uniformly.
+ */
+export declare function checkAppleContainerAvailable(execFileFn?: ExecFileFn, host?: AppleContainerHostInfo): Promise<DockerAvailability>;
+/**
+ * Builds the `container create` argument list from a container config.
+ * Exported for testing.
+ *
+ * Configs that encode Docker-only mechanisms (`extraHosts`, `restartPolicy`)
+ * throw rather than being silently dropped: they only occur on the
+ * Docker-specific topologies, and reaching here with one set means a
+ * wiring bug, not a portable request.
+ */
+export declare function buildAppleCreateArgs(config: DockerContainerConfig): string[];
+export declare function createAppleContainerManager(execFileFn?: ExecFileFn, availabilityProbe?: (execFileFn?: ExecFileFn) => Promise<DockerAvailability>, spawnOpts?: CreateDockerManagerOptions): ContainerRuntime;