@provos/ironcurtain 0.3.1 → 0.4.0

package/dist/trusted-process/tcp-server-transport.js

@@ -0,0 +1,119 @@
+/**
+ * TCP server transport for the MCP SDK.
+ *
+ * Listens on a configurable TCP host and port and bridges each
+ * connection to the MCP SDK's Transport interface. Uses the same
+ * newline-delimited JSON framing as StdioServerTransport.
+ *
+ * This is the TCP equivalent of UdsServerTransport, used on macOS
+ * where Docker Desktop's VirtioFS does not support Unix domain
+ * sockets in bind mounts. The caller controls the bind address:
+ * 127.0.0.1 for loopback-only or 0.0.0.0 for all interfaces.
+ *
+ * Only one concurrent client is expected (the agent in the container).
+ * If a new connection arrives while one is active, the old connection
+ * is closed.
+ */
+import { createServer } from 'node:net';
+import { ReadBuffer, serializeMessage } from '@modelcontextprotocol/sdk/shared/stdio.js';
+export class TcpServerTransport {
+    host;
+    requestedPort;
+    server = null;
+    activeSocket = null;
+    readBuffer = new ReadBuffer();
+    _port = null;
+    onclose;
+    onerror;
+    onmessage;
+    constructor(host, port) {
+        this.host = host;
+        this.requestedPort = port;
+    }
+    /** The actual port the server is listening on. Only valid after start(). */
+    get port() {
+        if (this._port === null) {
+            throw new Error('TcpServerTransport has not been started');
+        }
+        return this._port;
+    }
+    /**
+     * Starts listening on the TCP port.
+     * Resolves once the server is bound and ready for connections.
+     * Idempotent: subsequent calls are no-ops (the MCP SDK's
+     * server.connect() calls start() internally).
+     */
+    async start() {
+        if (this.server)
+            return;
+        const server = createServer((socket) => this.handleConnection(socket));
+        this.server = server;
+        return new Promise((resolve, reject) => {
+            server.on('error', (err) => {
+                reject(err);
+            });
+            server.listen(this.requestedPort, this.host, () => {
+                const addr = server.address();
+                if (addr && typeof addr === 'object') {
+                    this._port = addr.port;
+                }
+                resolve();
+            });
+        });
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars -- options included for Transport interface compliance
+    async send(message, options) {
+        const socket = this.activeSocket;
+        if (!socket || socket.destroyed) {
+            throw new Error('No active TCP connection to send message to');
+        }
+        return new Promise((resolve, reject) => {
+            const data = serializeMessage(message);
+            socket.write(data, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async close() {
+        this.activeSocket?.destroy();
+        this.activeSocket = null;
+        const server = this.server;
+        if (server) {
+            this.server = null;
+            await new Promise((resolve) => {
+                server.close(() => resolve());
+            });
+        }
+        this.onclose?.();
+    }
+    handleConnection(socket) {
+        // Close any existing connection -- only one client expected
+        if (this.activeSocket && !this.activeSocket.destroyed) {
+            this.activeSocket.destroy();
+        }
+        this.activeSocket = socket;
+        this.readBuffer = new ReadBuffer();
+        socket.on('data', (chunk) => {
+            this.readBuffer.append(chunk);
+            this.processReadBuffer();
+        });
+        socket.on('error', (err) => {
+            this.onerror?.(err);
+        });
+        socket.on('close', () => {
+            if (this.activeSocket === socket) {
+                this.activeSocket = null;
+            }
+        });
+    }
+    processReadBuffer() {
+        let message;
+        while ((message = this.readBuffer.readMessage()) !== null) {
+            this.onmessage?.(message);
+        }
+    }
+}
+//# sourceMappingURL=tcp-server-transport.js.map

package/dist/trusted-process/tcp-server-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tcp-server-transport.js","sourceRoot":"","sources":["../../src/trusted-process/tcp-server-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAyC,MAAM,UAAU,CAAC;AAG/E,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAEzF,MAAM,OAAO,kBAAkB;IACZ,IAAI,CAAS;IACb,aAAa,CAAS;IAC/B,MAAM,GAAqB,IAAI,CAAC;IAChC,YAAY,GAAkB,IAAI,CAAC;IACnC,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,KAAK,GAAkB,IAAI,CAAC;IAEpC,OAAO,CAAc;IACrB,OAAO,CAA0B;IACjC,SAAS,CAAqC;IAE9C,YAAY,IAAY,EAAE,IAAY;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,4EAA4E;IAC5E,IAAI,IAAI;QACN,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QAExB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;gBACzB,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oHAAoH;IACpH,KAAK,CAAC,IAAI,CAAC,OAAuB,EAAE,OAA8B;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IACnB,CAAC;IAEO,gBAAgB,CAAC,MAAc;QACrC,4DAA4D;QAC5D,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YACtD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;QAEnC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAC3B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB;QACvB,IAAI,OAA8B,CAAC;QACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF"}

package/dist/types/argument-roles.js

@@ -44,11 +44,26 @@ export function resolveRealPath(filePath) {
         return realpathSync(absolute);
     }
     catch {
-        try {
-            return join(realpathSync(dirname(absolute)), basename(absolute));
-        }
-        catch {
-            return absolute;
+        // Walk up to find the deepest existing ancestor, resolve it, then reattach the tail.
+        // This handles cases like /tmp/nonexistent/file.txt on macOS where /tmp → /private/tmp
+        // but the intermediate directory doesn't exist yet.
+        let current = absolute;
+        const tail = [];
+        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- loop exits via return
+        while (true) {
+            const parent = dirname(current);
+            tail.unshift(basename(current));
+            if (parent === current) {
+                // Reached filesystem root without finding an existing path
+                return absolute;
+            }
+            current = parent;
+            try {
+                return join(realpathSync(current), ...tail);
+            }
+            catch {
+                // Continue walking up
+            }
         }
     }
 }

package/dist/types/argument-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"argument-roles.js","sourceRoot":"","sources":["../../src/types/argument-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA2CnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,eAAe,GAAqC;IACxD;QACE,WAAW;QACX;YACE,WAAW,EAAE,mCAAmC;YAChD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,yEAAyE;gBACzE,mDAAmD;YACrD,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,YAAY;QACZ;YACE,WAAW,EAAE,yCAAyC;YACtD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,+EAA+E;gBAC/E,gEAAgE;YAClE,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gFAAgF;gBAChF,uFAAuF;YACzF,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,eAAe;QACf;YACE,WAAW,EAAE,qDAAqD;YAClE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gGAAgG;gBAChG,sFAAsF;gBACtF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,2DAA2D;YACxE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,8FAA8F;gBAC9F,oFAAoF;gBACpF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,WAAW;QACX;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,YAAY;YAC1B,kBAAkB,EAChB,iEAAiE;gBACjE,8CAA8C;YAChD,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,uDAAuD;YACpE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,sFAAsF;gBACtF,kGAAkG;YACpG,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,iBAAiB;YAC9B,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,iDAAiD;gBACjD,2FAA2F;YAC7F,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,yBAAyB;YACtC,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAAE,oDAAoD,GAAG,kCAAkC;YAC7G,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,MAAM;QACN;YACE,WAAW,EAAE,mDAAmD;YAChE,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,kEAAkE;gBAClE,gFAAgF;SACnF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAA8C,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1G,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,wBAAwB,GAA+B;IAC3D,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,IAAI;IACtB,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,kBAAkB,CAAC,QAAsB;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,YAAY;IAC1B,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW;IACzB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA8B,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC"}
+{"version":3,"file":"argument-roles.js","sourceRoot":"","sources":["../../src/types/argument-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA2CnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,uFAAuF;QACvF,oDAAoD;QACpD,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,gGAAgG;QAChG,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,2DAA2D;gBAC3D,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,eAAe,GAAqC;IACxD;QACE,WAAW;QACX;YACE,WAAW,EAAE,mCAAmC;YAChD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,yEAAyE;gBACzE,mDAAmD;YACrD,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,YAAY;QACZ;YACE,WAAW,EAAE,yCAAyC;YACtD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,+EAA+E;gBAC/E,gEAAgE;YAClE,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gFAAgF;gBAChF,uFAAuF;YACzF,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,eAAe;QACf;YACE,WAAW,EAAE,qDAAqD;YAClE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gGAAgG;gBAChG,sFAAsF;gBACtF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,2DAA2D;YACxE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,8FAA8F;gBAC9F,oFAAoF;gBACpF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,WAAW;QACX;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,YAAY;YAC1B,kBAAkB,EAChB,iEAAiE;gBACjE,8CAA8C;YAChD,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,uDAAuD;YACpE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,sFAAsF;gBACtF,kGAAkG;YACpG,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,iBAAiB;YAC9B,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,iDAAiD;gBACjD,2FAA2F;YAC7F,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,yBAAyB;YACtC,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAAE,oDAAoD,GAAG,kCAAkC;YAC7G,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,MAAM;QACN;YACE,WAAW,EAAE,mDAAmD;YAChE,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,kEAAkE;gBAClE,gFAAgF;SACnF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAA8C,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1G,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,wBAAwB,GAA+B;IAC3D,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,IAAI;IACtB,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,kBAAkB,CAAC,QAAsB;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,YAAY;IAC1B,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW;IACzB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA8B,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC"}

package/docker/Dockerfile.base.arm64

@@ -0,0 +1,23 @@
+FROM node:22-bookworm
+
+# Replicate the 'codespace' user (uid 1000) from the devcontainers/universal
+# image so Dockerfile.claude-code works unchanged on both platforms.
+# node:22-bookworm already has node:node at uid/gid 1000 — rename it.
+RUN usermod -l codespace -d /home/codespace -m node && \
+    groupmod -n codespace node
+
+USER root
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends git socat ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# IronCurtain CA (for MITM proxy trust)
+# This file is copied into a temporary build context by ensureImage().
+COPY ironcurtain-ca-cert.pem /usr/local/share/ca-certificates/ironcurtain-ca.crt
+RUN update-ca-certificates
+
+RUN mkdir -p /workspace /etc/ironcurtain /run/ironcurtain && \
+    chown codespace:codespace /workspace /etc/ironcurtain /run/ironcurtain
+
+WORKDIR /workspace
+USER codespace

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provos/ironcurtain",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "type": "module",
   "description": "Secure agent runtime with trusted process mediation",
   "license": "Apache-2.0",
@@ -26,7 +26,7 @@
     "model-context-protocol"
   ],
   "engines": {
-    "node": ">=20.19.0"
+    "node": ">=22.0.0 <26"
   },
   "bin": {
     "ironcurtain": "dist/cli.js"
@@ -50,6 +50,7 @@
     "annotate-tools": "tsx src/cli.ts annotate-tools",
     "compile-policy": "tsx src/cli.ts compile-policy",
     "customize-policy": "tsx src/cli.ts customize-policy",
+    "bot": "tsx src/cli.ts bot",
     "config": "tsx src/cli.ts config",
     "setup": "tsx src/cli.ts setup",
     "prepublishOnly": "npm run build",
@@ -94,12 +95,14 @@
     "@types/node-forge": "^1.3.14",
     "@types/shell-quote": "^1.7.5",
     "@types/turndown": "^5.0.6",
+    "@types/ws": "^8.18.1",
     "eslint": "^10.0.1",
     "eslint-config-prettier": "^10.1.8",
     "prettier": "^3.8.1",
     "tsx": "^4.19.0",
     "typescript": "^5.7.0",
     "typescript-eslint": "^8.56.0",
-    "vitest": "^4.0.18"
+    "vitest": "^4.0.18",
+    "ws": "^8.19.0"
   }
 }