@provos/ironcurtain 0.3.1 → 0.4.1

package/dist/trusted-process/tcp-server-transport.js

@@ -0,0 +1,119 @@
+/**
+ * TCP server transport for the MCP SDK.
+ *
+ * Listens on a configurable TCP host and port and bridges each
+ * connection to the MCP SDK's Transport interface. Uses the same
+ * newline-delimited JSON framing as StdioServerTransport.
+ *
+ * This is the TCP equivalent of UdsServerTransport, used on macOS
+ * where Docker Desktop's VirtioFS does not support Unix domain
+ * sockets in bind mounts. The caller controls the bind address:
+ * 127.0.0.1 for loopback-only or 0.0.0.0 for all interfaces.
+ *
+ * Only one concurrent client is expected (the agent in the container).
+ * If a new connection arrives while one is active, the old connection
+ * is closed.
+ */
+import { createServer } from 'node:net';
+import { ReadBuffer, serializeMessage } from '@modelcontextprotocol/sdk/shared/stdio.js';
+export class TcpServerTransport {
+    host;
+    requestedPort;
+    server = null;
+    activeSocket = null;
+    readBuffer = new ReadBuffer();
+    _port = null;
+    onclose;
+    onerror;
+    onmessage;
+    constructor(host, port) {
+        this.host = host;
+        this.requestedPort = port;
+    }
+    /** The actual port the server is listening on. Only valid after start(). */
+    get port() {
+        if (this._port === null) {
+            throw new Error('TcpServerTransport has not been started');
+        }
+        return this._port;
+    }
+    /**
+     * Starts listening on the TCP port.
+     * Resolves once the server is bound and ready for connections.
+     * Idempotent: subsequent calls are no-ops (the MCP SDK's
+     * server.connect() calls start() internally).
+     */
+    async start() {
+        if (this.server)
+            return;
+        const server = createServer((socket) => this.handleConnection(socket));
+        this.server = server;
+        return new Promise((resolve, reject) => {
+            server.on('error', (err) => {
+                reject(err);
+            });
+            server.listen(this.requestedPort, this.host, () => {
+                const addr = server.address();
+                if (addr && typeof addr === 'object') {
+                    this._port = addr.port;
+                }
+                resolve();
+            });
+        });
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars -- options included for Transport interface compliance
+    async send(message, options) {
+        const socket = this.activeSocket;
+        if (!socket || socket.destroyed) {
+            throw new Error('No active TCP connection to send message to');
+        }
+        return new Promise((resolve, reject) => {
+            const data = serializeMessage(message);
+            socket.write(data, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async close() {
+        this.activeSocket?.destroy();
+        this.activeSocket = null;
+        const server = this.server;
+        if (server) {
+            this.server = null;
+            await new Promise((resolve) => {
+                server.close(() => resolve());
+            });
+        }
+        this.onclose?.();
+    }
+    handleConnection(socket) {
+        // Close any existing connection -- only one client expected
+        if (this.activeSocket && !this.activeSocket.destroyed) {
+            this.activeSocket.destroy();
+        }
+        this.activeSocket = socket;
+        this.readBuffer = new ReadBuffer();
+        socket.on('data', (chunk) => {
+            this.readBuffer.append(chunk);
+            this.processReadBuffer();
+        });
+        socket.on('error', (err) => {
+            this.onerror?.(err);
+        });
+        socket.on('close', () => {
+            if (this.activeSocket === socket) {
+                this.activeSocket = null;
+            }
+        });
+    }
+    processReadBuffer() {
+        let message;
+        while ((message = this.readBuffer.readMessage()) !== null) {
+            this.onmessage?.(message);
+        }
+    }
+}
+//# sourceMappingURL=tcp-server-transport.js.map

package/dist/trusted-process/tcp-server-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tcp-server-transport.js","sourceRoot":"","sources":["../../src/trusted-process/tcp-server-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAyC,MAAM,UAAU,CAAC;AAG/E,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAEzF,MAAM,OAAO,kBAAkB;IACZ,IAAI,CAAS;IACb,aAAa,CAAS;IAC/B,MAAM,GAAqB,IAAI,CAAC;IAChC,YAAY,GAAkB,IAAI,CAAC;IACnC,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,KAAK,GAAkB,IAAI,CAAC;IAEpC,OAAO,CAAc;IACrB,OAAO,CAA0B;IACjC,SAAS,CAAqC;IAE9C,YAAY,IAAY,EAAE,IAAY;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,4EAA4E;IAC5E,IAAI,IAAI;QACN,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QAExB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;gBACzB,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oHAAoH;IACpH,KAAK,CAAC,IAAI,CAAC,OAAuB,EAAE,OAA8B;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IACnB,CAAC;IAEO,gBAAgB,CAAC,MAAc;QACrC,4DAA4D;QAC5D,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YACtD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;QAEnC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAC3B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB;QACvB,IAAI,OAA8B,CAAC;QACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF"}

package/dist/types/argument-roles.d.ts

@@ -74,5 +74,12 @@ export declare function getUrlRoles(): ArgumentRole[];
  * `delete-history` are NOT sandbox-safe: even when the repo path is inside
  * the sandbox, these operations require compiled rule evaluation (and
  * typically human approval) because they can destroy git history.
+ *
+ * NOTE: The policy engine's filesystem sandbox fast path
+ * (structural-sandbox-allow in policy-engine.ts) assumes that the
+ * filesystem server only has sandbox-safe path roles and no other roles.
+ * If a non-sandbox-safe path role is ever added with
+ * serverNames including 'filesystem', the fast path must be updated
+ * to check for those roles before auto-allowing.
  */
 export declare const SANDBOX_SAFE_PATH_ROLES: ReadonlySet<ArgumentRole>;

package/dist/types/argument-roles.js

@@ -44,12 +44,30 @@ export function resolveRealPath(filePath) {
         return realpathSync(absolute);
     }
     catch {
-        try {
-            return join(realpathSync(dirname(absolute)), basename(absolute));
-        }
-        catch {
-            return absolute;
+        // Walk up to find the deepest existing ancestor, resolve it, then reattach the tail.
+        // This handles cases like /tmp/nonexistent/file.txt on macOS where /tmp → /private/tmp
+        // but the intermediate directory doesn't exist yet.
+        let current = absolute;
+        const tail = [];
+        const MAX_DEPTH = 64;
+        for (let i = 0; i < MAX_DEPTH; i++) {
+            const parent = dirname(current);
+            tail.unshift(basename(current));
+            if (parent === current) {
+                // Reached filesystem root without finding an existing path
+                return absolute;
+            }
+            current = parent;
+            try {
+                return join(realpathSync(current), ...tail);
+            }
+            catch {
+                // Continue walking up
+            }
         }
+        // TODO: revisit whether falling back to the unresolved path has security
+        // implications in the policy engine (symlink-based sandbox escapes).
+        return absolute;
     }
 }
 /** Identity function -- returns the value unchanged. */
@@ -254,6 +272,13 @@ export function getUrlRoles() {
  * `delete-history` are NOT sandbox-safe: even when the repo path is inside
  * the sandbox, these operations require compiled rule evaluation (and
  * typically human approval) because they can destroy git history.
+ *
+ * NOTE: The policy engine's filesystem sandbox fast path
+ * (structural-sandbox-allow in policy-engine.ts) assumes that the
+ * filesystem server only has sandbox-safe path roles and no other roles.
+ * If a non-sandbox-safe path role is ever added with
+ * serverNames including 'filesystem', the fast path must be updated
+ * to check for those roles before auto-allowing.
  */
 export const SANDBOX_SAFE_PATH_ROLES = new Set(['read-path', 'write-path', 'delete-path']);
 //# sourceMappingURL=argument-roles.js.map

package/dist/types/argument-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"argument-roles.js","sourceRoot":"","sources":["../../src/types/argument-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA2CnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,eAAe,GAAqC;IACxD;QACE,WAAW;QACX;YACE,WAAW,EAAE,mCAAmC;YAChD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,yEAAyE;gBACzE,mDAAmD;YACrD,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,YAAY;QACZ;YACE,WAAW,EAAE,yCAAyC;YACtD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,+EAA+E;gBAC/E,gEAAgE;YAClE,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gFAAgF;gBAChF,uFAAuF;YACzF,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,eAAe;QACf;YACE,WAAW,EAAE,qDAAqD;YAClE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gGAAgG;gBAChG,sFAAsF;gBACtF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,2DAA2D;YACxE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,8FAA8F;gBAC9F,oFAAoF;gBACpF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,WAAW;QACX;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,YAAY;YAC1B,kBAAkB,EAChB,iEAAiE;gBACjE,8CAA8C;YAChD,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,uDAAuD;YACpE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,sFAAsF;gBACtF,kGAAkG;YACpG,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,iBAAiB;YAC9B,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,iDAAiD;gBACjD,2FAA2F;YAC7F,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,yBAAyB;YACtC,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAAE,oDAAoD,GAAG,kCAAkC;YAC7G,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,MAAM;QACN;YACE,WAAW,EAAE,mDAAmD;YAChE,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,kEAAkE;gBAClE,gFAAgF;SACnF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAA8C,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1G,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,wBAAwB,GAA+B;IAC3D,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,IAAI;IACtB,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,kBAAkB,CAAC,QAAsB;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,YAAY;IAC1B,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW;IACzB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA8B,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC"}
+{"version":3,"file":"argument-roles.js","sourceRoot":"","sources":["../../src/types/argument-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA2CnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,uFAAuF;QACvF,oDAAoD;QACpD,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,2DAA2D;gBAC3D,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,eAAe,GAAqC;IACxD;QACE,WAAW;QACX;YACE,WAAW,EAAE,mCAAmC;YAChD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,yEAAyE;gBACzE,mDAAmD;YACrD,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,YAAY;QACZ;YACE,WAAW,EAAE,yCAAyC;YACtD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,+EAA+E;gBAC/E,gEAAgE;YAClE,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gFAAgF;gBAChF,uFAAuF;YACzF,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,eAAe;QACf;YACE,WAAW,EAAE,qDAAqD;YAClE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gGAAgG;gBAChG,sFAAsF;gBACtF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,2DAA2D;YACxE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,8FAA8F;gBAC9F,oFAAoF;gBACpF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,WAAW;QACX;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,YAAY;YAC1B,kBAAkB,EAChB,iEAAiE;gBACjE,8CAA8C;YAChD,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,uDAAuD;YACpE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,sFAAsF;gBACtF,kGAAkG;YACpG,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,iBAAiB;YAC9B,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,iDAAiD;gBACjD,2FAA2F;YAC7F,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,yBAAyB;YACtC,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAAE,oDAAoD,GAAG,kCAAkC;YAC7G,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,MAAM;QACN;YACE,WAAW,EAAE,mDAAmD;YAChE,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,kEAAkE;gBAClE,gFAAgF;SACnF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAA8C,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1G,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,wBAAwB,GAA+B;IAC3D,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,IAAI;IACtB,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,kBAAkB,CAAC,QAAsB;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,YAAY;IAC1B,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW;IACzB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA8B,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC"}

package/docker/Dockerfile.base.arm64

@@ -0,0 +1,23 @@
+FROM node:22-bookworm
+
+# Replicate the 'codespace' user (uid 1000) from the devcontainers/universal
+# image so Dockerfile.claude-code works unchanged on both platforms.
+# node:22-bookworm already has node:node at uid/gid 1000 — rename it.
+RUN usermod -l codespace -d /home/codespace -m node && \
+    groupmod -n codespace node
+
+USER root
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends git socat ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# IronCurtain CA (for MITM proxy trust)
+# This file is copied into a temporary build context by ensureImage().
+COPY ironcurtain-ca-cert.pem /usr/local/share/ca-certificates/ironcurtain-ca.crt
+RUN update-ca-certificates
+
+RUN mkdir -p /workspace /etc/ironcurtain /run/ironcurtain && \
+    chown codespace:codespace /workspace /etc/ironcurtain /run/ironcurtain
+
+WORKDIR /workspace
+USER codespace

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provos/ironcurtain",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "type": "module",
   "description": "Secure agent runtime with trusted process mediation",
   "license": "Apache-2.0",
@@ -26,7 +26,7 @@
     "model-context-protocol"
   ],
   "engines": {
-    "node": ">=20.19.0"
+    "node": ">=22.0.0 <26"
   },
   "bin": {
     "ironcurtain": "dist/cli.js"
@@ -50,6 +50,7 @@
     "annotate-tools": "tsx src/cli.ts annotate-tools",
     "compile-policy": "tsx src/cli.ts compile-policy",
     "customize-policy": "tsx src/cli.ts customize-policy",
+    "bot": "tsx src/cli.ts bot",
     "config": "tsx src/cli.ts config",
     "setup": "tsx src/cli.ts setup",
     "prepublishOnly": "npm run build",
@@ -57,7 +58,8 @@
     "test:watch": "vitest",
     "lint": "eslint src/ test/",
     "format": "prettier --log-level=warn --write 'src/**/*.ts' 'test/**/*.ts'",
-    "format:check": "prettier --check 'src/**/*.ts' 'test/**/*.ts'"
+    "format:check": "prettier --check 'src/**/*.ts' 'test/**/*.ts'",
+    "setup-hooks": "cp .hooks/pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit && echo 'Pre-commit hook installed.'"
   },
   "dependencies": {
     "@ai-sdk/anthropic": "^3.0.44",
@@ -94,12 +96,15 @@
     "@types/node-forge": "^1.3.14",
     "@types/shell-quote": "^1.7.5",
     "@types/turndown": "^5.0.6",
+    "@types/ws": "^8.18.1",
+    "@vitest/coverage-v8": "^4.0.18",
     "eslint": "^10.0.1",
     "eslint-config-prettier": "^10.1.8",
     "prettier": "^3.8.1",
     "tsx": "^4.19.0",
     "typescript": "^5.7.0",
     "typescript-eslint": "^8.56.0",
-    "vitest": "^4.0.18"
+    "vitest": "^4.0.18",
+    "ws": "^8.19.0"
   }
 }

package/src/config/mcp-servers.json

@@ -1,10 +1,12 @@
 {
   "filesystem": {
+    "description": "Read, write, search, and manage files and directories",
     "command": "npx",
     "args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp/ironcurtain-sandbox"],
     "sandbox": false
   },
   "git": {
+    "description": "Git version control operations (commits, branches, diffs, etc.)",
     "command": "node",
     "args": ["node_modules/.bin/git-mcp-server"],
     "env": {
@@ -20,6 +22,7 @@
     }
   },
   "fetch": {
+    "description": "HTTP requests and web search",
     "command": "tsx",
     "args": ["./src/servers/fetch-server.ts"],
     "sandbox": false,

package/dist/docker/managed-proxy.d.ts

@@ -1,27 +0,0 @@
-/**
- * Manages the lifecycle of an MCP proxy server process for a Docker session.
- *
- * Spawns the proxy as a child process with PROXY_SOCKET_PATH set.
- * The proxy process is the same mcp-proxy-server.ts used by the
- * built-in session, just with a UDS transport instead of stdio.
- */
-import type { ToolInfo } from './agent-adapter.js';
-export interface ManagedProxy {
-    /** Start the proxy process. Resolves when the UDS is ready for connections. */
-    start(): Promise<void>;
-    /** Query available tools from the running proxy. */
-    listTools(): Promise<ToolInfo[]>;
-    /** Stop the proxy process and clean up the socket. */
-    stop(): Promise<void>;
-    /** The socket path the proxy is listening on. */
-    readonly socketPath: string;
-}
-export interface ManagedProxyOptions {
-    /** Absolute path for the UDS socket. */
-    readonly socketPath: string;
-    /** Environment variables to pass to the proxy process. */
-    readonly env: Record<string, string>;
-    /** Working directory for the proxy process. Defaults to process.cwd(). */
-    readonly cwd?: string;
-}
-export declare function createManagedProxy(options: ManagedProxyOptions): ManagedProxy;

package/dist/docker/managed-proxy.js

@@ -1,175 +0,0 @@
-/**
- * Manages the lifecycle of an MCP proxy server process for a Docker session.
- *
- * Spawns the proxy as a child process with PROXY_SOCKET_PATH set.
- * The proxy process is the same mcp-proxy-server.ts used by the
- * built-in session, just with a UDS transport instead of stdio.
- */
-import { fork } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { setTimeout as delay } from 'node:timers/promises';
-import { resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { connect as netConnect } from 'node:net';
-import { ReadBuffer, serializeMessage } from '@modelcontextprotocol/sdk/shared/stdio.js';
-import { VERSION } from '../version.js';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-/** Timeout for socket readiness polling. */
-const SOCKET_READY_TIMEOUT_MS = 15_000;
-const SOCKET_POLL_INTERVAL_MS = 50;
-/** Path to the mcp-proxy-server module. */
-function getProxyModulePath() {
-    // In compiled mode: dist/trusted-process/mcp-proxy-server.js
-    // In source mode: src/trusted-process/mcp-proxy-server.ts (needs tsx)
-    const compiledPath = resolve(__dirname, '..', 'trusted-process', 'mcp-proxy-server.js');
-    if (existsSync(compiledPath))
-        return compiledPath;
-    return resolve(__dirname, '..', 'trusted-process', 'mcp-proxy-server.ts');
-}
-/**
- * Creates a temporary MCP client connection to the UDS socket.
- * Used for listTools() queries.
- */
-class UdsClientTransport {
-    socket = null;
-    readBuffer = new ReadBuffer();
-    socketPath;
-    onclose;
-    onerror;
-    onmessage;
-    constructor(socketPath) {
-        this.socketPath = socketPath;
-    }
-    async start() {
-        return new Promise((resolve, reject) => {
-            this.socket = netConnect(this.socketPath, () => resolve());
-            this.socket.on('error', reject);
-            this.socket.on('data', (chunk) => {
-                this.readBuffer.append(chunk);
-                let message;
-                while ((message = this.readBuffer.readMessage()) !== null) {
-                    this.onmessage?.(message);
-                }
-            });
-            this.socket.on('close', () => this.onclose?.());
-        });
-    }
-    async send(message) {
-        const socket = this.socket;
-        if (!socket || socket.destroyed) {
-            throw new Error('UDS client not connected');
-        }
-        return new Promise((resolve, reject) => {
-            socket.write(serializeMessage(message), (err) => {
-                if (err)
-                    reject(err);
-                else
-                    resolve();
-            });
-        });
-    }
-    // eslint-disable-next-line @typescript-eslint/require-await -- must be async to satisfy Transport interface
-    async close() {
-        this.socket?.destroy();
-        this.socket = null;
-    }
-}
-export function createManagedProxy(options) {
-    let childProcess = null;
-    return {
-        socketPath: options.socketPath,
-        async start() {
-            const modulePath = getProxyModulePath();
-            const isTsSource = modulePath.endsWith('.ts');
-            // Fork the proxy process with PROXY_SOCKET_PATH set
-            const env = {
-                ...process.env,
-                ...options.env,
-                PROXY_SOCKET_PATH: options.socketPath,
-            };
-            const cwd = options.cwd ?? process.cwd();
-            if (isTsSource) {
-                // In development, use tsx to run TypeScript directly
-                const { spawn } = await import('node:child_process');
-                childProcess = spawn('npx', ['tsx', modulePath], {
-                    env,
-                    cwd,
-                    stdio: ['pipe', 'pipe', 'pipe'],
-                });
-            }
-            else {
-                childProcess = fork(modulePath, [], {
-                    env,
-                    cwd,
-                    stdio: ['pipe', 'pipe', 'pipe', 'ipc'],
-                });
-            }
-            // Capture stderr and exit for diagnostics
-            let proxyStderr = '';
-            let proxyExited = false;
-            let proxyExitCode = null;
-            childProcess.stderr?.on('data', (chunk) => {
-                proxyStderr += chunk.toString();
-            });
-            childProcess.on('error', (err) => {
-                console.error(`MCP proxy process error: ${err.message}`);
-            });
-            childProcess.on('exit', (code) => {
-                proxyExited = true;
-                proxyExitCode = code;
-            });
-            // Poll for socket readiness
-            const start = Date.now();
-            while (!existsSync(options.socketPath)) {
-                // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- mutated by async 'exit' event handler
-                if (proxyExited) {
-                    throw new Error(`MCP proxy process exited with code ${proxyExitCode} before creating socket.\nStderr: ${proxyStderr}`);
-                }
-                if (Date.now() - start > SOCKET_READY_TIMEOUT_MS) {
-                    throw new Error(`MCP proxy did not create socket at ${options.socketPath} within ${SOCKET_READY_TIMEOUT_MS}ms.\nStderr: ${proxyStderr}`);
-                }
-                await delay(SOCKET_POLL_INTERVAL_MS);
-            }
-        },
-        async listTools() {
-            const transport = new UdsClientTransport(options.socketPath);
-            const client = new Client({ name: 'ironcurtain-tool-lister', version: VERSION }, {});
-            try {
-                await client.connect(transport);
-                const result = await client.listTools();
-                return result.tools.map((t) => ({
-                    name: t.name,
-                    description: t.description,
-                    inputSchema: t.inputSchema,
-                }));
-            }
-            finally {
-                try {
-                    await client.close();
-                }
-                catch {
-                    /* ignore cleanup errors */
-                }
-            }
-        },
-        async stop() {
-            if (childProcess) {
-                childProcess.kill('SIGTERM');
-                // Give it a moment to clean up
-                await new Promise((resolve) => {
-                    const timeout = setTimeout(() => {
-                        childProcess?.kill('SIGKILL');
-                        resolve();
-                    }, 3000);
-                    childProcess?.on('exit', () => {
-                        clearTimeout(timeout);
-                        resolve();
-                    });
-                });
-                childProcess = null;
-            }
-        },
-    };
-}
-//# sourceMappingURL=managed-proxy.js.map

package/dist/docker/managed-proxy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"managed-proxy.js","sourceRoot":"","sources":["../../src/docker/managed-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAqB,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAIzF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,4CAA4C;AAC5C,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,2CAA2C;AAC3C,SAAS,kBAAkB;IACzB,6DAA6D;IAC7D,sEAAsE;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IACxF,IAAI,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAClD,OAAO,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;AAC5E,CAAC;AA2BD;;;GAGG;AACH,MAAM,kBAAkB;IACd,MAAM,GAAyC,IAAI,CAAC;IACpD,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IACrB,UAAU,CAAS;IAEpC,OAAO,CAAc;IACrB,OAAO,CAA0B;IACjC,SAAS,CAAqC;IAE9C,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9B,IAAI,OAA8B,CAAC;gBACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9C,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4GAA4G;IAC5G,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,IAAI,YAAY,GAAwB,IAAI,CAAC;IAE7C,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAE9B,KAAK,CAAC,KAAK;YACT,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAE9C,oDAAoD;YACpD,MAAM,GAAG,GAAG;gBACV,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,OAAO,CAAC,GAAG;gBACd,iBAAiB,EAAE,OAAO,CAAC,UAAU;aACtC,CAAC;YAEF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAEzC,IAAI,UAAU,EAAE,CAAC;gBACf,qDAAqD;gBACrD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBACrD,YAAY,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE;oBAC/C,GAAG;oBACH,GAAG;oBACH,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE;oBAClC,GAAG;oBACH,GAAG;oBACH,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;YAED,0CAA0C;YAC1C,IAAI,WAAW,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,aAAa,GAAkB,IAAI,CAAC;YAExC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAChD,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClC,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC/B,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,WAAW,GAAG,IAAI,CAAC;gBACnB,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC,CAAC,CAAC;YAEH,4BAA4B;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,gHAAgH;gBAChH,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,sCAAsC,aAAa,qCAAqC,WAAW,EAAE,CACtG,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,uBAAuB,EAAE,CAAC;oBACjD,MAAM,IAAI,KAAK,CACb,sCAAsC,OAAO,CAAC,UAAU,WAAW,uBAAuB,gBAAgB,WAAW,EAAE,CACxH,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,SAAS;YACb,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAErF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAsC;iBACtD,CAAC,CAAC,CAAC;YACN,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC7B,+BAA+B;gBAC/B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;wBAC9B,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;wBAC9B,OAAO,EAAE,CAAC;oBACZ,CAAC,EAAE,IAAI,CAAC,CAAC;oBACT,YAAY,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;wBAC5B,YAAY,CAAC,OAAO,CAAC,CAAC;wBACtB,OAAO,EAAE,CAAC;oBACZ,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}