@provos/ironcurtain 0.3.1 → 0.4.1

package/dist/docker/audit-log-tailer.js

@@ -1,12 +1,12 @@
 /**
  * Tails a JSONL audit log file and emits DiagnosticEvent callbacks
- * for each new entry. Uses fs.watch() for change notification and
+ * for each new entry. Uses fs.watchFile() for change notification and
  * tracks the file read offset to parse only new lines.
  */
-import { openSync, readSync, fstatSync, closeSync, watch } from 'node:fs';
+import { openSync, readSync, fstatSync, closeSync, watchFile, unwatchFile } from 'node:fs';
 export class AuditLogTailer {
     offset = 0;
-    watcher = null;
+    watching = false;
     auditLogPath;
     onDiagnostic;
     constructor(auditLogPath, onDiagnostic) {
@@ -14,14 +14,16 @@ export class AuditLogTailer {
         this.onDiagnostic = onDiagnostic;
     }
     start() {
-        this.watcher = watch(this.auditLogPath, () => this.readNewEntries());
+        this.watching = true;
+        watchFile(this.auditLogPath, { interval: 100 }, () => this.readNewEntries());
     }
     stop() {
-        if (this.watcher) {
-            this.watcher.close();
-            this.watcher = null;
+        if (this.watching) {
+            unwatchFile(this.auditLogPath);
+            this.watching = false;
         }
     }
+    /** Read and process any new entries appended since the last read. */
     readNewEntries() {
         let fd;
         try {

package/dist/docker/audit-log-tailer.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log-tailer.js","sourceRoot":"","sources":["../../src/docker/audit-log-tailer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAkB,MAAM,SAAS,CAAC;AAI1F,MAAM,OAAO,cAAc;IACjB,MAAM,GAAG,CAAC,CAAC;IACX,OAAO,GAAqB,IAAI,CAAC;IACxB,YAAY,CAAS;IACrB,YAAY,CAAmC;IAEhE,YAAY,YAAoB,EAAE,YAA8C;QAC9E,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,yBAAyB;QACnC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YAErC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAClD,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC;YAExB,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;oBAC7C,IAAI,CAAC,YAAY,CAAC;wBAChB,IAAI,EAAE,WAAW;wBACjB,QAAQ,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE;wBACjD,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,0CAA0C;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,KAAiB;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,OAAO,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"audit-log-tailer.js","sourceRoot":"","sources":["../../src/docker/audit-log-tailer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAI3F,MAAM,OAAO,cAAc;IACjB,MAAM,GAAG,CAAC,CAAC;IACX,QAAQ,GAAG,KAAK,CAAC;IACR,YAAY,CAAS;IACrB,YAAY,CAAmC;IAEhE,YAAY,YAAoB,EAAE,YAA8C;QAC9E,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,cAAc;QACZ,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,yBAAyB;QACnC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YAErC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAClD,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC;YAExB,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;oBAC7C,IAAI,CAAC,YAAY,CAAC;wBAChB,IAAI,EAAE,WAAW;wBACjB,QAAQ,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE;wBACjD,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,0CAA0C;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,KAAiB;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,OAAO,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;IAClC,CAAC;CACF"}

package/dist/docker/code-mode-proxy.d.ts

@@ -0,0 +1,34 @@
+/**
+ * CodeModeProxy -- MCP server that exposes a single `execute_code` tool
+ * backed by the UTCP Code Mode sandbox.
+ *
+ * Replaces the old ManagedProxy (which spawned mcp-proxy-server.ts as a
+ * child process). Docker agents now send TypeScript via `execute_code`,
+ * sharing the same execution engine as builtin Code Mode sessions.
+ *
+ * Architecture:
+ *   Container (Claude Code) → socat → UDS/TCP socket
+ *     → CodeModeProxy (MCP Server with execute_code)
+ *     → Sandbox.executeCode(code)
+ *     → V8 isolate → UTCP → per-server mcp-proxy-server.ts (stdio)
+ *     → PolicyEngine → real MCP servers
+ */
+import { type HelpData } from '../sandbox/index.js';
+import type { IronCurtainConfig } from '../config/types.js';
+/** Public interface for the Docker session's proxy. */
+export interface DockerProxy {
+    start(): Promise<void>;
+    getHelpData(): HelpData;
+    stop(): Promise<void>;
+    readonly socketPath: string;
+    readonly port: number | undefined;
+}
+export interface CodeModeProxyOptions {
+    /** Absolute path for the UDS socket (used in UDS mode, also stored for reference in TCP mode). */
+    readonly socketPath: string;
+    /** Session configuration passed to the Sandbox. */
+    readonly config: IronCurtainConfig;
+    /** Listen mode: 'uds' (default) or 'tcp'. TCP mode uses OS-assigned port. */
+    readonly listenMode?: 'uds' | 'tcp';
+}
+export declare function createCodeModeProxy(options: CodeModeProxyOptions): DockerProxy;

package/dist/docker/code-mode-proxy.js

@@ -0,0 +1,137 @@
+/**
+ * CodeModeProxy -- MCP server that exposes a single `execute_code` tool
+ * backed by the UTCP Code Mode sandbox.
+ *
+ * Replaces the old ManagedProxy (which spawned mcp-proxy-server.ts as a
+ * child process). Docker agents now send TypeScript via `execute_code`,
+ * sharing the same execution engine as builtin Code Mode sessions.
+ *
+ * Architecture:
+ *   Container (Claude Code) → socat → UDS/TCP socket
+ *     → CodeModeProxy (MCP Server with execute_code)
+ *     → Sandbox.executeCode(code)
+ *     → V8 isolate → UTCP → per-server mcp-proxy-server.ts (stdio)
+ *     → PolicyEngine → real MCP servers
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { UdsServerTransport } from '../trusted-process/uds-server-transport.js';
+import { TcpServerTransport } from '../trusted-process/tcp-server-transport.js';
+import { Sandbox } from '../sandbox/index.js';
+import { VERSION } from '../version.js';
+export function createCodeModeProxy(options) {
+    const sandbox = new Sandbox();
+    const useTcp = options.listenMode === 'tcp';
+    let mcpServer = null; // eslint-disable-line @typescript-eslint/no-deprecated
+    let transport = null;
+    return {
+        socketPath: options.socketPath,
+        get port() {
+            if (transport instanceof TcpServerTransport) {
+                try {
+                    return transport.port;
+                }
+                catch {
+                    return undefined;
+                }
+            }
+            return undefined;
+        },
+        async start() {
+            // 1. Initialize the sandbox (registers MCP proxy servers per backend)
+            await sandbox.initialize(options.config);
+            // 2. Create the MCP server exposing a single execute_code tool
+            mcpServer = new Server(// eslint-disable-line @typescript-eslint/no-deprecated
+            { name: 'ironcurtain-code-mode', version: VERSION }, { capabilities: { tools: {} } });
+            // eslint-disable-next-line @typescript-eslint/require-await -- MCP SDK handler must return Promise
+            mcpServer.setRequestHandler(ListToolsRequestSchema, async () => ({
+                tools: [
+                    {
+                        name: 'execute_code',
+                        description: 'Execute TypeScript code in a secure sandbox. ' +
+                            'Tool calls are synchronous (no await). ' +
+                            'Use `return` to send a value back. ' +
+                            'Call help.help() to discover available tools.',
+                        inputSchema: {
+                            type: 'object',
+                            properties: {
+                                code: {
+                                    type: 'string',
+                                    description: 'TypeScript code to execute',
+                                },
+                            },
+                            required: ['code'],
+                        },
+                    },
+                ],
+            }));
+            mcpServer.setRequestHandler(CallToolRequestSchema, async (request) => {
+                if (request.params.name !== 'execute_code') {
+                    return {
+                        content: [{ type: 'text', text: `Unknown tool: ${request.params.name}` }],
+                        isError: true,
+                    };
+                }
+                const args = request.params.arguments;
+                const code = args?.code;
+                if (!code || typeof code !== 'string') {
+                    return {
+                        content: [{ type: 'text', text: 'Missing required parameter: code' }],
+                        isError: true,
+                    };
+                }
+                try {
+                    const { result, logs } = await sandbox.executeCode(code);
+                    const parts = [];
+                    if (logs.length > 0) {
+                        parts.push(`[logs]\n${logs.join('\n')}`);
+                    }
+                    if (result === undefined) {
+                        parts.push('(no return value)');
+                    }
+                    else if (typeof result === 'string') {
+                        parts.push(result);
+                    }
+                    else {
+                        parts.push(JSON.stringify(result, null, 2));
+                    }
+                    return {
+                        content: [{ type: 'text', text: parts.join('\n\n') }],
+                    };
+                }
+                catch (err) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `Execution error: ${err instanceof Error ? err.message : String(err)}`,
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            });
+            // 3. Start the transport
+            if (useTcp) {
+                transport = new TcpServerTransport('127.0.0.1', 0);
+            }
+            else {
+                transport = new UdsServerTransport(options.socketPath);
+            }
+            await mcpServer.connect(transport);
+        },
+        getHelpData() {
+            return sandbox.getHelpData();
+        },
+        async stop() {
+            if (mcpServer) {
+                await mcpServer.close();
+                mcpServer = null;
+            }
+            // mcpServer.close() closes the transport, but shutdown sandbox separately
+            transport = null;
+            await sandbox.shutdown();
+        },
+    };
+}
+//# sourceMappingURL=code-mode-proxy.js.map

package/dist/docker/code-mode-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-mode-proxy.js","sourceRoot":"","sources":["../../src/docker/code-mode-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,OAAO,EAAiB,MAAM,qBAAqB,CAAC;AAE7D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAoBxC,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;IAE5C,IAAI,SAAS,GAAkB,IAAI,CAAC,CAAC,uDAAuD;IAC5F,IAAI,SAAS,GAAmD,IAAI,CAAC;IAErE,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAE9B,IAAI,IAAI;YACN,IAAI,SAAS,YAAY,kBAAkB,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,OAAO,SAAS,CAAC,IAAI,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,KAAK;YACT,sEAAsE;YACtE,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEzC,+DAA+D;YAC/D,SAAS,GAAG,IAAI,MAAM,CAAE,uDAAuD;YAC7E,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,EACnD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;YAEF,mGAAmG;YACnG,SAAS,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC/D,KAAK,EAAE;oBACL;wBACE,IAAI,EAAE,cAAc;wBACpB,WAAW,EACT,+CAA+C;4BAC/C,yCAAyC;4BACzC,qCAAqC;4BACrC,+CAA+C;wBACjD,WAAW,EAAE;4BACX,IAAI,EAAE,QAAiB;4BACvB,UAAU,EAAE;gCACV,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,4BAA4B;iCAC1C;6BACF;4BACD,QAAQ,EAAE,CAAC,MAAM,CAAC;yBACnB;qBACF;iBACF;aACF,CAAC,CAAC,CAAC;YAEJ,SAAS,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAC3C,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBACzE,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAA0C,CAAC;gBACvE,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtC,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;wBACrE,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;oBACzD,MAAM,KAAK,GAAa,EAAE,CAAC;oBAE3B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpB,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBAClC,CAAC;yBAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACtC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,CAAC;yBAAM,CAAC;wBACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC9C,CAAC;oBAED,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;qBACtD,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;6BAC7E;yBACF;wBACD,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,yBAAyB;YACzB,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAED,WAAW;YACT,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;gBACxB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,0EAA0E;YAC1E,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/docker/docker-agent-session.d.ts

@@ -15,7 +15,7 @@ import type { Session, SessionId, SessionInfo, ConversationTurn, DiagnosticEvent
 import type { IronCurtainConfig } from '../config/types.js';
 import type { AgentAdapter } from './agent-adapter.js';
 import type { DockerManager } from './types.js';
-import type { ManagedProxy } from './managed-proxy.js';
+import type { DockerProxy } from './code-mode-proxy.js';
 import type { MitmProxy } from './mitm-proxy.js';
 import type { CertificateAuthority } from './ca.js';
 export interface DockerAgentSessionDeps {
@@ -23,7 +23,7 @@ export interface DockerAgentSessionDeps {
     readonly sessionId: SessionId;
     readonly adapter: AgentAdapter;
     readonly docker: DockerManager;
-    readonly proxy: ManagedProxy;
+    readonly proxy: DockerProxy;
     readonly mitmProxy: MitmProxy;
     readonly ca: CertificateAuthority;
     readonly fakeKeys: ReadonlyMap<string, string>;
@@ -31,6 +31,8 @@ export interface DockerAgentSessionDeps {
     readonly sandboxDir: string;
     readonly escalationDir: string;
     readonly auditLogPath: string;
+    /** Use TCP transport instead of UDS (macOS Docker Desktop). */
+    readonly useTcp?: boolean;
     readonly onEscalation?: (request: EscalationRequest) => void;
     readonly onEscalationExpired?: () => void;
     readonly onDiagnostic?: (event: DiagnosticEvent) => void;
@@ -48,9 +50,12 @@ export declare class DockerAgentSession implements Session {
     private readonly sandboxDir;
     private readonly escalationDir;
     private readonly auditLogPath;
+    private readonly useTcp;
     private status;
     private readonly createdAt;
     private containerId;
+    private sidecarContainerId;
+    private networkName;
     private systemPrompt;
     private turns;
     private diagnosticLog;
@@ -66,9 +71,9 @@ export declare class DockerAgentSession implements Session {
     constructor(deps: DockerAgentSessionDeps);
     /**
      * Initialize the Docker agent session:
-     * 1. Start MCP proxy (UDS)
-     * 2. Start MITM proxy (UDS)
-     * 3. Query proxy for available tools
+     * 1. Start Code Mode proxy (UDS/TCP)
+     * 2. Start MITM proxy (UDS/TCP)
+     * 3. Build server listings from sandbox help data
      * 4. Generate orientation files
      * 5. Ensure Docker image exists (with CA cert baked in)
      * 6. Create and start container (--network=none)
@@ -79,11 +84,18 @@ export declare class DockerAgentSession implements Session {
     sendMessage(userMessage: string): Promise<string>;
     getHistory(): readonly ConversationTurn[];
     getDiagnosticLog(): readonly DiagnosticEvent[];
+    /** Process any new audit log entries immediately (useful for tests). */
+    flushAuditLog(): void;
     getPendingEscalation(): EscalationRequest | undefined;
     getBudgetStatus(): BudgetStatus;
     resolveEscalation(escalationId: string, decision: 'approved' | 'denied'): Promise<void>;
     close(): Promise<void>;
     private emitDiagnostic;
+    /**
+     * Checks whether the container can reach host-side proxies via the
+     * socat sidecar on the internal Docker network. Throws if connectivity fails.
+     */
+    private checkInternalNetworkConnectivity;
     private startEscalationWatcher;
     private stopEscalationWatcher;
     private pollEscalationDirectory;

package/dist/docker/docker-agent-session.js

@@ -14,11 +14,13 @@
 import { mkdirSync, readdirSync, readFileSync, writeFileSync, existsSync, copyFileSync, rmSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { mkdtempSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { tmpdir, arch } from 'node:os';
+import { quote } from 'shell-quote';
 import { createHash } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { AuditLogTailer } from './audit-log-tailer.js';
 import { prepareSession } from './orientation.js';
+import { INTERNAL_NETWORK_NAME, INTERNAL_NETWORK_SUBNET, INTERNAL_NETWORK_GATEWAY } from './platform.js';
 import { SessionNotReadyError, SessionClosedError } from '../session/errors.js';
 import * as logger from '../logger.js';
 const ESCALATION_POLL_INTERVAL_MS = 300;
@@ -35,9 +37,12 @@ export class DockerAgentSession {
     sandboxDir;
     escalationDir;
     auditLogPath;
+    useTcp;
     status = 'initializing';
     createdAt;
     containerId = null;
+    sidecarContainerId = null;
+    networkName = null;
     systemPrompt = '';
     turns = [];
     diagnosticLog = [];
@@ -63,6 +68,7 @@ export class DockerAgentSession {
         this.sandboxDir = deps.sandboxDir;
         this.escalationDir = deps.escalationDir;
         this.auditLogPath = deps.auditLogPath;
+        this.useTcp = deps.useTcp ?? false;
         this.onEscalation = deps.onEscalation;
         this.onEscalationExpired = deps.onEscalationExpired;
         this.onDiagnostic = deps.onDiagnostic;
@@ -70,9 +76,9 @@ export class DockerAgentSession {
     }
     /**
      * Initialize the Docker agent session:
-     * 1. Start MCP proxy (UDS)
-     * 2. Start MITM proxy (UDS)
-     * 3. Query proxy for available tools
+     * 1. Start Code Mode proxy (UDS/TCP)
+     * 2. Start MITM proxy (UDS/TCP)
+     * 3. Build server listings from sandbox help data
      * 4. Generate orientation files
      * 5. Ensure Docker image exists (with CA cert baked in)
      * 6. Create and start container (--network=none)
@@ -82,46 +88,143 @@ export class DockerAgentSession {
         // Ensure directories exist
         mkdirSync(this.sandboxDir, { recursive: true });
         mkdirSync(this.escalationDir, { recursive: true });
-        // 1. Start MCP proxy
+        // 1. Start Code Mode proxy
         await this.proxy.start();
-        logger.info(`MCP proxy listening on ${this.proxy.socketPath}`);
-        // 2. Start MITM proxy (UDS)
+        if (this.useTcp && this.proxy.port !== undefined) {
+            logger.info(`Code Mode proxy listening on 127.0.0.1:${this.proxy.port}`);
+        }
+        else {
+            logger.info(`Code Mode proxy listening on ${this.proxy.socketPath}`);
+        }
+        // 2. Start MITM proxy
         const mitmAddr = await this.mitmProxy.start();
-        logger.info(`MITM proxy listening on ${mitmAddr.socketPath}`);
-        // 3. Query proxy for available tools
-        const tools = await this.proxy.listTools();
-        logger.info(`Available tools: ${tools.map((t) => t.name).join(', ')}`);
+        if (mitmAddr.port !== undefined) {
+            logger.info(`MITM proxy listening on 127.0.0.1:${mitmAddr.port}`);
+        }
+        else {
+            logger.info(`MITM proxy listening on ${mitmAddr.socketPath}`);
+        }
+        // 3. Build server listings from sandbox help data
+        const helpData = this.proxy.getHelpData();
+        const serverListings = Object.entries(helpData.serverDescriptions).map(([name, description]) => ({
+            name,
+            description,
+        }));
+        logger.info(`Available servers: ${serverListings.map((s) => s.name).join(', ')}`);
         // 4. Generate orientation
-        const { systemPrompt } = prepareSession(this.adapter, tools, this.sessionDir, this.config, this.sandboxDir);
+        // In TCP mode, the container reaches the MCP proxy via host.docker.internal
+        const proxyAddress = this.useTcp && this.proxy.port !== undefined ? `host.docker.internal:${this.proxy.port}` : undefined;
+        const { systemPrompt } = prepareSession(this.adapter, serverListings, this.sessionDir, this.config, this.sandboxDir, proxyAddress);
         this.systemPrompt = systemPrompt;
         // 5. Ensure Docker image exists (build if needed, with CA cert)
         const image = await this.adapter.getImage();
         await this.ensureImage(image);
-        // 6. Create and start container (--network=none + UDS for MITM proxy)
+        // 6. Create and start container
         const shortId = this.sessionId.substring(0, 12);
-        const env = {
-            ...this.adapter.buildEnv(this.config, this.fakeKeys),
-            HTTPS_PROXY: 'http://127.0.0.1:18080',
-            HTTP_PROXY: 'http://127.0.0.1:18080',
-        };
         const orientationDir = resolve(this.sessionDir, 'orientation');
-        this.containerId = await this.docker.create({
-            image,
-            name: `ironcurtain-${shortId}`,
-            network: 'none',
-            mounts: [
+        let env;
+        let network;
+        let mounts;
+        let extraHosts;
+        if (this.useTcp && mitmAddr.port !== undefined && this.proxy.port !== undefined) {
+            // macOS TCP mode: internal bridge network blocks egress.
+            // A socat sidecar bridges the internal network to the host
+            // because Docker Desktop VMs don't forward gateway traffic.
+            const mcpPort = this.proxy.port;
+            const mitmPort = mitmAddr.port;
+            env = {
+                ...this.adapter.buildEnv(this.config, this.fakeKeys),
+                HTTPS_PROXY: `http://host.docker.internal:${mitmPort}`,
+                HTTP_PROXY: `http://host.docker.internal:${mitmPort}`,
+            };
+            // Create an --internal Docker network that blocks internet egress
+            await this.docker.createNetwork(INTERNAL_NETWORK_NAME, {
+                internal: true,
+                subnet: INTERNAL_NETWORK_SUBNET,
+                gateway: INTERNAL_NETWORK_GATEWAY,
+            });
+            network = INTERNAL_NETWORK_NAME;
+            // Ensure the socat image is available
+            const socatImage = 'alpine/socat';
+            if (!(await this.docker.imageExists(socatImage))) {
+                logger.info(`Pulling ${socatImage}...`);
+                await this.docker.pullImage(socatImage);
+            }
+            // Create socat sidecar on the default bridge (can reach host.docker.internal)
+            const sidecarName = `ironcurtain-sidecar-${shortId}`;
+            this.sidecarContainerId = await this.docker.create({
+                image: socatImage,
+                name: sidecarName,
+                network: 'bridge',
+                mounts: [],
+                env: {},
+                entrypoint: '/bin/sh',
+                command: [
+                    '-c',
+                    quote(['socat', `TCP-LISTEN:${mcpPort},fork,reuseaddr`, `TCP:host.docker.internal:${mcpPort}`]) +
+                        ' & ' +
+                        quote(['socat', `TCP-LISTEN:${mitmPort},fork,reuseaddr`, `TCP:host.docker.internal:${mitmPort}`]) +
+                        ' & wait',
+                ],
+            });
+            await this.docker.start(this.sidecarContainerId);
+            // Connect sidecar to the internal network so the app container can reach it
+            await this.docker.connectNetwork(INTERNAL_NETWORK_NAME, this.sidecarContainerId);
+            const sidecarIp = await this.docker.getContainerIp(this.sidecarContainerId, INTERNAL_NETWORK_NAME);
+            extraHosts = [`host.docker.internal:${sidecarIp}`];
+            logger.info(`Sidecar ${sidecarName} bridging ports ${mcpPort},${mitmPort} at ${sidecarIp}`);
+            mounts = [
+                { source: this.sandboxDir, target: '/workspace', readonly: false },
+                // No session dir mount needed for sockets (TCP mode) -- only orientation subdir is mounted
+                { source: orientationDir, target: '/etc/ironcurtain', readonly: true },
+            ];
+        }
+        else {
+            // Linux UDS mode: --network=none, session dir with sockets mounted
+            env = {
+                ...this.adapter.buildEnv(this.config, this.fakeKeys),
+                HTTPS_PROXY: 'http://127.0.0.1:18080',
+                HTTP_PROXY: 'http://127.0.0.1:18080',
+            };
+            network = 'none';
+            mounts = [
                 { source: this.sandboxDir, target: '/workspace', readonly: false },
+                // Session dir contains proxy.sock and mitm-proxy.sock -- directory mount
+                // exposes both to the container (file mounts for UDS don't work on macOS Docker Desktop).
                 { source: this.sessionDir, target: '/run/ironcurtain', readonly: false },
                 { source: orientationDir, target: '/etc/ironcurtain', readonly: true },
-                { source: mitmAddr.socketPath, target: '/run/ironcurtain/mitm-proxy.sock', readonly: true },
-            ],
-            env,
-            command: ['sleep', 'infinity'],
-            sessionLabel: this.sessionId,
-            resources: { memoryMb: 4096, cpus: 2 },
-        });
-        await this.docker.start(this.containerId);
-        logger.info(`Container started: ${this.containerId.substring(0, 12)}`);
+            ];
+        }
+        try {
+            this.containerId = await this.docker.create({
+                image,
+                name: `ironcurtain-${shortId}`,
+                network,
+                mounts,
+                env,
+                command: ['sleep', 'infinity'],
+                sessionLabel: this.sessionId,
+                resources: { memoryMb: 4096, cpus: 2 },
+                extraHosts,
+            });
+            await this.docker.start(this.containerId);
+            this.networkName = network;
+            logger.info(`Container started: ${this.containerId.substring(0, 12)}`);
+            // Connectivity check: verify the container can reach host proxies
+            // through the internal network. Abort if unreachable.
+            if (this.useTcp && network === INTERNAL_NETWORK_NAME && this.proxy.port !== undefined) {
+                await this.checkInternalNetworkConnectivity(this.containerId, this.proxy.port);
+            }
+        }
+        catch (err) {
+            // Clean up sidecar if app container setup fails
+            if (this.sidecarContainerId) {
+                await this.docker.stop(this.sidecarContainerId);
+                await this.docker.remove(this.sidecarContainerId);
+                this.sidecarContainerId = null;
+            }
+            throw err;
+        }
         // 7. Start watchers
         this.startEscalationWatcher();
         // Create the audit log file so fs.watch() can attach to it.
@@ -194,6 +297,10 @@ export class DockerAgentSession {
     getDiagnosticLog() {
         return this.diagnosticLog;
     }
+    /** Process any new audit log entries immediately (useful for tests). */
+    flushAuditLog() {
+        this.auditTailer?.readNewEntries();
+    }
     getPendingEscalation() {
         return this.pendingEscalation;
     }
@@ -238,6 +345,15 @@ export class DockerAgentSession {
             await this.docker.stop(this.containerId);
             await this.docker.remove(this.containerId);
         }
+        // Stop and remove sidecar container
+        if (this.sidecarContainerId) {
+            await this.docker.stop(this.sidecarContainerId);
+            await this.docker.remove(this.sidecarContainerId);
+        }
+        // Remove internal network (ignore errors -- other sessions may use it)
+        if (this.networkName === INTERNAL_NETWORK_NAME) {
+            await this.docker.removeNetwork(INTERNAL_NETWORK_NAME);
+        }
         // Stop proxies
         await this.mitmProxy.stop();
         await this.proxy.stop();
@@ -247,6 +363,20 @@ export class DockerAgentSession {
         this.diagnosticLog.push(event);
         this.onDiagnostic?.(event);
     }
+    /**
+     * Checks whether the container can reach host-side proxies via the
+     * socat sidecar on the internal Docker network. Throws if connectivity fails.
+     */
+    async checkInternalNetworkConnectivity(containerId, mcpPort) {
+        const result = await this.docker.exec(containerId, ['socat', '-u', '/dev/null', `TCP:host.docker.internal:${mcpPort},connect-timeout=5`], 
+        // Allow a small buffer above socat's 5s connect-timeout for docker exec/process startup overhead.
+        6_000);
+        if (result.exitCode !== 0) {
+            throw new Error(`Internal network connectivity check failed (exit=${result.exitCode}). ` +
+                `The container cannot reach host-side proxies via the socat sidecar on the --internal Docker network. ` +
+                `Check that the sidecar container is running and connected to the internal network.`);
+        }
+    }
     startEscalationWatcher() {
         this.escalationPollInterval = setInterval(() => {
             this.pollEscalationDirectory();
@@ -312,10 +442,15 @@ export class DockerAgentSession {
     async ensureImage(image) {
         const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
         const dockerDir = resolve(packageRoot, 'docker');
+        // On arm64 hosts (Apple Silicon), use the lightweight arm64-native Dockerfile
+        // instead of the amd64-only devcontainers/universal image.
+        const baseDockerfile = arch() === 'arm64' && existsSync(resolve(dockerDir, 'Dockerfile.base.arm64'))
+            ? 'Dockerfile.base.arm64'
+            : 'Dockerfile.base';
         // Build base image with CA cert baked in (if stale or missing)
         const baseImage = 'ironcurtain-base:latest';
-        const baseBuildHash = this.computeBuildHash(dockerDir, ['Dockerfile.base']);
-        const baseRebuilt = await this.ensureBaseImage(baseImage, dockerDir, baseBuildHash);
+        const baseBuildHash = this.computeBuildHash(dockerDir, [baseDockerfile]);
+        const baseRebuilt = await this.ensureBaseImage(baseImage, dockerDir, baseDockerfile, baseBuildHash);
         // Build the agent-specific image (if stale, missing, or base was rebuilt)
         const agentName = image.replace('ironcurtain-', '').replace(':latest', '');
         const dockerfile = `Dockerfile.${agentName}`;
@@ -337,7 +472,7 @@ export class DockerAgentSession {
      * Ensures the base image exists and is up-to-date.
      * Returns true if the base image was (re)built.
      */
-    async ensureBaseImage(baseImage, dockerDir, buildHash) {
+    async ensureBaseImage(baseImage, dockerDir, dockerfile, buildHash) {
         if (!(await this.isImageStale(baseImage, buildHash)))
             return false;
         logger.info('Building base Docker image (this may take a while on first run)...');
@@ -350,7 +485,7 @@ export class DockerAgentSession {
             }
             // Copy CA cert into build context
             copyFileSync(this.ca.certPath, resolve(tmpContext, 'ironcurtain-ca-cert.pem'));
-            await this.docker.buildImage(baseImage, resolve(tmpContext, 'Dockerfile.base'), tmpContext, {
+            await this.docker.buildImage(baseImage, resolve(tmpContext, dockerfile), tmpContext, {
                 'ironcurtain.build-hash': buildHash,
             });
         }