@provos/ironcurtain 0.4.0 → 0.5.0

package/dist/docker/adapters/claude-code.js

@@ -6,14 +6,16 @@
  * - System prompt injection via --append-system-prompt
  * - --continue for session resume across turns
  * - --dangerously-skip-permissions (IronCurtain handles security)
+ *
+ * The system prompt composes two layers:
+ * 1. Code Mode instructions (from session/prompts.ts) for tool discovery
+ * 2. Docker environment context explaining workspace, host access, and policy
  */
-import { anthropicProvider } from '../provider-config.js';
+import { anthropicProvider, claudePlatformProvider, anthropicOAuthProvider, claudePlatformOAuthProvider, } from '../provider-config.js';
+import { buildSystemPrompt } from '../../session/prompts.js';
 const CLAUDE_CODE_IMAGE = 'ironcurtain-claude-code:latest';
-function buildOrientationPrompt(context) {
-    const toolList = context.tools.map((t) => `- \`${t.name}\` -- ${t.description ?? 'no description'}`).join('\n');
-    return `You are running inside a sandboxed Docker container managed by IronCurtain.
-
-## Environment Constraints
+function buildDockerEnvironmentPrompt(context) {
+    return `## Docker Environment
 
 ### Workspace (\`${context.workspaceDir}\`)
 This is YOUR local workspace inside the container. Use your normal built-in
@@ -24,40 +26,35 @@ Files you create at \`${context.workspaceDir}/foo.txt\` are visible to MCP tools
 at \`${context.hostSandboxDir}/foo.txt\` and vice versa.
 
 ### Host Filesystem
-To read or modify files on the host operating system you MUST use the MCP
-tools listed below. These tools are mediated by IronCurtain's policy engine:
-every call is evaluated against security rules and recorded in the audit log.
+To read or modify files on the host operating system you MUST use the
+\`execute_code\` MCP tool with the sandbox tools listed above. These tools are
+mediated by IronCurtain's policy engine: every call is evaluated against
+security rules and recorded in the audit log.
 Your built-in file tools cannot reach the host filesystem.
 
 ### Network
-${context.networkMode === 'none'
-        ? `The container has NO network access (--network=none). All HTTP requests and
-git operations MUST go through the MCP tools below.
+The container has NO direct internet access. All HTTP requests and
+git operations MUST go through the sandbox tools via \`execute_code\`.
 
-Your built-in web search and web fetch tools route through the Anthropic API
-and will work, but they bypass IronCurtain's audit log. Prefer the MCP fetch
-tool when an auditable record of network access is required.`
-        : `The container's outbound network is restricted to IronCurtain's host-side
-proxies. Direct internet access is blocked by firewall rules. All HTTP
-requests and git operations MUST go through the MCP tools below.
+IMPORTANT: Your built-in server-side web search tool (WebSearch) is DISABLED
+and will NOT work — it is stripped by the security proxy. You MUST use the
+sandbox tools via \`execute_code\` instead. Do NOT attempt to use your
+built-in WebSearch or WebFetch tools.
 
-Your built-in web search and web fetch tools route through the Anthropic API
-via the MITM proxy and will work, but they bypass IronCurtain's audit log.
-Prefer the MCP fetch tool when an auditable record of network access is
-required.`}
-
-### Available MCP Tools
-${toolList}
+To search the web:
+  \`const results = tools.fetch_web_search({ query: "search terms" });\`
+To fetch a URL:
+  \`const page = tools.fetch_http_fetch({ url: "https://example.com" });\`
 
 ### Policy Enforcement
-Every MCP tool call is evaluated against security policy rules:
+Every tool call through \`execute_code\` is evaluated against security policy rules:
 - **Allowed**: proceeds automatically
 - **Denied**: blocked -- do NOT retry denied operations
 - **Escalated**: requires human approval -- you will receive the result once approved
 
 ### Best Practices
 1. Use your built-in tools for work inside ${context.workspaceDir}
-2. Use MCP tools for anything on the host filesystem or network
+2. Use \`execute_code\` for anything on the host filesystem or network
 3. Batch external operations to minimize escalation prompts
 4. If an operation is denied, explain the denial and suggest alternatives
 5. Do not attempt to bypass the sandbox
@@ -90,8 +87,37 @@ export const claudeCodeAdapter = {
         ];
     },
     generateOrientationFiles() {
-        // Orientation is delivered via --append-system-prompt, not files
-        return [];
+        // Wrapper script for PTY mode -- avoids shell quoting issues by reading
+        // the system prompt from $IRONCURTAIN_SYSTEM_PROMPT (set by entrypoint).
+        const startScript = `#!/bin/bash
+exec claude --dangerously-skip-permissions \\
+  --mcp-config /etc/ironcurtain/claude-mcp-config.json \\
+  --append-system-prompt "$IRONCURTAIN_SYSTEM_PROMPT"
+`;
+        // Helper script to resize the PTY that Claude Code is actually running on.
+        // docker exec stty targets a transient exec session PTY, not socat's PTY.
+        const resizeScript = `#!/bin/bash
+# Called from the host via: docker exec <cid> /etc/ironcurtain/resize-pty.sh <cols> <rows>
+COLS=$1
+ROWS=$2
+
+CLAUDE_PID=$(pgrep -f "claude --dangerously" | head -1)
+if [ -z "$CLAUDE_PID" ]; then
+  exit 0  # claude not started yet; resize will be retried
+fi
+
+PTS=$(readlink /proc/$CLAUDE_PID/fd/0 2>/dev/null)
+if [ -z "$PTS" ]; then
+  exit 0
+fi
+
+stty -F "$PTS" cols "$COLS" rows "$ROWS" 2>/dev/null
+kill -WINCH "$CLAUDE_PID" 2>/dev/null
+`;
+        return [
+            { path: 'start-claude.sh', content: startScript, mode: 0o755 },
+            { path: 'resize-pty.sh', content: resizeScript, mode: 0o755 },
+        ];
     },
     buildCommand(message, systemPrompt) {
         return [
@@ -109,18 +135,39 @@ export const claudeCodeAdapter = {
         ];
     },
     buildSystemPrompt(context) {
-        return buildOrientationPrompt(context);
+        // Layer 1: Code Mode instructions (tool discovery, sync calls, return semantics)
+        const codeModePrompt = buildSystemPrompt(context.serverListings, context.hostSandboxDir);
+        // Layer 2: Docker environment specifics (workspace, host access, policy)
+        const dockerPrompt = buildDockerEnvironmentPrompt(context);
+        return `${codeModePrompt}\n${dockerPrompt}`;
     },
-    getProviders() {
-        return [anthropicProvider];
+    getProviders(authKind) {
+        if (authKind === 'oauth') {
+            return [anthropicOAuthProvider, claudePlatformOAuthProvider];
+        }
+        return [anthropicProvider, claudePlatformProvider];
     },
-    buildEnv(_config, fakeKeys) {
-        return {
-            ANTHROPIC_API_KEY: fakeKeys.get('api.anthropic.com') ?? '',
+    buildEnv(config, fakeKeys) {
+        const env = {
             CLAUDE_CODE_DISABLE_UPDATE_CHECK: '1',
             // Node.js does not use the system CA store -- must set this explicitly
             NODE_EXTRA_CA_CERTS: '/usr/local/share/ca-certificates/ironcurtain-ca.crt',
         };
+        const fakeKey = fakeKeys.get('api.anthropic.com');
+        if (!fakeKey) {
+            throw new Error('No fake key generated for api.anthropic.com — cannot configure Claude Code authentication');
+        }
+        if (config.dockerAuth?.kind === 'oauth') {
+            // OAuth mode: pass fake token via Claude Code's native env var.
+            // Claude Code reads CLAUDE_CODE_OAUTH_TOKEN as its highest-priority auth.
+            env.CLAUDE_CODE_OAUTH_TOKEN = fakeKey;
+        }
+        else {
+            // API key mode: pass the fake key via a non-Claude env var; apiKeyHelper
+            // in settings.json echoes it so Claude Code never prompts for approval.
+            env.IRONCURTAIN_API_KEY = fakeKey;
+        }
+        return env;
     },
     extractResponse(exitCode, stdout) {
         if (exitCode !== 0) {
@@ -128,6 +175,16 @@ export const claudeCodeAdapter = {
         }
         return parseClaudeCodeJson(stdout);
     },
+    buildPtyCommand(_systemPrompt, ptySockPath, ptyPort) {
+        // The socat listener target depends on platform
+        const listenArg = ptySockPath
+            ? `UNIX-LISTEN:${ptySockPath},fork` // Linux UDS
+            : `TCP-LISTEN:${ptyPort},reuseaddr`; // macOS TCP
+        // Interactive mode: claude runs via a wrapper script that reads the system
+        // prompt from an env var set by the entrypoint. This avoids shell quoting
+        // issues that occur when embedding large prompts in socat EXEC: strings.
+        return ['socat', listenArg, 'EXEC:/etc/ironcurtain/start-claude.sh,pty,setsid,ctty,stderr'];
+    },
 };
 /**
  * Parses Claude Code's `--output-format json` response.
@@ -139,8 +196,10 @@ function parseClaudeCodeJson(stdout) {
         if (parsed && typeof parsed === 'object' && 'result' in parsed) {
             const obj = parsed;
             const text = typeof obj.result === 'string' ? obj.result : stdout.trim();
-            const costUsd = typeof obj.total_cost_usd === 'number' ? obj.total_cost_usd : undefined;
-            return costUsd !== undefined ? { text, costUsd } : { text };
+            if (typeof obj.total_cost_usd === 'number') {
+                return { text, costUsd: obj.total_cost_usd };
+            }
+            return { text };
         }
     }
     catch {

package/dist/docker/adapters/claude-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/docker/adapters/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAE3D,SAAS,sBAAsB,CAAC,OAA2B;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,WAAW,IAAI,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhH,OAAO;;;;mBAIU,OAAO,CAAC,YAAY;;;;sCAID,OAAO,CAAC,cAAc;wBACpC,OAAO,CAAC,YAAY;OACrC,OAAO,CAAC,cAAc;;;;;;;;;EAU3B,OAAO,CAAC,WAAW,KAAK,MAAM;QAC5B,CAAC,CAAC;;;;;6DAKuD;QACzD,CAAC,CAAC;;;;;;;UAQN;;;EAGE,QAAQ;;;;;;;;;6CASmC,OAAO,CAAC,YAAY;;;;;CAKhE,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,EAAE,EAAE,aAAwB;IAC5B,WAAW,EAAE,aAAa;IAE1B,iGAAiG;IACjG,KAAK,CAAC,QAAQ;QACZ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,8DAA8D;IAC9D,iBAAiB,CAAC,UAAkB;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE;gBACV,WAAW,EAAE;oBACX,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,gBAAgB,UAAU,EAAE,CAAC;iBACvF;aACF;SACF,CAAC;QAEF,OAAO;YACL;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,iEAAiE;QACjE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,YAAoB;QAChD,OAAO;YACL,QAAQ;YACR,YAAY;YACZ,gCAAgC;YAChC,iBAAiB;YACjB,MAAM;YACN,cAAc;YACd,yCAAyC;YACzC,wBAAwB;YACxB,YAAY;YACZ,IAAI;YACJ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,OAA2B;QAC3C,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,YAAY;QACV,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7B,CAAC;IAED,QAAQ,CAAC,OAA0B,EAAE,QAAqC;QACxE,OAAO;YACL,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE;YAC1D,gCAAgC,EAAE,GAAG;YACrC,uEAAuE;YACvE,mBAAmB,EAAE,qDAAqD;SAC3E,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,QAAgB,EAAE,MAAc;QAC9C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,0BAA0B,QAAQ,iBAAiB,MAAM,EAAE,EAAE,CAAC;QAC/E,CAAC;QACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzE,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/docker/adapters/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAE3D,SAAS,4BAA4B,CAAC,OAA2B;IAC/D,OAAO;;mBAEU,OAAO,CAAC,YAAY;;;;sCAID,OAAO,CAAC,cAAc;wBACpC,OAAO,CAAC,YAAY;OACrC,OAAO,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CA8BgB,OAAO,CAAC,YAAY;;;;;CAKhE,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,EAAE,EAAE,aAAwB;IAC5B,WAAW,EAAE,aAAa;IAE1B,iGAAiG;IACjG,KAAK,CAAC,QAAQ;QACZ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,8DAA8D;IAC9D,iBAAiB,CAAC,UAAkB;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE;gBACV,WAAW,EAAE;oBACX,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,gBAAgB,UAAU,EAAE,CAAC;iBACvF;aACF;SACF,CAAC;QAEF,OAAO;YACL;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,WAAW,GAAG;;;;CAIvB,CAAC;QAEE,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;CAiBxB,CAAC;QAEE,OAAO;YACL,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE;YAC9D,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE;SAC9D,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,YAAoB;QAChD,OAAO;YACL,QAAQ;YACR,YAAY;YACZ,gCAAgC;YAChC,iBAAiB;YACjB,MAAM;YACN,cAAc;YACd,yCAAyC;YACzC,wBAAwB;YACxB,YAAY;YACZ,IAAI;YACJ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,OAA2B;QAC3C,iFAAiF;QACjF,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAEzF,yEAAyE;QACzE,MAAM,YAAY,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAE3D,OAAO,GAAG,cAAc,KAAK,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED,YAAY,CAAC,QAA6B;QACxC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,sBAAsB,EAAE,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IACrD,CAAC;IAED,QAAQ,CAAC,MAAyB,EAAE,QAAqC;QACvE,MAAM,GAAG,GAA2B;YAClC,gCAAgC,EAAE,GAAG;YACrC,uEAAuE;YACvE,mBAAmB,EAAE,qDAAqD;SAC3E,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACxC,gEAAgE;YAChE,0EAA0E;YAC1E,GAAG,CAAC,uBAAuB,GAAG,OAAO,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,wEAAwE;YACxE,GAAG,CAAC,mBAAmB,GAAG,OAAO,CAAC;QACpC,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,eAAe,CAAC,QAAgB,EAAE,MAAc;QAC9C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,0BAA0B,QAAQ,iBAAiB,MAAM,EAAE,EAAE,CAAC;QAC/E,CAAC;QACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,eAAe,CACb,aAAqB,EACrB,WAA+B,EAC/B,OAA2B;QAE3B,gDAAgD;QAChD,MAAM,SAAS,GAAG,WAAW;YAC3B,CAAC,CAAC,eAAe,WAAW,OAAO,CAAC,YAAY;YAChD,CAAC,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC,YAAY;QAEnD,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,8DAA8D,CAAC,CAAC;IAC9F,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzE,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAC3C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACjC,CAAC"}

package/dist/docker/agent-adapter.d.ts

@@ -7,6 +7,7 @@
  */
 import type { IronCurtainConfig } from '../config/types.js';
 import type { ProviderConfig } from './provider-config.js';
+import type { ServerListing } from '../session/prompts.js';
 /**
  * Structured response from an agent adapter, carrying both the
  * text response and optional cost/usage metadata reported by the agent.
@@ -31,14 +32,8 @@ export interface AgentConfigFile {
     readonly path: string;
     /** File content. */
     readonly content: string;
-}
-/**
- * Information about a single MCP tool, used for orientation content.
- */
-export interface ToolInfo {
-    readonly name: string;
-    readonly description?: string;
-    readonly inputSchema: Record<string, unknown>;
+    /** Optional file mode (e.g. 0o755 for executable scripts). */
+    readonly mode?: number;
 }
 /**
  * Context passed to the adapter for generating orientation content.
@@ -48,8 +43,8 @@ export interface OrientationContext {
     readonly workspaceDir: string;
     /** The host-side path that is bind-mounted as workspaceDir. */
     readonly hostSandboxDir: string;
-    /** List of available MCP tools with descriptions. */
-    readonly tools: ToolInfo[];
+    /** Server listings for progressive tool disclosure. */
+    readonly serverListings: ServerListing[];
     /** Domains the agent may access via fetch MCP tool. */
     readonly allowedDomains: string[];
     /** Container network mode: 'none' (Linux UDS) or 'bridge' (macOS TCP). */
@@ -79,9 +74,8 @@ export interface AgentAdapter {
      * the agent how to connect to IronCurtain's proxy.
      *
      * @param socketPath - container-side UDS path (e.g., /run/ironcurtain/proxy.sock)
-     * @param tools - list of available MCP tools for documentation
      */
-    generateMcpConfig(socketPath: string, tools: ToolInfo[]): AgentConfigFile[];
+    generateMcpConfig(socketPath: string): AgentConfigFile[];
     /**
      * Generates orientation documents that teach the agent about
      * the MCP-mediated environment.
@@ -102,8 +96,11 @@ export interface AgentAdapter {
      * Returns LLM provider configurations for this agent.
      * The MITM proxy uses these to build the host allowlist,
      * generate fake API keys, swap keys in requests, and filter endpoints.
+     *
+     * @param authKind - When 'oauth', returns providers configured for bearer
+     *   token injection instead of header-based API key injection.
      */
-    getProviders(): readonly ProviderConfig[];
+    getProviders(authKind?: 'oauth' | 'apikey'): readonly ProviderConfig[];
     /**
      * Constructs environment variables for the container.
      * Receives fake keys instead of real keys -- the real keys never
@@ -119,4 +116,16 @@ export interface AgentAdapter {
      * @param stdout - captured stdout from the container
      */
     extractResponse(exitCode: number, stdout: string): AgentResponse;
+    /**
+     * Returns the Docker container command for PTY mode.
+     * When provided, the container runs this command directly instead of
+     * `sleep infinity`, and the host attaches via a PTY proxy.
+     *
+     * Adapters that do not implement this method do not support PTY mode.
+     *
+     * @param systemPrompt - the orientation prompt (written to a file, not embedded in shell)
+     * @param ptySockPath - the UDS path for the PTY listener (Linux), or undefined for TCP mode
+     * @param ptyPort - the TCP port for the PTY listener (macOS), or undefined for UDS mode
+     */
+    buildPtyCommand?(systemPrompt: string, ptySockPath: string | undefined, ptyPort: number | undefined): readonly string[];
 }

package/dist/docker/code-mode-proxy.d.ts

@@ -0,0 +1,34 @@
+/**
+ * CodeModeProxy -- MCP server that exposes a single `execute_code` tool
+ * backed by the UTCP Code Mode sandbox.
+ *
+ * Replaces the old ManagedProxy (which spawned mcp-proxy-server.ts as a
+ * child process). Docker agents now send TypeScript via `execute_code`,
+ * sharing the same execution engine as builtin Code Mode sessions.
+ *
+ * Architecture:
+ *   Container (Claude Code) → socat → UDS/TCP socket
+ *     → CodeModeProxy (MCP Server with execute_code)
+ *     → Sandbox.executeCode(code)
+ *     → V8 isolate → UTCP → per-server mcp-proxy-server.ts (stdio)
+ *     → PolicyEngine → real MCP servers
+ */
+import { type HelpData } from '../sandbox/index.js';
+import type { IronCurtainConfig } from '../config/types.js';
+/** Public interface for the Docker session's proxy. */
+export interface DockerProxy {
+    start(): Promise<void>;
+    getHelpData(): HelpData;
+    stop(): Promise<void>;
+    readonly socketPath: string;
+    readonly port: number | undefined;
+}
+export interface CodeModeProxyOptions {
+    /** Absolute path for the UDS socket (used in UDS mode, also stored for reference in TCP mode). */
+    readonly socketPath: string;
+    /** Session configuration passed to the Sandbox. */
+    readonly config: IronCurtainConfig;
+    /** Listen mode: 'uds' (default) or 'tcp'. TCP mode uses OS-assigned port. */
+    readonly listenMode?: 'uds' | 'tcp';
+}
+export declare function createCodeModeProxy(options: CodeModeProxyOptions): DockerProxy;

package/dist/docker/code-mode-proxy.js

@@ -0,0 +1,137 @@
+/**
+ * CodeModeProxy -- MCP server that exposes a single `execute_code` tool
+ * backed by the UTCP Code Mode sandbox.
+ *
+ * Replaces the old ManagedProxy (which spawned mcp-proxy-server.ts as a
+ * child process). Docker agents now send TypeScript via `execute_code`,
+ * sharing the same execution engine as builtin Code Mode sessions.
+ *
+ * Architecture:
+ *   Container (Claude Code) → socat → UDS/TCP socket
+ *     → CodeModeProxy (MCP Server with execute_code)
+ *     → Sandbox.executeCode(code)
+ *     → V8 isolate → UTCP → per-server mcp-proxy-server.ts (stdio)
+ *     → PolicyEngine → real MCP servers
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { UdsServerTransport } from '../trusted-process/uds-server-transport.js';
+import { TcpServerTransport } from '../trusted-process/tcp-server-transport.js';
+import { Sandbox } from '../sandbox/index.js';
+import { VERSION } from '../version.js';
+export function createCodeModeProxy(options) {
+    const sandbox = new Sandbox();
+    const useTcp = options.listenMode === 'tcp';
+    let mcpServer = null; // eslint-disable-line @typescript-eslint/no-deprecated
+    let transport = null;
+    return {
+        socketPath: options.socketPath,
+        get port() {
+            if (transport instanceof TcpServerTransport) {
+                try {
+                    return transport.port;
+                }
+                catch {
+                    return undefined;
+                }
+            }
+            return undefined;
+        },
+        async start() {
+            // 1. Initialize the sandbox (registers MCP proxy servers per backend)
+            await sandbox.initialize(options.config);
+            // 2. Create the MCP server exposing a single execute_code tool
+            mcpServer = new Server(// eslint-disable-line @typescript-eslint/no-deprecated
+            { name: 'ironcurtain-code-mode', version: VERSION }, { capabilities: { tools: {} } });
+            // eslint-disable-next-line @typescript-eslint/require-await -- MCP SDK handler must return Promise
+            mcpServer.setRequestHandler(ListToolsRequestSchema, async () => ({
+                tools: [
+                    {
+                        name: 'execute_code',
+                        description: 'Execute TypeScript code in a secure sandbox. ' +
+                            'Tool calls are synchronous (no await). ' +
+                            'Use `return` to send a value back. ' +
+                            'Call help.help() to discover available tools.',
+                        inputSchema: {
+                            type: 'object',
+                            properties: {
+                                code: {
+                                    type: 'string',
+                                    description: 'TypeScript code to execute',
+                                },
+                            },
+                            required: ['code'],
+                        },
+                    },
+                ],
+            }));
+            mcpServer.setRequestHandler(CallToolRequestSchema, async (request) => {
+                if (request.params.name !== 'execute_code') {
+                    return {
+                        content: [{ type: 'text', text: `Unknown tool: ${request.params.name}` }],
+                        isError: true,
+                    };
+                }
+                const args = request.params.arguments;
+                const code = args?.code;
+                if (!code || typeof code !== 'string') {
+                    return {
+                        content: [{ type: 'text', text: 'Missing required parameter: code' }],
+                        isError: true,
+                    };
+                }
+                try {
+                    const { result, logs } = await sandbox.executeCode(code);
+                    const parts = [];
+                    if (logs.length > 0) {
+                        parts.push(`[logs]\n${logs.join('\n')}`);
+                    }
+                    if (result === undefined) {
+                        parts.push('(no return value)');
+                    }
+                    else if (typeof result === 'string') {
+                        parts.push(result);
+                    }
+                    else {
+                        parts.push(JSON.stringify(result, null, 2));
+                    }
+                    return {
+                        content: [{ type: 'text', text: parts.join('\n\n') }],
+                    };
+                }
+                catch (err) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `Execution error: ${err instanceof Error ? err.message : String(err)}`,
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+            });
+            // 3. Start the transport
+            if (useTcp) {
+                transport = new TcpServerTransport('127.0.0.1', 0);
+            }
+            else {
+                transport = new UdsServerTransport(options.socketPath);
+            }
+            await mcpServer.connect(transport);
+        },
+        getHelpData() {
+            return sandbox.getHelpData();
+        },
+        async stop() {
+            if (mcpServer) {
+                await mcpServer.close();
+                mcpServer = null;
+            }
+            // mcpServer.close() closes the transport, but shutdown sandbox separately
+            transport = null;
+            await sandbox.shutdown();
+        },
+    };
+}
+//# sourceMappingURL=code-mode-proxy.js.map

package/dist/docker/code-mode-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-mode-proxy.js","sourceRoot":"","sources":["../../src/docker/code-mode-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,OAAO,EAAiB,MAAM,qBAAqB,CAAC;AAE7D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAoBxC,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;IAE5C,IAAI,SAAS,GAAkB,IAAI,CAAC,CAAC,uDAAuD;IAC5F,IAAI,SAAS,GAAmD,IAAI,CAAC;IAErE,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAE9B,IAAI,IAAI;YACN,IAAI,SAAS,YAAY,kBAAkB,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,OAAO,SAAS,CAAC,IAAI,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,KAAK;YACT,sEAAsE;YACtE,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEzC,+DAA+D;YAC/D,SAAS,GAAG,IAAI,MAAM,CAAE,uDAAuD;YAC7E,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,EACnD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;YAEF,mGAAmG;YACnG,SAAS,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC/D,KAAK,EAAE;oBACL;wBACE,IAAI,EAAE,cAAc;wBACpB,WAAW,EACT,+CAA+C;4BAC/C,yCAAyC;4BACzC,qCAAqC;4BACrC,+CAA+C;wBACjD,WAAW,EAAE;4BACX,IAAI,EAAE,QAAiB;4BACvB,UAAU,EAAE;gCACV,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,4BAA4B;iCAC1C;6BACF;4BACD,QAAQ,EAAE,CAAC,MAAM,CAAC;yBACnB;qBACF;iBACF;aACF,CAAC,CAAC,CAAC;YAEJ,SAAS,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACnE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAC3C,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBACzE,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAA0C,CAAC;gBACvE,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtC,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;wBACrE,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;oBACzD,MAAM,KAAK,GAAa,EAAE,CAAC;oBAE3B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpB,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBAClC,CAAC;yBAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACtC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,CAAC;yBAAM,CAAC;wBACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC9C,CAAC;oBAED,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;qBACtD,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;6BAC7E;yBACF;wBACD,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,yBAAyB;YACzB,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAED,WAAW;YACT,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;gBACxB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,0EAA0E;YAC1E,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/docker/docker-agent-session.d.ts

@@ -15,7 +15,7 @@ import type { Session, SessionId, SessionInfo, ConversationTurn, DiagnosticEvent
 import type { IronCurtainConfig } from '../config/types.js';
 import type { AgentAdapter } from './agent-adapter.js';
 import type { DockerManager } from './types.js';
-import type { ManagedProxy } from './managed-proxy.js';
+import type { DockerProxy } from './code-mode-proxy.js';
 import type { MitmProxy } from './mitm-proxy.js';
 import type { CertificateAuthority } from './ca.js';
 export interface DockerAgentSessionDeps {
@@ -23,7 +23,7 @@ export interface DockerAgentSessionDeps {
     readonly sessionId: SessionId;
     readonly adapter: AgentAdapter;
     readonly docker: DockerManager;
-    readonly proxy: ManagedProxy;
+    readonly proxy: DockerProxy;
     readonly mitmProxy: MitmProxy;
     readonly ca: CertificateAuthority;
     readonly fakeKeys: ReadonlyMap<string, string>;
@@ -36,6 +36,19 @@ export interface DockerAgentSessionDeps {
     readonly onEscalation?: (request: EscalationRequest) => void;
     readonly onEscalationExpired?: () => void;
     readonly onDiagnostic?: (event: DiagnosticEvent) => void;
+    /**
+     * When set, proxies are already started, orientation is built, and
+     * the image name is resolved. initialize() skips those steps and
+     * proceeds directly to container creation + watchers.
+     */
+    readonly preBuiltInfrastructure?: {
+        readonly systemPrompt: string;
+        readonly image: string;
+        readonly mitmAddr: {
+            socketPath?: string;
+            port?: number;
+        };
+    };
 }
 export declare class DockerAgentSession implements Session {
     private readonly sessionId;
@@ -54,25 +67,25 @@ export declare class DockerAgentSession implements Session {
     private status;
     private readonly createdAt;
     private containerId;
+    private sidecarContainerId;
     private networkName;
     private systemPrompt;
     private turns;
     private diagnosticLog;
-    private pendingEscalation;
-    private seenEscalationIds;
-    private escalationPollInterval;
+    private escalationWatcher;
     private auditTailer;
     private cumulativeActiveMs;
     private cumulativeCostUsd;
     private readonly onEscalation?;
     private readonly onEscalationExpired?;
     private readonly onDiagnostic?;
+    private readonly preBuiltInfrastructure?;
     constructor(deps: DockerAgentSessionDeps);
     /**
      * Initialize the Docker agent session:
-     * 1. Start MCP proxy (UDS)
-     * 2. Start MITM proxy (UDS)
-     * 3. Query proxy for available tools
+     * 1. Start Code Mode proxy (UDS/TCP)
+     * 2. Start MITM proxy (UDS/TCP)
+     * 3. Build server listings from sandbox help data
      * 4. Generate orientation files
      * 5. Ensure Docker image exists (with CA cert baked in)
      * 6. Create and start container (--network=none)
@@ -92,15 +105,10 @@ export declare class DockerAgentSession implements Session {
     private emitDiagnostic;
     /**
      * Checks whether the container can reach host-side proxies via the
-     * internal Docker network. Throws if connectivity fails.
+     * socat sidecar on the internal Docker network. Throws if connectivity fails.
      */
     private checkInternalNetworkConnectivity;
-    private startEscalationWatcher;
-    private stopEscalationWatcher;
-    private pollEscalationDirectory;
-    private checkEscalationExpiry;
     private writeUserContext;
-    private extractEscalationId;
     /**
      * Ensures the Docker image exists and is up-to-date, building it
      * (and the base image) if needed.