@provos/ironcurtain 0.4.1 → 0.5.1

package/dist/docker/pty-session.js

@@ -0,0 +1,510 @@
+/**
+ * PTY session module -- orchestrates a Docker session where the user's
+ * terminal is attached directly to Claude Code's PTY inside the container.
+ *
+ * Instead of the batch-oriented DockerAgentSession (docker exec per turn),
+ * this module provides a native interactive experience by bridging the
+ * terminal via a Node.js PTY proxy to a socat-managed PTY inside the container.
+ *
+ * Architecture:
+ *   User terminal -> Node.js PTY proxy -> UDS/TCP -> socat (container)
+ *     -> Claude Code (interactive, with PTY)
+ *     -> Code Mode Proxy (MCP)
+ *     -> mcp-proxy-server (PolicyEngine + Audit)
+ */
+import { createConnection } from 'node:net';
+import { execFile } from 'node:child_process';
+import { mkdirSync, writeFileSync, unlinkSync } from 'node:fs';
+import { resolve } from 'node:path';
+import chalk from 'chalk';
+import ora from 'ora';
+import { createSessionId } from '../session/types.js';
+import { CONTAINER_WORKSPACE_DIR } from './agent-adapter.js';
+import { PTY_SOCK_NAME, DEFAULT_PTY_PORT } from './pty-types.js';
+import { createEscalationWatcher, atomicWriteJsonSync } from '../escalation/escalation-watcher.js';
+import { getSessionDir, getSessionSandboxDir, getSessionEscalationDir, getSessionAuditLogPath, getSessionLogPath, getSessionLlmLogPath, getPtyRegistryDir, } from '../config/paths.js';
+import * as logger from '../logger.js';
+/** Maximum time to wait for the PTY socket to appear (ms). */
+const PTY_READINESS_TIMEOUT_MS = 30_000;
+/** Poll interval when waiting for PTY socket (ms). */
+const PTY_READINESS_POLL_MS = 200;
+/**
+ * Runs a PTY session: starts proxies, launches container with PTY-enabled
+ * Claude Code, attaches the terminal, and blocks until the session ends.
+ */
+export async function runPtySession(options) {
+    const { prepareDockerInfrastructure } = await import('./docker-infrastructure.js');
+    const sessionId = createSessionId();
+    const sessionDir = getSessionDir(sessionId);
+    const sandboxDir = getSessionSandboxDir(sessionId);
+    const escalationDir = getSessionEscalationDir(sessionId);
+    const auditLogPath = getSessionAuditLogPath(sessionId);
+    const socketsDir = resolve(sessionDir, 'sockets');
+    mkdirSync(sandboxDir, { recursive: true, mode: 0o700 });
+    mkdirSync(escalationDir, { recursive: true, mode: 0o700 });
+    mkdirSync(socketsDir, { recursive: true, mode: 0o700 });
+    // Set up session logging
+    const sessionLogPath = getSessionLogPath(sessionId);
+    const llmLogPath = getSessionLlmLogPath(sessionId);
+    logger.setup({ logFilePath: sessionLogPath });
+    logger.info(`PTY session ${sessionId} starting`);
+    logger.info(`Sandbox: ${sandboxDir}`);
+    logger.info(`Escalation dir: ${escalationDir}`);
+    logger.info(`LLM log: ${llmLogPath}`);
+    // Patch config for this session
+    const sessionConfig = {
+        ...options.config,
+        allowedDirectory: sandboxDir,
+        auditLogPath,
+        escalationDir,
+        sessionLogPath,
+        llmLogPath,
+        mcpServers: JSON.parse(JSON.stringify(options.config.mcpServers)),
+    };
+    const initSpinner = ora({
+        text: `Initializing PTY session (${options.mode.agent})...`,
+        stream: process.stderr,
+        discardStdin: false,
+    }).start();
+    let containerId = null;
+    let sidecarContainerId = null;
+    let escalationFileWatcher = null;
+    let registrationPath = null;
+    let shutdownSpinner = null;
+    // Terminal safety: ensure raw mode is restored on any exit
+    const restoreTerminal = () => {
+        try {
+            if (process.stdin.isTTY && process.stdin.isRaw) {
+                process.stdin.setRawMode(false);
+                process.stdin.pause();
+            }
+        }
+        catch {
+            /* best effort */
+        }
+    };
+    process.on('exit', restoreTerminal);
+    // SIGTERM triggers graceful shutdown by aborting the PTY connection.
+    // This causes attachPty() to resolve, which then falls through to the
+    // finally block for full async cleanup (containers, proxies, files).
+    const shutdownController = new AbortController();
+    const handleSigterm = () => {
+        shutdownController.abort();
+    };
+    process.on('SIGTERM', handleSigterm);
+    // Infra variables set inside try, used in finally for cleanup
+    let proxy = null;
+    let mitmProxy = null;
+    let docker = null;
+    let useTcp = false;
+    try {
+        const infra = await prepareDockerInfrastructure(sessionConfig, options.mode, sessionDir, sandboxDir, escalationDir, auditLogPath, sessionId);
+        ({ docker, proxy, mitmProxy, useTcp } = infra);
+        const { adapter, fakeKeys, orientationDir, systemPrompt, image, mitmAddr } = infra;
+        // Validate adapter supports PTY mode
+        if (!adapter.buildPtyCommand) {
+            throw new Error(`Agent ${adapter.id} does not support PTY mode.`);
+        }
+        // Write system prompt to file for shell-injection-safe PTY command
+        writeFileSync(resolve(orientationDir, 'system-prompt.txt'), systemPrompt);
+        // Determine PTY connection target
+        const ptySockPath = useTcp ? undefined : `/run/ironcurtain/${PTY_SOCK_NAME}`;
+        const ptyPort = useTcp ? DEFAULT_PTY_PORT : undefined;
+        // Build the PTY command
+        const ptyCommand = adapter.buildPtyCommand(systemPrompt, ptySockPath, ptyPort);
+        // Build container configuration
+        const shortId = sessionId.substring(0, 12);
+        const { INTERNAL_NETWORK_NAME, INTERNAL_NETWORK_SUBNET, INTERNAL_NETWORK_GATEWAY } = await import('./platform.js');
+        const { quote } = await import('shell-quote');
+        let env;
+        let network;
+        let mounts;
+        let extraHosts;
+        if (useTcp && proxy.port !== undefined && mitmAddr.port !== undefined) {
+            // macOS TCP mode
+            const mcpPort = proxy.port;
+            const mitmPort = mitmAddr.port;
+            env = {
+                ...adapter.buildEnv(sessionConfig, fakeKeys),
+                HTTPS_PROXY: `http://host.docker.internal:${mitmPort}`,
+                HTTP_PROXY: `http://host.docker.internal:${mitmPort}`,
+            };
+            await docker.createNetwork(INTERNAL_NETWORK_NAME, {
+                internal: true,
+                subnet: INTERNAL_NETWORK_SUBNET,
+                gateway: INTERNAL_NETWORK_GATEWAY,
+            });
+            network = INTERNAL_NETWORK_NAME;
+            const socatImage = 'alpine/socat';
+            if (!(await docker.imageExists(socatImage))) {
+                logger.info(`Pulling ${socatImage}...`);
+                await docker.pullImage(socatImage);
+            }
+            // Create socat sidecar with PTY port forwarding
+            const sidecarName = `ironcurtain-sidecar-${shortId}`;
+            const ptyPortNum = ptyPort ?? DEFAULT_PTY_PORT;
+            sidecarContainerId = await docker.create({
+                image: socatImage,
+                name: sidecarName,
+                network: 'bridge',
+                mounts: [],
+                env: {},
+                entrypoint: '/bin/sh',
+                command: [
+                    '-c',
+                    quote(['socat', `TCP-LISTEN:${mcpPort},fork,reuseaddr`, `TCP:host.docker.internal:${mcpPort}`]) +
+                        ' & ' +
+                        quote(['socat', `TCP-LISTEN:${mitmPort},fork,reuseaddr`, `TCP:host.docker.internal:${mitmPort}`]) +
+                        ' & ' +
+                        quote(['socat', `TCP-LISTEN:${ptyPortNum},fork,reuseaddr`, `TCP:host.docker.internal:${ptyPortNum}`]) +
+                        ' & wait',
+                ],
+            });
+            await docker.start(sidecarContainerId);
+            await docker.connectNetwork(INTERNAL_NETWORK_NAME, sidecarContainerId);
+            const sidecarIp = await docker.getContainerIp(sidecarContainerId, INTERNAL_NETWORK_NAME);
+            extraHosts = [`host.docker.internal:${sidecarIp}`];
+            mounts = [
+                { source: sandboxDir, target: CONTAINER_WORKSPACE_DIR, readonly: false },
+                { source: orientationDir, target: '/etc/ironcurtain', readonly: true },
+            ];
+        }
+        else {
+            // Linux UDS mode
+            env = {
+                ...adapter.buildEnv(sessionConfig, fakeKeys),
+                HTTPS_PROXY: 'http://127.0.0.1:18080',
+                HTTP_PROXY: 'http://127.0.0.1:18080',
+            };
+            network = 'none';
+            mounts = [
+                { source: sandboxDir, target: CONTAINER_WORKSPACE_DIR, readonly: false },
+                { source: socketsDir, target: '/run/ironcurtain', readonly: false },
+                { source: orientationDir, target: '/etc/ironcurtain', readonly: true },
+            ];
+        }
+        // Pass initial terminal size so start-claude.sh can set PTY dimensions
+        // before Claude starts, eliminating the resize race condition.
+        const { columns, rows } = process.stdout;
+        if (columns)
+            env.IRONCURTAIN_INITIAL_COLS = String(columns);
+        if (rows)
+            env.IRONCURTAIN_INITIAL_ROWS = String(rows);
+        // Create and start container with PTY command and TTY
+        containerId = await docker.create({
+            image,
+            name: `ironcurtain-pty-${shortId}`,
+            network,
+            mounts,
+            env,
+            command: ptyCommand,
+            sessionLabel: sessionId,
+            resources: { memoryMb: 4096, cpus: 2 },
+            extraHosts,
+            tty: true,
+        });
+        await docker.start(containerId);
+        logger.info(`PTY container started: ${containerId.substring(0, 12)}`);
+        // Write session registration for the escalation listener
+        registrationPath = writeRegistration(sessionId, escalationDir, adapter.displayName);
+        // Start escalation file watcher (emits BEL to alert user)
+        escalationFileWatcher = createEscalationWatcher(escalationDir, {
+            onEscalation: () => {
+                process.stderr.write('\x07'); // BEL character
+            },
+            onEscalationExpired: () => { },
+        });
+        escalationFileWatcher.start();
+        // Wait for PTY socket readiness
+        const ptyTarget = useTcp
+            ? { host: 'localhost', port: ptyPort ?? DEFAULT_PTY_PORT }
+            : resolve(socketsDir, PTY_SOCK_NAME);
+        await waitForPtyReady(ptyTarget);
+        initSpinner.succeed(chalk.dim('PTY session ready'));
+        process.stderr.write('\n');
+        // Attach terminal via Node.js PTY proxy
+        const exitCode = await attachPty({
+            target: ptyTarget,
+            containerId,
+            signal: shutdownController.signal,
+        });
+        // PTY disconnected -- restore terminal and show shutdown progress
+        restoreTerminal();
+        process.stderr.write('\n');
+        shutdownSpinner = ora({
+            text: 'Shutting down PTY session...',
+            stream: process.stderr,
+            discardStdin: false,
+        }).start();
+        if (exitCode !== 0) {
+            process.stderr.write(chalk.yellow(`PTY session exited with code ${exitCode}\n`));
+        }
+    }
+    finally {
+        // Stop spinner if still running (e.g. error during setup)
+        if (initSpinner.isSpinning) {
+            initSpinner.fail(chalk.red('PTY session failed'));
+        }
+        restoreTerminal();
+        process.off('exit', restoreTerminal);
+        process.off('SIGTERM', handleSigterm);
+        // Stop escalation watcher
+        escalationFileWatcher?.stop();
+        // Delete registration file
+        if (registrationPath) {
+            try {
+                unlinkSync(registrationPath);
+            }
+            catch {
+                /* best effort */
+            }
+        }
+        // Stop and remove containers
+        if (docker && containerId) {
+            await docker.stop(containerId).catch(() => { });
+            await docker.remove(containerId).catch(() => { });
+        }
+        if (docker && sidecarContainerId) {
+            await docker.stop(sidecarContainerId).catch(() => { });
+            await docker.remove(sidecarContainerId).catch(() => { });
+        }
+        // Remove internal network if used
+        if (docker && useTcp) {
+            const { INTERNAL_NETWORK_NAME } = await import('./platform.js');
+            await docker.removeNetwork(INTERNAL_NETWORK_NAME).catch(() => { });
+        }
+        // Stop proxies
+        await mitmProxy?.stop().catch(() => { });
+        await proxy?.stop().catch(() => { });
+        logger.info(`PTY session ${sessionId} ended`);
+        logger.teardown();
+        // shutdownSpinner is declared inside try but accessible here via closure
+        shutdownSpinner?.succeed(chalk.dim('PTY session ended'));
+    }
+}
+/** Creates a net.Socket connection to the PTY target (UDS or TCP). */
+function connectToTarget(target) {
+    if (typeof target === 'string') {
+        return createConnection({ path: target });
+    }
+    return createConnection({ host: target.host, port: target.port });
+}
+/**
+ * Attaches the user's terminal to the container PTY via a Node.js socket.
+ * Returns a promise that resolves with 0 on normal close, 1 on error.
+ */
+function attachPty(options) {
+    const conn = connectToTarget(options.target);
+    const { stdin, stdout } = process;
+    return new Promise((resolvePromise) => {
+        let resolved = false;
+        const settle = (code) => {
+            if (resolved)
+                return;
+            resolved = true;
+            resolvePromise(code);
+        };
+        conn.once('connect', () => {
+            // Put terminal in raw mode
+            if (stdin.isTTY) {
+                stdin.setRawMode(true);
+            }
+            stdin.resume();
+            // SIGWINCH: forward terminal resize to container PTY.
+            // verifyAbort cancels the background verify loop on first user resize
+            // so it doesn't fight with the new size.
+            const verifyAbort = new AbortController();
+            let isFirstResize = true;
+            const onResize = () => {
+                const { columns, rows } = stdout;
+                if (columns && rows) {
+                    if (!isFirstResize) {
+                        verifyAbort.abort();
+                    }
+                    isFirstResize = false;
+                    execFile('docker', ['exec', options.containerId, '/etc/ironcurtain/resize-pty.sh', String(columns), String(rows)], { timeout: 5000 }, (err, _stdout, stderr) => {
+                        if (err) {
+                            logger.warn(`resize-pty.sh failed: ${err.message}`);
+                            if (stderr) {
+                                logger.warn(`resize-pty.sh stderr: ${stderr.trim()}`);
+                            }
+                        }
+                    });
+                }
+            };
+            stdout.on('resize', onResize);
+            // Send initial size
+            onResize();
+            // Background verify+retry to ensure the initial resize took effect.
+            // Fire-and-forget -- does not block the PTY proxy.
+            // Canceled via verifyAbort when the user resizes the terminal.
+            if (stdout.columns && stdout.rows) {
+                void verifyInitialPtySize(options.containerId, stdout.columns, stdout.rows, verifyAbort.signal);
+            }
+            // Host -> Container
+            // Ctrl-\ (0x1c) is intercepted as an emergency exit since raw mode
+            // disables normal signal generation for SIGQUIT.
+            const CTRL_BACKSLASH = 0x1c;
+            const onData = (data) => {
+                if (data.length === 1 && data[0] === CTRL_BACKSLASH) {
+                    cleanup();
+                    conn.destroy();
+                    settle(0);
+                    return;
+                }
+                conn.write(data);
+            };
+            stdin.on('data', onData);
+            // Container -> Host (untrusted output, displayed directly)
+            conn.pipe(stdout);
+            // Use function declarations (hoisted) so cleanup and onAbort can
+            // reference each other without temporal dead zone issues.
+            function cleanup() {
+                stdout.removeListener('resize', onResize);
+                stdin.removeListener('data', onData);
+                conn.unpipe(stdout);
+                stdin.pause();
+                verifyAbort.abort();
+                options.signal?.removeEventListener('abort', onAbort);
+            }
+            function onAbort() {
+                cleanup();
+                conn.destroy();
+                settle(0);
+            }
+            if (options.signal?.aborted) {
+                onAbort();
+                return;
+            }
+            options.signal?.addEventListener('abort', onAbort, { once: true });
+            conn.once('close', () => {
+                cleanup();
+                settle(0);
+            });
+            conn.once('error', () => {
+                cleanup();
+                settle(1);
+            });
+        });
+        conn.once('error', () => {
+            settle(1);
+        });
+    });
+}
+// --- PTY size verification ---
+/** Maximum retries for initial PTY size verification. */
+const PTY_SIZE_VERIFY_RETRIES = 5;
+/** Interval between PTY size verification attempts (ms). */
+const PTY_SIZE_VERIFY_INTERVAL_MS = 1_000;
+/** Initial delay before first verification attempt (ms). */
+const PTY_SIZE_VERIFY_INITIAL_DELAY_MS = 500;
+/**
+ * Runs check-pty-size.sh and returns { rows, cols } or null on failure.
+ */
+function checkPtySize(containerId) {
+    return new Promise((resolve) => {
+        execFile('docker', ['exec', containerId, '/etc/ironcurtain/check-pty-size.sh'], { timeout: 5000 }, (err, stdout) => {
+            if (err) {
+                resolve(null);
+                return;
+            }
+            const parts = stdout.trim().split(/\s+/);
+            if (parts.length >= 2) {
+                const rows = parseInt(parts[0], 10);
+                const cols = parseInt(parts[1], 10);
+                if (!isNaN(rows) && !isNaN(cols) && rows > 0 && cols > 0) {
+                    resolve({ rows, cols });
+                    return;
+                }
+            }
+            resolve(null);
+        });
+    });
+}
+/**
+ * Background verify+retry loop for initial PTY resize.
+ * Non-blocking (fire-and-forget). Aborted when a user resize occurs so it
+ * does not fight with legitimate SIGWINCH-driven resizes.
+ */
+async function verifyInitialPtySize(containerId, expectedCols, expectedRows, signal) {
+    await new Promise((r) => setTimeout(r, PTY_SIZE_VERIFY_INITIAL_DELAY_MS));
+    for (let attempt = 0; attempt < PTY_SIZE_VERIFY_RETRIES; attempt++) {
+        if (signal?.aborted)
+            return;
+        const size = await checkPtySize(containerId);
+        if (size && size.cols === expectedCols && size.rows === expectedRows) {
+            return; // PTY size matches
+        }
+        if (signal?.aborted)
+            return;
+        // Mismatch or check failed -- try resizing
+        await new Promise((resolve) => {
+            execFile('docker', ['exec', containerId, '/etc/ironcurtain/resize-pty.sh', String(expectedCols), String(expectedRows)], { timeout: 5000 }, () => resolve());
+        });
+        // Wait before rechecking
+        await new Promise((r) => setTimeout(r, PTY_SIZE_VERIFY_INTERVAL_MS));
+    }
+    if (signal?.aborted)
+        return;
+    // Final check
+    const finalSize = await checkPtySize(containerId);
+    if (!finalSize || finalSize.cols !== expectedCols || finalSize.rows !== expectedRows) {
+        logger.warn(`PTY size verification failed after ${PTY_SIZE_VERIFY_RETRIES} retries ` +
+            `(expected ${expectedCols}x${expectedRows}, got ${finalSize ? `${finalSize.cols}x${finalSize.rows}` : 'unknown'})`);
+    }
+}
+// --- Readiness polling ---
+/**
+ * Waits for the PTY socket/port to become connectable.
+ */
+async function waitForPtyReady(target) {
+    const deadline = Date.now() + PTY_READINESS_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        const connected = await tryConnect(target);
+        if (connected)
+            return;
+        await new Promise((r) => setTimeout(r, PTY_READINESS_POLL_MS));
+    }
+    throw new Error(`PTY socket did not become ready within ${PTY_READINESS_TIMEOUT_MS / 1000}s`);
+}
+/**
+ * Tries to connect to a target. Returns true if the connection succeeds.
+ */
+function tryConnect(target) {
+    return new Promise((resolve) => {
+        const conn = connectToTarget(target);
+        const timer = setTimeout(() => {
+            conn.destroy();
+            resolve(false);
+        }, 1000);
+        conn.on('connect', () => {
+            clearTimeout(timer);
+            conn.destroy();
+            resolve(true);
+        });
+        conn.on('error', () => {
+            clearTimeout(timer);
+            resolve(false);
+        });
+    });
+}
+// --- Registration ---
+/**
+ * Writes a PTY session registration file to the registry directory.
+ * Returns the absolute path of the registration file.
+ */
+function writeRegistration(sessionId, escalationDir, adapterDisplayName) {
+    const registryDir = getPtyRegistryDir();
+    mkdirSync(registryDir, { recursive: true, mode: 0o700 });
+    const registration = {
+        sessionId,
+        escalationDir,
+        label: `${adapterDisplayName} (interactive)`,
+        startedAt: new Date().toISOString(),
+        pid: process.pid,
+    };
+    const registrationPath = resolve(registryDir, `session-${sessionId}.json`);
+    atomicWriteJsonSync(registrationPath, registration);
+    return registrationPath;
+}
+//# sourceMappingURL=pty-session.js.map

package/dist/docker/pty-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pty-session.js","sourceRoot":"","sources":["../../src/docker/pty-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AAItB,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEjE,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAEnG,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAOvC,8DAA8D;AAC9D,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC,sDAAsD;AACtD,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA0B;IAC5D,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAEnF,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAElD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExD,yBAAyB;IACzB,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,IAAI,CAAC,eAAe,SAAS,WAAW,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC;IACtC,MAAM,CAAC,IAAI,CAAC,mBAAmB,aAAa,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC;IAEtC,gCAAgC;IAChC,MAAM,aAAa,GAAG;QACpB,GAAG,OAAO,CAAC,MAAM;QACjB,gBAAgB,EAAE,UAAU;QAC5B,YAAY;QACZ,aAAa;QACb,cAAc;QACd,UAAU;QACV,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAqC;KACtG,CAAC;IAEF,MAAM,WAAW,GAAG,GAAG,CAAC;QACtB,IAAI,EAAE,6BAA6B,OAAO,CAAC,IAAI,CAAC,KAAK,MAAM;QAC3D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC,KAAK,EAAE,CAAC;IAEX,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,qBAAqB,GAA6B,IAAI,CAAC;IAC3D,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,IAAI,eAAe,GAAkC,IAAI,CAAC;IAE1D,2DAA2D;IAC3D,MAAM,eAAe,GAAG,GAAS,EAAE;QACjC,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC/C,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAChC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEpC,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAC;IACjD,MAAM,aAAa,GAAG,GAAS,EAAE;QAC/B,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAErC,8DAA8D;IAC9D,IAAI,KAAK,GAA4E,IAAI,CAAC;IAC1F,IAAI,SAAS,GAAgF,IAAI,CAAC;IAClG,IAAI,MAAM,GAA6E,IAAI,CAAC;IAC5F,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAC7C,aAAa,EACb,OAAO,CAAC,IAAI,EACZ,UAAU,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,SAAS,CACV,CAAC;QAEF,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;QAC/C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAEnF,qCAAqC;QACrC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,6BAA6B,CAAC,CAAC;QACpE,CAAC;QAED,mEAAmE;QACnE,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC,CAAC;QAE1E,kCAAkC;QAClC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,aAAa,EAAE,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtD,wBAAwB;QACxB,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAE/E,gCAAgC;QAChC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACnH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,GAA2B,CAAC;QAChC,IAAI,OAAe,CAAC;QACpB,IAAI,MAA+D,CAAC;QACpE,IAAI,UAAgC,CAAC;QAErC,IAAI,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtE,iBAAiB;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;YAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;YAE/B,GAAG,GAAG;gBACJ,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;gBAC5C,WAAW,EAAE,+BAA+B,QAAQ,EAAE;gBACtD,UAAU,EAAE,+BAA+B,QAAQ,EAAE;aACtD,CAAC;YAEF,MAAM,MAAM,CAAC,aAAa,CAAC,qBAAqB,EAAE;gBAChD,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,uBAAuB;gBAC/B,OAAO,EAAE,wBAAwB;aAClC,CAAC,CAAC;YACH,OAAO,GAAG,qBAAqB,CAAC;YAEhC,MAAM,UAAU,GAAG,cAAc,CAAC;YAClC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,WAAW,UAAU,KAAK,CAAC,CAAC;gBACxC,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;YAED,gDAAgD;YAChD,MAAM,WAAW,GAAG,uBAAuB,OAAO,EAAE,CAAC;YACrD,MAAM,UAAU,GAAG,OAAO,IAAI,gBAAgB,CAAC;YAC/C,kBAAkB,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;gBACvC,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,EAAE;gBACV,GAAG,EAAE,EAAE;gBACP,UAAU,EAAE,SAAS;gBACrB,OAAO,EAAE;oBACP,IAAI;oBACJ,KAAK,CAAC,CAAC,OAAO,EAAE,cAAc,OAAO,iBAAiB,EAAE,4BAA4B,OAAO,EAAE,CAAC,CAAC;wBAC7F,KAAK;wBACL,KAAK,CAAC,CAAC,OAAO,EAAE,cAAc,QAAQ,iBAAiB,EAAE,4BAA4B,QAAQ,EAAE,CAAC,CAAC;wBACjG,KAAK;wBACL,KAAK,CAAC,CAAC,OAAO,EAAE,cAAc,UAAU,iBAAiB,EAAE,4BAA4B,UAAU,EAAE,CAAC,CAAC;wBACrG,SAAS;iBACZ;aACF,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACvC,MAAM,MAAM,CAAC,cAAc,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;YACzF,UAAU,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;YAEnD,MAAM,GAAG;gBACP,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACxE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;aACvE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iBAAiB;YACjB,GAAG,GAAG;gBACJ,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;gBAC5C,WAAW,EAAE,wBAAwB;gBACrC,UAAU,EAAE,wBAAwB;aACrC,CAAC;YACF,OAAO,GAAG,MAAM,CAAC;YACjB,MAAM,GAAG;gBACP,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACxE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACnE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;aACvE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACzC,IAAI,OAAO;YAAE,GAAG,CAAC,wBAAwB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,IAAI;YAAE,GAAG,CAAC,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAEtD,sDAAsD;QACtD,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;YAChC,KAAK;YACL,IAAI,EAAE,mBAAmB,OAAO,EAAE;YAClC,OAAO;YACP,MAAM;YACN,GAAG;YACH,OAAO,EAAE,UAAU;YACnB,YAAY,EAAE,SAAS;YACvB,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE;YACtC,UAAU;YACV,GAAG,EAAE,IAAI;SACV,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,0BAA0B,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAEtE,yDAAyD;QACzD,gBAAgB,GAAG,iBAAiB,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEpF,0DAA0D;QAC1D,qBAAqB,GAAG,uBAAuB,CAAC,aAAa,EAAE;YAC7D,YAAY,EAAE,GAAG,EAAE;gBACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;YAChD,CAAC;YACD,mBAAmB,EAAE,GAAG,EAAE,GAAE,CAAC;SAC9B,CAAC,CAAC;QACH,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAE9B,gCAAgC;QAChC,MAAM,SAAS,GAAG,MAAM;YACtB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,IAAI,gBAAgB,EAAE;YAC1D,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAEvC,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QAEjC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE3B,wCAAwC;QACxC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;YAC/B,MAAM,EAAE,SAAS;YACjB,WAAW;YACX,MAAM,EAAE,kBAAkB,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,kEAAkE;QAClE,eAAe,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE3B,eAAe,GAAG,GAAG,CAAC;YACpB,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC,KAAK,EAAE,CAAC;QAEX,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,gCAAgC,QAAQ,IAAI,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;YAAS,CAAC;QACT,0DAA0D;QAC1D,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,eAAe,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAEtC,0BAA0B;QAC1B,qBAAqB,EAAE,IAAI,EAAE,CAAC;QAE9B,2BAA2B;QAC3B,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,MAAM,IAAI,WAAW,EAAE,CAAC;YAC1B,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC/C,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjC,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtD,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAChE,MAAM,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,eAAe;QACf,MAAM,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEpC,MAAM,CAAC,IAAI,CAAC,eAAe,SAAS,QAAQ,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,EAAE,CAAC;QAElB,yEAAyE;QACzE,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAOD,sEAAsE;AACtE,SAAS,eAAe,CAAC,MAAiB;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAUD;;;GAGG;AACH,SAAS,SAAS,CAAC,OAAwB;IACzC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAElC,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAQ,EAAE;YACpC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,cAAc,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,2BAA2B;YAC3B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YACD,KAAK,CAAC,MAAM,EAAE,CAAC;YAEf,sDAAsD;YACtD,sEAAsE;YACtE,yCAAyC;YACzC,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;YAC1C,IAAI,aAAa,GAAG,IAAI,CAAC;YACzB,MAAM,QAAQ,GAAG,GAAS,EAAE;gBAC1B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;gBACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;oBACpB,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,WAAW,CAAC,KAAK,EAAE,CAAC;oBACtB,CAAC;oBACD,aAAa,GAAG,KAAK,CAAC;oBACtB,QAAQ,CACN,QAAQ,EACR,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,gCAAgC,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAC9F,EAAE,OAAO,EAAE,IAAI,EAAE,EACjB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;wBACvB,IAAI,GAAG,EAAE,CAAC;4BACR,MAAM,CAAC,IAAI,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;4BACpD,IAAI,MAAM,EAAE,CAAC;gCACX,MAAM,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;4BACxD,CAAC;wBACH,CAAC;oBACH,CAAC,CACF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC9B,oBAAoB;YACpB,QAAQ,EAAE,CAAC;YAEX,oEAAoE;YACpE,mDAAmD;YACnD,+DAA+D;YAC/D,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,KAAK,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAClG,CAAC;YAED,oBAAoB;YACpB,mEAAmE;YACnE,iDAAiD;YACjD,MAAM,cAAc,GAAG,IAAI,CAAC;YAC5B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAQ,EAAE;gBACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;oBACpD,OAAO,EAAE,CAAC;oBACV,IAAI,CAAC,OAAO,EAAE,CAAC;oBACf,MAAM,CAAC,CAAC,CAAC,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAEzB,2DAA2D;YAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAElB,iEAAiE;YACjE,0DAA0D;YAC1D,SAAS,OAAO;gBACd,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC1C,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACpB,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,WAAW,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YACD,SAAS,OAAO;gBACd,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAEnE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gCAAgC;AAEhC,yDAAyD;AACzD,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC,4DAA4D;AAC5D,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAE1C,4DAA4D;AAC5D,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAE7C;;GAEG;AACH,SAAS,YAAY,CAAC,WAAmB;IACvC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CACN,QAAQ,EACR,CAAC,MAAM,EAAE,WAAW,EAAE,oCAAoC,CAAC,EAC3D,EAAE,OAAO,EAAE,IAAI,EAAE,EACjB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACd,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;oBACzD,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,WAAmB,EACnB,YAAoB,EACpB,YAAoB,EACpB,MAAoB;IAEpB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAE1E,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,EAAE,EAAE,CAAC;QACnE,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO;QAE5B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACrE,OAAO,CAAC,mBAAmB;QAC7B,CAAC;QAED,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO;QAE5B,2CAA2C;QAC3C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,QAAQ,CACN,QAAQ,EACR,CAAC,MAAM,EAAE,WAAW,EAAE,gCAAgC,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,EACnG,EAAE,OAAO,EAAE,IAAI,EAAE,EACjB,GAAG,EAAE,CAAC,OAAO,EAAE,CAChB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,yBAAyB;QACzB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO;IAE5B,cAAc;IACd,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACrF,MAAM,CAAC,IAAI,CACT,sCAAsC,uBAAuB,WAAW;YACtE,aAAa,YAAY,IAAI,YAAY,SAAS,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CACrH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4BAA4B;AAE5B;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,MAAiB;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB,CAAC;IAEvD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,SAAS;YAAE,OAAO;QAEtB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,0CAA0C,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC;AAChG,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,MAAiB;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAErC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACtB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uBAAuB;AAEvB;;;GAGG;AACH,SAAS,iBAAiB,CAAC,SAAiB,EAAE,aAAqB,EAAE,kBAA0B;IAC7F,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEzD,MAAM,YAAY,GAA2B;QAC3C,SAAS;QACT,aAAa;QACb,KAAK,EAAE,GAAG,kBAAkB,gBAAgB;QAC5C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,WAAW,SAAS,OAAO,CAAC,CAAC;IAC3E,mBAAmB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpD,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

package/dist/docker/pty-types.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Types for PTY session management and the escalation listener.
+ */
+/** Registration file written by PTY sessions for the escalation listener. */
+export interface PtySessionRegistration {
+    /** Unique session identifier (SessionId). */
+    readonly sessionId: string;
+    /** Absolute path to the session's escalation directory. */
+    readonly escalationDir: string;
+    /** Human-readable label for TUI display. */
+    readonly label: string;
+    /** ISO 8601 timestamp when the session started. */
+    readonly startedAt: string;
+    /** PID of the ironcurtain process managing this session. */
+    readonly pid: number;
+}
+/** Well-known directory for PTY session registration files. */
+export declare const PTY_REGISTRY_DIR_NAME = "pty-registry";
+/** Lock file name for single-instance enforcement. */
+export declare const LISTENER_LOCK_FILE = "escalation-listener.lock";
+/** PTY socket filename (Linux UDS mode). */
+export declare const PTY_SOCK_NAME = "pty.sock";
+/** Default PTY port inside the container (macOS TCP mode only). */
+export declare const DEFAULT_PTY_PORT = 19000;

package/dist/docker/pty-types.js

@@ -0,0 +1,12 @@
+/**
+ * Types for PTY session management and the escalation listener.
+ */
+/** Well-known directory for PTY session registration files. */
+export const PTY_REGISTRY_DIR_NAME = 'pty-registry';
+/** Lock file name for single-instance enforcement. */
+export const LISTENER_LOCK_FILE = 'escalation-listener.lock';
+/** PTY socket filename (Linux UDS mode). */
+export const PTY_SOCK_NAME = 'pty.sock';
+/** Default PTY port inside the container (macOS TCP mode only). */
+export const DEFAULT_PTY_PORT = 19000;
+//# sourceMappingURL=pty-types.js.map

package/dist/docker/pty-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pty-types.js","sourceRoot":"","sources":["../../src/docker/pty-types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAgBH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAEpD,sDAAsD;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAE7D,4CAA4C;AAC5C,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC"}

package/dist/docker/types.d.ts

@@ -57,6 +57,12 @@ export interface DockerContainerConfig {
      * must NEVER set this field.
      */
     readonly capAdd?: readonly string[];
+    /**
+     * Allocate a pseudo-TTY for the container (-t flag).
+     * Required for PTY mode where the container runs an interactive process.
+     * Optional. Defaults to false (no TTY allocated).
+     */
+    readonly tty?: boolean;
 }
 /** A volume mount for a Docker container. */
 export interface DockerMount {

package/dist/escalation/escalation-watcher.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared escalation watcher for polling escalation directories.
+ *
+ * Pure data module -- no I/O presentation. Consumers (DockerAgentSession,
+ * EscalationListener) handle display. Polls a session's escalation
+ * directory for new request files and handles resolution via response files.
+ */
+import type { EscalationRequest } from '../session/types.js';
+/** Events emitted by the escalation watcher. */
+export interface EscalationWatcherEvents {
+    /** A new escalation request was detected. */
+    onEscalation: (request: EscalationRequest) => void;
+    /** A pending escalation expired (proxy timed out and cleaned up files). */
+    onEscalationExpired: (escalationId: string) => void;
+}
+export interface EscalationWatcher {
+    /** Start polling the escalation directory. */
+    start(): void;
+    /** Stop polling. */
+    stop(): void;
+    /** Returns the currently pending escalation, if any. */
+    getPending(): EscalationRequest | undefined;
+    /**
+     * Resolves a pending escalation by writing the response file.
+     * Returns true if the resolution was accepted (request file still exists),
+     * or false if the escalation had already expired.
+     *
+     * @throws {Error} if no escalation with this ID is pending
+     */
+    resolve(escalationId: string, decision: 'approved' | 'denied'): boolean;
+}
+export interface EscalationWatcherOptions {
+    /** Poll interval in ms. Default: 300. */
+    pollIntervalMs?: number;
+}
+/**
+ * Atomically writes a JSON file using write-to-temp-then-rename.
+ * Prevents partial reads by other processes polling the same directory.
+ */
+export declare function atomicWriteJsonSync(filePath: string, data: unknown): void;
+/**
+ * Creates an escalation watcher for a single session's escalation directory.
+ */
+export declare function createEscalationWatcher(escalationDir: string, events: EscalationWatcherEvents, options?: EscalationWatcherOptions): EscalationWatcher;