@provos/ironcurtain 0.5.0 → 0.6.0

package/dist/docker/oauth-credentials.js

@@ -11,13 +11,19 @@
  * 2. macOS Keychain (if credentials file missing)
  * 3. Fall back to API key from config
  */
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
 import { homedir, platform, userInfo } from 'node:os';
 import { resolve } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import * as logger from '../logger.js';
 /** Minimum remaining token lifetime (5 minutes) to consider a token usable. */
 const TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1000;
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+function isPositiveFiniteNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0;
+}
 /** Service names used by Claude Code in macOS Keychain. */
 const KEYCHAIN_SERVICE_NAMES = ['Claude Code-credentials', 'Claude Code'];
 /**
@@ -71,11 +77,11 @@ export function parseCredentialsJson(json) {
         if (typeof oauth !== 'object' || oauth === null)
             return null;
         const creds = oauth;
-        if (typeof creds.accessToken !== 'string' || !creds.accessToken)
+        if (!isNonEmptyString(creds.accessToken))
             return null;
-        if (typeof creds.refreshToken !== 'string' || !creds.refreshToken)
+        if (!isNonEmptyString(creds.refreshToken))
             return null;
-        if (typeof creds.expiresAt !== 'number' || !Number.isFinite(creds.expiresAt) || creds.expiresAt <= 0)
+        if (!isPositiveFiniteNumber(creds.expiresAt))
             return null;
         return {
             accessToken: creds.accessToken,
@@ -119,6 +125,86 @@ export function extractFromKeychain() {
     }
     return null;
 }
+/** Claude Code's public OAuth client ID. */
+const OAUTH_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+/** Anthropic's OAuth token endpoint. */
+const OAUTH_TOKEN_URL = 'https://console.anthropic.com/api/oauth/token';
+/**
+ * Refreshes an OAuth access token using a refresh token grant.
+ *
+ * Returns new credentials on success, or null on failure (expired refresh
+ * token, network error, etc.).
+ */
+export async function refreshOAuthToken(refreshToken) {
+    try {
+        const response = await fetch(OAUTH_TOKEN_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+                client_id: OAUTH_CLIENT_ID,
+            }),
+        });
+        if (!response.ok) {
+            logger.warn(`OAuth token refresh failed: HTTP ${response.status}`);
+            return null;
+        }
+        const data = (await response.json());
+        return parseTokenResponse(data);
+    }
+    catch (err) {
+        logger.warn(`OAuth token refresh error: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+/**
+ * Validates and extracts credentials from an OAuth token endpoint response.
+ * Returns null if any required field is missing or invalid.
+ */
+function parseTokenResponse(data) {
+    const { access_token: accessToken, refresh_token: refreshToken, expires_in: expiresIn } = data;
+    if (!isNonEmptyString(accessToken))
+        return null;
+    if (!isNonEmptyString(refreshToken))
+        return null;
+    if (!isPositiveFiniteNumber(expiresIn))
+        return null;
+    return {
+        accessToken,
+        refreshToken,
+        expiresAt: Date.now() + expiresIn * 1000,
+    };
+}
+/**
+ * Writes updated OAuth credentials back to ~/.claude/.credentials.json,
+ * preserving other fields in the file (e.g., scopes, subscriptionType).
+ */
+export function saveOAuthCredentials(credentials, filePath) {
+    const credPath = filePath ?? getCredentialsFilePath();
+    let existing = {};
+    try {
+        if (existsSync(credPath)) {
+            existing = JSON.parse(readFileSync(credPath, 'utf-8'));
+        }
+    }
+    catch {
+        // Start fresh if file is unreadable
+    }
+    const existingOauth = typeof existing.claudeAiOauth === 'object' && existing.claudeAiOauth !== null
+        ? existing.claudeAiOauth
+        : {};
+    existing.claudeAiOauth = {
+        ...existingOauth,
+        accessToken: credentials.accessToken,
+        refreshToken: credentials.refreshToken,
+        expiresAt: credentials.expiresAt,
+    };
+    writeFileSync(credPath, JSON.stringify(existing, null, 2) + '\n', { mode: 0o600 });
+    // chmod after write — writeFileSync's mode only applies when creating new files;
+    // existing files with broader permissions need an explicit chmod.
+    chmodSync(credPath, 0o600);
+}
 const defaultSources = {
     loadFromFile: loadOAuthCredentials,
     loadFromKeychain: extractFromKeychain,
@@ -132,8 +218,6 @@ const defaultSources = {
  * 3. OAuth credentials from macOS Keychain (if credentials file missing)
  * 4. API key from config
  * 5. None
- *
- * @param sources - Injectable credential loaders (for testing)
  */
 export function detectAuthMethod(config, sources) {
     const { loadFromFile, loadFromKeychain } = sources ?? defaultSources;
@@ -147,7 +231,7 @@ export function detectAuthMethod(config, sources) {
     if (fileCreds) {
         if (!isTokenExpired(fileCreds)) {
             logger.info('Detected OAuth credentials from ~/.claude/.credentials.json');
-            return { kind: 'oauth', credentials: fileCreds };
+            return { kind: 'oauth', credentials: fileCreds, source: 'file' };
         }
         logger.warn('OAuth token from credentials file is expired');
     }
@@ -156,7 +240,7 @@ export function detectAuthMethod(config, sources) {
         const keychainCreds = loadFromKeychain();
         if (keychainCreds) {
             if (!isTokenExpired(keychainCreds)) {
-                return { kind: 'oauth', credentials: keychainCreds };
+                return { kind: 'oauth', credentials: keychainCreds, source: 'keychain' };
             }
             logger.warn('OAuth token from macOS Keychain is expired');
         }

package/dist/docker/oauth-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-credentials.js","sourceRoot":"","sources":["../../src/docker/oauth-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAevC,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,2DAA2D;AAC3D,MAAM,sBAAsB,GAAG,CAAC,yBAAyB,EAAE,aAAa,CAAU,CAAC;AAEnF;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,WAA6B;IAC1D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,IAAI,WAAW,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE/D,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE7D,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC/E,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAElH,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;gBACrG,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,wDAAwD,OAAO,IAAI,CAAC,CAAC;gBACjF,OAAO,WAAW,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;YACxD,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,MAAM,cAAc,GAAsB;IACxC,YAAY,EAAE,oBAAoB;IAClC,gBAAgB,EAAE,mBAAmB;CACtC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,EAAE,OAA2B;IACrF,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,OAAO,IAAI,cAAc,CAAC;IAErE,gDAAgD;IAChD,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,kCAAkC;IAClC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC9D,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QACzC,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;YACvD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAyB;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;IAC9C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"oauth-credentials.js","sourceRoot":"","sources":["../../src/docker/oauth-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAkBvC,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,sBAAsB,GAAG,CAAC,yBAAyB,EAAE,aAAa,CAAU,CAAC;AAEnF;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,WAA6B;IAC1D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,IAAI,WAAW,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE/D,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE7D,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1D,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;gBACrG,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,wDAAwD,OAAO,IAAI,CAAC,CAAC;gBACjF,OAAO,WAAW,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;YACxD,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4CAA4C;AAC5C,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAE/D,wCAAwC;AACxC,MAAM,eAAe,GAAG,+CAA+C,CAAC;AAExE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB;IAC1D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,eAAe;aAC3B,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAE/F,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,OAAO;QACL,WAAW;QACX,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;KACzC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA6B,EAAE,QAAiB;IACnF,MAAM,QAAQ,GAAG,QAAQ,IAAI,sBAAsB,EAAE,CAAC;IAEtD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;QACpF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IAED,MAAM,aAAa,GACjB,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI;QAC3E,CAAC,CAAE,QAAQ,CAAC,aAAyC;QACrD,CAAC,CAAC,EAAE,CAAC;IAET,QAAQ,CAAC,aAAa,GAAG;QACvB,GAAG,aAAa;QAChB,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,SAAS,EAAE,WAAW,CAAC,SAAS;KACjC,CAAC;IAEF,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,iFAAiF;IACjF,kEAAkE;IAClE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAQD,MAAM,cAAc,GAAsB;IACxC,YAAY,EAAE,oBAAoB;IAClC,gBAAgB,EAAE,mBAAmB;CACtC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,EAAE,OAA2B;IACrF,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,OAAO,IAAI,cAAc,CAAC;IAErE,gDAAgD;IAChD,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,kCAAkC;IAClC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC9D,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QACzC,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAC3E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAyB;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;IAC9C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC"}

package/dist/docker/oauth-token-manager.d.ts

@@ -0,0 +1,80 @@
+/**
+ * OAuth token lifecycle manager for Docker agent sessions.
+ *
+ * Handles proactive refresh (before token expiry) and reactive refresh
+ * (on upstream 401). Coordinates with the host Claude Code process that
+ * may also refresh tokens concurrently — re-reads the credentials file
+ * before attempting a refresh to avoid using a stale refresh token.
+ *
+ * On macOS where credentials come from the Keychain, the manager operates
+ * in read-only mode: it re-reads credentials from file and Keychain but
+ * never performs its own refresh grant. This prevents invalidating the
+ * host Claude Code's refresh token, which lives in the Keychain.
+ *
+ * A single in-flight refresh promise is shared across concurrent callers
+ * to prevent duplicate refresh requests.
+ */
+import type { OAuthCredentials } from './oauth-credentials.js';
+/** Injectable dependencies for testability. */
+export interface TokenManagerDeps {
+    loadCredentials: (filePath: string) => OAuthCredentials | null;
+    loadFromKeychain: () => OAuthCredentials | null;
+    refreshToken: (refreshToken: string) => Promise<OAuthCredentials | null>;
+    saveCredentials: (credentials: OAuthCredentials, filePath?: string) => void;
+    credentialsFilePath: string;
+    /** @deprecated No longer used internally. Kept for backward compatibility with tests. */
+    now?: () => number;
+}
+export interface OAuthTokenManagerOptions {
+    /**
+     * Whether the manager may perform its own refresh_token grant.
+     *
+     * When false (Keychain-sourced credentials on macOS), the manager only
+     * re-reads credentials from the file and Keychain — it never POSTs to
+     * the token endpoint itself, because doing so would rotate the refresh
+     * token and break host Claude Code's copy in the Keychain.
+     *
+     * Defaults to true (file-sourced credentials on Linux/WSL).
+     */
+    canRefresh?: boolean;
+}
+export declare class OAuthTokenManager {
+    private credentials;
+    private inflightRefresh;
+    private readonly deps;
+    private readonly canRefresh;
+    constructor(initialCredentials: OAuthCredentials, options?: OAuthTokenManagerOptions, deps?: Partial<TokenManagerDeps>);
+    /**
+     * Returns the current access token. This is always the latest known-good
+     * token, whether from the initial credentials, a file re-read, or a refresh.
+     */
+    get accessToken(): string;
+    /**
+     * Returns a valid access token, refreshing proactively if near expiry.
+     *
+     * Called before every upstream request to ensure the token is fresh.
+     * If the token has more than 5 minutes of validity, returns immediately.
+     */
+    getValidAccessToken(): Promise<string>;
+    /**
+     * Called on upstream 401 — forces a refresh attempt.
+     *
+     * Returns the new access token on success, or null if refresh is
+     * unrecoverable (both our refresh and file re-read failed).
+     */
+    handleAuthFailure(): Promise<string | null>;
+    /**
+     * Core refresh logic with deduplication. Concurrent callers share a single
+     * in-flight refresh promise.
+     *
+     * File-sourced credentials (canRefresh=true):
+     *   Re-read file -> if still expired, POST refresh grant -> on failure,
+     *   re-read file once more (host process may have won the race).
+     *
+     * Keychain-sourced credentials (canRefresh=false):
+     *   Re-read file and Keychain only -- never POST a refresh grant, because
+     *   doing so would rotate the refresh token and break host Claude Code.
+     */
+    private doRefresh;
+    private executeRefresh;
+}

package/dist/docker/oauth-token-manager.js

@@ -0,0 +1,133 @@
+/**
+ * OAuth token lifecycle manager for Docker agent sessions.
+ *
+ * Handles proactive refresh (before token expiry) and reactive refresh
+ * (on upstream 401). Coordinates with the host Claude Code process that
+ * may also refresh tokens concurrently — re-reads the credentials file
+ * before attempting a refresh to avoid using a stale refresh token.
+ *
+ * On macOS where credentials come from the Keychain, the manager operates
+ * in read-only mode: it re-reads credentials from file and Keychain but
+ * never performs its own refresh grant. This prevents invalidating the
+ * host Claude Code's refresh token, which lives in the Keychain.
+ *
+ * A single in-flight refresh promise is shared across concurrent callers
+ * to prevent duplicate refresh requests.
+ */
+import { isTokenExpired, loadCredentialsFromFile, refreshOAuthToken, saveOAuthCredentials, getCredentialsFilePath, extractFromKeychain, } from './oauth-credentials.js';
+import * as logger from '../logger.js';
+const defaultDeps = {
+    loadCredentials: loadCredentialsFromFile,
+    loadFromKeychain: extractFromKeychain,
+    refreshToken: refreshOAuthToken,
+    saveCredentials: saveOAuthCredentials,
+    credentialsFilePath: getCredentialsFilePath(),
+};
+export class OAuthTokenManager {
+    credentials;
+    inflightRefresh = null;
+    deps;
+    canRefresh;
+    constructor(initialCredentials, options, deps) {
+        this.credentials = initialCredentials;
+        this.canRefresh = options?.canRefresh ?? true;
+        this.deps = { ...defaultDeps, ...deps };
+    }
+    /**
+     * Returns the current access token. This is always the latest known-good
+     * token, whether from the initial credentials, a file re-read, or a refresh.
+     */
+    get accessToken() {
+        return this.credentials.accessToken;
+    }
+    /**
+     * Returns a valid access token, refreshing proactively if near expiry.
+     *
+     * Called before every upstream request to ensure the token is fresh.
+     * If the token has more than 5 minutes of validity, returns immediately.
+     */
+    async getValidAccessToken() {
+        if (!isTokenExpired(this.credentials)) {
+            return this.credentials.accessToken;
+        }
+        logger.info('[oauth-token-manager] Token near expiry, attempting proactive refresh');
+        const newToken = await this.doRefresh();
+        return newToken ?? this.credentials.accessToken;
+    }
+    /**
+     * Called on upstream 401 — forces a refresh attempt.
+     *
+     * Returns the new access token on success, or null if refresh is
+     * unrecoverable (both our refresh and file re-read failed).
+     */
+    async handleAuthFailure() {
+        logger.info('[oauth-token-manager] Handling auth failure (401), attempting refresh');
+        return this.doRefresh();
+    }
+    /**
+     * Core refresh logic with deduplication. Concurrent callers share a single
+     * in-flight refresh promise.
+     *
+     * File-sourced credentials (canRefresh=true):
+     *   Re-read file -> if still expired, POST refresh grant -> on failure,
+     *   re-read file once more (host process may have won the race).
+     *
+     * Keychain-sourced credentials (canRefresh=false):
+     *   Re-read file and Keychain only -- never POST a refresh grant, because
+     *   doing so would rotate the refresh token and break host Claude Code.
+     */
+    doRefresh() {
+        if (this.inflightRefresh) {
+            return this.inflightRefresh;
+        }
+        this.inflightRefresh = this.executeRefresh().finally(() => {
+            this.inflightRefresh = null;
+        });
+        return this.inflightRefresh;
+    }
+    async executeRefresh() {
+        // Re-read credentials file -- another process may have refreshed already
+        const fileCreds = this.deps.loadCredentials(this.deps.credentialsFilePath);
+        if (fileCreds && !isTokenExpired(fileCreds)) {
+            logger.info('[oauth-token-manager] Found valid token in credentials file (refreshed by another process)');
+            this.credentials = fileCreds;
+            return this.credentials.accessToken;
+        }
+        // In read-only mode, also try the Keychain but never POST a refresh grant
+        if (!this.canRefresh) {
+            const keychainCreds = this.deps.loadFromKeychain();
+            if (keychainCreds && !isTokenExpired(keychainCreds)) {
+                logger.info('[oauth-token-manager] Found valid token in Keychain (refreshed by host process)');
+                this.credentials = keychainCreds;
+                return this.credentials.accessToken;
+            }
+            logger.warn('[oauth-token-manager] Token expired and cannot self-refresh (Keychain mode) — waiting for host Claude Code to refresh');
+            return null;
+        }
+        // Attempt refresh ourselves, preferring the file's refresh token if available
+        const refreshToken = fileCreds?.refreshToken ?? this.credentials.refreshToken;
+        const newCreds = await this.deps.refreshToken(refreshToken);
+        if (newCreds) {
+            logger.info('[oauth-token-manager] Token refresh successful');
+            try {
+                this.deps.saveCredentials(newCreds, this.deps.credentialsFilePath);
+            }
+            catch (err) {
+                logger.warn(`[oauth-token-manager] Failed to save refreshed credentials: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            this.credentials = newCreds;
+            return this.credentials.accessToken;
+        }
+        // Refresh failed -- re-read file one more time (host may have won the race)
+        logger.info('[oauth-token-manager] Refresh failed, re-reading credentials file as fallback');
+        const fallbackCreds = this.deps.loadCredentials(this.deps.credentialsFilePath);
+        if (fallbackCreds && !isTokenExpired(fallbackCreds)) {
+            logger.info('[oauth-token-manager] Found valid token in credentials file on fallback re-read');
+            this.credentials = fallbackCreds;
+            return this.credentials.accessToken;
+        }
+        logger.warn('[oauth-token-manager] Token refresh failed and no valid credentials available');
+        return null;
+    }
+}
+//# sourceMappingURL=oauth-token-manager.js.map

package/dist/docker/oauth-token-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-manager.js","sourceRoot":"","sources":["../../src/docker/oauth-token-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAavC,MAAM,WAAW,GAAqB;IACpC,eAAe,EAAE,uBAAuB;IACxC,gBAAgB,EAAE,mBAAmB;IACrC,YAAY,EAAE,iBAAiB;IAC/B,eAAe,EAAE,oBAAoB;IACrC,mBAAmB,EAAE,sBAAsB,EAAE;CAC9C,CAAC;AAgBF,MAAM,OAAO,iBAAiB;IACpB,WAAW,CAAmB;IAC9B,eAAe,GAAkC,IAAI,CAAC;IAC7C,IAAI,CAAmB;IACvB,UAAU,CAAU;IAErC,YACE,kBAAoC,EACpC,OAAkC,EAClC,IAAgC;QAEhC,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;OAWG;IACK,SAAS;QACf,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,eAAe,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACxD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,SAAS,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;YAC1G,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;YAC7B,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACnD,IAAI,aAAa,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;gBAC/F,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC;gBACjC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;YACtC,CAAC;YACD,MAAM,CAAC,IAAI,CACT,uHAAuH,CACxH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8EAA8E;QAC9E,MAAM,YAAY,GAAG,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;QAC9E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAE5D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CACT,+DAA+D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClH,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,4EAA4E;QAC5E,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC7F,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,IAAI,aAAa,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;YAC/F,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/docker/orientation.d.ts

@@ -5,7 +5,7 @@
  * agent container. Written to the orientation directory which is
  * bind-mounted read-only into the container.
  */
-import type { AgentAdapter } from './agent-adapter.js';
+import { type AgentAdapter } from './agent-adapter.js';
 import type { IronCurtainConfig } from '../config/types.js';
 import type { ServerListing } from '../session/prompts.js';
 /**

package/dist/docker/orientation.js

@@ -7,6 +7,7 @@
  */
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
+import { CONTAINER_WORKSPACE_DIR, } from './agent-adapter.js';
 /**
  * Extracts allowed domains from MCP server configurations.
  * Used to inform the agent about which domains it can access via MCP tools.
@@ -47,7 +48,7 @@ export function prepareSession(adapter, serverListings, sessionDir, config, host
     const orientationDir = resolve(sessionDir, 'orientation');
     mkdirSync(orientationDir, { recursive: true });
     const context = {
-        workspaceDir: '/workspace',
+        workspaceDir: CONTAINER_WORKSPACE_DIR,
         hostSandboxDir,
         serverListings,
         allowedDomains: extractAllowedDomains(config),

package/dist/docker/orientation.js.map

@@ -1 +1 @@
-{"version":3,"file":"orientation.js","sourceRoot":"","sources":["../../src/docker/orientation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAK7C;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAyB;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QACrC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe,EAAE,KAAwB;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAqB,EACrB,cAA+B,EAC/B,UAAkB,EAClB,MAAyB,EACzB,cAAsB,EACtB,YAAqB;IAErB,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC1D,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAuB;QAClC,YAAY,EAAE,YAAY;QAC1B,cAAc;QACd,cAAc;QACd,cAAc,EAAE,qBAAqB,CAAC,MAAM,CAAC;QAC7C,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;KAC9C,CAAC;IAEF,qFAAqF;IACrF,MAAM,OAAO,GAAG,YAAY,IAAI,6BAA6B,CAAC;IAC9D,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,MAAM,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"orientation.js","sourceRoot":"","sources":["../../src/docker/orientation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,uBAAuB,GAIxB,MAAM,oBAAoB,CAAC;AAI5B;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAyB;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QACrC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe,EAAE,KAAwB;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAqB,EACrB,cAA+B,EAC/B,UAAkB,EAClB,MAAyB,EACzB,cAAsB,EACtB,YAAqB;IAErB,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC1D,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAuB;QAClC,YAAY,EAAE,uBAAuB;QACrC,cAAc;QACd,cAAc;QACd,cAAc,EAAE,qBAAqB,CAAC,MAAM,CAAC;QAC7C,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;KAC9C,CAAC;IAEF,qFAAqF;IACrF,MAAM,OAAO,GAAG,YAAY,IAAI,6BAA6B,CAAC;IAC9D,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,MAAM,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC"}

package/dist/docker/pty-session.d.ts

@@ -19,6 +19,8 @@ export interface PtySessionOptions {
     readonly mode: SessionMode & {
         kind: 'docker';
     };
+    /** Validated workspace path. When provided, replaces the session sandbox. */
+    readonly workspacePath?: string;
 }
 /**
  * Runs a PTY session: starts proxies, launches container with PTY-enabled

package/dist/docker/pty-session.js

@@ -19,9 +19,10 @@ import { resolve } from 'node:path';
 import chalk from 'chalk';
 import ora from 'ora';
 import { createSessionId } from '../session/types.js';
+import { CONTAINER_WORKSPACE_DIR } from './agent-adapter.js';
 import { PTY_SOCK_NAME, DEFAULT_PTY_PORT } from './pty-types.js';
 import { createEscalationWatcher, atomicWriteJsonSync } from '../escalation/escalation-watcher.js';
-import { getSessionDir, getSessionSandboxDir, getSessionEscalationDir, getSessionAuditLogPath, getSessionLogPath, getSessionLlmLogPath, getPtyRegistryDir, } from '../config/paths.js';
+import { getSessionDir, getSessionSandboxDir, getSessionEscalationDir, getSessionAuditLogPath, getSessionLogPath, getSessionLlmLogPath, getSessionAutoApproveLlmLogPath, getPtyRegistryDir, } from '../config/paths.js';
 import * as logger from '../logger.js';
 /** Maximum time to wait for the PTY socket to appear (ms). */
 const PTY_READINESS_TIMEOUT_MS = 30_000;
@@ -35,11 +36,14 @@ export async function runPtySession(options) {
     const { prepareDockerInfrastructure } = await import('./docker-infrastructure.js');
     const sessionId = createSessionId();
     const sessionDir = getSessionDir(sessionId);
-    const sandboxDir = getSessionSandboxDir(sessionId);
+    const sandboxDir = options.workspacePath ?? getSessionSandboxDir(sessionId);
     const escalationDir = getSessionEscalationDir(sessionId);
     const auditLogPath = getSessionAuditLogPath(sessionId);
     const socketsDir = resolve(sessionDir, 'sockets');
-    mkdirSync(sandboxDir, { recursive: true, mode: 0o700 });
+    // Only create the sandbox directory when not using an external workspace
+    if (!options.workspacePath) {
+        mkdirSync(sandboxDir, { recursive: true, mode: 0o700 });
+    }
     mkdirSync(escalationDir, { recursive: true, mode: 0o700 });
     mkdirSync(socketsDir, { recursive: true, mode: 0o700 });
     // Set up session logging
@@ -47,10 +51,11 @@ export async function runPtySession(options) {
     const llmLogPath = getSessionLlmLogPath(sessionId);
     logger.setup({ logFilePath: sessionLogPath });
     logger.info(`PTY session ${sessionId} starting`);
-    logger.info(`Sandbox: ${sandboxDir}`);
+    logger.info(`${options.workspacePath ? 'Workspace' : 'Sandbox'}: ${sandboxDir}`);
     logger.info(`Escalation dir: ${escalationDir}`);
     logger.info(`LLM log: ${llmLogPath}`);
     // Patch config for this session
+    const autoApproveLlmLogPath = getSessionAutoApproveLlmLogPath(sessionId);
     const sessionConfig = {
         ...options.config,
         allowedDirectory: sandboxDir,
@@ -58,6 +63,8 @@ export async function runPtySession(options) {
         escalationDir,
         sessionLogPath,
         llmLogPath,
+        autoApproveLlmLogPath,
+        isPtySession: true,
         mcpServers: JSON.parse(JSON.stringify(options.config.mcpServers)),
     };
     const initSpinner = ora({
@@ -164,7 +171,7 @@ export async function runPtySession(options) {
             const sidecarIp = await docker.getContainerIp(sidecarContainerId, INTERNAL_NETWORK_NAME);
             extraHosts = [`host.docker.internal:${sidecarIp}`];
             mounts = [
-                { source: sandboxDir, target: '/workspace', readonly: false },
+                { source: sandboxDir, target: CONTAINER_WORKSPACE_DIR, readonly: false },
                 { source: orientationDir, target: '/etc/ironcurtain', readonly: true },
             ];
         }
@@ -177,11 +184,18 @@ export async function runPtySession(options) {
             };
             network = 'none';
             mounts = [
-                { source: sandboxDir, target: '/workspace', readonly: false },
+                { source: sandboxDir, target: CONTAINER_WORKSPACE_DIR, readonly: false },
                 { source: socketsDir, target: '/run/ironcurtain', readonly: false },
                 { source: orientationDir, target: '/etc/ironcurtain', readonly: true },
             ];
         }
+        // Pass initial terminal size so start-claude.sh can set PTY dimensions
+        // before Claude starts, eliminating the resize race condition.
+        const { columns, rows } = process.stdout;
+        if (columns)
+            env.IRONCURTAIN_INITIAL_COLS = String(columns);
+        if (rows)
+            env.IRONCURTAIN_INITIAL_ROWS = String(rows);
         // Create and start container with PTY command and TTY
         containerId = await docker.create({
             image,
@@ -302,18 +316,37 @@ function attachPty(options) {
                 stdin.setRawMode(true);
             }
             stdin.resume();
-            // SIGWINCH: forward terminal resize to container PTY
+            // SIGWINCH: forward terminal resize to container PTY.
+            // verifyAbort cancels the background verify loop on first user resize
+            // so it doesn't fight with the new size.
+            const verifyAbort = new AbortController();
+            let isFirstResize = true;
             const onResize = () => {
                 const { columns, rows } = stdout;
                 if (columns && rows) {
-                    execFile('docker', ['exec', options.containerId, '/etc/ironcurtain/resize-pty.sh', String(columns), String(rows)], { timeout: 5000 }, () => {
-                        /* best effort */
+                    if (!isFirstResize) {
+                        verifyAbort.abort();
+                    }
+                    isFirstResize = false;
+                    execFile('docker', ['exec', options.containerId, '/etc/ironcurtain/resize-pty.sh', String(columns), String(rows)], { timeout: 5000 }, (err, _stdout, stderr) => {
+                        if (err) {
+                            logger.warn(`resize-pty.sh failed: ${err.message}`);
+                            if (stderr) {
+                                logger.warn(`resize-pty.sh stderr: ${stderr.trim()}`);
+                            }
+                        }
                     });
                 }
             };
             stdout.on('resize', onResize);
             // Send initial size
             onResize();
+            // Background verify+retry to ensure the initial resize took effect.
+            // Fire-and-forget -- does not block the PTY proxy.
+            // Canceled via verifyAbort when the user resizes the terminal.
+            if (stdout.columns && stdout.rows) {
+                void verifyInitialPtySize(options.containerId, stdout.columns, stdout.rows, verifyAbort.signal);
+            }
             // Host -> Container
             // Ctrl-\ (0x1c) is intercepted as an emergency exit since raw mode
             // disables normal signal generation for SIGQUIT.
@@ -337,6 +370,7 @@ function attachPty(options) {
                 stdin.removeListener('data', onData);
                 conn.unpipe(stdout);
                 stdin.pause();
+                verifyAbort.abort();
                 options.signal?.removeEventListener('abort', onAbort);
             }
             function onAbort() {
@@ -363,6 +397,68 @@ function attachPty(options) {
         });
     });
 }
+// --- PTY size verification ---
+/** Maximum retries for initial PTY size verification. */
+const PTY_SIZE_VERIFY_RETRIES = 5;
+/** Interval between PTY size verification attempts (ms). */
+const PTY_SIZE_VERIFY_INTERVAL_MS = 1_000;
+/** Initial delay before first verification attempt (ms). */
+const PTY_SIZE_VERIFY_INITIAL_DELAY_MS = 500;
+/**
+ * Runs check-pty-size.sh and returns { rows, cols } or null on failure.
+ */
+function checkPtySize(containerId) {
+    return new Promise((resolve) => {
+        execFile('docker', ['exec', containerId, '/etc/ironcurtain/check-pty-size.sh'], { timeout: 5000 }, (err, stdout) => {
+            if (err) {
+                resolve(null);
+                return;
+            }
+            const parts = stdout.trim().split(/\s+/);
+            if (parts.length >= 2) {
+                const rows = parseInt(parts[0], 10);
+                const cols = parseInt(parts[1], 10);
+                if (!isNaN(rows) && !isNaN(cols) && rows > 0 && cols > 0) {
+                    resolve({ rows, cols });
+                    return;
+                }
+            }
+            resolve(null);
+        });
+    });
+}
+/**
+ * Background verify+retry loop for initial PTY resize.
+ * Non-blocking (fire-and-forget). Aborted when a user resize occurs so it
+ * does not fight with legitimate SIGWINCH-driven resizes.
+ */
+async function verifyInitialPtySize(containerId, expectedCols, expectedRows, signal) {
+    await new Promise((r) => setTimeout(r, PTY_SIZE_VERIFY_INITIAL_DELAY_MS));
+    for (let attempt = 0; attempt < PTY_SIZE_VERIFY_RETRIES; attempt++) {
+        if (signal?.aborted)
+            return;
+        const size = await checkPtySize(containerId);
+        if (size && size.cols === expectedCols && size.rows === expectedRows) {
+            return; // PTY size matches
+        }
+        if (signal?.aborted)
+            return;
+        // Mismatch or check failed -- try resizing
+        await new Promise((resolve) => {
+            execFile('docker', ['exec', containerId, '/etc/ironcurtain/resize-pty.sh', String(expectedCols), String(expectedRows)], { timeout: 5000 }, () => resolve());
+        });
+        // Wait before rechecking
+        await new Promise((r) => setTimeout(r, PTY_SIZE_VERIFY_INTERVAL_MS));
+    }
+    if (signal?.aborted)
+        return;
+    // Final check
+    const finalSize = await checkPtySize(containerId);
+    if (!finalSize || finalSize.cols !== expectedCols || finalSize.rows !== expectedRows) {
+        logger.warn(`PTY size verification failed after ${PTY_SIZE_VERIFY_RETRIES} retries ` +
+            `(expected ${expectedCols}x${expectedRows}, got ${finalSize ? `${finalSize.cols}x${finalSize.rows}` : 'unknown'})`);
+    }
+}
 // --- Readiness polling ---
 /**
  * Waits for the PTY socket/port to become connectable.