@provos/ironcurtain 0.5.1 → 0.6.0

package/README.md

@@ -9,8 +9,17 @@
 
 _\*When someone writes "secure," you should immediately be skeptical. [What do we mean by secure?](https://ironcurtain.dev)_
 
+> [!WARNING]
 > **Research Prototype.** IronCurtain is an early-stage research project exploring how to make AI agents safe enough to be genuinely useful. APIs, configuration formats, and architecture may change. Contributions and feedback are welcome.
 
+## Demo
+
+<p align="center">
+  <img src="demo.gif" alt="IronCurtain mux demo: trusted input from command mode enables auto-approval of git clone and git push" width="800">
+</p>
+
+The agent is asked to clone a repository and push changes. Both `git_clone` and `git_push` are escalated by the policy engine, but the [auto-approver](#auto-approve-escalations) approves them automatically — the user's trusted input from command mode (Ctrl-A) provided clear intent, so no manual `/approve` was needed.
+
 ## The Problem
 
 Autonomous AI agents can manage files, run git commands, send messages, and interact with APIs on your behalf. But today's agent frameworks give the agent the same privileges as the user such as full access to the filesystem, credentials, and network. Security researchers call this **ambient authority**, and it means a single prompt injection or multi-turn drift can cause an agent to delete files, exfiltrate data, or push malicious code.
@@ -30,14 +39,6 @@ The key ideas:
 - **Semantic interposition.** Instead of giving the agent raw system access, all interactions go through [MCP](https://modelcontextprotocol.io/) servers (filesystem, git, etc.). Every tool call passes through a policy engine that can **allow**, **deny**, or **escalate** to the user for approval.
 - **Defense in depth.** Agent code runs in a V8 isolate with no direct access to the host. The only way out is through semantically meaningful MCP tool calls and every one is checked against policy.
 
-## Demo
-
-<p align="center">
-  <img src="demo.gif" alt="IronCurtain demo: agent clones a repo, policy escalates git_clone for approval, user approves, then auto-approve handles git push" width="800">
-</p>
-
-The agent clones a repository and edits a file. The policy engine escalates `git_clone` for human approval. After the user types `/approve`, the agent completes the task. On the second request ("ok. git push to origin please"), [auto-approve](#auto-approve-escalations) recognizes the explicit intent and approves `git_push` automatically — no interruption needed.
-
 ## Architecture
 
 IronCurtain supports two session modes with different trust models:
@@ -82,7 +83,7 @@ npm install
 export ANTHROPIC_API_KEY=sk-ant-...
 ```
 
-Or add it to `~/.ironcurtain/config.json` via `ironcurtain config`. Environment variables take precedence. Supported: `ANTHROPIC_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, `OPENAI_API_KEY`.
+You can also place keys in a `.env` file in the project root (loaded automatically via `dotenv`), or add them to `~/.ironcurtain/config.json` via `ironcurtain config`. Environment variables take precedence over config file values. Supported: `ANTHROPIC_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, `OPENAI_API_KEY`.
 
 **2. Run the first-start wizard** (runs automatically on first `ironcurtain start`, or explicitly):
 
@@ -128,6 +129,17 @@ Send one task and exit when the agent finishes:
 ironcurtain start "Summarize the files in the current directory"
 ```
 
+### Workspace mode
+
+Point the agent at an existing directory instead of a fresh sandbox:
+
+```bash
+ironcurtain start -w ./my-project "Fix the failing tests"
+ironcurtain start --workspace /home/user/repos/my-app
+```
+
+The workspace replaces the session sandbox as the agent's working area. All session infrastructure (logs, escalations, audit) still lives under `~/.ironcurtain/sessions/`. The path is validated to prevent use of sensitive directories (root, home, `~/.ironcurtain/`, or paths overlapping with protected paths).
+
 ### Session resume
 
 Resume a previous session's conversation history:
@@ -138,15 +150,26 @@ ironcurtain start --resume <session-id>
 
 Session IDs are printed on session start and stored under `~/.ironcurtain/sessions/`.
 
-### PTY mode and the escalation listener
+### Terminal multiplexer (recommended for Docker Agent Mode)
 
-PTY mode attaches your terminal directly to Claude Code running inside the Docker container. You get Claude Code's full interactive TUI — spinners, diffs, file previews, slash commands — while IronCurtain still mediates every tool call through its policy engine.
+The terminal multiplexer is the recommended way to use IronCurtain with Docker Agent Mode. It gives you the full power of Claude Code's interactive TUI — spinners, diffs, file previews, slash commands — while IronCurtain mediates every tool call through its policy engine. All in a single terminal.
 
 ```bash
-ironcurtain start --pty
+ironcurtain mux
 ```
 
-**Why a separate escalation listener?** In PTY mode your terminal is fully occupied by Claude Code's raw TTY — there is no channel left to inject escalation prompts inline. Each PTY session registers itself in `~/.ironcurtain/pty-registry/` and a separate companion process handles approvals:
+**Key capabilities:**
+
+- **Full agent TUI** — Claude Code runs in a PTY inside a Docker container with no network access. You interact with it exactly as if it were running locally.
+- **Inline escalation handling** — When a tool call needs approval, an escalation panel overlays the viewport. No separate terminal needed — press Ctrl-A to enter command mode, `/approve N` or `/deny N`, and return.
+- **Trusted user input** — Text typed in command mode (Ctrl-A) is captured on the host side before entering the container. This creates a verified intent signal that the [auto-approver](#auto-approve-escalations) can use — e.g., typing "push my changes to origin" will auto-approve a subsequent `git_push` escalation.
+- **Tab management** — Spawn multiple concurrent sessions (`/new`), switch between them (`/tab N`, Alt-1..9), close them (`/close`).
+
+See [DEVELOPER_GUIDE.md](DEVELOPER_GUIDE.md) for the full walkthrough: input modes, trusted input security model, escalation workflow, and keyboard reference.
+
+### PTY mode with a separate escalation listener
+
+An alternative to the mux — run a raw PTY session in one terminal and handle escalations in another:
 
 ```bash
 # Terminal 1 — interactive Claude Code session
@@ -156,33 +179,9 @@ ironcurtain start --pty
 ironcurtain escalation-listener
 ```
 
-**How session discovery works:**
-
-1. When `--pty` starts, it writes a registration file to `~/.ironcurtain/pty-registry/session-<id>.json` containing the session ID, escalation directory path, display label, and process PID.
-2. The escalation listener polls `pty-registry/` every second. It discovers new sessions, attaches an escalation watcher to each one, and detaches watchers when sessions end. Stale registrations (process PID no longer alive) are removed automatically, so a crashed PTY session doesn't leave phantom entries.
-
-**The escalation flow:**
-
-When a tool call is escalated, the PTY session emits a **BEL character** (`\x07`) — your terminal bell or visual flash signals that attention is needed. Switch to the listener terminal. The listener TUI re-renders in place: active sessions are listed with sequential display numbers, and each pending escalation shows the tool name, arguments, and the policy reason for the escalation.
-
-**Listener commands:**
-
-| Command        | Description                               |
-| -------------- | ----------------------------------------- |
-| `/approve N`   | Approve escalation #N                     |
-| `/deny N`      | Deny escalation #N                        |
-| `/approve all` | Approve all pending escalations           |
-| `/deny all`    | Deny all pending escalations              |
-| `/sessions`    | Show detailed session information         |
-| `/quit`        | Exit the listener                         |
-
-Escalation numbers are sequential across all sessions. If you have two active PTY sessions, their escalations share a single numbered list in the dashboard — escalation #3 might be from session [1] and #4 from session [2]. Use the number shown in the dashboard to resolve them.
-
-**Multiple concurrent sessions:** The listener aggregates escalations from all active PTY sessions in one dashboard. Each session is assigned a display number (e.g., `Claude Code [1]`, `Claude Code [2]`) when it first appears.
-
-**Single-instance lock:** Only one escalation listener may run at a time, enforced via a PID-checked lock file at `~/.ironcurtain/escalation-listener.lock`. A stale lock from a crashed process is cleaned up automatically on the next start.
+This workflow does not support trusted input or auto-approval for PTY sessions. The mux is recommended instead.
 
-**Emergency exit and terminal recovery:** Press `Ctrl-\` to trigger a graceful shutdown of the PTY session (stops containers, proxies, and performs async cleanup). If the process is killed ungracefully (e.g., `kill -9`), run `reset` in that terminal to restore normal terminal mode.
+**Emergency exit and terminal recovery:** Press `Ctrl-\` to trigger a graceful shutdown of the PTY session. If the process is killed ungracefully, run `reset` in that terminal to restore normal terminal mode.
 
 ### Signal messaging transport
 
@@ -199,15 +198,15 @@ See [TRANSPORT.md](TRANSPORT.md) for setup instructions, architecture details, a
 
 Commands available during an **interactive** or **single-shot** session:
 
-| Command    | Description                                      |
-| ---------- | ------------------------------------------------ |
-| `/approve` | Approve the pending escalation                   |
-| `/deny`    | Deny the pending escalation                      |
-| `/budget`  | Show resource consumption (tokens, steps, cost)  |
-| `/logs`    | Display diagnostic events                        |
-| `/quit`    | End the session                                  |
+| Command    | Description                                     |
+| ---------- | ----------------------------------------------- |
+| `/approve` | Approve the pending escalation                  |
+| `/deny`    | Deny the pending escalation                     |
+| `/budget`  | Show resource consumption (tokens, steps, cost) |
+| `/logs`    | Display diagnostic events                       |
+| `/quit`    | End the session                                 |
 
-In **PTY mode**, use the escalation listener instead (see above) — the PTY terminal is occupied by Claude Code's TUI.
+In **PTY mode**, use the [terminal multiplexer](#terminal-multiplexer-recommended-for-docker-agent-mode) (`ironcurtain mux`) for inline escalation handling and trusted input support.
 
 ## Policy: Constitution → Enforcement
 
@@ -242,9 +241,9 @@ compiles to:
 
 ```json
 [
-  { "tool": "git_status", "decision": "allow",    "condition": { "directory": { "within": "$SANDBOX" } } },
-  { "tool": "git_diff",   "decision": "allow",    "condition": { "directory": { "within": "$SANDBOX" } } },
-  { "tool": "git_push",   "decision": "escalate", "reason": "Remote-contacting git operations require human approval" }
+  { "tool": "git_status", "decision": "allow", "condition": { "directory": { "within": "$SANDBOX" } } },
+  { "tool": "git_diff", "decision": "allow", "condition": { "directory": { "within": "$SANDBOX" } } },
+  { "tool": "git_push", "decision": "escalate", "reason": "Remote-contacting git operations require human approval" }
 ]
 ```
 
@@ -376,11 +375,11 @@ After compilation, review the updated `tool-annotations.json` and `compiled-poli
 
 IronCurtain ships with four pre-configured MCP servers. All tool calls are governed by your compiled policy.
 
-| Server         | Tools | Key capabilities                                                                               |
-| -------------- | ----- | ---------------------------------------------------------------------------------------------- |
-| **Filesystem** | 14    | Read, write, edit, search files; directory tree; move; diff calculation                        |
-| **Git**        | 27    | Full git workflow: status, diff, log, commit, branch, push/pull/fetch, clone, stash, blame     |
-| **Fetch**      | 2     | HTTP GET with HTML-to-markdown conversion; `web_search` (see [Web Search](#web-search))        |
+| Server         | Tools | Key capabilities                                                                                                  |
+| -------------- | ----- | ----------------------------------------------------------------------------------------------------------------- |
+| **Filesystem** | 14    | Read, write, edit, search files; directory tree; move; diff calculation                                           |
+| **Git**        | 27    | Full git workflow: status, diff, log, commit, branch, push/pull/fetch, clone, stash, blame                        |
+| **Fetch**      | 2     | HTTP GET with HTML-to-markdown conversion; `web_search` (see [Web Search](#web-search))                           |
 | **GitHub**     | 41    | Issues, PRs, code search, reviews via `ghcr.io/github/github-mcp-server`; requires a GitHub personal access token |
 
 Read-only operations are allowed by default policy; mutations (writes, pushes, PR creation) escalate for human approval.
@@ -411,17 +410,17 @@ See [docs/SECURITY_CONCERNS.md](docs/SECURITY_CONCERNS.md) for a detailed threat
 
 ## Troubleshooting
 
-| Issue                                       | Guidance                                                                                                                                                                                                                                              |
-| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Missing API key**                         | Set the environment variable (`ANTHROPIC_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, or `OPENAI_API_KEY`) or add the corresponding key to `~/.ironcurtain/config.json`.                                                                                 |
-| **Sandbox unavailable**                     | OS-level sandboxing requires `bubblewrap` and `socat`. Install both, or set `"sandboxPolicy": "warn"` in your MCP server config for development.                                                                                                      |
-| **Budget exhausted**                        | Adjust limits in `~/.ironcurtain/config.json` under `resourceBudget`. Set any individual limit to `null` to disable it.                                                                                                                               |
-| **Node version errors**                     | Node.js 22+ is required (`isolated-vm` needs `>=22.0.0`). Maximum supported is Node 25 (`<26`).                                                                                                                                                       |
-| **Policy doesn't match intent**             | Review `compiled-policy.json` to see the generated rules. Run `ironcurtain customize-policy` to refine your constitution, then `ironcurtain compile-policy` to recompile. Specific wording produces better rules — vague phrasing leads to vague policy. |
-| **Auto-approve not triggering**             | The auto-approver only approves when the user's message explicitly authorizes the action (e.g., "push to origin" for `git_push`). Vague messages always escalate to human review. Verify `autoApprove.enabled` is `true` in `config.json`.             |
-| **PTY terminal garbled after exit**         | Run `reset` in the PTY terminal to restore normal mode. This is needed when the process is killed ungracefully and raw mode is not restored.                                                                                                           |
-| **Escalation listener: "already running"** | Another listener holds the lock at `~/.ironcurtain/escalation-listener.lock`. The lock is auto-cleared if the previous process is dead. If it persists, check the PID in the lock file.                                                               |
-| **Signal bot not responding**               | Verify the signal-cli container is running (`docker ps \| grep ironcurtain-signal`). Check that Signal is configured (`ironcurtain setup-signal`). See [TRANSPORT.md](TRANSPORT.md) for detailed troubleshooting.                                     |
+| Issue                                   | Guidance                                                                                                                                                                                                                                                 |
+| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Missing API key**                     | Set the environment variable (`ANTHROPIC_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, or `OPENAI_API_KEY`) or add the corresponding key to `~/.ironcurtain/config.json`.                                                                                    |
+| **Sandbox unavailable**                 | OS-level sandboxing requires `bubblewrap` and `socat`. Install both, or set `"sandboxPolicy": "warn"` in your MCP server config for development.                                                                                                         |
+| **Budget exhausted**                    | Adjust limits in `~/.ironcurtain/config.json` under `resourceBudget`. Set any individual limit to `null` to disable it.                                                                                                                                  |
+| **Node version errors**                 | Node.js 22+ is required (`isolated-vm` needs `>=22.0.0`). Maximum supported is Node 25 (`<26`).                                                                                                                                                          |
+| **Policy doesn't match intent**         | Review `compiled-policy.json` to see the generated rules. Run `ironcurtain customize-policy` to refine your constitution, then `ironcurtain compile-policy` to recompile. Specific wording produces better rules — vague phrasing leads to vague policy. |
+| **Auto-approve not triggering**         | The auto-approver only approves when the user's message explicitly authorizes the action (e.g., "push to origin" for `git_push`). Vague messages always escalate to human review. Verify `autoApprove.enabled` is `true` in `config.json`.               |
+| **PTY/mux terminal garbled after exit** | Run `reset` in that terminal to restore normal mode. This is needed when the process is killed ungracefully and raw mode is not restored.                                                                                                                |
+| **Mux/listener: "already running"**     | Only one mux or escalation-listener can run at a time. The lock at `~/.ironcurtain/escalation-listener.lock` is auto-cleared if the previous process is dead. If it persists, check the PID in the lock file.                                            |
+| **Signal bot not responding**           | Verify the signal-cli container is running (`docker ps \| grep ironcurtain-signal`). Check that Signal is configured (`ironcurtain setup-signal`). See [TRANSPORT.md](TRANSPORT.md) for detailed troubleshooting.                                        |
 
 ## Development
 
@@ -450,6 +449,7 @@ src/
 ├── trusted-process/            # Policy engine, MCP proxy, audit log, escalation handler
 ├── pipeline/                   # Constitution → policy compilation pipeline
 ├── escalation/                 # Escalation listener: session registry, TUI dashboard, state
+├── mux/                        # Terminal multiplexer: PTY bridge, renderer, trusted input
 ├── signal/                     # Signal messaging transport (bot daemon, setup, formatting)
 ├── docker/                     # Docker agent mode, PTY session, MITM proxy, adapters
 ├── servers/                    # Built-in MCP servers (fetch, web search providers)

package/dist/cli.js

@@ -20,6 +20,7 @@ Usage:
 
 Commands:
   start [task]         Run the agent (interactive or single-shot)
+  mux                  Terminal multiplexer for PTY sessions (requires node-pty)
   escalation-listener  Aggregate escalation notifications from PTY sessions
   bot                  Run the Signal messaging transport daemon
   setup                Run the first-start wizard (always runs)
@@ -37,6 +38,8 @@ Options:
   -v, --version        Show version number
   -a, --agent <name>   Agent mode: builtin or claude-code (Docker)
                        Auto-detects if omitted: Docker if available, else builtin
+  -w, --workspace <path>  Use an existing directory as the agent's workspace
+                       instead of creating a fresh sandbox
   --pty                Attach terminal directly to agent PTY (Docker mode only)
                        Ctrl-\\ is the emergency exit; run 'reset' to recover
                        the terminal if killed ungracefully
@@ -47,6 +50,7 @@ Examples:
   ironcurtain start                              # Interactive session
   ironcurtain start "Summarize files in ."       # Single-shot task
   ironcurtain start --resume <session-id>        # Resume a session
+  ironcurtain start -w ./my-project "Fix bugs"   # Work in existing directory
   ironcurtain start --agent claude-code "task"   # Docker: Claude Code
   ironcurtain start --pty                        # PTY mode: interactive Docker terminal
   ironcurtain start --list-agents                # List available agents
@@ -118,6 +122,11 @@ switch (subcommand) {
         await runBot({ agent: agentName });
         break;
     }
+    case 'mux': {
+        const { main: muxMain } = await import('./mux/mux-command.js');
+        await muxMain(process.argv.slice(3));
+        break;
+    }
     case 'escalation-listener': {
         const { main: listenerMain } = await import('./escalation/listener-command.js');
         await listenerMain();

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,KAAK,CACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CH,CAAC,IAAI,EAAE,CACL,CAAC;AACJ,CAAC;AAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IACxD,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,KAAK,CACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDH,CAAC,IAAI,EAAE,CACL,CAAC;AACJ,CAAC;AAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IACxD,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnC,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/config/types.d.ts

@@ -98,4 +98,10 @@ export interface IronCurtainConfig {
     dockerAuth?: {
         readonly kind: 'oauth' | 'apikey';
     };
+    /**
+     * Whether this is a PTY session. When true, the proxy requires
+     * trusted input source ("mux-trusted-input") for auto-approval.
+     * Set by PTY session orchestration code.
+     */
+    isPtySession?: boolean;
 }

package/dist/docker/adapters/claude-code.js

@@ -208,7 +208,7 @@ stty -F "$PTS" size 2>/dev/null || echo "0 0"
         // Interactive mode: claude runs via a wrapper script that reads the system
         // prompt from an env var set by the entrypoint. This avoids shell quoting
         // issues that occur when embedding large prompts in socat EXEC: strings.
-        return ['socat', listenArg, 'EXEC:/etc/ironcurtain/start-claude.sh,pty,setsid,ctty,stderr'];
+        return ['socat', listenArg, 'EXEC:/etc/ironcurtain/start-claude.sh,pty,setsid,ctty,stderr,rawer'];
     },
 };
 /**

package/dist/docker/adapters/claude-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/docker/adapters/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAE3D,SAAS,4BAA4B,CAAC,OAA2B;IAC/D,OAAO;;mBAEU,OAAO,CAAC,YAAY;;;;;;;;4BAQX,OAAO,CAAC,YAAY;;;SAGvC,OAAO,CAAC,YAAY;;oBAET,OAAO,CAAC,YAAY;;;;0BAId,OAAO,CAAC,YAAY;UACpC,OAAO,CAAC,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;CAyB7B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,EAAE,EAAE,aAAwB;IAC5B,WAAW,EAAE,aAAa;IAE1B,iGAAiG;IACjG,KAAK,CAAC,QAAQ;QACZ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,8DAA8D;IAC9D,iBAAiB,CAAC,UAAkB;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE;gBACV,WAAW,EAAE;oBACX,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,gBAAgB,UAAU,EAAE,CAAC;iBACvF;aACF;SACF,CAAC;QAEF,OAAO;YACL;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,WAAW,GAAG;;;;;;;;CAQvB,CAAC;QAEE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,4DAA4D;QAC5D,mEAAmE;QACnE,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBxB,CAAC;QAEE,2EAA2E;QAC3E,MAAM,eAAe,GAAG;;;;;;;CAO3B,CAAC;QAEE,OAAO;YACL,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE;YAC9D,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE;YAC7D,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE;SACrE,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,YAAoB;QAChD,OAAO;YACL,QAAQ;YACR,YAAY;YACZ,gCAAgC;YAChC,iBAAiB;YACjB,MAAM;YACN,cAAc;YACd,yCAAyC;YACzC,wBAAwB;YACxB,YAAY;YACZ,IAAI;YACJ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,OAA2B;QAC3C,iFAAiF;QACjF,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAEzF,yEAAyE;QACzE,MAAM,YAAY,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAE3D,OAAO,GAAG,cAAc,KAAK,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED,YAAY,CAAC,QAA6B;QACxC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,sBAAsB,EAAE,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IACrD,CAAC;IAED,QAAQ,CAAC,MAAyB,EAAE,QAAqC;QACvE,MAAM,GAAG,GAA2B;YAClC,gCAAgC,EAAE,GAAG;YACrC,uEAAuE;YACvE,mBAAmB,EAAE,qDAAqD;SAC3E,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACxC,gEAAgE;YAChE,0EAA0E;YAC1E,GAAG,CAAC,uBAAuB,GAAG,OAAO,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,wEAAwE;YACxE,GAAG,CAAC,mBAAmB,GAAG,OAAO,CAAC;QACpC,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,eAAe,CAAC,QAAgB,EAAE,MAAc;QAC9C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,0BAA0B,QAAQ,iBAAiB,MAAM,EAAE,EAAE,CAAC;QAC/E,CAAC;QACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,eAAe,CACb,aAAqB,EACrB,WAA+B,EAC/B,OAA2B;QAE3B,gDAAgD;QAChD,MAAM,SAAS,GAAG,WAAW;YAC3B,CAAC,CAAC,eAAe,WAAW,OAAO,CAAC,YAAY;YAChD,CAAC,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC,YAAY;QAEnD,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,8DAA8D,CAAC,CAAC;IAC9F,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzE,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAC3C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/docker/adapters/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAE3D,SAAS,4BAA4B,CAAC,OAA2B;IAC/D,OAAO;;mBAEU,OAAO,CAAC,YAAY;;;;;;;;4BAQX,OAAO,CAAC,YAAY;;;SAGvC,OAAO,CAAC,YAAY;;oBAET,OAAO,CAAC,YAAY;;;;0BAId,OAAO,CAAC,YAAY;UACpC,OAAO,CAAC,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;CAyB7B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,EAAE,EAAE,aAAwB;IAC5B,WAAW,EAAE,aAAa;IAE1B,iGAAiG;IACjG,KAAK,CAAC,QAAQ;QACZ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,8DAA8D;IAC9D,iBAAiB,CAAC,UAAkB;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE;gBACV,WAAW,EAAE;oBACX,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,gBAAgB,UAAU,EAAE,CAAC;iBACvF;aACF;SACF,CAAC;QAEF,OAAO;YACL;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;aAC5C;SACF,CAAC;IACJ,CAAC;IAED,wBAAwB;QACtB,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,WAAW,GAAG;;;;;;;;CAQvB,CAAC;QAEE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,4DAA4D;QAC5D,mEAAmE;QACnE,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBxB,CAAC;QAEE,2EAA2E;QAC3E,MAAM,eAAe,GAAG;;;;;;;CAO3B,CAAC;QAEE,OAAO;YACL,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE;YAC9D,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE;YAC7D,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE;SACrE,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,YAAoB;QAChD,OAAO;YACL,QAAQ;YACR,YAAY;YACZ,gCAAgC;YAChC,iBAAiB;YACjB,MAAM;YACN,cAAc;YACd,yCAAyC;YACzC,wBAAwB;YACxB,YAAY;YACZ,IAAI;YACJ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,OAA2B;QAC3C,iFAAiF;QACjF,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAEzF,yEAAyE;QACzE,MAAM,YAAY,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAE3D,OAAO,GAAG,cAAc,KAAK,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED,YAAY,CAAC,QAA6B;QACxC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,sBAAsB,EAAE,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IACrD,CAAC;IAED,QAAQ,CAAC,MAAyB,EAAE,QAAqC;QACvE,MAAM,GAAG,GAA2B;YAClC,gCAAgC,EAAE,GAAG;YACrC,uEAAuE;YACvE,mBAAmB,EAAE,qDAAqD;SAC3E,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACxC,gEAAgE;YAChE,0EAA0E;YAC1E,GAAG,CAAC,uBAAuB,GAAG,OAAO,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,wEAAwE;YACxE,GAAG,CAAC,mBAAmB,GAAG,OAAO,CAAC;QACpC,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,eAAe,CAAC,QAAgB,EAAE,MAAc;QAC9C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,0BAA0B,QAAQ,iBAAiB,MAAM,EAAE,EAAE,CAAC;QAC/E,CAAC;QACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,eAAe,CACb,aAAqB,EACrB,WAA+B,EAC/B,OAA2B;QAE3B,gDAAgD;QAChD,MAAM,SAAS,GAAG,WAAW;YAC3B,CAAC,CAAC,eAAe,WAAW,OAAO,CAAC,YAAY;YAChD,CAAC,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC,YAAY;QAEnD,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,oEAAoE,CAAC,CAAC;IACpG,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzE,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAC3C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACjC,CAAC"}

package/dist/docker/docker-infrastructure.js

@@ -11,6 +11,8 @@ import { existsSync, readdirSync, readFileSync, copyFileSync, mkdtempSync, rmSyn
 import { arch, tmpdir } from 'node:os';
 import { createHash } from 'node:crypto';
 import * as logger from '../logger.js';
+/** Hosts that use Anthropic OAuth credentials when available. */
+const ANTHROPIC_HOSTS = new Set(['api.anthropic.com', 'platform.claude.com']);
 /**
  * Prepares all Docker infrastructure needed to run a session.
  *
@@ -32,6 +34,7 @@ export async function prepareDockerInfrastructure(config, mode, sessionDir, sand
     const { prepareSession } = await import('./orientation.js');
     const { mkdirSync } = await import('node:fs');
     const { detectAuthMethod } = await import('./oauth-credentials.js');
+    const { OAuthTokenManager } = await import('./oauth-token-manager.js');
     await registerBuiltinAdapters();
     const adapter = getAgent(mode.agent);
     const useTcp = useTcpTransport();
@@ -65,6 +68,9 @@ export async function prepareDockerInfrastructure(config, mode, sessionDir, sand
     // Providers sharing the same fakeKeyPrefix (and thus the same real credential)
     // reuse the same fake key so a single container token authenticates against all hosts.
     const oauthAccessToken = authMethod.kind === 'oauth' ? authMethod.credentials.accessToken : undefined;
+    const tokenManager = authMethod.kind === 'oauth'
+        ? new OAuthTokenManager(authMethod.credentials, { canRefresh: authMethod.source === 'file' })
+        : undefined;
     const providers = adapter.getProviders(authKind);
     const fakeKeys = new Map();
     const providerMappings = [];
@@ -77,7 +83,9 @@ export async function prepareDockerInfrastructure(config, mode, sessionDir, sand
         }
         fakeKeys.set(providerConfig.host, fakeKey);
         const realKey = resolveRealKey(providerConfig.host, config, oauthAccessToken);
-        providerMappings.push({ config: providerConfig, fakeKey, realKey });
+        // Attach the token manager only to Anthropic hosts (the ones using OAuth)
+        const hostTokenManager = tokenManager && ANTHROPIC_HOSTS.has(providerConfig.host) ? tokenManager : undefined;
+        providerMappings.push({ config: providerConfig, fakeKey, realKey, tokenManager: hostTokenManager });
     }
     const mitmProxy = useTcp
         ? createMitmProxy({
@@ -156,8 +164,7 @@ export async function prepareDockerInfrastructure(config, mode, sessionDir, sand
  * For all other cases, falls back to the API key from config.
  */
 function resolveRealKey(host, config, oauthAccessToken) {
-    // OAuth access token replaces API key for Anthropic hosts
-    if (oauthAccessToken && (host === 'api.anthropic.com' || host === 'platform.claude.com')) {
+    if (oauthAccessToken && ANTHROPIC_HOSTS.has(host)) {
         return oauthAccessToken;
     }
     let key;

package/dist/docker/docker-infrastructure.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker-infrastructure.js","sourceRoot":"","sources":["../../src/docker/docker-infrastructure.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AA0BvC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAyB,EACzB,IAAsC,EACtC,UAAkB,EAClB,UAAkB,EAClB,aAAqB,EACrB,YAAoB,EACpB,SAAiB;IAEjB,6EAA6E;IAC7E,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAClF,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACpE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAE9C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAEpE,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IAEjC,iFAAiF;IACjF,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,+CAA+C,GAAG,8DAA8D,CACjH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;IAEjC,8EAA8E;IAC9E,+DAA+D;IAC/D,MAAM,CAAC,UAAU,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEvC,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAClD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAErD,MAAM,KAAK,GAAG,mBAAmB,CAAC;QAChC,UAAU;QACV,MAAM;QACN,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;KACnC,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAEjC,sDAAsD;IACtD,wFAAwF;IACxF,+EAA+E;IAC/E,uFAAuF;IACvF,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,gBAAgB,GAAyB,EAAE,CAAC;IAClD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,KAAK,MAAM,cAAc,IAAI,SAAS,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,eAAe,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;YACxD,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC9E,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM;QACtB,CAAC,CAAC,eAAe,CAAC;YACd,UAAU,EAAE,CAAC;YACb,EAAE;YACF,SAAS,EAAE,gBAAgB;SAC5B,CAAC;QACJ,CAAC,CAAC,eAAe,CAAC;YACd,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,iBAAiB,CAAC;YAClD,EAAE;YACF,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IAErC,gBAAgB;IAChB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,IAAI,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,0CAA0C,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;IACzC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,qCAAqC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,2BAA2B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC;QACH,oBAAoB;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/F,IAAI;YACJ,WAAW;SACZ,CAAC,CAAC,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,sBAAsB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAElF,MAAM,YAAY,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,MAAM,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAE/G,8CAA8C;QAC9C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAErC,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAE1D,OAAO;YACL,SAAS;YACT,UAAU;YACV,UAAU;YACV,aAAa;YACb,YAAY;YACZ,KAAK;YACL,SAAS;YACT,MAAM;YACN,OAAO;YACP,EAAE;YACF,QAAQ;YACR,cAAc;YACd,YAAY;YACZ,KAAK;YACL,MAAM;YACN,UAAU;YACV,QAAQ;YACR,QAAQ;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+CAA+C;QAC/C,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,MAAyB,EAAE,gBAAoC;IACnG,0DAA0D;IAC1D,IAAI,gBAAgB,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,qBAAqB,CAAC,EAAE,CAAC;QACzF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,mBAAmB,CAAC;QACzB,KAAK,qBAAqB;YACxB,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;YACxC,MAAM;QACR,KAAK,gBAAgB;YACnB,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;YACrC,MAAM;QACR,KAAK,mCAAmC;YACtC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;YACrC,MAAM;QACR;YACE,MAAM,CAAC,IAAI,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;YACrE,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,MAAqB,EAAE,EAAwB;IACvF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEjD,8EAA8E;IAC9E,MAAM,cAAc,GAClB,IAAI,EAAE,KAAK,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,iBAAiB,CAAC;IAExB,+DAA+D;IAC/D,MAAM,SAAS,GAAG,yBAAyB,CAAC;IAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAE3G,0EAA0E;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,cAAc,SAAS,EAAE,CAAC;IAC7C,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,MAAM,mBAAmB,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC5F,MAAM,eAAe,GAAG,WAAW,IAAI,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAE3F,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC;QACjD,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE;YAC7D,wBAAwB,EAAE,cAAc;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,MAAqB,EACrB,EAAwB,EACxB,SAAiB,EACjB,UAAkB,EAClB,SAAiB;IAEjB,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtE,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IAElF,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC;QAE1E,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,UAAU,EAAE;YAC9E,wBAAwB,EAAE,SAAS;SACpC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,MAAqB,EAAE,YAAoB;IACpF,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAC/E,OAAO,UAAU,KAAK,YAAY,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,WAAqB,EAAE,SAAiB,EAAE,UAAmB;IACxG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAElC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEvB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,UAAU,UAAU,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"docker-infrastructure.js","sourceRoot":"","sources":["../../src/docker/docker-infrastructure.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AA0BvC,iEAAiE;AACjE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAyB,EACzB,IAAsC,EACtC,UAAkB,EAClB,UAAkB,EAClB,aAAqB,EACrB,YAAoB,EACpB,SAAiB;IAEjB,6EAA6E;IAC7E,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAClF,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACpE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAE9C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACpE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAEvE,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IAEjC,iFAAiF;IACjF,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,+CAA+C,GAAG,8DAA8D,CACjH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;IAEjC,8EAA8E;IAC9E,+DAA+D;IAC/D,MAAM,CAAC,UAAU,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEvC,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAClD,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAErD,MAAM,KAAK,GAAG,mBAAmB,CAAC;QAChC,UAAU;QACV,MAAM;QACN,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;KACnC,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAEjC,sDAAsD;IACtD,wFAAwF;IACxF,+EAA+E;IAC/E,uFAAuF;IACvF,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,MAAM,YAAY,GAChB,UAAU,CAAC,IAAI,KAAK,OAAO;QACzB,CAAC,CAAC,IAAI,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7F,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,gBAAgB,GAAyB,EAAE,CAAC;IAClD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,KAAK,MAAM,cAAc,IAAI,SAAS,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,eAAe,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;YACxD,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC9E,0EAA0E;QAC1E,MAAM,gBAAgB,GAAG,YAAY,IAAI,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,SAAS,GAAG,MAAM;QACtB,CAAC,CAAC,eAAe,CAAC;YACd,UAAU,EAAE,CAAC;YACb,EAAE;YACF,SAAS,EAAE,gBAAgB;SAC5B,CAAC;QACJ,CAAC,CAAC,eAAe,CAAC;YACd,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,iBAAiB,CAAC;YAClD,EAAE;YACF,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IAErC,gBAAgB;IAChB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,IAAI,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,0CAA0C,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;IACzC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,qCAAqC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,2BAA2B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC;QACH,oBAAoB;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/F,IAAI;YACJ,WAAW;SACZ,CAAC,CAAC,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,sBAAsB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAElF,MAAM,YAAY,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,MAAM,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAE/G,8CAA8C;QAC9C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAErC,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAE1D,OAAO;YACL,SAAS;YACT,UAAU;YACV,UAAU;YACV,aAAa;YACb,YAAY;YACZ,KAAK;YACL,SAAS;YACT,MAAM;YACN,OAAO;YACP,EAAE;YACF,QAAQ;YACR,cAAc;YACd,YAAY;YACZ,KAAK;YACL,MAAM;YACN,UAAU;YACV,QAAQ;YACR,QAAQ;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+CAA+C;QAC/C,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,MAAyB,EAAE,gBAAoC;IACnG,IAAI,gBAAgB,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,mBAAmB,CAAC;QACzB,KAAK,qBAAqB;YACxB,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;YACxC,MAAM;QACR,KAAK,gBAAgB;YACnB,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;YACrC,MAAM;QACR,KAAK,mCAAmC;YACtC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;YACrC,MAAM;QACR;YACE,MAAM,CAAC,IAAI,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;YACrE,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,MAAqB,EAAE,EAAwB;IACvF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEjD,8EAA8E;IAC9E,MAAM,cAAc,GAClB,IAAI,EAAE,KAAK,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,iBAAiB,CAAC;IAExB,+DAA+D;IAC/D,MAAM,SAAS,GAAG,yBAAyB,CAAC;IAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAE3G,0EAA0E;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,cAAc,SAAS,EAAE,CAAC;IAC7C,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,MAAM,mBAAmB,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC5F,MAAM,eAAe,GAAG,WAAW,IAAI,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAE3F,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC;QACjD,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE;YAC7D,wBAAwB,EAAE,cAAc;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,MAAqB,EACrB,EAAwB,EACxB,SAAiB,EACjB,UAAkB,EAClB,SAAiB;IAEjB,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtE,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IAElF,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC;QAE1E,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,UAAU,EAAE;YAC9E,wBAAwB,EAAE,SAAS;SACpC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,MAAqB,EAAE,YAAoB;IACpF,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAC/E,OAAO,UAAU,KAAK,YAAY,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,WAAqB,EAAE,SAAiB,EAAE,UAAmB;IACxG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAElC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEvB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,UAAU,UAAU,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/docker/mitm-proxy.d.ts

@@ -14,6 +14,7 @@
  */
 import { type CertificateAuthority } from './ca.js';
 import { type ProviderConfig } from './provider-config.js';
+import type { OAuthTokenManager } from './oauth-token-manager.js';
 export interface MitmProxy {
     /** Start listening on the UDS or TCP port. Pre-warms cert cache for all providers. */
     start(): Promise<{
@@ -40,7 +41,9 @@ export interface ProviderKeyMapping {
     readonly config: ProviderConfig;
     /** The fake sentinel key given to the container. */
     readonly fakeKey: string;
-    /** The real API key to inject in upstream requests. */
-    readonly realKey: string;
+    /** The real API key to inject in upstream requests. Mutable for token refresh. */
+    realKey: string;
+    /** Optional token manager for OAuth providers — enables proactive refresh and 401 retry. */
+    readonly tokenManager?: OAuthTokenManager;
 }
 export declare function createMitmProxy(options: MitmProxyOptions): MitmProxy;