@provos/ironcurtain 0.5.1 → 0.7.0

package/README.md

@@ -9,8 +9,17 @@
 
 _\*When someone writes "secure," you should immediately be skeptical. [What do we mean by secure?](https://ironcurtain.dev)_
 
+> [!WARNING]
 > **Research Prototype.** IronCurtain is an early-stage research project exploring how to make AI agents safe enough to be genuinely useful. APIs, configuration formats, and architecture may change. Contributions and feedback are welcome.
 
+## Demo
+
+<p align="center">
+  <img src="demo.gif" alt="IronCurtain mux demo: trusted input from command mode enables auto-approval of git clone and git push" width="800">
+</p>
+
+The agent is asked to clone a repository and push changes. Both `git_clone` and `git_push` are escalated by the policy engine, but the [auto-approver](#auto-approve-escalations) approves them automatically — the user's trusted input from command mode (Ctrl-A) provided clear intent, so no manual `/approve` was needed.
+
 ## The Problem
 
 Autonomous AI agents can manage files, run git commands, send messages, and interact with APIs on your behalf. But today's agent frameworks give the agent the same privileges as the user such as full access to the filesystem, credentials, and network. Security researchers call this **ambient authority**, and it means a single prompt injection or multi-turn drift can cause an agent to delete files, exfiltrate data, or push malicious code.
@@ -30,14 +39,6 @@ The key ideas:
 - **Semantic interposition.** Instead of giving the agent raw system access, all interactions go through [MCP](https://modelcontextprotocol.io/) servers (filesystem, git, etc.). Every tool call passes through a policy engine that can **allow**, **deny**, or **escalate** to the user for approval.
 - **Defense in depth.** Agent code runs in a V8 isolate with no direct access to the host. The only way out is through semantically meaningful MCP tool calls and every one is checked against policy.
 
-## Demo
-
-<p align="center">
-  <img src="demo.gif" alt="IronCurtain demo: agent clones a repo, policy escalates git_clone for approval, user approves, then auto-approve handles git push" width="800">
-</p>
-
-The agent clones a repository and edits a file. The policy engine escalates `git_clone` for human approval. After the user types `/approve`, the agent completes the task. On the second request ("ok. git push to origin please"), [auto-approve](#auto-approve-escalations) recognizes the explicit intent and approves `git_push` automatically — no interruption needed.
-
 ## Architecture
 
 IronCurtain supports two session modes with different trust models:
@@ -82,7 +83,7 @@ npm install
 export ANTHROPIC_API_KEY=sk-ant-...
 ```
 
-Or add it to `~/.ironcurtain/config.json` via `ironcurtain config`. Environment variables take precedence. Supported: `ANTHROPIC_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, `OPENAI_API_KEY`.
+You can also place keys in a `.env` file in the project root (loaded automatically via `dotenv`), or add them to `~/.ironcurtain/config.json` via `ironcurtain config`. Environment variables take precedence over config file values. Supported: `ANTHROPIC_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, `OPENAI_API_KEY`.
 
 **2. Run the first-start wizard** (runs automatically on first `ironcurtain start`, or explicitly):
 
@@ -128,6 +129,17 @@ Send one task and exit when the agent finishes:
 ironcurtain start "Summarize the files in the current directory"
 ```
 
+### Workspace mode
+
+Point the agent at an existing directory instead of a fresh sandbox:
+
+```bash
+ironcurtain start -w ./my-project "Fix the failing tests"
+ironcurtain start --workspace /home/user/repos/my-app
+```
+
+The workspace replaces the session sandbox as the agent's working area. All session infrastructure (logs, escalations, audit) still lives under `~/.ironcurtain/sessions/`. The path is validated to prevent use of sensitive directories (root, home, `~/.ironcurtain/`, or paths overlapping with protected paths).
+
 ### Session resume
 
 Resume a previous session's conversation history:
@@ -138,15 +150,26 @@ ironcurtain start --resume <session-id>
 
 Session IDs are printed on session start and stored under `~/.ironcurtain/sessions/`.
 
-### PTY mode and the escalation listener
+### Terminal multiplexer (recommended for Docker Agent Mode)
 
-PTY mode attaches your terminal directly to Claude Code running inside the Docker container. You get Claude Code's full interactive TUI — spinners, diffs, file previews, slash commands — while IronCurtain still mediates every tool call through its policy engine.
+The terminal multiplexer is the recommended way to use IronCurtain with Docker Agent Mode. It gives you the full power of your agent's interactive TUI (Claude Code or Goose) while IronCurtain mediates every tool call through its policy engine. All in a single terminal.
 
 ```bash
-ironcurtain start --pty
+ironcurtain mux
 ```
 
-**Why a separate escalation listener?** In PTY mode your terminal is fully occupied by Claude Code's raw TTY — there is no channel left to inject escalation prompts inline. Each PTY session registers itself in `~/.ironcurtain/pty-registry/` and a separate companion process handles approvals:
+**Key capabilities:**
+
+- **Full agent TUI** — The agent (Claude Code or Goose) runs in a PTY inside a Docker container with no network access. You interact with it exactly as if it were running locally.
+- **Inline escalation handling** — When a tool call needs approval, an escalation panel overlays the viewport. No separate terminal needed — press Ctrl-A to enter command mode, `/approve N` or `/deny N`, and return.
+- **Trusted user input** — Text typed in command mode (Ctrl-A) is captured on the host side before entering the container. This creates a verified intent signal that the [auto-approver](#auto-approve-escalations) can use — e.g., typing "push my changes to origin" will auto-approve a subsequent `git_push` escalation.
+- **Tab management** — Spawn multiple concurrent sessions (`/new`), switch between them (`/tab N`, Alt-1..9), close them (`/close`).
+
+See [DEVELOPER_GUIDE.md](DEVELOPER_GUIDE.md) for the full walkthrough: input modes, trusted input security model, escalation workflow, and keyboard reference.
+
+### PTY mode with a separate escalation listener
+
+An alternative to the mux — run a raw PTY session in one terminal and handle escalations in another:
 
 ```bash
 # Terminal 1 — interactive Claude Code session
@@ -156,33 +179,9 @@ ironcurtain start --pty
 ironcurtain escalation-listener
 ```
 
-**How session discovery works:**
-
-1. When `--pty` starts, it writes a registration file to `~/.ironcurtain/pty-registry/session-<id>.json` containing the session ID, escalation directory path, display label, and process PID.
-2. The escalation listener polls `pty-registry/` every second. It discovers new sessions, attaches an escalation watcher to each one, and detaches watchers when sessions end. Stale registrations (process PID no longer alive) are removed automatically, so a crashed PTY session doesn't leave phantom entries.
-
-**The escalation flow:**
-
-When a tool call is escalated, the PTY session emits a **BEL character** (`\x07`) — your terminal bell or visual flash signals that attention is needed. Switch to the listener terminal. The listener TUI re-renders in place: active sessions are listed with sequential display numbers, and each pending escalation shows the tool name, arguments, and the policy reason for the escalation.
-
-**Listener commands:**
-
-| Command        | Description                               |
-| -------------- | ----------------------------------------- |
-| `/approve N`   | Approve escalation #N                     |
-| `/deny N`      | Deny escalation #N                        |
-| `/approve all` | Approve all pending escalations           |
-| `/deny all`    | Deny all pending escalations              |
-| `/sessions`    | Show detailed session information         |
-| `/quit`        | Exit the listener                         |
-
-Escalation numbers are sequential across all sessions. If you have two active PTY sessions, their escalations share a single numbered list in the dashboard — escalation #3 might be from session [1] and #4 from session [2]. Use the number shown in the dashboard to resolve them.
+This workflow does not support trusted input or auto-approval for PTY sessions. The mux is recommended instead.
 
-**Multiple concurrent sessions:** The listener aggregates escalations from all active PTY sessions in one dashboard. Each session is assigned a display number (e.g., `Claude Code [1]`, `Claude Code [2]`) when it first appears.
-
-**Single-instance lock:** Only one escalation listener may run at a time, enforced via a PID-checked lock file at `~/.ironcurtain/escalation-listener.lock`. A stale lock from a crashed process is cleaned up automatically on the next start.
-
-**Emergency exit and terminal recovery:** Press `Ctrl-\` to trigger a graceful shutdown of the PTY session (stops containers, proxies, and performs async cleanup). If the process is killed ungracefully (e.g., `kill -9`), run `reset` in that terminal to restore normal terminal mode.
+**Emergency exit and terminal recovery:** Press `Ctrl-\` to trigger a graceful shutdown of the PTY session. If the process is killed ungracefully, run `reset` in that terminal to restore normal terminal mode.
 
 ### Signal messaging transport
 
@@ -195,19 +194,35 @@ ironcurtain bot             # Start the Signal bot daemon
 
 See [TRANSPORT.md](TRANSPORT.md) for setup instructions, architecture details, and why we chose Signal over alternatives like Telegram.
 
+### Daemon mode
+
+A unified long-running daemon that combines Signal messaging with scheduled cron jobs. Define recurring tasks with per-job security policies, and IronCurtain runs them headlessly on a cron schedule.
+
+```bash
+ironcurtain daemon add-job        # Interactive wizard to define a scheduled job
+ironcurtain daemon                # Start the daemon (Signal + cron)
+ironcurtain daemon --no-signal    # Cron-only mode (no Signal transport)
+ironcurtain daemon list-jobs      # List jobs with schedule and status
+ironcurtain daemon logs <id>      # Show recent run summaries
+```
+
+Each job has its own task description, security constitution (compiled into per-job policy rules), persistent workspace, optional git repo sync, and configurable resource budgets. Escalations are auto-denied in headless mode unless Signal is configured for approval routing.
+
+See [DAEMON.md](DAEMON.md) for the full setup guide, job definition reference, and troubleshooting.
+
 ## Session Commands
 
 Commands available during an **interactive** or **single-shot** session:
 
-| Command    | Description                                      |
-| ---------- | ------------------------------------------------ |
-| `/approve` | Approve the pending escalation                   |
-| `/deny`    | Deny the pending escalation                      |
-| `/budget`  | Show resource consumption (tokens, steps, cost)  |
-| `/logs`    | Display diagnostic events                        |
-| `/quit`    | End the session                                  |
+| Command    | Description                                     |
+| ---------- | ----------------------------------------------- |
+| `/approve` | Approve the pending escalation                  |
+| `/deny`    | Deny the pending escalation                     |
+| `/budget`  | Show resource consumption (tokens, steps, cost) |
+| `/logs`    | Display diagnostic events                       |
+| `/quit`    | End the session                                 |
 
-In **PTY mode**, use the escalation listener instead (see above) — the PTY terminal is occupied by Claude Code's TUI.
+In **PTY mode**, use the [terminal multiplexer](#terminal-multiplexer-recommended-for-docker-agent-mode) (`ironcurtain mux`) for inline escalation handling and trusted input support.
 
 ## Policy: Constitution → Enforcement
 
@@ -242,9 +257,9 @@ compiles to:
 
 ```json
 [
-  { "tool": "git_status", "decision": "allow",    "condition": { "directory": { "within": "$SANDBOX" } } },
-  { "tool": "git_diff",   "decision": "allow",    "condition": { "directory": { "within": "$SANDBOX" } } },
-  { "tool": "git_push",   "decision": "escalate", "reason": "Remote-contacting git operations require human approval" }
+  { "tool": "git_status", "decision": "allow", "condition": { "directory": { "within": "$SANDBOX" } } },
+  { "tool": "git_diff", "decision": "allow", "condition": { "directory": { "within": "$SANDBOX" } } },
+  { "tool": "git_push", "decision": "escalate", "reason": "Remote-contacting git operations require human approval" }
 ]
 ```
 
@@ -292,6 +307,7 @@ IronCurtain stores configuration and session data in `~/.ironcurtain/`:
 ├── generated/               # User-compiled policy artifacts (overrides package defaults)
 ├── signal-data/             # Signal transport persistent data (registration keys)
 ├── pty-registry/            # Active PTY session registrations (auto-managed)
+├── jobs/                    # Cron job definitions, workspaces, and run records
 ├── sessions/
 │   └── {sessionId}/
 │       ├── sandbox/         # Per-session filesystem sandbox
@@ -376,11 +392,11 @@ After compilation, review the updated `tool-annotations.json` and `compiled-poli
 
 IronCurtain ships with four pre-configured MCP servers. All tool calls are governed by your compiled policy.
 
-| Server         | Tools | Key capabilities                                                                               |
-| -------------- | ----- | ---------------------------------------------------------------------------------------------- |
-| **Filesystem** | 14    | Read, write, edit, search files; directory tree; move; diff calculation                        |
-| **Git**        | 27    | Full git workflow: status, diff, log, commit, branch, push/pull/fetch, clone, stash, blame     |
-| **Fetch**      | 2     | HTTP GET with HTML-to-markdown conversion; `web_search` (see [Web Search](#web-search))        |
+| Server         | Tools | Key capabilities                                                                                                  |
+| -------------- | ----- | ----------------------------------------------------------------------------------------------------------------- |
+| **Filesystem** | 14    | Read, write, edit, search files; directory tree; move; diff calculation                                           |
+| **Git**        | 27    | Full git workflow: status, diff, log, commit, branch, push/pull/fetch, clone, stash, blame                        |
+| **Fetch**      | 2     | HTTP GET with HTML-to-markdown conversion; `web_search` (see [Web Search](#web-search))                           |
 | **GitHub**     | 41    | Issues, PRs, code search, reviews via `ghcr.io/github/github-mcp-server`; requires a GitHub personal access token |
 
 Read-only operations are allowed by default policy; mutations (writes, pushes, PR creation) escalate for human approval.
@@ -411,17 +427,17 @@ See [docs/SECURITY_CONCERNS.md](docs/SECURITY_CONCERNS.md) for a detailed threat
 
 ## Troubleshooting
 
-| Issue                                       | Guidance                                                                                                                                                                                                                                              |
-| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Missing API key**                         | Set the environment variable (`ANTHROPIC_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, or `OPENAI_API_KEY`) or add the corresponding key to `~/.ironcurtain/config.json`.                                                                                 |
-| **Sandbox unavailable**                     | OS-level sandboxing requires `bubblewrap` and `socat`. Install both, or set `"sandboxPolicy": "warn"` in your MCP server config for development.                                                                                                      |
-| **Budget exhausted**                        | Adjust limits in `~/.ironcurtain/config.json` under `resourceBudget`. Set any individual limit to `null` to disable it.                                                                                                                               |
-| **Node version errors**                     | Node.js 22+ is required (`isolated-vm` needs `>=22.0.0`). Maximum supported is Node 25 (`<26`).                                                                                                                                                       |
-| **Policy doesn't match intent**             | Review `compiled-policy.json` to see the generated rules. Run `ironcurtain customize-policy` to refine your constitution, then `ironcurtain compile-policy` to recompile. Specific wording produces better rules — vague phrasing leads to vague policy. |
-| **Auto-approve not triggering**             | The auto-approver only approves when the user's message explicitly authorizes the action (e.g., "push to origin" for `git_push`). Vague messages always escalate to human review. Verify `autoApprove.enabled` is `true` in `config.json`.             |
-| **PTY terminal garbled after exit**         | Run `reset` in the PTY terminal to restore normal mode. This is needed when the process is killed ungracefully and raw mode is not restored.                                                                                                           |
-| **Escalation listener: "already running"** | Another listener holds the lock at `~/.ironcurtain/escalation-listener.lock`. The lock is auto-cleared if the previous process is dead. If it persists, check the PID in the lock file.                                                               |
-| **Signal bot not responding**               | Verify the signal-cli container is running (`docker ps \| grep ironcurtain-signal`). Check that Signal is configured (`ironcurtain setup-signal`). See [TRANSPORT.md](TRANSPORT.md) for detailed troubleshooting.                                     |
+| Issue                                   | Guidance                                                                                                                                                                                                                                                 |
+| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Missing API key**                     | Set the environment variable (`ANTHROPIC_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, or `OPENAI_API_KEY`) or add the corresponding key to `~/.ironcurtain/config.json`.                                                                                    |
+| **Sandbox unavailable**                 | OS-level sandboxing requires `bubblewrap` and `socat`. Install both, or set `"sandboxPolicy": "warn"` in your MCP server config for development.                                                                                                         |
+| **Budget exhausted**                    | Adjust limits in `~/.ironcurtain/config.json` under `resourceBudget`. Set any individual limit to `null` to disable it.                                                                                                                                  |
+| **Node version errors**                 | Node.js 22+ is required (`isolated-vm` needs `>=22.0.0`). Maximum supported is Node 25 (`<26`).                                                                                                                                                          |
+| **Policy doesn't match intent**         | Review `compiled-policy.json` to see the generated rules. Run `ironcurtain customize-policy` to refine your constitution, then `ironcurtain compile-policy` to recompile. Specific wording produces better rules — vague phrasing leads to vague policy. |
+| **Auto-approve not triggering**         | The auto-approver only approves when the user's message explicitly authorizes the action (e.g., "push to origin" for `git_push`). Vague messages always escalate to human review. Verify `autoApprove.enabled` is `true` in `config.json`.               |
+| **PTY/mux terminal garbled after exit** | Run `reset` in that terminal to restore normal mode. This is needed when the process is killed ungracefully and raw mode is not restored.                                                                                                                |
+| **Mux/listener: "already running"**     | Only one mux or escalation-listener can run at a time. The lock at `~/.ironcurtain/escalation-listener.lock` is auto-cleared if the previous process is dead. If it persists, check the PID in the lock file.                                            |
+| **Signal bot not responding**           | Verify the signal-cli container is running (`docker ps \| grep ironcurtain-signal`). Check that Signal is configured (`ironcurtain setup-signal`). See [TRANSPORT.md](TRANSPORT.md) for detailed troubleshooting.                                        |
 
 ## Development
 
@@ -450,7 +466,10 @@ src/
 ├── trusted-process/            # Policy engine, MCP proxy, audit log, escalation handler
 ├── pipeline/                   # Constitution → policy compilation pipeline
 ├── escalation/                 # Escalation listener: session registry, TUI dashboard, state
+├── mux/                        # Terminal multiplexer: PTY bridge, renderer, trusted input
 ├── signal/                     # Signal messaging transport (bot daemon, setup, formatting)
+├── daemon/                     # Unified daemon (Signal + cron scheduler, control socket)
+├── cron/                       # Cron job management (scheduler, job store, git sync, policy)
 ├── docker/                     # Docker agent mode, PTY session, MITM proxy, adapters
 ├── servers/                    # Built-in MCP servers (fetch, web search providers)
 └── types/                      # Shared type definitions

package/dist/cli-help.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Shared CLI help formatting module.
+ *
+ * Provides a declarative CommandSpec interface and formatting utilities
+ * so every subcommand produces consistent, aligned help output.
+ */
+export interface CommandOption {
+    /** The long flag name, without dashes (e.g., 'agent'). */
+    readonly flag: string;
+    /** Optional single-character short alias (e.g., 'a'). */
+    readonly short?: string;
+    /** Human-readable description. */
+    readonly description: string;
+    /** Placeholder for the value (e.g., '<name>'). Omit for boolean flags. */
+    readonly placeholder?: string;
+}
+export interface CommandSpec {
+    /** The full command name as invoked (e.g., 'ironcurtain daemon'). */
+    readonly name: string;
+    /** One-line summary of what the command does. */
+    readonly description: string;
+    /** Usage lines shown at the top. Each string is a separate line. */
+    readonly usage: readonly string[];
+    /** Named subcommands, displayed in a table after the usage block. */
+    readonly subcommands?: readonly {
+        readonly name: string;
+        readonly description: string;
+    }[];
+    /** Command-line options, displayed in a table after subcommands. */
+    readonly options?: readonly CommandOption[];
+    /** Example invocations shown at the bottom. */
+    readonly examples?: readonly string[];
+}
+/**
+ * Formats a CommandSpec into a complete help string.
+ *
+ * Layout:
+ *   <name> - <description>
+ *
+ *   Usage:
+ *     <usage lines>
+ *
+ *   Subcommands:      (if any)
+ *     <table>
+ *
+ *   Options:          (if any)
+ *     <table>
+ *
+ *   Examples:         (if any)
+ *     <lines>
+ */
+export declare function formatHelp(spec: CommandSpec): string;
+/**
+ * Prints formatted help to stderr.
+ */
+export declare function printHelp(spec: CommandSpec): void;
+/**
+ * Convenience: if `values.help` is truthy, prints help and returns true.
+ * Callers can use: `if (checkHelp(values, spec)) return;`
+ */
+export declare function checkHelp(values: {
+    help?: boolean;
+}, spec: CommandSpec): boolean;

package/dist/cli-help.js

@@ -0,0 +1,102 @@
+/**
+ * Shared CLI help formatting module.
+ *
+ * Provides a declarative CommandSpec interface and formatting utilities
+ * so every subcommand produces consistent, aligned help output.
+ */
+// ---------------------------------------------------------------------------
+// Formatting
+// ---------------------------------------------------------------------------
+/** Pads `text` with spaces on the right to reach at least `width` characters. */
+function pad(text, width) {
+    return text.length >= width ? text : text + ' '.repeat(width - text.length);
+}
+/** Formats a single option into its flag string (e.g., '-a, --agent <name>'). */
+function formatOptionFlag(opt) {
+    const parts = [];
+    if (opt.short) {
+        parts.push(`-${opt.short},`);
+    }
+    let longFlag = `--${opt.flag}`;
+    if (opt.placeholder) {
+        longFlag += ` ${opt.placeholder}`;
+    }
+    if (opt.short) {
+        parts.push(longFlag);
+    }
+    else {
+        // Indent to align with flags that have a short alias.
+        // "-X, " is 4 chars, so we add 4 spaces of leading indent.
+        parts.push(`    ${longFlag}`);
+    }
+    return parts.join(' ');
+}
+/**
+ * Renders a two-column table (label + description) with consistent alignment.
+ * Each row is indented by 2 spaces.
+ */
+function formatTable(rows) {
+    const maxLabel = rows.reduce((max, r) => Math.max(max, r.label.length), 0);
+    const colWidth = maxLabel + 2; // 2 spaces between columns
+    return rows.map((r) => `  ${pad(r.label, colWidth)}${r.description}`).join('\n');
+}
+/**
+ * Formats a CommandSpec into a complete help string.
+ *
+ * Layout:
+ *   <name> - <description>
+ *
+ *   Usage:
+ *     <usage lines>
+ *
+ *   Subcommands:      (if any)
+ *     <table>
+ *
+ *   Options:          (if any)
+ *     <table>
+ *
+ *   Examples:         (if any)
+ *     <lines>
+ */
+export function formatHelp(spec) {
+    const sections = [];
+    // Header
+    sections.push(`${spec.name} - ${spec.description}`);
+    // Usage
+    sections.push('Usage:\n' + spec.usage.map((u) => `  ${u}`).join('\n'));
+    // Subcommands
+    if (spec.subcommands && spec.subcommands.length > 0) {
+        const rows = spec.subcommands.map((s) => ({ label: s.name, description: s.description }));
+        sections.push('Subcommands:\n' + formatTable(rows));
+    }
+    // Options
+    if (spec.options && spec.options.length > 0) {
+        const rows = spec.options.map((o) => ({
+            label: formatOptionFlag(o),
+            description: o.description,
+        }));
+        sections.push('Options:\n' + formatTable(rows));
+    }
+    // Examples
+    if (spec.examples && spec.examples.length > 0) {
+        sections.push('Examples:\n' + spec.examples.map((e) => `  ${e}`).join('\n'));
+    }
+    return sections.join('\n\n');
+}
+/**
+ * Prints formatted help to stderr.
+ */
+export function printHelp(spec) {
+    console.error(formatHelp(spec));
+}
+/**
+ * Convenience: if `values.help` is truthy, prints help and returns true.
+ * Callers can use: `if (checkHelp(values, spec)) return;`
+ */
+export function checkHelp(values, spec) {
+    if (!values.help)
+        return false;
+    printHelp(spec);
+    return true;
+}
+//# sourceMappingURL=cli-help.js.map

package/dist/cli-help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgCH,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,iFAAiF;AACjF,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa;IACtC,OAAO,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,QAAQ,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,sDAAsD;QACtD,2DAA2D;QAC3D,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAuD;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,2BAA2B;IAE1D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS;IACT,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAEpD,QAAQ;IACR,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,cAAc;IACd,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,UAAU;IACV,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,WAAW;IACX,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAiB;IACzC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAA0B,EAAE,IAAiB;IACrE,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli.js

@@ -4,6 +4,7 @@ import { readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseArgs } from 'node:util';
+import { checkHelp, printHelp as printSpecHelp } from './cli-help.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 function getVersion() {
     // Works from both dist/ and src/ since package.json is one level up in either case.
@@ -11,53 +12,48 @@ function getVersion() {
     const pkg = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
     return pkg.version;
 }
-function printHelp() {
-    console.error(`
-ironcurtain - Secure agent runtime with policy-driven tool mediation
-
-Usage:
-  ironcurtain <command> [options]
-
-Commands:
-  start [task]         Run the agent (interactive or single-shot)
-  escalation-listener  Aggregate escalation notifications from PTY sessions
-  bot                  Run the Signal messaging transport daemon
-  setup                Run the first-start wizard (always runs)
-  setup-signal         Interactive Signal transport onboarding
-                       --re-trust: re-verify a changed identity key
-  annotate-tools       Classify MCP tool arguments via LLM
-  compile-policy       Compile constitution into enforceable policy rules
-  refresh-lists        Re-resolve dynamic lists without full recompilation
-  customize-policy     Customize your policy via LLM-assisted conversation
-  config               Edit configuration interactively
-  help                 Show this help message
-
-Options:
-  -h, --help           Show this help message
-  -v, --version        Show version number
-  -a, --agent <name>   Agent mode: builtin or claude-code (Docker)
-                       Auto-detects if omitted: Docker if available, else builtin
-  --pty                Attach terminal directly to agent PTY (Docker mode only)
-                       Ctrl-\\ is the emergency exit; run 'reset' to recover
-                       the terminal if killed ungracefully
-  --list-agents        List registered agent adapters
-
-Examples:
-  ironcurtain start "task"                        # Auto-detects Docker or builtin
-  ironcurtain start                              # Interactive session
-  ironcurtain start "Summarize files in ."       # Single-shot task
-  ironcurtain start --resume <session-id>        # Resume a session
-  ironcurtain start --agent claude-code "task"   # Docker: Claude Code
-  ironcurtain start --pty                        # PTY mode: interactive Docker terminal
-  ironcurtain start --list-agents                # List available agents
-  ironcurtain annotate-tools                     # Classify tool arguments
-  ironcurtain compile-policy                     # Compile policy from constitution
-  ironcurtain refresh-lists                      # Refresh all dynamic lists
-  ironcurtain refresh-lists --list major-news    # Refresh a single list
-  ironcurtain refresh-lists --with-mcp           # Include MCP-backed lists
-  ironcurtain customize-policy                   # Customize policy interactively
-`.trim());
-}
+const topLevelSpec = {
+    name: 'ironcurtain',
+    description: 'Secure agent runtime with policy-driven tool mediation',
+    usage: ['ironcurtain <command> [options]'],
+    subcommands: [
+        { name: 'start [task]', description: 'Run the agent (interactive or single-shot)' },
+        { name: 'daemon', description: 'Unified Signal + cron daemon' },
+        { name: 'mux', description: 'Terminal multiplexer for PTY sessions (requires node-pty)' },
+        { name: 'escalation-listener', description: 'Aggregate escalation notifications from PTY sessions' },
+        { name: 'bot', description: "Alias for 'daemon' (backward compatible)" },
+        { name: 'setup', description: 'Run the first-start wizard (always runs)' },
+        { name: 'setup-signal', description: 'Interactive Signal transport onboarding' },
+        { name: 'annotate-tools', description: 'Classify MCP tool arguments via LLM' },
+        { name: 'compile-policy', description: 'Compile constitution into enforceable policy rules' },
+        { name: 'refresh-lists', description: 'Re-resolve dynamic lists without full recompilation' },
+        { name: 'customize-policy', description: 'Customize your policy via LLM-assisted conversation' },
+        { name: 'config', description: 'Edit configuration interactively' },
+        { name: 'help', description: 'Show this help message' },
+    ],
+    options: [
+        { flag: 'help', short: 'h', description: 'Show this help message' },
+        { flag: 'version', short: 'v', description: 'Show version number' },
+    ],
+    examples: [
+        'ironcurtain start "Summarize files in ."       # Single-shot task',
+        'ironcurtain start                              # Interactive session',
+        'ironcurtain start --resume <session-id>        # Resume a session',
+        'ironcurtain start -w ./my-project "Fix bugs"   # Work in existing directory',
+        'ironcurtain start --agent claude-code "task"   # Docker: Claude Code',
+        'ironcurtain start --pty                        # PTY mode',
+        'ironcurtain daemon                             # Start the daemon',
+        'ironcurtain daemon list-jobs                   # List scheduled jobs',
+        'ironcurtain compile-policy                     # Compile policy',
+        'ironcurtain refresh-lists --with-mcp           # Refresh dynamic lists',
+    ],
+};
+const setupSignalSpec = {
+    name: 'ironcurtain setup-signal',
+    description: 'Interactive Signal transport onboarding',
+    usage: ['ironcurtain setup-signal [options]'],
+    options: [{ flag: 're-trust', description: 'Re-verify a changed identity key' }],
+};
 const { values, positionals } = parseArgs({
     args: process.argv.slice(2),
     options: {
@@ -72,8 +68,11 @@ if (values.version) {
     process.exit(0);
 }
 const subcommand = positionals[0];
-if (values.help || subcommand === 'help' || !subcommand) {
-    printHelp();
+// Show top-level help when no subcommand is given or 'help' is the subcommand.
+// When a recognized subcommand is present, --help passes through to the
+// subcommand handler via process.argv.slice(3).
+if (!subcommand || subcommand === 'help') {
+    printSpecHelp(topLevelSpec);
     process.exit(0);
 }
 switch (subcommand) {
@@ -112,10 +111,35 @@ switch (subcommand) {
         await runFirstStart();
         break;
     }
+    case 'daemon': {
+        const { runDaemonCommand } = await import('./daemon/daemon-command.js');
+        await runDaemonCommand(process.argv.slice(3));
+        break;
+    }
     case 'bot': {
+        // 'bot' is an alias for 'daemon' (backward compatibility)
+        const botArgs = process.argv.slice(3);
+        if (botArgs.includes('--help') || botArgs.includes('-h')) {
+            const { botSpec } = await import('./signal/bot-command.js');
+            printSpecHelp(botSpec);
+            break;
+        }
         const agentName = values.agent;
-        const { runBot } = await import('./signal/bot-command.js');
-        await runBot({ agent: agentName });
+        if (botArgs.some((a) => !a.startsWith('-'))) {
+            // Has subcommands -- route through daemon command
+            const { runDaemonCommand } = await import('./daemon/daemon-command.js');
+            await runDaemonCommand(botArgs);
+        }
+        else {
+            // No subcommands -- existing bot behavior
+            const { runBot } = await import('./signal/bot-command.js');
+            await runBot({ agent: agentName });
+        }
+        break;
+    }
+    case 'mux': {
+        const { main: muxMain } = await import('./mux/mux-command.js');
+        await muxMain(process.argv.slice(3));
         break;
     }
     case 'escalation-listener': {
@@ -124,6 +148,8 @@ switch (subcommand) {
         break;
     }
     case 'setup-signal': {
+        if (checkHelp({ help: process.argv.includes('--help') || process.argv.includes('-h') }, setupSignalSpec))
+            break;
         const reTrust = process.argv.includes('--re-trust');
         const { runSignalSetup } = await import('./signal/setup-signal.js');
         await runSignalSetup({ reTrust });
@@ -131,7 +157,7 @@ switch (subcommand) {
     }
     default:
         console.error(`Unknown command: ${subcommand}\n`);
-        printHelp();
+        printSpecHelp(topLevelSpec);
         process.exit(1);
 }
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,KAAK,CACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CH,CAAC,IAAI,EAAE,CACL,CAAC;AACJ,CAAC;AAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IACxD,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,aAAa,EAAoB,MAAM,eAAe,CAAC;AAExF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,YAAY,GAAgB;IAChC,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,CAAC,iCAAiC,CAAC;IAC1C,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,4CAA4C,EAAE;QACnF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;QAC/D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,2DAA2D,EAAE;QACzF,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,sDAAsD,EAAE;QACpG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACxE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC1E,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAChF,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,qCAAqC,EAAE;QAC9E,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,oDAAoD,EAAE;QAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAChG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;QACnE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,EAAE;KACxD;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE;QACnE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE;KACpE;IACD,QAAQ,EAAE;QACR,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,6EAA6E;QAC7E,sEAAsE;QACtE,2DAA2D;QAC3D,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;KACzE;CACF,CAAC;AAEF,MAAM,eAAe,GAAgB;IACnC,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,yCAAyC;IACtD,KAAK,EAAE,CAAC,oCAAoC,CAAC;IAC7C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;CACjF,CAAC;AAEF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,+EAA+E;AAC/E,wEAAwE;AACxE,gDAAgD;AAChD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACzC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC5D,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,kDAAkD;YAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;YAAE,MAAM;QAChH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}