@provos/ironcurtain 0.5.1 → 0.7.0

package/dist/mux/pty-bridge.d.ts

@@ -0,0 +1,79 @@
+/**
+ * PtyBridge -- bridges a node-pty child process to a headless xterm terminal.
+ *
+ * Data flow:
+ *   node-pty child -> raw bytes -> @xterm/headless Terminal.write()
+ *   @xterm/headless buffer -> readBuffer() -> MuxRenderer
+ *
+ * Each PtyBridge instance owns:
+ * - One node-pty child process (the `ironcurtain start --pty` invocation)
+ * - One @xterm/headless Terminal (the virtual terminal buffer)
+ * - The session's escalation directory path (for trusted input writes)
+ */
+import type { Terminal as TerminalType } from '@xterm/headless';
+import type { PtySessionRegistration } from '../docker/pty-types.js';
+export interface PtyBridge {
+    /** The headless terminal instance for reading buffer state. */
+    readonly terminal: TerminalType;
+    /** The session ID (extracted from child process registration). */
+    readonly sessionId: string | undefined;
+    /** The escalation directory path for this session. */
+    readonly escalationDir: string | undefined;
+    /** Whether the child process is still running. */
+    readonly alive: boolean;
+    /** The child process exit code, if exited. */
+    readonly exitCode: number | undefined;
+    /** The child process PID. */
+    readonly pid: number;
+    /**
+     * Writes raw bytes to the child process's PTY stdin.
+     * Used in PTY mode to forward keystrokes.
+     */
+    write(data: string): void;
+    /**
+     * Resizes the child PTY and the headless terminal.
+     */
+    resize(cols: number, rows: number): void;
+    /**
+     * Kills the child process and cleans up resources.
+     */
+    kill(): void;
+    /**
+     * Registers a callback invoked when new output arrives.
+     */
+    onOutput(callback: () => void): void;
+    /**
+     * Registers a callback invoked when the child process exits.
+     */
+    onExit(callback: (exitCode: number) => void): void;
+    /**
+     * Registers a callback invoked when the child's session registration
+     * is discovered (sessionId and escalationDir become available).
+     */
+    onSessionDiscovered(callback: (registration: PtySessionRegistration | null) => void): void;
+    /**
+     * Updates the registration if not already set (e.g. from late discovery
+     * via the escalation manager's registry polling). Fires any queued
+     * session callbacks.
+     */
+    updateRegistration(registration: PtySessionRegistration): void;
+}
+export interface PtyBridgeOptions {
+    /** Columns for the initial PTY size. */
+    readonly cols: number;
+    /** Rows for the initial PTY size. */
+    readonly rows: number;
+    /** The ironcurtain binary path (or runtime like tsx/node). */
+    readonly ironcurtainBin: string;
+    /** Extra args to insert before the 'start' subcommand (e.g. the script path when running via tsx). */
+    readonly prefixArgs?: string[];
+    /** Agent to pass to --agent flag. */
+    readonly agent: string;
+    /** Optional workspace directory path (passed as --workspace to the child). */
+    readonly workspacePath?: string;
+}
+/**
+ * Spawns a new `ironcurtain start --pty` child process via node-pty
+ * and wires it to a headless xterm terminal.
+ */
+export declare function createPtyBridge(options: PtyBridgeOptions): Promise<PtyBridge>;

package/dist/mux/pty-bridge.js

@@ -0,0 +1,151 @@
+/**
+ * PtyBridge -- bridges a node-pty child process to a headless xterm terminal.
+ *
+ * Data flow:
+ *   node-pty child -> raw bytes -> @xterm/headless Terminal.write()
+ *   @xterm/headless buffer -> readBuffer() -> MuxRenderer
+ *
+ * Each PtyBridge instance owns:
+ * - One node-pty child process (the `ironcurtain start --pty` invocation)
+ * - One @xterm/headless Terminal (the virtual terminal buffer)
+ * - The session's escalation directory path (for trusted input writes)
+ */
+import xtermHeadless from '@xterm/headless';
+const { Terminal } = xtermHeadless;
+import { getPtyRegistryDir } from '../config/paths.js';
+import { readActiveRegistrations } from '../escalation/session-registry.js';
+/** Session discovery timeout (ms). */
+const DISCOVERY_TIMEOUT_MS = 10_000;
+/** Session discovery poll interval (ms). */
+const DISCOVERY_POLL_MS = 200;
+/**
+ * Spawns a new `ironcurtain start --pty` child process via node-pty
+ * and wires it to a headless xterm terminal.
+ */
+export async function createPtyBridge(options) {
+    const nodePty = (await import('node-pty'));
+    const terminal = new Terminal({
+        cols: options.cols,
+        rows: options.rows,
+        allowProposedApi: true,
+    });
+    const spawnArgs = [...(options.prefixArgs ?? []), 'start', '--pty', '--agent', options.agent];
+    if (options.workspacePath) {
+        spawnArgs.push('--workspace', options.workspacePath);
+    }
+    const child = nodePty.spawn(options.ironcurtainBin, spawnArgs, {
+        cols: options.cols,
+        rows: options.rows,
+        name: 'xterm-256color',
+        env: process.env,
+    });
+    const outputCallbacks = [];
+    const exitCallbacks = [];
+    const sessionCallbacks = [];
+    let _alive = true;
+    let _exitCode;
+    let _registration;
+    // Wire child output to headless terminal
+    child.onData((data) => {
+        terminal.write(data, () => {
+            for (const cb of outputCallbacks)
+                cb();
+        });
+    });
+    const discoveryAbort = new AbortController();
+    child.onExit(({ exitCode }) => {
+        _alive = false;
+        _exitCode = exitCode;
+        discoveryAbort.abort();
+        // If discovery hasn't resolved yet, flush callbacks with null
+        if (_registration === undefined) {
+            _registration = null;
+            for (const cb of sessionCallbacks)
+                cb(null);
+            sessionCallbacks.length = 0;
+        }
+        for (const cb of exitCallbacks)
+            cb(exitCode);
+    });
+    // Start session discovery
+    void discoverSessionRegistration(child.pid, discoveryAbort.signal).then((registration) => {
+        if (!_alive)
+            return; // child already exited; ignore late result
+        _registration = registration;
+        for (const cb of sessionCallbacks)
+            cb(registration);
+        sessionCallbacks.length = 0;
+    });
+    return {
+        get terminal() {
+            return terminal;
+        },
+        get sessionId() {
+            return _registration?.sessionId;
+        },
+        get escalationDir() {
+            return _registration?.escalationDir;
+        },
+        get alive() {
+            return _alive;
+        },
+        get exitCode() {
+            return _exitCode;
+        },
+        get pid() {
+            return child.pid;
+        },
+        write(data) {
+            if (_alive)
+                child.write(data);
+        },
+        resize(cols, rows) {
+            if (_alive)
+                child.resize(cols, rows);
+            terminal.resize(cols, rows);
+        },
+        kill() {
+            if (_alive)
+                child.kill('SIGTERM');
+        },
+        onOutput(callback) {
+            outputCallbacks.push(callback);
+        },
+        onExit(callback) {
+            exitCallbacks.push(callback);
+        },
+        onSessionDiscovered(callback) {
+            // If already discovered, call immediately with the stored registration
+            if (_registration !== undefined || !_alive) {
+                callback(_registration ?? null);
+                return;
+            }
+            sessionCallbacks.push(callback);
+        },
+        updateRegistration(registration) {
+            if (_registration)
+                return; // already have one
+            _registration = registration;
+            for (const cb of sessionCallbacks)
+                cb(registration);
+            sessionCallbacks.length = 0;
+        },
+    };
+}
+/**
+ * Polls the PTY registry for a registration matching the child PID.
+ * Stops early if the abort signal fires (e.g. child exited).
+ */
+async function discoverSessionRegistration(childPid, signal) {
+    const registryDir = getPtyRegistryDir();
+    const deadline = Date.now() + DISCOVERY_TIMEOUT_MS;
+    while (Date.now() < deadline && !signal.aborted) {
+        const registrations = readActiveRegistrations(registryDir);
+        const match = registrations.find((r) => r.pid === childPid);
+        if (match)
+            return match;
+        await new Promise((r) => setTimeout(r, DISCOVERY_POLL_MS));
+    }
+    return null;
+}
+//# sourceMappingURL=pty-bridge.js.map

package/dist/mux/pty-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pty-bridge.js","sourceRoot":"","sources":["../../src/mux/pty-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AA6E5E,sCAAsC;AACtC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,4CAA4C;AAC5C,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAyB;IAC7D,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAA8B,CAAC;IAExE,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9F,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,SAAS,EAAE;QAC7D,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,gBAAgB;QACtB,GAAG,EAAE,OAAO,CAAC,GAA6B;KAC3C,CAAC,CAAC;IAEH,MAAM,eAAe,GAAsB,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAsC,EAAE,CAAC;IAC5D,MAAM,gBAAgB,GAAwD,EAAE,CAAC;IAEjF,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,SAA6B,CAAC;IAClC,IAAI,aAAwD,CAAC;IAE7D,yCAAyC;IACzC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QAC5B,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;YACxB,KAAK,MAAM,EAAE,IAAI,eAAe;gBAAE,EAAE,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;IAE7C,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAwB,EAAE,EAAE;QAClD,MAAM,GAAG,KAAK,CAAC;QACf,SAAS,GAAG,QAAQ,CAAC;QACrB,cAAc,CAAC,KAAK,EAAE,CAAC;QACvB,8DAA8D;QAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,aAAa,GAAG,IAAI,CAAC;YACrB,KAAK,MAAM,EAAE,IAAI,gBAAgB;gBAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5C,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,aAAa;YAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,KAAK,2BAA2B,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE;QACvF,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,2CAA2C;QAChE,aAAa,GAAG,YAAY,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,gBAAgB;YAAE,EAAE,CAAC,YAAY,CAAC,CAAC;QACpD,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,QAAQ;YACV,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,SAAS;YACX,OAAO,aAAa,EAAE,SAAS,CAAC;QAClC,CAAC;QACD,IAAI,aAAa;YACf,OAAO,aAAa,EAAE,aAAa,CAAC;QACtC,CAAC;QACD,IAAI,KAAK;YACP,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAAG;YACL,OAAO,KAAK,CAAC,GAAG,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,IAAY;YAChB,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,CAAC,IAAY,EAAE,IAAY;YAC/B,IAAI,MAAM;gBAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI;YACF,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,QAAQ,CAAC,QAAoB;YAC3B,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,CAAC,QAAoC;YACzC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,mBAAmB,CAAC,QAAsD;YACxE,uEAAuE;YACvE,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC3C,QAAQ,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAED,kBAAkB,CAAC,YAAoC;YACrD,IAAI,aAAa;gBAAE,OAAO,CAAC,mBAAmB;YAC9C,aAAa,GAAG,YAAY,CAAC;YAC7B,KAAK,MAAM,EAAE,IAAI,gBAAgB;gBAAE,EAAE,CAAC,YAAY,CAAC,CAAC;YACpD,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,2BAA2B,CACxC,QAAgB,EAChB,MAAmB;IAEnB,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;IAEnD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,aAAa,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QAC5D,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/mux/trusted-input.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Trusted input module for the terminal multiplexer.
+ *
+ * Writes user-context.json with a `source: "mux-trusted-input"` field
+ * that the auto-approver can check to distinguish trusted input from
+ * context written by the session (which is in-sandbox and untrusted
+ * in PTY mode).
+ */
+/**
+ * The user-context.json schema for mux trusted input.
+ */
+export interface TrustedUserContext {
+    /** The user's message text. */
+    readonly userMessage: string;
+    /** ISO 8601 timestamp when the input was captured. */
+    readonly timestamp: string;
+    /** Source identifier. Must be "mux-trusted-input" for auto-approver trust. */
+    readonly source: 'mux-trusted-input';
+}
+/**
+ * Writes a trusted user context file to the session's escalation directory.
+ * Uses atomicWriteJsonSync for crash-safe writes.
+ *
+ * @param escalationDir - Absolute path to the session's escalation directory
+ * @param userMessage - The user's message text
+ */
+export declare function writeTrustedUserContext(escalationDir: string, userMessage: string): void;

package/dist/mux/trusted-input.js

@@ -0,0 +1,27 @@
+/**
+ * Trusted input module for the terminal multiplexer.
+ *
+ * Writes user-context.json with a `source: "mux-trusted-input"` field
+ * that the auto-approver can check to distinguish trusted input from
+ * context written by the session (which is in-sandbox and untrusted
+ * in PTY mode).
+ */
+import { atomicWriteJsonSync } from '../escalation/escalation-watcher.js';
+import { resolve } from 'node:path';
+/**
+ * Writes a trusted user context file to the session's escalation directory.
+ * Uses atomicWriteJsonSync for crash-safe writes.
+ *
+ * @param escalationDir - Absolute path to the session's escalation directory
+ * @param userMessage - The user's message text
+ */
+export function writeTrustedUserContext(escalationDir, userMessage) {
+    const contextPath = resolve(escalationDir, 'user-context.json');
+    const context = {
+        userMessage,
+        timestamp: new Date().toISOString(),
+        source: 'mux-trusted-input',
+    };
+    atomicWriteJsonSync(contextPath, context);
+}
+//# sourceMappingURL=trusted-input.js.map

package/dist/mux/trusted-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-input.js","sourceRoot":"","sources":["../../src/mux/trusted-input.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,aAAqB,EAAE,WAAmB;IAChF,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAuB;QAClC,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,mBAAmB;KAC5B,CAAC;IACF,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/dist/mux/types.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Shared types for the terminal multiplexer (`ironcurtain mux`).
+ */
+import type { PtyBridge } from './pty-bridge.js';
+/** Input mode for the mux. */
+export type InputMode = 'pty' | 'command' | 'picker';
+/** A single tab in the mux. */
+export interface MuxTab {
+    /** Sequential tab number (1-based, for display). */
+    readonly number: number;
+    /** The PtyBridge instance for this tab. */
+    readonly bridge: PtyBridge;
+    /** Display label for the tab. */
+    label: string;
+    /** Whether the child process has exited. */
+    status: 'running' | 'exited';
+    /** Exit code if exited. */
+    exitCode?: number;
+    /** Whether escalation watching is available for this session. */
+    escalationAvailable: boolean;
+    /** Scroll offset into xterm buffer (null = live/bottom). */
+    scrollOffset: number | null;
+}
+/**
+ * Actions produced by the input handler for the orchestrator to execute.
+ */
+export type MuxAction = {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'write-pty';
+    readonly data: string;
+} | {
+    readonly kind: 'enter-command-mode';
+} | {
+    readonly kind: 'enter-pty-mode';
+} | {
+    readonly kind: 'command';
+    readonly command: string;
+    readonly args: string[];
+} | {
+    readonly kind: 'trusted-input';
+    readonly text: string;
+} | {
+    readonly kind: 'redraw-input';
+} | {
+    readonly kind: 'enter-picker-mode';
+} | {
+    readonly kind: 'picker-spawn';
+    readonly workspacePath?: string;
+} | {
+    readonly kind: 'picker-cancel';
+} | {
+    readonly kind: 'redraw-picker';
+} | {
+    readonly kind: 'scroll-up';
+    readonly amount: number;
+} | {
+    readonly kind: 'scroll-down';
+    readonly amount: number;
+} | {
+    readonly kind: 'quit';
+};
+/**
+ * Layout calculations for the screen regions.
+ */
+export interface Layout {
+    /** Y position of the tab bar (always 0). */
+    readonly tabBarY: number;
+    /** Y position of the PTY viewport. */
+    readonly ptyViewportY: number;
+    /** Height of the PTY viewport in rows (CONSTANT -- never changes on mode switch). */
+    readonly ptyViewportRows: number;
+    /** Y position of the footer. */
+    readonly footerY: number;
+    /** Total overlay rows in command mode (0 in PTY mode). */
+    readonly overlayRows: number;
+    /** Y position where overlay starts. */
+    readonly overlayY: number;
+    /** Height of the escalation panel within the overlay. */
+    readonly escalationPanelRows: number;
+    /** Rows available for the picker overlay (half of viewport). */
+    readonly pickerRows: number;
+    /** Y position where the picker overlay starts. */
+    readonly pickerY: number;
+    /** Actual number of input rows allocated (after clamping). */
+    readonly inputLineRows: number;
+}
+export declare const MAX_INPUT_LINE_ROWS = 6;
+/**
+ * Calculates the screen layout.
+ *
+ * The PTY viewport is CONSTANT: totalRows - TAB_BAR_ROWS - FOOTER_ROWS.
+ * In command mode, the overlay paints over the bottom rows of the PTY viewport.
+ *
+ * @param inputLineRows - Number of input rows requested (default 1). Clamped
+ *   between MIN_INPUT_LINE_ROWS and MAX_INPUT_LINE_ROWS, then further clamped
+ *   by available viewport space.
+ */
+export declare function calculateLayout(totalRows: number, mode: InputMode, pendingCount: number, inputLineRows?: number): Layout;

package/dist/mux/types.js

@@ -0,0 +1,57 @@
+/**
+ * Shared types for the terminal multiplexer (`ironcurtain mux`).
+ */
+// Layout constants
+const TAB_BAR_ROWS = 1;
+const FOOTER_ROWS = 2;
+const HINT_BAR_ROWS = 1;
+const MIN_INPUT_LINE_ROWS = 1;
+export const MAX_INPUT_LINE_ROWS = 6;
+const ESCALATION_ROWS_PER_ITEM = 4;
+const MAX_ESCALATION_PANEL_ROWS = 12;
+/**
+ * Calculates the screen layout.
+ *
+ * The PTY viewport is CONSTANT: totalRows - TAB_BAR_ROWS - FOOTER_ROWS.
+ * In command mode, the overlay paints over the bottom rows of the PTY viewport.
+ *
+ * @param inputLineRows - Number of input rows requested (default 1). Clamped
+ *   between MIN_INPUT_LINE_ROWS and MAX_INPUT_LINE_ROWS, then further clamped
+ *   by available viewport space.
+ */
+export function calculateLayout(totalRows, mode, pendingCount, inputLineRows = 1) {
+    // Ensure footer fits on screen; degrade gracefully on tiny terminals
+    const footerRows = Math.min(FOOTER_ROWS, Math.max(0, totalRows - TAB_BAR_ROWS));
+    const ptyViewportRows = Math.max(1, totalRows - TAB_BAR_ROWS - footerRows);
+    let overlayRows = 0;
+    let escalationPanelRows = 0;
+    let allocatedInputRows = MIN_INPUT_LINE_ROWS;
+    if (mode === 'command') {
+        if (pendingCount > 0) {
+            escalationPanelRows = Math.min(pendingCount * ESCALATION_ROWS_PER_ITEM, MAX_ESCALATION_PANEL_ROWS);
+        }
+        const actualInputRows = Math.min(Math.max(inputLineRows, MIN_INPUT_LINE_ROWS), MAX_INPUT_LINE_ROWS);
+        // Ensure overlay fits at least the hint bar + 1 input row, even on tiny terminals.
+        const minOverlay = Math.min(ptyViewportRows, HINT_BAR_ROWS + MIN_INPUT_LINE_ROWS);
+        overlayRows = Math.max(minOverlay, Math.min(escalationPanelRows + HINT_BAR_ROWS + actualInputRows, Math.floor(ptyViewportRows / 2), ptyViewportRows));
+        // Clamp escalation panel to fit within overlay budget, reserving
+        // space for the hint bar and at least one input row.
+        escalationPanelRows = Math.min(escalationPanelRows, Math.max(0, overlayRows - HINT_BAR_ROWS - MIN_INPUT_LINE_ROWS));
+        allocatedInputRows = Math.max(MIN_INPUT_LINE_ROWS, overlayRows - escalationPanelRows - HINT_BAR_ROWS);
+    }
+    const pickerRows = mode === 'picker' ? Math.min(Math.floor(ptyViewportRows / 2), ptyViewportRows) : 0;
+    const pickerY = TAB_BAR_ROWS + ptyViewportRows - pickerRows;
+    return {
+        tabBarY: 0,
+        ptyViewportY: TAB_BAR_ROWS,
+        ptyViewportRows,
+        footerY: TAB_BAR_ROWS + ptyViewportRows,
+        overlayRows,
+        overlayY: TAB_BAR_ROWS + ptyViewportRows - overlayRows,
+        escalationPanelRows,
+        pickerRows,
+        pickerY,
+        inputLineRows: mode === 'command' ? allocatedInputRows : 1,
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/mux/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/mux/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAsEH,mBAAmB;AACnB,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,IAAe,EAAE,YAAoB,EAAE,aAAa,GAAG,CAAC;IACzG,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC;IAE3E,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,kBAAkB,GAAG,mBAAmB,CAAC;IAE7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,wBAAwB,EAAE,yBAAyB,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,mBAAmB,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACpG,mFAAmF;QACnF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,GAAG,mBAAmB,CAAC,CAAC;QAClF,WAAW,GAAG,IAAI,CAAC,GAAG,CACpB,UAAU,EACV,IAAI,CAAC,GAAG,CAAC,mBAAmB,GAAG,aAAa,GAAG,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAClH,CAAC;QACF,iEAAiE;QACjE,qDAAqD;QACrD,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,mBAAmB,CAAC,CAAC,CAAC;QACpH,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,GAAG,mBAAmB,GAAG,aAAa,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,YAAY,GAAG,eAAe,GAAG,UAAU,CAAC;IAE5D,OAAO;QACL,OAAO,EAAE,CAAC;QACV,YAAY,EAAE,YAAY;QAC1B,eAAe;QACf,OAAO,EAAE,YAAY,GAAG,eAAe;QACvC,WAAW;QACX,QAAQ,EAAE,YAAY,GAAG,eAAe,GAAG,WAAW;QACtD,mBAAmB;QACnB,UAAU;QACV,OAAO;QACP,aAAa,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC"}

package/dist/pipeline/annotate.js

@@ -10,6 +10,7 @@ import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { permissiveJsonSchemaValidator } from '../trusted-process/permissive-output-validator.js';
 import chalk from 'chalk';
 import { computeHash, createPipelineLlm, loadExistingArtifact, loadPipelineConfig, showCached, writeArtifact, withSpinner, } from './pipeline-shared.js';
 import { annotateTools, buildAnnotationPrompt, validateAnnotationsHeuristic } from './tool-annotator.js';
@@ -33,7 +34,7 @@ async function connectAndDiscoverTools(mcpServers) {
                 if (transport.stderr) {
                     transport.stderr.on('data', () => { });
                 }
-                client = new Client({ name: 'ironcurtain-annotator', version: VERSION });
+                client = new Client({ name: 'ironcurtain-annotator', version: VERSION }, { jsonSchemaValidator: permissiveJsonSchemaValidator });
                 await client.connect(transport);
                 const toolsResult = await client.listTools();
                 totalTools += toolsResult.tools.length;

package/dist/pipeline/annotate.js.map

@@ -1 +1 @@
-{"version":3,"file":"annotate.js","sourceRoot":"","sources":["../../src/pipeline/annotate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEzG,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAWxC,KAAK,UAAU,uBAAuB,CACpC,UAA2C;IAE3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAClC,iCAAiC,EACjC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;QACxD,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,IAAI,GAAG,mCAAmC,UAAU,KAAK,CAAC;YAClE,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;oBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE;oBAClE,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;gBACH,kEAAkE;gBAClE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;oBACrB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,CAAC;gBACD,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAEhC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC7C,UAAU,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;gBAEvC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wDAAwD;gBACxD,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;oBACvB,CAAC;oBAAC,MAAM,CAAC;wBACP,sBAAsB;oBACxB,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC,EACD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,UAAU,WAAW,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAWD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,KAAgC;IACjF,OAAO,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,UAAkB,EAClB,KAAgC,EAChC,mBAAoD,EACpD,GAAkB;IAElB,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,8BAA8B,UAAU,EAAE,CAAC;IAE5D,uDAAuD;IACvD,MAAM,MAAM,GAAG,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAClC,QAAQ,EACR,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACtE,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,eAAe,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,EACD,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,QAAQ,KAAK,WAAW,CAAC,MAAM,qBAAqB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxG,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,wBAAwB,CAAC,iBAAgD;IAChF,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACrD,OAAO,CAAC,UAAU,CAAC,GAAG;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,WAAW;SAC1B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,KAAK,UAAU,aAAa,CAAC,WAA0C;IACrE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAErG,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,oBAAoB,CAC9C,MAAM,CAAC,YAAY,EACnB,uBAAuB,EACvB,MAAM,CAAC,mBAAmB,CAC3B,CAAC;QAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC9D,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YAC7C,UAAU,CAAC,QAAQ,GAAG,YAAY,UAAU,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC3F,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QACxE,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;QAEjF,MAAM,UAAU,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"annotate.js","sourceRoot":"","sources":["../../src/pipeline/annotate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAClG,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEzG,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAWxC,KAAK,UAAU,uBAAuB,CACpC,UAA2C;IAE3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAClC,iCAAiC,EACjC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;QACxD,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,IAAI,GAAG,mCAAmC,UAAU,KAAK,CAAC;YAClE,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;oBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE;oBAClE,MAAM,EAAE,MAAM;iBACf,CAAC,CAAC;gBACH,kEAAkE;gBAClE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;oBACrB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,CAAC;gBACD,MAAM,GAAG,IAAI,MAAM,CACjB,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,EACnD,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,CACvD,CAAC;gBACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAEhC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC7C,UAAU,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;gBAEvC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wDAAwD;gBACxD,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;oBACvB,CAAC;oBAAC,MAAM,CAAC;wBACP,sBAAsB;oBACxB,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC,EACD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,UAAU,WAAW,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAWD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,KAAgC;IACjF,OAAO,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,UAAkB,EAClB,KAAgC,EAChC,mBAA0D,EAC1D,GAAkB;IAElB,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,8BAA8B,UAAU,EAAE,CAAC;IAE5D,uDAAuD;IACvD,MAAM,MAAM,GAAG,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAClC,QAAQ,EACR,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACtE,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,GAAG,GAAG,QAAQ,eAAe,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,EACD,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,QAAQ,KAAK,WAAW,CAAC,MAAM,qBAAqB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxG,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,wBAAwB,CAAC,iBAAgD;IAChF,MAAM,OAAO,GAAyC,EAAE,CAAC;IACzD,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACrD,OAAO,CAAC,UAAU,CAAC,GAAG;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,WAAW;SAC1B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,KAAK,UAAU,aAAa,CAAC,WAA0C;IACrE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAErG,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,oBAAoB,CAC9C,MAAM,CAAC,YAAY,EACnB,uBAAuB,EACvB,MAAM,CAAC,mBAAmB,CAC3B,CAAC;QAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC9D,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YAC7C,UAAU,CAAC,QAAQ,GAAG,YAAY,UAAU,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC3F,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QACxE,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;QAEjF,MAAM,UAAU,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACrG,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/pipeline/compile.d.ts

@@ -1,40 +1,10 @@
 /**
  * CLI entry point for `ironcurtain compile-policy`.
  *
- * Orchestrates the policy compilation pipeline (stages 1-3):
- *   1. Compile constitution into declarative rules via LLM
- *   2. Generate test scenarios via LLM
- *   3. Verify compiled policy against real engine + LLM judge
+ * Thin wrapper over PipelineRunner that handles CLI-specific concerns:
+ * loading config, printing the progress banner, and exit codes.
  *
- * Requires tool-annotations.json to exist on disk. Run
- * `npm run annotate-tools` first to generate it.
+ * The core compile-verify-repair loop lives in PipelineRunner.
  */
-import type { MCPServerConfig } from '../config/types.js';
-import { type McpServerConnection } from './list-resolver.js';
-import type { CompiledRule, DiscardedScenario, ListDefinition, TestScenario } from './types.js';
-/**
- * Merges replacement scenarios from the regeneration session into the
- * scenario list. Removes corrected and discarded scenarios, then adds
- * unique replacements that don't duplicate any remaining scenario.
- */
-export declare function mergeReplacements(scenarios: TestScenario[], replacements: TestScenario[], corrections: ReadonlyArray<{
-    scenarioDescription: string;
-}>, discardedScenarios: ReadonlyArray<DiscardedScenario>): TestScenario[];
-/**
- * Resolves all `paths.within` values in compiled rules to their real
- * filesystem paths, following symlinks. This ensures that symlinked
- * directories (e.g., ~/Downloads -> /mnt/c/.../Downloads on WSL) are
- * resolved to their canonical form so that runtime path comparisons
- * match correctly.
- *
- * Falls back to path.resolve() if the path does not exist on disk.
- */
-export declare function resolveRulePaths(rules: CompiledRule[]): CompiledRule[];
-/**
- * Connects to MCP servers needed for data-backed list resolution.
- * Only connects to servers hinted by list definitions with requiresMcp: true.
- * Returns a map keyed by server name for the resolver.
- */
-export declare function connectMcpServersForLists(definitions: ListDefinition[], mcpServers: Record<string, MCPServerConfig>): Promise<Map<string, McpServerConnection>>;
-export declare function disconnectMcpServers(connections: Map<string, McpServerConnection>): Promise<void>;
+export { resolveRulePaths, mergeReplacements } from './pipeline-shared.js';
 export declare function main(): Promise<void>;