@provos/ironcurtain 0.5.1 → 0.7.0

package/dist/types/argument-roles.js

@@ -181,6 +181,19 @@ const registryEntries = [
             serverNames: ['github'],
         },
     ],
+    [
+        'github-repo',
+        {
+            description: 'GitHub repository name (without owner prefix)',
+            isResourceIdentifier: true,
+            category: 'identifier',
+            canonicalize: lowercase,
+            annotationGuidance: 'Assign to arguments that identify a GitHub repository name (without the owner prefix). ' +
+                'Typically the "repo" parameter on GitHub API tools. ' +
+                'Always pair with the corresponding github-owner argument.',
+            serverNames: ['github'],
+        },
+    ],
     [
         'branch-name',
         {
@@ -231,6 +244,7 @@ const _ROLE_COMPLETENESS_CHECK = {
     'fetch-url': true,
     'git-remote-url': true,
     'github-owner': true,
+    'github-repo': true,
     'branch-name': true,
     'commit-message': true,
     none: true,
@@ -303,5 +317,119 @@ export function getIdentifierRoles() {
  * serverNames including 'filesystem', the fast path must be updated
  * to check for those roles before auto-allowing.
  */
-export const SANDBOX_SAFE_PATH_ROLES = new Set(['read-path', 'write-path', 'delete-path']);
+export const SANDBOX_SAFE_PATH_ROLES = new Set([
+    'read-path',
+    'write-path',
+    'delete-path',
+    'write-history',
+    'delete-history',
+]);
+/** Type guard: returns true if an ArgumentRoleSpec is a conditional block. */
+export function isConditionalRoles(spec) {
+    return !Array.isArray(spec) && 'default' in spec;
+}
+/**
+ * Extracts the static/default roles from an ArgumentRoleSpec.
+ * For static arrays, returns them directly.
+ * For conditional specs, returns the default (most-restrictive) roles.
+ *
+ * Used by pipeline stages that inspect annotations without a tool call context.
+ */
+export function extractDefaultRoles(spec) {
+    if (Array.isArray(spec))
+        return spec;
+    return spec.default;
+}
+/**
+ * Resolves a StoredToolAnnotation (which may contain conditional role specs)
+ * into a plain ToolAnnotation (where all args are ArgumentRole[]).
+ *
+ * This is the sole boundary where conditionals are evaluated. Every consumer
+ * downstream receives a ToolAnnotation with static role arrays.
+ *
+ * @param stored - The stored annotation (from JSON file / annotation map)
+ * @param callArgs - The actual tool call arguments
+ * @returns A ToolAnnotation with all conditional specs resolved
+ */
+export function resolveStoredAnnotation(stored, callArgs) {
+    // Fast path: if no args have conditional specs, avoid allocation
+    const hasConditionals = Object.values(stored.args).some((spec) => !Array.isArray(spec));
+    if (!hasConditionals) {
+        return stored;
+    }
+    const resolvedArgs = {};
+    for (const [argName, spec] of Object.entries(stored.args)) {
+        resolvedArgs[argName] = Array.isArray(spec) ? spec : evaluateConditionalRoles(spec, callArgs);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const { args: _rawArgs, ...rest } = stored;
+    return { ...rest, args: resolvedArgs };
+}
+/**
+ * Resolves an entire StoredToolAnnotationsFile to a plain ToolAnnotationsFile
+ * by flattening all conditional role specs to their default roles.
+ *
+ * This is the correct entry point for the policy compilation pipeline, which
+ * never has actual call arguments and should only see the flat ToolAnnotation
+ * shape. The policy engine resolves conditionals at evaluation time instead.
+ */
+export function resolveStoredAnnotationsFile(stored) {
+    return {
+        ...stored,
+        servers: Object.fromEntries(Object.entries(stored.servers).map(([serverName, server]) => [
+            serverName,
+            {
+                ...server,
+                tools: server.tools.map((tool) => {
+                    const resolvedArgs = {};
+                    for (const [argName, spec] of Object.entries(tool.args)) {
+                        resolvedArgs[argName] = extractDefaultRoles(spec);
+                    }
+                    const { args: _rawArgs, ...rest } = tool; // eslint-disable-line @typescript-eslint/no-unused-vars
+                    return { ...rest, args: resolvedArgs };
+                }),
+            },
+        ])),
+    };
+}
+/**
+ * Evaluates a conditional roles block against tool call arguments.
+ * First-match-wins: iterates through `when` clauses in order and
+ * returns the first matching entry's roles, or the default roles.
+ */
+function evaluateConditionalRoles(spec, callArgs) {
+    for (const entry of spec.when) {
+        if (evaluateCondition(entry.condition, callArgs)) {
+            return entry.roles;
+        }
+    }
+    return spec.default;
+}
+/**
+ * Evaluates a single RoleCondition against tool call arguments.
+ * Exactly one of equals/in/is should be set (enforced by Zod at parse time).
+ */
+function evaluateCondition(cond, callArgs) {
+    const value = callArgs[cond.arg];
+    if (cond.equals !== undefined) {
+        return value === cond.equals;
+    }
+    if (cond.in !== undefined) {
+        return cond.in.includes(value);
+    }
+    if (cond.is !== undefined) {
+        switch (cond.is) {
+            case 'present':
+                return cond.arg in callArgs && value !== null && value !== undefined;
+            case 'absent':
+                return !(cond.arg in callArgs) || value === null || value === undefined;
+            case 'truthy':
+                return cond.arg in callArgs && !!value;
+            case 'falsy':
+                return !(cond.arg in callArgs) || !value;
+        }
+    }
+    // No condition operator set -- should be caught by Zod validation
+    return false;
+}
 //# sourceMappingURL=argument-roles.js.map

package/dist/types/argument-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"argument-roles.js","sourceRoot":"","sources":["../../src/types/argument-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA6CnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,uFAAuF;QACvF,oDAAoD;QACpD,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,2DAA2D;gBAC3D,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,eAAe,GAAqC;IACxD;QACE,WAAW;QACX;YACE,WAAW,EAAE,mCAAmC;YAChD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,yEAAyE;gBACzE,mDAAmD;YACrD,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,YAAY;QACZ;YACE,WAAW,EAAE,yCAAyC;YACtD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,+EAA+E;gBAC/E,gEAAgE;YAClE,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gFAAgF;gBAChF,uFAAuF;YACzF,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,eAAe;QACf;YACE,WAAW,EAAE,qDAAqD;YAClE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gGAAgG;gBAChG,sFAAsF;gBACtF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,2DAA2D;YACxE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,8FAA8F;gBAC9F,oFAAoF;gBACpF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,WAAW;QACX;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,YAAY;YAC1B,kBAAkB,EAChB,iEAAiE;gBACjE,8CAA8C;YAChD,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,uDAAuD;YACpE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,sFAAsF;gBACtF,kGAAkG;YACpG,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,cAAc;QACd;YACE,WAAW,EAAE,gEAAgE;YAC7E,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE,SAAS;YACvB,kBAAkB,EAChB,iGAAiG;gBACjG,+DAA+D;YACjE,WAAW,EAAE,CAAC,QAAQ,CAAC;SACxB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,iBAAiB;YAC9B,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,iDAAiD;gBACjD,4FAA4F;gBAC5F,yEAAyE;YAC3E,WAAW,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;SAC/B;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,yBAAyB;YACtC,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAAE,oDAAoD,GAAG,kCAAkC;YAC7G,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,MAAM;QACN;YACE,WAAW,EAAE,mDAAmD;YAChE,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,kEAAkE;gBAClE,gFAAgF;SACnF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAA8C,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1G,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,wBAAwB,GAA+B;IAC3D,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,IAAI;IACtB,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,kBAAkB,CAAC,QAAsB;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,YAAY;IAC1B,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW;IACzB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB;IAChC,OAAO,kBAAkB,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA8B,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC"}
+{"version":3,"file":"argument-roles.js","sourceRoot":"","sources":["../../src/types/argument-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA8CnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,uFAAuF;QACvF,oDAAoD;QACpD,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,2DAA2D;gBAC3D,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,eAAe,GAAqC;IACxD;QACE,WAAW;QACX;YACE,WAAW,EAAE,mCAAmC;YAChD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,yEAAyE;gBACzE,mDAAmD;YACrD,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,YAAY;QACZ;YACE,WAAW,EAAE,yCAAyC;YACtD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,+EAA+E;gBAC/E,gEAAgE;YAClE,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gFAAgF;gBAChF,uFAAuF;YACzF,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,eAAe;QACf;YACE,WAAW,EAAE,qDAAqD;YAClE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gGAAgG;gBAChG,sFAAsF;gBACtF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,2DAA2D;YACxE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,8FAA8F;gBAC9F,oFAAoF;gBACpF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,WAAW;QACX;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,YAAY;YAC1B,kBAAkB,EAChB,iEAAiE;gBACjE,8CAA8C;YAChD,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,uDAAuD;YACpE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,sFAAsF;gBACtF,kGAAkG;YACpG,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,cAAc;QACd;YACE,WAAW,EAAE,gEAAgE;YAC7E,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE,SAAS;YACvB,kBAAkB,EAChB,iGAAiG;gBACjG,+DAA+D;YACjE,WAAW,EAAE,CAAC,QAAQ,CAAC;SACxB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,+CAA+C;YAC5D,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE,SAAS;YACvB,kBAAkB,EAChB,yFAAyF;gBACzF,sDAAsD;gBACtD,2DAA2D;YAC7D,WAAW,EAAE,CAAC,QAAQ,CAAC;SACxB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,iBAAiB;YAC9B,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,iDAAiD;gBACjD,4FAA4F;gBAC5F,yEAAyE;YAC3E,WAAW,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;SAC/B;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,yBAAyB;YACtC,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAAE,oDAAoD,GAAG,kCAAkC;YAC7G,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,MAAM;QACN;YACE,WAAW,EAAE,mDAAmD;YAChE,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,kEAAkE;gBAClE,gFAAgF;SACnF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAA8C,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1G,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,wBAAwB,GAA+B;IAC3D,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,IAAI;IACnB,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,IAAI;IACtB,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,kBAAkB,CAAC,QAAsB;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,YAAY;IAC1B,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW;IACzB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB;IAChC,OAAO,kBAAkB,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA8B,IAAI,GAAG,CAAC;IACxE,WAAW;IACX,YAAY;IACZ,aAAa;IACb,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAgBH,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAsB;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA4B,EAC5B,QAAiC;IAEjC,iEAAiE;IACjE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,MAAmC,CAAC;IAC7C,CAAC;IAED,MAAM,YAAY,GAAmC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,YAAY,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChG,CAAC;IACD,6DAA6D;IAC7D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC3C,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAiC;IAC5E,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3D,UAAU;YACV;gBACE,GAAG,MAAM;gBACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBAC/B,MAAM,YAAY,GAAmC,EAAE,CAAC;oBACxD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxD,YAAY,CAAC,OAAO,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;oBACpD,CAAC;oBACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,wDAAwD;oBAClG,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;gBACzC,CAAC,CAAC;aACH;SACF,CAAC,CACH;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,IAAsB,EAAE,QAAiC;IACzF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAmB,EAAE,QAAiC;IAC/E,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAkC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC1B,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;YAChB,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,GAAG,IAAI,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;YACvE,KAAK,QAAQ;gBACX,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;YAC1E,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC;YACzC,KAAK,OAAO;gBACV,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,OAAO,KAAK,CAAC;AACf,CAAC"}

package/docker/Dockerfile.goose

@@ -0,0 +1,34 @@
+FROM ironcurtain-base:latest
+
+# Install Goose CLI
+# The binary is distributed as a single statically-linked Rust executable.
+# Downloaded from GitHub releases and placed in /usr/local/bin/.
+USER root
+
+ARG GOOSE_VERSION=1.26.1
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends curl ca-certificates && \
+    ARCH=$(dpkg --print-architecture) && \
+    case "$ARCH" in \
+      amd64) GOOSE_ARCH=x86_64 ;; \
+      arm64) GOOSE_ARCH=aarch64 ;; \
+      *) echo "Unsupported arch: $ARCH" && exit 1 ;; \
+    esac && \
+    curl -fsSL "https://github.com/block/goose/releases/download/v${GOOSE_VERSION}/goose-${GOOSE_ARCH}-unknown-linux-gnu.tar.bz2" \
+      -o /tmp/goose.tar.bz2 && \
+    tar -xjf /tmp/goose.tar.bz2 -C /usr/local/bin/ && \
+    chmod +x /usr/local/bin/goose && \
+    rm -f /tmp/goose.tar.bz2 && \
+    apt-get purge -y curl && \
+    apt-get autoremove -y && \
+    rm -rf /var/lib/apt/lists/*
+
+# Entrypoint: bridges UDS proxy, writes Goose config, hands off to CMD
+COPY entrypoint-goose.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+# Pre-create Goose config directory
+USER codespace
+RUN mkdir -p /home/codespace/.config/goose
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

package/docker/entrypoint-goose.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# IronCurtain entrypoint for Goose containers.
+# Sets up proxy bridges, writes Goose config, then hands off to CMD.
+
+# 1. Bridge MITM proxy UDS to local TCP (same as Claude Code entrypoint)
+MITM_SOCK="/run/ironcurtain/mitm-proxy.sock"
+PROXY_PORT=18080
+if [ -S "$MITM_SOCK" ]; then
+  socat TCP-LISTEN:$PROXY_PORT,fork,reuseaddr UNIX-CONNECT:$MITM_SOCK &
+fi
+
+# 2. Copy MCP config from orientation mount to Goose's expected location.
+# The orientation dir is read-only mounted at /etc/ironcurtain/.
+GOOSE_CONFIG_DIR="$HOME/.config/goose"
+mkdir -p "$GOOSE_CONFIG_DIR"
+if [ -f /etc/ironcurtain/goose-config.yaml ]; then
+  cp /etc/ironcurtain/goose-config.yaml "$GOOSE_CONFIG_DIR/config.yaml"
+fi
+
+# 3. Load system prompt into env var for PTY mode scripts.
+# Non-PTY mode injects the prompt via --instructions per turn.
+if [ -f /etc/ironcurtain/system-prompt.txt ]; then
+  export IRONCURTAIN_SYSTEM_PROMPT
+  IRONCURTAIN_SYSTEM_PROMPT=$(cat /etc/ironcurtain/system-prompt.txt)
+fi
+
+# 4. Hand off to CMD
+# Non-PTY: CMD = "sleep infinity" (agent commands arrive via docker exec)
+# PTY:     CMD = socat PTY command from buildPtyCommand()
+exec "$@"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provos/ironcurtain",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "type": "module",
   "description": "Secure agent runtime with trusted process mediation",
   "license": "Apache-2.0",
@@ -73,6 +73,7 @@
     "@mozilla/readability": "^0.6.0",
     "@utcp/code-mode": "^1.2.11",
     "@utcp/mcp": "^1.1.1",
+    "@xterm/headless": "^6.0.0",
     "ai": "^6.0.104",
     "chalk": "^5.6.2",
     "cli-highlight": "^2.1.11",
@@ -87,6 +88,10 @@
     "uuid": "^13.0.0",
     "zod": "^4.3.6"
   },
+  "optionalDependencies": {
+    "node-pty": "^1.1.0",
+    "terminal-kit": "^3.1.2"
+  },
   "overrides": {
     "minimatch": "^10.2.1"
   },