@provos/ironcurtain 0.6.0 → 0.7.0

package/dist/session/session-manager.d.ts

@@ -0,0 +1,105 @@
+/**
+ * SessionManager -- Unified session state management.
+ *
+ * Extracted from SignalBotDaemon to serve as the single owner of all
+ * managed session state. Both Signal-initiated and cron-initiated
+ * sessions register here for unified lifecycle management and
+ * escalation routing.
+ *
+ * This is the canonical location for SessionSource and ManagedSession
+ * types. The daemon module re-exports them for convenience.
+ */
+import type { Session } from './types.js';
+import type { Transport } from './transport.js';
+import type { JobId } from '../cron/types.js';
+/**
+ * Source discriminant for managed sessions.
+ * Determines cleanup behavior, notification routing, and
+ * message forwarding eligibility.
+ *
+ * - 'signal': interactive session created via Signal message.
+ *   Accepts follow-up messages via forwardToSession().
+ * - 'cron': headless session created by the cron scheduler.
+ *   Does NOT accept follow-up messages.
+ */
+export type SessionSource = {
+    readonly kind: 'signal';
+} | {
+    readonly kind: 'cron';
+    readonly jobId: JobId;
+    readonly jobName: string;
+};
+/**
+ * Unified managed session entry. Used for both Signal-initiated
+ * interactive sessions and cron-initiated headless sessions.
+ *
+ * The transport field uses the base Transport interface because
+ * cron sessions use HeadlessTransport. Code that needs
+ * Signal-specific methods must guard on source.kind === 'signal'.
+ */
+export interface ManagedSession {
+    readonly label: number;
+    readonly session: Session;
+    readonly transport: Transport;
+    readonly source: SessionSource;
+    messageInFlight: boolean;
+    pendingEscalationId: string | null;
+    escalationResolving: boolean;
+}
+/**
+ * Owns all managed session state. Both SignalBotDaemon and
+ * CronScheduler delegate to this class for session registration,
+ * lookup, and teardown.
+ *
+ * Invariants:
+ * - Labels are monotonically increasing integers starting at 1.
+ * - At most one session exists per label.
+ * - currentLabel is always either null or a valid label in the map.
+ */
+export declare class SessionManager {
+    private sessions;
+    private nextLabel;
+    /**
+     * The currently "focused" session label for Signal message routing.
+     * When a Signal message arrives without an explicit #N prefix, it
+     * is routed to this session.
+     *
+     * Only updated by register() for Signal sessions. Cron sessions
+     * do not steal Signal focus.
+     */
+    currentLabel: number | null;
+    /**
+     * Registers a new session and returns its assigned label.
+     *
+     * For Signal sessions: sets currentLabel to the new session.
+     * For cron sessions: currentLabel is NOT changed.
+     */
+    register(session: Session, transport: Transport, source: SessionSource): number;
+    /**
+     * Ends a session by label: closes the transport, closes the
+     * session, and removes it from the map.
+     *
+     * If the ended session was currentLabel, switches to the most
+     * recently registered remaining Signal session, or null if none.
+     */
+    end(label: number): Promise<void>;
+    /** Returns the ManagedSession for a label, or undefined. */
+    get(label: number): ManagedSession | undefined;
+    /** Returns all managed sessions (snapshot). */
+    all(): readonly ManagedSession[];
+    /** Returns managed sessions filtered by source kind. */
+    byKind(kind: SessionSource['kind']): readonly ManagedSession[];
+    /** Returns the number of active sessions. */
+    get size(): number;
+    /** Records that a session has a pending escalation. */
+    setPendingEscalation(label: number, escalationId: string): void;
+    /** Clears a session's pending escalation. */
+    clearPendingEscalation(label: number): void;
+    /** Returns sessions that have pending escalations. */
+    withPendingEscalation(): readonly ManagedSession[];
+    /**
+     * Finds the most recently registered Signal session label.
+     * Returns null if no Signal sessions exist.
+     */
+    private findMostRecentSignalLabel;
+}

package/dist/session/session-manager.js

@@ -0,0 +1,134 @@
+/**
+ * SessionManager -- Unified session state management.
+ *
+ * Extracted from SignalBotDaemon to serve as the single owner of all
+ * managed session state. Both Signal-initiated and cron-initiated
+ * sessions register here for unified lifecycle management and
+ * escalation routing.
+ *
+ * This is the canonical location for SessionSource and ManagedSession
+ * types. The daemon module re-exports them for convenience.
+ */
+import * as logger from '../logger.js';
+/**
+ * Owns all managed session state. Both SignalBotDaemon and
+ * CronScheduler delegate to this class for session registration,
+ * lookup, and teardown.
+ *
+ * Invariants:
+ * - Labels are monotonically increasing integers starting at 1.
+ * - At most one session exists per label.
+ * - currentLabel is always either null or a valid label in the map.
+ */
+export class SessionManager {
+    sessions = new Map();
+    nextLabel = 1;
+    /**
+     * The currently "focused" session label for Signal message routing.
+     * When a Signal message arrives without an explicit #N prefix, it
+     * is routed to this session.
+     *
+     * Only updated by register() for Signal sessions. Cron sessions
+     * do not steal Signal focus.
+     */
+    currentLabel = null;
+    /**
+     * Registers a new session and returns its assigned label.
+     *
+     * For Signal sessions: sets currentLabel to the new session.
+     * For cron sessions: currentLabel is NOT changed.
+     */
+    register(session, transport, source) {
+        const label = this.nextLabel++;
+        const managed = {
+            label,
+            session,
+            transport,
+            source,
+            messageInFlight: false,
+            pendingEscalationId: null,
+            escalationResolving: false,
+        };
+        this.sessions.set(label, managed);
+        // Only Signal sessions update currentLabel
+        if (source.kind === 'signal') {
+            this.currentLabel = label;
+        }
+        return label;
+    }
+    /**
+     * Ends a session by label: closes the transport, closes the
+     * session, and removes it from the map.
+     *
+     * If the ended session was currentLabel, switches to the most
+     * recently registered remaining Signal session, or null if none.
+     */
+    async end(label) {
+        const managed = this.sessions.get(label);
+        if (!managed)
+            return;
+        try {
+            managed.transport.close();
+        }
+        catch (err) {
+            logger.warn(`[SessionManager] Error closing transport for session #${label}: ${String(err)}`);
+        }
+        try {
+            await managed.session.close();
+        }
+        catch (err) {
+            logger.warn(`[SessionManager] Error closing session #${label}: ${String(err)}`);
+        }
+        this.sessions.delete(label);
+        // If the ended session was the current label, find a replacement
+        if (this.currentLabel === label) {
+            this.currentLabel = this.findMostRecentSignalLabel();
+        }
+    }
+    /** Returns the ManagedSession for a label, or undefined. */
+    get(label) {
+        return this.sessions.get(label);
+    }
+    /** Returns all managed sessions (snapshot). */
+    all() {
+        return [...this.sessions.values()];
+    }
+    /** Returns managed sessions filtered by source kind. */
+    byKind(kind) {
+        return [...this.sessions.values()].filter((m) => m.source.kind === kind);
+    }
+    /** Returns the number of active sessions. */
+    get size() {
+        return this.sessions.size;
+    }
+    /** Records that a session has a pending escalation. */
+    setPendingEscalation(label, escalationId) {
+        const managed = this.sessions.get(label);
+        if (managed) {
+            managed.pendingEscalationId = escalationId;
+        }
+    }
+    /** Clears a session's pending escalation. */
+    clearPendingEscalation(label) {
+        const managed = this.sessions.get(label);
+        if (managed) {
+            managed.pendingEscalationId = null;
+            managed.escalationResolving = false;
+        }
+    }
+    /** Returns sessions that have pending escalations. */
+    withPendingEscalation() {
+        return [...this.sessions.values()].filter((m) => m.pendingEscalationId !== null);
+    }
+    /**
+     * Finds the most recently registered Signal session label.
+     * Returns null if no Signal sessions exist.
+     */
+    findMostRecentSignalLabel() {
+        const signalSessions = this.byKind('signal');
+        if (signalSessions.length === 0)
+            return null;
+        return Math.max(...signalSessions.map((m) => m.label));
+    }
+}
+//# sourceMappingURL=session-manager.js.map

package/dist/session/session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../../src/session/session-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAkCvC;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAc;IACjB,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7C,SAAS,GAAG,CAAC,CAAC;IAEtB;;;;;;;OAOG;IACH,YAAY,GAAkB,IAAI,CAAC;IAEnC;;;;;OAKG;IACH,QAAQ,CAAC,OAAgB,EAAE,SAAoB,EAAE,MAAqB;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAmB;YAC9B,KAAK;YACL,OAAO;YACP,SAAS;YACT,MAAM;YACN,eAAe,EAAE,KAAK;YACtB,mBAAmB,EAAE,IAAI;YACzB,mBAAmB,EAAE,KAAK;SAC3B,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAElC,2CAA2C;QAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC5B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,CAAC;YACH,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,yDAAyD,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,2CAA2C,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE5B,iEAAiE;QACjE,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,+CAA+C;IAC/C,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,wDAAwD;IACxD,MAAM,CAAC,IAA2B;QAChC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,6CAA6C;IAC7C,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,uDAAuD;IACvD,oBAAoB,CAAC,KAAa,EAAE,YAAoB;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,mBAAmB,GAAG,YAAY,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,sBAAsB,CAAC,KAAa;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACnC,OAAO,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACtC,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,qBAAqB;QACnB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC;IACnF,CAAC;IAED;;;OAGG;IACK,yBAAyB;QAC/B,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/session/types.d.ts

@@ -180,6 +180,12 @@ export interface SessionOptions {
      * The transport uses this to clear the escalation banner and notify the user.
      */
     onEscalationExpired?: () => void;
+    /**
+     * Callback invoked when a pending escalation is resolved (approved or denied).
+     * Fires after the response file is written, regardless of whether the resolution
+     * was initiated by the transport or by the proxy (e.g., Signal approve command).
+     */
+    onEscalationResolved?: (escalationId: string, decision: 'approved' | 'denied') => void;
     /**
      * Callback invoked during message processing with diagnostic events.
      * Transports use this to display progress (e.g., tool call previews).
@@ -192,6 +198,27 @@ export interface SessionOptions {
      * Must be validated via validateWorkspacePath() before passing here.
      */
     workspacePath?: string;
+    /**
+     * When set, loads compiled-policy.json (and optionally
+     * dynamic-lists.json) from this directory instead of the global
+     * generated directory. Tool annotations are always loaded from
+     * the global location regardless of this setting.
+     *
+     * Used by cron sessions to load task-scoped policy.
+     */
+    policyDir?: string;
+    /**
+     * Additional content appended to the system prompt.
+     * Used by cron sessions to inject task context and workspace
+     * conventions.
+     */
+    systemPromptAugmentation?: string;
+    /**
+     * When true, disables the auto-approver for this session even if
+     * enabled in user config. Used by cron/headless sessions where there
+     * is no interactive user context to match escalations against.
+     */
+    disableAutoApprove?: boolean;
 }
 /**
  * The core session contract. A session is a stateful conversation

package/dist/session/workspace-validation.d.ts

@@ -6,6 +6,8 @@
  * as the allowedDirectory, so it must not overlap with protected paths
  * or sensitive system directories.
  */
+/** Returns true when `child` is equal to or nested inside `parent`. */
+export declare function isEqualOrInside(child: string, parent: string): boolean;
 /**
  * Validates and canonicalizes a workspace path.
  *

package/dist/session/workspace-validation.js

@@ -12,7 +12,7 @@ import { resolve } from 'node:path';
 import { expandTilde, resolveRealPath } from '../types/argument-roles.js';
 import { getIronCurtainHome } from '../config/paths.js';
 /** Returns true when `child` is equal to or nested inside `parent`. */
-function isEqualOrInside(child, parent) {
+export function isEqualOrInside(child, parent) {
     if (child === parent)
         return true;
     const prefix = parent === '/' ? '/' : parent + '/';
@@ -50,15 +50,16 @@ export function validateWorkspacePath(rawPath, protectedPaths) {
     if (isEqualOrInside(canonical, ironCurtainHome)) {
         throw new Error(`Workspace path is inside the IronCurtain home directory: ${canonical}`);
     }
-    // Bidirectional overlap check with protected paths
+    // Check that workspace is not inside a protected path.
+    // The reverse direction (protected path inside workspace) is intentionally
+    // NOT checked here — the PolicyEngine already protects those paths at
+    // runtime regardless of the allowedDirectory, so a workspace that happens
+    // to contain e.g. src/config/generated/ is perfectly safe.
     for (const pp of protectedPaths) {
         const protectedCanonical = resolveRealPath(pp);
         if (isEqualOrInside(canonical, protectedCanonical)) {
             throw new Error(`Workspace path overlaps with protected path: ${protectedCanonical}`);
         }
-        if (isEqualOrInside(protectedCanonical, canonical)) {
-            throw new Error(`Workspace would contain protected path ${protectedCanonical} — ` + `use a more specific subdirectory`);
-        }
     }
     return canonical;
 }

package/dist/session/workspace-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-validation.js","sourceRoot":"","sources":["../../src/session/workspace-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,uEAAuE;AACvE,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc;IACpD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;IACnD,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,cAAwB;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE5C,gCAAgC;IAChC,IAAI,IAAiC,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9D,IAAI,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,4DAA4D,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,mDAAmD;IACnD,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAChC,MAAM,kBAAkB,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QAE/C,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,gDAAgD,kBAAkB,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,eAAe,CAAC,kBAAkB,EAAE,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,0CAA0C,kBAAkB,KAAK,GAAG,kCAAkC,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"workspace-validation.js","sourceRoot":"","sources":["../../src/session/workspace-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc;IAC3D,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;IACnD,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,cAAwB;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE5C,gCAAgC;IAChC,IAAI,IAAiC,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9D,IAAI,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,4DAA4D,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,uDAAuD;IACvD,2EAA2E;IAC3E,sEAAsE;IACtE,0EAA0E;IAC1E,2DAA2D;IAC3D,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAChC,MAAM,kBAAkB,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QAE/C,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,gDAAgD,kBAAkB,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/signal/bot-command.d.ts

@@ -6,6 +6,8 @@
  * indefinitely. Sessions are created on demand when the user sends a
  * Signal message and destroyed when they end.
  */
+import type { CommandSpec } from '../cli-help.js';
+export declare const botSpec: CommandSpec;
 export interface BotOptions {
     /** Explicit agent selection (e.g., 'claude-code'). */
     agent?: string;

package/dist/signal/bot-command.js

@@ -15,6 +15,14 @@ import { SignalBotDaemon } from './signal-bot-daemon.js';
 import { createSignalContainerManager } from './signal-container.js';
 import { resolveSignalConfig } from './signal-config.js';
 import * as logger from '../logger.js';
+export const botSpec = {
+    name: 'ironcurtain bot',
+    description: 'Run the Signal transport (standalone, without cron scheduler)',
+    usage: ['ironcurtain bot [options]'],
+    options: [
+        { flag: 'agent', short: 'a', description: 'Agent mode: builtin or claude-code (Docker)', placeholder: '<name>' },
+    ],
+};
 export async function runBot(options = {}) {
     const userConfig = loadUserConfig();
     const signalConfig = resolveSignalConfig(userConfig);

package/dist/signal/bot-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"bot-command.js","sourceRoot":"","sources":["../../src/signal/bot-command.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAQvC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,UAAsB,EAAE;IACnD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAErD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sDAAsD;IACtD,6DAA6D;IAC7D,yDAAyD;IACzD,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,OAAO,CAAC,KAAiB,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAE5B,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAEtF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,MAAM,EAAE,YAAY;QACpB,gBAAgB;QAChB,IAAI;KACL,CAAC,CAAC;IAEH,gDAAgD;IAChD,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;QACzC,IAAI,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B;QAC/D,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAE7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC;IAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAEhD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"bot-command.js","sourceRoot":"","sources":["../../src/signal/bot-command.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAIvC,MAAM,CAAC,MAAM,OAAO,GAAgB;IAClC,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,+DAA+D;IAC5E,KAAK,EAAE,CAAC,2BAA2B,CAAC;IACpC,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,6CAA6C,EAAE,WAAW,EAAE,QAAQ,EAAE;KACjH;CACF,CAAC;AAOF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,UAAsB,EAAE;IACnD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAErD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sDAAsD;IACtD,6DAA6D;IAC7D,yDAAyD;IACzD,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,OAAO,CAAC,KAAiB,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAE5B,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAEtF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,MAAM,EAAE,YAAY;QACpB,gBAAgB;QAChB,IAAI;KACL,CAAC,CAAC;IAEH,gDAAgD;IAChD,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;QACzC,IAAI,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B;QAC/D,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAE7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC;IAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAEhD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC"}

package/dist/signal/format.d.ts

@@ -49,3 +49,30 @@ export declare function formatSessionList(sessions: SessionListEntry[], currentL
  * Prefixes a message with `[#N]` when multiple sessions are active.
  */
 export declare function prefixWithLabel(text: string, label: number, sessionCount: number): string;
+/**
+ * Information about a scheduled job for display in Signal.
+ * Dates are ISO strings (serialized by the control socket).
+ */
+export interface JobListEntry {
+    readonly job: {
+        readonly id: string;
+        readonly name: string;
+        readonly schedule: string;
+        readonly enabled: boolean;
+    };
+    readonly nextRun: string | null;
+    readonly lastRun: {
+        readonly outcome: {
+            readonly kind: string;
+            readonly message?: string;
+            readonly dimension?: string;
+        };
+        readonly startedAt: string;
+    } | undefined;
+    readonly isRunning: boolean;
+}
+/**
+ * Formats the /jobs command output.
+ * Shows each job with schedule, status, next run, and last run outcome.
+ */
+export declare function formatJobList(jobs: JobListEntry[]): string;

package/dist/signal/format.js

@@ -5,6 +5,7 @@
  * (**bold**, *italic*, `mono`, ~strike~). Output is intended
  * to be sent with `text_mode: "styled"`.
  */
+import { describeCronExpression, formatRelativeTime } from '../cron/format-utils.js';
 /** Maximum length for a single Signal message. */
 export const SIGNAL_MAX_MESSAGE_LENGTH = 2000;
 /**
@@ -128,6 +129,64 @@ export function prefixWithLabel(text, label, sessionCount) {
         return text;
     return `[#${label}] ${text}`;
 }
+/**
+ * Formats the /jobs command output.
+ * Shows each job with schedule, status, next run, and last run outcome.
+ */
+export function formatJobList(jobs) {
+    if (jobs.length === 0)
+        return 'No scheduled jobs.';
+    const lines = ['**Scheduled jobs:**'];
+    for (const entry of jobs) {
+        lines.push('');
+        lines.push(formatJobEntry(entry));
+    }
+    return lines.join('\n');
+}
+function formatJobEntry(entry) {
+    const { job, nextRun, lastRun, isRunning } = entry;
+    const lines = [];
+    // Header: name + status tags
+    const tags = [];
+    if (isRunning)
+        tags.push('[RUNNING]');
+    if (!job.enabled)
+        tags.push('[DISABLED]');
+    const tagSuffix = tags.length > 0 ? ' ' + tags.join(' ') : '';
+    lines.push(`**${job.name}** (\`${job.id}\`)${tagSuffix}`);
+    // Schedule
+    const scheduleDesc = describeCronExpression(job.schedule);
+    lines.push(`  Schedule: ${scheduleDesc}`);
+    // Next run
+    if (nextRun) {
+        lines.push(`  Next run: ${formatRelativeTime(new Date(nextRun))}`);
+    }
+    else if (!job.enabled) {
+        lines.push('  Next run: disabled');
+    }
+    else {
+        lines.push('  Next run: --');
+    }
+    // Last run
+    if (lastRun) {
+        const outcomeStr = formatRunOutcome(lastRun.outcome);
+        const timeStr = formatRelativeTime(new Date(lastRun.startedAt));
+        lines.push(`  Last run: ${outcomeStr}, ${timeStr}`);
+    }
+    return lines.join('\n');
+}
+function formatRunOutcome(outcome) {
+    switch (outcome.kind) {
+        case 'success':
+            return 'success';
+        case 'budget_exhausted':
+            return `budget exhausted (${outcome.dimension ?? 'unknown'})`;
+        case 'error':
+            return `error: ${outcome.message ?? 'unknown'}`;
+        default:
+            return outcome.kind;
+    }
+}
 // --- Private helpers ---
 function formatBudgetLine(label, current, limit, format) {
     const currentStr = format(current);

package/dist/signal/format.js.map

@@ -1 +1 @@
-{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/signal/format.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,kDAAkD;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA0B,EAAE,YAAqB;IACtF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B;IACtE,MAAM,QAAQ,GAAG,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,eAAe,QAAQ,6BAA6B,CAAC;IACpE,MAAM,QAAQ,GAAG,WAAW,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC;IACvE,MAAM,QAAQ,GAAG,gBAAgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,UAAU,GAAG,YAAY,OAAO,CAAC,MAAM,GAAG,CAAC;IACjD,MAAM,YAAY,GAAG,+BAA+B,CAAC;IAErD,OAAO;QACL,SAAS;QACT,MAAM;QACN,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,GAAG,YAAY;QACf,UAAU;QACV,SAAS;QACT,YAAY;QACZ,SAAS;KACV,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACtC,MAAM,KAAK,GAAa,CAAC,0BAA0B,CAAC,CAAC;IAErD,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClH,KAAK,CAAC,IAAI,CACR,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9G,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEtE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,OAAO,CACL,YAAY,UAAU,EAAE;QACxB,GAAG,UAAU,CAAC,SAAS,QAAQ;QAC/B,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG;QAC5C,OAAO,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IAErB,OAAO,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACpC,iDAAiD;QACjD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,0BAA0B;YAC1B,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,2BAA2B;YAC3B,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA4B,EAAE,YAA2B;IACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAExD,MAAM,KAAK,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,SAAS,aAAa,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,YAAoB;IAC/E,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,KAAK,KAAK,KAAK,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,0BAA0B;AAE1B,SAAS,gBAAgB,CAAC,KAAa,EAAE,OAAe,EAAE,KAAoB,EAAE,MAA6B;IAC3G,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,KAAK,KAAK,UAAU,aAAa,CAAC;IAClE,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,KAAK,KAAK,UAAU,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;AAClE,CAAC"}
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/signal/format.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAErF,kDAAkD;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA0B,EAAE,YAAqB;IACtF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B;IACtE,MAAM,QAAQ,GAAG,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,eAAe,QAAQ,6BAA6B,CAAC;IACpE,MAAM,QAAQ,GAAG,WAAW,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC;IACvE,MAAM,QAAQ,GAAG,gBAAgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,UAAU,GAAG,YAAY,OAAO,CAAC,MAAM,GAAG,CAAC;IACjD,MAAM,YAAY,GAAG,+BAA+B,CAAC;IAErD,OAAO;QACL,SAAS;QACT,MAAM;QACN,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,GAAG,YAAY;QACf,UAAU;QACV,SAAS;QACT,YAAY;QACZ,SAAS;KACV,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACtC,MAAM,KAAK,GAAa,CAAC,0BAA0B,CAAC,CAAC;IAErD,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClH,KAAK,CAAC,IAAI,CACR,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9G,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,aAAa,UAAU,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEtE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,OAAO,CACL,YAAY,UAAU,EAAE;QACxB,GAAG,UAAU,CAAC,SAAS,QAAQ;QAC/B,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG;QAC5C,OAAO,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IAErB,OAAO,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACpC,iDAAiD;QACjD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,0BAA0B;YAC1B,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,2BAA2B;YAC3B,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA4B,EAAE,YAA2B;IACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAExD,MAAM,KAAK,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,SAAS,aAAa,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,YAAoB;IAC/E,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,KAAK,KAAK,KAAK,IAAI,EAAE,CAAC;AAC/B,CAAC;AAyBD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoB;IAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAEnD,MAAM,KAAK,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc,CAAC,KAAmB;IACzC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,6BAA6B;IAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,MAAM,SAAS,EAAE,CAAC,CAAC;IAE1D,WAAW;IACX,MAAM,YAAY,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,eAAe,YAAY,EAAE,CAAC,CAAC;IAE1C,WAAW;IACX,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,eAAe,kBAAkB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;SAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/B,CAAC;IAED,WAAW;IACX,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,eAAe,UAAU,KAAK,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA+D;IACvF,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,kBAAkB;YACrB,OAAO,qBAAqB,OAAO,CAAC,SAAS,IAAI,SAAS,GAAG,CAAC;QAChE,KAAK,OAAO;YACV,OAAO,UAAU,OAAO,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;QAClD;YACE,OAAO,OAAO,CAAC,IAAI,CAAC;IACxB,CAAC;AACH,CAAC;AAED,0BAA0B;AAE1B,SAAS,gBAAgB,CAAC,KAAa,EAAE,OAAe,EAAE,KAAoB,EAAE,MAA6B;IAC3G,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,KAAK,KAAK,UAAU,aAAa,CAAC;IAClE,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,KAAK,KAAK,UAAU,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;AAClE,CAAC"}

package/dist/signal/signal-bot-daemon.d.ts

@@ -9,10 +9,15 @@
  * - Identity verification with TTL cache (5 min), fail-closed
  * - Escalation state with race prevention (per-session)
  * - Message sending via POST /v2/send with text_mode: "styled"
+ *
+ * Session state is owned by SessionManager (injected via constructor).
+ * This class only handles Signal-specific concerns: WebSocket, identity,
+ * message parsing, and command dispatch.
  */
 import { type ResolvedSignalConfig } from './signal-config.js';
 import type { SessionMode } from '../session/types.js';
 import type { SignalContainerManager } from './signal-container.js';
+import { SessionManager } from '../session/session-manager.js';
 /**
  * Signal message envelope received via WebSocket.
  * Only the fields relevant to IronCurtain are typed here;
@@ -46,20 +51,19 @@ export interface SignalBotDaemonOptions {
     readonly config: ResolvedSignalConfig;
     readonly containerManager: SignalContainerManager;
     readonly mode: SessionMode;
+    readonly sessionManager?: SessionManager;
 }
 export declare class SignalBotDaemon {
     private config;
     private readonly containerManager;
     private readonly mode;
+    private readonly sessionManager;
     private ws;
     private baseUrl;
     private closed;
     private reconnectAttempts;
     private static readonly MAX_RECONNECT_DELAY_MS;
     private static readonly BASE_RECONNECT_DELAY_MS;
-    private sessions;
-    private currentLabel;
-    private nextLabel;
     private readonly maxConcurrentSessions;
     private identityLocked;
     private lastIdentityCheckMs;
@@ -74,12 +78,23 @@ export declare class SignalBotDaemon {
      */
     private scheduleSessionOp;
     /**
-     * Starts the daemon. Returns a promise that resolves when
-     * shutdown() is called (e.g., SIGTERM/SIGINT).
+     * Connects the daemon: starts the Docker container, waits for
+     * health, connects WebSocket, and sends the online greeting.
+     * Throws if any step fails (container won't start, health timeout, etc.).
+     */
+    connect(): Promise<void>;
+    /**
+     * Blocks until shutdown() is called (e.g., SIGTERM/SIGINT).
+     * Call connect() first to establish the connection.
+     */
+    run(): Promise<void>;
+    /**
+     * Convenience: connects and then blocks until shutdown.
+     * Used by the standalone `ironcurtain bot` command.
      */
     start(): Promise<void>;
     /**
-     * Initiates graceful shutdown. Ends all active sessions,
+     * Initiates graceful shutdown. Ends all Signal sessions,
      * closes the WebSocket, and unblocks start().
      */
     shutdown(): Promise<void>;
@@ -93,12 +108,13 @@ export declare class SignalBotDaemon {
     private scheduleReconnect;
     private handleIncomingMessage;
     /**
-     * Routes a user message to the current session. Creates a new
+     * Routes a user message to the current Signal session. Creates a new
      * session if none exists. Handles BudgetExhaustedError by ending
      * the exhausted session and notifying the user.
      *
      * Supports one-shot `#N` prefix routing: `#2 do something` routes
      * "do something" to session #2 without changing currentLabel.
+     * Only Signal sessions accept forwarded messages.
      */
     private routeToSession;
     /**
@@ -107,34 +123,20 @@ export declare class SignalBotDaemon {
      */
     private forwardToSession;
     /**
-     * Creates a new session with a fresh SignalSessionTransport.
+     * Creates a new Signal session with a fresh SignalSessionTransport.
      * Follows the same pattern as index.ts: create transport,
      * wire callbacks, create session, start transport.
      * Returns the label of the new session.
      */
     private startNewSession;
-    /**
-     * Ends a specific session by label and cleans up.
-     * If it was the current session, auto-switches to the most recent remaining.
-     */
-    endSession(label: number): Promise<void>;
-    /**
-     * Convenience method: ends the current session (if any).
-     */
-    endCurrentSession(): Promise<void>;
-    /**
-     * Auto-switches currentLabel to the highest remaining label (most recent),
-     * or null if no sessions remain.
-     */
-    private autoSwitchCurrent;
     /**
      * Checks if the message is an escalation reply.
      * Accepts: approve, deny, /approve, /deny (case-insensitive).
      * Optionally with a session label: "approve #2", "/approve 2".
      *
-     * Routes to the session with a pending escalation. If multiple
-     * sessions have pending escalations and no label is specified,
-     * asks for disambiguation.
+     * Routes to the session with a pending escalation.
+     * Works across ALL session types (signal + cron) so that
+     * `approve #3` from Signal can approve a cron job's escalation.
      */
     private handleEscalationReply;
     /** Called by SignalSessionTransport when the session surfaces an escalation. */