@provos/ironcurtain 0.6.0 → 0.7.1

package/README.md

@@ -56,7 +56,7 @@ See [SANDBOXING.md](SANDBOXING.md) for the full architecture with diagrams, laye
 ### Prerequisites
 
 - Node.js 22+ (required by `isolated-vm`; maximum Node 25)
-- Docker (required for Docker Agent Mode and PTY mode)
+- Docker — not required but **strongly recommended** for Docker Agent Mode, which provides the strongest isolation
 - An API key for at least one LLM provider (Anthropic, Google, or OpenAI)
 
 ### Install
@@ -93,66 +93,13 @@ ironcurtain setup
 
 Walks you through GitHub token setup, web search provider, model selection, and other settings. Creates `~/.ironcurtain/config.json` with your choices.
 
-**3. Customize your policy** (optional but recommended):
+## Running IronCurtain
 
-```bash
-ironcurtain customize-policy
-```
-
-An LLM-assisted conversation that generates a constitution tailored to your workflow, saved to `~/.ironcurtain/constitution-user.md`. You can also edit this file directly.
-
-**4. Compile the policy:**
-
-```bash
-ironcurtain compile-policy
-```
-
-Translates your constitution into deterministic rules, generates test scenarios, and verifies them. Compiled artifacts go to `~/.ironcurtain/generated/`. The package ships with pre-compiled defaults — skip this step until you customize.
+IronCurtain ships with a default policy geared towards the developer experience — read-only operations are allowed, mutations (writes, pushes, PR creation) escalate for human approval. You can start using it immediately after setup.
 
-## Running Modes
+### Terminal multiplexer (recommended)
 
-### Interactive mode
-
-A multi-turn session where you type tasks and the agent responds:
-
-```bash
-ironcurtain start
-```
-
-Escalated tool calls pause the agent and prompt you with `/approve` or `/deny`.
-
-### Single-shot mode
-
-Send one task and exit when the agent finishes:
-
-```bash
-ironcurtain start "Summarize the files in the current directory"
-```
-
-### Workspace mode
-
-Point the agent at an existing directory instead of a fresh sandbox:
-
-```bash
-ironcurtain start -w ./my-project "Fix the failing tests"
-ironcurtain start --workspace /home/user/repos/my-app
-```
-
-The workspace replaces the session sandbox as the agent's working area. All session infrastructure (logs, escalations, audit) still lives under `~/.ironcurtain/sessions/`. The path is validated to prevent use of sensitive directories (root, home, `~/.ironcurtain/`, or paths overlapping with protected paths).
-
-### Session resume
-
-Resume a previous session's conversation history:
-
-```bash
-ironcurtain start --resume <session-id>
-```
-
-Session IDs are printed on session start and stored under `~/.ironcurtain/sessions/`.
-
-### Terminal multiplexer (recommended for Docker Agent Mode)
-
-The terminal multiplexer is the recommended way to use IronCurtain with Docker Agent Mode. It gives you the full power of Claude Code's interactive TUI — spinners, diffs, file previews, slash commands — while IronCurtain mediates every tool call through its policy engine. All in a single terminal.
+The recommended way to use IronCurtain. It gives you the full power of your agent's interactive TUI (Claude Code or Goose) while IronCurtain mediates every tool call through its policy engine — all in a single terminal.
 
 ```bash
 ironcurtain mux
@@ -160,53 +107,46 @@ ironcurtain mux
 
 **Key capabilities:**
 
-- **Full agent TUI** — Claude Code runs in a PTY inside a Docker container with no network access. You interact with it exactly as if it were running locally.
-- **Inline escalation handling** — When a tool call needs approval, an escalation panel overlays the viewport. No separate terminal needed — press Ctrl-A to enter command mode, `/approve N` or `/deny N`, and return.
+- **Full agent TUI** — The agent runs in a PTY inside a Docker container with no network access. You interact with it exactly as if it were running locally.
+- **Inline escalation handling** — When a tool call needs approval, an escalation panel overlays the viewport. Press Ctrl-A to enter command mode, `/approve N` or `/deny N`, and return.
 - **Trusted user input** — Text typed in command mode (Ctrl-A) is captured on the host side before entering the container. This creates a verified intent signal that the [auto-approver](#auto-approve-escalations) can use — e.g., typing "push my changes to origin" will auto-approve a subsequent `git_push` escalation.
 - **Tab management** — Spawn multiple concurrent sessions (`/new`), switch between them (`/tab N`, Alt-1..9), close them (`/close`).
 
 See [DEVELOPER_GUIDE.md](DEVELOPER_GUIDE.md) for the full walkthrough: input modes, trusted input security model, escalation workflow, and keyboard reference.
 
-### PTY mode with a separate escalation listener
+### Builtin agent (no Docker required)
 
-An alternative to the mux — run a raw PTY session in one terminal and handle escalations in another:
+For quick tasks or environments without Docker, IronCurtain's builtin agent runs entirely locally in a V8 sandbox:
 
 ```bash
-# Terminal 1 — interactive Claude Code session
-ironcurtain start --pty
-
-# Terminal 2 — approve or deny escalations from all active PTY sessions
-ironcurtain escalation-listener
+ironcurtain start                                    # Interactive multi-turn session
+ironcurtain start "Summarize the files in ./src"     # Single-shot mode
+ironcurtain start -w ./my-project "Fix the tests"    # Workspace mode
 ```
 
-This workflow does not support trusted input or auto-approval for PTY sessions. The mux is recommended instead.
+### Other running modes
 
-**Emergency exit and terminal recovery:** Press `Ctrl-\` to trigger a graceful shutdown of the PTY session. If the process is killed ungracefully, run `reset` in that terminal to restore normal terminal mode.
+IronCurtain also supports PTY mode with a separate escalation listener, a Signal messaging transport for mobile approval, and a daemon mode for scheduled cron jobs. See [RUNNING_MODES.md](RUNNING_MODES.md) for details.
 
-### Signal messaging transport
+## Customizing Your Policy
 
-Run IronCurtain sessions via Signal messages — send tasks, receive responses, and approve or deny escalations from your phone. All communication is end-to-end encrypted via the Signal protocol.
+The default policy works well for general development, but you can tailor it to your workflow:
+
+**1. Customize your constitution** (optional but recommended):
 
 ```bash
-ironcurtain setup-signal    # One-time setup wizard
-ironcurtain bot             # Start the Signal bot daemon
+ironcurtain customize-policy
 ```
 
-See [TRANSPORT.md](TRANSPORT.md) for setup instructions, architecture details, and why we chose Signal over alternatives like Telegram.
-
-## Session Commands
+An LLM-assisted conversation that generates a constitution tailored to your workflow, saved to `~/.ironcurtain/constitution-user.md`. You can also edit this file directly.
 
-Commands available during an **interactive** or **single-shot** session:
+**2. Compile the policy:**
 
-| Command    | Description                                     |
-| ---------- | ----------------------------------------------- |
-| `/approve` | Approve the pending escalation                  |
-| `/deny`    | Deny the pending escalation                     |
-| `/budget`  | Show resource consumption (tokens, steps, cost) |
-| `/logs`    | Display diagnostic events                       |
-| `/quit`    | End the session                                 |
+```bash
+ironcurtain compile-policy
+```
 
-In **PTY mode**, use the [terminal multiplexer](#terminal-multiplexer-recommended-for-docker-agent-mode) (`ironcurtain mux`) for inline escalation handling and trusted input support.
+Translates your constitution into deterministic rules, generates test scenarios, and verifies them. Compiled artifacts go to `~/.ironcurtain/generated/`.
 
 ## Policy: Constitution → Enforcement
 
@@ -260,7 +200,7 @@ Review the generated `~/.ironcurtain/generated/compiled-policy.json` — these a
 
 ## Web Search
 
-IronCurtain's fetch server includes a `web_search` tool backed by your choice of provider. Configure via `ironcurtain config` → **Web Search**, or directly in `~/.ironcurtain/config.json`:
+IronCurtain's fetch server includes a `web_search` tool backed by your choice of provider. Configure via `ironcurtain config` or directly in `~/.ironcurtain/config.json`:
 
 ```json
 {
@@ -291,6 +231,7 @@ IronCurtain stores configuration and session data in `~/.ironcurtain/`:
 ├── generated/               # User-compiled policy artifacts (overrides package defaults)
 ├── signal-data/             # Signal transport persistent data (registration keys)
 ├── pty-registry/            # Active PTY session registrations (auto-managed)
+├── jobs/                    # Cron job definitions, workspaces, and run records
 ├── sessions/
 │   └── {sessionId}/
 │       ├── sandbox/         # Per-session filesystem sandbox
@@ -451,6 +392,8 @@ src/
 ├── escalation/                 # Escalation listener: session registry, TUI dashboard, state
 ├── mux/                        # Terminal multiplexer: PTY bridge, renderer, trusted input
 ├── signal/                     # Signal messaging transport (bot daemon, setup, formatting)
+├── daemon/                     # Unified daemon (Signal + cron scheduler, control socket)
+├── cron/                       # Cron job management (scheduler, job store, git sync, policy)
 ├── docker/                     # Docker agent mode, PTY session, MITM proxy, adapters
 ├── servers/                    # Built-in MCP servers (fetch, web search providers)
 └── types/                      # Shared type definitions

package/dist/cli-help.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Shared CLI help formatting module.
+ *
+ * Provides a declarative CommandSpec interface and formatting utilities
+ * so every subcommand produces consistent, aligned help output.
+ */
+export interface CommandOption {
+    /** The long flag name, without dashes (e.g., 'agent'). */
+    readonly flag: string;
+    /** Optional single-character short alias (e.g., 'a'). */
+    readonly short?: string;
+    /** Human-readable description. */
+    readonly description: string;
+    /** Placeholder for the value (e.g., '<name>'). Omit for boolean flags. */
+    readonly placeholder?: string;
+}
+export interface CommandSpec {
+    /** The full command name as invoked (e.g., 'ironcurtain daemon'). */
+    readonly name: string;
+    /** One-line summary of what the command does. */
+    readonly description: string;
+    /** Usage lines shown at the top. Each string is a separate line. */
+    readonly usage: readonly string[];
+    /** Named subcommands, displayed in a table after the usage block. */
+    readonly subcommands?: readonly {
+        readonly name: string;
+        readonly description: string;
+    }[];
+    /** Command-line options, displayed in a table after subcommands. */
+    readonly options?: readonly CommandOption[];
+    /** Example invocations shown at the bottom. */
+    readonly examples?: readonly string[];
+}
+/**
+ * Formats a CommandSpec into a complete help string.
+ *
+ * Layout:
+ *   <name> - <description>
+ *
+ *   Usage:
+ *     <usage lines>
+ *
+ *   Subcommands:      (if any)
+ *     <table>
+ *
+ *   Options:          (if any)
+ *     <table>
+ *
+ *   Examples:         (if any)
+ *     <lines>
+ */
+export declare function formatHelp(spec: CommandSpec): string;
+/**
+ * Prints formatted help to stderr.
+ */
+export declare function printHelp(spec: CommandSpec): void;
+/**
+ * Convenience: if `values.help` is truthy, prints help and returns true.
+ * Callers can use: `if (checkHelp(values, spec)) return;`
+ */
+export declare function checkHelp(values: {
+    help?: boolean;
+}, spec: CommandSpec): boolean;

package/dist/cli-help.js

@@ -0,0 +1,102 @@
+/**
+ * Shared CLI help formatting module.
+ *
+ * Provides a declarative CommandSpec interface and formatting utilities
+ * so every subcommand produces consistent, aligned help output.
+ */
+// ---------------------------------------------------------------------------
+// Formatting
+// ---------------------------------------------------------------------------
+/** Pads `text` with spaces on the right to reach at least `width` characters. */
+function pad(text, width) {
+    return text.length >= width ? text : text + ' '.repeat(width - text.length);
+}
+/** Formats a single option into its flag string (e.g., '-a, --agent <name>'). */
+function formatOptionFlag(opt) {
+    const parts = [];
+    if (opt.short) {
+        parts.push(`-${opt.short},`);
+    }
+    let longFlag = `--${opt.flag}`;
+    if (opt.placeholder) {
+        longFlag += ` ${opt.placeholder}`;
+    }
+    if (opt.short) {
+        parts.push(longFlag);
+    }
+    else {
+        // Indent to align with flags that have a short alias.
+        // "-X, " is 4 chars, so we add 4 spaces of leading indent.
+        parts.push(`    ${longFlag}`);
+    }
+    return parts.join(' ');
+}
+/**
+ * Renders a two-column table (label + description) with consistent alignment.
+ * Each row is indented by 2 spaces.
+ */
+function formatTable(rows) {
+    const maxLabel = rows.reduce((max, r) => Math.max(max, r.label.length), 0);
+    const colWidth = maxLabel + 2; // 2 spaces between columns
+    return rows.map((r) => `  ${pad(r.label, colWidth)}${r.description}`).join('\n');
+}
+/**
+ * Formats a CommandSpec into a complete help string.
+ *
+ * Layout:
+ *   <name> - <description>
+ *
+ *   Usage:
+ *     <usage lines>
+ *
+ *   Subcommands:      (if any)
+ *     <table>
+ *
+ *   Options:          (if any)
+ *     <table>
+ *
+ *   Examples:         (if any)
+ *     <lines>
+ */
+export function formatHelp(spec) {
+    const sections = [];
+    // Header
+    sections.push(`${spec.name} - ${spec.description}`);
+    // Usage
+    sections.push('Usage:\n' + spec.usage.map((u) => `  ${u}`).join('\n'));
+    // Subcommands
+    if (spec.subcommands && spec.subcommands.length > 0) {
+        const rows = spec.subcommands.map((s) => ({ label: s.name, description: s.description }));
+        sections.push('Subcommands:\n' + formatTable(rows));
+    }
+    // Options
+    if (spec.options && spec.options.length > 0) {
+        const rows = spec.options.map((o) => ({
+            label: formatOptionFlag(o),
+            description: o.description,
+        }));
+        sections.push('Options:\n' + formatTable(rows));
+    }
+    // Examples
+    if (spec.examples && spec.examples.length > 0) {
+        sections.push('Examples:\n' + spec.examples.map((e) => `  ${e}`).join('\n'));
+    }
+    return sections.join('\n\n');
+}
+/**
+ * Prints formatted help to stderr.
+ */
+export function printHelp(spec) {
+    console.error(formatHelp(spec));
+}
+/**
+ * Convenience: if `values.help` is truthy, prints help and returns true.
+ * Callers can use: `if (checkHelp(values, spec)) return;`
+ */
+export function checkHelp(values, spec) {
+    if (!values.help)
+        return false;
+    printHelp(spec);
+    return true;
+}
+//# sourceMappingURL=cli-help.js.map

package/dist/cli-help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgCH,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,iFAAiF;AACjF,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa;IACtC,OAAO,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,QAAQ,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,sDAAsD;QACtD,2DAA2D;QAC3D,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAuD;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,2BAA2B;IAE1D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS;IACT,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAEpD,QAAQ;IACR,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,cAAc;IACd,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,UAAU;IACV,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,WAAW;IACX,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAiB;IACzC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAA0B,EAAE,IAAiB;IACrE,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli.js

@@ -4,6 +4,7 @@ import { readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseArgs } from 'node:util';
+import { checkHelp, printHelp as printSpecHelp } from './cli-help.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 function getVersion() {
     // Works from both dist/ and src/ since package.json is one level up in either case.
@@ -11,57 +12,49 @@ function getVersion() {
     const pkg = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
     return pkg.version;
 }
-function printHelp() {
-    console.error(`
-ironcurtain - Secure agent runtime with policy-driven tool mediation
-
-Usage:
-  ironcurtain <command> [options]
-
-Commands:
-  start [task]         Run the agent (interactive or single-shot)
-  mux                  Terminal multiplexer for PTY sessions (requires node-pty)
-  escalation-listener  Aggregate escalation notifications from PTY sessions
-  bot                  Run the Signal messaging transport daemon
-  setup                Run the first-start wizard (always runs)
-  setup-signal         Interactive Signal transport onboarding
-                       --re-trust: re-verify a changed identity key
-  annotate-tools       Classify MCP tool arguments via LLM
-  compile-policy       Compile constitution into enforceable policy rules
-  refresh-lists        Re-resolve dynamic lists without full recompilation
-  customize-policy     Customize your policy via LLM-assisted conversation
-  config               Edit configuration interactively
-  help                 Show this help message
-
-Options:
-  -h, --help           Show this help message
-  -v, --version        Show version number
-  -a, --agent <name>   Agent mode: builtin or claude-code (Docker)
-                       Auto-detects if omitted: Docker if available, else builtin
-  -w, --workspace <path>  Use an existing directory as the agent's workspace
-                       instead of creating a fresh sandbox
-  --pty                Attach terminal directly to agent PTY (Docker mode only)
-                       Ctrl-\\ is the emergency exit; run 'reset' to recover
-                       the terminal if killed ungracefully
-  --list-agents        List registered agent adapters
-
-Examples:
-  ironcurtain start "task"                        # Auto-detects Docker or builtin
-  ironcurtain start                              # Interactive session
-  ironcurtain start "Summarize files in ."       # Single-shot task
-  ironcurtain start --resume <session-id>        # Resume a session
-  ironcurtain start -w ./my-project "Fix bugs"   # Work in existing directory
-  ironcurtain start --agent claude-code "task"   # Docker: Claude Code
-  ironcurtain start --pty                        # PTY mode: interactive Docker terminal
-  ironcurtain start --list-agents                # List available agents
-  ironcurtain annotate-tools                     # Classify tool arguments
-  ironcurtain compile-policy                     # Compile policy from constitution
-  ironcurtain refresh-lists                      # Refresh all dynamic lists
-  ironcurtain refresh-lists --list major-news    # Refresh a single list
-  ironcurtain refresh-lists --with-mcp           # Include MCP-backed lists
-  ironcurtain customize-policy                   # Customize policy interactively
-`.trim());
-}
+const topLevelSpec = {
+    name: 'ironcurtain',
+    description: 'Secure agent runtime with policy-driven tool mediation',
+    usage: ['ironcurtain <command> [options]'],
+    subcommands: [
+        { name: 'start [task]', description: 'Run the agent (interactive or single-shot)' },
+        { name: 'daemon', description: 'Unified Signal + cron daemon' },
+        { name: 'mux', description: 'Terminal multiplexer for PTY sessions (requires node-pty)' },
+        { name: 'escalation-listener', description: 'Aggregate escalation notifications from PTY sessions' },
+        { name: 'bot', description: "Alias for 'daemon' (backward compatible)" },
+        { name: 'persona', description: 'Manage personas (named policy profiles)' },
+        { name: 'setup', description: 'Run the first-start wizard (always runs)' },
+        { name: 'setup-signal', description: 'Interactive Signal transport onboarding' },
+        { name: 'annotate-tools', description: 'Classify MCP tool arguments via LLM' },
+        { name: 'compile-policy', description: 'Compile constitution into enforceable policy rules' },
+        { name: 'refresh-lists', description: 'Re-resolve dynamic lists without full recompilation' },
+        { name: 'customize-policy', description: 'Customize your policy via LLM-assisted conversation' },
+        { name: 'config', description: 'Edit configuration interactively' },
+        { name: 'help', description: 'Show this help message' },
+    ],
+    options: [
+        { flag: 'help', short: 'h', description: 'Show this help message' },
+        { flag: 'version', short: 'v', description: 'Show version number' },
+    ],
+    examples: [
+        'ironcurtain start "Summarize files in ."       # Single-shot task',
+        'ironcurtain start                              # Interactive session',
+        'ironcurtain start --resume <session-id>        # Resume a session',
+        'ironcurtain start -w ./my-project "Fix bugs"   # Work in existing directory',
+        'ironcurtain start --agent claude-code "task"   # Docker: Claude Code',
+        'ironcurtain start --pty                        # PTY mode',
+        'ironcurtain daemon                             # Start the daemon',
+        'ironcurtain daemon list-jobs                   # List scheduled jobs',
+        'ironcurtain compile-policy                     # Compile policy',
+        'ironcurtain refresh-lists --with-mcp           # Refresh dynamic lists',
+    ],
+};
+const setupSignalSpec = {
+    name: 'ironcurtain setup-signal',
+    description: 'Interactive Signal transport onboarding',
+    usage: ['ironcurtain setup-signal [options]'],
+    options: [{ flag: 're-trust', description: 'Re-verify a changed identity key' }],
+};
 const { values, positionals } = parseArgs({
     args: process.argv.slice(2),
     options: {
@@ -76,8 +69,11 @@ if (values.version) {
     process.exit(0);
 }
 const subcommand = positionals[0];
-if (values.help || subcommand === 'help' || !subcommand) {
-    printHelp();
+// Show top-level help when no subcommand is given or 'help' is the subcommand.
+// When a recognized subcommand is present, --help passes through to the
+// subcommand handler via process.argv.slice(3).
+if (!subcommand || subcommand === 'help') {
+    printSpecHelp(topLevelSpec);
     process.exit(0);
 }
 switch (subcommand) {
@@ -111,15 +107,40 @@ switch (subcommand) {
         await runConfigCommand();
         break;
     }
+    case 'persona': {
+        const { main: personaMain } = await import('./persona/persona-command.js');
+        await personaMain(process.argv.slice(3));
+        break;
+    }
     case 'setup': {
         const { runFirstStart } = await import('./config/first-start.js');
         await runFirstStart();
         break;
     }
+    case 'daemon': {
+        const { runDaemonCommand } = await import('./daemon/daemon-command.js');
+        await runDaemonCommand(process.argv.slice(3));
+        break;
+    }
     case 'bot': {
+        // 'bot' is an alias for 'daemon' (backward compatibility)
+        const botArgs = process.argv.slice(3);
+        if (botArgs.includes('--help') || botArgs.includes('-h')) {
+            const { botSpec } = await import('./signal/bot-command.js');
+            printSpecHelp(botSpec);
+            break;
+        }
         const agentName = values.agent;
-        const { runBot } = await import('./signal/bot-command.js');
-        await runBot({ agent: agentName });
+        if (botArgs.some((a) => !a.startsWith('-'))) {
+            // Has subcommands -- route through daemon command
+            const { runDaemonCommand } = await import('./daemon/daemon-command.js');
+            await runDaemonCommand(botArgs);
+        }
+        else {
+            // No subcommands -- existing bot behavior
+            const { runBot } = await import('./signal/bot-command.js');
+            await runBot({ agent: agentName });
+        }
         break;
     }
     case 'mux': {
@@ -133,6 +154,8 @@ switch (subcommand) {
         break;
     }
     case 'setup-signal': {
+        if (checkHelp({ help: process.argv.includes('--help') || process.argv.includes('-h') }, setupSignalSpec))
+            break;
         const reTrust = process.argv.includes('--re-trust');
         const { runSignalSetup } = await import('./signal/setup-signal.js');
         await runSignalSetup({ reTrust });
@@ -140,7 +163,7 @@ switch (subcommand) {
     }
     default:
         console.error(`Unknown command: ${subcommand}\n`);
-        printHelp();
+        printSpecHelp(topLevelSpec);
         process.exit(1);
 }
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,KAAK,CACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDH,CAAC,IAAI,EAAE,CACL,CAAC;AACJ,CAAC;AAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IACxD,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnC,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,aAAa,EAAoB,MAAM,eAAe,CAAC;AAExF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,YAAY,GAAgB;IAChC,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,CAAC,iCAAiC,CAAC;IAC1C,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,4CAA4C,EAAE;QACnF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;QAC/D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,2DAA2D,EAAE;QACzF,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,sDAAsD,EAAE;QACpG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACxE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC1E,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAChF,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,qCAAqC,EAAE;QAC9E,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,oDAAoD,EAAE;QAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAChG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;QACnE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,EAAE;KACxD;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE;QACnE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE;KACpE;IACD,QAAQ,EAAE;QACR,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,6EAA6E;QAC7E,sEAAsE;QACtE,2DAA2D;QAC3D,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;KACzE;CACF,CAAC;AAEF,MAAM,eAAe,GAAgB;IACnC,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,yCAAyC;IACtD,KAAK,EAAE,CAAC,oCAAoC,CAAC;IAC7C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;CACjF,CAAC;AAEF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,+EAA+E;AAC/E,wEAAwE;AACxE,gDAAgD;AAChD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACzC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,SAAS,CAAC,CAAC,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC5D,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,kDAAkD;YAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;YAAE,MAAM;QAChH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}