@provos/ironcurtain 0.7.2 → 0.9.0

package/dist/trusted-process/sandbox-integration.js

@@ -10,10 +10,12 @@
  * for the availability check.
  */
 import { SandboxManager } from '@anthropic-ai/sandbox-runtime';
-import { writeFileSync, mkdirSync, rmSync, existsSync } from 'node:fs';
+import { writeFileSync, readFileSync, mkdirSync, rmSync, existsSync, realpathSync } from 'node:fs';
 import { join, resolve, dirname, isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { quote } from 'shell-quote';
+import { expandTilde } from '../types/argument-roles.js';
 // ── Constants ──────────────────────────────────────────────────────────────
 /** Sensitive directories blocked from reads by default. */
 const DEFAULT_DENY_READ = ['~/.ssh', '~/.gnupg', '~/.aws'];
@@ -62,12 +64,13 @@ export function resolveSandboxConfig(serverConfig, sessionSandboxDir, platformAv
     const fsConfig = sandboxConfig.filesystem ?? {};
     const networkConfig = sandboxConfig.network;
     const allowWrite = buildAllowWrite(sessionSandboxDir, fsConfig.allowWrite ?? []);
+    const allowRead = (fsConfig.allowRead ?? []).map((p) => expandTilde(p));
     const denyRead = fsConfig.denyRead ?? DEFAULT_DENY_READ;
     const denyWrite = fsConfig.denyWrite ?? [];
     const network = resolveNetworkConfig(networkConfig);
     return {
         sandboxed: true,
-        config: { allowWrite, denyRead, denyWrite, network },
+        config: { allowWrite, allowRead, denyRead, denyWrite, network },
     };
 }
 /**
@@ -93,6 +96,7 @@ export function writeServerSettings(serverName, config, settingsDir) {
         network,
         filesystem: {
             denyRead: config.denyRead,
+            allowRead: config.allowRead,
             allowWrite: [...config.allowWrite, cwdPath],
             denyWrite: config.denyWrite,
         },
@@ -114,7 +118,16 @@ export function wrapServerCommand(serverName, command, args, sandboxConfig, sett
     const settingsPath = join(settingsDir, `${serverName}.srt-settings.json`);
     // Resolve relative paths in args to absolute so the command works when
     // the proxy sets cwd to the per-server temp directory.
-    const resolvedArgs = args.map((a) => (!isAbsolute(a) && !a.startsWith('-') ? resolve(a) : a));
+    // Skip flags (-y, --foo) and npm package specifiers (contain @, e.g.
+    // @org/pkg, @org/pkg@1.0.0, or unscoped pkg@1.0.0).
+    const resolvedArgs = args.map((a) => {
+        if (isAbsolute(a) || a.startsWith('-') || a.includes('@'))
+            return a;
+        // Only resolve args that look like filesystem paths (contain / or .)
+        if (a.includes('/') || a.includes('.'))
+            return resolve(a);
+        return a;
+    });
     const cmdString = quote([command, ...resolvedArgs]);
     return {
         command: SRT_BIN,
@@ -147,7 +160,106 @@ export function annotateSandboxViolation(errorMessage, serverSandboxed) {
         return errorMessage;
     return `[SANDBOX BLOCKED] ${errorMessage}`;
 }
+/**
+ * Discovers filesystem paths required by the current Node.js installation.
+ *
+ * When a sandbox uses `denyRead: ["~"]`, node/npm installations under the
+ * home directory (nvm, volta, fnm, asdf) become unreadable. This function
+ * inspects the running process to find the actual installation paths and
+ * returns them for inclusion in `allowRead`.
+ *
+ * Returns deduplicated absolute real paths. Safe to call on any platform.
+ */
+export function discoverNodePaths() {
+    const paths = new Set();
+    // Resolve home through realpath so prefix comparisons work when
+    // homedir() involves symlinks (e.g., macOS /var → /private/var)
+    const home = safeRealPath(homedir()) ?? homedir();
+    // 1. Node.js binary -- follow symlinks to the real location
+    const execPath = safeRealPath(process.execPath);
+    if (execPath) {
+        // The binary is typically at <prefix>/bin/node; we want <prefix>
+        const binDir = dirname(execPath);
+        const prefix = dirname(binDir);
+        addIfUnderHome(paths, prefix, home);
+    }
+    // 2. Version manager root directories -- these contain node versions,
+    //    global packages, and shims that the server process needs to read
+    const versionManagerRoots = [
+        { envVar: 'NVM_DIR', fallback: '.nvm' },
+        { envVar: 'VOLTA_HOME', fallback: '.volta' },
+        { envVar: 'ASDF_DATA_DIR', fallback: '.asdf' },
+    ];
+    for (const { envVar, fallback } of versionManagerRoots) {
+        const dir = process.env[envVar] ?? (home ? join(home, fallback) : '');
+        if (dir && existsSync(dir)) {
+            const realDir = safeRealPath(dir);
+            if (realDir)
+                addIfUnderHome(paths, realDir, home);
+        }
+    }
+    // 3. fnm uses a platform-specific default location
+    const fnmDir = process.env.FNM_DIR ??
+        (process.platform === 'darwin' && home
+            ? join(home, 'Library', 'Application Support', 'fnm')
+            : home
+                ? join(home, '.local', 'share', 'fnm')
+                : '');
+    if (fnmDir && existsSync(fnmDir)) {
+        const realDir = safeRealPath(fnmDir);
+        if (realDir)
+            addIfUnderHome(paths, realDir, home);
+    }
+    return [...paths];
+}
+/**
+ * Rewrites an existing srt settings file to add additional allowRead
+ * and/or allowWrite paths. Used after OAuth setup discovers credential
+ * directories that weren't known when the settings were first written.
+ *
+ * Merges new paths with existing ones (deduplicating).
+ */
+export function rewriteServerSettings(settingsPath, additions) {
+    const content = JSON.parse(readFileSync(settingsPath, 'utf-8'));
+    const fs = content.filesystem ?? {};
+    if (additions.allowRead?.length) {
+        const existing = new Set(fs.allowRead ?? []);
+        for (const p of additions.allowRead)
+            existing.add(p);
+        fs.allowRead = [...existing];
+    }
+    if (additions.allowWrite?.length) {
+        const existing = new Set(fs.allowWrite ?? []);
+        for (const p of additions.allowWrite)
+            existing.add(p);
+        fs.allowWrite = [...existing];
+    }
+    content.filesystem = fs;
+    writeFileSync(settingsPath, JSON.stringify(content, null, 2));
+}
 // ── Internal helpers ───────────────────────────────────────────────────────
+/**
+ * Resolves a path to its real (canonical) path, returning null on failure.
+ * Silently handles paths that don't exist or can't be resolved.
+ */
+function safeRealPath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Adds a path to the set only if it's under the home directory.
+ * Paths outside home don't need to be in allowRead since they
+ * aren't blocked by `denyRead: ["~"]`.
+ */
+function addIfUnderHome(paths, dir, home) {
+    if (home && dir.startsWith(home + '/')) {
+        paths.add(dir);
+    }
+}
 /**
  * Builds the allowWrite list with the session sandbox dir always included.
  * Relative paths are resolved against the session sandbox directory.

package/dist/trusted-process/sandbox-integration.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-integration.js","sourceRoot":"","sources":["../../src/trusted-process/sandbox-integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAsCpC,8EAA8E;AAE9E,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpF,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,+EAA+E,CAAC;AAE9G,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,iBAAiB,GAAG,cAAc,CAAC,mBAAmB,EAAE,CAAC;IAE/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;IAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAA6B,EAC7B,iBAAyB,EACzB,iBAA0B,EAC1B,MAAiC;IAEjC,IAAI,YAAY,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACnC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,mEAAmE,GAAG,iCAAiC,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC;IAE5C,MAAM,UAAU,GAAG,eAAe,CAAC,iBAAiB,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAEjF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAEpD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE;KACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,MAA6B,EAC7B,WAAmB;IAEnB,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,UAAU,oBAAoB,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,UAAU,MAAM,CAAC,CAAC;IACvD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,KAAK,KAAK;QACtB,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;QAC3C,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IAErG,MAAM,QAAQ,GAAG;QACf,OAAO;QACP,UAAU,EAAE;YACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;YAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B;KACF,CAAC;IAEF,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,OAAe,EACf,IAAuB,EACvB,aAAoC,EACpC,WAAmB;IAEnB,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,UAAU,oBAAoB,CAAC,CAAC;IAC1E,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IAEpD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,IAAI,CAAC;QACH,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB,EAAE,eAAwB;IACrF,IAAI,CAAC,eAAe;QAAE,OAAO,YAAY,CAAC;IAC1C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAEnE,OAAO,qBAAqB,YAAY,EAAE,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,eAAe,CAAC,iBAAyB,EAAE,eAAkC;IACpF,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,MAAgD;IAC5E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,QAAgB;IACrE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,OAAO,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"sandbox-integration.js","sourceRoot":"","sources":["../../src/trusted-process/sandbox-integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAsCzD,8EAA8E;AAE9E,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpF,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,+EAA+E,CAAC;AAE9G,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,iBAAiB,GAAG,cAAc,CAAC,mBAAmB,EAAE,CAAC;IAE/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;IAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAA6B,EAC7B,iBAAyB,EACzB,iBAA0B,EAC1B,MAAiC;IAEjC,IAAI,YAAY,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACnC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,mEAAmE,GAAG,iCAAiC,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC;IAE5C,MAAM,UAAU,GAAG,eAAe,CAAC,iBAAiB,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAEpD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,MAA6B,EAC7B,WAAmB;IAEnB,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,UAAU,oBAAoB,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,UAAU,MAAM,CAAC,CAAC;IACvD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,KAAK,KAAK;QACtB,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;QAC3C,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IAErG,MAAM,QAAQ,GAAG;QACf,OAAO;QACP,UAAU,EAAE;YACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;YAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B;KACF,CAAC;IAEF,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,OAAe,EACf,IAAuB,EACvB,aAAoC,EACpC,WAAmB;IAEnB,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,UAAU,oBAAoB,CAAC,CAAC;IAC1E,uEAAuE;IACvE,uDAAuD;IACvD,qEAAqE;IACrE,oDAAoD;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACpE,qEAAqE;QACrE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IAEpD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,IAAI,CAAC;QACH,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB,EAAE,eAAwB;IACrF,IAAI,CAAC,eAAe;QAAE,OAAO,YAAY,CAAC;IAC1C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAEnE,OAAO,qBAAqB,YAAY,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,gEAAgE;IAChE,gEAAgE;IAChE,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;IAElD,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,iEAAiE;QACjE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,mBAAmB,GAAgD;QACvE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;QACvC,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC5C,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE;KAC/C,CAAC;IAEF,KAAK,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtE,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,OAAO;gBAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI;YACpC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,CAAC;YACrD,CAAC,CAAC,IAAI;gBACJ,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC;gBACtC,CAAC,CAAC,EAAE,CAAC,CAAC;IACZ,IAAI,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,OAAO;YAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,SAA0D;IAE1D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAE7D,CAAC;IACF,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAEpC,IAAI,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,SAAS;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,EAAE,CAAC,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,UAAU;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtD,EAAE,CAAC,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;IACxB,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAkB,EAAE,GAAW,EAAE,IAAY;IACnE,IAAI,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,iBAAyB,EAAE,eAAkC;IACpF,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,CAAC,iBAAiB,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,MAAgD;IAC5E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,QAAgB;IACrE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,OAAO,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC"}

package/dist/trusted-process/token-file-refresher.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Proactive OAuth credential file refresher for MCP servers.
+ *
+ * Runs in the proxy process. Periodically checks token expiry and
+ * writes fresh credential files before the access token expires.
+ * The MCP server's own loadCredentialsQuietly() re-reads the file
+ * on each tool call, picking up the refreshed token transparently.
+ *
+ * Why this lives in the proxy process (not session):
+ * - The proxy process spawns and owns the MCP server child processes
+ * - The proxy process has direct access to the credential file directory
+ * - The proxy process lifetime matches the MCP server lifetime
+ */
+/** Configuration for a single server's token refresh. */
+export interface TokenRefreshConfig {
+    /** OAuth provider ID (e.g., 'google'). Used in log messages. */
+    readonly providerId: string;
+    /** Function to obtain a fresh access token. Calls OAuthTokenProvider. */
+    readonly getAccessToken: () => Promise<{
+        accessToken: string;
+        expiresAt: number;
+        scopes: readonly string[];
+    }>;
+    /** Function to write the credential file in the format the MCP server expects. */
+    readonly writeCredentialFile: (accessToken: string, expiresAt: number, scopes: readonly string[]) => void;
+    /** Optional callback to log to the session log (not just stderr). */
+    readonly logToSession?: (message: string) => void;
+}
+/**
+ * Default refresh check interval: 5 minutes.
+ *
+ * Much shorter than the MCP server's own 45-minute interval, ensuring
+ * we always refresh well before the ~60-minute access token lifetime
+ * expires. With a 10-minute-before-expiry threshold, the worst case
+ * is 5 + 10 = 15 minutes before expiry.
+ */
+export declare const DEFAULT_REFRESH_INTERVAL_MS: number;
+/**
+ * Refresh when within 10 minutes of expiry.
+ * Exported for test access.
+ */
+export declare const REFRESH_THRESHOLD_MS: number;
+/**
+ * Manages proactive token refresh for a single MCP server.
+ *
+ * Checks token expiry on a timer and writes a fresh credential file
+ * before the access token expires. Errors are logged to stderr but
+ * never thrown (the refresher runs on an interval and must not crash).
+ */
+export declare class TokenFileRefresher {
+    private intervalHandle;
+    private inflight;
+    private currentExpiresAt;
+    private readonly config;
+    constructor(config: TokenRefreshConfig, initialExpiresAt: number);
+    /** Best-effort log to session log (if available) and stderr (errors only). */
+    private log;
+    /** Starts the periodic refresh check. Performs an immediate check first. */
+    start(intervalMs?: number): void;
+    /** Stops the periodic refresh and cleans up. */
+    stop(): void;
+    /**
+     * Performs a single refresh check.
+     * Public for testing; normally called by the interval.
+     *
+     * Errors are caught and logged to stderr -- never propagated.
+     */
+    refreshIfNeeded(): Promise<void>;
+}

package/dist/trusted-process/token-file-refresher.js

@@ -0,0 +1,120 @@
+/**
+ * Proactive OAuth credential file refresher for MCP servers.
+ *
+ * Runs in the proxy process. Periodically checks token expiry and
+ * writes fresh credential files before the access token expires.
+ * The MCP server's own loadCredentialsQuietly() re-reads the file
+ * on each tool call, picking up the refreshed token transparently.
+ *
+ * Why this lives in the proxy process (not session):
+ * - The proxy process spawns and owns the MCP server child processes
+ * - The proxy process has direct access to the credential file directory
+ * - The proxy process lifetime matches the MCP server lifetime
+ */
+/**
+ * Default refresh check interval: 5 minutes.
+ *
+ * Much shorter than the MCP server's own 45-minute interval, ensuring
+ * we always refresh well before the ~60-minute access token lifetime
+ * expires. With a 10-minute-before-expiry threshold, the worst case
+ * is 5 + 10 = 15 minutes before expiry.
+ */
+export const DEFAULT_REFRESH_INTERVAL_MS = 5 * 60 * 1000;
+/**
+ * Refresh when within 10 minutes of expiry.
+ * Exported for test access.
+ */
+export const REFRESH_THRESHOLD_MS = 10 * 60 * 1000;
+/**
+ * Manages proactive token refresh for a single MCP server.
+ *
+ * Checks token expiry on a timer and writes a fresh credential file
+ * before the access token expires. Errors are logged to stderr but
+ * never thrown (the refresher runs on an interval and must not crash).
+ */
+export class TokenFileRefresher {
+    intervalHandle = null;
+    inflight = null;
+    currentExpiresAt;
+    config;
+    constructor(config, initialExpiresAt) {
+        this.config = config;
+        this.currentExpiresAt = initialExpiresAt;
+    }
+    /** Best-effort log to session log (if available) and stderr (errors only). */
+    log(message, isError = false) {
+        const prefix = `[token-refresher:${this.config.providerId}]`;
+        const full = `${prefix} ${message}`;
+        try {
+            this.config.logToSession?.(full);
+        }
+        catch {
+            // Swallow — logging must never break the refresh loop.
+        }
+        if (isError) {
+            try {
+                process.stderr.write(`${full}\n`);
+            }
+            catch {
+                // Swallow — logging must never break the refresh loop.
+            }
+        }
+    }
+    /** Starts the periodic refresh check. Performs an immediate check first. */
+    start(intervalMs = DEFAULT_REFRESH_INTERVAL_MS) {
+        if (this.intervalHandle !== null)
+            return;
+        // Immediate check — catches tokens already near expiry at session start
+        void this.refreshIfNeeded();
+        this.intervalHandle = setInterval(() => {
+            void this.refreshIfNeeded();
+        }, intervalMs);
+        // Ensure the interval doesn't keep the process alive
+        this.intervalHandle.unref();
+    }
+    /** Stops the periodic refresh and cleans up. */
+    stop() {
+        if (this.intervalHandle !== null) {
+            clearInterval(this.intervalHandle);
+            this.intervalHandle = null;
+        }
+    }
+    /**
+     * Performs a single refresh check.
+     * Public for testing; normally called by the interval.
+     *
+     * Errors are caught and logged to stderr -- never propagated.
+     */
+    async refreshIfNeeded() {
+        // Guard against concurrent refreshes (slow network can overlap next tick)
+        if (this.inflight)
+            return;
+        try {
+            const now = Date.now();
+            const timeUntilExpiry = this.currentExpiresAt - now;
+            if (timeUntilExpiry > REFRESH_THRESHOLD_MS) {
+                return; // Token still has plenty of time
+            }
+            const minUntilExpiry = Math.round(timeUntilExpiry / 60_000);
+            this.log(`Refreshing token (${minUntilExpiry} min until expiry)`);
+            const refresh = (async () => {
+                const { accessToken, expiresAt, scopes } = await this.config.getAccessToken();
+                this.config.writeCredentialFile(accessToken, expiresAt, scopes);
+                this.currentExpiresAt = expiresAt;
+                const newMin = Math.round((expiresAt - Date.now()) / 60_000);
+                this.log(`Token refreshed successfully (new expiry in ${newMin} min)`);
+            })();
+            this.inflight = refresh;
+            await refresh;
+        }
+        catch (err) {
+            // Log but don't throw -- this runs on an interval
+            const message = err instanceof Error ? err.message : String(err);
+            this.log(`FAILED to refresh token: ${message}`, true);
+        }
+        finally {
+            this.inflight = null;
+        }
+    }
+}
+//# sourceMappingURL=token-file-refresher.js.map

package/dist/trusted-process/token-file-refresher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-file-refresher.js","sourceRoot":"","sources":["../../src/trusted-process/token-file-refresher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAkBH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACrB,cAAc,GAA0C,IAAI,CAAC;IAC7D,QAAQ,GAAyB,IAAI,CAAC;IACtC,gBAAgB,CAAS;IAChB,MAAM,CAAqB;IAE5C,YAAY,MAA0B,EAAE,gBAAwB;QAC9D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAED,8EAA8E;IACtE,GAAG,CAAC,OAAe,EAAE,OAAO,GAAG,KAAK;QAC1C,MAAM,MAAM,GAAG,oBAAoB,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC;QAC7D,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,aAAqB,2BAA2B;QACpD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;YAAE,OAAO;QAEzC,wEAAwE;QACxE,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;QAE5B,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;YACrC,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9B,CAAC,EAAE,UAAU,CAAC,CAAC;QAEf,qDAAqD;QACrD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,gDAAgD;IAChD,IAAI;QACF,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe;QACnB,0EAA0E;QAC1E,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAE1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC;YAEpD,IAAI,eAAe,GAAG,oBAAoB,EAAE,CAAC;gBAC3C,OAAO,CAAC,iCAAiC;YAC3C,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,qBAAqB,cAAc,oBAAoB,CAAC,CAAC;YAElE,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC1B,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBAChE,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;gBAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;gBAC7D,IAAI,CAAC,GAAG,CAAC,+CAA+C,MAAM,OAAO,CAAC,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;YACL,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YACxB,MAAM,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kDAAkD;YAClD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,4BAA4B,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}

package/dist/types/argument-roles.d.ts

@@ -14,7 +14,7 @@
  *   - opaque: no structural invariant (semantic meaning only)
  */
 export type RoleCategory = 'path' | 'url' | 'identifier' | 'opaque';
-export type ArgumentRole = 'read-path' | 'write-path' | 'delete-path' | 'write-history' | 'delete-history' | 'fetch-url' | 'git-remote-url' | 'github-owner' | 'github-repo' | 'branch-name' | 'commit-message' | 'none';
+export type ArgumentRole = 'read-path' | 'write-path' | 'delete-path' | 'write-history' | 'delete-history' | 'fetch-url' | 'git-remote-url' | 'github-owner' | 'github-repo' | 'branch-name' | 'commit-message' | 'email-address' | 'email-body' | 'share-permission' | 'none';
 export interface RoleDefinition {
     readonly description: string;
     readonly isResourceIdentifier: boolean;
@@ -46,6 +46,12 @@ export declare function expandTilde(filePath: string): string;
  * directory inside the sandbox could escape containment checks.
  */
 export declare function resolveRealPath(filePath: string): string;
+/**
+ * Checks whether a target path is contained within a directory.
+ * Both paths are resolved to their real canonical form (following symlinks)
+ * before comparison, which neutralizes both path traversal and symlink attacks.
+ */
+export declare function isWithinDirectory(targetPath: string, directory: string): boolean;
 export declare const ARGUMENT_ROLE_REGISTRY: ReadonlyMap<ArgumentRole, RoleDefinition>;
 /** Returns the RoleDefinition for a role. Throws if not registered. */
 export declare function getRoleDefinition(role: ArgumentRole): RoleDefinition;

package/dist/types/argument-roles.js

@@ -71,6 +71,16 @@ export function resolveRealPath(filePath) {
         return absolute;
     }
 }
+/**
+ * Checks whether a target path is contained within a directory.
+ * Both paths are resolved to their real canonical form (following symlinks)
+ * before comparison, which neutralizes both path traversal and symlink attacks.
+ */
+export function isWithinDirectory(targetPath, directory) {
+    const resolved = resolveRealPath(targetPath);
+    const resolvedDir = resolveRealPath(directory);
+    return resolved === resolvedDir || resolved.startsWith(resolvedDir + '/');
+}
 /** Identity function -- returns the value unchanged. */
 function identity(value) {
     return value;
@@ -218,6 +228,43 @@ const registryEntries = [
             serverNames: ['git'],
         },
     ],
+    // ── Google Workspace roles ──────────────────────────────────────
+    [
+        'email-address',
+        {
+            description: 'Email address (recipient, attendee, share target)',
+            isResourceIdentifier: false,
+            category: 'opaque',
+            canonicalize: identity,
+            annotationGuidance: 'Assign to arguments that are email addresses (recipients, attendees, share targets). ' +
+                'Includes the "to" field on send/draft, "attendees" on calendar events, "email" on file sharing.',
+            serverNames: ['google-workspace'],
+        },
+    ],
+    [
+        'email-body',
+        {
+            description: 'Email message body content',
+            isResourceIdentifier: false,
+            category: 'opaque',
+            canonicalize: identity,
+            annotationGuidance: 'Assign to arguments that contain email body text or rich content. ' +
+                'Includes the "body" field on send/draft message tools.',
+            serverNames: ['google-workspace'],
+        },
+    ],
+    [
+        'share-permission',
+        {
+            description: 'Sharing permission level (viewer, commenter, editor, organizer)',
+            isResourceIdentifier: false,
+            category: 'opaque',
+            canonicalize: lowercase,
+            annotationGuidance: 'Assign to arguments that specify a sharing or permission level on shared resources ' +
+                '(e.g., the role parameter on Drive file sharing).',
+            serverNames: ['google-workspace'],
+        },
+    ],
     [
         'none',
         {
@@ -247,6 +294,9 @@ const _ROLE_COMPLETENESS_CHECK = {
     'github-repo': true,
     'branch-name': true,
     'commit-message': true,
+    'email-address': true,
+    'email-body': true,
+    'share-permission': true,
     none: true,
 };
 // ---------------------------------------------------------------------------

package/dist/types/argument-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"argument-roles.js","sourceRoot":"","sources":["../../src/types/argument-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AA8CnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,uFAAuF;QACvF,oDAAoD;QACpD,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,2DAA2D;gBAC3D,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,eAAe,GAAqC;IACxD;QACE,WAAW;QACX;YACE,WAAW,EAAE,mCAAmC;YAChD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,yEAAyE;gBACzE,mDAAmD;YACrD,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,YAAY;QACZ;YACE,WAAW,EAAE,yCAAyC;YACtD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,+EAA+E;gBAC/E,gEAAgE;YAClE,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gFAAgF;gBAChF,uFAAuF;YACzF,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,eAAe;QACf;YACE,WAAW,EAAE,qDAAqD;YAClE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gGAAgG;gBAChG,sFAAsF;gBACtF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,2DAA2D;YACxE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,8FAA8F;gBAC9F,oFAAoF;gBACpF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,WAAW;QACX;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,YAAY;YAC1B,kBAAkB,EAChB,iEAAiE;gBACjE,8CAA8C;YAChD,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,uDAAuD;YACpE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,sFAAsF;gBACtF,kGAAkG;YACpG,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,cAAc;QACd;YACE,WAAW,EAAE,gEAAgE;YAC7E,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE,SAAS;YACvB,kBAAkB,EAChB,iGAAiG;gBACjG,+DAA+D;YACjE,WAAW,EAAE,CAAC,QAAQ,CAAC;SACxB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,+CAA+C;YAC5D,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE,SAAS;YACvB,kBAAkB,EAChB,yFAAyF;gBACzF,sDAAsD;gBACtD,2DAA2D;YAC7D,WAAW,EAAE,CAAC,QAAQ,CAAC;SACxB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,iBAAiB;YAC9B,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,iDAAiD;gBACjD,4FAA4F;gBAC5F,yEAAyE;YAC3E,WAAW,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;SAC/B;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,yBAAyB;YACtC,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAAE,oDAAoD,GAAG,kCAAkC;YAC7G,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,MAAM;QACN;YACE,WAAW,EAAE,mDAAmD;YAChE,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,kEAAkE;gBAClE,gFAAgF;SACnF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAA8C,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1G,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,wBAAwB,GAA+B;IAC3D,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,IAAI;IACnB,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,IAAI;IACtB,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,kBAAkB,CAAC,QAAsB;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,YAAY;IAC1B,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW;IACzB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB;IAChC,OAAO,kBAAkB,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA8B,IAAI,GAAG,CAAC;IACxE,WAAW;IACX,YAAY;IACZ,aAAa;IACb,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAgBH,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAsB;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA4B,EAC5B,QAAiC;IAEjC,iEAAiE;IACjE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,MAAmC,CAAC;IAC7C,CAAC;IAED,MAAM,YAAY,GAAmC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,YAAY,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChG,CAAC;IACD,6DAA6D;IAC7D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC3C,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAiC;IAC5E,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3D,UAAU;YACV;gBACE,GAAG,MAAM;gBACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBAC/B,MAAM,YAAY,GAAmC,EAAE,CAAC;oBACxD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxD,YAAY,CAAC,OAAO,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;oBACpD,CAAC;oBACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,wDAAwD;oBAClG,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;gBACzC,CAAC,CAAC;aACH;SACF,CAAC,CACH;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,IAAsB,EAAE,QAAiC;IACzF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAmB,EAAE,QAAiC;IAC/E,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAkC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC1B,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;YAChB,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,GAAG,IAAI,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;YACvE,KAAK,QAAQ;gBACX,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;YAC1E,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC;YACzC,KAAK,OAAO;gBACV,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"argument-roles.js","sourceRoot":"","sources":["../../src/types/argument-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAkDnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,uFAAuF;QACvF,oDAAoD;QACpD,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,2DAA2D;gBAC3D,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,SAAiB;IACrE,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,eAAe,GAAqC;IACxD;QACE,WAAW;QACX;YACE,WAAW,EAAE,mCAAmC;YAChD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,yEAAyE;gBACzE,mDAAmD;YACrD,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,YAAY;QACZ;YACE,WAAW,EAAE,yCAAyC;YACtD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,+EAA+E;gBAC/E,gEAAgE;YAClE,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gFAAgF;gBAChF,uFAAuF;YACzF,WAAW,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;SACnC;KACF;IACD;QACE,eAAe;QACf;YACE,WAAW,EAAE,qDAAqD;YAClE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,gGAAgG;gBAChG,sFAAsF;gBACtF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,2DAA2D;YACxE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,8FAA8F;gBAC9F,oFAAoF;gBACpF,qFAAqF;YACvF,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,WAAW;QACX;YACE,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,YAAY;YAC1B,kBAAkB,EAChB,iEAAiE;gBACjE,8CAA8C;YAChD,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,uDAAuD;YACpE,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,eAAe;YAC7B,kBAAkB,EAChB,sFAAsF;gBACtF,kGAAkG;YACpG,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD;QACE,cAAc;QACd;YACE,WAAW,EAAE,gEAAgE;YAC7E,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE,SAAS;YACvB,kBAAkB,EAChB,iGAAiG;gBACjG,+DAA+D;YACjE,WAAW,EAAE,CAAC,QAAQ,CAAC;SACxB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,+CAA+C;YAC5D,oBAAoB,EAAE,IAAI;YAC1B,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE,SAAS;YACvB,kBAAkB,EAChB,yFAAyF;gBACzF,sDAAsD;gBACtD,2DAA2D;YAC7D,WAAW,EAAE,CAAC,QAAQ,CAAC;SACxB;KACF;IACD;QACE,aAAa;QACb;YACE,WAAW,EAAE,iBAAiB;YAC9B,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,iDAAiD;gBACjD,4FAA4F;gBAC5F,yEAAyE;YAC3E,WAAW,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;SAC/B;KACF;IACD;QACE,gBAAgB;QAChB;YACE,WAAW,EAAE,yBAAyB;YACtC,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAAE,oDAAoD,GAAG,kCAAkC;YAC7G,WAAW,EAAE,CAAC,KAAK,CAAC;SACrB;KACF;IACD,mEAAmE;IACnE;QACE,eAAe;QACf;YACE,WAAW,EAAE,mDAAmD;YAChE,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,uFAAuF;gBACvF,iGAAiG;YACnG,WAAW,EAAE,CAAC,kBAAkB,CAAC;SAClC;KACF;IACD;QACE,YAAY;QACZ;YACE,WAAW,EAAE,4BAA4B;YACzC,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,oEAAoE;gBACpE,wDAAwD;YAC1D,WAAW,EAAE,CAAC,kBAAkB,CAAC;SAClC;KACF;IACD;QACE,kBAAkB;QAClB;YACE,WAAW,EAAE,iEAAiE;YAC9E,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,SAAS;YACvB,kBAAkB,EAChB,qFAAqF;gBACrF,mDAAmD;YACrD,WAAW,EAAE,CAAC,kBAAkB,CAAC;SAClC;KACF;IACD;QACE,MAAM;QACN;YACE,WAAW,EAAE,mDAAmD;YAChE,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,kBAAkB,EAChB,kEAAkE;gBAClE,gFAAgF;SACnF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAA8C,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1G,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,wBAAwB,GAA+B;IAC3D,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,IAAI;IACrB,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,IAAI;IACnB,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,IAAI;IACrB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,IAAI;IACxB,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,kBAAkB,CAAC,QAAsB;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,YAAY;IAC1B,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW;IACzB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB;IAChC,OAAO,kBAAkB,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA8B,IAAI,GAAG,CAAC;IACxE,WAAW;IACX,YAAY;IACZ,aAAa;IACb,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAgBH,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAsB;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA4B,EAC5B,QAAiC;IAEjC,iEAAiE;IACjE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,MAAmC,CAAC;IAC7C,CAAC;IAED,MAAM,YAAY,GAAmC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,YAAY,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChG,CAAC;IACD,6DAA6D;IAC7D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC3C,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAiC;IAC5E,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3D,UAAU;YACV;gBACE,GAAG,MAAM;gBACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBAC/B,MAAM,YAAY,GAAmC,EAAE,CAAC;oBACxD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxD,YAAY,CAAC,OAAO,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;oBACpD,CAAC;oBACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,wDAAwD;oBAClG,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;gBACzC,CAAC,CAAC;aACH;SACF,CAAC,CACH;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,IAAsB,EAAE,QAAiC;IACzF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAmB,EAAE,QAAiC;IAC/E,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAkC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC1B,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;YAChB,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,GAAG,IAAI,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;YACvE,KAAK,QAAQ;gBACX,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;YAC1E,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,GAAG,IAAI,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC;YACzC,KAAK,OAAO;gBACV,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/types/audit.d.ts

@@ -20,4 +20,15 @@ export interface AuditEntry {
      * rather than a human. Only present when escalationResult is 'approved'.
      */
     autoApproved?: boolean;
+    /**
+     * When true, the escalation was bypassed because a whitelist
+     * pattern matched. The whitelistPatternId links to the original
+     * approval that created the pattern.
+     */
+    whitelistApproved?: boolean;
+    /**
+     * ID of the whitelist pattern that matched, linking back to the
+     * original escalation approval. Only present when whitelistApproved is true.
+     */
+    whitelistPatternId?: string;
 }

package/docker/Dockerfile.base

@@ -10,8 +10,30 @@ RUN apt-get update && apt-get install -y --no-install-recommends socat && rm -rf
 COPY ironcurtain-ca-cert.pem /usr/local/share/ca-certificates/ironcurtain-ca.crt
 RUN update-ca-certificates
 
+# Python tooling: uv (fast package manager) and ruff (linter)
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
+    curl -LsSf https://astral.sh/ruff/install.sh | sh && \
+    mv /root/.local/bin/uv /usr/local/bin/uv && \
+    mv /root/.local/bin/ruff /usr/local/bin/ruff && \
+    rm -rf /root/.local
+
+# Pre-install Python 3.12 so uv never needs to download it at runtime.
+# Containers run with --network=none, so runtime downloads would fail.
+# Install to a shared location so the codespace user can find it.
+# uv uses rustls by default, which doesn't read system CA certs.
+# UV_NATIVE_TLS makes it use the system TLS stack (OpenSSL) instead,
+# so it trusts the IronCurtain MITM CA installed above.
+ENV UV_NATIVE_TLS=1
+ENV UV_PYTHON_INSTALL_DIR=/opt/uv-python
+RUN uv python install 3.12
+
 RUN mkdir -p /workspace /etc/ironcurtain /run/ironcurtain && \
     chown codespace:codespace /workspace /etc/ironcurtain /run/ironcurtain
 
 WORKDIR /workspace
 USER codespace
+
+# Node.js headers for native addon compilation (node-gyp).
+# Must run as codespace — node-gyp caches headers in ~/.cache/node-gyp/
+# and the runtime user is codespace, not root.
+RUN node-gyp install

package/docker/Dockerfile.base.arm64

@@ -1,23 +1,63 @@
-FROM node:22-bookworm
+FROM node:22-trixie
 
 # Replicate the 'codespace' user (uid 1000) from the devcontainers/universal
 # image so Dockerfile.claude-code works unchanged on both platforms.
-# node:22-bookworm already has node:node at uid/gid 1000 — rename it.
+# The node base image ships node:node at uid/gid 1000 — rename it.
 RUN usermod -l codespace -d /home/codespace -m node && \
     groupmod -n codespace node
 
 USER root
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends git socat ca-certificates && \
-    rm -rf /var/lib/apt/lists/*
+    apt-get install -y --no-install-recommends \
+    # Existing
+    git socat ca-certificates \
+    # Build tools for native extensions
+    build-essential cmake pkg-config \
+    # Graphics/Qt runtime + dev
+    libegl1 libegl-dev libgl1 libgl-dev \
+    libxkbcommon0 libxkbcommon-dev libdbus-1-3 libdbus-1-dev \
+    # X11/XCB (Qt offscreen mode)
+    libx11-6 libxext6 libxrender1 libxcb1 \
+    libxcb-cursor0 libxcb-icccm4 libxcb-keysyms1 \
+    libxcb-shape0 libxcb-xfixes0 libxcb-xkb1 libxkbcommon-x11-0 \
+    # Common native Python deps
+    libffi-dev libssl-dev zlib1g-dev libxml2-dev libxslt1-dev \
+    # Fonts (Qt needs at least one font)
+    fontconfig fonts-dejavu-core \
+    && rm -rf /var/lib/apt/lists/*
 
 # IronCurtain CA (for MITM proxy trust)
 # This file is copied into a temporary build context by ensureImage().
 COPY ironcurtain-ca-cert.pem /usr/local/share/ca-certificates/ironcurtain-ca.crt
 RUN update-ca-certificates
 
+# Python tooling: uv (fast package manager) and ruff (linter)
+# curl is available from the apt-get install above.
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
+    curl -LsSf https://astral.sh/ruff/install.sh | sh && \
+    mv /root/.local/bin/uv /usr/local/bin/uv && \
+    mv /root/.local/bin/ruff /usr/local/bin/ruff && \
+    rm -rf /root/.local
+
+# Pre-install Python 3.12 so uv never needs to download it at runtime.
+# Containers run with --network=none, so runtime downloads would fail.
+# Install to a shared location so the codespace user can find it.
+# uv uses rustls by default, which doesn't read system CA certs.
+# UV_NATIVE_TLS makes it use the system TLS stack (OpenSSL) instead,
+# so it trusts the IronCurtain MITM CA installed above.
+ENV UV_NATIVE_TLS=1
+ENV UV_PYTHON_INSTALL_DIR=/opt/uv-python
+RUN uv python install 3.12
+
+RUN npm install -g node-gyp
+
 RUN mkdir -p /workspace /etc/ironcurtain /run/ironcurtain && \
     chown codespace:codespace /workspace /etc/ironcurtain /run/ironcurtain
 
 WORKDIR /workspace
 USER codespace
+
+# Node.js headers for native addon compilation (node-gyp).
+# Must run as codespace — node-gyp caches headers in ~/.cache/node-gyp/
+# and the runtime user is codespace, not root.
+RUN node-gyp install