@provos/ironcurtain 0.7.2 → 0.9.0

package/docker/Dockerfile.claude-code

@@ -13,11 +13,11 @@ USER codespace
 
 # Pre-seed Claude Code config so it skips interactive prompts:
 # - .claude.json: marks onboarding complete (skips login flow)
-# - .claude/settings.json: accepts bypass-permissions mode (skips confirmation dialog)
+# - .claude/settings.json: accepts bypass-permissions mode, skips web fetch preflight
 RUN mkdir -p /home/codespace/.claude && \
     echo '{"hasCompletedOnboarding":true,"numStartups":1,"projects":{"/workspace":{"allowedTools":[],"hasTrustDialogAccepted":true}}}' \
       > /home/codespace/.claude.json && \
-    echo '{"permissions":{"allow":[],"deny":[]},"skipDangerousModePermissionPrompt":true}' \
+    echo '{"permissions":{"allow":[],"deny":[]},"skipDangerousModePermissionPrompt":true,"skipWebFetchPreflight":true}' \
       > /home/codespace/.claude/settings.json
 
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

package/docker/entrypoint-claude-code.sh

@@ -13,7 +13,13 @@ fi
 
 # Pre-seed .claude.json so Claude Code skips onboarding, trusts /workspace,
 # and doesn't prompt for API key approval.
-cat > "$HOME/.claude.json" <<'EOJSON'
+# On resume, restore the previous session's .claude.json from the state dir
+# (it contains conversation metadata that --continue needs).
+SAVED_CLAUDE_JSON="$HOME/.claude/.claude.json.saved"
+if [ -n "$IRONCURTAIN_RESUME_FLAGS" ] && [ -f "$SAVED_CLAUDE_JSON" ]; then
+  cp "$SAVED_CLAUDE_JSON" "$HOME/.claude.json"
+else
+  cat > "$HOME/.claude.json" <<'EOJSON'
 {
   "hasCompletedOnboarding": true,
   "numStartups": 1,
@@ -25,19 +31,23 @@ cat > "$HOME/.claude.json" <<'EOJSON'
   }
 }
 EOJSON
+fi
 
 # Configure settings.json:
 # - skipDangerousModePermissionPrompt: suppresses the bypass-permissions warning
+# - skipWebFetchPreflight: bypasses domain safety check that fails in proxied env
+# - env.HTTPS_PROXY: ensures Claude Code's WebFetch routes through the MITM proxy
 # Auth mode determines how Claude Code gets its API credentials:
 # - OAuth mode (CLAUDE_CODE_OAUTH_TOKEN set): Claude Code reads the token from
 #   this env var directly -- no apiKeyHelper needed.
 # - API key mode: apiKeyHelper echoes the fake key so Claude Code skips the
 #   custom API key approval dialog entirely.
+# Always written (even on resume) because auth mode is runtime-specific.
 mkdir -p "$HOME/.claude"
 
 if [ -n "$CLAUDE_CODE_OAUTH_TOKEN" ]; then
   # OAuth mode: Claude Code reads the token from env var directly.
-  cat > "$HOME/.claude/settings.json" <<'EOSETTINGS'
+  cat > "$HOME/.claude/settings.json" <<EOSETTINGS
 {
   "permissions": {
     "allow": [],
@@ -45,12 +55,16 @@ if [ -n "$CLAUDE_CODE_OAUTH_TOKEN" ]; then
     "additionalDirectories": [],
     "defaultMode": "bypassPermissions"
   },
-  "skipDangerousModePermissionPrompt": true
+  "skipDangerousModePermissionPrompt": true,
+  "skipWebFetchPreflight": true,
+  "env": {
+    "HTTPS_PROXY": "${HTTPS_PROXY}"
+  }
 }
 EOSETTINGS
 else
   # API key mode: apiKeyHelper echoes the fake key at runtime.
-  cat > "$HOME/.claude/settings.json" <<'EOSETTINGS'
+  cat > "$HOME/.claude/settings.json" <<EOSETTINGS
 {
   "permissions": {
     "allow": [],
@@ -58,8 +72,12 @@ else
     "additionalDirectories": [],
     "defaultMode": "bypassPermissions"
   },
-  "apiKeyHelper": "echo $IRONCURTAIN_API_KEY",
-  "skipDangerousModePermissionPrompt": true
+  "apiKeyHelper": "echo \$IRONCURTAIN_API_KEY",
+  "skipDangerousModePermissionPrompt": true,
+  "skipWebFetchPreflight": true,
+  "env": {
+    "HTTPS_PROXY": "${HTTPS_PROXY}"
+  }
 }
 EOSETTINGS
 fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provos/ironcurtain",
-  "version": "0.7.2",
+  "version": "0.9.0",
   "type": "module",
   "description": "Secure agent runtime with trusted process mediation",
   "license": "Apache-2.0",
@@ -25,6 +25,9 @@
     "trusted-process",
     "model-context-protocol"
   ],
+  "workspaces": [
+    "packages/*"
+  ],
   "engines": {
     "node": ">=22.0.0 <26"
   },
@@ -49,6 +52,7 @@
     "start": "tsx src/cli.ts start",
     "annotate-tools": "tsx src/cli.ts annotate-tools",
     "compile-policy": "tsx src/cli.ts compile-policy",
+    "compile-policy:readonly": "tsx src/cli.ts compile-policy --no-mcp --constitution src/config/constitution-readonly.md --output-dir src/config/generated-readonly",
     "customize-policy": "tsx src/cli.ts customize-policy",
     "bot": "tsx src/cli.ts bot",
     "config": "tsx src/cli.ts config",
@@ -66,11 +70,12 @@
     "@ai-sdk/anthropic": "^3.0.49",
     "@ai-sdk/google": "^3.0.33",
     "@ai-sdk/openai": "^3.0.36",
-    "@anthropic-ai/sandbox-runtime": "^0.0.39",
+    "@anthropic-ai/sandbox-runtime": "^0.0.42",
     "@clack/prompts": "^1.0.1",
     "@cyanheads/git-mcp-server": "^2.8.4",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "@mozilla/readability": "^0.6.0",
+    "@provos/memory-mcp-server": "^0.1.3",
     "@utcp/code-mode": "^1.2.11",
     "@utcp/mcp": "^1.1.1",
     "@xterm/headless": "^6.0.0",
@@ -81,6 +86,7 @@
     "jsdom": "^28.1.0",
     "marked": "^15.0.12",
     "marked-terminal": "^7.3.0",
+    "minimatch": "^10.2.1",
     "node-forge": "^1.3.3",
     "ora": "^9.3.0",
     "shell-quote": "^1.8.3",

package/src/config/constitution-user-base.md

@@ -11,3 +11,18 @@
  - The agent may fetch web content from popular development sites.
  - The agent may freely list, search, and read GitHub resources (issues, pull requests, repositories, code, comments, reviews) without human approval.
  - Creating, updating, closing, or deleting GitHub resources (issues, PRs, comments, reviews, branches, files, repositories) requires human approval.
+
+## Google Workspace
+
+### Principle: Read-First, Write-with-Approval
+- Reading emails, calendar events, drive files, docs, and sheets is generally safe.
+- Sending emails, creating/modifying calendar events, and editing documents require human approval.
+- Deleting emails, calendar events, or Drive files is a destructive operation requiring explicit approval.
+
+### Principle: No Bulk Operations Without Oversight
+- Batch operations (e.g., batch_modify_labels, batch email operations) affect many items simultaneously.
+- These should be escalated regardless of the individual operation's safety level.
+
+### Principle: Respect Privacy Boundaries
+- The agent should not read private calendar details or email content without clear task relevance.
+- Sharing permissions on Drive files (drive_share_file) must always be escalated.

package/src/config/generated/test-scenarios.json

@@ -262,7 +262,7 @@
         "arguments": {}
       },
       "expectedDecision": "allow",
-      "reasoning": "list_allowed_directories has sideEffects=false and requires no path arguments, so it is always permitted.",
+      "reasoning": "list_allowed_directories requires no path arguments, so it is always permitted.",
       "source": "generated"
     },
     {