@provos/ironcurtain 0.8.0 → 0.9.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (216) hide show
  1. package/README.md +11 -10
  2. package/dist/auth/auth-command.d.ts +15 -0
  3. package/dist/auth/auth-command.js +424 -0
  4. package/dist/auth/auth-command.js.map +1 -0
  5. package/dist/auth/oauth-flow.d.ts +46 -0
  6. package/dist/auth/oauth-flow.js +279 -0
  7. package/dist/auth/oauth-flow.js.map +1 -0
  8. package/dist/auth/oauth-provider.d.ts +55 -0
  9. package/dist/auth/oauth-provider.js +73 -0
  10. package/dist/auth/oauth-provider.js.map +1 -0
  11. package/dist/auth/oauth-registry.d.ts +34 -0
  12. package/dist/auth/oauth-registry.js +69 -0
  13. package/dist/auth/oauth-registry.js.map +1 -0
  14. package/dist/auth/oauth-token-provider.d.ts +52 -0
  15. package/dist/auth/oauth-token-provider.js +159 -0
  16. package/dist/auth/oauth-token-provider.js.map +1 -0
  17. package/dist/auth/oauth-token-store.d.ts +30 -0
  18. package/dist/auth/oauth-token-store.js +93 -0
  19. package/dist/auth/oauth-token-store.js.map +1 -0
  20. package/dist/auth/providers/google-scopes.d.ts +35 -0
  21. package/dist/auth/providers/google-scopes.js +183 -0
  22. package/dist/auth/providers/google-scopes.js.map +1 -0
  23. package/dist/auth/providers/google.d.ts +2 -0
  24. package/dist/auth/providers/google.js +28 -0
  25. package/dist/auth/providers/google.js.map +1 -0
  26. package/dist/cli.js +6 -0
  27. package/dist/cli.js.map +1 -1
  28. package/dist/config/config-command.js +39 -1
  29. package/dist/config/config-command.js.map +1 -1
  30. package/dist/config/constitution-readonly.md +14 -11
  31. package/dist/config/constitution-user-base.md +15 -0
  32. package/dist/config/generated/test-scenarios.json +1 -1
  33. package/dist/config/generated/tool-annotations.json +10617 -296
  34. package/dist/config/generated-readonly/compiled-policy.json +787 -244
  35. package/dist/config/index.d.ts +2 -2
  36. package/dist/config/index.js +8 -0
  37. package/dist/config/index.js.map +1 -1
  38. package/dist/config/mcp-servers.json +23 -0
  39. package/dist/config/paths.d.ts +15 -0
  40. package/dist/config/paths.js +35 -0
  41. package/dist/config/paths.js.map +1 -1
  42. package/dist/config/types.d.ts +8 -0
  43. package/dist/config/user-config.d.ts +2 -0
  44. package/dist/config/user-config.js +2 -0
  45. package/dist/config/user-config.js.map +1 -1
  46. package/dist/cron/headless-transport.d.ts +4 -0
  47. package/dist/cron/headless-transport.js +1 -1
  48. package/dist/cron/headless-transport.js.map +1 -1
  49. package/dist/daemon/ironcurtain-daemon.js +6 -1
  50. package/dist/daemon/ironcurtain-daemon.js.map +1 -1
  51. package/dist/docker/docker-agent-session.d.ts +3 -1
  52. package/dist/docker/docker-agent-session.js +49 -28
  53. package/dist/docker/docker-agent-session.js.map +1 -1
  54. package/dist/docker/docker-infrastructure.js +39 -11
  55. package/dist/docker/docker-infrastructure.js.map +1 -1
  56. package/dist/docker/docker-manager.d.ts +2 -0
  57. package/dist/docker/docker-manager.js +9 -1
  58. package/dist/docker/docker-manager.js.map +1 -1
  59. package/dist/docker/mitm-proxy.d.ts +50 -0
  60. package/dist/docker/mitm-proxy.js +220 -31
  61. package/dist/docker/mitm-proxy.js.map +1 -1
  62. package/dist/docker/oauth-credentials.d.ts +45 -6
  63. package/dist/docker/oauth-credentials.js +151 -24
  64. package/dist/docker/oauth-credentials.js.map +1 -1
  65. package/dist/docker/oauth-token-manager.d.ts +15 -16
  66. package/dist/docker/oauth-token-manager.js +23 -17
  67. package/dist/docker/oauth-token-manager.js.map +1 -1
  68. package/dist/docker/platform.d.ts +6 -6
  69. package/dist/docker/platform.js +8 -6
  70. package/dist/docker/platform.js.map +1 -1
  71. package/dist/docker/proxy-tools.d.ts +80 -0
  72. package/dist/docker/proxy-tools.js +248 -0
  73. package/dist/docker/proxy-tools.js.map +1 -0
  74. package/dist/docker/pty-session.js +48 -29
  75. package/dist/docker/pty-session.js.map +1 -1
  76. package/dist/docker/pty-types.d.ts +4 -0
  77. package/dist/docker/pty-types.js.map +1 -1
  78. package/dist/escalation/escalation-watcher.d.ts +3 -1
  79. package/dist/escalation/escalation-watcher.js +6 -2
  80. package/dist/escalation/escalation-watcher.js.map +1 -1
  81. package/dist/escalation/listener-command.js +24 -10
  82. package/dist/escalation/listener-command.js.map +1 -1
  83. package/dist/escalation/listener-lock.d.ts +5 -0
  84. package/dist/escalation/listener-lock.js +14 -0
  85. package/dist/escalation/listener-lock.js.map +1 -1
  86. package/dist/index.js +6 -1
  87. package/dist/index.js.map +1 -1
  88. package/dist/memory/auto-save.d.ts +25 -0
  89. package/dist/memory/auto-save.js +89 -0
  90. package/dist/memory/auto-save.js.map +1 -0
  91. package/dist/mux/mux-app.d.ts +4 -0
  92. package/dist/mux/mux-app.js +186 -21
  93. package/dist/mux/mux-app.js.map +1 -1
  94. package/dist/mux/mux-command.d.ts +2 -2
  95. package/dist/mux/mux-command.js +14 -22
  96. package/dist/mux/mux-command.js.map +1 -1
  97. package/dist/mux/mux-escalation-manager.d.ts +9 -3
  98. package/dist/mux/mux-escalation-manager.js +69 -19
  99. package/dist/mux/mux-escalation-manager.js.map +1 -1
  100. package/dist/mux/mux-input-handler.d.ts +33 -1
  101. package/dist/mux/mux-input-handler.js +112 -29
  102. package/dist/mux/mux-input-handler.js.map +1 -1
  103. package/dist/mux/mux-renderer.d.ts +17 -1
  104. package/dist/mux/mux-renderer.js +288 -7
  105. package/dist/mux/mux-renderer.js.map +1 -1
  106. package/dist/mux/pty-bridge.d.ts +4 -0
  107. package/dist/mux/pty-bridge.js +13 -1
  108. package/dist/mux/pty-bridge.js.map +1 -1
  109. package/dist/mux/types.d.ts +24 -1
  110. package/dist/mux/types.js +10 -1
  111. package/dist/mux/types.js.map +1 -1
  112. package/dist/persona/persona-command.js +0 -5
  113. package/dist/persona/persona-command.js.map +1 -1
  114. package/dist/pipeline/annotate.js +1 -7
  115. package/dist/pipeline/annotate.js.map +1 -1
  116. package/dist/pipeline/compile.d.ts +5 -2
  117. package/dist/pipeline/compile.js +23 -11
  118. package/dist/pipeline/compile.js.map +1 -1
  119. package/dist/pipeline/constitution-compiler.d.ts +302 -3
  120. package/dist/pipeline/constitution-compiler.js +285 -23
  121. package/dist/pipeline/constitution-compiler.js.map +1 -1
  122. package/dist/pipeline/generate-with-repair.d.ts +2 -2
  123. package/dist/pipeline/generate-with-repair.js +2 -2
  124. package/dist/pipeline/handwritten-scenarios.d.ts +20 -7
  125. package/dist/pipeline/handwritten-scenarios.js +20 -41
  126. package/dist/pipeline/handwritten-scenarios.js.map +1 -1
  127. package/dist/pipeline/list-resolver.d.ts +18 -20
  128. package/dist/pipeline/list-resolver.js +28 -36
  129. package/dist/pipeline/list-resolver.js.map +1 -1
  130. package/dist/pipeline/pipeline-runner.d.ts +102 -13
  131. package/dist/pipeline/pipeline-runner.js +497 -237
  132. package/dist/pipeline/pipeline-runner.js.map +1 -1
  133. package/dist/pipeline/pipeline-shared.d.ts +7 -9
  134. package/dist/pipeline/pipeline-shared.js +8 -18
  135. package/dist/pipeline/pipeline-shared.js.map +1 -1
  136. package/dist/pipeline/policy-verifier.d.ts +32 -5
  137. package/dist/pipeline/policy-verifier.js +137 -8
  138. package/dist/pipeline/policy-verifier.js.map +1 -1
  139. package/dist/pipeline/proxy-mcp-connections.d.ts +25 -0
  140. package/dist/pipeline/proxy-mcp-connections.js +121 -0
  141. package/dist/pipeline/proxy-mcp-connections.js.map +1 -0
  142. package/dist/pipeline/refresh-lists.js +21 -13
  143. package/dist/pipeline/refresh-lists.js.map +1 -1
  144. package/dist/pipeline/scenario-generator.d.ts +29 -49
  145. package/dist/pipeline/scenario-generator.js +180 -143
  146. package/dist/pipeline/scenario-generator.js.map +1 -1
  147. package/dist/pipeline/scenario-schema-validator.d.ts +51 -0
  148. package/dist/pipeline/scenario-schema-validator.js +132 -0
  149. package/dist/pipeline/scenario-schema-validator.js.map +1 -0
  150. package/dist/pipeline/tool-annotator.d.ts +9 -8
  151. package/dist/pipeline/tool-annotator.js +48 -95
  152. package/dist/pipeline/tool-annotator.js.map +1 -1
  153. package/dist/pipeline/types.d.ts +31 -24
  154. package/dist/sandbox/index.js +20 -0
  155. package/dist/sandbox/index.js.map +1 -1
  156. package/dist/servers/fetch-server.js +10 -5
  157. package/dist/servers/fetch-server.js.map +1 -1
  158. package/dist/session/agent-session.d.ts +6 -19
  159. package/dist/session/agent-session.js +18 -69
  160. package/dist/session/agent-session.js.map +1 -1
  161. package/dist/session/base-transport.d.ts +17 -1
  162. package/dist/session/base-transport.js +25 -1
  163. package/dist/session/base-transport.js.map +1 -1
  164. package/dist/session/cli-transport.d.ts +5 -0
  165. package/dist/session/cli-transport.js +48 -25
  166. package/dist/session/cli-transport.js.map +1 -1
  167. package/dist/session/preflight.js +15 -16
  168. package/dist/session/preflight.js.map +1 -1
  169. package/dist/session/prompts.js +0 -1
  170. package/dist/session/prompts.js.map +1 -1
  171. package/dist/session/session-manager.d.ts +6 -0
  172. package/dist/session/session-manager.js +12 -0
  173. package/dist/session/session-manager.js.map +1 -1
  174. package/dist/session/types.d.ts +6 -1
  175. package/dist/session/types.js.map +1 -1
  176. package/dist/signal/signal-bot-daemon.js +24 -8
  177. package/dist/signal/signal-bot-daemon.js.map +1 -1
  178. package/dist/signal/signal-transport.d.ts +5 -2
  179. package/dist/signal/signal-transport.js +3 -3
  180. package/dist/signal/signal-transport.js.map +1 -1
  181. package/dist/trusted-process/approval-whitelist.d.ts +117 -0
  182. package/dist/trusted-process/approval-whitelist.js +237 -0
  183. package/dist/trusted-process/approval-whitelist.js.map +1 -0
  184. package/dist/trusted-process/gworkspace-credentials.d.ts +40 -0
  185. package/dist/trusted-process/gworkspace-credentials.js +45 -0
  186. package/dist/trusted-process/gworkspace-credentials.js.map +1 -0
  187. package/dist/trusted-process/index.d.ts +11 -1
  188. package/dist/trusted-process/index.js +63 -27
  189. package/dist/trusted-process/index.js.map +1 -1
  190. package/dist/trusted-process/mcp-proxy-server.d.ts +14 -0
  191. package/dist/trusted-process/mcp-proxy-server.js +325 -64
  192. package/dist/trusted-process/mcp-proxy-server.js.map +1 -1
  193. package/dist/trusted-process/policy-engine.d.ts +8 -2
  194. package/dist/trusted-process/policy-engine.js +18 -22
  195. package/dist/trusted-process/policy-engine.js.map +1 -1
  196. package/dist/trusted-process/policy-types.d.ts +17 -0
  197. package/dist/trusted-process/sandbox-integration.d.ts +23 -0
  198. package/dist/trusted-process/sandbox-integration.js +115 -3
  199. package/dist/trusted-process/sandbox-integration.js.map +1 -1
  200. package/dist/trusted-process/token-file-refresher.d.ts +69 -0
  201. package/dist/trusted-process/token-file-refresher.js +120 -0
  202. package/dist/trusted-process/token-file-refresher.js.map +1 -0
  203. package/dist/types/argument-roles.d.ts +7 -1
  204. package/dist/types/argument-roles.js +50 -0
  205. package/dist/types/argument-roles.js.map +1 -1
  206. package/dist/types/audit.d.ts +11 -0
  207. package/docker/Dockerfile.claude-code +2 -2
  208. package/docker/entrypoint-claude-code.sh +15 -5
  209. package/package.json +3 -2
  210. package/src/config/constitution-user-base.md +15 -0
  211. package/src/config/generated/test-scenarios.json +1 -1
  212. package/src/config/generated/tool-annotations.json +10617 -296
  213. package/src/config/mcp-servers.json +23 -0
  214. package/dist/pipeline/mcp-connections.d.ts +0 -16
  215. package/dist/pipeline/mcp-connections.js +0 -61
  216. package/dist/pipeline/mcp-connections.js.map +0 -1
@@ -37,5 +37,28 @@
37
37
  "ghcr.io/github/github-mcp-server"
38
38
  ],
39
39
  "sandbox": false
40
+ },
41
+ "google-workspace": {
42
+ "description": "Google Workspace tools (Gmail, Calendar, Drive, Docs, Sheets, Slides)",
43
+ "command": "npx",
44
+ "args": ["-y", "@alanse/mcp-server-google-workspace@1.0.2"],
45
+ "env": {},
46
+ "_comment": "npm registry domains are needed for the initial npx -y install. To remove them, vendor the package as a local dependency instead.",
47
+ "sandbox": {
48
+ "filesystem": {
49
+ "denyRead": ["~"],
50
+ "allowRead": ["/usr", "/lib", "/etc"]
51
+ },
52
+ "network": {
53
+ "allowedDomains": [
54
+ "googleapis.com",
55
+ "*.googleapis.com",
56
+ "accounts.google.com",
57
+ "oauth2.googleapis.com",
58
+ "registry.npmjs.org",
59
+ "*.npmjs.org"
60
+ ]
61
+ }
62
+ }
40
63
  }
41
64
  }
@@ -1,16 +0,0 @@
1
- /**
2
- * MCP server connection helpers for dynamic list resolution.
3
- *
4
- * Connects to MCP servers needed by list definitions that require
5
- * tool-use-based resolution (requiresMcp: true).
6
- */
7
- import type { MCPServerConfig } from '../config/types.js';
8
- import type { ListDefinition } from './types.js';
9
- import type { McpServerConnection } from './list-resolver.js';
10
- /**
11
- * Connects to MCP servers needed for data-backed list resolution.
12
- * Only connects to servers hinted by list definitions with requiresMcp: true.
13
- * Returns a map keyed by server name for the resolver.
14
- */
15
- export declare function connectMcpServersForLists(definitions: ListDefinition[], mcpServers: Record<string, MCPServerConfig>): Promise<Map<string, McpServerConnection>>;
16
- export declare function disconnectMcpServers(connections: Map<string, McpServerConnection>): Promise<void>;
@@ -1,61 +0,0 @@
1
- /**
2
- * MCP server connection helpers for dynamic list resolution.
3
- *
4
- * Connects to MCP servers needed by list definitions that require
5
- * tool-use-based resolution (requiresMcp: true).
6
- */
7
- import chalk from 'chalk';
8
- import { Client } from '@modelcontextprotocol/sdk/client/index.js';
9
- import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
10
- import { permissiveJsonSchemaValidator } from '../trusted-process/permissive-output-validator.js';
11
- import { VERSION } from '../version.js';
12
- /**
13
- * Connects to MCP servers needed for data-backed list resolution.
14
- * Only connects to servers hinted by list definitions with requiresMcp: true.
15
- * Returns a map keyed by server name for the resolver.
16
- */
17
- export async function connectMcpServersForLists(definitions, mcpServers) {
18
- const mcpDefs = definitions.filter((d) => d.requiresMcp);
19
- const hasUnhintedLists = mcpDefs.some((d) => !d.mcpServerHint);
20
- // Connect all configured servers if any list lacks a hint,
21
- // otherwise connect only the hinted servers.
22
- const neededServers = hasUnhintedLists
23
- ? new Set(Object.keys(mcpServers))
24
- : new Set(mcpDefs
25
- .filter((d) => d.mcpServerHint != null)
26
- .map((d) => d.mcpServerHint));
27
- const entries = await Promise.all([...neededServers].map(async (serverName) => {
28
- const serverConfig = mcpServers[serverName];
29
- // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- serverName may not exist in mcpServers at runtime (from mcpServerHint)
30
- if (!serverConfig) {
31
- console.error(` ${chalk.yellow('Warning:')} MCP server "${serverName}" not configured — skipping`);
32
- return null;
33
- }
34
- const transport = new StdioClientTransport({
35
- command: serverConfig.command,
36
- args: serverConfig.args,
37
- env: serverConfig.env ? { ...process.env, ...serverConfig.env } : undefined,
38
- stderr: 'pipe',
39
- });
40
- // Drain piped stderr to prevent backpressure
41
- if (transport.stderr) {
42
- transport.stderr.on('data', () => { });
43
- }
44
- const client = new Client({ name: 'ironcurtain-list-resolver', version: VERSION }, { jsonSchemaValidator: permissiveJsonSchemaValidator });
45
- await client.connect(transport);
46
- const toolsResult = await client.listTools();
47
- return [serverName, { client, tools: toolsResult.tools }];
48
- }));
49
- return new Map(entries.filter((e) => e !== null));
50
- }
51
- export async function disconnectMcpServers(connections) {
52
- for (const conn of connections.values()) {
53
- try {
54
- await conn.client.close();
55
- }
56
- catch {
57
- // Ignore cleanup errors
58
- }
59
- }
60
- }
61
- //# sourceMappingURL=mcp-connections.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"mcp-connections.js","sourceRoot":"","sources":["../../src/pipeline/mcp-connections.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAKxC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAA6B,EAC7B,UAA2C;IAE3C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAE/D,2DAA2D;IAC3D,6CAA6C;IAC7C,MAAM,aAAa,GAAG,gBAAgB;QACpC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,GAAG,CACL,OAAO;aACJ,MAAM,CAAC,CAAC,CAAC,EAA6C,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC;aACjF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAC/B,CAAC;IAEN,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAiD,EAAE;QACzF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAC5C,iJAAiJ;QACjJ,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,UAAU,6BAA6B,CAAC,CAAC;YACpG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;YACvG,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,6CAA6C;QAC7C,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,OAAO,EAAE,EACvD,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,CACvD,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAE7C,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAA6C;IACtF,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC"}