@provos/ironcurtain 0.9.1 → 0.11.0

package/README.md

@@ -127,7 +127,30 @@ ironcurtain start --persona my-assistant "Check my email"  # Use a persona
 
 ### Other running modes
 
-IronCurtain also supports PTY mode, session resume (`--resume <session-id>`), a Signal messaging transport for mobile approval, and a daemon mode for scheduled cron jobs. See [RUNNING_MODES.md](RUNNING_MODES.md) for details.
+IronCurtain also supports PTY mode, session resume (`--resume <session-id>`), a Signal messaging transport for mobile approval, and a daemon mode for scheduled cron jobs. The daemon has an optional [web UI](DAEMON.md#web-ui) (`--web-ui`) for browser-based monitoring and escalation handling. See [RUNNING_MODES.md](RUNNING_MODES.md) for details.
+
+### Multi-agent workflows
+
+IronCurtain orchestrates multiple AI agents through structured workflows. The bundled **vulnerability discovery** workflow hunts memory-safety and logic bugs in native code through a tiered harness pipeline (Tier 1 isolated function → Tier 2 multi-component → Tier 3 full build) with libFuzzer/AFL++ coverage gating, hypothesis-driven `discover`/`triage` states, and a final human report-review gate. The **design-and-code** workflow runs plan / design / implement / review cycles, also with human gates. Each agent runs in its own Docker container with role-specific policy boundaries; the engine manages state transitions, artifact passing, and crash-resume checkpointing automatically. Open source, runs entirely on your machine, enforces per-agent security policies via the constitution-based policy engine, and works with any Docker-containerized agent — comparable in scope to Amazon Kiro and Google Jules for coding tasks, but with first-class security and an extensible workflow definition format.
+
+![Vuln-discovery state machine in the IronCurtain web UI](packages/web-ui/docs/workflow-state-machine.png)
+
+**The web UI is the intended interface for workflow runs.** Start the daemon, open the printed URL, and drive runs from the Workflows page — the state-machine graph above is live, the agent-message timeline streams with markdown rendering, gate reviews include a workspace + artifact browser, and past runs stay listed.
+
+```bash
+ironcurtain daemon --web-ui
+```
+
+CLI access is available for scripting, automation, and debugging:
+
+```bash
+ironcurtain workflow start vuln-discovery \
+  "Find memory-safety bugs in libical" --workspace ~/src/libical
+ironcurtain workflow start design-and-code \
+  "Build a REST API with authentication"
+```
+
+See [WORKFLOWS.md](WORKFLOWS.md) for the full documentation.
 
 ## Customizing Your Policy
 
@@ -161,6 +184,10 @@ ironcurtain start --persona my-assistant "Check my calendar"
 
 In mux mode, `/new my-assistant` spawns a tab using that persona. Personas can also be assigned to cron jobs. See [DAEMON.md](DAEMON.md) for scheduled job configuration.
 
+### Skills
+
+Drop SKILL.md packages under `~/.ironcurtain/skills/<name>/` to make purpose-specific guidance (helper scripts, deterministic checks, domain knowledge) available to every Docker agent session. The merged set is staged into a per-bundle host directory and bind-mounted **read-only** into the container at the path the active agent's native discovery walks — Claude Code is pointed at the staging dir via `--add-dir`, Goose scans `~/.config/goose/skills/<name>/SKILL.md`. The agent discovers them automatically and decides when to read them based on each skill's frontmatter description. The SKILL.md _format_ is the open standard adopted by Claude Code, Goose, and Codex; only the _discovery path_ differs per agent. Workflows can ship per-state skills inside the workflow package — see [WORKFLOWS.md](WORKFLOWS.md#skills).
+
 ## Policy: Constitution → Enforcement
 
 You write intent in plain English; IronCurtain compiles it into deterministic rules:
@@ -203,7 +230,8 @@ compiles to:
 Any call that doesn't match an explicit `allow` or `escalate` rule is **denied by default**.
 
 ```bash
-ironcurtain annotate-tools                      # Classify MCP tool arguments (re-run when servers change)
+ironcurtain annotate-tools --server filesystem   # Annotate one server (merge with existing)
+ironcurtain annotate-tools --all                 # Re-annotate all servers
 ironcurtain compile-policy                      # Compile constitution into rules and verify
 ironcurtain refresh-lists                       # Re-resolve dynamic lists without full recompilation
 ironcurtain refresh-lists --list major-news     # Refresh a single list
@@ -222,6 +250,7 @@ IronCurtain stores configuration and session data in `~/.ironcurtain/`:
 ├── constitution-user.md     # Your policy customizations (generated by customize-policy)
 ├── generated/               # User-compiled policy artifacts (overrides package defaults)
 ├── personas/                # Persona directories (constitution, policy, workspace, memory)
+├── skills/                  # User-global SKILL.md packages, mounted into every Docker session
 ├── jobs/                    # Cron job definitions, workspaces, and run records
 ├── sessions/
 │   └── {sessionId}/
@@ -229,7 +258,27 @@ IronCurtain stores configuration and session data in `~/.ironcurtain/`:
 │       ├── escalations/     # File-based IPC for human approval
 │       ├── audit.jsonl      # Per-session audit log
 │       └── session.log      # Diagnostics
+└── workflow-runs/           # Shared-container workflow runs (see below)
+```
+
+Single-session runs (`ironcurtain start`, mux tabs, cron jobs) write under `sessions/`. Shared-container workflow runs write under `workflow-runs/` instead — see the next section.
+
+### Workflow run layout
+
+A workflow definition can opt in to a shared Docker container by setting `settings.sharedContainer: true` in its YAML. In that mode every agent state runs inside the same long-lived container and shares one policy engine instance; between states the orchestrator hot-swaps the active policy so each persona sees its own rules. All artifacts for the run land in a single tree:
+
 ```
+~/.ironcurtain/workflow-runs/<workflowId>/
+├── audit.jsonl              # Persona-tagged append-only audit
+├── messages.jsonl           # Orchestrator message log
+├── workspace/               # Agent workspace (filesystem MCP root)
+├── bundle/                  # Shared container support (claude-state, orientation, sockets, escalations, system-prompt.txt)
+├── states/
+│   └── <stateId>.<visitCount>/   # session.log + session-metadata.json per invocation
+└── proxy-control.sock       # Coordinator UDS for policy hot-swap
+```
+
+No per-session entries are created under `~/.ironcurtain/sessions/` for a shared-container workflow run. User-visible commands (`ironcurtain workflow start|resume|inspect|list`) are unchanged. See [WORKFLOWS.md](WORKFLOWS.md) for authoring workflow definitions and the full lifecycle.
 
 Edit configuration interactively:
 
@@ -239,20 +288,28 @@ ironcurtain config
 
 Key configuration areas: models and API keys, resource budgets (token/step/time/cost limits), auto-approve escalations, web search provider, audit redaction, and memory server LLM settings. See [CONFIG.md](CONFIG.md) for the full reference.
 
+To route LLM traffic through a gateway like LiteLLM or OpenRouter (in both Code Mode and Docker Agent Mode), see [MODEL_ROUTING.md](MODEL_ROUTING.md).
+
 ## Built-in Capabilities
 
 IronCurtain ships with six pre-configured MCP servers. All tool calls (except memory) are governed by your compiled policy.
 
-| Server               | Tools | Key capabilities                                                                                                  |
-| -------------------- | ----- | ----------------------------------------------------------------------------------------------------------------- |
-| **Filesystem**       | 14    | Read, write, edit, search files; directory tree; move; diff calculation                                           |
-| **Git**              | 28    | Full git workflow: status, diff, log, commit, branch, push/pull/fetch, clone, stash, blame                        |
-| **Fetch**            | 2     | HTTP GET with HTML-to-markdown conversion; web search (Brave, Tavily, SerpAPI)                                    |
-| **GitHub**           | 41    | Issues, PRs, code search, reviews via `ghcr.io/github/github-mcp-server`; requires a GitHub personal access token |
-| **Google Workspace** | 128   | Gmail, Calendar, Drive, Docs, Sheets — requires OAuth setup via `ironcurtain auth`                                |
+| Server               | Tools | Key capabilities                                                                                                                                  |
+| -------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Filesystem**       | 14    | Read, write, edit, search files; directory tree; move; diff calculation                                                                           |
+| **Git**              | 28    | Full git workflow: status, diff, log, commit, branch, push/pull/fetch, clone, stash, blame                                                        |
+| **Fetch**            | 2     | HTTP GET with HTML-to-markdown conversion; web search (Brave, Tavily, SerpAPI)                                                                    |
+| **GitHub**           | 41    | Issues, PRs, code search, reviews via `ghcr.io/github/github-mcp-server`; requires a GitHub personal access token                                 |
+| **Google Workspace** | 128   | Gmail, Calendar, Drive, Docs, Sheets — requires OAuth setup via `ironcurtain auth`                                                                |
 | **Memory**           | 5     | Persistent semantic memory with hybrid vector+keyword search, LLM summarization, and automatic compaction. Enabled for persona and cron sessions. |
 
-Read-only operations are allowed by default policy; mutations (writes, pushes, PR creation) escalate for human approval. Tools use `server.tool` naming (e.g., `filesystem.read_file`, `memory.recall`).
+Read-only operations are allowed by default policy; mutations (writes, pushes, PR creation) escalate for human approval. Tools use `server.tool` naming (e.g., `filesystem.read_file`, `memory.recall`). See [ADDING_MCP_SERVERS.md](ADDING_MCP_SERVERS.md) to add your own.
+
+### Network Passthrough (Docker Agent Mode)
+
+In Docker Agent Mode, the container has no network access — all traffic goes through IronCurtain's MITM proxy. By default, only LLM provider domains are reachable. The agent can request access to additional domains at runtime via the `proxy` virtual MCP server (`add_proxy_domain`). Each request requires human approval via the escalation flow.
+
+Approved domains get a **raw passthrough tunnel** — HTTP, HTTPS, and WebSocket connections are forwarded without content inspection or credential injection. This gives the agent greater utility (calling third-party APIs, streaming data from external services) but means traffic to those domains is **unmediated**. See [SECURITY_CONCERNS.md](docs/SECURITY_CONCERNS.md) Section 2b-i for the threat model and [DEVELOPER_GUIDE.md](DEVELOPER_GUIDE.md) for usage details.
 
 ## Security Model
 
@@ -323,6 +380,8 @@ src/
 ├── daemon/                     # Unified daemon (Signal + cron scheduler, control socket)
 ├── cron/                       # Cron job management (scheduler, job store, git sync, policy)
 ├── docker/                     # Docker agent mode, PTY session, MITM proxy, registry proxy
+├── workflow/                   # Multi-agent workflow engine (orchestrator, state machine, gates)
+├── web-ui/                     # Web UI backend (JSON-RPC dispatch, event bus, workflow manager)
 ├── servers/                    # Built-in MCP servers (fetch, web search providers)
 └── types/                      # Shared type definitions
 packages/

package/dist/auth/oauth-provider.js

@@ -7,6 +7,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { getOAuthDir } from '../config/paths.js';
+import { isPlainObject } from '../utils/is-plain-object.js';
 // ---------------------------------------------------------------------------
 // Credential loading
 // ---------------------------------------------------------------------------
@@ -66,8 +67,4 @@ function extractClientCredentials(parsed, filePath) {
     }
     return { clientId, clientSecret };
 }
-/** Type guard for non-null, non-array objects. */
-function isPlainObject(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
 //# sourceMappingURL=oauth-provider.js.map

package/dist/auth/oauth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAgDjD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA6B;IACjE,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC1D,OAAO,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,QAAgB;IACzD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,KAAK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,MAAe,EAAE,QAAgB;IACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,0BAA0B,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAE7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED,kDAAkD;AAClD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAgD5D,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA6B;IACjE,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC1D,OAAO,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,QAAgB;IACzD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,KAAK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,MAAe,EAAE,QAAgB;IACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,0BAA0B,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAE7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC"}

package/dist/cli.js

@@ -26,11 +26,14 @@ const topLevelSpec = {
         { name: 'auth', description: 'Manage OAuth providers (import credentials, authorize, revoke)' },
         { name: 'setup', description: 'Run the first-start wizard (always runs)' },
         { name: 'setup-signal', description: 'Interactive Signal transport onboarding' },
-        { name: 'annotate-tools', description: 'Classify MCP tool arguments via LLM' },
+        { name: 'annotate-tools', description: 'Classify MCP tool arguments via LLM (--server <name> or --all)' },
         { name: 'compile-policy', description: 'Compile constitution into enforceable policy rules' },
         { name: 'refresh-lists', description: 'Re-resolve dynamic lists without full recompilation' },
         { name: 'customize-policy', description: 'Customize your policy via LLM-assisted conversation' },
         { name: 'config', description: 'Edit configuration interactively' },
+        { name: 'workflow', description: 'Run multi-agent workflows (start, resume, inspect)' },
+        { name: 'observe', description: 'Watch live LLM token output for running sessions' },
+        { name: 'doctor', description: 'Diagnose installation, credentials, and MCP server health' },
         { name: 'help', description: 'Show this help message' },
     ],
     options: [
@@ -77,6 +80,26 @@ if (!subcommand || subcommand === 'help') {
     printSpecHelp(topLevelSpec);
     process.exit(0);
 }
+// Commands that require the V8 sandbox. We check early to catch Node version
+// mismatches (like Node 25) or stale native module builds before importing heavy dependencies.
+// `compile-policy` is the offline policy pipeline and never instantiates the V8 sandbox.
+const requiresSandbox = ['start', 'daemon', 'bot', 'workflow'];
+if (requiresSandbox.includes(subcommand)) {
+    const { checkSandboxViability } = await import('./utils/preflight-checks.js');
+    const result = await checkSandboxViability();
+    if (!result.ok) {
+        const chalk = (await import('chalk')).default;
+        // Use process.stderr.write rather than console.error because the logger
+        // (src/logger.ts) monkey-patches console.* to redirect into the session log
+        // file. Writing directly to stderr keeps fatal errors visible on the terminal.
+        process.stderr.write(`\n${chalk.bold(chalk.red('Fatal Error:'))} ${result.message}\n`);
+        if (result.details) {
+            process.stderr.write(chalk.dim(result.details) + '\n');
+        }
+        process.stderr.write(chalk.dim('Run `ironcurtain doctor` for a full diagnostic.\n\n'));
+        process.exit(1);
+    }
+}
 switch (subcommand) {
     case 'start': {
         const { main } = await import('./index.js');
@@ -85,7 +108,7 @@ switch (subcommand) {
     }
     case 'annotate-tools': {
         const { main } = await import('./pipeline/annotate.js');
-        await main();
+        await main(process.argv.slice(3));
         break;
     }
     case 'compile-policy': {
@@ -159,6 +182,21 @@ switch (subcommand) {
         await listenerMain();
         break;
     }
+    case 'workflow': {
+        const { main: workflowMain } = await import('./workflow/workflow-command.js');
+        await workflowMain(process.argv.slice(3));
+        break;
+    }
+    case 'observe': {
+        const { runObserveCommand } = await import('./observe/observe-command.js');
+        await runObserveCommand(process.argv.slice(3));
+        break;
+    }
+    case 'doctor': {
+        const { runDoctorCommand } = await import('./doctor/doctor-command.js');
+        await runDoctorCommand(process.argv.slice(3));
+        break;
+    }
     case 'setup-signal': {
         if (checkHelp({ help: process.argv.includes('--help') || process.argv.includes('-h') }, setupSignalSpec))
             break;

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,aAAa,EAAoB,MAAM,eAAe,CAAC;AAExF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,YAAY,GAAgB;IAChC,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,CAAC,iCAAiC,CAAC;IAC1C,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,4CAA4C,EAAE;QACnF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;QAC/D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,2DAA2D,EAAE;QACzF,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,sDAAsD,EAAE;QACpG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACxE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAC3E,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,gEAAgE,EAAE;QAC/F,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC1E,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAChF,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,qCAAqC,EAAE;QAC9E,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,oDAAoD,EAAE;QAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAChG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;QACnE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,EAAE;KACxD;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE;QACnE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE;KACpE;IACD,QAAQ,EAAE;QACR,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,6EAA6E;QAC7E,sEAAsE;QACtE,2DAA2D;QAC3D,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;KACzE;CACF,CAAC;AAEF,MAAM,eAAe,GAAgB;IACnC,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,yCAAyC;IACtD,KAAK,EAAE,CAAC,oCAAoC,CAAC;IAC7C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;CACjF,CAAC;AAEF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,+EAA+E;AAC/E,wEAAwE;AACxE,gDAAgD;AAChD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACzC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,SAAS,CAAC,CAAC,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM;IACR,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,CAAC;QACZ,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAClE,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC5D,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,kDAAkD;YAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;YAAE,MAAM;QAChH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,aAAa,EAAoB,MAAM,eAAe,CAAC;AAExF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,YAAY,GAAgB;IAChC,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,CAAC,iCAAiC,CAAC;IAC1C,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,4CAA4C,EAAE;QACnF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;QAC/D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,2DAA2D,EAAE;QACzF,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,sDAAsD,EAAE;QACpG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACxE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAC3E,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,gEAAgE,EAAE;QAC/F,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC1E,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAChF,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,gEAAgE,EAAE;QACzG,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,oDAAoD,EAAE;QAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAChG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;QACnE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,oDAAoD,EAAE;QACvF,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACpF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2DAA2D,EAAE;QAC5F,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,EAAE;KACxD;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE;QACnE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE;KACpE;IACD,QAAQ,EAAE;QACR,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,6EAA6E;QAC7E,sEAAsE;QACtE,2DAA2D;QAC3D,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;KACzE;CACF,CAAC;AAEF,MAAM,eAAe,GAAgB;IACnC,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,yCAAyC;IACtD,KAAK,EAAE,CAAC,oCAAoC,CAAC;IAC7C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;CACjF,CAAC;AAEF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,+EAA+E;AAC/E,wEAAwE;AACxE,gDAAgD;AAChD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACzC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,+FAA+F;AAC/F,yFAAyF;AACzF,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AAC/D,IAAI,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;IACzC,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9C,wEAAwE;QACxE,4EAA4E;QAC5E,+EAA+E;QAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,SAAS,CAAC,CAAC,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM;IACR,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,CAAC;QACZ,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAClE,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC5D,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,kDAAkD;YAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,UAAU,CAAC,CAAC,CAAC;QAChB,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC9E,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM;IACR,CAAC;IACD,KAAK,SAAS,CAAC,CAAC,CAAC;QACf,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;YAAE,MAAM;QAChH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/config/config-command.js

@@ -9,7 +9,7 @@ import * as p from '@clack/prompts';
 import { readFileSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { loadUserConfig, saveUserConfig, validateModelId, ESCALATION_TIMEOUT_MIN, ESCALATION_TIMEOUT_MAX, WEB_SEARCH_PROVIDERS, WEB_SEARCH_PROVIDER_LABELS, WEB_SEARCH_PROVIDER_URLS, GOOSE_PROVIDERS, DOCKER_AGENTS, } from './user-config.js';
+import { loadUserConfig, saveUserConfig, validateModelId, ESCALATION_TIMEOUT_MIN, ESCALATION_TIMEOUT_MAX, WEB_SEARCH_PROVIDERS, WEB_SEARCH_PROVIDER_LABELS, WEB_SEARCH_PROVIDER_URLS, GOOSE_PROVIDERS, DOCKER_AGENTS, SESSION_MODES, } from './user-config.js';
 import { getUserConfigPath } from './paths.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /** Known model options for selection prompts. */
@@ -73,17 +73,26 @@ export function computeDiff(resolved, pending) {
     const topLevelKeys = [
         'agentModelId',
         'policyModelId',
+        'prefilterModelId',
         'escalationTimeoutSeconds',
         'gooseProvider',
         'gooseModel',
         'preferredDockerAgent',
+        'preferredMode',
     ];
     for (const key of topLevelKeys) {
         if (key in pending && pending[key] !== undefined && pending[key] !== resolved[key]) {
             diffs.push([key, { from: resolved[key], to: pending[key] }]);
         }
     }
-    const nestedSections = ['resourceBudget', 'autoCompact', 'autoApprove', 'auditRedaction', 'memory'];
+    const nestedSections = [
+        'resourceBudget',
+        'autoCompact',
+        'autoApprove',
+        'auditRedaction',
+        'memory',
+        'dockerResources',
+    ];
     for (const section of nestedSections) {
         const pendingSection = pending[section];
         if (!pendingSection)
@@ -198,8 +207,8 @@ async function promptNullableNumber(opts) {
             if (!val || val.trim() === '')
                 return 'Must be a number';
             const n = Number(val);
-            if (isNaN(n))
-                return 'Must be a number';
+            if (!Number.isFinite(n))
+                return 'Must be a finite number';
             return opts.validate?.(n);
         },
     });
@@ -213,18 +222,25 @@ async function handleModels(resolved, pending) {
     while (true) {
         const currentAgent = pending.agentModelId ?? resolved.agentModelId;
         const currentPolicy = pending.policyModelId ?? resolved.policyModelId;
+        const currentPrefilter = pending.prefilterModelId ?? resolved.prefilterModelId;
         const field = await p.select({
             message: 'Models',
             options: [
                 { value: 'agentModelId', label: 'Agent model', hint: formatModelShort(currentAgent) },
                 { value: 'policyModelId', label: 'Policy model', hint: formatModelShort(currentPolicy) },
+                { value: 'prefilterModelId', label: 'Pre-filter model', hint: formatModelShort(currentPrefilter) },
                 { value: 'back', label: 'Back' },
             ],
         });
         if (isCancelled(field) || field === 'back')
             return;
-        const current = field === 'agentModelId' ? currentAgent : currentPolicy;
-        const newValue = await promptModelId(field === 'agentModelId' ? 'Select agent model:' : 'Select policy model:', current);
+        const current = field === 'agentModelId' ? currentAgent : field === 'policyModelId' ? currentPolicy : currentPrefilter;
+        const promptLabel = field === 'agentModelId'
+            ? 'Select agent model:'
+            : field === 'policyModelId'
+                ? 'Select policy model:'
+                : 'Select pre-filter model:';
+        const newValue = await promptModelId(promptLabel, current);
         if (newValue !== undefined && newValue !== current) {
             pending[field] = newValue;
         }
@@ -305,10 +321,16 @@ async function handleSecurity(resolved, pending) {
 async function handleMemory(resolved, pending) {
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
     while (true) {
+        const currentEnabled = pending.memory?.enabled ?? resolved.memory.enabled;
         const currentAutoSave = pending.memory?.autoSave ?? resolved.memory.autoSave;
         const field = await p.select({
             message: 'Memory',
             options: [
+                {
+                    value: 'enabled',
+                    label: 'Enabled (kill switch — affects all personas/jobs)',
+                    hint: currentEnabled ? 'on' : 'off',
+                },
                 {
                     value: 'autoSave',
                     label: 'Auto-save session summary to memory',
@@ -319,7 +341,18 @@ async function handleMemory(resolved, pending) {
         });
         if (isCancelled(field) || field === 'back')
             return;
-        if (field === 'autoSave') {
+        if (field === 'enabled') {
+            const enabled = await p.confirm({
+                message: 'Enable memory globally? (turning this off disables memory for all personas and jobs)',
+                initialValue: currentEnabled,
+            });
+            if (isCancelled(enabled))
+                continue;
+            if (enabled !== currentEnabled) {
+                pending.memory = { ...pending.memory, enabled: enabled };
+            }
+        }
+        else if (field === 'autoSave') {
             const enabled = await p.confirm({
                 message: 'Auto-save a session summary to memory when sessions end?',
                 initialValue: currentAutoSave,
@@ -652,6 +685,54 @@ async function handleServerCredentials(resolved, pending) {
         }
     }
 }
+// ─── Session Mode ─────────────────────────────────────────────
+/** Human-readable labels for session modes. */
+const SESSION_MODE_LABELS = {
+    docker: 'Docker (recommended)',
+    builtin: 'Builtin (V8 sandbox)',
+};
+/** Short labels used in hints (no parenthetical). */
+const SESSION_MODE_SHORT_LABELS = {
+    docker: 'Docker',
+    builtin: 'Builtin',
+};
+async function handleSessionMode(resolved, pending) {
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
+    while (true) {
+        const currentMode = pending.preferredMode ?? resolved.preferredMode;
+        const field = await p.select({
+            message: 'Session Mode',
+            options: [
+                {
+                    value: 'preferredMode',
+                    label: 'Preferred mode',
+                    hint: SESSION_MODE_LABELS[currentMode],
+                },
+                { value: 'back', label: 'Back' },
+            ],
+        });
+        if (isCancelled(field) || field === 'back')
+            return;
+        if (field === 'preferredMode') {
+            const modeOptions = SESSION_MODES.map((mode) => ({
+                value: mode,
+                label: SESSION_MODE_LABELS[mode],
+                hint: mode === currentMode ? '(current)' : undefined,
+            }));
+            const selected = await p.select({
+                message: 'Select preferred session mode:',
+                options: modeOptions,
+                initialValue: currentMode,
+            });
+            if (isCancelled(selected))
+                continue;
+            const mode = selected;
+            if (mode !== currentMode) {
+                pending.preferredMode = mode;
+            }
+        }
+    }
+}
 // ─── Docker Agent Settings ────────────────────────────────────
 /** Human-readable labels for Goose providers. */
 const GOOSE_PROVIDER_LABELS = {
@@ -674,6 +755,11 @@ async function handleDockerAgent(resolved, pending) {
                 label: 'Preferred agent',
                 hint: DOCKER_AGENT_LABELS[currentPreferred],
             },
+            {
+                value: 'dockerResources',
+                label: 'Container resources...',
+                hint: dockerResourcesSummary(resolved, pending),
+            },
             {
                 value: 'configureGoose',
                 label: 'Configure Goose...',
@@ -708,8 +794,74 @@ async function handleDockerAgent(resolved, pending) {
         else if (field === 'configureGoose') {
             await handleGooseConfig(resolved, pending);
         }
+        else if (field === 'dockerResources') {
+            await handleDockerResources(resolved, pending);
+        }
     }
 }
+/** Submenu for Docker container memory and cpu ceilings. */
+async function handleDockerResources(resolved, pending) {
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
+    while (true) {
+        const current = { ...resolved.dockerResources, ...(pending.dockerResources ?? {}) };
+        const field = await p.select({
+            message: 'Docker container resources',
+            options: [
+                {
+                    value: 'memoryMb',
+                    label: 'Memory ceiling (MB)',
+                    hint: current.memoryMb === null ? 'unlimited' : `${current.memoryMb} MB`,
+                },
+                {
+                    value: 'cpus',
+                    label: 'CPU ceiling',
+                    hint: current.cpus === null ? 'unlimited' : String(current.cpus),
+                },
+                { value: 'back', label: 'Back' },
+            ],
+        });
+        if (isCancelled(field) || field === 'back')
+            return;
+        if (field === 'memoryMb') {
+            const result = await promptNullableNumber({
+                message: 'Memory ceiling (MB):',
+                current: current.memoryMb,
+                format: (n) => (n === null ? 'unlimited' : `${n} MB`),
+                validate: (n) => {
+                    if (!Number.isInteger(n))
+                        return 'Must be an integer';
+                    if (n < 6)
+                        return 'Must be at least 6 (Docker minimum)';
+                    return undefined;
+                },
+            });
+            if (result !== undefined) {
+                pending.dockerResources = { ...(pending.dockerResources ?? {}), memoryMb: result };
+            }
+        }
+        else if (field === 'cpus') {
+            const result = await promptNullableNumber({
+                message: 'CPU ceiling (decimal allowed, e.g. 1.5):',
+                current: current.cpus,
+                format: (n) => (n === null ? 'unlimited' : String(n)),
+                validate: (n) => {
+                    if (n < 0.01)
+                        return 'Must be at least 0.01 (Docker minimum)';
+                    return undefined;
+                },
+            });
+            if (result !== undefined) {
+                pending.dockerResources = { ...(pending.dockerResources ?? {}), cpus: result };
+            }
+        }
+    }
+}
+function dockerResourcesSummary(resolved, pending) {
+    const r = { ...resolved.dockerResources, ...(pending.dockerResources ?? {}) };
+    const cpu = r.cpus === null ? 'unlimited' : `${r.cpus} cpus`;
+    const mem = r.memoryMb === null ? 'unlimited' : `${r.memoryMb} MB`;
+    return `${cpu}, ${mem}`;
+}
 /** Goose-specific configuration submenu (provider + model). */
 async function handleGooseConfig(resolved, pending) {
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
@@ -776,7 +928,8 @@ function gooseConfigHint(resolved, pending) {
 function modelsHint(resolved, pending) {
     const agent = formatModelShort(pending.agentModelId ?? resolved.agentModelId);
     const policy = formatModelShort(pending.policyModelId ?? resolved.policyModelId);
-    return `${agent}, ${policy}`;
+    const prefilter = formatModelShort(pending.prefilterModelId ?? resolved.prefilterModelId);
+    return `${agent}, ${policy}, pre-filter: ${prefilter}`;
 }
 function securityHint(resolved, pending) {
     const timeout = formatSeconds(pending.escalationTimeoutSeconds ?? resolved.escalationTimeoutSeconds);
@@ -803,11 +956,18 @@ function serverCredentialsHint(resolved, pending) {
     return configured.map(([name]) => name).join(', ');
 }
 function memoryHint(resolved, pending) {
+    const enabled = pending.memory?.enabled ?? resolved.memory.enabled;
     const autoSave = pending.memory?.autoSave ?? resolved.memory.autoSave;
-    return `auto-save: ${autoSave ? 'on' : 'off'}`;
+    if (!enabled)
+        return 'off (kill switch)';
+    return `on, auto-save: ${autoSave ? 'on' : 'off'}`;
 }
 function dockerAgentHint(resolved, pending) {
-    return DOCKER_AGENT_LABELS[pending.preferredDockerAgent ?? resolved.preferredDockerAgent];
+    const agent = DOCKER_AGENT_LABELS[pending.preferredDockerAgent ?? resolved.preferredDockerAgent];
+    return `${agent}, ${dockerResourcesSummary(resolved, pending)}`;
+}
+function sessionModeHint(resolved, pending) {
+    return SESSION_MODE_SHORT_LABELS[pending.preferredMode ?? resolved.preferredMode];
 }
 function changeCount(resolved, pending) {
     const diffs = computeDiff(resolved, pending);
@@ -845,6 +1005,7 @@ export async function runConfigCommand() {
                 { value: 'websearch', label: `Web Search (${webSearchHint(resolved, pending)})` },
                 { value: 'credentials', label: `Server Credentials (${serverCredentialsHint(resolved, pending)})` },
                 { value: 'memory', label: `Memory (${memoryHint(resolved, pending)})` },
+                { value: 'sessionMode', label: `Session Mode (${sessionModeHint(resolved, pending)})` },
                 { value: 'dockerAgent', label: `Docker Agent (${dockerAgentHint(resolved, pending)})` },
                 { value: 'save', label: 'Save & Exit', hint: changeCount(resolved, pending) },
                 { value: 'cancel', label: 'Cancel', hint: 'discard all changes' },
@@ -876,6 +1037,9 @@ export async function runConfigCommand() {
             case 'memory':
                 await handleMemory(resolved, pending);
                 break;
+            case 'sessionMode':
+                await handleSessionMode(resolved, pending);
+                break;
             case 'dockerAgent':
                 await handleDockerAgent(resolved, pending);
                 break;