@provos/ironcurtain 0.9.1 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (502) hide show
  1. package/README.md +69 -10
  2. package/dist/auth/oauth-provider.js +1 -4
  3. package/dist/auth/oauth-provider.js.map +1 -1
  4. package/dist/cli.js +40 -2
  5. package/dist/cli.js.map +1 -1
  6. package/dist/config/config-command.js +174 -10
  7. package/dist/config/config-command.js.map +1 -1
  8. package/dist/config/first-start.js +61 -0
  9. package/dist/config/first-start.js.map +1 -1
  10. package/dist/config/generated/compiled-policy.json +528 -161
  11. package/dist/config/generated/test-scenarios.json +4810 -170
  12. package/dist/config/generated/tool-annotations.json +34 -47
  13. package/dist/config/index.d.ts +58 -0
  14. package/dist/config/index.js +97 -15
  15. package/dist/config/index.js.map +1 -1
  16. package/dist/config/mcp-servers.json +2 -2
  17. package/dist/config/model-provider.d.ts +8 -2
  18. package/dist/config/model-provider.js +52 -9
  19. package/dist/config/model-provider.js.map +1 -1
  20. package/dist/config/paths.d.ts +181 -0
  21. package/dist/config/paths.js +326 -23
  22. package/dist/config/paths.js.map +1 -1
  23. package/dist/config/types.d.ts +7 -1
  24. package/dist/config/user-config.d.ts +61 -4
  25. package/dist/config/user-config.js +108 -21
  26. package/dist/config/user-config.js.map +1 -1
  27. package/dist/config/validate-policy-dir.d.ts +10 -0
  28. package/dist/config/validate-policy-dir.js +59 -0
  29. package/dist/config/validate-policy-dir.js.map +1 -0
  30. package/dist/cron/compile-task-policy.js +1 -0
  31. package/dist/cron/compile-task-policy.js.map +1 -1
  32. package/dist/cron/job-commands.js +22 -2
  33. package/dist/cron/job-commands.js.map +1 -1
  34. package/dist/cron/types.d.ts +16 -2
  35. package/dist/cron/types.js +1 -3
  36. package/dist/cron/types.js.map +1 -1
  37. package/dist/daemon/daemon-command.js +16 -2
  38. package/dist/daemon/daemon-command.js.map +1 -1
  39. package/dist/daemon/ironcurtain-daemon.d.ts +44 -1
  40. package/dist/daemon/ironcurtain-daemon.js +210 -8
  41. package/dist/daemon/ironcurtain-daemon.js.map +1 -1
  42. package/dist/docker/adapters/claude-code.d.ts +2 -1
  43. package/dist/docker/adapters/claude-code.js +320 -131
  44. package/dist/docker/adapters/claude-code.js.map +1 -1
  45. package/dist/docker/adapters/goose.d.ts +12 -11
  46. package/dist/docker/adapters/goose.js +80 -27
  47. package/dist/docker/adapters/goose.js.map +1 -1
  48. package/dist/docker/agent-adapter.d.ts +178 -4
  49. package/dist/docker/agent-adapter.js +14 -0
  50. package/dist/docker/agent-adapter.js.map +1 -1
  51. package/dist/docker/agent-registry.js +3 -2
  52. package/dist/docker/agent-registry.js.map +1 -1
  53. package/dist/docker/code-mode-proxy.d.ts +27 -0
  54. package/dist/docker/code-mode-proxy.js +3 -0
  55. package/dist/docker/code-mode-proxy.js.map +1 -1
  56. package/dist/docker/container-lifecycle.d.ts +15 -0
  57. package/dist/docker/container-lifecycle.js +32 -0
  58. package/dist/docker/container-lifecycle.js.map +1 -0
  59. package/dist/docker/docker-agent-session.d.ts +113 -62
  60. package/dist/docker/docker-agent-session.js +241 -300
  61. package/dist/docker/docker-agent-session.js.map +1 -1
  62. package/dist/docker/docker-infrastructure.d.ts +256 -21
  63. package/dist/docker/docker-infrastructure.js +585 -30
  64. package/dist/docker/docker-infrastructure.js.map +1 -1
  65. package/dist/docker/docker-manager.d.ts +36 -1
  66. package/dist/docker/docker-manager.js +168 -26
  67. package/dist/docker/docker-manager.js.map +1 -1
  68. package/dist/docker/docker-progress-sink.d.ts +43 -0
  69. package/dist/docker/docker-progress-sink.js +299 -0
  70. package/dist/docker/docker-progress-sink.js.map +1 -0
  71. package/dist/docker/mitm-proxy.d.ts +90 -1
  72. package/dist/docker/mitm-proxy.js +720 -40
  73. package/dist/docker/mitm-proxy.js.map +1 -1
  74. package/dist/docker/oauth-credentials.d.ts +46 -3
  75. package/dist/docker/oauth-credentials.js +56 -14
  76. package/dist/docker/oauth-credentials.js.map +1 -1
  77. package/dist/docker/oauth-token-manager.js +2 -2
  78. package/dist/docker/oauth-token-manager.js.map +1 -1
  79. package/dist/docker/orientation.d.ts +1 -1
  80. package/dist/docker/provider-config.d.ts +81 -2
  81. package/dist/docker/provider-config.js +222 -28
  82. package/dist/docker/provider-config.js.map +1 -1
  83. package/dist/docker/proxy-tools.d.ts +0 -2
  84. package/dist/docker/proxy-tools.js +2 -7
  85. package/dist/docker/proxy-tools.js.map +1 -1
  86. package/dist/docker/pty-session.d.ts +49 -1
  87. package/dist/docker/pty-session.js +212 -90
  88. package/dist/docker/pty-session.js.map +1 -1
  89. package/dist/docker/pty-types.d.ts +0 -2
  90. package/dist/docker/pty-types.js +0 -2
  91. package/dist/docker/pty-types.js.map +1 -1
  92. package/dist/docker/resource-limits.d.ts +125 -0
  93. package/dist/docker/resource-limits.js +200 -0
  94. package/dist/docker/resource-limits.js.map +1 -0
  95. package/dist/docker/spawn-with-idle-timeout.d.ts +39 -0
  96. package/dist/docker/spawn-with-idle-timeout.js +152 -0
  97. package/dist/docker/spawn-with-idle-timeout.js.map +1 -0
  98. package/dist/docker/sse-extractor.d.ts +51 -0
  99. package/dist/docker/sse-extractor.js +303 -0
  100. package/dist/docker/sse-extractor.js.map +1 -0
  101. package/dist/docker/token-stream-bus.d.ts +83 -0
  102. package/dist/docker/token-stream-bus.js +98 -0
  103. package/dist/docker/token-stream-bus.js.map +1 -0
  104. package/dist/docker/token-stream-types.d.ts +71 -0
  105. package/dist/docker/token-stream-types.js +8 -0
  106. package/dist/docker/token-stream-types.js.map +1 -0
  107. package/dist/docker/types.d.ts +61 -6
  108. package/dist/doctor/checks.d.ts +138 -0
  109. package/dist/doctor/checks.js +511 -0
  110. package/dist/doctor/checks.js.map +1 -0
  111. package/dist/doctor/doctor-command.d.ts +29 -0
  112. package/dist/doctor/doctor-command.js +160 -0
  113. package/dist/doctor/doctor-command.js.map +1 -0
  114. package/dist/doctor/mcp-liveness.d.ts +28 -0
  115. package/dist/doctor/mcp-liveness.js +84 -0
  116. package/dist/doctor/mcp-liveness.js.map +1 -0
  117. package/dist/doctor/oauth-checks.d.ts +23 -0
  118. package/dist/doctor/oauth-checks.js +157 -0
  119. package/dist/doctor/oauth-checks.js.map +1 -0
  120. package/dist/doctor/output.d.ts +26 -0
  121. package/dist/doctor/output.js +82 -0
  122. package/dist/doctor/output.js.map +1 -0
  123. package/dist/escalation/listener-command.js +0 -3
  124. package/dist/escalation/listener-command.js.map +1 -1
  125. package/dist/event-bus/typed-event-bus.d.ts +26 -0
  126. package/dist/event-bus/typed-event-bus.js +35 -0
  127. package/dist/event-bus/typed-event-bus.js.map +1 -0
  128. package/dist/index.js +32 -9
  129. package/dist/index.js.map +1 -1
  130. package/dist/logger.js +31 -2
  131. package/dist/logger.js.map +1 -1
  132. package/dist/memory/auto-save.d.ts +18 -4
  133. package/dist/memory/auto-save.js +46 -6
  134. package/dist/memory/auto-save.js.map +1 -1
  135. package/dist/memory/memory-policy.d.ts +41 -0
  136. package/dist/memory/memory-policy.js +36 -0
  137. package/dist/memory/memory-policy.js.map +1 -0
  138. package/dist/mux/mux-app.d.ts +2 -0
  139. package/dist/mux/mux-app.js +30 -34
  140. package/dist/mux/mux-app.js.map +1 -1
  141. package/dist/mux/mux-command.d.ts +10 -1
  142. package/dist/mux/mux-command.js +62 -35
  143. package/dist/mux/mux-command.js.map +1 -1
  144. package/dist/mux/mux-renderer.js +22 -17
  145. package/dist/mux/mux-renderer.js.map +1 -1
  146. package/dist/mux/pty-bridge.d.ts +2 -0
  147. package/dist/mux/pty-bridge.js +3 -0
  148. package/dist/mux/pty-bridge.js.map +1 -1
  149. package/dist/mux/session-scanner.d.ts +7 -0
  150. package/dist/mux/session-scanner.js +21 -2
  151. package/dist/mux/session-scanner.js.map +1 -1
  152. package/dist/mux/types.d.ts +0 -4
  153. package/dist/mux/types.js.map +1 -1
  154. package/dist/{pipeline → observability}/llm-logger.d.ts +9 -3
  155. package/dist/{pipeline → observability}/llm-logger.js +16 -4
  156. package/dist/observability/llm-logger.js.map +1 -0
  157. package/dist/observe/observe-command.d.ts +12 -0
  158. package/dist/observe/observe-command.js +298 -0
  159. package/dist/observe/observe-command.js.map +1 -0
  160. package/dist/observe/observe-renderer.d.ts +24 -0
  161. package/dist/observe/observe-renderer.js +87 -0
  162. package/dist/observe/observe-renderer.js.map +1 -0
  163. package/dist/observe/observe-tui-rain.d.ts +42 -0
  164. package/dist/observe/observe-tui-rain.js +531 -0
  165. package/dist/observe/observe-tui-rain.js.map +1 -0
  166. package/dist/observe/observe-tui-text-panel.d.ts +46 -0
  167. package/dist/observe/observe-tui-text-panel.js +525 -0
  168. package/dist/observe/observe-tui-text-panel.js.map +1 -0
  169. package/dist/observe/observe-tui-types.d.ts +270 -0
  170. package/dist/observe/observe-tui-types.js +200 -0
  171. package/dist/observe/observe-tui-types.js.map +1 -0
  172. package/dist/observe/observe-tui-word-scorer.d.ts +143 -0
  173. package/dist/observe/observe-tui-word-scorer.js +572 -0
  174. package/dist/observe/observe-tui-word-scorer.js.map +1 -0
  175. package/dist/observe/observe-tui.d.ts +59 -0
  176. package/dist/observe/observe-tui.js +592 -0
  177. package/dist/observe/observe-tui.js.map +1 -0
  178. package/dist/persona/compile-persona-policy.js +1 -0
  179. package/dist/persona/compile-persona-policy.js.map +1 -1
  180. package/dist/persona/memory-gate.d.ts +19 -0
  181. package/dist/persona/memory-gate.js +33 -0
  182. package/dist/persona/memory-gate.js.map +1 -0
  183. package/dist/persona/persona-command.js +41 -6
  184. package/dist/persona/persona-command.js.map +1 -1
  185. package/dist/persona/resolve.d.ts +22 -0
  186. package/dist/persona/resolve.js +45 -2
  187. package/dist/persona/resolve.js.map +1 -1
  188. package/dist/persona/types.d.ts +16 -0
  189. package/dist/pipeline/annotate.d.ts +7 -1
  190. package/dist/pipeline/annotate.js +92 -2
  191. package/dist/pipeline/annotate.js.map +1 -1
  192. package/dist/pipeline/compile.js +2 -0
  193. package/dist/pipeline/compile.js.map +1 -1
  194. package/dist/pipeline/constitution-compiler.d.ts +25 -14
  195. package/dist/pipeline/constitution-compiler.js +107 -38
  196. package/dist/pipeline/constitution-compiler.js.map +1 -1
  197. package/dist/pipeline/dynamic-list-types.d.ts +3 -6
  198. package/dist/pipeline/dynamic-list-types.js +3 -16
  199. package/dist/pipeline/dynamic-list-types.js.map +1 -1
  200. package/dist/pipeline/parallel-progress.d.ts +59 -0
  201. package/dist/pipeline/parallel-progress.js +263 -0
  202. package/dist/pipeline/parallel-progress.js.map +1 -0
  203. package/dist/pipeline/pipeline-runner.d.ts +49 -8
  204. package/dist/pipeline/pipeline-runner.js +419 -231
  205. package/dist/pipeline/pipeline-runner.js.map +1 -1
  206. package/dist/pipeline/pipeline-shared.d.ts +59 -1
  207. package/dist/pipeline/pipeline-shared.js +127 -12
  208. package/dist/pipeline/pipeline-shared.js.map +1 -1
  209. package/dist/pipeline/policy-verifier.js +16 -3
  210. package/dist/pipeline/policy-verifier.js.map +1 -1
  211. package/dist/pipeline/proxy-mcp-connections.js +17 -2
  212. package/dist/pipeline/proxy-mcp-connections.js.map +1 -1
  213. package/dist/pipeline/scenario-generator.d.ts +4 -8
  214. package/dist/pipeline/scenario-generator.js +13 -46
  215. package/dist/pipeline/scenario-generator.js.map +1 -1
  216. package/dist/pipeline/server-prefilter.d.ts +31 -0
  217. package/dist/pipeline/server-prefilter.js +115 -0
  218. package/dist/pipeline/server-prefilter.js.map +1 -0
  219. package/dist/pipeline/types.d.ts +5 -0
  220. package/dist/sandbox/index.d.ts +14 -0
  221. package/dist/sandbox/index.js +335 -116
  222. package/dist/sandbox/index.js.map +1 -1
  223. package/dist/sandbox/ironcurtain-protocol.d.ts +52 -0
  224. package/dist/sandbox/ironcurtain-protocol.js +185 -0
  225. package/dist/sandbox/ironcurtain-protocol.js.map +1 -0
  226. package/dist/session/agent-session.d.ts +6 -0
  227. package/dist/session/agent-session.js +16 -5
  228. package/dist/session/agent-session.js.map +1 -1
  229. package/dist/session/cli-transport.js +0 -6
  230. package/dist/session/cli-transport.js.map +1 -1
  231. package/dist/session/index.d.ts +35 -14
  232. package/dist/session/index.js +324 -130
  233. package/dist/session/index.js.map +1 -1
  234. package/dist/session/preflight.d.ts +50 -13
  235. package/dist/session/preflight.js +252 -80
  236. package/dist/session/preflight.js.map +1 -1
  237. package/dist/session/prompts.d.ts +2 -5
  238. package/dist/session/prompts.js.map +1 -1
  239. package/dist/session/session-manager.d.ts +61 -6
  240. package/dist/session/session-manager.js +72 -10
  241. package/dist/session/session-manager.js.map +1 -1
  242. package/dist/session/session-metadata.d.ts +21 -5
  243. package/dist/session/session-metadata.js +34 -12
  244. package/dist/session/session-metadata.js.map +1 -1
  245. package/dist/session/types.d.ts +311 -5
  246. package/dist/session/types.js +57 -1
  247. package/dist/session/types.js.map +1 -1
  248. package/dist/signal/setup-signal.js +13 -21
  249. package/dist/signal/setup-signal.js.map +1 -1
  250. package/dist/signal/signal-bot-daemon.d.ts +16 -1
  251. package/dist/signal/signal-bot-daemon.js +39 -27
  252. package/dist/signal/signal-bot-daemon.js.map +1 -1
  253. package/dist/signal/signal-container.js +7 -1
  254. package/dist/signal/signal-container.js.map +1 -1
  255. package/dist/skills/discovery.d.ts +77 -0
  256. package/dist/skills/discovery.js +206 -0
  257. package/dist/skills/discovery.js.map +1 -0
  258. package/dist/skills/index.d.ts +4 -0
  259. package/dist/skills/index.js +3 -0
  260. package/dist/skills/index.js.map +1 -0
  261. package/dist/skills/staging.d.ts +28 -0
  262. package/dist/skills/staging.js +68 -0
  263. package/dist/skills/staging.js.map +1 -0
  264. package/dist/skills/types.d.ts +46 -0
  265. package/dist/skills/types.js +2 -0
  266. package/dist/skills/types.js.map +1 -0
  267. package/dist/trusted-process/approval-whitelist.d.ts +0 -2
  268. package/dist/trusted-process/approval-whitelist.js +17 -17
  269. package/dist/trusted-process/approval-whitelist.js.map +1 -1
  270. package/dist/trusted-process/async-mutex.d.ts +32 -0
  271. package/dist/trusted-process/async-mutex.js +50 -0
  272. package/dist/trusted-process/async-mutex.js.map +1 -0
  273. package/dist/trusted-process/audit-log.d.ts +38 -1
  274. package/dist/trusted-process/audit-log.js +82 -13
  275. package/dist/trusted-process/audit-log.js.map +1 -1
  276. package/dist/trusted-process/call-circuit-breaker.js +2 -1
  277. package/dist/trusted-process/call-circuit-breaker.js.map +1 -1
  278. package/dist/trusted-process/control-server.d.ts +101 -0
  279. package/dist/trusted-process/control-server.js +282 -0
  280. package/dist/trusted-process/control-server.js.map +1 -0
  281. package/dist/trusted-process/domain-utils.d.ts +6 -6
  282. package/dist/trusted-process/domain-utils.js +7 -23
  283. package/dist/trusted-process/domain-utils.js.map +1 -1
  284. package/dist/trusted-process/error-prefixes.d.ts +16 -0
  285. package/dist/trusted-process/error-prefixes.js +17 -0
  286. package/dist/trusted-process/error-prefixes.js.map +1 -0
  287. package/dist/trusted-process/index.d.ts +40 -23
  288. package/dist/trusted-process/index.js +131 -225
  289. package/dist/trusted-process/index.js.map +1 -1
  290. package/dist/trusted-process/list-matcher.d.ts +17 -0
  291. package/dist/trusted-process/list-matcher.js +31 -0
  292. package/dist/trusted-process/list-matcher.js.map +1 -0
  293. package/dist/trusted-process/mcp-client-manager.d.ts +35 -6
  294. package/dist/trusted-process/mcp-client-manager.js +40 -45
  295. package/dist/trusted-process/mcp-client-manager.js.map +1 -1
  296. package/dist/trusted-process/mcp-proxy-server.d.ts +31 -120
  297. package/dist/trusted-process/mcp-proxy-server.js +166 -657
  298. package/dist/trusted-process/mcp-proxy-server.js.map +1 -1
  299. package/dist/trusted-process/policy-engine.d.ts +16 -4
  300. package/dist/trusted-process/policy-engine.js +90 -45
  301. package/dist/trusted-process/policy-engine.js.map +1 -1
  302. package/dist/trusted-process/policy-roots.d.ts +6 -0
  303. package/dist/trusted-process/policy-roots.js +20 -0
  304. package/dist/trusted-process/policy-roots.js.map +1 -1
  305. package/dist/trusted-process/sandbox-integration.d.ts +12 -0
  306. package/dist/trusted-process/sandbox-integration.js +26 -0
  307. package/dist/trusted-process/sandbox-integration.js.map +1 -1
  308. package/dist/trusted-process/tool-call-coordinator.d.ts +269 -0
  309. package/dist/trusted-process/tool-call-coordinator.js +508 -0
  310. package/dist/trusted-process/tool-call-coordinator.js.map +1 -0
  311. package/dist/trusted-process/tool-call-pipeline.d.ts +205 -0
  312. package/dist/trusted-process/tool-call-pipeline.js +798 -0
  313. package/dist/trusted-process/tool-call-pipeline.js.map +1 -0
  314. package/dist/trusted-process/tool-description-hints.d.ts +1 -1
  315. package/dist/types/argument-roles.d.ts +1 -1
  316. package/dist/types/argument-roles.js +14 -1
  317. package/dist/types/argument-roles.js.map +1 -1
  318. package/dist/types/audit.d.ts +9 -0
  319. package/dist/{session → types}/errors.d.ts +8 -2
  320. package/dist/{session → types}/errors.js +8 -2
  321. package/dist/types/errors.js.map +1 -0
  322. package/dist/types/reserved-servers.d.ts +11 -0
  323. package/dist/types/reserved-servers.js +12 -0
  324. package/dist/types/reserved-servers.js.map +1 -0
  325. package/dist/types/server-listing.d.ts +14 -0
  326. package/dist/types/server-listing.js +2 -0
  327. package/dist/types/server-listing.js.map +1 -0
  328. package/dist/types/slug.d.ts +2 -0
  329. package/dist/types/slug.js +2 -0
  330. package/dist/types/slug.js.map +1 -1
  331. package/dist/types/url-normalize.d.ts +16 -0
  332. package/dist/types/url-normalize.js +33 -0
  333. package/dist/types/url-normalize.js.map +1 -0
  334. package/dist/utils/error-message.d.ts +8 -0
  335. package/dist/utils/error-message.js +11 -0
  336. package/dist/utils/error-message.js.map +1 -0
  337. package/dist/utils/exec-error.d.ts +19 -0
  338. package/dist/utils/exec-error.js +16 -0
  339. package/dist/utils/exec-error.js.map +1 -0
  340. package/dist/utils/is-plain-object.d.ts +7 -0
  341. package/dist/utils/is-plain-object.js +12 -0
  342. package/dist/utils/is-plain-object.js.map +1 -0
  343. package/dist/utils/preflight-checks.d.ts +16 -0
  344. package/dist/utils/preflight-checks.js +178 -0
  345. package/dist/utils/preflight-checks.js.map +1 -0
  346. package/dist/web-ui/__tests__/json-rpc-dispatch.test.d.ts +7 -0
  347. package/dist/web-ui/__tests__/json-rpc-dispatch.test.js +725 -0
  348. package/dist/web-ui/__tests__/json-rpc-dispatch.test.js.map +1 -0
  349. package/dist/web-ui/dispatch/escalation-dispatch.d.ts +7 -0
  350. package/dist/web-ui/dispatch/escalation-dispatch.js +52 -0
  351. package/dist/web-ui/dispatch/escalation-dispatch.js.map +1 -0
  352. package/dist/web-ui/dispatch/job-dispatch.d.ts +8 -0
  353. package/dist/web-ui/dispatch/job-dispatch.js +83 -0
  354. package/dist/web-ui/dispatch/job-dispatch.js.map +1 -0
  355. package/dist/web-ui/dispatch/persona-dispatch.d.ts +6 -0
  356. package/dist/web-ui/dispatch/persona-dispatch.js +116 -0
  357. package/dist/web-ui/dispatch/persona-dispatch.js.map +1 -0
  358. package/dist/web-ui/dispatch/session-dispatch.d.ts +9 -0
  359. package/dist/web-ui/dispatch/session-dispatch.js +201 -0
  360. package/dist/web-ui/dispatch/session-dispatch.js.map +1 -0
  361. package/dist/web-ui/dispatch/token-stream-dispatch.d.ts +15 -0
  362. package/dist/web-ui/dispatch/token-stream-dispatch.js +55 -0
  363. package/dist/web-ui/dispatch/token-stream-dispatch.js.map +1 -0
  364. package/dist/web-ui/dispatch/types.d.ts +31 -0
  365. package/dist/web-ui/dispatch/types.js +68 -0
  366. package/dist/web-ui/dispatch/types.js.map +1 -0
  367. package/dist/web-ui/dispatch/workflow-dispatch.d.ts +103 -0
  368. package/dist/web-ui/dispatch/workflow-dispatch.js +925 -0
  369. package/dist/web-ui/dispatch/workflow-dispatch.js.map +1 -0
  370. package/dist/web-ui/json-rpc-dispatch.d.ts +12 -0
  371. package/dist/web-ui/json-rpc-dispatch.js +34 -0
  372. package/dist/web-ui/json-rpc-dispatch.js.map +1 -0
  373. package/dist/web-ui/state-graph.d.ts +13 -0
  374. package/dist/web-ui/state-graph.js +82 -0
  375. package/dist/web-ui/state-graph.js.map +1 -0
  376. package/dist/web-ui/token-stream-bridge.d.ts +76 -0
  377. package/dist/web-ui/token-stream-bridge.js +265 -0
  378. package/dist/web-ui/token-stream-bridge.js.map +1 -0
  379. package/dist/web-ui/web-event-bus.d.ts +152 -0
  380. package/dist/web-ui/web-event-bus.js +19 -0
  381. package/dist/web-ui/web-event-bus.js.map +1 -0
  382. package/dist/web-ui/web-session-transport.d.ts +31 -0
  383. package/dist/web-ui/web-session-transport.js +109 -0
  384. package/dist/web-ui/web-session-transport.js.map +1 -0
  385. package/dist/web-ui/web-ui-server.d.ts +76 -0
  386. package/dist/web-ui/web-ui-server.js +461 -0
  387. package/dist/web-ui/web-ui-server.js.map +1 -0
  388. package/dist/web-ui/web-ui-types.d.ts +290 -0
  389. package/dist/web-ui/web-ui-types.js +32 -0
  390. package/dist/web-ui/web-ui-types.js.map +1 -0
  391. package/dist/web-ui/ws-utils.d.ts +5 -0
  392. package/dist/web-ui/ws-utils.js +12 -0
  393. package/dist/web-ui/ws-utils.js.map +1 -0
  394. package/dist/web-ui-static/assets/index-BFO5z1js.js +76 -0
  395. package/dist/web-ui-static/assets/index-CCUwrkIL.css +1 -0
  396. package/dist/web-ui-static/assets/orbitron-latin-700-normal-4jsRXGGJ.woff2 +0 -0
  397. package/dist/web-ui-static/assets/orbitron-latin-700-normal-DmYOh-W9.woff +0 -0
  398. package/dist/web-ui-static/index.html +14 -0
  399. package/dist/workflow/artifacts.d.ts +59 -0
  400. package/dist/workflow/artifacts.js +188 -0
  401. package/dist/workflow/artifacts.js.map +1 -0
  402. package/dist/workflow/checkpoint-selection.d.ts +34 -0
  403. package/dist/workflow/checkpoint-selection.js +48 -0
  404. package/dist/workflow/checkpoint-selection.js.map +1 -0
  405. package/dist/workflow/checkpoint.d.ts +35 -0
  406. package/dist/workflow/checkpoint.js +84 -0
  407. package/dist/workflow/checkpoint.js.map +1 -0
  408. package/dist/workflow/cli-support.d.ts +92 -0
  409. package/dist/workflow/cli-support.js +423 -0
  410. package/dist/workflow/cli-support.js.map +1 -0
  411. package/dist/workflow/definition-loader.d.ts +32 -0
  412. package/dist/workflow/definition-loader.js +56 -0
  413. package/dist/workflow/definition-loader.js.map +1 -0
  414. package/dist/workflow/discovery.d.ts +78 -0
  415. package/dist/workflow/discovery.js +203 -0
  416. package/dist/workflow/discovery.js.map +1 -0
  417. package/dist/workflow/errors.d.ts +66 -0
  418. package/dist/workflow/errors.js +49 -0
  419. package/dist/workflow/errors.js.map +1 -0
  420. package/dist/workflow/guards.d.ts +8 -0
  421. package/dist/workflow/guards.js +38 -0
  422. package/dist/workflow/guards.js.map +1 -0
  423. package/dist/workflow/lint-integration.d.ts +64 -0
  424. package/dist/workflow/lint-integration.js +56 -0
  425. package/dist/workflow/lint-integration.js.map +1 -0
  426. package/dist/workflow/lint.d.ts +66 -0
  427. package/dist/workflow/lint.js +410 -0
  428. package/dist/workflow/lint.js.map +1 -0
  429. package/dist/workflow/machine-builder.d.ts +90 -0
  430. package/dist/workflow/machine-builder.js +485 -0
  431. package/dist/workflow/machine-builder.js.map +1 -0
  432. package/dist/workflow/message-log.d.ts +85 -0
  433. package/dist/workflow/message-log.js +40 -0
  434. package/dist/workflow/message-log.js.map +1 -0
  435. package/dist/workflow/orchestrator.d.ts +450 -0
  436. package/dist/workflow/orchestrator.js +1941 -0
  437. package/dist/workflow/orchestrator.js.map +1 -0
  438. package/dist/workflow/prompt-builder.d.ts +39 -0
  439. package/dist/workflow/prompt-builder.js +242 -0
  440. package/dist/workflow/prompt-builder.js.map +1 -0
  441. package/dist/workflow/run-state-command.d.ts +9 -0
  442. package/dist/workflow/run-state-command.js +414 -0
  443. package/dist/workflow/run-state-command.js.map +1 -0
  444. package/dist/workflow/run-state-debug-capture.d.ts +40 -0
  445. package/dist/workflow/run-state-debug-capture.js +101 -0
  446. package/dist/workflow/run-state-debug-capture.js.map +1 -0
  447. package/dist/workflow/status-parser.d.ts +68 -0
  448. package/dist/workflow/status-parser.js +259 -0
  449. package/dist/workflow/status-parser.js.map +1 -0
  450. package/dist/workflow/types.d.ts +498 -0
  451. package/dist/workflow/types.js +83 -0
  452. package/dist/workflow/types.js.map +1 -0
  453. package/dist/workflow/validate.d.ts +58 -0
  454. package/dist/workflow/validate.js +499 -0
  455. package/dist/workflow/validate.js.map +1 -0
  456. package/dist/workflow/workflow-command.d.ts +26 -0
  457. package/dist/workflow/workflow-command.js +648 -0
  458. package/dist/workflow/workflow-command.js.map +1 -0
  459. package/dist/workflow/workflow-discovery.d.ts +25 -0
  460. package/dist/workflow/workflow-discovery.js +100 -0
  461. package/dist/workflow/workflow-discovery.js.map +1 -0
  462. package/dist/workflow/workflow-manager.d.ts +122 -0
  463. package/dist/workflow/workflow-manager.js +308 -0
  464. package/dist/workflow/workflow-manager.js.map +1 -0
  465. package/dist/workflow/workflows/design-and-code/workflow.yaml +169 -0
  466. package/dist/workflow/workflows/test-email-summary/skills/email-formatting/SKILL.md +55 -0
  467. package/dist/workflow/workflows/test-email-summary/skills/gmail-query-syntax/SKILL.md +63 -0
  468. package/dist/workflow/workflows/test-email-summary/skills/json-schema-emails/SKILL.md +41 -0
  469. package/dist/workflow/workflows/test-email-summary/skills/json-schema-emails/schema.json +34 -0
  470. package/dist/workflow/workflows/test-email-summary/skills/summary-style-guide/SKILL.md +51 -0
  471. package/dist/workflow/workflows/test-email-summary/workflow.yaml +89 -0
  472. package/dist/workflow/workflows/vuln-discovery/skills/harness-design-fuzzing/SKILL.md +201 -0
  473. package/dist/workflow/workflows/vuln-discovery/skills/memory-safety-c-cpp/SKILL.md +166 -0
  474. package/dist/workflow/workflows/vuln-discovery/skills/vulnerability-triage/SKILL.md +185 -0
  475. package/dist/workflow/workflows/vuln-discovery/workflow.yaml +920 -0
  476. package/dist/workflow/worktree.d.ts +43 -0
  477. package/dist/workflow/worktree.js +106 -0
  478. package/dist/workflow/worktree.js.map +1 -0
  479. package/docker/Dockerfile.base +12 -1
  480. package/docker/Dockerfile.base.arm64 +17 -1
  481. package/docker/entrypoint-claude-code.sh +46 -0
  482. package/docker/entrypoint-goose.sh +25 -0
  483. package/package.json +22 -8
  484. package/packages/web-ui/README.md +113 -0
  485. package/packages/web-ui/docs/workflow-state-machine.png +0 -0
  486. package/src/config/generated/compiled-policy.json +528 -161
  487. package/src/config/generated/test-scenarios.json +4810 -170
  488. package/src/config/generated/tool-annotations.json +34 -47
  489. package/src/config/mcp-servers.json +2 -2
  490. package/src/workflow/workflows/design-and-code/workflow.yaml +169 -0
  491. package/src/workflow/workflows/test-email-summary/skills/email-formatting/SKILL.md +55 -0
  492. package/src/workflow/workflows/test-email-summary/skills/gmail-query-syntax/SKILL.md +63 -0
  493. package/src/workflow/workflows/test-email-summary/skills/json-schema-emails/SKILL.md +41 -0
  494. package/src/workflow/workflows/test-email-summary/skills/json-schema-emails/schema.json +34 -0
  495. package/src/workflow/workflows/test-email-summary/skills/summary-style-guide/SKILL.md +51 -0
  496. package/src/workflow/workflows/test-email-summary/workflow.yaml +89 -0
  497. package/src/workflow/workflows/vuln-discovery/skills/harness-design-fuzzing/SKILL.md +201 -0
  498. package/src/workflow/workflows/vuln-discovery/skills/memory-safety-c-cpp/SKILL.md +166 -0
  499. package/src/workflow/workflows/vuln-discovery/skills/vulnerability-triage/SKILL.md +185 -0
  500. package/src/workflow/workflows/vuln-discovery/workflow.yaml +920 -0
  501. package/dist/pipeline/llm-logger.js.map +0 -1
  502. package/dist/session/errors.js.map +0 -1
@@ -444,10 +444,11 @@
444
444
  "comment": "Stages specified files or all changes in the repository for the next commit.",
445
445
  "args": {
446
446
  "path": [
447
- "read-path"
447
+ "read-path",
448
+ "write-history"
448
449
  ],
449
450
  "files": [
450
- "read-path"
451
+ "none"
451
452
  ],
452
453
  "update": [
453
454
  "none"
@@ -506,7 +507,7 @@
506
507
  "read-path"
507
508
  ],
508
509
  "file": [
509
- "read-path"
510
+ "none"
510
511
  ],
511
512
  "startLine": [
512
513
  "none"
@@ -791,7 +792,8 @@
791
792
  "args": {
792
793
  "path": [
793
794
  "read-path",
794
- "write-history"
795
+ "write-history",
796
+ "write-path"
795
797
  ],
796
798
  "target": [
797
799
  "branch-name"
@@ -803,7 +805,7 @@
803
805
  "none"
804
806
  ],
805
807
  "paths": [
806
- "read-path"
808
+ "none"
807
809
  ],
808
810
  "track": [
809
811
  "none"
@@ -1144,7 +1146,7 @@
1144
1146
  "none"
1145
1147
  ],
1146
1148
  "filesToStage": [
1147
- "read-path"
1149
+ "none"
1148
1150
  ],
1149
1151
  "forceUnsignedOnFailure": [
1150
1152
  "none"
@@ -1238,7 +1240,7 @@
1238
1240
  "none"
1239
1241
  ],
1240
1242
  "paths": [
1241
- "read-path"
1243
+ "none"
1242
1244
  ],
1243
1245
  "staged": [
1244
1246
  "none"
@@ -1318,7 +1320,8 @@
1318
1320
  "comment": "Downloads objects and refs from a remote repository without merging them into the local branch.",
1319
1321
  "args": {
1320
1322
  "path": [
1321
- "read-path"
1323
+ "read-path",
1324
+ "write-history"
1322
1325
  ],
1323
1326
  "remote": [
1324
1327
  "git-remote-url"
@@ -1434,7 +1437,7 @@
1434
1437
  "branch-name"
1435
1438
  ],
1436
1439
  "filePath": [
1437
- "read-path"
1440
+ "none"
1438
1441
  ],
1439
1442
  "oneline": [
1440
1443
  "none"
@@ -1934,39 +1937,9 @@
1934
1937
  "name": [
1935
1938
  "none"
1936
1939
  ],
1937
- "url": {
1938
- "default": [
1939
- "git-remote-url"
1940
- ],
1941
- "when": [
1942
- {
1943
- "condition": {
1944
- "arg": "mode",
1945
- "in": [
1946
- "list",
1947
- "get-url"
1948
- ]
1949
- },
1950
- "roles": [
1951
- "none"
1952
- ]
1953
- },
1954
- {
1955
- "condition": {
1956
- "arg": "mode",
1957
- "in": [
1958
- "add",
1959
- "rename",
1960
- "set-url",
1961
- "remove"
1962
- ]
1963
- },
1964
- "roles": [
1965
- "git-remote-url"
1966
- ]
1967
- }
1968
- ]
1969
- },
1940
+ "url": [
1941
+ "none"
1942
+ ],
1970
1943
  "newName": [
1971
1944
  "none"
1972
1945
  ],
@@ -2039,7 +2012,7 @@
2039
2012
  "none"
2040
2013
  ],
2041
2014
  "paths": [
2042
- "read-path"
2015
+ "none"
2043
2016
  ],
2044
2017
  "confirmed": [
2045
2018
  "none"
@@ -2091,9 +2064,23 @@
2091
2064
  "toolName": "git_set_working_dir",
2092
2065
  "comment": "Sets the session-level default working directory for all subsequent git operations.",
2093
2066
  "args": {
2094
- "path": [
2095
- "read-path"
2096
- ],
2067
+ "path": {
2068
+ "default": [
2069
+ "read-path"
2070
+ ],
2071
+ "when": [
2072
+ {
2073
+ "condition": {
2074
+ "arg": "initializeIfNotPresent",
2075
+ "equals": true
2076
+ },
2077
+ "roles": [
2078
+ "read-path",
2079
+ "write-path"
2080
+ ]
2081
+ }
2082
+ ]
2083
+ },
2097
2084
  "validateGitRepo": [
2098
2085
  "none"
2099
2086
  ],
@@ -2152,7 +2139,7 @@
2152
2139
  "none"
2153
2140
  ],
2154
2141
  "filePath": [
2155
- "read-path"
2142
+ "none"
2156
2143
  ]
2157
2144
  },
2158
2145
  "serverName": "git",
@@ -32,6 +32,20 @@ export declare function computeProtectedPaths(opts: {
32
32
  * (runtime) and `loadPipelineConfig()` (pipeline) use this.
33
33
  */
34
34
  export declare function resolveMcpServerPaths(mcpServers: Record<string, MCPServerConfig>): void;
35
+ /**
36
+ * Rewrites the filesystem MCP server's allowed-directory arg to match
37
+ * `allowedDirectory`. Must be called whenever `allowedDirectory` changes
38
+ * (e.g. during session/workflow setup), otherwise the filesystem server
39
+ * spawns with a stale path and fails with ENOENT.
40
+ *
41
+ * The filesystem server's args are `["-y", "<pkg>", "<path>"]`, so the
42
+ * path is always the last argument. We replace it unconditionally to
43
+ * cover both the initial load (args contain the sentinel) and subsequent
44
+ * re-patches (args already contain a previous allowed directory).
45
+ */
46
+ export declare function applyAllowedDirectoryToMcpArgs(mcpServers: Record<string, {
47
+ args: string[];
48
+ }>, allowedDirectory: string): void;
35
49
  export declare function loadConfig(): IronCurtainConfig;
36
50
  /**
37
51
  * Extracts domain allowlists from MCP server sandbox network configurations.
@@ -56,6 +70,37 @@ export declare function extractServerDomainAllowlists(mcpServers: Record<string,
56
70
  * last `ironcurtain compile-policy` run.
57
71
  */
58
72
  export declare function checkConstitutionFreshness(compiledPolicy: CompiledPolicyFile, constitutionPath: string): void;
73
+ /**
74
+ * Pure diff between the configured MCP servers and the servers covered by
75
+ * `tool-annotations.json`. Used by both the runtime freshness check and
76
+ * the compile-time preventive check, which format the same drift data
77
+ * differently.
78
+ *
79
+ * - `missing`: configured servers with no annotations entry (these will
80
+ * silently default-deny every call via the policy engine's
81
+ * structural-unknown-tool fallback).
82
+ * - `orphaned`: annotated servers no longer configured (informational).
83
+ */
84
+ export declare function findAnnotationServerDrift(toolAnnotations: StoredToolAnnotationsFile, mcpServers: Record<string, MCPServerConfig>): {
85
+ missing: string[];
86
+ orphaned: string[];
87
+ };
88
+ /**
89
+ * Runtime freshness check: emits stderr warnings when the on-disk
90
+ * tool-annotations.json no longer matches the configured MCP servers.
91
+ *
92
+ * The warning suggests re-running annotations for each specific server,
93
+ * not `--all`, so the user only re-classifies what actually changed.
94
+ */
95
+ export declare function checkAnnotationFreshness(toolAnnotations: StoredToolAnnotationsFile, mcpServers: Record<string, MCPServerConfig>): void;
96
+ /**
97
+ * Quotes a user-supplied identifier for inclusion in a stderr message or a
98
+ * copy-paste shell command. Escapes control characters, quotes, and
99
+ * backslashes via JSON string semantics, and wraps the result in double
100
+ * quotes. The output is both safe to print (no terminal injection) and
101
+ * safe to paste into bash (`--server "name"`).
102
+ */
103
+ export declare function safeForDisplay(identifier: string): string;
59
104
  /**
60
105
  * Options for loading generated policy artifacts with split directories.
61
106
  * Allows policy files and tool annotations to come from different dirs.
@@ -73,3 +118,16 @@ export declare function loadGeneratedPolicy(options: PolicyLoadOptions): {
73
118
  toolAnnotations: StoredToolAnnotationsFile;
74
119
  dynamicLists: DynamicListsFile | undefined;
75
120
  };
121
+ /**
122
+ * Loads only the per-persona / per-policy artifacts (compiled-policy.json
123
+ * and optional dynamic-lists.json). Tool annotations are deliberately not
124
+ * read here because they are globally-scoped: a persona directory only
125
+ * ships policy + lists, not annotations.
126
+ *
127
+ * Used by `ToolCallCoordinator.loadPolicy` during a hot-swap to pick up
128
+ * the new policy without touching the retained annotations.
129
+ */
130
+ export declare function loadPersonaPolicyArtifacts(policyDir: string): {
131
+ compiledPolicy: CompiledPolicyFile;
132
+ dynamicLists: DynamicListsFile | undefined;
133
+ };
@@ -4,17 +4,22 @@ import { fileURLToPath } from 'node:url';
4
4
  import { computeConstitutionHash, getIronCurtainHome, getUserConfigPath, getUserConstitutionBasePath, getUserConstitutionPath, getUserGeneratedDir, } from './paths.js';
5
5
  import { resolveRealPath } from '../types/argument-roles.js';
6
6
  import { loadUserConfig } from './user-config.js';
7
- import { RESERVED_SERVER_NAMES } from '../docker/proxy-tools.js';
7
+ import { RESERVED_SERVER_NAMES } from '../types/reserved-servers.js';
8
8
  const __filename = fileURLToPath(import.meta.url);
9
9
  const __dirname = dirname(__filename);
10
10
  const isCompiled = __filename.endsWith('.js');
11
11
  /**
12
- * Returns the user-local generated dir if it contains compiled-policy.json,
13
- * otherwise falls back to the package-bundled generated dir.
12
+ * Returns the user-local generated dir if it contains the given artifact,
13
+ * otherwise falls back to the package-bundled dir. Used independently for
14
+ * `compiled-policy.json` and `tool-annotations.json` so a user who drops
15
+ * an updated annotations file into `~/.ironcurtain/generated/` has it
16
+ * picked up even without a corresponding compiled policy there (tool
17
+ * annotations are globally scoped — see sandbox/index.ts comment on
18
+ * `toolAnnotationsDir`).
14
19
  */
15
- function resolveGeneratedDir(packageGeneratedDir) {
20
+ function resolveArtifactDir(filename, packageGeneratedDir) {
16
21
  const userDir = getUserGeneratedDir();
17
- if (existsSync(resolve(userDir, 'compiled-policy.json'))) {
22
+ if (existsSync(resolve(userDir, filename))) {
18
23
  return userDir;
19
24
  }
20
25
  return packageGeneratedDir;
@@ -117,6 +122,26 @@ function resolveInternalServerPaths(config, packageRoot, compiled) {
117
122
  }
118
123
  }
119
124
  }
125
+ /**
126
+ * Rewrites the filesystem MCP server's allowed-directory arg to match
127
+ * `allowedDirectory`. Must be called whenever `allowedDirectory` changes
128
+ * (e.g. during session/workflow setup), otherwise the filesystem server
129
+ * spawns with a stale path and fails with ENOENT.
130
+ *
131
+ * The filesystem server's args are `["-y", "<pkg>", "<path>"]`, so the
132
+ * path is always the last argument. We replace it unconditionally to
133
+ * cover both the initial load (args contain the sentinel) and subsequent
134
+ * re-patches (args already contain a previous allowed directory).
135
+ */
136
+ export function applyAllowedDirectoryToMcpArgs(mcpServers, allowedDirectory) {
137
+ const fsServer = mcpServers['filesystem'];
138
+ // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- defensive: key may not exist in external JSON
139
+ if (!fsServer)
140
+ return;
141
+ if (fsServer.args.length === 0)
142
+ return;
143
+ fsServer.args[fsServer.args.length - 1] = allowedDirectory;
144
+ }
120
145
  /**
121
146
  * Translates the typed webSearch config into flat env vars for the fetch server.
122
147
  */
@@ -161,20 +186,13 @@ export function loadConfig() {
161
186
  // Sync the filesystem server's allowed directory with the configured value.
162
187
  // The mcp-servers.json ships with a default path that may differ from
163
188
  // the ALLOWED_DIRECTORY environment variable.
164
- const fsServer = mcpServers['filesystem'];
165
- // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- defensive: key may not exist in external JSON
166
- if (fsServer) {
167
- const defaultDir = '/tmp/ironcurtain-sandbox';
168
- const dirIndex = fsServer.args.indexOf(defaultDir);
169
- if (dirIndex !== -1) {
170
- fsServer.args[dirIndex] = allowedDirectory;
171
- }
172
- }
189
+ applyAllowedDirectoryToMcpArgs(mcpServers, allowedDirectory);
173
190
  // Resolve all relative paths (node_modules/ and ./src/) to absolute paths.
174
191
  resolveMcpServerPaths(mcpServers);
175
192
  const constitutionPath = resolve(__dirname, 'constitution.md');
176
193
  const packageGeneratedDir = resolve(__dirname, 'generated');
177
- const generatedDir = resolveGeneratedDir(packageGeneratedDir);
194
+ const generatedDir = resolveArtifactDir('compiled-policy.json', packageGeneratedDir);
195
+ const toolAnnotationsDir = resolveArtifactDir('tool-annotations.json', packageGeneratedDir);
178
196
  const protectedPaths = computeProtectedPaths({
179
197
  constitutionPath,
180
198
  generatedDir,
@@ -209,6 +227,7 @@ export function loadConfig() {
209
227
  mcpServers,
210
228
  protectedPaths,
211
229
  generatedDir,
230
+ toolAnnotationsDir,
212
231
  constitutionPath,
213
232
  agentModelId: finalUserConfig.agentModelId,
214
233
  escalationTimeoutSeconds: finalUserConfig.escalationTimeoutSeconds,
@@ -258,12 +277,75 @@ export function checkConstitutionFreshness(compiledPolicy, constitutionPath) {
258
277
  'Run `ironcurtain compile-policy` to update the compiled policy.\n');
259
278
  }
260
279
  }
280
+ /**
281
+ * Pure diff between the configured MCP servers and the servers covered by
282
+ * `tool-annotations.json`. Used by both the runtime freshness check and
283
+ * the compile-time preventive check, which format the same drift data
284
+ * differently.
285
+ *
286
+ * - `missing`: configured servers with no annotations entry (these will
287
+ * silently default-deny every call via the policy engine's
288
+ * structural-unknown-tool fallback).
289
+ * - `orphaned`: annotated servers no longer configured (informational).
290
+ */
291
+ export function findAnnotationServerDrift(toolAnnotations, mcpServers) {
292
+ const configuredNames = new Set(Object.keys(mcpServers));
293
+ const annotatedNames = new Set(Object.keys(toolAnnotations.servers));
294
+ return {
295
+ missing: [...configuredNames].filter((name) => !annotatedNames.has(name)).sort(),
296
+ orphaned: [...annotatedNames].filter((name) => !configuredNames.has(name)).sort(),
297
+ };
298
+ }
299
+ /**
300
+ * Runtime freshness check: emits stderr warnings when the on-disk
301
+ * tool-annotations.json no longer matches the configured MCP servers.
302
+ *
303
+ * The warning suggests re-running annotations for each specific server,
304
+ * not `--all`, so the user only re-classifies what actually changed.
305
+ */
306
+ export function checkAnnotationFreshness(toolAnnotations, mcpServers) {
307
+ const { missing, orphaned } = findAnnotationServerDrift(toolAnnotations, mcpServers);
308
+ if (missing.length > 0) {
309
+ process.stderr.write(`Warning: ${missing.length} configured MCP server(s) have no tool annotations: ${missing.map(safeForDisplay).join(', ')}. ` +
310
+ `Tools from these servers will be denied by the policy engine until annotated.\n`);
311
+ for (const name of missing) {
312
+ process.stderr.write(` Run \`ironcurtain annotate-tools --server ${safeForDisplay(name)}\` to annotate this server.\n`);
313
+ }
314
+ }
315
+ if (orphaned.length > 0) {
316
+ process.stderr.write(`Note: tool-annotations.json contains server(s) no longer in mcp-servers.json: ${orphaned.map(safeForDisplay).join(', ')}.\n`);
317
+ }
318
+ }
319
+ /**
320
+ * Quotes a user-supplied identifier for inclusion in a stderr message or a
321
+ * copy-paste shell command. Escapes control characters, quotes, and
322
+ * backslashes via JSON string semantics, and wraps the result in double
323
+ * quotes. The output is both safe to print (no terminal injection) and
324
+ * safe to paste into bash (`--server "name"`).
325
+ */
326
+ export function safeForDisplay(identifier) {
327
+ return JSON.stringify(identifier);
328
+ }
261
329
  export function loadGeneratedPolicy(options) {
262
330
  const compiledPolicy = JSON.parse(readGeneratedFile(options.policyDir, 'compiled-policy.json', options.fallbackDir));
263
331
  const toolAnnotations = JSON.parse(readGeneratedFile(options.toolAnnotationsDir, 'tool-annotations.json', options.fallbackDir));
264
332
  const dynamicLists = loadOptionalGeneratedFile(options.policyDir, 'dynamic-lists.json', options.fallbackDir);
265
333
  return { compiledPolicy, toolAnnotations, dynamicLists };
266
334
  }
335
+ /**
336
+ * Loads only the per-persona / per-policy artifacts (compiled-policy.json
337
+ * and optional dynamic-lists.json). Tool annotations are deliberately not
338
+ * read here because they are globally-scoped: a persona directory only
339
+ * ships policy + lists, not annotations.
340
+ *
341
+ * Used by `ToolCallCoordinator.loadPolicy` during a hot-swap to pick up
342
+ * the new policy without touching the retained annotations.
343
+ */
344
+ export function loadPersonaPolicyArtifacts(policyDir) {
345
+ const compiledPolicy = JSON.parse(readGeneratedFile(policyDir, 'compiled-policy.json'));
346
+ const dynamicLists = loadOptionalGeneratedFile(policyDir, 'dynamic-lists.json');
347
+ return { compiledPolicy, dynamicLists };
348
+ }
267
349
  /**
268
350
  * Loads an optional generated artifact file. Returns undefined if not found.
269
351
  */
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAgC,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE9C;;;GAGG;AACH,SAAS,mBAAmB,CAAC,mBAA2B;IACtD,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,KAAK,GAAG;QACZ,mEAAmE;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,uEAAuE;QACvE,mCAAmC;QACnC,eAAe,CAAC,kBAAkB,EAAE,CAAC;QACrC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACtC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC;QACpC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,wDAAwD;IACxD,MAAM,oBAAoB,GAAG,2BAA2B,EAAE,CAAC;IAC3D,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;IACtD,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,sDAAsD;IACtD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA2C;IAC/E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAEnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAuB,EAAE,WAAmB,EAAE,QAAiB;IACjG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAEhE,IAAI,QAAQ,EAAE,CAAC;YACb,oDAAoD;YACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBACpC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAAC,SAAkC;IACrE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEtC,KAAK,CAAC,mBAAmB,GAAG,SAAS,CAAC,QAAQ,CAAC;IAE/C,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,OAAO;YACV,IAAI,SAAS,CAAC,KAAK;gBAAE,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAClE,MAAM;QACR,KAAK,QAAQ;YACX,IAAI,SAAS,CAAC,MAAM;gBAAE,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YACrE,MAAM;QACR,KAAK,SAAS;YACZ,IAAI,SAAS,CAAC,OAAO;gBAAE,KAAK,CAAC,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;YACxE,MAAM;IACV,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;IACnE,0DAA0D;IAC1D,+DAA+D;IAC/D,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAE5E,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAoC,CAAC;IAExG,gEAAgE;IAChE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,kCAAkC;gBACxD,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,wHAAwH;IACxH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,0BAA0B,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,gBAAgB;QAChB,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,YAAY;KACb,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4FAA4F;IAC5F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,OAAO,oDAAoD;gBACxF,sBAAsB,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,eAAe,GAAG,UAAU,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,aAAa,GAChB,UAAU,CAAC,iBAAwE,CAAC,KAAK,IAAI,EAAE,CAAC;QACnG,MAAM,iBAAiB,GAA2C,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAClC,CAAC;QACD,iBAAiB,CAAC,KAAK,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;QAClE,eAAe,GAAG,EAAE,GAAG,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,YAAY;QACZ,gBAAgB;QAChB,UAAU;QACV,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,YAAY,EAAE,eAAe,CAAC,YAAY;QAC1C,wBAAwB,EAAE,eAAe,CAAC,wBAAwB;QAClE,UAAU,EAAE,eAAe;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAA2C;IACvF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAkC,EAAE,gBAAwB;IACrG,MAAM,WAAW,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE;YACrE,mEAAmE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAeD,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAK5D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,CAAC,WAAW,CAAC,CAC5D,CAAC;IACxB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAChC,iBAAiB,CAAC,OAAO,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,OAAO,CAAC,WAAW,CAAC,CAC/D,CAAC;IAC/B,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAE7G,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAChC,YAAoB,EACpB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAqB,CAAC;IAC5E,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAqB,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,QAAgB,EAAE,WAAoB;IACrF,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,YAAoB,EAAE,QAAgB;IACpE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,OAAO,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACzC,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAgC,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE9C;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,mBAA2B;IACvE,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,KAAK,GAAG;QACZ,mEAAmE;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,uEAAuE;QACvE,mCAAmC;QACnC,eAAe,CAAC,kBAAkB,EAAE,CAAC;QACrC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACtC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC;QACpC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,wDAAwD;IACxD,MAAM,oBAAoB,GAAG,2BAA2B,EAAE,CAAC;IAC3D,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;IACtD,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,sDAAsD;IACtD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA2C;IAC/E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAEnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAuB,EAAE,WAAmB,EAAE,QAAiB;IACjG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAEhE,IAAI,QAAQ,EAAE,CAAC;YACb,oDAAoD;YACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBACpC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAA8C,EAC9C,gBAAwB;IAExB,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,wHAAwH;IACxH,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,gBAAgB,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAAC,SAAkC;IACrE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEtC,KAAK,CAAC,mBAAmB,GAAG,SAAS,CAAC,QAAQ,CAAC;IAE/C,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,OAAO;YACV,IAAI,SAAS,CAAC,KAAK;gBAAE,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAClE,MAAM;QACR,KAAK,QAAQ;YACX,IAAI,SAAS,CAAC,MAAM;gBAAE,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YACrE,MAAM;QACR,KAAK,SAAS;YACZ,IAAI,SAAS,CAAC,OAAO;gBAAE,KAAK,CAAC,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;YACxE,MAAM;IACV,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;IACnE,0DAA0D;IAC1D,+DAA+D;IAC/D,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAE5E,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAoC,CAAC;IAExG,gEAAgE;IAChE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,kCAAkC;gBACxD,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,8CAA8C;IAC9C,8BAA8B,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAE7D,2EAA2E;IAC3E,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,kBAAkB,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC;IACrF,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;IAE5F,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,gBAAgB;QAChB,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,YAAY;KACb,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4FAA4F;IAC5F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,OAAO,oDAAoD;gBACxF,sBAAsB,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,eAAe,GAAG,UAAU,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,aAAa,GAChB,UAAU,CAAC,iBAAwE,CAAC,KAAK,IAAI,EAAE,CAAC;QACnG,MAAM,iBAAiB,GAA2C,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAClC,CAAC;QACD,iBAAiB,CAAC,KAAK,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;QAClE,eAAe,GAAG,EAAE,GAAG,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,YAAY;QACZ,gBAAgB;QAChB,UAAU;QACV,cAAc;QACd,YAAY;QACZ,kBAAkB;QAClB,gBAAgB;QAChB,YAAY,EAAE,eAAe,CAAC,YAAY;QAC1C,wBAAwB,EAAE,eAAe,CAAC,wBAAwB;QAClE,UAAU,EAAE,eAAe;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAA2C;IACvF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAkC,EAAE,gBAAwB;IACrG,MAAM,WAAW,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE;YACrE,mEAAmE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,eAA0C,EAC1C,UAA2C;IAE3C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;QAChF,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;KAClF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,eAA0C,EAC1C,UAA2C;IAE3C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,yBAAyB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAErF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,OAAO,CAAC,MAAM,uDAAuD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACzH,iFAAiF,CACpF,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+CAA+C,cAAc,CAAC,IAAI,CAAC,+BAA+B,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iFAAiF,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAC9H,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAeD,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAK5D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,CAAC,WAAW,CAAC,CAC5D,CAAC;IACxB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAChC,iBAAiB,CAAC,OAAO,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,OAAO,CAAC,WAAW,CAAC,CAC/D,CAAC;IAC/B,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAE7G,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAI1D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAuB,CAAC;IAC9G,MAAM,YAAY,GAAG,yBAAyB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAChC,YAAoB,EACpB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAqB,CAAC;IAC5E,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAqB,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,QAAgB,EAAE,WAAoB;IACrF,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,YAAoB,EAAE,QAAgB;IACpE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,OAAO,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACzC,CAAC"}
@@ -44,10 +44,10 @@
44
44
  "args": ["-y", "@alanse/mcp-server-google-workspace@1.0.2"],
45
45
  "env": {},
46
46
  "_comment": "npm registry domains are needed for the initial npx -y install. To remove them, vendor the package as a local dependency instead.",
47
+ "_comment2": "On Linux, the @anthropic-ai/sandbox-runtime apply-seccomp binary is executed from node_modules inside the sandbox. Denying ~ blocks access to this binary if the project is in the home directory. We deny specific sensitive directories instead. TODO: separate development and production into different sandbox configs.",
47
48
  "sandbox": {
48
49
  "filesystem": {
49
- "denyRead": ["~"],
50
- "allowRead": ["/usr", "/lib", "/etc"]
50
+ "denyRead": ["~/.gnupg", "~/.aws", "~/.ssh"]
51
51
  },
52
52
  "network": {
53
53
  "allowedDomains": [
@@ -30,7 +30,8 @@ export interface ParsedModelId {
30
30
  *
31
31
  * Format: "provider:model-id" or just "model-id" (defaults to anthropic).
32
32
  *
33
- * @throws Error if the provider prefix is not recognized or model ID is empty
33
+ * @throws Error if the model ID is empty after a recognized provider prefix (e.g. "anthropic:").
34
+ * Unknown prefixes are treated as part of the model ID and default to the anthropic provider.
34
35
  */
35
36
  export declare function parseModelId(qualifiedId: string): ParsedModelId;
36
37
  /**
@@ -55,9 +56,14 @@ export declare function createLanguageModel(qualifiedId: string, config: Resolve
55
56
  * @param apiKey - Explicit API key for the model's provider (empty string uses env/default)
56
57
  * @returns A LanguageModelV3 instance ready for use with generateText()
57
58
  */
58
- export declare function createLanguageModelFromEnv(qualifiedId: string, apiKey: string): Promise<LanguageModelV3>;
59
+ export declare function createLanguageModelFromEnv(qualifiedId: string, apiKey: string, baseURL?: string): Promise<LanguageModelV3>;
59
60
  /**
60
61
  * Resolves the API key for a given provider from user config.
61
62
  * Returns empty string when no key is configured.
62
63
  */
63
64
  export declare function resolveApiKeyForProvider(provider: ProviderId, config: ResolvedUserConfig): string;
65
+ /**
66
+ * Resolves the base URL override for a given provider from user config.
67
+ * Returns empty string when no override is configured.
68
+ */
69
+ export declare function resolveBaseUrlForProvider(provider: ProviderId, config: ResolvedUserConfig): string;
@@ -13,6 +13,30 @@
13
13
  * 3. Optionally adding a key field to UserConfig
14
14
  * 4. Installing the @ai-sdk/<provider> package
15
15
  */
16
+ /**
17
+ * Returns a proxy-aware fetch function if HTTPS_PROXY or HTTP_PROXY is set.
18
+ * Memoized: the ProxyAgent and fetch wrapper are created once and reused.
19
+ */
20
+ let cachedProxyFetch;
21
+ let cachedProxyUrl;
22
+ async function getProxyFetch() {
23
+ const proxyUrl = process.env.HTTPS_PROXY || process.env.HTTP_PROXY;
24
+ if (!proxyUrl)
25
+ return undefined;
26
+ if (cachedProxyFetch && cachedProxyUrl === proxyUrl)
27
+ return cachedProxyFetch;
28
+ const { ProxyAgent, fetch: undiciFetch } = await import('undici');
29
+ const dispatcher = new ProxyAgent(proxyUrl);
30
+ // undici's fetch types are structurally incompatible with globalThis.fetch
31
+ // but fully compatible at runtime. The AI SDK only uses standard fetch semantics.
32
+ const proxyFetch = (input, init) => undiciFetch(input, {
33
+ ...init,
34
+ dispatcher,
35
+ });
36
+ cachedProxyUrl = proxyUrl;
37
+ cachedProxyFetch = proxyFetch;
38
+ return cachedProxyFetch;
39
+ }
16
40
  /** Default provider when no prefix is specified. */
17
41
  const DEFAULT_PROVIDER = 'anthropic';
18
42
  /** Known provider identifiers for validation. */
@@ -22,7 +46,8 @@ const KNOWN_PROVIDERS = new Set(['anthropic', 'google', 'openai']);
22
46
  *
23
47
  * Format: "provider:model-id" or just "model-id" (defaults to anthropic).
24
48
  *
25
- * @throws Error if the provider prefix is not recognized or model ID is empty
49
+ * @throws Error if the model ID is empty after a recognized provider prefix (e.g. "anthropic:").
50
+ * Unknown prefixes are treated as part of the model ID and default to the anthropic provider.
26
51
  */
27
52
  export function parseModelId(qualifiedId) {
28
53
  const colonIndex = qualifiedId.indexOf(':');
@@ -30,11 +55,13 @@ export function parseModelId(qualifiedId) {
30
55
  return { provider: DEFAULT_PROVIDER, modelId: qualifiedId };
31
56
  }
32
57
  const prefix = qualifiedId.substring(0, colonIndex);
33
- const modelId = qualifiedId.substring(colonIndex + 1);
58
+ // Only treat the prefix as a provider if it's a known provider name.
59
+ // Otherwise the entire string is a model ID (e.g. Ollama tags like
60
+ // "qwen3.5-uncensored:35b" where the colon separates name from tag).
34
61
  if (!KNOWN_PROVIDERS.has(prefix)) {
35
- const known = [...KNOWN_PROVIDERS].sort().join(', ');
36
- throw new Error(`Unknown model provider "${prefix}" in "${qualifiedId}". ` + `Supported providers: ${known}`);
62
+ return { provider: DEFAULT_PROVIDER, modelId: qualifiedId };
37
63
  }
64
+ const modelId = qualifiedId.substring(colonIndex + 1);
38
65
  if (!modelId) {
39
66
  throw new Error(`Empty model ID in "${qualifiedId}". ` + `Expected format: "provider:model-id"`);
40
67
  }
@@ -52,7 +79,7 @@ export function parseModelId(qualifiedId) {
52
79
  */
53
80
  export async function createLanguageModel(qualifiedId, config) {
54
81
  const { provider } = parseModelId(qualifiedId);
55
- return createLanguageModelFromEnv(qualifiedId, resolveApiKeyForProvider(provider, config));
82
+ return createLanguageModelFromEnv(qualifiedId, resolveApiKeyForProvider(provider, config), resolveBaseUrlForProvider(provider, config));
56
83
  }
57
84
  /**
58
85
  * Creates a LanguageModel from a qualified model ID and an explicit API key.
@@ -65,21 +92,23 @@ export async function createLanguageModel(qualifiedId, config) {
65
92
  * @param apiKey - Explicit API key for the model's provider (empty string uses env/default)
66
93
  * @returns A LanguageModelV3 instance ready for use with generateText()
67
94
  */
68
- export async function createLanguageModelFromEnv(qualifiedId, apiKey) {
95
+ export async function createLanguageModelFromEnv(qualifiedId, apiKey, baseURL) {
69
96
  const { provider, modelId } = parseModelId(qualifiedId);
70
97
  const key = apiKey || undefined;
98
+ const url = baseURL || undefined;
99
+ const fetch = await getProxyFetch();
71
100
  switch (provider) {
72
101
  case 'anthropic': {
73
102
  const { createAnthropic } = await import('@ai-sdk/anthropic');
74
- return createAnthropic({ apiKey: key })(modelId);
103
+ return createAnthropic({ apiKey: key, baseURL: url, fetch })(modelId);
75
104
  }
76
105
  case 'google': {
77
106
  const { createGoogleGenerativeAI } = await import('@ai-sdk/google');
78
- return createGoogleGenerativeAI({ apiKey: key })(modelId);
107
+ return createGoogleGenerativeAI({ apiKey: key, baseURL: url, fetch })(modelId);
79
108
  }
80
109
  case 'openai': {
81
110
  const { createOpenAI } = await import('@ai-sdk/openai');
82
- return createOpenAI({ apiKey: key })(modelId);
111
+ return createOpenAI({ apiKey: key, baseURL: url, fetch })(modelId);
83
112
  }
84
113
  }
85
114
  }
@@ -97,4 +126,18 @@ export function resolveApiKeyForProvider(provider, config) {
97
126
  return config.openaiApiKey;
98
127
  }
99
128
  }
129
+ /**
130
+ * Resolves the base URL override for a given provider from user config.
131
+ * Returns empty string when no override is configured.
132
+ */
133
+ export function resolveBaseUrlForProvider(provider, config) {
134
+ switch (provider) {
135
+ case 'anthropic':
136
+ return config.anthropicBaseUrl;
137
+ case 'google':
138
+ return config.googleBaseUrl;
139
+ case 'openai':
140
+ return config.openaiBaseUrl;
141
+ }
142
+ }
100
143
  //# sourceMappingURL=model-provider.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"model-provider.js","sourceRoot":"","sources":["../../src/config/model-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,oDAAoD;AACpD,MAAM,gBAAgB,GAAe,WAAW,CAAC;AAEjD,iDAAiD;AACjD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAW3E;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE5C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAEtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,SAAS,WAAW,KAAK,GAAG,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,WAAW,KAAK,GAAG,sCAAsC,CAAC,CAAC;IACnG,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAoB,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,MAA0B;IACvF,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,0BAA0B,CAAC,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,WAAmB,EAAE,MAAc;IAClF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,IAAI,SAAS,CAAC;IAEhC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC9D,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpE,OAAO,wBAAwB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxD,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAoB,EAAE,MAA0B;IACvF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,eAAe,CAAC;QAChC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,YAAY,CAAC;IAC/B,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"model-provider.js","sourceRoot":"","sources":["../../src/config/model-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH;;;GAGG;AACH,IAAI,gBAAqD,CAAC;AAC1D,IAAI,cAAkC,CAAC;AAEvC,KAAK,UAAU,aAAa;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACnE,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,gBAAgB,IAAI,cAAc,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAE7E,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5C,2EAA2E;IAC3E,kFAAkF;IAClF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,IAAc,EAAE,EAAE,CACpD,WAAW,CAAC,KAA0C,EAAE;QACtD,GAAI,IAAgC;QACpC,UAAU;KACX,CAAC,CAAC;IACL,cAAc,GAAG,QAAQ,CAAC;IAC1B,gBAAgB,GAAG,UAAgD,CAAC;IACpE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAKD,oDAAoD;AACpD,MAAM,gBAAgB,GAAe,WAAW,CAAC;AAEjD,iDAAiD;AACjD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAW3E;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE5C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAEpD,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,WAAW,KAAK,GAAG,sCAAsC,CAAC,CAAC;IACnG,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAoB,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,MAA0B;IACvF,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,0BAA0B,CAC/B,WAAW,EACX,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC1C,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,MAAc,EACd,OAAgB;IAEhB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,IAAI,SAAS,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,IAAI,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;IAEpC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC9D,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpE,OAAO,wBAAwB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACjF,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxD,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAoB,EAAE,MAA0B;IACvF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,eAAe,CAAC;QAChC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,YAAY,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAoB,EAAE,MAA0B;IACxF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,gBAAgB,CAAC;QACjC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,aAAa,CAAC;QAC9B,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,aAAa,CAAC;IAChC,CAAC;AACH,CAAC"}