@zgeoff/atc 2.11.0 → 2.13.0

package/src/daemon/mint-session-id.ts

@@ -1,12 +1,12 @@
+import { randomUUID } from 'node:crypto';
 import type { SessionID } from '../shared/session-id';
 
-let counter = 0;
-
 /**
- * A fresh atc session id: an incrementing counter joined to the current time
- * in base36. Every session the session manager spawns or restores gets one.
+ * A fresh atc session id: a random uuid. Every session the session manager
+ * spawns gets one, and the fleet row keeps it, so the id stays the same
+ * across daemon restarts and fleet restores.
  */
 export function mintSessionID(): SessionID {
   // oxlint-disable-next-line no-unsafe-type-assertion -- this is where atc mints a session id
-  return `s${++counter}-${Date.now().toString(36)}` as SessionID;
+  return randomUUID() as SessionID;
 }

package/src/daemon/parse-hook-line.ts

@@ -0,0 +1,31 @@
+import { isRecord } from '../shared/report';
+import { toSessionID } from '../shared/to-session-id';
+import type { HookEvent } from './hooks';
+
+/**
+ * One reporter line as a hook event, or null for a line that is not one.
+ */
+export function parseHookLine(line: string): HookEvent | null {
+  let parsed: unknown;
+
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return null;
+  }
+
+  if (
+    !isRecord(parsed) ||
+    typeof parsed['atcId'] !== 'string' ||
+    typeof parsed['event'] !== 'string' ||
+    !isRecord(parsed['payload'])
+  ) {
+    return null;
+  }
+
+  return {
+    atcId: toSessionID(parsed['atcId']),
+    event: parsed['event'],
+    payload: parsed['payload'],
+  };
+}

package/src/daemon/parse-spawn-overrides.ts

@@ -0,0 +1,94 @@
+import type { SpawnOverrides } from '../agents/agent-adapter';
+import type { AgentEntry, SpawnOptionEntry } from './build-agent-list';
+
+interface RequestedOverrides {
+  readonly model?: string | undefined;
+  readonly effort?: string | undefined;
+}
+
+interface SpawnRefusal {
+  readonly ok: false;
+  readonly code: 'bad_args' | 'unsupported';
+  readonly message: string;
+}
+
+type ParsedOverrides = { readonly ok: true; readonly overrides: SpawnOverrides } | SpawnRefusal;
+
+/**
+ * Checks a spawn's model and effort against the options the agent list
+ * shows for that agent, so a spawn accepts exactly what `agents.list`
+ * advertises. An option the agent cannot take on this host is unsupported,
+ * never ignored. A value outside an option's closed set, or one that could
+ * pass for a flag, is bad_args.
+ */
+export function parseSpawnOverrides(
+  agent: AgentEntry,
+  requested: RequestedOverrides,
+): ParsedOverrides {
+  const model = requested.model;
+  const effort = requested.effort;
+
+  const refusal =
+    (model === undefined
+      ? null
+      : findOptionRefusal(agent.id, 'model', agent.spawnOptions.model, model)) ??
+    (effort === undefined
+      ? null
+      : findOptionRefusal(agent.id, 'effort', agent.spawnOptions.effort, effort));
+
+  if (refusal !== null) {
+    return refusal;
+  }
+
+  return {
+    ok: true,
+    overrides: {
+      ...(model === undefined ? {} : { model }),
+      ...(effort === undefined ? {} : { effort }),
+    },
+  };
+}
+
+const MAX_VALUE_LENGTH = 200;
+
+// oxlint-disable-next-line no-control-regex -- control characters are what a value is refused for
+const CONTROL_CHARACTER = /[\u0000-\u001F\u007F]/u;
+
+function findOptionRefusal(
+  agentID: string,
+  name: 'model' | 'effort',
+  option: SpawnOptionEntry,
+  value: string,
+): SpawnRefusal | null {
+  if (!option.available) {
+    const reason = option.supported ? 'is not installed on this host' : `takes no ${name}`;
+
+    return { ok: false, code: 'unsupported', message: `agent '${agentID}' ${reason}` };
+  }
+
+  if (value === '' || value.length > MAX_VALUE_LENGTH) {
+    return {
+      ok: false,
+      code: 'bad_args',
+      message: `${name} must be 1 to ${MAX_VALUE_LENGTH} characters`,
+    };
+  }
+
+  if (value.startsWith('-') || CONTROL_CHARACTER.test(value)) {
+    return {
+      ok: false,
+      code: 'bad_args',
+      message: `${name} must not start with '-' or hold control characters`,
+    };
+  }
+
+  if (option.values !== null && !option.values.includes(value)) {
+    return {
+      ok: false,
+      code: 'bad_args',
+      message: `agent '${agentID}' takes ${name} ${option.values.join(', ')}; got '${value}'`,
+    };
+  }
+
+  return null;
+}

package/src/daemon/permission-registry.ts

@@ -30,7 +30,9 @@ export class PermissionRegistry {
 
   private readonly pending = new Map<string, PendingRequest>();
 
-  private readonly resolved = new Set<string>();
+  // Each answered request's session, kept to tell already_answered from
+  // unknown.
+  private readonly resolved = new Map<string, SessionID>();
 
   private counter = 0;
 
@@ -72,6 +74,14 @@ export class PermissionRegistry {
     return 'ok';
   }
 
+  /**
+   * The session a request belongs to, answered or not, or null for a
+   * request this registry never opened.
+   */
+  findSessionID(id: string): SessionID | null {
+    return this.pending.get(id)?.req.sessionID ?? this.resolved.get(id) ?? null;
+  }
+
   answerAll(sessionID: SessionID, decision: string): void {
     for (const [id, entry] of this.pending) {
       if (entry.req.sessionID === sessionID) {
@@ -90,12 +100,12 @@ export class PermissionRegistry {
     clearTimeout(entry.timer);
 
     this.pending.delete(id);
-    this.resolved.add(id);
+    this.resolved.set(id, entry.req.sessionID);
 
-    // The resolved set only exists to tell already_answered from unknown;
+    // The resolved map only exists to tell already_answered from unknown;
     // cap it so a long-lived daemon cannot grow it without bound.
     if (this.resolved.size > 1000) {
-      for (const oldest of this.resolved) {
+      for (const oldest of this.resolved.keys()) {
         this.resolved.delete(oldest);
         break;
       }

package/src/daemon/pick-session-state.ts

@@ -0,0 +1,15 @@
+import type { SessionLifecycle } from './build-session-lifecycle';
+
+type SessionState = 'running' | 'needs_you' | 'done' | 'exited';
+
+/**
+ * The state a session lists with: `exited` whenever its harness is not
+ * running, suspended inside a sleeping host included, and otherwise the
+ * attention its hooks last reported.
+ */
+export function pickSessionState(
+  lifecycle: Readonly<SessionLifecycle>,
+  attention: SessionState,
+): SessionState {
+  return lifecycle.harness === 'running' ? attention : 'exited';
+}

package/src/daemon/restore-fleet.ts

@@ -1,7 +1,7 @@
-import type { AgentSessionID } from '../shared/agent-session-id';
+import { DaemonError } from '../protocol/daemon-error';
 import type { SessionID } from '../shared/session-id';
+import type { FleetEntry } from '../store/fleet-entry';
 import type { StateStore } from '../store/state-store';
-import { ScreenModel } from './screen-model';
 import type { SessionRuntime } from './session-runtime';
 import type { Session, SessionManager } from './sessions';
 
@@ -33,15 +33,17 @@ export async function restoreFleet(params: RestoreFleetParams): Promise<number>
   const rows = params.rows;
   const capMs = params.capMs;
 
-  const hasLiveSession = (agentSessionID: AgentSessionID) =>
+  const hasLiveSession = (entry: FleetEntry) =>
     mgr.sessions.some(
       (s) =>
-        s.agentSessionID === agentSessionID &&
+        isSameSession(s, entry) &&
         (s.pty !== null || (s.kind === 'headless' && s.state !== 'exited')),
     );
 
-  const hasAnySession = (agentSessionID: AgentSessionID) =>
-    mgr.sessions.some((s) => s.agentSessionID === agentSessionID);
+  const hasAnySession = (entry: FleetEntry) => mgr.sessions.some((s) => isSameSession(s, entry));
+
+  const findRecency = (entry: FleetEntry) =>
+    entry.agentSessionID === undefined ? '' : (recency.get(entry.agentSessionID) ?? '');
 
   const recency = await store.collectFleetRecency();
   const stored = await store.loadFleet();
@@ -52,14 +54,8 @@ export async function restoreFleet(params: RestoreFleetParams): Promise<number>
   // dedupe against every listed session, so repeated restores never double
   // up the killed archive.
   const kept = stored
-    .filter((entry) =>
-      entry.exited === true
-        ? !hasAnySession(entry.agentSessionID)
-        : !hasLiveSession(entry.agentSessionID),
-    )
-    .toSorted((a, b) =>
-      (recency.get(b.agentSessionID) ?? '').localeCompare(recency.get(a.agentSessionID) ?? ''),
-    );
+    .filter((entry) => (entry.exited === true ? !hasAnySession(entry) : !hasLiveSession(entry)))
+    .toSorted((a, b) => findRecency(b).localeCompare(findRecency(a)));
 
   // Sub-sessions register after every top-level entry, so each one links
   // to a parent that is already listed; the wrangling session also boots
@@ -72,30 +68,41 @@ export async function restoreFleet(params: RestoreFleetParams): Promise<number>
   // The whole fleet registers as terminal-less sessions up front, so the
   // list shows every incoming session immediately instead of revealing them
   // one boot at a time. Exited entries only register — they stay killed
-  // until revived by hand, so no terminal is adopted for them.
-  const registered = entries.map((entry) => mgr.restore(entry));
-  const queued = registered.filter((s) => s.state !== 'exited');
-
-  const adoptQueued = (s: Session): boolean => {
-    if (mgr.adoptTerminal(s.id, cols, rows) === null) {
-      return false;
-    }
-
-    const runtime = findRuntime(s.id);
-
-    if (runtime !== undefined) {
-      runtime.dims = { cols, rows };
-
-      runtime.screen ??= new ScreenModel(cols, rows);
-    }
-
-    return true;
+  // until revived by hand, so no terminal is adopted for them. An entry
+  // whose session is still listed, dead, revives that session in place
+  // rather than listing a second session under the same id.
+  const registered = entries.map((entry) => {
+    const listed = mgr.sessions.find((s) => s.id === entry.sessionID);
+
+    return listed === undefined
+      ? { session: mgr.restore(entry), revive: false }
+      : { session: listed, revive: true };
+  });
+
+  const queued = registered
+    .filter((r) => r.revive || r.session.state !== 'exited')
+    .map((r) => r.session);
+
+  // A session whose target refuses to start a terminal stays listed without
+  // one, and the restore moves on to the next.
+  const adoptQueued = async (s: Session): Promise<boolean> => {
+    const adopted = await tryAdoptTerminal(mgr, s.id, cols, rows);
+
+    return adopted !== null;
   };
 
+  // A session that announced itself, or whose terminal died, before the
+  // wait began has nothing left to wait for.
   const waitForBoot = (sessionID: SessionID): Promise<void> => {
     const runtime = findRuntime(sessionID);
-
-    if (runtime === undefined) {
+    const session = mgr.sessions.find((s) => s.id === sessionID);
+
+    if (
+      runtime === undefined ||
+      runtime.startedAt !== null ||
+      session === undefined ||
+      session.pty === null
+    ) {
       return Promise.resolve();
     }
 
@@ -124,11 +131,26 @@ export async function restoreFleet(params: RestoreFleetParams): Promise<number>
     return registered.length;
   }
 
-  // The first terminal attaches synchronously so a caller can attach at
-  // once; each later one waits for the previous session to report it has
+  // The first terminal attaches before the restore answers so a caller can
+  // attach at once; each later one waits for the previous session to report it has
   // booted, so a heavy fleet comes up one process at a time instead of all
   // at once. A per-session cap keeps a session that never reports from
   // stalling the rest.
+  // A session whose revive fails is logged and left without a terminal,
+  // and the restore moves on: one host's failure never keeps the sessions on
+  // other hosts down, and a later one's runs where nothing awaits it.
+  const tryAdoptQueued = async (s: Session): Promise<boolean> => {
+    try {
+      return await adoptQueued(s);
+    } catch (error) {
+      mgr.log(
+        `atc could not revive session ${s.id} (${error instanceof Error ? error.message : String(error)})`,
+      );
+
+      return false;
+    }
+  };
+
   const adoptRest = async (previous: Session | null) => {
     let prev = previous;
 
@@ -137,13 +159,56 @@ export async function restoreFleet(params: RestoreFleetParams): Promise<number>
         await waitForBoot(prev.id);
       }
 
-      prev = adoptQueued(s) ? s : null;
+      const booted = await tryAdoptQueued(s);
+
+      prev = booted ? s : null;
     }
   };
 
-  const firstBooted = adoptQueued(first) ? first : null;
+  const firstAdopted = await tryAdoptQueued(first);
+
+  const firstBooted = firstAdopted ? first : null;
 
   void adoptRest(firstBooted);
 
   return registered.length;
 }
+
+// A stored entry matches a listed session by its atc session id, or by its
+// agent session id when a listed session resumed the same agent session.
+function isSameSession(s: Session, entry: FleetEntry): boolean {
+  return (
+    s.id === entry.sessionID ||
+    (entry.agentSessionID !== undefined && s.agentSessionID === entry.agentSessionID)
+  );
+}
+
+// The refusals that leave one session without a terminal: its target is
+// misconfigured, gone from the config, changed, has no provider here, or
+// cannot start a terminal.
+const REFUSED_ADOPT_CODES: ReadonlySet<string> = new Set([
+  'unsupported_operation',
+  'unknown_target',
+  'target_unavailable',
+  'target_changed',
+  'target_config_invalid',
+  'host_unavailable',
+  'auth_not_configured',
+]);
+
+async function tryAdoptTerminal(
+  mgr: SessionManager,
+  id: SessionID,
+  cols: number,
+  rows: number,
+): Promise<Session | null> {
+  try {
+    return await mgr.adoptTerminal(id, cols, rows);
+  } catch (error) {
+    if (error instanceof DaemonError && REFUSED_ADOPT_CODES.has(error.code)) {
+      return null;
+    }
+
+    throw error;
+  }
+}

package/src/daemon/screen-model.ts

@@ -99,6 +99,13 @@ export class ScreenModel {
     return RESET_INPUT_MODES + this.renderVisibleScreen() + this.renderInputModes();
   }
 
+  // Whether the TUI has turned bracketed paste on, as of the output parsed
+  // so far. It reads the mode without waiting, so output still queued for
+  // parsing never delays the caller; a TUI turns the mode on once, at start.
+  hasBracketedPaste(): boolean {
+    return this.term.modes.bracketedPasteMode;
+  }
+
   // The visible rows of whichever buffer the session is showing, as plain
   // text with no escape sequences: one line per row, trailing blanks
   // trimmed from each row, trailing blank rows dropped. Drains pending

package/src/daemon/session-runtime.ts

@@ -46,6 +46,16 @@ export class SessionRuntime {
   // later dropped may be restarting, so it keeps the inbox open.
   tapAttached = false;
 
+  // Returns the boot-scoped state to how a fresh terminal starts, at the
+  // dims it boots with: no SessionStart yet and no tap since. Every path
+  // that boots a new terminal for an existing session runs it, so a revived
+  // session never inherits its previous process's message gate.
+  resetBoot(dims: Dims): void {
+    this.dims = dims;
+    this.startedAt = null;
+    this.tapAttached = false;
+  }
+
   dispose(): void {
     clearTimeout(this.resizeTimer);
     clearTimeout(this.detectTimer);