@zgeoff/atc 2.15.1 → 2.15.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.15.1",
+  "version": "2.15.2",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",

package/src/daemon/build-fleet-events.ts

@@ -18,18 +18,24 @@ export interface FleetEvent {
   readonly label?: string;
 }
 
+/**
+ * Builds the events from the sessions that may name them. Rows written
+ * before atc session ids stayed stable across restores carry an earlier atc
+ * id, so a session of `aliases` that holds a row's agent session id names
+ * it when no session holds the atc id; every session that may name a row
+ * may alias it unless the caller gives fewer.
+ */
 export function buildFleetEvents(
   rows: readonly StoredEvent[],
   sessions: readonly SessionDescriptor[],
+  aliases: readonly SessionDescriptor[] = sessions,
 ): FleetEvent[] {
   return rows.map((row) => {
-    // Rows written before atc session ids stayed stable across restores
-    // carry an earlier atc id, so the agent session id links them.
     const live =
+      sessions.find((s) => s.id === row.atcID) ??
       (row.agentSessionID === null
         ? undefined
-        : sessions.find((s) => s.agentSessionID === row.agentSessionID)) ??
-      sessions.find((s) => s.id === row.atcID);
+        : aliases.find((s) => s.agentSessionID === row.agentSessionID));
 
     return {
       cursor: encodeCursor({ kind: 'events', id: row.id }),

package/src/daemon/build-grant-from-fleet-entry.ts

@@ -0,0 +1,14 @@
+import type { FleetEntry } from '../store/fleet-entry';
+import { buildTargetIdentity } from './build-target-identity';
+import type { TargetGrant } from './target-access';
+
+/**
+ * The target a fleet row's session is bound to. A row that stores no
+ * target ran on the implicit `local` target, under its identity.
+ */
+export function buildGrantFromFleetEntry(entry: FleetEntry): TargetGrant {
+  return {
+    target: entry.target ?? 'local',
+    targetIdentity: entry.targetIdentity ?? buildTargetIdentity('local-pty', {}),
+  };
+}

package/src/daemon/build-report-view.ts

@@ -17,17 +17,23 @@ export interface ReportView {
   readonly complete: boolean;
 }
 
+/**
+ * Builds the view from the sessions that may name it. A row written before
+ * atc session ids stayed stable across restores carries an earlier atc id,
+ * so a session of `aliases` that holds its agent session id names it when
+ * no session holds the atc id. The alias only names the report: whoever
+ * checks who may read it checks the row's own atc id.
+ */
 export function buildReportView(
   stored: StoredReport,
   sessions: readonly SessionDescriptor[],
+  aliases: readonly SessionDescriptor[],
 ): ReportView {
-  // A row written before atc session ids stayed stable across restores
-  // carries an earlier atc id, so the agent session id links it.
   const live =
+    sessions.find((s) => s.id === stored.atcID) ??
     (stored.agentSessionID === null
       ? undefined
-      : sessions.find((s) => s.agentSessionID === stored.agentSessionID)) ??
-    sessions.find((s) => s.id === stored.atcID);
+      : aliases.find((s) => s.agentSessionID === stored.agentSessionID));
 
   return {
     report: encodeCursor({ kind: 'events', id: stored.id }),

package/src/daemon/build-scoped-context.ts

@@ -1,8 +1,8 @@
 import { DaemonError } from '../protocol/daemon-error';
 import type { SessionID } from '../shared/session-id';
 import { toSessionID } from '../shared/to-session-id';
+import { buildGrantFromFleetEntry } from './build-grant-from-fleet-entry';
 import { buildTargetForbiddenError } from './build-target-forbidden-error';
-import { buildTargetIdentity } from './build-target-identity';
 import type { DaemonContext } from './daemon-context';
 import type { KeyedRequest } from './idempotency-ledger';
 import type { TargetAccess, TargetGrant } from './target-access';
@@ -10,14 +10,16 @@ import type { TargetAccess, TargetGrant } from './target-access';
 /**
  * The daemon as a principal with the given access sees it. Its keyed
  * spawns and messages hold their keys in the given namespace, apart from
- * every other namespace's. A session on a target outside the access does
- * not exist here: every lookup of it answers as a lookup of an unknown
- * session does, so the request's own handling refuses it with the words
- * and data it gives a session that never existed. Lists leave such
- * sessions out, and a spawn may use only a target the access holds, a
- * spawn's replayed answer included. A kill, or a pin, of a session whose
- * sub-sessions reach past the access is refused whole, before anything
- * changes.
+ * every other namespace's. A session exists here only when the access
+ * reaches every session in its tree: its top-level session and each
+ * sub-session of that one. Every lookup of any other session answers as a
+ * lookup of an unknown session does, so the request's own handling refuses
+ * it with the words and data it gives a session that never existed. Lists
+ * leave such sessions out, the directory list leaves out directories
+ * spawned only on targets outside the access, and a spawn may use only a
+ * target the access holds, a spawn's replayed answer included. A kill, a
+ * forget, or a change checks the tree in the same synchronous step that
+ * starts it, so a sub-session added after the check is never part of it.
  */
 export function buildScopedContext(
   ctx: DaemonContext,
@@ -28,11 +30,11 @@ export function buildScopedContext(
   const buildPrincipalKey = (keyed: KeyedRequest | null): KeyedRequest | null =>
     keyed === null ? null : { ...keyed, principal: keyNamespace };
 
-  const canSee = (id: SessionID): boolean => {
-    const grant = ctx.findSessionGrant(id);
+  const canSee = (id: SessionID): boolean => ctx.canSeeSession(id, access);
 
-    return grant !== null && access.canUse(grant);
-  };
+  // A request's own access narrowed to this one.
+  const mergeAccess = (outer: TargetAccess | null): TargetAccess =>
+    outer === null ? access : outer.merge(access);
 
   const canUseTarget = (target: string): boolean => {
     const targetIdentity = ctx.findTargetIdentity(target);
@@ -57,10 +59,7 @@ export function buildScopedContext(
       return null;
     }
 
-    return {
-      target: entry.target ?? 'local',
-      targetIdentity: entry.targetIdentity ?? buildTargetIdentity('local-pty', {}),
-    };
+    return buildGrantFromFleetEntry(entry);
   };
 
   // Throws the refusal a fresh spawn to the session's target gets when a
@@ -73,24 +72,9 @@ export function buildScopedContext(
     }
   };
 
-  // Throws the refusal of a change to a session whose sub-sessions the
-  // change would reach too when any of them is out of reach. The refusal
-  // holds only the session the caller sent, never a sub-session's id or
-  // how many there are.
-  const requireTreeInReach = (id: SessionID, action: string): void => {
-    if (ctx.collectChildIDs(id).every((child) => canSee(child))) {
-      return;
-    }
-
-    throw new DaemonError(
-      'target_forbidden',
-      `this client may not ${action} session '${id}': it has a sub-session on a target this client may not use`,
-      { session: id },
-    );
-  };
-
   return {
     ...ctx,
+    isSessionVisible: canSee,
     collectSessions: () => ctx.collectSessions().filter((session) => canSee(session.id)),
     collectAgents: () => {
       const list = ctx.collectAgents();
@@ -115,11 +99,12 @@ export function buildScopedContext(
         }),
       };
     },
-    collectFleet: async () => {
-      const fleet = await ctx.collectFleet();
+    collectSpawnDirs: (outer) => {
+      const merged = outer === null ? access : outer.merge(access);
 
-      return fleet.filter((entry) => canSee(entry.sessionID));
+      return ctx.collectSpawnDirs(merged);
     },
+    resolveSpawnParent: (id) => (canSee(id) ? ctx.resolveSpawnParent(id) : 'missing'),
     resolveSpawnTarget: (requested) => {
       if (requested !== undefined) {
         requireTarget(canUseTarget, requested);
@@ -132,12 +117,10 @@ export function buildScopedContext(
       return target;
     },
     spawnSession: async (plan, keyed) => {
-      let answer: Readonly<Record<string, unknown>>;
-
       // A held key's replay is checked against the target its session was
       // bound to, inside the spawn, before its answer leaves the daemon.
       try {
-        answer = await ctx.spawnSession(plan, buildPrincipalKey(keyed), access);
+        return await ctx.spawnSession(plan, buildPrincipalKey(keyed), access);
       } catch (error) {
         // A held key's refusal may carry the session its spawn made.
         if (error instanceof DaemonError && typeof error.data?.['effectRef'] === 'string') {
@@ -146,29 +129,17 @@ export function buildScopedContext(
 
         throw error;
       }
-
-      return answer;
     },
-    killSession: (id) => {
-      if (!canSee(id)) {
-        return Promise.resolve(false);
-      }
 
-      requireTreeInReach(id, 'kill');
-
-      return ctx.killSession(id);
-    },
-    updateSession: (id, name, pinned) => {
-      if (!canSee(id)) {
-        return false;
-      }
+    // The daemon's kill takes the session's sub-sessions before its first
+    // await, so the set it kills is the set this check saw.
+    killSession: (id) => (canSee(id) ? ctx.killSession(id) : Promise.resolve(false)),
 
-      if (pinned !== undefined) {
-        requireTreeInReach(id, 'pin');
-      }
-
-      return ctx.updateSession(id, name, pinned);
-    },
+    // A session out of reach answers before any confirm token is handed
+    // out or taken, so its host is never touched.
+    forgetSession: (id, confirmToken) =>
+      canSee(id) ? ctx.forgetSession(id, confirmToken) : Promise.resolve('missing' as const),
+    updateSession: (id, name, pinned) => canSee(id) && ctx.updateSession(id, name, pinned),
     ackSession: (id) => canSee(id) && ctx.ackSession(id),
     buildResumeCommand: (id) => (canSee(id) ? ctx.buildResumeCommand(id) : null),
     readSessionScreen: (id) =>
@@ -190,12 +161,16 @@ export function buildScopedContext(
     writeSessionLine: (sessionID, text) =>
       canSee(sessionID) ? ctx.writeSessionLine(sessionID, text) : 'missing',
     ejectSession: (id, prompt) => (canSee(id) ? ctx.ejectSession(id, prompt) : 'missing'),
-    adoptSession: (id, cols, rows) =>
-      canSee(id) ? ctx.adoptSession(id, cols, rows) : Promise.resolve('missing' as const),
+    adoptSession: (id, cols, rows, outer) =>
+      canSee(id)
+        ? ctx.adoptSession(id, cols, rows, mergeAccess(outer))
+        : Promise.resolve('missing' as const),
     resizeSession: (client, sessionID, dims) =>
       canSee(sessionID) && ctx.resizeSession(client, sessionID, dims),
-    readSessionRecord: (id) =>
-      canSee(id) ? ctx.readSessionRecord(id) : Promise.resolve('missing' as const),
+    readSessionRecord: (id, outer) =>
+      canSee(id)
+        ? ctx.readSessionRecord(id, mergeAccess(outer))
+        : Promise.resolve('missing' as const),
     loadSessionTranscript: (id, from, limit) =>
       canSee(id) ? ctx.loadSessionTranscript(id, from, limit) : Promise.resolve('missing' as const),
     readEvents: (afterID, limit, waitMs, sessionID, outer) => {
@@ -203,31 +178,43 @@ export function buildScopedContext(
 
       return ctx.readEvents(afterID, limit, waitMs, sessionID, merged);
     },
-    readReport: (id, outer) => {
-      const merged = outer === null ? access : outer.merge(access);
-
-      return ctx.readReport(id, merged);
-    },
-    writeSessionMessage: (sessionID, from, text, keyed) =>
+    readReport: (id, outer) => ctx.readReport(id, mergeAccess(outer)),
+    writeSessionMessage: (sessionID, from, text, keyed, outer) =>
       canSee(sessionID)
-        ? ctx.writeSessionMessage(sessionID, from, text, buildPrincipalKey(keyed))
+        ? ctx.writeSessionMessage(
+            sessionID,
+            from,
+            text,
+            buildPrincipalKey(keyed),
+            mergeAccess(outer),
+          )
         : Promise.resolve('missing' as const),
     readMessage: async (messageID, waitMs) => {
       // The owner is checked before any wait, so a message outside the
       // access answers at once, as an unknown message does.
       const view = await ctx.readMessage(messageID, 0);
 
-      if (view === null || !canSee(view.session)) {
+      // Only the session the message was sent to owns it here, never one
+      // that shares its agent session id.
+      if (view === null || view.session !== view.record.atcID || !canSee(view.session)) {
         return null;
       }
 
-      return waitMs === 0 ? view : ctx.readMessage(messageID, waitMs);
+      if (waitMs === 0) {
+        return view;
+      }
+
+      // The message may move to another session that holds its agent
+      // session id while the read waits.
+      const waited = await ctx.readMessage(messageID, waitMs);
+
+      return waited !== null && waited.session === waited.record.atcID ? waited : null;
     },
-    attachTap: (client, sessionID) =>
-      canSee(sessionID) ? ctx.attachTap(client, sessionID) : 'missing',
-    ackMessage: (client, sessionID, messageID) =>
+    attachTap: (client, sessionID, outer) =>
+      canSee(sessionID) ? ctx.attachTap(client, sessionID, mergeAccess(outer)) : 'missing',
+    ackMessage: (client, sessionID, messageID, outer) =>
       canSee(sessionID)
-        ? ctx.ackMessage(client, sessionID, messageID)
+        ? ctx.ackMessage(client, sessionID, messageID, mergeAccess(outer))
         : Promise.resolve('unknown' as const),
   };
 }