@zgeoff/atc 2.15.1 → 2.16.0

package/src/daemon/verify-broker-authority.ts

@@ -0,0 +1,52 @@
+import { BrokerAuthorityError } from './broker-authority-error';
+import type { ImpPort } from './imp-port';
+import { verifyTokenImpAuthority } from './verify-token-imp-authority';
+
+/**
+ * What a provisioning call is about to touch: the imps under their actual
+ * names, as the target's runtime namespace builds them, and every secret
+ * the binding grants them.
+ */
+export interface BrokerActivation {
+  readonly impNames: readonly string[];
+  readonly secrets: readonly string[];
+}
+
+/**
+ * The gate before atc grants or relies on a brokered credential. It reads
+ * impd's features, then the token's identity, and writes nothing, so a
+ * refusal leaves impd as it was. It rejects unless impd has both grantable
+ * tokens and secret rebinds, the token may manage each imp and reaches no
+ * imp outside the namespace whose imp names start with the prefix, and the
+ * token may grant every bound secret.
+ * Whether each secret's rules match the binding is a separate comparison.
+ */
+export async function verifyBrokerAuthority(
+  port: Pick<ImpPort, 'readFeatures' | 'readIdentity'>,
+  activation: BrokerActivation,
+  impPrefix: string,
+): Promise<void> {
+  const features = await port.readFeatures();
+
+  if (!features.grantableTokens || !features.secretRebind) {
+    throw new BrokerAuthorityError(
+      'auth_impd_too_old',
+      'impd lacks grantable tokens or secret rebinds; it must be 0.27.0 or later',
+      { grantableTokens: features.grantableTokens, secretRebind: features.secretRebind },
+    );
+  }
+
+  const identity = await port.readIdentity();
+
+  verifyTokenImpAuthority(identity, activation.impNames, impPrefix);
+
+  const missing = activation.secrets.filter((secret) => !identity.grantable.includes(secret));
+
+  if (missing.length > 0) {
+    throw new BrokerAuthorityError(
+      'auth_secret_not_grantable',
+      `impd token ${identity.name} cannot grant ${missing.join(', ')}`,
+      { token: identity.name, grantable: identity.grantable, missing },
+    );
+  }
+}

package/src/daemon/verify-cleanup-authority.ts

@@ -0,0 +1,44 @@
+import { BrokerAuthorityError } from './broker-authority-error';
+import type { ImpPort, ImpView } from './imp-port';
+import { verifyTokenImpAuthority } from './verify-token-imp-authority';
+
+// The imp a binding recorded when atc made it.
+export interface RecordedImp {
+  readonly name: string;
+  readonly id: string;
+}
+
+/**
+ * The check before atc destroys a session's imp or revokes its grants.
+ * It asks that the token may manage the recorded imp, under imp patterns
+ * that stay inside the namespace whose imp names start with the prefix,
+ * and that the imp under that
+ * name is still the one recorded. It never asks that a secret's rules
+ * still match or that every grant is still in place, so a rotated, rebound
+ * or deleted secret never stops atc removing access. Resolves to the imp,
+ * or to null when impd confirms no imp holds the name, which needs no
+ * cleanup; an imp with another id rejects.
+ */
+export async function verifyCleanupAuthority(
+  port: Pick<ImpPort, 'readIdentity' | 'readImp'>,
+  recorded: RecordedImp,
+  impPrefix: string,
+): Promise<ImpView | null> {
+  const identity = await port.readIdentity();
+
+  // Checked first, so impd's answer for the name comes from a token that
+  // can see the imp, and a missing imp means it is gone.
+  verifyTokenImpAuthority(identity, [recorded.name], impPrefix);
+
+  const imp = await port.readImp(recorded.name);
+
+  if (imp !== null && imp.id !== recorded.id) {
+    throw new BrokerAuthorityError(
+      'auth_runtime_mismatch',
+      `imp ${recorded.name} is no longer the imp atc made`,
+      { imp: recorded.name, recordedID: recorded.id, actualID: imp.id },
+    );
+  }
+
+  return imp;
+}

package/src/daemon/verify-token-imp-authority.ts

@@ -0,0 +1,74 @@
+import { BrokerAuthorityError } from './broker-authority-error';
+import type { ImpIdentity } from './imp-port';
+import { isImpNameAllowed } from './is-imp-name-allowed';
+
+/**
+ * Rejects unless the token may manage every named imp and reaches no imp
+ * outside atc's namespace: scope `manage`, imp patterns rather than none,
+ * and each pattern contained in the namespace prefix, so the literal text
+ * before its first `*`, or the whole pattern when it has none, starts with
+ * the prefix. A token with any pattern beyond the prefix is refused
+ * outright, however few names that pattern reaches, never used in place of
+ * a contained one. Each name must then match a pattern. The prefix is the
+ * literal start of every imp name the target's runtime namespace builds,
+ * and the names are the imps the call touches under those built names.
+ */
+export function verifyTokenImpAuthority(
+  identity: ImpIdentity,
+  impNames: readonly string[],
+  impPrefix: string,
+): void {
+  assertImpPrefix(impPrefix);
+
+  if (identity.scope !== 'manage') {
+    throw new BrokerAuthorityError(
+      'auth_token_scope',
+      `impd token ${identity.name} cannot manage imps`,
+      {
+        token: identity.name,
+        scope: identity.scope,
+      },
+    );
+  }
+
+  const patterns = identity.imps;
+
+  if (patterns === null || !patterns.every((pattern) => isPatternContained(pattern, impPrefix))) {
+    throw new BrokerAuthorityError(
+      'auth_token_too_broad',
+      `impd token ${identity.name} can reach imps outside atc's namespace, whose imp names start with ${impPrefix}`,
+      {
+        token: identity.name,
+        imps: patterns,
+        offending:
+          patterns === null
+            ? null
+            : patterns.filter((pattern) => !isPatternContained(pattern, impPrefix)),
+      },
+    );
+  }
+
+  const outside = impNames.filter((name) => !isImpNameAllowed(patterns, name));
+
+  if (outside.length > 0) {
+    throw new BrokerAuthorityError(
+      'auth_imp_out_of_scope',
+      `impd token ${identity.name} cannot manage ${outside.join(', ')}`,
+      { token: identity.name, imps: patterns, outside },
+    );
+  }
+}
+
+// An empty prefix would contain every pattern, `*` included.
+function assertImpPrefix(impPrefix: string): void {
+  if (impPrefix === '') {
+    throw new Error('the imp name prefix of a runtime namespace must not be empty');
+  }
+}
+
+// Every name a pattern matches starts with the text before its first `*`.
+function isPatternContained(pattern: string, impPrefix: string): boolean {
+  const [literal = ''] = pattern.split('*');
+
+  return literal.startsWith(impPrefix);
+}

package/src/hook-report.ts

@@ -4,10 +4,12 @@ import { isRecord, sendReport } from './shared/report';
 /**
  * Runs as a hook inside wrangled sessions. Reads the hook event from stdin
  * (Claude snake_case keys or Grok camelCase keys) and forwards a PascalCase
- * event name to the atc unix socket. Always exits 0 so it never blocks the
- * session it reports on.
+ * event name to the atc unix socket, with the agent id the hook command
+ * gave it, so the daemon can tell a nested harness's report from the
+ * session's own. Always exits 0 so it never blocks the session it reports
+ * on.
  */
-export async function runHookReport(): Promise<void> {
+export async function runHookReport(agent: string): Promise<void> {
   const sock = process.env['ATC_SOCKET'];
   const atcId = process.env['ATC_SESSION_ID'];
 
@@ -26,7 +28,7 @@ export async function runHookReport(): Promise<void> {
 
     const rawName = payload['hook_event_name'] ?? payload['hookEventName'];
     const event = typeof rawName === 'string' ? normalizeHookEventName(rawName) : rawName;
-    const line = `${JSON.stringify({ atcId, event, payload })}\n`;
+    const line = `${JSON.stringify({ atcId, ...(agent === '' ? {} : { agent }), event, payload })}\n`;
 
     await sendReport(sock, line, 2000);
   }

package/src/protocol/hook-event.ts

@@ -1,11 +1,15 @@
+import type { AgentID } from '../shared/agent-id';
 import type { SessionID } from '../shared/session-id';
 
 /**
- * One line a hook reporter sends: the atc session it reports on, the agent's
- * hook event name, and the hook's payload as the agent gave it.
+ * One line a hook reporter sends: the atc session it reports on, the agent
+ * whose hook command sent it, the agent's hook event name, and the hook's
+ * payload as the agent gave it. The agent is absent on a line from a hook
+ * command that carries none.
  */
 export interface HookEvent {
   atcId: SessionID;
+  agent?: AgentID;
   event: string;
   payload: Record<string, unknown>;
 }

package/src/statusline.ts

@@ -8,10 +8,11 @@ import { isRecord, sendReport } from './shared/report';
 /**
  * Runs as the statusLine command injected into wrangled sessions. Chains the
  * user's own statusline (from ~/.claude/settings.json), appends the atc fleet
- * segment, and heartbeats the session id back to the atc socket. Always
- * exits 0 so it never breaks the session it renders for.
+ * segment, and heartbeats the session id back to the atc socket, with the
+ * agent id the command gave it. Always exits 0 so it never breaks the
+ * session it renders for.
  */
-export async function runStatusline(): Promise<void> {
+export async function runStatusline(agent: string): Promise<void> {
   const raw = await new Response(Bun.stdin.stream()).text();
 
   const sock = process.env['ATC_SOCKET'];
@@ -28,7 +29,7 @@ export async function runStatusline(): Promise<void> {
       }
     } catch {}
 
-    const line = `${JSON.stringify({ atcId, event: 'Statusline', payload })}\n`;
+    const line = `${JSON.stringify({ atcId, ...(agent === '' ? {} : { agent }), event: 'Statusline', payload })}\n`;
 
     await sendReport(sock, line, 500);
   }
@@ -128,7 +129,8 @@ async function readOwnSegment(sock: string): Promise<string> {
 }
 
 // A user statusline that is atc's own injected command would chain into
-// itself; the injected command always ends with the bare subcommand.
+// itself; the injected command ends with the bare subcommand, or with the
+// subcommand and its agent flag.
 function isSelfCommand(cmd: string): boolean {
-  return cmd.includes('statusline.ts') || cmd.trimEnd().endsWith(' statusline');
+  return cmd.includes('statusline.ts') || /\sstatusline(?:\s+--agent\s.*)?$/u.test(cmd);
 }

package/src/store/run-migrations.ts

@@ -56,6 +56,8 @@ interface EventsTable {
 
 interface SpawnHistoryTable {
   cwd: string;
+  target: string;
+  target_identity: string;
   last_spawn: number;
 }
 
@@ -152,8 +154,9 @@ export interface StateStoreSchema {
 // agent_session_id under its Claude-era name plus name and cwd, and each
 // later step adds one column the daemon grew to depend on, until the
 // rebuild that keys the table by the atc session id. events later gains
-// columns of its own, as does messages, while spawn_history and prefs have
-// carried one shape since they were added.
+// columns of its own, as does messages, spawn_history is rebuilt to key each
+// directory by the target it was spawned on, and prefs has carried one shape
+// since it was added.
 const MIGRATIONS: Record<string, Migration> = {
   '001_create_initial_schema': {
     async up(db: Kysely<StateStoreSchema>) {
@@ -446,6 +449,29 @@ const MIGRATIONS: Record<string, Migration> = {
       await db.schema.alterTable('events').addColumn('report_text', 'text').execute();
     },
   },
+  '024_rebuild_spawn_history_keyed_by_target': {
+    async up(db: Kysely<StateStoreSchema>) {
+      // The ledger records this step only after it returns, so a crash in
+      // between leaves a rebuilt table behind a ledger that still lacks it.
+      const columns = await sql<ColumnInfoRow>`PRAGMA table_info(spawn_history)`.execute(db);
+
+      if (columns.rows.some((column) => column.name === 'target')) {
+        return;
+      }
+
+      await sql`BEGIN IMMEDIATE`.execute(db);
+
+      try {
+        await updateSpawnHistoryKeyToTarget(db);
+
+        await sql`COMMIT`.execute(db);
+      } catch (error) {
+        await sql`ROLLBACK`.execute(db);
+
+        throw error;
+      }
+    },
+  },
 };
 
 const PROVIDER: MigrationProvider = {
@@ -457,8 +483,9 @@ const PROVIDER: MigrationProvider = {
  * `Migrator`, one additive step at a time. A database from before the
  * ladder existed is recognized at whichever shape it stopped at by a
  * baselining pass that records the steps its columns already satisfy, so
- * only what is genuinely missing runs. One step rebuilds the fleet table
- * under a new key and carries every row across; no step drops a row.
+ * only what is genuinely missing runs. Two steps rebuild a table under a
+ * new key, the fleet and the spawn history, and carry every row across; no
+ * step drops a row.
  */
 export async function runMigrations(db: Kysely<StateStoreSchema>): Promise<void> {
   // A baselined step can land out of order relative to a step that turned
@@ -652,6 +679,30 @@ interface ColumnInfoRow {
   type: string;
 }
 
+// The identity of the local target with no options. Every spawn from before
+// spawns recorded their target ran there.
+const LEGACY_SPAWN_TARGET_IDENTITY = 'local-pty:44136fa355b3678a';
+
+async function updateSpawnHistoryKeyToTarget(db: Kysely<StateStoreSchema>): Promise<void> {
+  await sql`
+    CREATE TABLE spawn_history_rebuilt (
+      cwd TEXT NOT NULL,
+      target TEXT NOT NULL,
+      target_identity TEXT NOT NULL,
+      last_spawn INTEGER NOT NULL,
+      PRIMARY KEY (cwd, target, target_identity)
+    )
+  `.execute(db);
+
+  await sql`
+    INSERT INTO spawn_history_rebuilt (cwd, target, target_identity, last_spawn)
+    SELECT cwd, 'local', ${LEGACY_SPAWN_TARGET_IDENTITY}, last_spawn FROM spawn_history
+  `.execute(db);
+
+  await sql`DROP TABLE spawn_history`.execute(db);
+  await sql`ALTER TABLE spawn_history_rebuilt RENAME TO spawn_history`.execute(db);
+}
+
 async function collectFleetColumns(db: Kysely<StateStoreSchema>): Promise<ReadonlySet<string>> {
   const result = await sql<ColumnInfoRow>`PRAGMA table_info(fleet)`.execute(db);
 

package/src/store/state-store.ts

@@ -64,6 +64,27 @@ export interface StoredEvent {
   readonly label?: string;
 }
 
+// The target a spawn ran on: its name and the identity the spawned session
+// was bound to there.
+interface SpawnTarget {
+  readonly target: string;
+  readonly targetIdentity: string;
+}
+
+// A directory a spawn ran in and the target it ran on.
+export interface SpawnDir {
+  readonly cwd: string;
+  readonly grant: SpawnTarget;
+}
+
+/**
+ * Another message one turn answered, and the atc id it was sent to.
+ */
+export interface TurnSibling {
+  readonly id: MessageID;
+  readonly atcID: SessionID;
+}
+
 /**
  * One report as the trail holds it. A report recorded before the trail kept
  * whole texts has only its preview, so its text is that preview and
@@ -513,24 +534,38 @@ export class StateStore {
     return row?.ts === null || row?.ts === undefined ? null : Date.parse(row.ts);
   }
 
-  async recordSpawnDir(cwd: string): Promise<void> {
+  async recordSpawnDir(cwd: string, grant: SpawnTarget): Promise<void> {
     await this.db
       .insertInto('spawn_history')
-      .values({ cwd, last_spawn: Date.now() })
+      .values({
+        cwd,
+        target: grant.target,
+        target_identity: grant.targetIdentity,
+        last_spawn: Date.now(),
+      })
       .onConflict((oc) =>
-        oc.column('cwd').doUpdateSet((eb) => ({ last_spawn: eb.ref('excluded.last_spawn') })),
+        oc
+          .columns(['cwd', 'target', 'target_identity'])
+          .doUpdateSet((eb) => ({ last_spawn: eb.ref('excluded.last_spawn') })),
       )
       .execute();
   }
 
-  async collectSpawnDirs(): Promise<string[]> {
+  /**
+   * Each directory a spawn ran in, with the target it ran on, most recent
+   * first. A directory spawned on several targets has one entry for each.
+   */
+  async collectSpawnDirs(): Promise<SpawnDir[]> {
     const rows = await this.db
       .selectFrom('spawn_history')
-      .select('cwd')
+      .select(['cwd', 'target', 'target_identity'])
       .orderBy('last_spawn', 'desc')
       .execute();
 
-    return rows.map((row) => row.cwd);
+    return rows.map((row) => ({
+      cwd: row.cwd,
+      grant: { target: row.target, targetIdentity: row.target_identity },
+    }));
   }
 
   async loadLastUsedAgent(): Promise<AgentID> {
@@ -607,7 +642,7 @@ export class StateStore {
 
   // The other messages of the same session the given message's turn
   // answered, oldest first; none when the message has no turn.
-  async collectTurnSiblings(record: MessageRecord): Promise<MessageID[]> {
+  async collectTurnSiblings(record: MessageRecord): Promise<TurnSibling[]> {
     if (record.turn === undefined) {
       return [];
     }
@@ -619,7 +654,7 @@ export class StateStore {
 
     const rows = await this.db
       .selectFrom('messages')
-      .select('id')
+      .select(['id', 'atc_id'])
       .where('turn_id', '=', record.turn)
       .where('id', '!=', record.id)
       .where((eb) => buildOwnerFilter(eb, owner))
@@ -627,7 +662,7 @@ export class StateStore {
       .orderBy(sql`rowid`, 'asc')
       .execute();
 
-    return rows.map((row) => toMessageID(row.id));
+    return rows.map((row) => ({ id: toMessageID(row.id), atcID: toSessionID(row.atc_id) }));
   }
 
   async updateMessageDelivered(