@zgeoff/atc 2.15.2 → 2.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.15.2",
+  "version": "2.17.0",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",
@@ -43,7 +43,7 @@
     "@better-auth/oauth-provider": "1.7.6",
     "@xterm/addon-serialize": "0.14.0",
     "@xterm/headless": "6.0.0",
-    "@zgeoff/imp-client": "0.24.0",
+    "@zgeoff/imp-client": "0.27.0",
     "better-auth": "1.7.6",
     "bun-pty": "0.4.10",
     "citty": "0.2.2",

package/src/agents/build-hook-settings.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { AgentID } from '../shared/agent-id';
+import { toShellArg } from '../shared/to-shell-arg';
 import { buildCLICommand } from './build-cli-command';
 
 /**
@@ -20,7 +21,9 @@ export interface HookSettingsProfile {
  * The settings object injected into wrangled sessions via
  * `claude --settings`. The user's own settings are untouched; these hooks
  * only exist in sessions atc spawns, and identify themselves via
- * ATC_SESSION_ID in the env.
+ * ATC_SESSION_ID in the env and the agent id on their command line. A
+ * nested harness inherits the env but not the command line, so the agent id
+ * keeps its reports from passing as the session's own.
  *
  * A settings-file env block outranks a shell export of the same variable, so
  * a session's backend is decided here rather than by whatever the terminal
@@ -37,7 +40,13 @@ export function buildHookSettings(
 ): Record<string, unknown> {
   const entry = [
     {
-      hooks: [{ type: 'command', command: buildCLICommand('hook-report', cliArgv), timeout: 5 }],
+      hooks: [
+        {
+          type: 'command',
+          command: buildCLICommand(`hook-report --agent ${toShellArg(profile.id)}`, cliArgv),
+          timeout: 5,
+        },
+      ],
     },
   ];
 
@@ -61,7 +70,7 @@ export function buildHookSettings(
     // padding.
     statusLine: {
       type: 'command',
-      command: buildCLICommand('statusline', cliArgv),
+      command: buildCLICommand(`statusline --agent ${toShellArg(profile.id)}`, cliArgv),
       padding: statuslinePadding,
     },
     ...(profile.env === undefined || Object.keys(profile.env).length === 0

package/src/agents/print-codex-hook-file.ts

@@ -17,7 +17,7 @@ export function printCodexHookFile(): void {
 }
 
 function buildCodexHookFile(): string {
-  const cmd = buildCLICommand('hook-report');
+  const cmd = buildCLICommand('hook-report --agent codex');
   const buildEntry = (timeout: number) => [{ hooks: [{ type: 'command', command: cmd, timeout }] }];
   const hooks = Object.fromEntries(CODEX_HOOK_EVENTS.map((event) => [event, buildEntry(5)]));
 

package/src/agents/print-grok-hook-file.ts

@@ -19,7 +19,7 @@ export function printGrokHookFile(): void {
 }
 
 function buildGrokHookFile(): string {
-  const cmd = buildCLICommand('hook-report');
+  const cmd = buildCLICommand('hook-report --agent grok');
   const entry = [{ hooks: [{ type: 'command', command: cmd, timeout: 5 }] }];
   const hooks = Object.fromEntries(GROK_HOOK_EVENTS.map((event) => [event, entry]));
 

package/src/cli.ts

@@ -161,6 +161,10 @@ const main = defineCommand({
           const gateway = await import('./agents/gateway-adapter');
           const headless = await import('./agents/start-claude-headless-run');
           const targets = await import('./daemon/build-execution-targets');
+          const sourceOrder = await import('./sources/build-sources');
+          const builtinSources = await import('./sources/collect-builtin-sources');
+          const zoxide = await import('./shared/collect-zoxide-dirs');
+          const home = await import('./shared/resolve-home-dir');
 
           // Test harnesses shrink the outbound queue to force overflow
           // deterministically; unset means the production default.
@@ -178,10 +182,27 @@ const main = defineCommand({
             console.error(`atc daemon: config: ${line}`);
           }
 
-          for (const problem of cfg.principalErrors) {
+          for (const problem of [...cfg.principalErrors, ...cfg.workspaceErrors]) {
             console.error(`atc daemon: config: ${problem}`);
           }
 
+          const sources = sourceOrder.buildSources(
+            builtinSources.collectBuiltinSources({
+              roots: cfg.dirs.roots,
+              githubOwner: cfg.workspaces.githubOwner,
+              ghBin: 'gh',
+              homeDir: home.resolveHomeDir(),
+              collectZoxideDirs: zoxide.collectZoxideDirs,
+            }),
+            cfg.workspaces.sources,
+          );
+
+          for (const id of sources.missing) {
+            console.error(
+              `atc daemon: config: workspaces.sources holds '${id}', which this daemon cannot offer; the picker leaves it out`,
+            );
+          }
+
           // Cap on how long a fleet restore waits for one revived session to
           // report it has booted before moving to the next. Tests pin it to
           // keep timing deterministic; unset means the production default.
@@ -220,6 +241,8 @@ const main = defineCommand({
               defaultTarget: cfg.defaultTarget,
               targetErrors,
               principals: cfg.principals,
+              sources: sources.sources,
+              gitTransports: cfg.workspaces.gitTransports,
               restoreBootTimeoutMs,
               ...(Number.isFinite(graceOverride) && graceOverride >= 0
                 ? { tapGraceMs: graceOverride }
@@ -291,10 +314,16 @@ const main = defineCommand({
           description: 'Forward a hook event from a wrangled session to the atc socket',
           hidden: true,
         },
-        async run() {
+
+        // No arg is required: a citty usage error exits nonzero, and
+        // reporters must always exit 0.
+        args: {
+          agent: { type: 'string', default: '' },
+        },
+        async run(ctx) {
           const reporter = await import('./hook-report');
 
-          await reporter.runHookReport();
+          await reporter.runHookReport(ctx.args.agent);
         },
       }),
     tap: () =>
@@ -352,10 +381,15 @@ const main = defineCommand({
           description: 'Render the chained statusline for a wrangled session',
           hidden: true,
         },
-        async run() {
+
+        // A statusline command must always exit 0 too, so no arg is required.
+        args: {
+          agent: { type: 'string', default: '' },
+        },
+        async run(ctx) {
           const statusline = await import('./statusline');
 
-          await statusline.runStatusline();
+          await statusline.runStatusline(ctx.args.agent);
         },
       }),
   },

package/src/client/collect-target-picks.ts

@@ -0,0 +1,53 @@
+import { isRecord } from '../shared/report';
+
+export interface TargetPick {
+  readonly id: string;
+  readonly provider: string;
+  readonly available: boolean;
+  readonly isDefault: boolean;
+
+  // Whether a workspace can be materialized there: the daemon has the
+  // provider, and it can both transfer an archive and run a command.
+  readonly takesWorkspace: boolean;
+
+  // Whether a session there runs on the daemon's own machine, where a
+  // local directory runs in place.
+  readonly inPlace: boolean;
+}
+
+/**
+ * The execution targets an `agents.list` answer holds, in config order. An
+ * answer from a daemon without targets, or a malformed entry, yields none.
+ */
+export function collectTargetPicks(answer: Readonly<Record<string, unknown>>): TargetPick[] {
+  const targets = answer['targets'];
+
+  if (!Array.isArray(targets)) {
+    return [];
+  }
+
+  return targets.flatMap((entry: unknown): TargetPick[] => {
+    if (
+      !isRecord(entry) ||
+      typeof entry['id'] !== 'string' ||
+      typeof entry['provider'] !== 'string'
+    ) {
+      return [];
+    }
+
+    const capabilities = isRecord(entry['capabilities']) ? entry['capabilities'] : {};
+    const available = entry['available'] === true;
+
+    return [
+      {
+        id: entry['id'],
+        provider: entry['provider'],
+        available,
+        isDefault: entry['default'] === true,
+        takesWorkspace:
+          available && capabilities['transfer'] === true && capabilities['run'] === true,
+        inPlace: entry['provider'] === 'local-pty',
+      },
+    ];
+  });
+}

package/src/client/dirs.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename } from 'node:path';
-import { collectRootDirs } from './collect-root-dirs';
+import { collectRootDirs } from '../shared/collect-root-dirs';
 
 /**
  * Every source the picker lists, merged in the order the reader expects

package/src/client/spawn-picker.ts

@@ -1,17 +1,19 @@
 import { homedir } from 'node:os';
 import { DaemonError } from '../protocol/daemon-error';
 import type { AgentID } from '../shared/agent-id';
+import { collectZoxideDirs } from '../shared/collect-zoxide-dirs';
 import { loadConfig } from '../shared/config';
 import { collectAgentPicks } from './collect-agent-picks';
 import type { AgentPick } from './collect-agent-picks';
 import { collectPathCompletions } from './collect-path-completions';
-import { collectZoxideDirs } from './collect-zoxide-dirs';
+import { collectTargetPicks } from './collect-target-picks';
+import type { TargetPick } from './collect-target-picks';
 import { collectDirs, formatDir, formatDirName, pickMatches } from './dirs';
 import { planTextEdit } from './keys';
 import { resolvePathInput } from './resolve-path-input';
 import { ansi, cols, drawPicker } from './ui';
 
-type PickerStep = 'agent' | 'dir' | 'name' | 'prompt';
+type PickerStep = 'agent' | 'dir' | 'target' | 'name' | 'prompt';
 
 // What the flow borrows from the client that owns the screen, the daemon
 // connection and the fleet mirror.
@@ -31,8 +33,9 @@ export interface SpawnPickerDeps<TMirror> {
 }
 
 /**
- * The modal flow behind n and r: agent, then directory, then name, then an
- * optional first prompt. Every path out of it either attaches the new
+ * The modal flow behind n and r: agent, then directory, then execution
+ * target when the daemon has more than one, then name, then an optional
+ * first prompt. Every path out of it either attaches the new
  * session or returns the client to the screen it came from. A spawn the
  * daemon refuses is no path out: the flow stays open and shows why.
  */
@@ -56,6 +59,12 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
   private dir = '';
 
+  // The daemon's execution targets, read when the directory step opens,
+  // and the one chosen; null spawns on the daemon's default target.
+  private targets: TargetPick[] = [];
+
+  private target: TargetPick | null = null;
+
   private name = '';
 
   private resume = false;
@@ -72,6 +81,7 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
   open(resume = false) {
     this.resume = resume;
+    this.target = null;
 
     const config = loadConfig();
 
@@ -99,7 +109,7 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
     const edit = planTextEdit(buf, this.input, {
       isLeaderKey: this.deps.isLeaderKey,
-      moves: this.step === 'agent' || this.step === 'dir',
+      moves: this.step === 'agent' || this.step === 'dir' || this.step === 'target',
     });
 
     switch (edit.kind) {
@@ -131,6 +141,11 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
         return;
       }
       case 'input': {
+        // The target step takes no text: its list is short and fixed.
+        if (this.step === 'target') {
+          return;
+        }
+
         this.input = edit.value;
 
         this.render();
@@ -170,6 +185,21 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
         input: this.input,
         hint: 'type to filter, or a path (/ ~ .) · ↑↓ move · ⏎ select · esc cancel',
       });
+    } else if (this.step === 'target') {
+      this.selected = Math.min(this.selected, this.targets.length - 1);
+
+      drawPicker({
+        title: `${verb}: target`,
+        items: this.targets.map((t) => formatTargetPick(t)),
+        selected: this.selected,
+        input: '',
+        hint: this.refusal ?? `where ${formatDir(this.dir)} runs · ↑↓ move · ⏎ select · esc back`,
+        dimmed: new Set(
+          this.targets.flatMap((t, i) =>
+            t.takesWorkspace || (t.available && t.inPlace) ? [] : [i],
+          ),
+        ),
+      });
     } else if (this.step === 'name') {
       drawPicker({
         title: `${verb}: name`,
@@ -209,8 +239,10 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
       );
 
       this.step = 'agent';
-    } else if (this.step === 'name') {
+    } else if (this.step === 'target') {
       this.step = 'dir';
+    } else if (this.step === 'name') {
+      this.openTargetOrDir('dir');
     } else {
       this.step = 'name';
     }
@@ -246,6 +278,27 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
       this.dir = chosen;
       this.input = '';
+
+      this.openTargetOrDir('name');
+    } else if (this.step === 'target') {
+      const pick = this.targets[this.selected];
+
+      if (pick === undefined) {
+        return;
+      }
+
+      const refusal = findTargetRefusal(pick);
+
+      if (refusal !== null) {
+        this.refusal = refusal;
+
+        this.render();
+
+        return;
+      }
+
+      this.target = pick;
+      this.input = '';
       this.step = 'name';
     } else if (this.step === 'name') {
       this.name = this.input.trim();
@@ -280,9 +333,44 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
       : collectPathCompletions(this.input, process.cwd(), homedir());
   }
 
+  // Opens the target step when the daemon has more than one target, with
+  // the chosen or default target selected, and the fallback step otherwise.
+  private openTargetOrDir(fallback: 'dir' | 'name') {
+    if (this.targets.length < 2) {
+      // The one target is the spawn's, default or not, so the spawn names it
+      // and its provider decides whether a directory runs in place.
+      this.target = this.targets[0] ?? null;
+      this.step = fallback;
+
+      return;
+    }
+
+    const preferred = this.target?.id;
+
+    this.selected = Math.max(
+      0,
+      this.targets.findIndex((t) => (preferred === undefined ? t.isDefault : t.id === preferred)),
+    );
+
+    this.step = 'target';
+  }
+
   private async openDirStep() {
     let recent: string[] = [];
 
+    try {
+      const listed = await this.deps.sendRequest('agents.list');
+
+      const picks = collectTargetPicks(listed);
+
+      // An adopt resumes a session from its history on this host, which a
+      // fresh checkout elsewhere does not hold, so it is offered only the
+      // targets that run here.
+      this.targets = this.resume ? picks.filter((t) => t.available && t.inPlace) : picks;
+    } catch {
+      this.targets = [];
+    }
+
     try {
       const answer = await this.deps.sendRequest('dirs.list');
 
@@ -318,6 +406,7 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
         rows: this.deps.ptyRows(),
         ...(this.resume ? { resume: true } : {}),
         agent: this.agent,
+        ...this.buildTargetParams(),
       });
 
       const spawned = this.deps.toMirrorSession(ok['session']);
@@ -347,4 +436,41 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
     this.deps.toBase();
   }
+
+  // A chosen target goes with the spawn. A local directory runs in place on
+  // a target on the daemon's own machine, and is materialized at the same
+  // path from its pushed HEAD on any other.
+  private buildTargetParams(): Readonly<Record<string, unknown>> {
+    if (this.target === null) {
+      return {};
+    }
+
+    return this.target.inPlace
+      ? { target: this.target.id }
+      : { target: this.target.id, workspace: { kind: 'path', path: this.dir } };
+  }
+}
+
+function formatTargetPick(pick: TargetPick): string {
+  const notes = [
+    pick.provider,
+    ...(pick.isDefault ? ['default'] : []),
+    ...(pick.available ? [] : ['unavailable']),
+    ...(pick.available && !pick.takesWorkspace ? ['no workspace'] : []),
+  ];
+
+  return `${pick.id}  ${notes.join(' · ')}`;
+}
+
+// Why a local directory cannot run on a target, or null when it can.
+function findTargetRefusal(pick: TargetPick): string | null {
+  if (!pick.available) {
+    return `target '${pick.id}' is unavailable on this daemon · esc back`;
+  }
+
+  if (!pick.inPlace && !pick.takesWorkspace) {
+    return `target '${pick.id}' cannot take a workspace · esc back`;
+  }
+
+  return null;
 }

package/src/client/ui.ts

@@ -387,6 +387,9 @@ export interface PickerView {
   input: string;
   placeholder?: string;
   hint: string;
+
+  // The indexes of items drawn dim: listed, but not a fit for the flow.
+  dimmed?: ReadonlySet<number>;
 }
 
 export function drawPicker(view: PickerView) {
@@ -397,7 +400,9 @@ export function drawPicker(view: PickerView) {
   for (const [i, item] of shown.entries()) {
     const sel = i === view.selected;
     const t = truncate(item, width - 4);
-    const styled = sel ? `${ESC}[7m${t.padEnd(width - 4)}${ESC}[0m` : t;
+    const dim = view.dimmed?.has(i) === true;
+    const inverse = sel ? `${ESC}[7m${t.padEnd(width - 4)}${ESC}[0m` : t;
+    const styled = dim ? `${ESC}[90m${inverse}${ESC}[0m` : inverse;
     const plainLen = sel ? width - 4 : t.length;
 
     rowsList.push(boxRow(width, styled, plainLen));

package/src/daemon/broker-authority-error.ts

@@ -0,0 +1,41 @@
+/**
+ * Why impd's credential broker may not be used for a session, or why atc
+ * may not clean up after one:
+ *
+ * - `auth_impd_too_old`: impd lacks grantable tokens or secret rebinds.
+ * - `auth_token_scope`: the token's scope is below `manage`.
+ * - `auth_token_too_broad`: the token can reach imps outside atc's
+ *   namespace, through no imp patterns or a pattern whose literal text
+ *   before its first `*` does not start with the namespace prefix.
+ * - `auth_imp_out_of_scope`: an imp the call touches is outside the
+ *   token's patterns.
+ * - `auth_secret_not_grantable`: a bound secret is not on the token's
+ *   grantable list.
+ * - `auth_runtime_mismatch`: the imp under the recorded name has another
+ *   id than the one recorded.
+ */
+export type BrokerAuthorityCode =
+  | 'auth_impd_too_old'
+  | 'auth_token_scope'
+  | 'auth_token_too_broad'
+  | 'auth_imp_out_of_scope'
+  | 'auth_secret_not_grantable'
+  | 'auth_runtime_mismatch';
+
+/**
+ * A refusal to provision through impd's credential broker or to clean up
+ * after it, carrying its code and the detail the code defines.
+ */
+export class BrokerAuthorityError extends Error {
+  readonly code: BrokerAuthorityCode;
+
+  readonly data: Readonly<Record<string, unknown>>;
+
+  constructor(code: BrokerAuthorityCode, message: string, data: Readonly<Record<string, unknown>>) {
+    super(message);
+
+    this.code = code;
+    this.data = data;
+    this.name = 'BrokerAuthorityError';
+  }
+}

package/src/daemon/collect-secret-rule-mismatches.ts

@@ -0,0 +1,83 @@
+import type { ImpSecret, ImpSecretRule } from './imp-port';
+
+/**
+ * One secret as a resolved binding expects impd to hold it: its kind and
+ * the complete set of rules, one per host.
+ */
+export interface ExpectedSecret {
+  readonly secret: string;
+  readonly kind: ImpSecret['kind'];
+  readonly rules: readonly ImpSecretRule[];
+}
+
+export type SecretRuleMismatch =
+  | { readonly secret: string; readonly reason: 'missing' }
+  | {
+      readonly secret: string;
+      readonly reason: 'kind';
+      readonly expected: ImpSecret['kind'];
+      readonly actual: ImpSecret['kind'];
+    }
+  | {
+      readonly secret: string;
+      readonly reason: 'rules';
+      readonly expected: readonly ImpSecretRule[];
+      readonly actual: readonly ImpSecretRule[];
+    };
+
+/**
+ * Compares the secrets a resolved binding expects with the secrets impd
+ * lists, secret by secret. Each expected secret must exist with the same
+ * kind and exactly the same set of rules, in any order: a rule impd holds
+ * that the binding lacks is a mismatch as much as a missing one, since it
+ * sends the credential to a host the binding never approved. An empty
+ * result means every expected secret matches; secrets the binding does not
+ * expect are ignored.
+ */
+export function collectSecretRuleMismatches(
+  expected: readonly ExpectedSecret[],
+  secrets: readonly ImpSecret[],
+): SecretRuleMismatch[] {
+  const held = new Map(secrets.map((secret) => [secret.name, secret]));
+
+  const mismatches: SecretRuleMismatch[] = [];
+
+  for (const want of expected) {
+    const actual = held.get(want.secret);
+
+    if (actual === undefined) {
+      mismatches.push({ secret: want.secret, reason: 'missing' });
+    } else if (actual.kind !== want.kind) {
+      mismatches.push({
+        secret: want.secret,
+        reason: 'kind',
+        expected: want.kind,
+        actual: actual.kind,
+      });
+    } else if (!hasSameRules(want.rules, actual.rules)) {
+      mismatches.push({
+        secret: want.secret,
+        reason: 'rules',
+        expected: want.rules,
+        actual: actual.rules,
+      });
+    }
+  }
+
+  return mismatches;
+}
+
+function hasSameRules(left: readonly ImpSecretRule[], right: readonly ImpSecretRule[]): boolean {
+  const leftKeys = left.map((rule) => toRuleKey(rule)).toSorted();
+  const rightKeys = right.map((rule) => toRuleKey(rule)).toSorted();
+
+  return (
+    leftKeys.length === rightKeys.length && leftKeys.every((key, index) => key === rightKeys[index])
+  );
+}
+
+// A rule as one comparable string; JSON keeps a missing user apart from
+// any user a basic rule can hold.
+function toRuleKey(rule: ImpSecretRule): string {
+  return JSON.stringify([rule.host, rule.header, rule.scheme, rule.user ?? null]);
+}