@zgeoff/atc 2.15.2 → 2.17.0

package/src/daemon/daemon-connection.ts

@@ -19,6 +19,7 @@ import type { AgentID } from '../shared/agent-id';
 import { isRecord } from '../shared/report';
 import type { SessionID } from '../shared/session-id';
 import { toSessionID } from '../shared/to-session-id';
+import type { SourceProvider, SourceRequest } from '../sources/types';
 import { buildPayloadHash } from './build-payload-hash';
 import { buildScopedContext } from './build-scoped-context';
 import { buildTargetForbiddenError } from './build-target-forbidden-error';
@@ -43,6 +44,18 @@ interface ViewUpdate {
   readonly withdrawn: readonly SessionID[];
 }
 
+// What a source request holds: the source's id and the target it is for.
+interface SourceParams {
+  readonly source: string;
+  readonly target?: string | undefined;
+}
+
+// The source a request asks for, and the request the source serves.
+interface ResolvedSourceRequest {
+  readonly source: SourceProvider;
+  readonly request: SourceRequest;
+}
+
 interface PeerSocket extends SocketWriter {
   readonly end: () => void;
 }
@@ -409,6 +422,21 @@ export class DaemonConnection {
 
         return;
       }
+      case 'sources.list': {
+        await this.applySourcesList(req, ctx);
+
+        return;
+      }
+      case 'sources.interpret': {
+        await this.applySourcesInterpret(req, ctx);
+
+        return;
+      }
+      case 'git.probe': {
+        await this.applyGitProbe(req, ctx);
+
+        return;
+      }
       case 'session.spawn': {
         await this.applySpawn(req, ctx);
 
@@ -794,6 +822,107 @@ export class DaemonConnection {
     this.sendOk(req.id, spawned);
   }
 
+  // Lists one source's candidates for a spawn to the request's target.
+  private async applySourcesList(req: RequestMsg, ctx: DaemonContext): Promise<void> {
+    const parsed = parseRequestParams('sources.list', req.p);
+
+    if (!parsed.ok) {
+      this.sendErr(req.id, 'bad_args', parsed.message);
+
+      return;
+    }
+
+    const resolved = this.resolveSourceRequest(parsed.data, ctx);
+    const source = resolved.source;
+
+    const listed = await source.list(
+      {
+        ...(parsed.data.scope === undefined ? {} : { scope: parsed.data.scope }),
+        ...(parsed.data.text === undefined ? {} : { text: parsed.data.text }),
+      },
+      resolved.request,
+    );
+
+    this.sendOk(req.id, { source: source.id, scope: listed.scope, candidates: listed.candidates });
+  }
+
+  // Reads typed input through one source for a spawn to the request's
+  // target.
+  private async applySourcesInterpret(req: RequestMsg, ctx: DaemonContext): Promise<void> {
+    const parsed = parseRequestParams('sources.interpret', req.p);
+
+    if (!parsed.ok) {
+      this.sendErr(req.id, 'bad_args', parsed.message);
+
+      return;
+    }
+
+    const resolved = this.resolveSourceRequest(parsed.data, ctx);
+
+    const interpretation = await resolved.source.interpret(parsed.data.input, resolved.request);
+
+    this.sendOk(req.id, { ...interpretation });
+  }
+
+  // The source a request asks for and the request it serves, so a principal
+  // reaches a source only for a target it may spawn on, and a git source
+  // only for a target it may spawn a workspace on.
+  private resolveSourceRequest(params: SourceParams, ctx: DaemonContext): ResolvedSourceRequest {
+    const source = ctx.findSource(params.source);
+
+    if (source === null) {
+      throw new DaemonError('unsupported', `this daemon offers no source '${params.source}'`);
+    }
+
+    const target = ctx.resolveSpawnTarget(params.target);
+
+    if (source.kind === 'git') {
+      this.ctx.requireWorkspaceTarget(target);
+    }
+
+    // The spawn history is read through the request's own view, so a
+    // principal lists only directories spawned on targets it may use.
+    return { source, request: { target, collectSpawnDirs: () => ctx.collectSpawnDirs(null) } };
+  }
+
+  // Probes a git workspace source for a spawn to the request's target, so
+  // a principal probes only for a target it may spawn a workspace on. A
+  // refusal holds the repository's other URLs that the offered sources know.
+  private async applyGitProbe(req: RequestMsg, ctx: DaemonContext): Promise<void> {
+    const parsed = parseRequestParams('git.probe', req.p);
+
+    if (!parsed.ok) {
+      this.sendErr(req.id, 'bad_args', parsed.message);
+
+      return;
+    }
+
+    const data = parsed.data;
+
+    this.ctx.requireWorkspaceTarget(ctx.resolveSpawnTarget(data.target));
+
+    const access = await ctx.checkRepositoryAccess({
+      url: data.url,
+      ref: data.ref,
+      sha: data.sha,
+      credential: data.credentialRef,
+    });
+
+    if (!access.ok) {
+      const alternates = ctx.collectAlternateGitURLs(data.url);
+      const detail = alternates.length === 0 ? undefined : { alternates };
+
+      throw new DaemonError(access.code, access.message, detail);
+    }
+
+    this.sendOk(req.id, {
+      url: access.url,
+      head: access.head,
+      refs: access.refs,
+      resolved: access.resolved,
+    });
+  }
+
   private applyAttach(req: RequestMsg, ctx: DaemonContext): void {
     const parsed = parseRequestParams('session.attach', req.p);
 

package/src/daemon/daemon-context.ts

@@ -6,9 +6,11 @@ import type { TargetConfigError } from '../shared/collect-targets';
 import type { DaemonID } from '../shared/daemon-id';
 import type { MessageID } from '../shared/message-id';
 import type { SessionID } from '../shared/session-id';
+import type { SourceKind, SourceProvider } from '../sources/types';
 import type { FleetEntry } from '../store/fleet-entry';
 import type { MessageRecord } from '../store/message-record';
 import type { TurnSibling } from '../store/state-store';
+import type { checkRepositoryAccess } from '../workspace/check-repository-access';
 import type { Dims } from './attach-registry';
 import type { AgentEntry } from './build-agent-list';
 import type { FleetEvent } from './build-fleet-events';
@@ -79,6 +81,13 @@ interface AgentList {
   readonly spawnDefaults: { readonly agent: AgentID; readonly target: string | null };
   readonly configRevision: string;
   readonly targetErrors: readonly TargetConfigError[];
+
+  // The sources the spawn picker offers, in order.
+  readonly sources: readonly {
+    readonly id: string;
+    readonly label: string;
+    readonly kind: SourceKind;
+  }[];
 }
 
 // The slice of a connection the attach bookkeeping needs: identity plus the
@@ -163,6 +172,20 @@ export interface DaemonContext {
   // one whose provider cannot both transfer an archive and run a command.
   readonly requireWorkspaceTarget: (target: string) => void;
 
+  // The source the daemon offers the spawn picker under an id, or null when
+  // it offers none under it.
+  readonly findSource: (id: string) => SourceProvider | null;
+
+  // The other URLs the offered sources know for a git URL the daemon's host
+  // could not read, each once.
+  readonly collectAlternateGitURLs: (url: string) => readonly string[];
+
+  // Checks that the daemon's host can read a git workspace source, and
+  // resolves its ref, the way a workspace spawn from it would.
+  readonly checkRepositoryAccess: (
+    request: Omit<Parameters<typeof checkRepositoryAccess>[0], 'transports'>,
+  ) => ReturnType<typeof checkRepositoryAccess>;
+
   // Runs the plan, which throws the refusal for a spawn it refuses, then
   // spawns. Answers with the `session.spawn` ok payload, which a keyed
   // retry replays as the first spawn answered it while the access, when

package/src/daemon/daemon.ts

@@ -13,12 +13,15 @@ import type { SpawnWorkspaceSource } from '../protocol/request-param-schemas';
 import type { SessionState } from '../protocol/session-state';
 import type { HooksConfig } from '../shared/collect-hooks';
 import type { TargetConfigError } from '../shared/collect-targets';
+import type { InvalidGitTransports } from '../shared/collect-workspaces-config';
+import { DEFAULT_GIT_TRANSPORTS } from '../shared/default-git-transports';
 import { findDaemonRecord } from '../shared/find-daemon-record';
 import type { MessageID } from '../shared/message-id';
 import { isRecord } from '../shared/report';
 import type { SessionID } from '../shared/session-id';
 import { toMessageID } from '../shared/to-message-id';
 import { truncateToBytes } from '../shared/truncate-to-bytes';
+import type { SourceProvider } from '../sources/types';
 import type { IdempotencyRecord } from '../store/idempotency-record';
 import type { MessageOwner } from '../store/message-owner';
 import type { MessageRecord, MessageStatus } from '../store/message-record';
@@ -26,6 +29,7 @@ import { StateStore } from '../store/state-store';
 import type { EventScope } from '../store/state-store';
 import type { TrailEntry } from '../store/trail-entry';
 import type { SessionWorkspace } from '../store/workspace-materialization';
+import { checkRepositoryAccess } from '../workspace/check-repository-access';
 import { ANSWER_BYTE_CAP } from './answer-byte-cap';
 import { AttachRegistry } from './attach-registry';
 import { buildAgentList } from './build-agent-list';
@@ -58,6 +62,7 @@ import { EffectRemainsError } from './effect-remains-error';
 import { EventSignal } from './event-signal';
 import { startHookServer } from './hooks';
 import { IdempotencyLedger } from './idempotency-ledger';
+import { isOwnHookEvent } from './is-own-hook-event';
 import { isTreeInReach } from './is-tree-in-reach';
 import { loadTranscriptPage } from './load-transcript-page';
 import { makeHookRunner } from './make-hook-runner';
@@ -67,6 +72,7 @@ import { mintMessageID } from './mint-message-id';
 import { mintSessionID } from './mint-session-id';
 import { parseReport } from './parse-report';
 import { PermissionRegistry } from './permission-registry';
+import { requireGitTransports } from './require-git-transports';
 import { restoreFleet } from './restore-fleet';
 import { runEjectHandoff } from './run-eject-handoff';
 import { ScreenModel } from './screen-model';
@@ -152,6 +158,15 @@ export interface DaemonOptions {
   // Where background failures are reported, one line at a time; stderr
   // when unset.
   readonly log?: (line: string) => void;
+
+  // The sources the spawn picker offers, in order, each built with the
+  // services it uses; none when unset.
+  readonly sources?: readonly SourceProvider[];
+
+  // The transports a git workspace source may use and git may fetch over,
+  // or the invalid list the config holds, which refuses every git
+  // operation; https and ssh when unset.
+  readonly gitTransports?: readonly string[] | InvalidGitTransports;
 }
 
 export interface DaemonHandle {
@@ -235,6 +250,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
 
   const targetErrors = opts.targetErrors ?? [];
   const principals = opts.principals ?? null;
+  const gitTransports = opts.gitTransports ?? DEFAULT_GIT_TRANSPORTS;
 
   const targetsByID = new Map(targets.map((target) => [target.id, target]));
 
@@ -765,6 +781,22 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
     }
 
     const before = mgr.sessions.find((s) => s.id === e.atcId);
+    const runtime = runtimes.get(e.atcId);
+
+    // A harness nested inside a session inherits its environment and reports
+    // under its id; only the harness atc started may change the session.
+    if (
+      before !== undefined &&
+      runtime !== undefined &&
+      !isOwnHookEvent(e.agent, before.agent, runtime.hasAgentHookLines)
+    ) {
+      return;
+    }
+
+    if (runtime !== undefined && e.agent !== undefined) {
+      runtime.hasAgentHookLines = true;
+    }
+
     const previousAgentSessionID = before?.agentSessionID;
     const ev = mgr.applyHook(e);
 
@@ -777,7 +809,6 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
     }
 
     const kind = ev?.kind ?? null;
-    const runtime = runtimes.get(e.atcId);
     const currentAgentSessionID = mgr.sessions.find((s) => s.id === e.atcId)?.agentSessionID;
 
     if (currentAgentSessionID !== undefined && currentAgentSessionID !== previousAgentSessionID) {
@@ -895,6 +926,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
           mgr.log(line);
         },
         stagingRoot: tmpdir(),
+        gitTransports,
       },
     );
   };
@@ -1176,6 +1208,8 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
     }
   };
 
+  const sources = opts.sources ?? [];
+
   const ctx: DaemonContext = {
     build: opts.build,
     daemonID: store.daemonID,
@@ -1199,6 +1233,11 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
       spawnDefaults: { agent: 'claude', target: defaultTarget },
       configRevision,
       targetErrors,
+      sources: sources.map((source) => ({
+        id: source.id,
+        label: source.label,
+        kind: source.kind,
+      })),
     }),
     collectFleet: () => store.loadFleet(),
     loadLastUsedAgent: () => store.loadLastUsedAgent(),
@@ -1240,6 +1279,12 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
       mgr.requireExecution({ target, targetIdentity: null }, 'transfer');
       mgr.requireExecution({ target, targetIdentity: null }, 'run');
     },
+    findSource: (id) => sources.find((source) => source.id === id) ?? null,
+    collectAlternateGitURLs: (url) => [
+      ...new Set(sources.flatMap((source) => source.findAlternateURLs?.(url) ?? [])),
+    ],
+    checkRepositoryAccess: (request) =>
+      checkRepositoryAccess({ ...request, transports: requireGitTransports(gitTransports) }),
     spawnSession: (plan, keyed, access) => {
       // Under an access, a spawn under a parent whose tree leaves the access
       // before the harness starts is refused as a spawn under an unknown

package/src/daemon/imp-client-port.ts

@@ -1,14 +1,17 @@
 import { createImpClient, openExecSession, openReverseForward } from '@zgeoff/imp-client';
 import type { ExecOutcome, ImpClient } from '@zgeoff/imp-client';
+import { isRecord } from '../shared/report';
 import type {
   ImpCommand,
   ImpCommandResult,
   ImpCreateSpec,
   ImpFeatures,
+  ImpIdentity,
   ImpLease,
   ImpPort,
   ImpRelayConnection,
   ImpReverseForward,
+  ImpSecret,
   ImpSessionConnection,
   ImpSessionHandlers,
   ImpSessionOutcome,
@@ -48,11 +51,79 @@ export class ImpClientPort implements ImpPort {
     this.readToken = options.readToken;
   }
 
-  // An impd from before the flags has neither.
+  // A flag counts only as a literal true: an impd from before a flag has
+  // it false, and so does one that sends anything else in its place.
   readonly readFeatures = async (): Promise<ImpFeatures> => {
     const info = await this.tryCall((client) => client.system.info());
 
-    return info.features ?? { sessionOffsets: false, leases: false };
+    const features: Readonly<Record<string, unknown>> | undefined = info.features;
+
+    return {
+      sessionOffsets: features?.['sessionOffsets'] === true,
+      leases: features?.['leases'] === true,
+      grantableTokens: features?.['grantableTokens'] === true,
+      secretRebind: features?.['secretRebind'] === true,
+    };
+  };
+
+  // An impd from before grantable lists sends none, which grants nothing.
+  readonly readIdentity = async (): Promise<ImpIdentity> => {
+    const identity = await this.tryCall((client) => client.tokens.whoami());
+
+    return {
+      kind: identity.kind,
+      name: identity.name,
+      scope: identity.scope,
+      imps: identity.imps === null ? null : [...identity.imps],
+      grantable: [...(identity.grantable ?? [])],
+    };
+  };
+
+  readonly readSecrets = async (): Promise<readonly ImpSecret[]> => {
+    const secrets = await this.tryCall((client) => client.secrets.list());
+
+    return secrets.map((secret) => ({
+      name: secret.name,
+      kind: secret.kind,
+      rules: secret.rules.map((rule) => ({
+        host: rule.host,
+        header: rule.header,
+        scheme: rule.scheme,
+        ...(rule.user === undefined ? {} : { user: rule.user }),
+      })),
+      imps: [...secret.imps],
+    }));
+  };
+
+  readonly readGrants = async (name: string): Promise<readonly string[]> => {
+    const grants = await this.tryCall((client) => client.grants.list({ name }));
+
+    return [...grants];
+  };
+
+  readonly createGrant = async (name: string, secret: string): Promise<void> => {
+    await this.tryCall((client) => client.grants.add({ name, secret }));
+  };
+
+  // A grant impd no longer holds is no grant to revoke; a missing imp or
+  // secret still rejects.
+  readonly removeGrant = async (name: string, secret: string): Promise<boolean> => {
+    try {
+      await this.tryCall((client) => client.grants.delete({ name, secret }));
+
+      return true;
+    } catch (error) {
+      if (
+        error instanceof ImpPortError &&
+        error.code === 'NOT_FOUND' &&
+        isRecord(error.data) &&
+        error.data['kind'] === 'grant'
+      ) {
+        return false;
+      }
+
+      throw error;
+    }
   };
 
   readonly readImp = async (name: string): Promise<ImpView | null> => {
@@ -60,6 +131,7 @@ export class ImpClientPort implements ImpPort {
       const imp = await this.tryCall((client) => client.imps.get({ name }));
 
       return {
+        id: imp.id,
         name: imp.name,
         state: imp.state,
         leases: (imp.leases?.leases ?? []).map((lease) => toLease(lease)),
@@ -83,7 +155,7 @@ export class ImpClientPort implements ImpPort {
       }),
     );
 
-    return { name: imp.name, state: imp.state, leases: [], otherLeaseCount: 0 };
+    return { id: imp.id, name: imp.name, state: imp.state, leases: [], otherLeaseCount: 0 };
   };
 
   readonly acquireLease = async (

package/src/daemon/imp-port.ts

@@ -9,6 +9,23 @@ export interface ImpPort {
   // impd's capability flags; an impd without them has neither.
   readonly readFeatures: () => Promise<ImpFeatures>;
 
+  // The caller's own identity: its scope, the imps it may reach, and the
+  // secrets it may grant.
+  readonly readIdentity: () => Promise<ImpIdentity>;
+
+  // Every secret impd holds, with its rules and never its value.
+  readonly readSecrets: () => Promise<readonly ImpSecret[]>;
+
+  // The names of the secrets granted to an imp.
+  readonly readGrants: (name: string) => Promise<readonly string[]>;
+
+  // Grants a secret to an imp; granting one it already holds changes
+  // nothing, and nothing in the result distinguishes the two.
+  readonly createGrant: (name: string, secret: string) => Promise<void>;
+
+  // Revokes a secret from an imp, and reports whether impd held the grant.
+  readonly removeGrant: (name: string, secret: string) => Promise<boolean>;
+
   // The imp under a name, or null when impd holds none.
   readonly readImp: (name: string) => Promise<ImpView | null>;
   readonly createImp: (spec: ImpCreateSpec) => Promise<ImpView>;
@@ -51,11 +68,54 @@ export interface ImpPort {
 export interface ImpFeatures {
   readonly sessionOffsets: boolean;
   readonly leases: boolean;
+
+  // Tokens limited to some imps may grant a list of secrets to them.
+  readonly grantableTokens: boolean;
+
+  // A rebound or recreated secret drops its grants and leaves a token's
+  // list of grantable secrets behind.
+  readonly secretRebind: boolean;
+}
+
+type ImpScope = 'read' | 'exec' | 'manage';
+
+export interface ImpIdentity {
+  readonly kind: 'token' | 'ssh' | 'tailnet' | 'dashboard';
+  readonly name: string;
+  readonly scope: ImpScope;
+
+  // Imp name patterns with `*` for any run of characters; null reaches
+  // every imp on the host.
+  readonly imps: readonly string[] | null;
+
+  // The secrets the caller may grant to the imps it reaches and revoke
+  // from them.
+  readonly grantable: readonly string[];
+}
+
+export interface ImpSecret {
+  readonly name: string;
+  readonly kind: 'anthropic' | 'custom' | 'github' | 'npm';
+  readonly rules: readonly ImpSecretRule[];
+
+  // The imps holding a grant of the secret.
+  readonly imps: readonly string[];
+}
+
+// How impd adds a secret to requests for one host.
+export interface ImpSecretRule {
+  readonly host: string;
+  readonly header: string;
+  readonly scheme: 'basic' | 'bearer' | 'raw';
+  readonly user?: string;
 }
 
 export type ImpState = 'creating' | 'running' | 'sleeping' | 'stopped' | 'error';
 
 export interface ImpView {
+  // impd's id for this imp, which a new imp made under the same name never
+  // shares.
+  readonly id: string;
   readonly name: string;
   readonly state: ImpState;
 

package/src/daemon/is-imp-name-allowed.ts

@@ -0,0 +1,38 @@
+/**
+ * Whether an imp name matches one of a token's imp patterns, as impd
+ * matches them: each pattern is an imp name with `*` for any run of
+ * characters, including none, so `dev-*` matches `dev-` and `dev-a1`, and
+ * a pattern without `*` matches only its own name.
+ */
+export function isImpNameAllowed(patterns: readonly string[], name: string): boolean {
+  return patterns.some((pattern) => isPatternMatch(pattern, name));
+}
+
+function isPatternMatch(pattern: string, name: string): boolean {
+  const [first = '', ...rest] = pattern.split('*');
+  const last = rest.pop();
+
+  if (last === undefined) {
+    return name === first;
+  }
+
+  if (name.length < first.length + last.length || !name.startsWith(first) || !name.endsWith(last)) {
+    return false;
+  }
+
+  // Each middle part in order, between the prefix and the suffix.
+  let at = first.length;
+  const end = name.length - last.length;
+
+  for (const part of rest) {
+    const found = name.indexOf(part, at);
+
+    if (found === -1 || found + part.length > end) {
+      return false;
+    }
+
+    at = found + part.length;
+  }
+
+  return true;
+}

package/src/daemon/is-own-hook-event.ts

@@ -0,0 +1,19 @@
+import type { AgentID } from '../shared/agent-id';
+
+/**
+ * Whether a hook line, judged by the agent it carries, comes from the
+ * harness atc started for its session rather than from a harness nested
+ * inside it, which inherits the session's environment and so reports under
+ * the same session. A line carrying an agent is the session's own when that
+ * agent is the session's. A line without one comes from a hook command that
+ * carries no agent flag, and stays the session's own until a line carrying
+ * the session's agent arrives from the same terminal: from then on the
+ * session's own hooks are known to carry it.
+ */
+export function isOwnHookEvent(
+  lineAgent: AgentID | undefined,
+  sessionAgent: AgentID,
+  hasAgentHookLines: boolean,
+): boolean {
+  return lineAgent === undefined ? !hasAgentHookLines : lineAgent === sessionAgent;
+}