@zgeoff/atc 2.15.2 → 2.17.0

package/src/daemon/materialize-workspace.ts

@@ -3,18 +3,22 @@ import { dirname, join, resolve } from 'node:path';
 import { DaemonError } from '../protocol/daemon-error';
 import type { ErrorCode } from '../protocol/protocol';
 import type { SpawnWorkspaceSource } from '../protocol/request-param-schemas';
+import type { InvalidGitTransports } from '../shared/collect-workspaces-config';
 import type { SessionID } from '../shared/session-id';
 import type { StateStore } from '../store/state-store';
 import type { MaterializationPhase, SessionWorkspace } from '../store/workspace-materialization';
 import { checkURLCredentials } from '../workspace/check-url-credentials';
 import { createWorkspaceClone } from '../workspace/create-workspace-clone';
+import { expandGitShorthand } from '../workspace/expand-git-shorthand';
 import { normalizeGitURL } from '../workspace/normalize-git-url';
 import { readWorkspaceTar } from '../workspace/read-workspace-tar';
 import { REPOSITORY_ENV_VARS } from '../workspace/repository-env-vars';
+import { resolveGitURL } from '../workspace/resolve-git-url';
 import { resolvePathSource } from '../workspace/resolve-path-source';
 import { runGit } from '../workspace/run-git';
 import { sanitizeWorkspaceClone } from '../workspace/sanitize-workspace-clone';
 import type { ExecutionProvider } from './execution-provider';
+import { requireGitTransports } from './require-git-transports';
 
 interface MaterializeRequest {
   readonly sessionID: SessionID;
@@ -39,6 +43,10 @@ interface MaterializeDeps {
   // The directory on the daemon's host that holds each clone's staging
   // directory while the workspace is built.
   readonly stagingRoot: string;
+
+  // The transports a source may use and git may fetch over, or the invalid
+  // list the config holds, which refuses every source that needs git.
+  readonly gitTransports: readonly string[] | InvalidGitTransports;
 }
 
 type MaterializedWorkspace = { readonly kind: 'in_place' } | ReadyWorkspace;
@@ -203,7 +211,9 @@ async function runMaterialization(
   updateProgress: ProgressTracker,
   secret: string | null,
 ): Promise<Omit<ReadyWorkspace, 'withheldEnv'>> {
-  const pinned = await resolveSource(request.source, staging);
+  const transports = requireGitTransports(deps.gitTransports, { phase: 'resolving' });
+
+  const pinned = await resolveSource(request.source, staging, transports);
 
   // What is recorded and returned is scrubbed of the credential, even
   // where a caller's own ref happens to spell it.
@@ -213,7 +223,7 @@ async function runMaterialization(
   await claimTargetDir(request, deps, updateProgress);
   await recordPhase(request, deps, updateProgress, 'cloning', { repoURL, ref });
 
-  const clone = await createCleanClone(pinned, join(staging, 'clone'));
+  const clone = await createCleanClone(pinned, join(staging, 'clone'), transports);
 
   // The archive is in memory, so the clone leaves the daemon's host before
   // the target is touched.
@@ -251,8 +261,10 @@ interface PinnedSource {
   readonly cloneURL: string;
   readonly repoURL: string;
 
-  // The ref or commit the clone checks out, and the branch or tag recorded.
+  // The ref or commit the clone checks out, the commit it is pinned to when
+  // the ref only names its branch, and the branch or tag recorded.
   readonly checkout: string;
+  readonly sha?: string | undefined;
   readonly ref: string | null;
   readonly credential: { readonly kind: 'env'; readonly name: string } | undefined;
   readonly warnings: readonly string[];
@@ -263,7 +275,11 @@ interface PinnedSource {
  * not a pushed, complete, credential-free repository. A path source pins
  * its pushed HEAD; a git source keeps its ref, which the clone pins.
  */
-async function resolveSource(source: SpawnWorkspaceSource, staging: string): Promise<PinnedSource> {
+async function resolveSource(
+  source: SpawnWorkspaceSource,
+  staging: string,
+  transports: readonly string[],
+): Promise<PinnedSource> {
   if (source.kind === 'path') {
     // The origin is checked as configured, before resolving it applies any
     // rewrite: a rewrite the checkout's own config holds expands it too.
@@ -271,6 +287,7 @@ async function resolveSource(source: SpawnWorkspaceSource, staging: string): Pro
 
     const resolved = await resolvePathSource(source.path, {
       allowDirty: source.allowDirty ?? 'refuse',
+      transports,
     });
 
     if (!resolved.ok) {
@@ -289,22 +306,19 @@ async function resolveSource(source: SpawnWorkspaceSource, staging: string): Pro
     };
   }
 
-  await requireNoURLCredentials(source.url, staging);
+  // The clone fetches the URL it records, so the spawn API's `owner/repo`
+  // shorthand reaches the repository it expands to.
+  const resolved = await resolveGitURL(expandGitShorthand(source.url), staging, transports);
 
-  // The clone fetches the URL it records, so an `owner/repo` shorthand
-  // reaches the repository it expands to.
-  const normalized = normalizeGitURL(source.url);
-
-  if (!normalized.ok) {
-    throw new DaemonError(normalized.code, normalized.message, { phase: 'resolving' });
+  if (!resolved.ok) {
+    throw new DaemonError(resolved.code, resolved.message, { phase: 'resolving' });
   }
 
-  await requireNoURLCredentials(normalized.url, staging);
-
   return {
-    cloneURL: normalized.url,
-    repoURL: normalized.url,
-    checkout: source.sha ?? source.ref ?? '',
+    cloneURL: resolved.url,
+    repoURL: resolved.url,
+    checkout: source.ref ?? source.sha ?? '',
+    sha: source.ref === undefined ? undefined : source.sha,
     ref: source.ref ?? null,
     credential: source.credentialRef,
     warnings: [],
@@ -400,10 +414,20 @@ interface CleanClone {
  * Clones the pinned source into a staging directory on the daemon's host,
  * sanitizes it, and reads it back as a tar archive.
  */
-async function createCleanClone(pinned: PinnedSource, dir: string): Promise<CleanClone> {
+async function createCleanClone(
+  pinned: PinnedSource,
+  dir: string,
+  transports: readonly string[],
+): Promise<CleanClone> {
   const clone = await createWorkspaceClone({
-    source: { kind: 'git', url: pinned.cloneURL, ref: pinned.checkout },
+    source: {
+      kind: 'git',
+      url: pinned.cloneURL,
+      ref: pinned.checkout,
+      ...(pinned.sha === undefined ? {} : { sha: pinned.sha }),
+    },
     dir,
+    transports,
     ...(pinned.credential === undefined ? {} : { credential: pinned.credential }),
   });
 

package/src/daemon/parse-hook-line.ts

@@ -23,8 +23,11 @@ export function parseHookLine(line: string): HookEvent | null {
     return null;
   }
 
+  const agent = parsed['agent'];
+
   return {
     atcId: toSessionID(parsed['atcId']),
+    ...(typeof agent === 'string' && agent !== '' ? { agent } : {}),
     event: parsed['event'],
     payload: parsed['payload'],
   };

package/src/daemon/require-git-transports.ts

@@ -0,0 +1,23 @@
+import { DaemonError } from '../protocol/daemon-error';
+import type { InvalidGitTransports } from '../shared/collect-workspaces-config';
+
+/**
+ * The transports git may fetch over, or the refusal of a git operation
+ * when the configured list is invalid: the daemon then runs no git at all,
+ * and the error quotes the config errors it printed at startup, with
+ * `data` as its detail.
+ */
+export function requireGitTransports(
+  policy: readonly string[] | InvalidGitTransports,
+  data?: Readonly<Record<string, unknown>>,
+): readonly string[] {
+  if ('invalid' in policy) {
+    throw new DaemonError(
+      'git_transports_invalid',
+      `workspaces.gitTransports in config.json is invalid, so the daemon runs no git: ${policy.invalid}`,
+      data,
+    );
+  }
+
+  return policy;
+}

package/src/daemon/session-runtime.ts

@@ -46,6 +46,11 @@ export class SessionRuntime {
   // later dropped may be restarting, so it keeps the inbox open.
   tapAttached = false;
 
+  // Whether a hook line carrying the session's agent arrived since the
+  // terminal last booted. Once one has, the session's own hooks are known
+  // to carry it, and a line without one comes from another harness.
+  hasAgentHookLines = false;
+
   // Returns the boot-scoped state to how a fresh terminal starts, at the
   // dims it boots with: no SessionStart yet and no tap since. Every path
   // that boots a new terminal for an existing session runs it, so a revived
@@ -54,6 +59,7 @@ export class SessionRuntime {
     this.dims = dims;
     this.startedAt = null;
     this.tapAttached = false;
+    this.hasAgentHookLines = false;
   }
 
   dispose(): void {

package/src/daemon/verify-broker-authority.ts

@@ -0,0 +1,52 @@
+import { BrokerAuthorityError } from './broker-authority-error';
+import type { ImpPort } from './imp-port';
+import { verifyTokenImpAuthority } from './verify-token-imp-authority';
+
+/**
+ * What a provisioning call is about to touch: the imps under their actual
+ * names, as the target's runtime namespace builds them, and every secret
+ * the binding grants them.
+ */
+export interface BrokerActivation {
+  readonly impNames: readonly string[];
+  readonly secrets: readonly string[];
+}
+
+/**
+ * The gate before atc grants or relies on a brokered credential. It reads
+ * impd's features, then the token's identity, and writes nothing, so a
+ * refusal leaves impd as it was. It rejects unless impd has both grantable
+ * tokens and secret rebinds, the token may manage each imp and reaches no
+ * imp outside the namespace whose imp names start with the prefix, and the
+ * token may grant every bound secret.
+ * Whether each secret's rules match the binding is a separate comparison.
+ */
+export async function verifyBrokerAuthority(
+  port: Pick<ImpPort, 'readFeatures' | 'readIdentity'>,
+  activation: BrokerActivation,
+  impPrefix: string,
+): Promise<void> {
+  const features = await port.readFeatures();
+
+  if (!features.grantableTokens || !features.secretRebind) {
+    throw new BrokerAuthorityError(
+      'auth_impd_too_old',
+      'impd lacks grantable tokens or secret rebinds; it must be 0.27.0 or later',
+      { grantableTokens: features.grantableTokens, secretRebind: features.secretRebind },
+    );
+  }
+
+  const identity = await port.readIdentity();
+
+  verifyTokenImpAuthority(identity, activation.impNames, impPrefix);
+
+  const missing = activation.secrets.filter((secret) => !identity.grantable.includes(secret));
+
+  if (missing.length > 0) {
+    throw new BrokerAuthorityError(
+      'auth_secret_not_grantable',
+      `impd token ${identity.name} cannot grant ${missing.join(', ')}`,
+      { token: identity.name, grantable: identity.grantable, missing },
+    );
+  }
+}

package/src/daemon/verify-cleanup-authority.ts

@@ -0,0 +1,44 @@
+import { BrokerAuthorityError } from './broker-authority-error';
+import type { ImpPort, ImpView } from './imp-port';
+import { verifyTokenImpAuthority } from './verify-token-imp-authority';
+
+// The imp a binding recorded when atc made it.
+export interface RecordedImp {
+  readonly name: string;
+  readonly id: string;
+}
+
+/**
+ * The check before atc destroys a session's imp or revokes its grants.
+ * It asks that the token may manage the recorded imp, under imp patterns
+ * that stay inside the namespace whose imp names start with the prefix,
+ * and that the imp under that
+ * name is still the one recorded. It never asks that a secret's rules
+ * still match or that every grant is still in place, so a rotated, rebound
+ * or deleted secret never stops atc removing access. Resolves to the imp,
+ * or to null when impd confirms no imp holds the name, which needs no
+ * cleanup; an imp with another id rejects.
+ */
+export async function verifyCleanupAuthority(
+  port: Pick<ImpPort, 'readIdentity' | 'readImp'>,
+  recorded: RecordedImp,
+  impPrefix: string,
+): Promise<ImpView | null> {
+  const identity = await port.readIdentity();
+
+  // Checked first, so impd's answer for the name comes from a token that
+  // can see the imp, and a missing imp means it is gone.
+  verifyTokenImpAuthority(identity, [recorded.name], impPrefix);
+
+  const imp = await port.readImp(recorded.name);
+
+  if (imp !== null && imp.id !== recorded.id) {
+    throw new BrokerAuthorityError(
+      'auth_runtime_mismatch',
+      `imp ${recorded.name} is no longer the imp atc made`,
+      { imp: recorded.name, recordedID: recorded.id, actualID: imp.id },
+    );
+  }
+
+  return imp;
+}

package/src/daemon/verify-token-imp-authority.ts

@@ -0,0 +1,74 @@
+import { BrokerAuthorityError } from './broker-authority-error';
+import type { ImpIdentity } from './imp-port';
+import { isImpNameAllowed } from './is-imp-name-allowed';
+
+/**
+ * Rejects unless the token may manage every named imp and reaches no imp
+ * outside atc's namespace: scope `manage`, imp patterns rather than none,
+ * and each pattern contained in the namespace prefix, so the literal text
+ * before its first `*`, or the whole pattern when it has none, starts with
+ * the prefix. A token with any pattern beyond the prefix is refused
+ * outright, however few names that pattern reaches, never used in place of
+ * a contained one. Each name must then match a pattern. The prefix is the
+ * literal start of every imp name the target's runtime namespace builds,
+ * and the names are the imps the call touches under those built names.
+ */
+export function verifyTokenImpAuthority(
+  identity: ImpIdentity,
+  impNames: readonly string[],
+  impPrefix: string,
+): void {
+  assertImpPrefix(impPrefix);
+
+  if (identity.scope !== 'manage') {
+    throw new BrokerAuthorityError(
+      'auth_token_scope',
+      `impd token ${identity.name} cannot manage imps`,
+      {
+        token: identity.name,
+        scope: identity.scope,
+      },
+    );
+  }
+
+  const patterns = identity.imps;
+
+  if (patterns === null || !patterns.every((pattern) => isPatternContained(pattern, impPrefix))) {
+    throw new BrokerAuthorityError(
+      'auth_token_too_broad',
+      `impd token ${identity.name} can reach imps outside atc's namespace, whose imp names start with ${impPrefix}`,
+      {
+        token: identity.name,
+        imps: patterns,
+        offending:
+          patterns === null
+            ? null
+            : patterns.filter((pattern) => !isPatternContained(pattern, impPrefix)),
+      },
+    );
+  }
+
+  const outside = impNames.filter((name) => !isImpNameAllowed(patterns, name));
+
+  if (outside.length > 0) {
+    throw new BrokerAuthorityError(
+      'auth_imp_out_of_scope',
+      `impd token ${identity.name} cannot manage ${outside.join(', ')}`,
+      { token: identity.name, imps: patterns, outside },
+    );
+  }
+}
+
+// An empty prefix would contain every pattern, `*` included.
+function assertImpPrefix(impPrefix: string): void {
+  if (impPrefix === '') {
+    throw new Error('the imp name prefix of a runtime namespace must not be empty');
+  }
+}
+
+// Every name a pattern matches starts with the text before its first `*`.
+function isPatternContained(pattern: string, impPrefix: string): boolean {
+  const [literal = ''] = pattern.split('*');
+
+  return literal.startsWith(impPrefix);
+}

package/src/hook-report.ts

@@ -4,10 +4,12 @@ import { isRecord, sendReport } from './shared/report';
 /**
  * Runs as a hook inside wrangled sessions. Reads the hook event from stdin
  * (Claude snake_case keys or Grok camelCase keys) and forwards a PascalCase
- * event name to the atc unix socket. Always exits 0 so it never blocks the
- * session it reports on.
+ * event name to the atc unix socket, with the agent id the hook command
+ * gave it, so the daemon can tell a nested harness's report from the
+ * session's own. Always exits 0 so it never blocks the session it reports
+ * on.
  */
-export async function runHookReport(): Promise<void> {
+export async function runHookReport(agent: string): Promise<void> {
   const sock = process.env['ATC_SOCKET'];
   const atcId = process.env['ATC_SESSION_ID'];
 
@@ -26,7 +28,7 @@ export async function runHookReport(): Promise<void> {
 
     const rawName = payload['hook_event_name'] ?? payload['hookEventName'];
     const event = typeof rawName === 'string' ? normalizeHookEventName(rawName) : rawName;
-    const line = `${JSON.stringify({ atcId, event, payload })}\n`;
+    const line = `${JSON.stringify({ atcId, ...(agent === '' ? {} : { agent }), event, payload })}\n`;
 
     await sendReport(sock, line, 2000);
   }

package/src/mcp/require-daemon-features.ts

@@ -19,6 +19,8 @@ const FEATURE_USES: Readonly<Record<DaemonFeature, string>> = {
   'report.get': 'atc_report_get',
   'request.principal': 'the target limits of a remote MCP client',
   'spawn.workspace': "atc_session_spawn's workspace",
+  sources: 'sources.list and sources.interpret',
+  'git.probe': 'git.probe',
 };
 
 /**

package/src/protocol/daemon-features.ts

@@ -56,6 +56,14 @@ export const DAEMON_FEATURES = [
 
   // `report.get` exists.
   'report.get',
+
+  // `sources.list` and `sources.interpret` exist, and `agents.list` returns
+  // `sources`.
+  'sources',
+
+  // `git.probe` exists, and `session.spawn` takes a git workspace with both
+  // `ref` and `sha`.
+  'git.probe',
 ] as const;
 
 export type DaemonFeature = (typeof DAEMON_FEATURES)[number];

package/src/protocol/hook-event.ts

@@ -1,11 +1,15 @@
+import type { AgentID } from '../shared/agent-id';
 import type { SessionID } from '../shared/session-id';
 
 /**
- * One line a hook reporter sends: the atc session it reports on, the agent's
- * hook event name, and the hook's payload as the agent gave it.
+ * One line a hook reporter sends: the atc session it reports on, the agent
+ * whose hook command sent it, the agent's hook event name, and the hook's
+ * payload as the agent gave it. The agent is absent on a line from a hook
+ * command that carries none.
  */
 export interface HookEvent {
   atcId: SessionID;
+  agent?: AgentID;
   event: string;
   payload: Record<string, unknown>;
 }

package/src/protocol/protocol.ts

@@ -34,6 +34,7 @@ const ERROR_CODES = [
   'workspace_dirty',
   'no_origin',
   'invalid_git_url',
+  'git_transports_invalid',
   'unpushed_head',
   'credential_in_url',
   'credential_missing',
@@ -44,6 +45,7 @@ const ERROR_CODES = [
   'workspace_exists',
   'transfer_failed',
   'workspace_mismatch',
+  'github_unavailable',
   'host_unavailable',
   'auth_not_configured',
   'host_leased',

package/src/protocol/request-param-schemas.ts

@@ -32,15 +32,30 @@ const CREDENTIAL_REF = z.strictObject({
   name: z.string().regex(/^[A-Za-z_]\w*$/u, 'a credentialRef names an environment variable'),
 });
 
+// A git workspace's repository URL, which git must never read as an option.
+const GIT_URL = z
+  .string({ error: 'a git workspace requires a url' })
+  .min(1, 'a git workspace requires a url')
+  .refine((url) => !url.startsWith('-'), 'a git workspace url must not start with -');
+
+// A git workspace's branch or tag, which git must never read as an option.
+const GIT_REF = z
+  .string()
+  .min(1, 'a git workspace ref must not be empty')
+  .refine((ref) => !ref.startsWith('-'), 'a git workspace ref must not start with -');
+
+const GIT_SHA = z.string().regex(COMMIT_ID, 'a git workspace sha is a full commit id');
+
 /**
  * Where a spawn's working directory comes from, materialized as a clean
  * checkout into the spawn's `cwd` on its execution target. A `path` source
  * is a directory on the daemon's host, resolved to its origin URL and
  * pushed HEAD; `allowDirty: 'warn'` resolves a tree with uncommitted
  * changes to HEAD and leaves the changes behind with a warning. A `git`
- * source is a repository URL with exactly one of a branch or tag `ref` or
- * a full commit `sha`, and an optional `credentialRef` naming the daemon
- * environment variable that holds its token.
+ * source is a repository URL with a branch or tag `ref`, a full commit
+ * `sha`, or both, and an optional `credentialRef` naming the daemon
+ * environment variable that holds its token. With both, the sha is the
+ * commit checked out and the ref is recorded as what it was resolved from.
  */
 const WORKSPACE_SOURCE = z.discriminatedUnion('kind', [
   z.strictObject({
@@ -53,23 +68,33 @@ const WORKSPACE_SOURCE = z.discriminatedUnion('kind', [
   z
     .strictObject({
       kind: z.literal('git'),
-      url: z
-        .string({ error: 'a git workspace requires a url' })
-        .min(1, 'a git workspace requires a url')
-        .refine((url) => !url.startsWith('-'), 'a git workspace url must not start with -'),
-      ref: z
-        .string()
-        .min(1, 'a git workspace ref must not be empty')
-        .refine((ref) => !ref.startsWith('-'), 'a git workspace ref must not start with -')
-        .optional(),
-      sha: z.string().regex(COMMIT_ID, 'a git workspace sha is a full commit id').optional(),
+      url: GIT_URL,
+      ref: GIT_REF.optional(),
+      sha: GIT_SHA.optional(),
       credentialRef: CREDENTIAL_REF.optional(),
     })
-    .refine((source) => (source.ref === undefined) !== (source.sha === undefined), {
-      message: 'a git workspace takes exactly one of ref or sha',
+    .refine((source) => source.ref !== undefined || source.sha !== undefined, {
+      message: 'a git workspace takes a ref, a sha, or both',
     }),
 ]);
 
+// The execution target a request acts for; absent is the default target.
+const TARGET = z
+  .string({ error: 'target must be a non-empty target id' })
+  .min(1, 'target must be a non-empty target id')
+  .optional();
+
+// The id of a source the daemon offers the spawn picker.
+const SOURCE_ID = z
+  .string({ error: 'source must be a source id' })
+  .min(1, 'source must be a source id')
+  .max(64, 'source must be a source id');
+
+// Text a source reads, at most 4096 characters.
+const SOURCE_TEXT = z
+  .string({ error: 'source text must be a string' })
+  .max(4096, 'source text must be at most 4096 characters');
+
 export type SpawnWorkspaceSource = z.infer<typeof WORKSPACE_SOURCE>;
 
 // The refusal of a terminal size outside the range a terminal takes.
@@ -88,6 +113,33 @@ export const REQUEST_PARAM_SCHEMAS = {
   'session.list': z.object({}),
   'dirs.list': z.object({}),
   'agents.list': z.object({}),
+
+  // One source's candidates for a spawn to the target, under the scope the
+  // source defines and filtered by text when it filters.
+  'sources.list': z.object({
+    source: SOURCE_ID,
+    target: TARGET,
+    scope: SOURCE_TEXT.min(1, 'scope must be non-empty').optional(),
+    text: SOURCE_TEXT.optional(),
+  }),
+
+  // What one source reads typed input as, for a spawn to the target.
+  'sources.interpret': z.object({ source: SOURCE_ID, input: SOURCE_TEXT, target: TARGET }),
+
+  // Whether the daemon's host can read a git workspace source the way a
+  // spawn to the target would, with its refs and the commit a ref or sha
+  // selects; at most one of the two.
+  'git.probe': z
+    .object({
+      url: GIT_URL,
+      ref: GIT_REF.optional(),
+      sha: GIT_SHA.optional(),
+      credentialRef: CREDENTIAL_REF.optional(),
+      target: TARGET,
+    })
+    .refine((probe) => probe.ref === undefined || probe.sha === undefined, {
+      message: 'git.probe takes at most one of ref or sha',
+    }),
   'fleet.list': z.object({}),
   'fleet.restore': z.object({
     cols: buildTerminalSize(80),