@zgeoff/atc 2.16.0 → 2.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.16.0",
+  "version": "2.17.0",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",

package/src/cli.ts

@@ -161,6 +161,10 @@ const main = defineCommand({
           const gateway = await import('./agents/gateway-adapter');
           const headless = await import('./agents/start-claude-headless-run');
           const targets = await import('./daemon/build-execution-targets');
+          const sourceOrder = await import('./sources/build-sources');
+          const builtinSources = await import('./sources/collect-builtin-sources');
+          const zoxide = await import('./shared/collect-zoxide-dirs');
+          const home = await import('./shared/resolve-home-dir');
 
           // Test harnesses shrink the outbound queue to force overflow
           // deterministically; unset means the production default.
@@ -178,10 +182,27 @@ const main = defineCommand({
             console.error(`atc daemon: config: ${line}`);
           }
 
-          for (const problem of cfg.principalErrors) {
+          for (const problem of [...cfg.principalErrors, ...cfg.workspaceErrors]) {
             console.error(`atc daemon: config: ${problem}`);
           }
 
+          const sources = sourceOrder.buildSources(
+            builtinSources.collectBuiltinSources({
+              roots: cfg.dirs.roots,
+              githubOwner: cfg.workspaces.githubOwner,
+              ghBin: 'gh',
+              homeDir: home.resolveHomeDir(),
+              collectZoxideDirs: zoxide.collectZoxideDirs,
+            }),
+            cfg.workspaces.sources,
+          );
+
+          for (const id of sources.missing) {
+            console.error(
+              `atc daemon: config: workspaces.sources holds '${id}', which this daemon cannot offer; the picker leaves it out`,
+            );
+          }
+
           // Cap on how long a fleet restore waits for one revived session to
           // report it has booted before moving to the next. Tests pin it to
           // keep timing deterministic; unset means the production default.
@@ -220,6 +241,8 @@ const main = defineCommand({
               defaultTarget: cfg.defaultTarget,
               targetErrors,
               principals: cfg.principals,
+              sources: sources.sources,
+              gitTransports: cfg.workspaces.gitTransports,
               restoreBootTimeoutMs,
               ...(Number.isFinite(graceOverride) && graceOverride >= 0
                 ? { tapGraceMs: graceOverride }

package/src/client/collect-target-picks.ts

@@ -0,0 +1,53 @@
+import { isRecord } from '../shared/report';
+
+export interface TargetPick {
+  readonly id: string;
+  readonly provider: string;
+  readonly available: boolean;
+  readonly isDefault: boolean;
+
+  // Whether a workspace can be materialized there: the daemon has the
+  // provider, and it can both transfer an archive and run a command.
+  readonly takesWorkspace: boolean;
+
+  // Whether a session there runs on the daemon's own machine, where a
+  // local directory runs in place.
+  readonly inPlace: boolean;
+}
+
+/**
+ * The execution targets an `agents.list` answer holds, in config order. An
+ * answer from a daemon without targets, or a malformed entry, yields none.
+ */
+export function collectTargetPicks(answer: Readonly<Record<string, unknown>>): TargetPick[] {
+  const targets = answer['targets'];
+
+  if (!Array.isArray(targets)) {
+    return [];
+  }
+
+  return targets.flatMap((entry: unknown): TargetPick[] => {
+    if (
+      !isRecord(entry) ||
+      typeof entry['id'] !== 'string' ||
+      typeof entry['provider'] !== 'string'
+    ) {
+      return [];
+    }
+
+    const capabilities = isRecord(entry['capabilities']) ? entry['capabilities'] : {};
+    const available = entry['available'] === true;
+
+    return [
+      {
+        id: entry['id'],
+        provider: entry['provider'],
+        available,
+        isDefault: entry['default'] === true,
+        takesWorkspace:
+          available && capabilities['transfer'] === true && capabilities['run'] === true,
+        inPlace: entry['provider'] === 'local-pty',
+      },
+    ];
+  });
+}

package/src/client/dirs.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename } from 'node:path';
-import { collectRootDirs } from './collect-root-dirs';
+import { collectRootDirs } from '../shared/collect-root-dirs';
 
 /**
  * Every source the picker lists, merged in the order the reader expects

package/src/client/spawn-picker.ts

@@ -1,17 +1,19 @@
 import { homedir } from 'node:os';
 import { DaemonError } from '../protocol/daemon-error';
 import type { AgentID } from '../shared/agent-id';
+import { collectZoxideDirs } from '../shared/collect-zoxide-dirs';
 import { loadConfig } from '../shared/config';
 import { collectAgentPicks } from './collect-agent-picks';
 import type { AgentPick } from './collect-agent-picks';
 import { collectPathCompletions } from './collect-path-completions';
-import { collectZoxideDirs } from './collect-zoxide-dirs';
+import { collectTargetPicks } from './collect-target-picks';
+import type { TargetPick } from './collect-target-picks';
 import { collectDirs, formatDir, formatDirName, pickMatches } from './dirs';
 import { planTextEdit } from './keys';
 import { resolvePathInput } from './resolve-path-input';
 import { ansi, cols, drawPicker } from './ui';
 
-type PickerStep = 'agent' | 'dir' | 'name' | 'prompt';
+type PickerStep = 'agent' | 'dir' | 'target' | 'name' | 'prompt';
 
 // What the flow borrows from the client that owns the screen, the daemon
 // connection and the fleet mirror.
@@ -31,8 +33,9 @@ export interface SpawnPickerDeps<TMirror> {
 }
 
 /**
- * The modal flow behind n and r: agent, then directory, then name, then an
- * optional first prompt. Every path out of it either attaches the new
+ * The modal flow behind n and r: agent, then directory, then execution
+ * target when the daemon has more than one, then name, then an optional
+ * first prompt. Every path out of it either attaches the new
  * session or returns the client to the screen it came from. A spawn the
  * daemon refuses is no path out: the flow stays open and shows why.
  */
@@ -56,6 +59,12 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
   private dir = '';
 
+  // The daemon's execution targets, read when the directory step opens,
+  // and the one chosen; null spawns on the daemon's default target.
+  private targets: TargetPick[] = [];
+
+  private target: TargetPick | null = null;
+
   private name = '';
 
   private resume = false;
@@ -72,6 +81,7 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
   open(resume = false) {
     this.resume = resume;
+    this.target = null;
 
     const config = loadConfig();
 
@@ -99,7 +109,7 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
     const edit = planTextEdit(buf, this.input, {
       isLeaderKey: this.deps.isLeaderKey,
-      moves: this.step === 'agent' || this.step === 'dir',
+      moves: this.step === 'agent' || this.step === 'dir' || this.step === 'target',
     });
 
     switch (edit.kind) {
@@ -131,6 +141,11 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
         return;
       }
       case 'input': {
+        // The target step takes no text: its list is short and fixed.
+        if (this.step === 'target') {
+          return;
+        }
+
         this.input = edit.value;
 
         this.render();
@@ -170,6 +185,21 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
         input: this.input,
         hint: 'type to filter, or a path (/ ~ .) · ↑↓ move · ⏎ select · esc cancel',
       });
+    } else if (this.step === 'target') {
+      this.selected = Math.min(this.selected, this.targets.length - 1);
+
+      drawPicker({
+        title: `${verb}: target`,
+        items: this.targets.map((t) => formatTargetPick(t)),
+        selected: this.selected,
+        input: '',
+        hint: this.refusal ?? `where ${formatDir(this.dir)} runs · ↑↓ move · ⏎ select · esc back`,
+        dimmed: new Set(
+          this.targets.flatMap((t, i) =>
+            t.takesWorkspace || (t.available && t.inPlace) ? [] : [i],
+          ),
+        ),
+      });
     } else if (this.step === 'name') {
       drawPicker({
         title: `${verb}: name`,
@@ -209,8 +239,10 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
       );
 
       this.step = 'agent';
-    } else if (this.step === 'name') {
+    } else if (this.step === 'target') {
       this.step = 'dir';
+    } else if (this.step === 'name') {
+      this.openTargetOrDir('dir');
     } else {
       this.step = 'name';
     }
@@ -246,6 +278,27 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
       this.dir = chosen;
       this.input = '';
+
+      this.openTargetOrDir('name');
+    } else if (this.step === 'target') {
+      const pick = this.targets[this.selected];
+
+      if (pick === undefined) {
+        return;
+      }
+
+      const refusal = findTargetRefusal(pick);
+
+      if (refusal !== null) {
+        this.refusal = refusal;
+
+        this.render();
+
+        return;
+      }
+
+      this.target = pick;
+      this.input = '';
       this.step = 'name';
     } else if (this.step === 'name') {
       this.name = this.input.trim();
@@ -280,9 +333,44 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
       : collectPathCompletions(this.input, process.cwd(), homedir());
   }
 
+  // Opens the target step when the daemon has more than one target, with
+  // the chosen or default target selected, and the fallback step otherwise.
+  private openTargetOrDir(fallback: 'dir' | 'name') {
+    if (this.targets.length < 2) {
+      // The one target is the spawn's, default or not, so the spawn names it
+      // and its provider decides whether a directory runs in place.
+      this.target = this.targets[0] ?? null;
+      this.step = fallback;
+
+      return;
+    }
+
+    const preferred = this.target?.id;
+
+    this.selected = Math.max(
+      0,
+      this.targets.findIndex((t) => (preferred === undefined ? t.isDefault : t.id === preferred)),
+    );
+
+    this.step = 'target';
+  }
+
   private async openDirStep() {
     let recent: string[] = [];
 
+    try {
+      const listed = await this.deps.sendRequest('agents.list');
+
+      const picks = collectTargetPicks(listed);
+
+      // An adopt resumes a session from its history on this host, which a
+      // fresh checkout elsewhere does not hold, so it is offered only the
+      // targets that run here.
+      this.targets = this.resume ? picks.filter((t) => t.available && t.inPlace) : picks;
+    } catch {
+      this.targets = [];
+    }
+
     try {
       const answer = await this.deps.sendRequest('dirs.list');
 
@@ -318,6 +406,7 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
         rows: this.deps.ptyRows(),
         ...(this.resume ? { resume: true } : {}),
         agent: this.agent,
+        ...this.buildTargetParams(),
       });
 
       const spawned = this.deps.toMirrorSession(ok['session']);
@@ -347,4 +436,41 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
     this.deps.toBase();
   }
+
+  // A chosen target goes with the spawn. A local directory runs in place on
+  // a target on the daemon's own machine, and is materialized at the same
+  // path from its pushed HEAD on any other.
+  private buildTargetParams(): Readonly<Record<string, unknown>> {
+    if (this.target === null) {
+      return {};
+    }
+
+    return this.target.inPlace
+      ? { target: this.target.id }
+      : { target: this.target.id, workspace: { kind: 'path', path: this.dir } };
+  }
+}
+
+function formatTargetPick(pick: TargetPick): string {
+  const notes = [
+    pick.provider,
+    ...(pick.isDefault ? ['default'] : []),
+    ...(pick.available ? [] : ['unavailable']),
+    ...(pick.available && !pick.takesWorkspace ? ['no workspace'] : []),
+  ];
+
+  return `${pick.id}  ${notes.join(' · ')}`;
+}
+
+// Why a local directory cannot run on a target, or null when it can.
+function findTargetRefusal(pick: TargetPick): string | null {
+  if (!pick.available) {
+    return `target '${pick.id}' is unavailable on this daemon · esc back`;
+  }
+
+  if (!pick.inPlace && !pick.takesWorkspace) {
+    return `target '${pick.id}' cannot take a workspace · esc back`;
+  }
+
+  return null;
 }

package/src/client/ui.ts

@@ -387,6 +387,9 @@ export interface PickerView {
   input: string;
   placeholder?: string;
   hint: string;
+
+  // The indexes of items drawn dim: listed, but not a fit for the flow.
+  dimmed?: ReadonlySet<number>;
 }
 
 export function drawPicker(view: PickerView) {
@@ -397,7 +400,9 @@ export function drawPicker(view: PickerView) {
   for (const [i, item] of shown.entries()) {
     const sel = i === view.selected;
     const t = truncate(item, width - 4);
-    const styled = sel ? `${ESC}[7m${t.padEnd(width - 4)}${ESC}[0m` : t;
+    const dim = view.dimmed?.has(i) === true;
+    const inverse = sel ? `${ESC}[7m${t.padEnd(width - 4)}${ESC}[0m` : t;
+    const styled = dim ? `${ESC}[90m${inverse}${ESC}[0m` : inverse;
     const plainLen = sel ? width - 4 : t.length;
 
     rowsList.push(boxRow(width, styled, plainLen));

package/src/daemon/daemon-connection.ts

@@ -19,6 +19,7 @@ import type { AgentID } from '../shared/agent-id';
 import { isRecord } from '../shared/report';
 import type { SessionID } from '../shared/session-id';
 import { toSessionID } from '../shared/to-session-id';
+import type { SourceProvider, SourceRequest } from '../sources/types';
 import { buildPayloadHash } from './build-payload-hash';
 import { buildScopedContext } from './build-scoped-context';
 import { buildTargetForbiddenError } from './build-target-forbidden-error';
@@ -43,6 +44,18 @@ interface ViewUpdate {
   readonly withdrawn: readonly SessionID[];
 }
 
+// What a source request holds: the source's id and the target it is for.
+interface SourceParams {
+  readonly source: string;
+  readonly target?: string | undefined;
+}
+
+// The source a request asks for, and the request the source serves.
+interface ResolvedSourceRequest {
+  readonly source: SourceProvider;
+  readonly request: SourceRequest;
+}
+
 interface PeerSocket extends SocketWriter {
   readonly end: () => void;
 }
@@ -409,6 +422,21 @@ export class DaemonConnection {
 
         return;
       }
+      case 'sources.list': {
+        await this.applySourcesList(req, ctx);
+
+        return;
+      }
+      case 'sources.interpret': {
+        await this.applySourcesInterpret(req, ctx);
+
+        return;
+      }
+      case 'git.probe': {
+        await this.applyGitProbe(req, ctx);
+
+        return;
+      }
       case 'session.spawn': {
         await this.applySpawn(req, ctx);
 
@@ -794,6 +822,107 @@ export class DaemonConnection {
     this.sendOk(req.id, spawned);
   }
 
+  // Lists one source's candidates for a spawn to the request's target.
+  private async applySourcesList(req: RequestMsg, ctx: DaemonContext): Promise<void> {
+    const parsed = parseRequestParams('sources.list', req.p);
+
+    if (!parsed.ok) {
+      this.sendErr(req.id, 'bad_args', parsed.message);
+
+      return;
+    }
+
+    const resolved = this.resolveSourceRequest(parsed.data, ctx);
+    const source = resolved.source;
+
+    const listed = await source.list(
+      {
+        ...(parsed.data.scope === undefined ? {} : { scope: parsed.data.scope }),
+        ...(parsed.data.text === undefined ? {} : { text: parsed.data.text }),
+      },
+      resolved.request,
+    );
+
+    this.sendOk(req.id, { source: source.id, scope: listed.scope, candidates: listed.candidates });
+  }
+
+  // Reads typed input through one source for a spawn to the request's
+  // target.
+  private async applySourcesInterpret(req: RequestMsg, ctx: DaemonContext): Promise<void> {
+    const parsed = parseRequestParams('sources.interpret', req.p);
+
+    if (!parsed.ok) {
+      this.sendErr(req.id, 'bad_args', parsed.message);
+
+      return;
+    }
+
+    const resolved = this.resolveSourceRequest(parsed.data, ctx);
+
+    const interpretation = await resolved.source.interpret(parsed.data.input, resolved.request);
+
+    this.sendOk(req.id, { ...interpretation });
+  }
+
+  // The source a request asks for and the request it serves, so a principal
+  // reaches a source only for a target it may spawn on, and a git source
+  // only for a target it may spawn a workspace on.
+  private resolveSourceRequest(params: SourceParams, ctx: DaemonContext): ResolvedSourceRequest {
+    const source = ctx.findSource(params.source);
+
+    if (source === null) {
+      throw new DaemonError('unsupported', `this daemon offers no source '${params.source}'`);
+    }
+
+    const target = ctx.resolveSpawnTarget(params.target);
+
+    if (source.kind === 'git') {
+      this.ctx.requireWorkspaceTarget(target);
+    }
+
+    // The spawn history is read through the request's own view, so a
+    // principal lists only directories spawned on targets it may use.
+    return { source, request: { target, collectSpawnDirs: () => ctx.collectSpawnDirs(null) } };
+  }
+
+  // Probes a git workspace source for a spawn to the request's target, so
+  // a principal probes only for a target it may spawn a workspace on. A
+  // refusal holds the repository's other URLs that the offered sources know.
+  private async applyGitProbe(req: RequestMsg, ctx: DaemonContext): Promise<void> {
+    const parsed = parseRequestParams('git.probe', req.p);
+
+    if (!parsed.ok) {
+      this.sendErr(req.id, 'bad_args', parsed.message);
+
+      return;
+    }
+
+    const data = parsed.data;
+
+    this.ctx.requireWorkspaceTarget(ctx.resolveSpawnTarget(data.target));
+
+    const access = await ctx.checkRepositoryAccess({
+      url: data.url,
+      ref: data.ref,
+      sha: data.sha,
+      credential: data.credentialRef,
+    });
+
+    if (!access.ok) {
+      const alternates = ctx.collectAlternateGitURLs(data.url);
+      const detail = alternates.length === 0 ? undefined : { alternates };
+
+      throw new DaemonError(access.code, access.message, detail);
+    }
+
+    this.sendOk(req.id, {
+      url: access.url,
+      head: access.head,
+      refs: access.refs,
+      resolved: access.resolved,
+    });
+  }
+
   private applyAttach(req: RequestMsg, ctx: DaemonContext): void {
     const parsed = parseRequestParams('session.attach', req.p);
 

package/src/daemon/daemon-context.ts

@@ -6,9 +6,11 @@ import type { TargetConfigError } from '../shared/collect-targets';
 import type { DaemonID } from '../shared/daemon-id';
 import type { MessageID } from '../shared/message-id';
 import type { SessionID } from '../shared/session-id';
+import type { SourceKind, SourceProvider } from '../sources/types';
 import type { FleetEntry } from '../store/fleet-entry';
 import type { MessageRecord } from '../store/message-record';
 import type { TurnSibling } from '../store/state-store';
+import type { checkRepositoryAccess } from '../workspace/check-repository-access';
 import type { Dims } from './attach-registry';
 import type { AgentEntry } from './build-agent-list';
 import type { FleetEvent } from './build-fleet-events';
@@ -79,6 +81,13 @@ interface AgentList {
   readonly spawnDefaults: { readonly agent: AgentID; readonly target: string | null };
   readonly configRevision: string;
   readonly targetErrors: readonly TargetConfigError[];
+
+  // The sources the spawn picker offers, in order.
+  readonly sources: readonly {
+    readonly id: string;
+    readonly label: string;
+    readonly kind: SourceKind;
+  }[];
 }
 
 // The slice of a connection the attach bookkeeping needs: identity plus the
@@ -163,6 +172,20 @@ export interface DaemonContext {
   // one whose provider cannot both transfer an archive and run a command.
   readonly requireWorkspaceTarget: (target: string) => void;
 
+  // The source the daemon offers the spawn picker under an id, or null when
+  // it offers none under it.
+  readonly findSource: (id: string) => SourceProvider | null;
+
+  // The other URLs the offered sources know for a git URL the daemon's host
+  // could not read, each once.
+  readonly collectAlternateGitURLs: (url: string) => readonly string[];
+
+  // Checks that the daemon's host can read a git workspace source, and
+  // resolves its ref, the way a workspace spawn from it would.
+  readonly checkRepositoryAccess: (
+    request: Omit<Parameters<typeof checkRepositoryAccess>[0], 'transports'>,
+  ) => ReturnType<typeof checkRepositoryAccess>;
+
   // Runs the plan, which throws the refusal for a spawn it refuses, then
   // spawns. Answers with the `session.spawn` ok payload, which a keyed
   // retry replays as the first spawn answered it while the access, when

package/src/daemon/daemon.ts

@@ -13,12 +13,15 @@ import type { SpawnWorkspaceSource } from '../protocol/request-param-schemas';
 import type { SessionState } from '../protocol/session-state';
 import type { HooksConfig } from '../shared/collect-hooks';
 import type { TargetConfigError } from '../shared/collect-targets';
+import type { InvalidGitTransports } from '../shared/collect-workspaces-config';
+import { DEFAULT_GIT_TRANSPORTS } from '../shared/default-git-transports';
 import { findDaemonRecord } from '../shared/find-daemon-record';
 import type { MessageID } from '../shared/message-id';
 import { isRecord } from '../shared/report';
 import type { SessionID } from '../shared/session-id';
 import { toMessageID } from '../shared/to-message-id';
 import { truncateToBytes } from '../shared/truncate-to-bytes';
+import type { SourceProvider } from '../sources/types';
 import type { IdempotencyRecord } from '../store/idempotency-record';
 import type { MessageOwner } from '../store/message-owner';
 import type { MessageRecord, MessageStatus } from '../store/message-record';
@@ -26,6 +29,7 @@ import { StateStore } from '../store/state-store';
 import type { EventScope } from '../store/state-store';
 import type { TrailEntry } from '../store/trail-entry';
 import type { SessionWorkspace } from '../store/workspace-materialization';
+import { checkRepositoryAccess } from '../workspace/check-repository-access';
 import { ANSWER_BYTE_CAP } from './answer-byte-cap';
 import { AttachRegistry } from './attach-registry';
 import { buildAgentList } from './build-agent-list';
@@ -68,6 +72,7 @@ import { mintMessageID } from './mint-message-id';
 import { mintSessionID } from './mint-session-id';
 import { parseReport } from './parse-report';
 import { PermissionRegistry } from './permission-registry';
+import { requireGitTransports } from './require-git-transports';
 import { restoreFleet } from './restore-fleet';
 import { runEjectHandoff } from './run-eject-handoff';
 import { ScreenModel } from './screen-model';
@@ -153,6 +158,15 @@ export interface DaemonOptions {
   // Where background failures are reported, one line at a time; stderr
   // when unset.
   readonly log?: (line: string) => void;
+
+  // The sources the spawn picker offers, in order, each built with the
+  // services it uses; none when unset.
+  readonly sources?: readonly SourceProvider[];
+
+  // The transports a git workspace source may use and git may fetch over,
+  // or the invalid list the config holds, which refuses every git
+  // operation; https and ssh when unset.
+  readonly gitTransports?: readonly string[] | InvalidGitTransports;
 }
 
 export interface DaemonHandle {
@@ -236,6 +250,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
 
   const targetErrors = opts.targetErrors ?? [];
   const principals = opts.principals ?? null;
+  const gitTransports = opts.gitTransports ?? DEFAULT_GIT_TRANSPORTS;
 
   const targetsByID = new Map(targets.map((target) => [target.id, target]));
 
@@ -911,6 +926,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
           mgr.log(line);
         },
         stagingRoot: tmpdir(),
+        gitTransports,
       },
     );
   };
@@ -1192,6 +1208,8 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
     }
   };
 
+  const sources = opts.sources ?? [];
+
   const ctx: DaemonContext = {
     build: opts.build,
     daemonID: store.daemonID,
@@ -1215,6 +1233,11 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
       spawnDefaults: { agent: 'claude', target: defaultTarget },
       configRevision,
       targetErrors,
+      sources: sources.map((source) => ({
+        id: source.id,
+        label: source.label,
+        kind: source.kind,
+      })),
     }),
     collectFleet: () => store.loadFleet(),
     loadLastUsedAgent: () => store.loadLastUsedAgent(),
@@ -1256,6 +1279,12 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
       mgr.requireExecution({ target, targetIdentity: null }, 'transfer');
       mgr.requireExecution({ target, targetIdentity: null }, 'run');
     },
+    findSource: (id) => sources.find((source) => source.id === id) ?? null,
+    collectAlternateGitURLs: (url) => [
+      ...new Set(sources.flatMap((source) => source.findAlternateURLs?.(url) ?? [])),
+    ],
+    checkRepositoryAccess: (request) =>
+      checkRepositoryAccess({ ...request, transports: requireGitTransports(gitTransports) }),
     spawnSession: (plan, keyed, access) => {
       // Under an access, a spawn under a parent whose tree leaves the access
       // before the harness starts is refused as a spawn under an unknown