@zgeoff/atc 2.17.0 → 2.20.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.17.0",
+  "version": "2.20.0",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",

package/src/agents/agent-adapter.ts

@@ -1,4 +1,5 @@
 import type { AdapterEvent } from '../protocol/adapter-event';
+import type { DaemonError } from '../protocol/daemon-error';
 import type { HookEvent } from '../protocol/hook-event';
 import type { AgentID } from '../shared/agent-id';
 import type { AgentSessionID } from '../shared/agent-session-id';
@@ -205,6 +206,10 @@ export interface AgentAdapter {
   // Absent: the agent runs there as a local spawn plans it, with no files.
   readonly planGuestSpawn?: (opts: SpawnOptions, guest: GuestPaths) => GuestSpawnPlan | null;
 
+  // The refusal every start of this agent's harness gets, on any target,
+  // or null when it may start. Absent: no start is refused.
+  readonly findSpawnRefusal?: () => DaemonError | null;
+
   // The command that exits 0 inside a remote host when the agent there can
   // sign in without a person. Absent: atc runs no check.
   readonly planAuthCheck?: () => readonly string[];

package/src/agents/gateway-adapter.ts

@@ -1,4 +1,5 @@
 import type { AdapterEvent } from '../protocol/adapter-event';
+import { DaemonError } from '../protocol/daemon-error';
 import type { HookEvent } from '../protocol/hook-event';
 import type { AgentID } from '../shared/agent-id';
 import type { AgentSessionID } from '../shared/agent-session-id';
@@ -39,7 +40,8 @@ export class GatewayAdapter implements AgentAdapter {
   readonly id: AgentID;
 
   // A headless turn carries the same settings file the terminal spawn does,
-  // so it reaches this backend rather than the default one.
+  // so it reaches this backend rather than the default one. A gateway whose
+  // credential comes through impd's broker runs no headless turn.
   readonly headlessRunner: HeadlessRunner | null;
 
   // The CLI's hooks are authoritative; no screen heuristics needed.
@@ -90,7 +92,7 @@ export class GatewayAdapter implements AgentAdapter {
     this.claude = new ClaudeAdapter(config);
 
     this.headlessRunner =
-      headlessRun === null
+      headlessRun === null || gateway.auth !== undefined
         ? null
         : makeClaudeHeadlessRunner(headlessRun, {
             claudeBin: gateway.bin,
@@ -100,6 +102,21 @@ export class GatewayAdapter implements AgentAdapter {
           });
   }
 
+  // A gateway whose credential comes through impd's broker never starts
+  // until the broker path exists: started without it, the CLI would send
+  // whatever credential it holds to the gateway's host.
+  findSpawnRefusal(): DaemonError | null {
+    if (this.gateway.auth === undefined) {
+      return null;
+    }
+
+    return new DaemonError(
+      'auth_target_unsupported',
+      `gateway '${this.id}' takes its credential from impd's broker, and brokered credentials are not wired yet`,
+      { agent: this.id },
+    );
+  }
+
   planSpawn(opts: SpawnOptions): SpawnPlan {
     return {
       bin: this.gateway.bin,
@@ -142,7 +159,13 @@ export class GatewayAdapter implements AgentAdapter {
   // explicit flag, so that mode overrides the one the CLI would restore, and
   // the generated settings file, because
   // without it the CLI would resume the session against the default backend.
+  // A gateway whose credential comes through impd's broker has none, since
+  // outside atc the broker never reaches it.
   buildResumeCommand(cwd: string, agentSessionID: AgentSessionID | undefined): string | null {
+    if (this.gateway.auth !== undefined) {
+      return null;
+    }
+
     const args = [
       ...this.gateway.args,
       ...buildRestoreModeArgs(this.gateway.args, this.gateway.settings),

package/src/cli.ts

@@ -182,7 +182,12 @@ const main = defineCommand({
             console.error(`atc daemon: config: ${line}`);
           }
 
-          for (const problem of [...cfg.principalErrors, ...cfg.workspaceErrors]) {
+          for (const problem of [
+            ...cfg.principalErrors,
+            ...cfg.workspaceErrors,
+            ...cfg.authProfileErrors,
+            ...cfg.gatewayErrors,
+          ]) {
             console.error(`atc daemon: config: ${problem}`);
           }
 

package/src/client/build-workspace-destination.ts

@@ -0,0 +1,38 @@
+interface DestinationParts {
+  // The root the checkout lands under, absolute on its target.
+  readonly root: string;
+
+  // The repository URL the checkout comes from, as the daemon resolved it.
+  readonly url: string;
+
+  // The branch or tag the commit was chosen by, or null for a bare commit.
+  readonly ref: string | null;
+  readonly sha: string;
+}
+
+/**
+ * The default directory a git workspace lands in: `<repo>-<ref>-<short
+ * sha>` under the root, with the ref left out for a bare commit. The repo
+ * is the URL's last path segment without `.git`, and each part keeps only
+ * `[A-Za-z0-9._-]`, with `/` turned into `-`, so the name is one path
+ * segment on any target.
+ */
+export function buildWorkspaceDestination(parts: DestinationParts): string {
+  const repo =
+    parts.url
+      .replace(/\/+$/u, '')
+      .split(/[/:]/u)
+      .at(-1)
+      ?.replace(/\.git$/u, '') ?? '';
+
+  const name = [repo, ...(parts.ref === null ? [] : [parts.ref]), parts.sha.slice(0, 7)]
+    .map((part) => toSafeSegment(part))
+    .filter((part) => part !== '')
+    .join('-');
+
+  return `${parts.root.replace(/\/+$/u, '')}/${name}`;
+}
+
+function toSafeSegment(part: string): string {
+  return part.replaceAll('/', '-').replaceAll(/[^\w.-]/gu, '');
+}

package/src/client/collect-agent-picks.ts

@@ -9,7 +9,8 @@ export interface AgentPick {
 /**
  * The agent choices the spawn and adopt flows offer, in menu order. An agent
  * whose configured binary does not resolve is left out, so every row in the
- * menu is a session that can start. Resolution follows the rule a spawn
+ * menu is a session that can start. A gateway with auth is left out too, since
+ * every start of one is refused. Resolution follows the rule a spawn
  * follows: a bare name comes off PATH, a name carrying a separator is taken
  * as a path, and either way it has to be executable.
  */
@@ -22,7 +23,9 @@ export function collectAgentPicks(config: Config): AgentPick[] {
     { agent: 'claude', label: 'Claude', bin: config.claudeBin },
     { agent: 'grok', label: 'Grok', bin: config.grokBin },
     { agent: 'codex', label: 'Codex', bin: config.codexBin },
-    ...config.gateways.map((g) => ({ agent: g.id, label: g.label, bin: g.bin })),
+    ...config.gateways
+      .filter((g) => g.auth === undefined)
+      .map((g) => ({ agent: g.id, label: g.label, bin: g.bin })),
   ];
 
   return candidates

package/src/client/pick-refusal-step.ts

@@ -0,0 +1,29 @@
+// The steps of the git spawn flow a refused spawn can return to.
+type RefusalStep = 'confirm' | 'destination' | 'ref' | 'source';
+
+const REFUSAL_STEPS: ReadonlyMap<string, RefusalStep> = new Map<string, RefusalStep>([
+  ['workspace_exists', 'destination'],
+  ['ref_not_found', 'ref'],
+  ['invalid_git_url', 'source'],
+  ['credential_in_url', 'source'],
+  ['credential_missing', 'source'],
+  ['clone_failed', 'source'],
+  ['has_submodules', 'confirm'],
+  ['lfs_unsupported', 'confirm'],
+  ['unreadable_tree', 'confirm'],
+  ['sanitize_failed', 'confirm'],
+  ['tar_failed', 'confirm'],
+  ['transfer_failed', 'confirm'],
+  ['workspace_mismatch', 'confirm'],
+]);
+
+/**
+ * The step of the git spawn flow that can fix a workspace spawn's
+ * refusal: the destination for one that already exists, the ref for one
+ * the upstream lacks, the source step for a URL or clone failure, and the
+ * confirm screen for a refusal of the commit or the target's copy of it.
+ * Null for any other refusal, which stays on the step that sent the spawn.
+ */
+export function pickRefusalStep(code: string): RefusalStep | null {
+  return REFUSAL_STEPS.get(code) ?? null;
+}

package/src/client/resolve-workspace-root.ts

@@ -0,0 +1,49 @@
+import type { WorkspacesConfig } from '../shared/collect-workspaces-config';
+import { resolveHomeDir } from '../shared/resolve-home-dir';
+
+type WorkspaceRoot =
+  | { readonly ok: true; readonly root: string }
+  | { readonly ok: false; readonly message: string };
+
+interface RootTarget {
+  readonly id: string;
+
+  // Whether the target is the daemon's own machine, where `~` is this
+  // user's home.
+  readonly inPlace: boolean;
+}
+
+// Where checkouts land on the daemon's own machine without a configured root.
+const DEFAULT_ROOT = '~/.local/share/atc/workspaces';
+
+/**
+ * The directory git workspaces land under on a target: the target's own
+ * root, else the global root, else the default. On the daemon's own
+ * machine a leading `~` expands to the home directory. On any other target
+ * the root must be absolute, since `~` there is a home this client cannot
+ * see, so a root that is not is refused with the config key to set.
+ */
+export function resolveWorkspaceRoot(config: WorkspacesConfig, target: RootTarget): WorkspaceRoot {
+  const configured = config.targetRoots.get(target.id) ?? config.root;
+
+  if (target.inPlace) {
+    const root = expandHome(configured ?? DEFAULT_ROOT);
+
+    return root.startsWith('/')
+      ? { ok: true, root }
+      : { ok: false, message: `workspaces root '${root}' must be an absolute path` };
+  }
+
+  if (configured === null || !configured.startsWith('/')) {
+    return {
+      ok: false,
+      message: `set workspaces.targets.${target.id} in config.json to an absolute path on that target`,
+    };
+  }
+
+  return { ok: true, root: configured };
+}
+
+function expandHome(dir: string): string {
+  return dir === '~' || dir.startsWith('~/') ? `${resolveHomeDir()}${dir.slice(1)}` : dir;
+}