@zgeoff/atc 2.19.0 → 2.20.0

package/src/shared/collect-gateways.ts

@@ -1,13 +1,26 @@
 import { z } from 'zod';
 import type { AgentID } from './agent-id';
 import { buildOptionalStringArray } from './build-optional-string-array';
+import type { AuthProfile } from './collect-auth-profiles';
 import { isRecord } from './report';
+import { resolveAuthProfiles } from './resolve-auth-profiles';
+
+/**
+ * The auth profiles a gateway's sessions are bound to through impd's
+ * broker, and the variables each session gets in place of a credential,
+ * every value the fixed placeholder.
+ */
+export interface GatewayAuth {
+  readonly profiles: readonly string[];
+  readonly placeholderEnv: Readonly<Record<string, string>>;
+}
 
 /**
  * A Claude-compatible backend the Claude CLI is pointed at: its own agent id,
  * its own row in the spawn menu, and its own generated settings file. The
- * credential is never held here — a helper command supplies it at run time,
- * so it stays out of the file atc writes.
+ * credential is never held here: a helper command supplies it at run time,
+ * or, with `auth`, impd's credential broker adds it to each request on the
+ * host's side, so it stays out of the file atc writes.
  */
 export interface GatewayConfig {
   readonly id: AgentID;
@@ -19,6 +32,14 @@ export interface GatewayConfig {
   readonly apiKeyHelper?: string;
   readonly env: Readonly<Record<string, string>>;
   readonly settings?: Readonly<Record<string, unknown>>;
+  readonly auth?: GatewayAuth;
+}
+
+interface Gateways {
+  readonly gateways: GatewayConfig[];
+
+  // The problems that kept a gateway with `auth` out, one per problem.
+  readonly errors: string[];
 }
 
 // Ids the built-in adapters answer to; a gateway may not take one.
@@ -41,18 +62,22 @@ const GATEWAY_ENTRY_SCHEMA = z.object({
 /**
  * Reads the gateway map into menu order. An entry without a base URL, or
  * under an id another adapter already answers to, is left out rather than
- * registered half-formed: every gateway in the result can be spawned.
+ * registered half-formed: every gateway in the result can be spawned. A
+ * gateway with `auth` is checked against the auth profiles, and one that
+ * fails a check is left out with an error for each problem.
  */
 export function collectGateways(
   raw: unknown,
   claudeBin: string,
   claudeArgs: readonly string[],
-): GatewayConfig[] {
+  authProfiles: ReadonlyMap<string, AuthProfile> = new Map(),
+): Gateways {
   if (!isRecord(raw)) {
-    return [];
+    return { gateways: [], errors: [] };
   }
 
   const gateways: GatewayConfig[] = [];
+  const errors: string[] = [];
 
   for (const [id, entry] of Object.entries(raw)) {
     if (id === '' || BUILT_IN_IDS.has(id)) {
@@ -65,6 +90,19 @@ export function collectGateways(
       continue;
     }
 
+    let auth: GatewayAuth | undefined;
+
+    if (isRecord(entry) && entry['auth'] !== undefined) {
+      const checked = checkGatewayAuth(entry['auth'], parsed.data, authProfiles);
+
+      if (Array.isArray(checked)) {
+        errors.push(...checked.map((problem) => `gateways.${id}: ${problem}`));
+        continue;
+      }
+
+      auth = checked;
+    }
+
     const firstOfMark = (parsed.data.mark ?? id).codePointAt(0);
 
     gateways.push({
@@ -79,10 +117,189 @@ export function collectGateways(
       ...(parsed.data.apiKeyHelper === undefined ? {} : { apiKeyHelper: parsed.data.apiKeyHelper }),
       env: parsed.data.env,
       ...(parsed.data.settings === undefined ? {} : { settings: parsed.data.settings }),
+      ...(auth === undefined ? {} : { auth }),
     });
   }
 
-  return gateways;
+  return { gateways, errors };
+}
+
+interface GatewayEntry {
+  readonly baseURL?: string | undefined;
+  readonly apiKeyHelper?: string | undefined;
+  readonly env: Readonly<Record<string, string>>;
+  readonly settings?: Readonly<Record<string, unknown>> | undefined;
+}
+
+// The gateway's auth, or every problem that refuses it. The checks cover
+// each place a session's environment comes from: the gateway env, the
+// settings env, and the placeholders, and which of them would win.
+function checkGatewayAuth(
+  raw: unknown,
+  entry: GatewayEntry,
+  authProfiles: ReadonlyMap<string, AuthProfile>,
+): GatewayAuth | string[] {
+  const auth = parseGatewayAuth(raw);
+
+  if (typeof auth === 'string') {
+    return [auth];
+  }
+
+  const problems: string[] = [];
+
+  if (entry.apiKeyHelper !== undefined) {
+    problems.push(
+      'apiKeyHelper cannot be set together with auth, which supplies the credential through the broker',
+    );
+  }
+
+  if (entry.settings?.['apiKeyHelper'] !== undefined) {
+    problems.push(
+      'settings.apiKeyHelper cannot be set together with auth, which supplies the credential through the broker',
+    );
+  }
+
+  const settingsEnv = toEnvKeys(entry.settings?.['env']);
+
+  problems.push(
+    ...collectEnvProblems('env', Object.keys(entry.env)),
+    ...collectEnvProblems('settings.env', settingsEnv),
+    ...collectPlaceholderProblems(auth.placeholderEnv),
+  );
+
+  for (const key of Object.keys(auth.placeholderEnv)) {
+    for (const [source, keys] of [
+      ['env', Object.keys(entry.env)],
+      ['settings.env', settingsEnv],
+    ] as const) {
+      if (keys.includes(key)) {
+        problems.push(`placeholderEnv.${key} is also set in ${source}, which would override it`);
+      }
+    }
+  }
+
+  const resolution = resolveAuthProfiles(authProfiles, auth.profiles);
+
+  if ('problem' in resolution) {
+    problems.push(resolution.problem.message);
+  } else {
+    const hostProblem = findBaseURLProblem(entry.baseURL ?? '', resolution.resolved.hosts);
+
+    if (hostProblem !== null) {
+      problems.push(hostProblem);
+    }
+  }
+
+  return problems.length > 0 ? problems : auth;
+}
+
+// The value every placeholder variable holds; impd's broker swaps the real
+// credential in on the host's side.
+const PLACEHOLDER = 'imp-broker-placeholder';
+
+function parseGatewayAuth(raw: unknown): GatewayAuth | string {
+  const profiles = isRecord(raw) ? raw['profiles'] : undefined;
+
+  if (
+    !isRecord(raw) ||
+    !Array.isArray(profiles) ||
+    profiles.length === 0 ||
+    !profiles.every((name) => typeof name === 'string')
+  ) {
+    return 'auth must be an object with a non-empty profiles array';
+  }
+
+  const placeholderEnv = raw['placeholderEnv'] ?? {};
+
+  if (!isRecord(placeholderEnv) || Array.isArray(placeholderEnv)) {
+    return 'placeholderEnv must be an object of variable names';
+  }
+
+  const env: Record<string, string> = {};
+
+  for (const [key, value] of Object.entries(placeholderEnv)) {
+    if (value !== PLACEHOLDER) {
+      return `placeholderEnv.${key} must be ${PLACEHOLDER}`;
+    }
+
+    env[key] = value;
+  }
+
+  return { profiles: profiles.map(String), placeholderEnv: env };
+}
+
+// A settings env's variable names; anything but an object sets none.
+function toEnvKeys(value: unknown): string[] {
+  return isRecord(value) && !Array.isArray(value) ? Object.keys(value) : [];
+}
+
+// Variables Claude reads its endpoint and credential from. Only the
+// placeholders may set a credential variable, and the base URL comes from
+// `baseURL` alone, whose host is checked against the profiles.
+const CREDENTIAL_VARIABLES: ReadonlySet<string> = new Set([
+  'ANTHROPIC_AUTH_TOKEN',
+  'ANTHROPIC_API_KEY',
+]);
+
+const BASE_URL_VARIABLE = 'ANTHROPIC_BASE_URL';
+
+function collectEnvProblems(source: string, keys: readonly string[]): string[] {
+  return keys
+    .filter(
+      (key) => isBrokerVariable(key) || CREDENTIAL_VARIABLES.has(key) || key === BASE_URL_VARIABLE,
+    )
+    .map((key) => `${source} must not set ${key}`);
+}
+
+// Variables impd sets in a brokered exec to route requests through the
+// broker and trust its CA. impd lets a variable the caller sets win, so a
+// configured one would route around the broker or mask a failed CA install.
+const BROKER_VARIABLES: ReadonlySet<string> = new Set([
+  'HTTPS_PROXY',
+  'HTTP_PROXY',
+  'ALL_PROXY',
+  'NO_PROXY',
+  'NODE_USE_ENV_PROXY',
+  'SSL_CERT_FILE',
+  'SSL_CERT_DIR',
+  'NODE_EXTRA_CA_CERTS',
+  'GIT_SSL_CAINFO',
+  'REQUESTS_CA_BUNDLE',
+  'CURL_CA_BUNDLE',
+]);
+
+// Proxy and CA variables are read in either case by some clients.
+function isBrokerVariable(key: string): boolean {
+  return BROKER_VARIABLES.has(key.toUpperCase());
+}
+
+function collectPlaceholderProblems(env: Readonly<Record<string, string>>): string[] {
+  return Object.keys(env)
+    .filter((key) => isBrokerVariable(key) || key === BASE_URL_VARIABLE)
+    .map((key) => `placeholderEnv must not set ${key}`);
+}
+
+// The broker matches a request by the exact host it connects to on the
+// default https port, so the base URL must be https on that port, with a
+// host one of the selected profiles covers.
+function findBaseURLProblem(baseURL: string, hosts: readonly string[]): string | null {
+  let url: URL;
+
+  try {
+    url = new URL(baseURL);
+  } catch {
+    return 'baseURL must be an https URL with no port or user info';
+  }
+
+  if (url.protocol !== 'https:' || url.port !== '' || url.username !== '' || url.password !== '') {
+    return 'baseURL must be an https URL with no port or user info';
+  }
+
+  if (!hosts.includes(url.hostname)) {
+    return `baseURL host ${url.hostname} is not a host of the selected profiles (${hosts.join(', ')})`;
+  }
+
+  return null;
 }
 
 // Claude Code settings the sessions of this gateway are started with, on top of

package/src/shared/config.ts

@@ -3,6 +3,8 @@ import { dirname, join } from 'node:path';
 import { z } from 'zod';
 import { buildOptionalString } from './build-optional-string';
 import { buildOptionalStringArray } from './build-optional-string-array';
+import { collectAuthProfiles } from './collect-auth-profiles';
+import type { AuthProfile } from './collect-auth-profiles';
 import { collectDirRoots } from './collect-dir-roots';
 import { collectGateways } from './collect-gateways';
 import type { GatewayConfig } from './collect-gateways';
@@ -28,6 +30,14 @@ export interface Config {
   dirs: DirsConfig;
   workspaces: WorkspacesConfig;
   gateways: GatewayConfig[];
+
+  // The problems that kept a gateway with auth out of the gateways.
+  gatewayErrors: readonly string[];
+
+  // The credential references a gateway's auth selects from, by profile
+  // name, and the problems that kept a profile out.
+  authProfiles: ReadonlyMap<string, AuthProfile>;
+  authProfileErrors: readonly string[];
   hooks: HooksConfig;
   leader: LeaderKey;
 
@@ -78,6 +88,9 @@ const DEFAULTS: Config = {
     targetRoots: new Map(),
   },
   gateways: [],
+  gatewayErrors: [],
+  authProfiles: new Map(),
+  authProfileErrors: [],
   hooks: {},
   leader: { code: 0, label: '^Space' },
   targets: [{ id: 'local', provider: 'local-pty', options: {} }],
@@ -118,6 +131,7 @@ const CONFIG_SCHEMA = z.object({
   dirs: z.unknown().optional(),
   workspaces: z.unknown().optional(),
   gateways: z.unknown().optional(),
+  authProfiles: z.unknown().optional(),
   hooks: z.unknown().optional(),
   leader: buildOptionalString(),
   targets: z.unknown().optional(),
@@ -206,11 +220,14 @@ function tryWriteDefaultConfig(file: string): void {
 /**
  * The config.json text a first run writes. It leaves out the targets and
  * principals, so the file holds the one implicit `local` target and no
- * principals until the user sets their own, and the errors a parse
- * reports, which belong to no file.
+ * principals until the user sets their own, no auth profiles, and the
+ * errors a parse reports, which belong to no file.
  */
 export function renderDefaultConfig(): string {
   const {
+    gatewayErrors: _gatewayErrors,
+    authProfiles: _authProfiles,
+    authProfileErrors: _authProfileErrors,
     targets: _targets,
     defaultTarget: _default,
     targetErrors: _errors,
@@ -266,7 +283,15 @@ export function parseConfig(raw: unknown, file: string = configFile): Config {
   const codexArgs = parsed.data.codexArgs ?? DEFAULTS.codexArgs;
   const dirs = { roots: collectDirRoots(parsed.data.dirs) };
   const workspaces = collectWorkspacesConfig(parsed.data.workspaces);
-  const gateways = collectGateways(parsed.data.gateways, claudeBin, claudeArgs);
+  const authProfiles = collectAuthProfiles(parsed.data.authProfiles);
+
+  const gateways = collectGateways(
+    parsed.data.gateways,
+    claudeBin,
+    claudeArgs,
+    authProfiles.profiles,
+  );
+
   const hooks = collectHooks(parsed.data.hooks);
   const targets = collectTargets(parsed.data.targets, parsed.data.defaultTarget);
   const principals = collectPrincipals(parsed.data.principals);
@@ -283,7 +308,10 @@ export function parseConfig(raw: unknown, file: string = configFile): Config {
     codexArgs,
     dirs,
     workspaces: workspaces.workspaces,
-    gateways,
+    gateways: gateways.gateways,
+    gatewayErrors: gateways.errors,
+    authProfiles: authProfiles.profiles,
+    authProfileErrors: authProfiles.errors,
     hooks,
     leader,
     targets: targets.targets,

package/src/shared/resolve-auth-profiles.ts

@@ -0,0 +1,186 @@
+import type { AuthProfile } from './collect-auth-profiles';
+
+/**
+ * How impd applies one secret to requests for one host.
+ */
+interface AuthRule {
+  readonly host: string;
+  readonly header: string;
+  readonly scheme: 'bearer';
+}
+
+/**
+ * One secret and the complete set of rules a selection needs impd to hold
+ * for it, one per host, sorted by host.
+ */
+export interface ResolvedAuthSecret {
+  readonly secret: string;
+  readonly kind: 'custom';
+  readonly rules: readonly AuthRule[];
+}
+
+/**
+ * A selection with its dependencies expanded: every profile it reaches,
+ * every host those profiles send a credential to, and the rules grouped by
+ * secret, each list sorted so two selections of the same profiles resolve
+ * the same.
+ */
+interface ResolvedAuthProfiles {
+  readonly profiles: readonly string[];
+  readonly hosts: readonly string[];
+  readonly secrets: readonly ResolvedAuthSecret[];
+}
+
+/**
+ * Why a selection cannot be bound:
+ *
+ * - `auth_profile_unknown`: it reaches a profile that is missing or that
+ *   the config refused.
+ * - `auth_dependency_cycle`: the dependencies loop back on themselves.
+ * - `auth_collision`: two profiles send different credentials or rules to
+ *   one host, which impd could not tell apart.
+ */
+export interface AuthProfileProblem {
+  readonly code: 'auth_profile_unknown' | 'auth_dependency_cycle' | 'auth_collision';
+  readonly message: string;
+}
+
+export type AuthProfileResolution =
+  | { readonly resolved: ResolvedAuthProfiles }
+  | { readonly problem: AuthProfileProblem };
+
+/**
+ * Expands the selected profiles through their dependencies, then checks
+ * the whole expanded set: each host must get exactly one rule, so a
+ * credential is never picked by order. Two profiles holding the identical
+ * secret and rule for a host merge into one rule.
+ */
+export function resolveAuthProfiles(
+  profiles: ReadonlyMap<string, AuthProfile>,
+  selected: readonly string[],
+): AuthProfileResolution {
+  let reached: ReadonlyMap<string, AuthProfile> = new Map();
+
+  for (const name of selected) {
+    const next = collectReached(profiles, name, null, [], reached);
+
+    if (isAuthProfileProblem(next)) {
+      return { problem: next };
+    }
+
+    reached = next;
+  }
+
+  const ordered = [...reached.values()].toSorted((a, b) => (a.name < b.name ? -1 : 1));
+
+  const byHost = new Map<string, AuthProfile>();
+
+  for (const profile of ordered) {
+    const other = byHost.get(profile.host);
+
+    if (other === undefined) {
+      byHost.set(profile.host, profile);
+    } else if (!hasSameRule(other, profile)) {
+      return {
+        problem: {
+          code: 'auth_collision',
+          message: `profiles ${other.name} and ${profile.name} both send a credential to ${profile.host}`,
+        },
+      };
+    }
+  }
+
+  return {
+    resolved: {
+      profiles: ordered.map((profile) => profile.name),
+      hosts: [...byHost.keys()].toSorted(),
+      secrets: buildSecrets([...byHost.values()]),
+    },
+  };
+}
+
+// Depth-first over the dependencies from one name: returns `reached` plus
+// every profile this name reaches, each added once its own dependencies are
+// done. A profile already reached is not walked again, so a shared
+// dependency costs one visit.
+// `path` holds the names on the way here, so a name already on it closes a
+// cycle.
+function collectReached(
+  profiles: ReadonlyMap<string, AuthProfile>,
+  name: string,
+  from: string | null,
+  path: readonly string[],
+  reached: ReadonlyMap<string, AuthProfile>,
+): ReadonlyMap<string, AuthProfile> | AuthProfileProblem {
+  if (path.includes(name)) {
+    return {
+      code: 'auth_dependency_cycle',
+      message: `profile dependencies form a cycle: ${[...path.slice(path.indexOf(name)), name].join(' -> ')}`,
+    };
+  }
+
+  if (reached.has(name)) {
+    return reached;
+  }
+
+  const profile = profiles.get(name);
+
+  if (profile === undefined) {
+    return {
+      code: 'auth_profile_unknown',
+      message:
+        from === null
+          ? `profile ${name} is selected, but authProfiles has no usable profile by that name`
+          : `profile ${from} depends on ${name}, but authProfiles has no usable profile by that name`,
+    };
+  }
+
+  let next = reached;
+
+  for (const dependency of profile.dependencies) {
+    const after = collectReached(profiles, dependency, name, [...path, name], next);
+
+    if (isAuthProfileProblem(after)) {
+      return after;
+    }
+
+    next = after;
+  }
+
+  return new Map([...next, [name, profile]]);
+}
+
+function isAuthProfileProblem(
+  value: ReadonlyMap<string, AuthProfile> | AuthProfileProblem,
+): value is AuthProfileProblem {
+  return 'code' in value;
+}
+
+function hasSameRule(left: AuthProfile, right: AuthProfile): boolean {
+  return (
+    left.secret === right.secret &&
+    left.header === right.header &&
+    left.scheme === right.scheme &&
+    left.kind === right.kind
+  );
+}
+
+// One entry per secret, sorted by secret, each with its rules sorted by host.
+function buildSecrets(profiles: readonly AuthProfile[]): ResolvedAuthSecret[] {
+  const rules = new Map<string, AuthRule[]>();
+
+  for (const profile of profiles) {
+    const list = rules.get(profile.secret) ?? [];
+
+    list.push({ host: profile.host, header: profile.header, scheme: profile.scheme });
+    rules.set(profile.secret, list);
+  }
+
+  return [...rules.entries()]
+    .toSorted(([a], [b]) => (a < b ? -1 : 1))
+    .map(([secret, list]) => ({
+      secret,
+      kind: 'custom',
+      rules: list.toSorted((a, b) => (a.host < b.host ? -1 : 1)),
+    }));
+}

package/src/store/run-migrations.ts

@@ -5,6 +5,7 @@ import { DEFAULT_MIGRATION_TABLE, Migrator } from 'kysely/migration';
 import type { Migration, MigrationProvider, MigrationResultSet } from 'kysely/migration';
 import type { IdempotencyState } from './idempotency-record';
 import type { MessageStatus } from './message-record';
+import type { RuntimeAuthBindingState, RuntimeAuthGrantPhase } from './runtime-auth-binding';
 import type { MaterializationPhase } from './workspace-materialization';
 
 interface FleetTable {
@@ -118,6 +119,41 @@ interface WorkspaceMaterializationTable {
   withheld_env: string | null;
 }
 
+// One host's runtime auth binding, keyed by the session that owns the imp.
+// The rebind columns hold a rebind in flight or the one that failed, all
+// null otherwise.
+interface RuntimeAuthBindingTable {
+  host_key: string;
+  target: string;
+  target_identity: string;
+  imp_name: string;
+  imp_id: string | null;
+  revision: number;
+  binding_hash: string;
+  binding_json: string;
+  state: RuntimeAuthBindingState;
+  attempt_id: string;
+  imp_created_by_attempt: number;
+  rebind_revision: number | null;
+  rebind_binding_hash: string | null;
+  rebind_binding_json: string | null;
+  rebind_attempt_id: string | null;
+  created_at: number;
+  updated_at: number;
+  revoked_at: number | null;
+}
+
+// One secret's grant to a host's imp, keyed by the host and the secret.
+interface RuntimeAuthGrantTable {
+  host_key: string;
+  secret: string;
+  revision: number;
+  attempt_id: string;
+  preexisting: number;
+  phase: RuntimeAuthGrantPhase;
+  updated_at: number;
+}
+
 interface MessagesTable {
   id: string;
   atc_id: string;
@@ -148,6 +184,8 @@ export interface StateStoreSchema {
   session_owner: SessionOwnerTable;
   idempotency: IdempotencyTable;
   workspace_materialization: WorkspaceMaterializationTable;
+  runtime_auth_binding: RuntimeAuthBindingTable;
+  runtime_auth_grant: RuntimeAuthGrantTable;
 }
 
 // Every shape the fleet table has shipped with: the oldest carries only
@@ -472,6 +510,45 @@ const MIGRATIONS: Record<string, Migration> = {
       }
     },
   },
+  '025_create_runtime_auth': {
+    async up(db: Kysely<StateStoreSchema>) {
+      await db.schema
+        .createTable('runtime_auth_binding')
+        .ifNotExists()
+        .addColumn('host_key', 'text', (c) => c.primaryKey())
+        .addColumn('target', 'text', (c) => c.notNull())
+        .addColumn('target_identity', 'text', (c) => c.notNull())
+        .addColumn('imp_name', 'text', (c) => c.notNull())
+        .addColumn('imp_id', 'text')
+        .addColumn('revision', 'integer', (c) => c.notNull())
+        .addColumn('binding_hash', 'text', (c) => c.notNull())
+        .addColumn('binding_json', 'text', (c) => c.notNull())
+        .addColumn('state', 'text', (c) => c.notNull())
+        .addColumn('attempt_id', 'text', (c) => c.notNull())
+        .addColumn('imp_created_by_attempt', 'integer', (c) => c.notNull().defaultTo(0))
+        .addColumn('rebind_revision', 'integer')
+        .addColumn('rebind_binding_hash', 'text')
+        .addColumn('rebind_binding_json', 'text')
+        .addColumn('rebind_attempt_id', 'text')
+        .addColumn('created_at', 'integer', (c) => c.notNull())
+        .addColumn('updated_at', 'integer', (c) => c.notNull())
+        .addColumn('revoked_at', 'integer')
+        .execute();
+
+      await db.schema
+        .createTable('runtime_auth_grant')
+        .ifNotExists()
+        .addColumn('host_key', 'text', (c) => c.notNull())
+        .addColumn('secret', 'text', (c) => c.notNull())
+        .addColumn('revision', 'integer', (c) => c.notNull())
+        .addColumn('attempt_id', 'text', (c) => c.notNull())
+        .addColumn('preexisting', 'integer', (c) => c.notNull())
+        .addColumn('phase', 'text', (c) => c.notNull())
+        .addColumn('updated_at', 'integer', (c) => c.notNull())
+        .addPrimaryKeyConstraint('runtime_auth_grant_pk', ['host_key', 'secret'])
+        .execute();
+    },
+  },
 };
 
 const PROVIDER: MigrationProvider = {