@zgeoff/atc 2.19.0 → 2.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.19.0",
+  "version": "2.22.0",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",

package/src/agents/agent-adapter.ts

@@ -1,4 +1,5 @@
 import type { AdapterEvent } from '../protocol/adapter-event';
+import type { DaemonError } from '../protocol/daemon-error';
 import type { HookEvent } from '../protocol/hook-event';
 import type { AgentID } from '../shared/agent-id';
 import type { AgentSessionID } from '../shared/agent-session-id';
@@ -205,6 +206,10 @@ export interface AgentAdapter {
   // Absent: the agent runs there as a local spawn plans it, with no files.
   readonly planGuestSpawn?: (opts: SpawnOptions, guest: GuestPaths) => GuestSpawnPlan | null;
 
+  // The refusal every start of this agent's harness gets, on any target,
+  // or null when it may start. Absent: no start is refused.
+  readonly findSpawnRefusal?: () => DaemonError | null;
+
   // The command that exits 0 inside a remote host when the agent there can
   // sign in without a person. Absent: atc runs no check.
   readonly planAuthCheck?: () => readonly string[];

package/src/agents/gateway-adapter.ts

@@ -1,4 +1,5 @@
 import type { AdapterEvent } from '../protocol/adapter-event';
+import { DaemonError } from '../protocol/daemon-error';
 import type { HookEvent } from '../protocol/hook-event';
 import type { AgentID } from '../shared/agent-id';
 import type { AgentSessionID } from '../shared/agent-session-id';
@@ -39,7 +40,8 @@ export class GatewayAdapter implements AgentAdapter {
   readonly id: AgentID;
 
   // A headless turn carries the same settings file the terminal spawn does,
-  // so it reaches this backend rather than the default one.
+  // so it reaches this backend rather than the default one. A gateway whose
+  // credential comes through impd's broker runs no headless turn.
   readonly headlessRunner: HeadlessRunner | null;
 
   // The CLI's hooks are authoritative; no screen heuristics needed.
@@ -90,7 +92,7 @@ export class GatewayAdapter implements AgentAdapter {
     this.claude = new ClaudeAdapter(config);
 
     this.headlessRunner =
-      headlessRun === null
+      headlessRun === null || gateway.auth !== undefined
         ? null
         : makeClaudeHeadlessRunner(headlessRun, {
             claudeBin: gateway.bin,
@@ -100,6 +102,21 @@ export class GatewayAdapter implements AgentAdapter {
           });
   }
 
+  // A gateway whose credential comes through impd's broker never starts
+  // until the broker path exists: started without it, the CLI would send
+  // whatever credential it holds to the gateway's host.
+  findSpawnRefusal(): DaemonError | null {
+    if (this.gateway.auth === undefined) {
+      return null;
+    }
+
+    return new DaemonError(
+      'auth_target_unsupported',
+      `gateway '${this.id}' takes its credential from impd's broker, and brokered credentials are not wired yet`,
+      { agent: this.id },
+    );
+  }
+
   planSpawn(opts: SpawnOptions): SpawnPlan {
     return {
       bin: this.gateway.bin,
@@ -142,7 +159,13 @@ export class GatewayAdapter implements AgentAdapter {
   // explicit flag, so that mode overrides the one the CLI would restore, and
   // the generated settings file, because
   // without it the CLI would resume the session against the default backend.
+  // A gateway whose credential comes through impd's broker has none, since
+  // outside atc the broker never reaches it.
   buildResumeCommand(cwd: string, agentSessionID: AgentSessionID | undefined): string | null {
+    if (this.gateway.auth !== undefined) {
+      return null;
+    }
+
     const args = [
       ...this.gateway.args,
       ...buildRestoreModeArgs(this.gateway.args, this.gateway.settings),

package/src/cli.ts

@@ -3,10 +3,23 @@
 import { defineCommand, runMain } from 'citty';
 import pkg from '../package.json';
 import { collectRedirectURIs } from './collect-redirect-uris';
+import { parseListenAddress } from './daemon/parse-listen-address';
 import { normalizeCLIArgs } from './normalize-cli-args';
 import { parsePort } from './parse-port';
 import { getBuild } from './shared/get-build';
 
+// The flags `atc daemon` takes.
+const DAEMON_ARGS = {
+  listen: {
+    type: 'string',
+    description: 'Serve the client protocol on <host>:<port> too, a loopback or tailnet address',
+  },
+  'token-file': {
+    type: 'string',
+    description: 'File holding the one or two bearer tokens a --listen handshake must present',
+  },
+} as const;
+
 const main = defineCommand({
   meta: {
     name: 'atc',
@@ -152,122 +165,36 @@ const main = defineCommand({
           name: 'daemon',
           description: 'Run the atc daemon in the foreground',
         },
-        async run() {
-          const daemon = await import('./daemon/daemon');
-          const config = await import('./shared/config');
-          const claude = await import('./agents/claude-adapter');
-          const grok = await import('./agents/grok-adapter');
-          const codex = await import('./agents/codex-adapter');
-          const gateway = await import('./agents/gateway-adapter');
-          const headless = await import('./agents/start-claude-headless-run');
-          const targets = await import('./daemon/build-execution-targets');
-          const sourceOrder = await import('./sources/build-sources');
-          const builtinSources = await import('./sources/collect-builtin-sources');
-          const zoxide = await import('./shared/collect-zoxide-dirs');
-          const home = await import('./shared/resolve-home-dir');
-
-          // Test harnesses shrink the outbound queue to force overflow
-          // deterministically; unset means the production default.
-          const queueBytes = Number(process.env['ATC_QUEUE_BYTES']);
-          const cfg = config.loadConfig();
-          const built = targets.buildExecutionTargets(cfg.targets);
-          const targetErrors = [...cfg.targetErrors, ...built.errors];
-
-          for (const error of targetErrors) {
-            const line =
-              error.scope === 'config'
-                ? `${error.path} cannot be used (${error.problem}: ${error.detail}); every spawn is refused, local ones included, until it is fixed`
-                : error.problem;
-
-            console.error(`atc daemon: config: ${line}`);
-          }
-
-          for (const problem of [...cfg.principalErrors, ...cfg.workspaceErrors]) {
-            console.error(`atc daemon: config: ${problem}`);
-          }
 
-          const sources = sourceOrder.buildSources(
-            builtinSources.collectBuiltinSources({
-              roots: cfg.dirs.roots,
-              githubOwner: cfg.workspaces.githubOwner,
-              ghBin: 'gh',
-              homeDir: home.resolveHomeDir(),
-              collectZoxideDirs: zoxide.collectZoxideDirs,
+        // Declared here as well as on `serve`, so the parser skips their
+        // values when it looks for a subcommand name.
+        args: DAEMON_ARGS,
+        default: 'serve',
+        subCommands: {
+          serve: () =>
+            defineCommand({
+              meta: {
+                name: 'serve',
+                description: 'Run the atc daemon in the foreground',
+                hidden: true,
+              },
+              args: DAEMON_ARGS,
+              async run(ctx) {
+                await runDaemon(ctx.args.listen ?? null, ctx.args['token-file'] ?? null);
+              },
             }),
-            cfg.workspaces.sources,
-          );
-
-          for (const id of sources.missing) {
-            console.error(
-              `atc daemon: config: workspaces.sources holds '${id}', which this daemon cannot offer; the picker leaves it out`,
-            );
-          }
-
-          // Cap on how long a fleet restore waits for one revived session to
-          // report it has booted before moving to the next. Tests pin it to
-          // keep timing deterministic; unset means the production default.
-          const capOverride = Number(process.env['ATC_RESTORE_BOOT_TIMEOUT_MS']);
-
-          const restoreBootTimeoutMs =
-            Number.isFinite(capOverride) && capOverride >= 0 ? capOverride : 15_000;
-
-          // How long a started session may go without a tap before a message
-          // to it is refused. Tests pin it to 0 to reach the refusal at once.
-          const graceOverride = Number(process.env['ATC_TAP_GRACE_MS']);
-
-          const claudeAdapter = new claude.ClaudeAdapter(cfg, headless.startClaudeHeadlessRun);
-          const grokAdapter = new grok.GrokAdapter(cfg);
-          const codexAdapter = new codex.CodexAdapter(cfg);
-
-          const gatewayAdapters = cfg.gateways.map(
-            (entry) => new gateway.GatewayAdapter(entry, cfg, headless.startClaudeHeadlessRun),
-          );
-
-          let handle: Awaited<ReturnType<typeof daemon.startDaemon>>;
-
-          try {
-            handle = await daemon.startDaemon({
-              socketPath: config.daemonSocketPath,
-              reporterSocketPath: config.socketPath,
-              eventsSocketPath: config.eventsSocketPath,
-              build: getBuild(),
-              adapter: claudeAdapter,
-              adapters: [claudeAdapter, grokAdapter, codexAdapter, ...gatewayAdapters],
-              dbPath: config.dbFile,
-              legacyFleetPath: config.legacyFleetFile,
-              pidPath: config.daemonPidFile,
-              hooks: cfg.hooks,
-              targets: built.targets,
-              defaultTarget: cfg.defaultTarget,
-              targetErrors,
-              principals: cfg.principals,
-              sources: sources.sources,
-              gitTransports: cfg.workspaces.gitTransports,
-              restoreBootTimeoutMs,
-              ...(Number.isFinite(graceOverride) && graceOverride >= 0
-                ? { tapGraceMs: graceOverride }
-                : {}),
-              ...(Number.isFinite(queueBytes) && queueBytes > 0 ? { queueBytes } : {}),
-              onQuit: () => process.exit(0),
-            });
-          } catch (error) {
-            // A second daemon on the same state directory refuses to start
-            // and touches nothing; any other startup failure stays a crash.
-            if (error instanceof Error && Reflect.get(error, 'code') === 'daemon_locked') {
-              console.error(error.message);
-              process.exit(1);
-            }
-
-            throw error;
-          }
-
-          process.on('SIGTERM', () => {
-            void (async () => {
-              await handle.stop();
+          id: () =>
+            defineCommand({
+              meta: {
+                name: 'id',
+                description: "Print the running daemon's daemonID",
+              },
+              async run() {
+                const id = await import('./run-daemon-id');
 
-              process.exit(0);
-            })();
-          });
+                await id.runDaemonID(getBuild());
+              },
+            }),
         },
       }),
     events: () =>
@@ -395,4 +322,151 @@ const main = defineCommand({
   },
 });
 
+// Runs the daemon in the foreground until SIGTERM, with a TCP listener when
+// --listen and --token-file are given.
+async function runDaemon(listenArg: string | null, tokenFile: string | null): Promise<void> {
+  if ((listenArg === null) !== (tokenFile === null)) {
+    console.error('atc daemon: --listen and --token-file go together');
+    process.exit(1);
+  }
+
+  const listen = listenArg === null ? null : parseListenAddress(listenArg);
+
+  if (listen !== null && !listen.ok) {
+    console.error(`atc daemon: ${listen.message}`);
+    process.exit(1);
+  }
+
+  const daemon = await import('./daemon/daemon');
+  const config = await import('./shared/config');
+  const claude = await import('./agents/claude-adapter');
+  const grok = await import('./agents/grok-adapter');
+  const codex = await import('./agents/codex-adapter');
+  const gateway = await import('./agents/gateway-adapter');
+  const headless = await import('./agents/start-claude-headless-run');
+  const targets = await import('./daemon/build-execution-targets');
+  const sourceOrder = await import('./sources/build-sources');
+  const builtinSources = await import('./sources/collect-builtin-sources');
+  const zoxide = await import('./shared/collect-zoxide-dirs');
+  const home = await import('./shared/resolve-home-dir');
+
+  // Test harnesses shrink the outbound queue to force overflow
+  // deterministically; unset means the production default.
+  const queueBytes = Number(process.env['ATC_QUEUE_BYTES']);
+  const cfg = config.loadConfig();
+  const built = targets.buildExecutionTargets(cfg.targets);
+  const targetErrors = [...cfg.targetErrors, ...built.errors];
+
+  for (const error of targetErrors) {
+    const line =
+      error.scope === 'config'
+        ? `${error.path} cannot be used (${error.problem}: ${error.detail}); every spawn is refused, local ones included, until it is fixed`
+        : error.problem;
+
+    console.error(`atc daemon: config: ${line}`);
+  }
+
+  for (const problem of [
+    ...cfg.principalErrors,
+    ...cfg.workspaceErrors,
+    ...cfg.authProfileErrors,
+    ...cfg.gatewayErrors,
+  ]) {
+    console.error(`atc daemon: config: ${problem}`);
+  }
+
+  const sources = sourceOrder.buildSources(
+    builtinSources.collectBuiltinSources({
+      roots: cfg.dirs.roots,
+      githubOwner: cfg.workspaces.githubOwner,
+      ghBin: 'gh',
+      homeDir: home.resolveHomeDir(),
+      collectZoxideDirs: zoxide.collectZoxideDirs,
+    }),
+    cfg.workspaces.sources,
+  );
+
+  for (const id of sources.missing) {
+    console.error(
+      `atc daemon: config: workspaces.sources holds '${id}', which this daemon cannot offer; the picker leaves it out`,
+    );
+  }
+
+  // Cap on how long a fleet restore waits for one revived session to
+  // report it has booted before moving to the next. Tests pin it to
+  // keep timing deterministic; unset means the production default.
+  const capOverride = Number(process.env['ATC_RESTORE_BOOT_TIMEOUT_MS']);
+
+  const restoreBootTimeoutMs =
+    Number.isFinite(capOverride) && capOverride >= 0 ? capOverride : 15_000;
+
+  // How long a started session may go without a tap before a message
+  // to it is refused. Tests pin it to 0 to reach the refusal at once.
+  const graceOverride = Number(process.env['ATC_TAP_GRACE_MS']);
+
+  const claudeAdapter = new claude.ClaudeAdapter(cfg, headless.startClaudeHeadlessRun);
+  const grokAdapter = new grok.GrokAdapter(cfg);
+  const codexAdapter = new codex.CodexAdapter(cfg);
+
+  const gatewayAdapters = cfg.gateways.map(
+    (entry) => new gateway.GatewayAdapter(entry, cfg, headless.startClaudeHeadlessRun),
+  );
+
+  let handle: Awaited<ReturnType<typeof daemon.startDaemon>>;
+
+  try {
+    handle = await daemon.startDaemon({
+      socketPath: config.daemonSocketPath,
+      reporterSocketPath: config.socketPath,
+      eventsSocketPath: config.eventsSocketPath,
+      build: getBuild(),
+      adapter: claudeAdapter,
+      adapters: [claudeAdapter, grokAdapter, codexAdapter, ...gatewayAdapters],
+      dbPath: config.dbFile,
+      legacyFleetPath: config.legacyFleetFile,
+      pidPath: config.daemonPidFile,
+      hooks: cfg.hooks,
+      targets: built.targets,
+      defaultTarget: cfg.defaultTarget,
+      targetErrors,
+      principals: cfg.principals,
+      sources: sources.sources,
+      gitTransports: cfg.workspaces.gitTransports,
+      ...(listen === null || tokenFile === null
+        ? {}
+        : { listen: { host: listen.host, port: listen.port, tokenFile } }),
+      restoreBootTimeoutMs,
+      ...(Number.isFinite(graceOverride) && graceOverride >= 0
+        ? { tapGraceMs: graceOverride }
+        : {}),
+      ...(Number.isFinite(queueBytes) && queueBytes > 0 ? { queueBytes } : {}),
+      onQuit: () => process.exit(0),
+    });
+  } catch (error) {
+    // A second daemon on the same state directory, or a listener whose
+    // address or token file is refused or whose bind fails, stops the start
+    // with nothing left held; any other startup failure stays a crash.
+    const code: unknown = error instanceof Error ? Reflect.get(error, 'code') : null;
+
+    if (error instanceof Error && (code === 'daemon_locked' || code === 'listen_refused')) {
+      console.error(error.message);
+      process.exit(1);
+    }
+
+    throw error;
+  }
+
+  process.on('SIGHUP', () => {
+    handle.refreshTokens();
+  });
+
+  process.on('SIGTERM', () => {
+    void (async () => {
+      await handle.stop();
+
+      process.exit(0);
+    })();
+  });
+}
+
 await runMain(main, { rawArgs: normalizeCLIArgs(process.argv.slice(2)) });

package/src/client/collect-agent-picks.ts

@@ -9,7 +9,8 @@ export interface AgentPick {
 /**
  * The agent choices the spawn and adopt flows offer, in menu order. An agent
  * whose configured binary does not resolve is left out, so every row in the
- * menu is a session that can start. Resolution follows the rule a spawn
+ * menu is a session that can start. A gateway with auth is left out too, since
+ * every start of one is refused. Resolution follows the rule a spawn
  * follows: a bare name comes off PATH, a name carrying a separator is taken
  * as a path, and either way it has to be executable.
  */
@@ -22,7 +23,9 @@ export function collectAgentPicks(config: Config): AgentPick[] {
     { agent: 'claude', label: 'Claude', bin: config.claudeBin },
     { agent: 'grok', label: 'Grok', bin: config.grokBin },
     { agent: 'codex', label: 'Codex', bin: config.codexBin },
-    ...config.gateways.map((g) => ({ agent: g.id, label: g.label, bin: g.bin })),
+    ...config.gateways
+      .filter((g) => g.auth === undefined)
+      .map((g) => ({ agent: g.id, label: g.label, bin: g.bin })),
   ];
 
   return candidates

package/src/client/daemon-client.ts

@@ -1,3 +1,4 @@
+import type { SocketHandler } from 'bun';
 import type { DaemonChannel } from '../protocol/daemon-channel';
 import { DaemonError } from '../protocol/daemon-error';
 import { LineDecoder } from '../protocol/line-decoder';
@@ -34,25 +35,30 @@ export class DaemonClient implements DaemonChannel {
   // once instead of waiting on a response that can never arrive.
   private closedReason: string | null = null;
 
-  static async open(socketPath: string): Promise<DaemonClient> {
+  // Connects to the daemon at a unix socket path, or at a TCP address.
+  static async open(
+    address: string | { readonly hostname: string; readonly port: number },
+  ): Promise<DaemonClient> {
     const client = new DaemonClient();
 
-    const socket = await Bun.connect({
-      unix: socketPath,
-      socket: {
-        data(_s, buf) {
-          client.applyChunk(buf);
-        },
-        drain() {
-          client.queue?.drain();
-        },
-        close() {
-          client.drainPending('connection closed');
-          client.onClose();
-        },
-        error() {},
+    const handlers: SocketHandler = {
+      data(_s, buf) {
+        client.applyChunk(buf);
       },
-    });
+      drain() {
+        client.queue?.drain();
+      },
+      close() {
+        client.drainPending('connection closed');
+        client.onClose();
+      },
+      error() {},
+    };
+
+    const socket =
+      typeof address === 'string'
+        ? await Bun.connect({ unix: address, socket: handlers })
+        : await Bun.connect({ hostname: address.hostname, port: address.port, socket: handlers });
 
     client.socket = socket;
 
@@ -61,8 +67,13 @@ export class DaemonClient implements DaemonChannel {
     return client;
   }
 
-  sendHello(build: string): Promise<Readonly<Record<string, unknown>>> {
-    return this.sendRequest('daemon.hello', { client: build, auth: { scheme: 'none' } });
+  // A handshake with a token presents it as a bearer token, which a TCP
+  // listener requires.
+  sendHello(build: string, token?: string): Promise<Readonly<Record<string, unknown>>> {
+    return this.sendRequest('daemon.hello', {
+      client: build,
+      auth: token === undefined ? { scheme: 'none' } : { scheme: 'bearer', token },
+    });
   }
 
   // A request with a principal acts as that principal, within what the

package/src/daemon/build-agent-list.ts

@@ -1,7 +1,8 @@
 import type { AgentAdapter, SpawnOptionSpec } from '../agents/agent-adapter';
 
 interface AgentCapabilities {
-  // Only an installed agent can start a session.
+  // Only an installed agent whose starts are not all refused can start a
+  // session.
   readonly spawn: boolean;
   readonly readTranscript: boolean;
 
@@ -51,6 +52,7 @@ export function buildAgentList(
   return adapters.map((adapter) => {
     const profile = adapter.profile;
     const installed = profile === undefined ? false : isInstalled(profile.bin);
+    const spawnable = installed && (adapter.findSpawnRefusal?.() ?? null) === null;
 
     return {
       id: adapter.id,
@@ -58,7 +60,7 @@ export function buildAgentList(
       kind: profile?.kind ?? adapter.id,
       installed,
       capabilities: {
-        spawn: installed,
+        spawn: spawnable,
         readTranscript: adapter.parseTranscriptLine !== undefined,
         message: adapter.takesMessages,
         attach: true,
@@ -67,8 +69,8 @@ export function buildAgentList(
       },
       models: profile?.models ?? null,
       spawnOptions: {
-        model: buildSpawnOptionEntry(profile?.spawnOptions.model, installed),
-        effort: buildSpawnOptionEntry(profile?.spawnOptions.effort, installed),
+        model: buildSpawnOptionEntry(profile?.spawnOptions.model, spawnable),
+        effort: buildSpawnOptionEntry(profile?.spawnOptions.effort, spawnable),
       },
     };
   });
@@ -86,9 +88,9 @@ const NO_SPAWN_OPTION: SpawnOptionSpec = {
 
 function buildSpawnOptionEntry(
   spec: SpawnOptionSpec | undefined,
-  installed: boolean,
+  spawnable: boolean,
 ): SpawnOptionEntry {
   const resolved = spec ?? NO_SPAWN_OPTION;
 
-  return { ...resolved, available: installed && resolved.supported };
+  return { ...resolved, available: spawnable && resolved.supported };
 }

package/src/daemon/build-auth-binding.ts

@@ -0,0 +1,58 @@
+import { createHash } from 'node:crypto';
+import type { AgentID } from '../shared/agent-id';
+import type { AuthProfile } from '../shared/collect-auth-profiles';
+import type { GatewayAuth, GatewayConfig } from '../shared/collect-gateways';
+import { resolveAuthProfiles } from '../shared/resolve-auth-profiles';
+import type { AuthProfileProblem, ResolvedAuthSecret } from '../shared/resolve-auth-profiles';
+import { sortJSONKeys } from '../shared/sort-json-keys';
+
+/**
+ * What a session's runtime is bound to through impd's broker: every
+ * profile its gateway's selection reaches, the secrets they need impd to
+ * hold with exactly these rules, the placeholder variables in place of a
+ * credential, and the endpoint. `hash` covers the secrets and their rules
+ * alone, so a change to a profile the binding does not reach leaves it as
+ * it was, and a change to one it reaches gives another hash.
+ */
+export interface AuthBinding {
+  readonly agent: AgentID;
+  readonly baseURL: string;
+  readonly profiles: readonly string[];
+  readonly secrets: readonly ResolvedAuthSecret[];
+  readonly placeholderEnv: Readonly<Record<string, string>>;
+  readonly hash: string;
+}
+
+type AuthGateway = Pick<GatewayConfig, 'id' | 'baseURL'> & { readonly auth: GatewayAuth };
+
+/**
+ * Plans the binding a gateway's auth asks for against the current auth
+ * profiles, or the problem that refuses it. The hash is the SHA-256 of the
+ * resolved secrets as canonical JSON, with each list sorted, so the order
+ * of the selection or of the config never changes it.
+ */
+export function buildAuthBinding(
+  gateway: AuthGateway,
+  profiles: ReadonlyMap<string, AuthProfile>,
+): { readonly binding: AuthBinding } | { readonly problem: AuthProfileProblem } {
+  const resolution = resolveAuthProfiles(profiles, gateway.auth.profiles);
+
+  if ('problem' in resolution) {
+    return resolution;
+  }
+
+  const secrets = resolution.resolved.secrets;
+
+  return {
+    binding: {
+      agent: gateway.id,
+      baseURL: gateway.baseURL,
+      profiles: resolution.resolved.profiles,
+      secrets,
+      placeholderEnv: gateway.auth.placeholderEnv,
+      hash: createHash('sha256')
+        .update(JSON.stringify(sortJSONKeys({ secrets })))
+        .digest('hex'),
+    },
+  };
+}

package/src/daemon/build-imp-name.ts

@@ -0,0 +1,11 @@
+/**
+ * The imp a host key runs on: the target's imp name prefix and the first
+ * 20 letters and digits of the key, which is the atc session id of the
+ * session that owns the host.
+ */
+export function buildImpName(impPrefix: string, hostKey: string): string {
+  return `${impPrefix}${hostKey
+    .toLowerCase()
+    .replaceAll(/[^a-z0-9]/g, '')
+    .slice(0, 20)}`;
+}

package/src/daemon/build-imp-provider.ts

@@ -17,8 +17,12 @@ export interface ImpProviderBuild {
  * so no credential sits in the config. `tokenEnv` holds the name of the
  * daemon's environment variable that carries the token, read once here.
  * `tokenFile` holds the path of a file that carries it, read here and again
- * before each impd call and connection. `image`, `memoryMib`, `guestDir`,
- * and `guestATC` pass through. No provider when `url` is missing, so the
+ * before each impd call and connection. `impPrefix` starts every imp name
+ * the target builds, `atc-` when absent, and must be a lowercase letter
+ * followed by up to 10 lowercase letters, digits or hyphens, so the name
+ * it builds with a host key's 20 characters stays within impd's 31. `image`,
+ * `memoryMib`, `guestDir`, and `guestATC` pass through. No provider when
+ * `url` is missing, so the
  * target lists and refuses every spawn. Both token options, either one not
  * a non-empty string, an unset or empty variable, or an empty or unreadable
  * file is a problem and leaves no provider; a target without either calls
@@ -41,7 +45,17 @@ export function buildImpProvider(
     return { provider: null, problem: source };
   }
 
+  const impPrefix = options['impPrefix'];
+
+  if (impPrefix !== undefined && !isImpPrefix(impPrefix)) {
+    return {
+      provider: null,
+      problem: `target ${JSON.stringify(id)} must give impPrefix as a lowercase letter followed by up to 10 lowercase letters, digits or hyphens, so every imp name it builds is one impd accepts`,
+    };
+  }
+
   const provider = new ImpProvider(new ImpClientPort({ url, readToken: source.readToken }), {
+    ...(impPrefix === undefined ? {} : { impPrefix }),
     ...pickString(options, 'image'),
     ...pickString(options, 'guestDir'),
     ...pickString(options, 'guestATC'),
@@ -105,6 +119,15 @@ function loadTokenSource(
   return { readToken: () => token };
 }
 
+// impd's imp name rule, a lowercase letter then up to 30 lowercase letters,
+// digits or hyphens, with room left for the 20 characters of a host key.
+// It holds no `*`, so the prefix never reads as an imp pattern.
+const IMP_PREFIX = /^[a-z][a-z0-9-]{0,10}$/;
+
+function isImpPrefix(value: unknown): value is string {
+  return typeof value === 'string' && IMP_PREFIX.test(value);
+}
+
 function pickString(
   options: Readonly<Record<string, unknown>>,
   key: 'image' | 'guestDir' | 'guestATC',