@zgeoff/atc 2.24.0 → 2.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.24.0",
+  "version": "2.26.0",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",

package/src/agents/agent-adapter.ts

@@ -3,6 +3,8 @@ import type { DaemonError } from '../protocol/daemon-error';
 import type { HookEvent } from '../protocol/hook-event';
 import type { AgentID } from '../shared/agent-id';
 import type { AgentSessionID } from '../shared/agent-session-id';
+import type { AuthProfile } from '../shared/collect-auth-profiles';
+import type { GatewayAuth, GatewayConfig } from '../shared/collect-gateways';
 import type { SessionID } from '../shared/session-id';
 
 export interface SpawnOptions {
@@ -35,19 +37,36 @@ export interface SpawnPlan {
 /**
  * Where a session on a remote host finds atc: the atc binary inside the
  * host, null when the host has none, and the folder the session's own
- * files unpack into.
+ * files unpack into. `auth` is given when the harness takes its credential
+ * from impd's broker: the revision of the host's runtime auth binding it
+ * launches under, which keys any settings the agent writes for it, and the
+ * placeholder variables the harness holds in place of a credential.
  */
 export interface GuestPaths {
   readonly atc: string | null;
   readonly dir: string;
+  readonly auth?: { readonly revision: number; readonly env: Readonly<Record<string, string>> };
+}
+
+/**
+ * The credential an agent takes from impd's broker instead of holding it:
+ * its gateway's endpoint and auth selection, and the auth profiles that
+ * selection resolves against.
+ */
+export interface AuthSelection {
+  readonly gateway: Pick<GatewayConfig, 'id' | 'baseURL'> & { readonly auth: GatewayAuth };
+  readonly profiles: ReadonlyMap<string, AuthProfile>;
 }
 
 /**
  * A spawn on a remote host, with the files the harness reads there, keyed
- * by their path inside the session's guest folder.
+ * by their path inside the session's guest folder, and the variables the
+ * harness process starts with, which no variable the harness inherits
+ * overrides.
  */
 export interface GuestSpawnPlan extends SpawnPlan {
   readonly files: Readonly<Record<string, string>>;
+  readonly env?: Readonly<Record<string, string>>;
 }
 
 export interface TranscriptToolUse {
@@ -204,8 +223,14 @@ export interface AgentAdapter {
   // Plans a spawn on a remote host; null when this agent cannot run there,
   // such as one whose instrumentation needs atc on a host without it.
   // Absent: the agent runs there as a local spawn plans it, with no files.
+  // A plan for a guest whose `auth` is given that cannot launch behind the
+  // broker is null.
   readonly planGuestSpawn?: (opts: SpawnOptions, guest: GuestPaths) => GuestSpawnPlan | null;
 
+  // The credential this agent takes from impd's broker, or null when it
+  // takes none. Absent: it takes none.
+  readonly findAuthSelection?: () => AuthSelection | null;
+
   // The refusal every start of this agent's harness gets, on any target,
   // or null when it may start. Absent: no start is refused.
   readonly findSpawnRefusal?: () => DaemonError | null;

package/src/agents/gateway-adapter.ts

@@ -5,10 +5,16 @@ import type { AgentID } from '../shared/agent-id';
 import type { AgentSessionID } from '../shared/agent-session-id';
 import type { GatewayConfig } from '../shared/collect-gateways';
 import type { Config } from '../shared/config';
+import { isBrokerVariable } from '../shared/is-broker-variable';
+import { isRecord } from '../shared/report';
+import { resolveAuthProfiles } from '../shared/resolve-auth-profiles';
 import { toShellArg } from '../shared/to-shell-arg';
 import type {
   AgentAdapter,
   AgentProfile,
+  AuthSelection,
+  GuestPaths,
+  GuestSpawnPlan,
   HeadlessRunner,
   NameUpdate,
   ResumeCheck,
@@ -16,10 +22,13 @@ import type {
   SpawnOptions,
   SpawnPlan,
 } from './agent-adapter';
+import { buildATCBridgeFiles } from './build-atc-bridge-files';
 import { buildClaudeOverrideArgs } from './build-claude-override-args';
+import { buildHookSettings } from './build-hook-settings';
 import { buildRestoreModeArgs } from './build-restore-mode-args';
 import { ClaudeAdapter } from './claude-adapter';
 import { CLAUDE_EFFORT_LEVELS } from './claude-effort-levels';
+import { findClaudePermissionMode } from './find-claude-permission-mode';
 import { findFlagValue } from './find-flag-value';
 import { makeClaudeHeadlessRunner } from './make-claude-headless-runner';
 import type { ClaudeHeadlessRun } from './make-claude-headless-runner';
@@ -59,6 +68,8 @@ export class GatewayAdapter implements AgentAdapter {
 
   private readonly gateway: GatewayConfig;
 
+  private readonly config: Config;
+
   private readonly claude: ClaudeAdapter;
 
   // Written on first spawn so constructing the adapter touches no state.
@@ -77,6 +88,7 @@ export class GatewayAdapter implements AgentAdapter {
   ) {
     this.bridgeTarget = bridgeTarget;
     this.gateway = gateway;
+    this.config = config;
     this.id = gateway.id;
 
     const models = pickModels(gateway.env);
@@ -102,44 +114,131 @@ export class GatewayAdapter implements AgentAdapter {
           });
   }
 
-  // A gateway whose credential comes through impd's broker never starts
-  // until the broker path exists: started without it, the CLI would send
-  // whatever credential it holds to the gateway's host.
+  // A gateway whose credential comes through impd's broker is refused
+  // before anything is prepared for it when its placeholders cannot pair
+  // with the broker's header, or when its settings env would route the CLI
+  // around the broker.
   findSpawnRefusal(): DaemonError | null {
-    if (this.gateway.auth === undefined) {
+    const auth = this.gateway.auth;
+
+    if (auth === undefined) {
       return null;
     }
 
-    return new DaemonError(
-      'auth_target_unsupported',
-      `gateway '${this.id}' takes its credential from impd's broker, and brokered credentials are not wired yet`,
-      { agent: this.id },
+    return (
+      this.findPlaceholderRefusal(auth.placeholderEnv, auth.profiles) ??
+      this.findSettingsEnvConflict()
     );
   }
 
+  findAuthSelection(): AuthSelection | null {
+    const auth = this.gateway.auth;
+
+    if (auth === undefined) {
+      return null;
+    }
+
+    return {
+      gateway: { id: this.gateway.id, baseURL: this.gateway.baseURL, auth },
+      profiles: this.config.authProfiles,
+    };
+  }
+
+  // A gateway whose credential comes through impd's broker never starts on
+  // the daemon's machine: started without the broker, the CLI would send
+  // whatever credential it holds to the gateway's host.
   planSpawn(opts: SpawnOptions): SpawnPlan {
+    if (this.gateway.auth !== undefined) {
+      throw this.buildBrokerRefusal('which only an imp target can give it');
+    }
+
+    const modeArgs =
+      opts.resume === false ? [] : buildRestoreModeArgs(this.gateway.args, this.gateway.settings);
+
     return {
       bin: this.gateway.bin,
-      args: [
-        ...buildClaudeOverrideArgs(this.gateway.args, opts),
-        ...(opts.resume === false
-          ? []
-          : buildRestoreModeArgs(this.gateway.args, this.gateway.settings)),
-        '--settings',
-        this.writeSettings(),
-        '--plugin-dir',
-        this.writeBridge(),
-        ...(opts.resume === true ? ['--resume'] : []),
-        ...(typeof opts.resume === 'string' ? ['--resume', opts.resume] : []),
-        ...(opts.prompt === '' ? [] : [opts.prompt]),
-      ],
+      args: this.buildArgs(opts, modeArgs, this.writeSettings(), this.writeBridge()),
     };
   }
 
-  // The credential helper runs on the daemon's machine, so a gateway
-  // session never runs on a remote host.
-  planGuestSpawn(): null {
-    return null;
+  // A gateway whose credential comes through impd's broker runs on a
+  // remote host with a settings file of the session's own per binding
+  // revision, a Claude config folder of its own that holds no account,
+  // and placeholders in place of the credential, which the broker swaps
+  // for the real one on the host's side. A shell seeds the config folder
+  // before it runs the CLI, since a transferred file would replace the
+  // state an earlier run left. Any other gateway's credential
+  // helper runs on the daemon's machine, so it never runs remotely.
+  planGuestSpawn(opts: SpawnOptions, guest: GuestPaths): GuestSpawnPlan | null {
+    if (this.gateway.auth === undefined) {
+      return null;
+    }
+
+    if (guest.auth === undefined) {
+      throw this.buildBrokerRefusal('and this session has no broker binding');
+    }
+
+    if (guest.atc === null) {
+      return null;
+    }
+
+    const refusal =
+      this.findPlaceholderRefusal(guest.auth.env, this.gateway.auth.profiles) ??
+      this.findSettingsEnvConflict();
+
+    if (refusal !== null) {
+      throw refusal;
+    }
+
+    const argv = [guest.atc];
+    const settingsPath = `auth-r${guest.auth.revision}/settings.json`;
+
+    const bridge = Object.entries(buildATCBridgeFiles(argv)).map(
+      ([path, content]): [string, string] => [`atc-bridge/${path}`, content],
+    );
+
+    const settings = buildHookSettings(
+      {
+        id: this.id,
+        env: {
+          ...this.gateway.env,
+          ANTHROPIC_BASE_URL: this.gateway.baseURL,
+          ...guest.auth.env,
+          CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
+        },
+        ...(this.gateway.settings === undefined
+          ? {}
+          : { settings: buildSettingsWithoutHelper(this.gateway.settings) }),
+      },
+      0,
+      argv,
+    );
+
+    const configDir = `${guest.dir}/${CLAUDE_CONFIG_FOLDER}`;
+
+    return {
+      bin: 'sh',
+      args: [
+        '-c',
+        SEED_CONFIG_SCRIPT,
+        'sh',
+        configDir,
+        `${guest.dir}/${CONFIG_SEED_FILE}`,
+        this.gateway.bin,
+        ...this.buildArgs(
+          opts,
+          this.buildGuestModeArgs(),
+          `${guest.dir}/${settingsPath}`,
+          `${guest.dir}/atc-bridge`,
+        ),
+      ],
+      files: {
+        [settingsPath]: JSON.stringify(settings, null, 2),
+        [CONFIG_SEED_FILE]: JSON.stringify(ONBOARDED_CONFIG, null, 2),
+        ...Object.fromEntries(bridge),
+      },
+      env: { CLAUDE_CONFIG_DIR: configDir, ...guest.auth.env },
+    };
   }
 
   normalizeHook(e: HookEvent): AdapterEvent {
@@ -179,6 +278,117 @@ export class GatewayAdapter implements AgentAdapter {
     return `cd ${toShellArg(cwd)} && ${this.gateway.bin}${args} --settings ${settings} --resume${resume}`;
   }
 
+  private buildArgs(
+    opts: SpawnOptions,
+    modeArgs: readonly string[],
+    settings: string,
+    pluginDir: string,
+  ): string[] {
+    return [
+      ...buildClaudeOverrideArgs(this.gateway.args, opts),
+      ...modeArgs,
+      '--settings',
+      settings,
+      '--plugin-dir',
+      pluginDir,
+      ...(opts.resume === true ? ['--resume'] : []),
+      ...(typeof opts.resume === 'string' ? ['--resume', opts.resume] : []),
+      ...(opts.prompt === '' ? [] : [opts.prompt]),
+    ];
+  }
+
+  // A brokered session's Claude config is fresh, so the CLI's own default
+  // mode would apply rather than the one the owner's settings set. Every
+  // start therefore names its mode: the one the gateway's arguments or
+  // settings set, else the CLI's manual mode, which asks before each
+  // action.
+  private buildGuestModeArgs(): string[] {
+    if (findFlagValue(this.gateway.args, ['--permission-mode']) !== null) {
+      return [];
+    }
+
+    return [
+      '--permission-mode',
+      findClaudePermissionMode([], this.gateway.settings) ?? MANUAL_PERMISSION_MODE,
+    ];
+  }
+
+  private buildBrokerRefusal(reason: string): DaemonError {
+    return new DaemonError(
+      'auth_target_unsupported',
+      `gateway '${this.id}' takes its credential from impd's broker, ${reason}`,
+      { agent: this.id },
+    );
+  }
+
+  // The Claude CLI sends ANTHROPIC_AUTH_TOKEN as a bearer authorization
+  // header, the one pairing atc binds, so the placeholders must be that
+  // variable alone, holding the placeholder, for a profile whose rule on
+  // the base URL's host sets that header. Any other variable would put the
+  // placeholder in a header the broker never fills.
+  private findPlaceholderRefusal(
+    env: Readonly<Record<string, string>>,
+    profiles: readonly string[],
+  ): DaemonError | null {
+    const keys = Object.keys(env);
+
+    if (keys.length !== 1 || keys[0] !== BEARER_VARIABLE) {
+      return this.buildPlaceholderRefusal(
+        `needs ${BEARER_VARIABLE} as its only placeholder variable, which the broker fills as a bearer authorization header; it has ${keys.length === 0 ? 'none' : keys.join(', ')}`,
+      );
+    }
+
+    if (env[BEARER_VARIABLE] !== PLACEHOLDER) {
+      return this.buildPlaceholderRefusal(`needs ${BEARER_VARIABLE} to hold ${PLACEHOLDER}`);
+    }
+
+    const resolution = resolveAuthProfiles(this.config.authProfiles, profiles);
+
+    const host = new URL(this.gateway.baseURL).hostname;
+
+    const rule =
+      'resolved' in resolution
+        ? resolution.resolved.secrets.flatMap((s) => s.rules).find((r) => r.host === host)
+        : undefined;
+
+    if (rule?.header !== 'authorization' || rule.scheme !== 'bearer') {
+      return this.buildPlaceholderRefusal(
+        `needs a profile that sets a bearer authorization header for ${host}, the header ${BEARER_VARIABLE} fills`,
+      );
+    }
+
+    return null;
+  }
+
+  // The settings file's env block reaches the CLI's own process, so a proxy
+  // or CA variable there would route the CLI around the broker.
+  private findSettingsEnvConflict(): DaemonError | null {
+    const settingsEnv = this.gateway.settings?.['env'];
+
+    const keys = [
+      ...Object.keys(this.gateway.env),
+      ...(isRecord(settingsEnv) ? Object.keys(settingsEnv) : []),
+    ];
+
+    const variable = keys.find((key) => isBrokerVariable(key));
+
+    if (variable === undefined) {
+      return null;
+    }
+
+    return new DaemonError(
+      'auth_target_unsupported',
+      `gateway '${this.id}' sets ${variable} in its settings env, which would route around impd's broker`,
+      { agent: this.id, problem: 'guest_env_conflict', variable },
+    );
+  }
+
+  private buildPlaceholderRefusal(problem: string): DaemonError {
+    return new DaemonError('auth_placeholder_unsupported', `gateway '${this.id}' ${problem}`, {
+      agent: this.id,
+    });
+  }
+
   private writeSettings(): string {
     this.settingsFile ??= writeHookSettings({
       id: this.id,
@@ -199,6 +409,43 @@ export class GatewayAdapter implements AgentAdapter {
   }
 }
 
+// The variable the Claude CLI sends as a bearer authorization header, and
+// the value impd's broker replaces with the credential on the host's side.
+const BEARER_VARIABLE = 'ANTHROPIC_AUTH_TOKEN';
+const PLACEHOLDER = 'imp-broker-placeholder';
+
+// The Claude CLI's mode that asks a person before each action.
+const MANUAL_PERMISSION_MODE = 'default';
+
+// The Claude config folder a brokered session gets inside its guest
+// folder, so no account or setting of the host's image reaches it.
+const CLAUDE_CONFIG_FOLDER = 'claude-config';
+
+// The state the Claude CLI reads from its config folder's `.claude.json`
+// to start without its first-run onboarding. It holds no account: the
+// placeholder credential is what keeps the CLI from asking for a login.
+// It holds no folder trust either, so the CLI asks a person to trust the
+// workspace on its first start.
+const ONBOARDED_CONFIG = { hasCompletedOnboarding: true };
+
+// Where that state travels, beside the config folder rather than in it.
+const CONFIG_SEED_FILE = 'claude-config-seed.json';
+
+// Copies the seed into the config folder only when the folder holds no
+// `.claude.json` yet, then runs the CLI. A resumed session keeps the state
+// the CLI wrote, a folder trust a person accepted included. The arguments
+// are the config folder, the seed, and the CLI's own command line.
+const SEED_CONFIG_SCRIPT =
+  'mkdir -p "$1" && { [ -e "$1/.claude.json" ] || cp "$2" "$1/.claude.json"; } && shift 2 && exec "$@"';
+
+// The gateway's settings without a credential helper, which a brokered
+// session never runs.
+function buildSettingsWithoutHelper(
+  settings: Readonly<Record<string, unknown>>,
+): Readonly<Record<string, unknown>> {
+  return Object.fromEntries(Object.entries(settings).filter(([key]) => key !== 'apiKeyHelper'));
+}
+
 // The model names a gateway's env sets explicitly, keyed by role:
 // `ANTHROPIC_MODEL` is `default`, and `ANTHROPIC_DEFAULT_<TIER>_MODEL` is the
 // tier in lower case. No other env value leaves the adapter.

package/src/client/collect-agent-picks.ts

@@ -9,8 +9,7 @@ export interface AgentPick {
 /**
  * The agent choices the spawn and adopt flows offer, in menu order. An agent
  * whose configured binary does not resolve is left out, so every row in the
- * menu is a session that can start. A gateway with auth is left out too, since
- * every start of one is refused. Resolution follows the rule a spawn
+ * menu is a session that can start. Resolution follows the rule a spawn
  * follows: a bare name comes off PATH, a name carrying a separator is taken
  * as a path, and either way it has to be executable.
  */
@@ -23,9 +22,7 @@ export function collectAgentPicks(config: Config): AgentPick[] {
     { agent: 'claude', label: 'Claude', bin: config.claudeBin },
     { agent: 'grok', label: 'Grok', bin: config.grokBin },
     { agent: 'codex', label: 'Codex', bin: config.codexBin },
-    ...config.gateways
-      .filter((g) => g.auth === undefined)
-      .map((g) => ({ agent: g.id, label: g.label, bin: g.bin })),
+    ...config.gateways.map((g) => ({ agent: g.id, label: g.label, bin: g.bin })),
   ];
 
   return candidates

package/src/client/collect-target-picks.ts

@@ -13,6 +13,10 @@ export interface TargetPick {
   // Whether a session there runs on the daemon's own machine, where a
   // local directory runs in place.
   readonly inPlace: boolean;
+
+  // Whether the target reaches impd's credential broker; false from a
+  // daemon that does not say.
+  readonly brokerAuth: boolean;
 }
 
 /**
@@ -47,6 +51,7 @@ export function collectTargetPicks(answer: Readonly<Record<string, unknown>>): T
         takesWorkspace:
           available && capabilities['transfer'] === true && capabilities['run'] === true,
         inPlace: entry['provider'] === 'local-pty',
+        brokerAuth: entry['brokerAuth'] === true,
       },
     ];
   });

package/src/client/spawn-picker.ts

@@ -1616,7 +1616,10 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
       return;
     }
 
-    const picks = collectTargetPicks(listed);
+    // An agent that takes its credential from impd's broker runs only on a
+    // target that reaches the broker.
+    const brokered = isBrokerAgent(listed['agents'], this.agent);
+    const picks = collectTargetPicks(listed).filter((t) => !brokered || t.brokerAuth);
 
     // An adopt resumes a session from its history on this host, which a
     // fresh checkout elsewhere does not hold, so it is offered only the
@@ -1870,6 +1873,17 @@ function buildProbedRepo(
   };
 }
 
+// Whether the daemon lists an agent as taking its credential from impd's
+// broker; a daemon that does not say lists none.
+function isBrokerAgent(raw: unknown, agent: AgentID): boolean {
+  return (
+    Array.isArray(raw) &&
+    raw.some(
+      (entry: unknown) => isRecord(entry) && entry['id'] === agent && entry['brokerAuth'] === true,
+    )
+  );
+}
+
 function parseAnnouncedSources(raw: unknown): AnnouncedSource[] {
   if (!Array.isArray(raw)) {
     return [];

package/src/daemon/broker-auth-host.ts

@@ -0,0 +1,25 @@
+import type { ImpPort, ImpView } from './imp-port';
+
+/**
+ * What a provider whose hosts can reach impd's credential broker offers
+ * runtime auth: the literal start of every imp name it builds, the imp a
+ * host key runs on, impd's identity, secret and grant calls, and creating
+ * and destroying a host's imp the way the provider itself does. A
+ * destroy that finds no imp counts as done.
+ */
+export interface BrokerAuthHost {
+  readonly impPrefix: string;
+  readonly port: Pick<
+    ImpPort,
+    | 'readFeatures'
+    | 'readIdentity'
+    | 'readSecrets'
+    | 'readGrants'
+    | 'createGrant'
+    | 'removeGrant'
+    | 'readImp'
+  >;
+  readonly getImpName: (hostKey: string) => string;
+  readonly createImp: (hostKey: string) => Promise<ImpView>;
+  readonly destroyImp: (hostKey: string) => Promise<void>;
+}

package/src/daemon/broker-authority-error.ts

@@ -2,7 +2,8 @@
  * Why impd's credential broker may not be used for a session, or why atc
  * may not clean up after one:
  *
- * - `auth_impd_too_old`: impd lacks grantable tokens or secret rebinds.
+ * - `auth_impd_too_old`: impd lacks grantable tokens, secret rebinds or
+ *   exec requirements.
  * - `auth_token_scope`: the token's scope is below `manage`.
  * - `auth_token_too_broad`: the token can reach imps outside atc's
  *   namespace, through no imp patterns or a pattern whose literal text

package/src/daemon/build-agent-list.ts

@@ -2,7 +2,8 @@ import type { AgentAdapter, SpawnOptionSpec } from '../agents/agent-adapter';
 
 interface AgentCapabilities {
   // Only an installed agent whose starts are not all refused can start a
-  // session.
+  // session, and one that takes its credential from impd's broker only
+  // where some target reaches the broker.
   readonly spawn: boolean;
   readonly readTranscript: boolean;
 
@@ -20,6 +21,10 @@ export interface AgentEntry {
 
   // Whether the agent's binary resolves, on PATH or at its configured path.
   readonly installed: boolean;
+
+  // Whether the agent takes its credential from impd's broker, so it runs
+  // only on a target whose entry has `brokerAuth`.
+  readonly brokerAuth: boolean;
   readonly capabilities: AgentCapabilities;
   readonly models: Readonly<Record<string, string>> | null;
   readonly spawnOptions: SpawnOptionEntries;
@@ -43,22 +48,30 @@ interface SpawnOptionEntries {
  * so no environment value, credential, helper command, or base URL reaches
  * it. Every session runs in a PTY, so each agent can be attached, read as a
  * screen, and typed into. A stand-in adapter without a profile is listed
- * under its id as both label and kind.
+ * under its id as both label and kind. hasBrokerTarget holds whether any
+ * target reaches impd's credential broker.
  */
 export function buildAgentList(
   adapters: readonly AgentAdapter[],
   isInstalled: (bin: string) => boolean,
+  hasBrokerTarget: boolean,
 ): AgentEntry[] {
   return adapters.map((adapter) => {
     const profile = adapter.profile;
     const installed = profile === undefined ? false : isInstalled(profile.bin);
-    const spawnable = installed && (adapter.findSpawnRefusal?.() ?? null) === null;
+    const brokerAuth = (adapter.findAuthSelection?.() ?? null) !== null;
+
+    const spawnable =
+      installed &&
+      (adapter.findSpawnRefusal?.() ?? null) === null &&
+      (!brokerAuth || hasBrokerTarget);
 
     return {
       id: adapter.id,
       label: profile?.label ?? adapter.id,
       kind: profile?.kind ?? adapter.id,
       installed,
+      brokerAuth,
       capabilities: {
         spawn: spawnable,
         readTranscript: adapter.parseTranscriptLine !== undefined,

package/src/daemon/build-scoped-context.ts

@@ -139,6 +139,8 @@ export function buildScopedContext(
     // out or taken, so its host is never touched.
     forgetSession: (id, confirmToken) =>
       canSee(id) ? ctx.forgetSession(id, confirmToken) : Promise.resolve('missing' as const),
+    revokeSessionAuth: (id) => (canSee(id) ? ctx.revokeSessionAuth(id) : Promise.resolve(false)),
+    updateSessionAuth: (id) => (canSee(id) ? ctx.updateSessionAuth(id) : Promise.resolve(null)),
     updateSession: (id, name, pinned) => canSee(id) && ctx.updateSession(id, name, pinned),
     ackSession: (id) => canSee(id) && ctx.ackSession(id),
     buildResumeCommand: (id) => (canSee(id) ? ctx.buildResumeCommand(id) : null),

package/src/daemon/build-target-list.ts

@@ -14,6 +14,10 @@ export interface TargetEntry {
   readonly available: boolean;
   readonly default: boolean;
   readonly capabilities: ExecutionCapabilities;
+
+  // Whether the target's provider reaches impd's credential broker, so an
+  // agent that takes its credential from the broker can run there.
+  readonly brokerAuth: boolean;
 }
 
 // What a target without a provider can do: nothing.
@@ -46,5 +50,6 @@ export function buildTargetList(
     available: target.provider !== null,
     default: target.id === defaultTarget,
     capabilities: target.provider?.capabilities ?? NO_CAPABILITIES,
+    brokerAuth: target.provider?.brokerAuth !== undefined,
   }));
 }