@zgeoff/atc 2.24.0 → 2.26.0

package/src/daemon/daemon-connection.ts

@@ -34,8 +34,14 @@ interface RequestScope {
   readonly keyNamespace: string;
 }
 
-// The requests that act on the whole daemon, which only its owner may make.
-const OWNER_METHODS: ReadonlySet<string> = new Set(['daemon.quit', 'fleet.restore']);
+// The requests that act on the whole daemon, or on the credentials a
+// session's host may use, which only its owner may make.
+const OWNER_METHODS: ReadonlySet<string> = new Set([
+  'daemon.quit',
+  'fleet.restore',
+  'session.auth.revoke',
+  'session.auth.rebind',
+]);
 
 // What a limited connection is sent for one event, and the sessions that
 // event moved out of its view.
@@ -68,9 +74,15 @@ interface PeerSocket extends SocketWriter {
 export interface TCPPeer {
   readonly verifyHandshake: (presented: string | null) => Promise<string | null>;
 
-  // Counts a line other than a handshake, sent before one passed, as a
-  // failed handshake from the peer's address.
-  readonly recordFailure: () => void;
+  // Counts a line other than a handshake, or one over the size cap, sent
+  // before a handshake passed, as a failed handshake from the peer's
+  // address.
+  readonly recordFailure: (reason: 'unexpected_line' | 'line_too_long') => void;
+
+  // Records a handshake or a request refused for a principal the config
+  // does not list. The principal itself is never logged: an unlisted one
+  // is whatever the peer sent, a credential included.
+  readonly recordRefusedPrincipal: () => void;
 }
 
 export class DaemonConnection {
@@ -214,7 +226,7 @@ export class DaemonConnection {
     const oversized = this.lines.pendingLength + chunk.length > MAX_LINE;
 
     if (oversized && this.isUnauthenticatedTCP()) {
-      this.tcp?.recordFailure();
+      this.tcp?.recordFailure('line_too_long');
       this.peer.end();
 
       return;
@@ -331,7 +343,7 @@ export class DaemonConnection {
       const isHello = decoded.kind === 'request' && decoded.msg.m === 'daemon.hello';
 
       if (this.tcpHelloSent || !isHello) {
-        this.tcp?.recordFailure();
+        this.tcp?.recordFailure('unexpected_line');
 
         return 'close';
       }
@@ -380,6 +392,7 @@ export class DaemonConnection {
     }
 
     if (!this.ctx.hasListedPrincipal(req.as)) {
+      this.tcp?.recordRefusedPrincipal();
       this.sendErr(req.id, 'unauthorized', `principal '${req.as}' is not listed in principals`);
 
       return;
@@ -648,6 +661,48 @@ export class DaemonConnection {
 
         return;
       }
+      case 'session.auth.revoke': {
+        const parsed = parseRequestParams('session.auth.revoke', req.p);
+
+        if (!parsed.ok) {
+          this.sendErr(req.id, 'bad_args', parsed.message);
+
+          return;
+        }
+
+        const id = parsed.data.session;
+
+        const revoked = await ctx.revokeSessionAuth(id);
+
+        if (revoked) {
+          this.sendOk(req.id, { revoked: true });
+        } else {
+          this.sendErr(req.id, 'no_such_session', `no session '${id}'`);
+        }
+
+        return;
+      }
+      case 'session.auth.rebind': {
+        const parsed = parseRequestParams('session.auth.rebind', req.p);
+
+        if (!parsed.ok) {
+          this.sendErr(req.id, 'bad_args', parsed.message);
+
+          return;
+        }
+
+        const id = parsed.data.session;
+
+        const revision = await ctx.updateSessionAuth(id);
+
+        if (revision === null) {
+          this.sendErr(req.id, 'no_such_session', `no session '${id}'`);
+        } else {
+          this.sendOk(req.id, { revision });
+        }
+
+        return;
+      }
       case 'session.resumeCommand': {
         const parsed = parseRequestParams('session.resumeCommand', req.p);
 
@@ -901,6 +956,8 @@ export class DaemonConnection {
         throw refusal;
       }
 
+      ctx.requireAgentTarget(agent, target);
+
       const overrides = parseSpawnOverrides(entry, { model: data.model, effort: data.effort });
 
       if (!overrides.ok) {
@@ -1619,6 +1676,8 @@ export class DaemonConnection {
       const principal = parsedHello.data.principal ?? null;
 
       if (principal !== null && !this.ctx.hasListedPrincipal(principal)) {
+        tcp.recordRefusedPrincipal();
+
         this.sendErr(
           req.id,
           'unauthorized',

package/src/daemon/daemon-context.ts

@@ -180,6 +180,10 @@ export interface DaemonContext {
   // one whose provider cannot both transfer an archive and run a command.
   readonly requireWorkspaceTarget: (target: string) => void;
 
+  // Throws the refusal for an agent that takes its credential from impd's
+  // broker on a target whose provider reaches no broker.
+  readonly requireAgentTarget: (agent: AgentID, target: string) => void;
+
   // The source the daemon offers the spawn picker under an id, or null when
   // it offers none under it.
   readonly findSource: (id: string) => SourceProvider | null;
@@ -211,6 +215,14 @@ export interface DaemonContext {
     id: SessionID,
     confirmToken: string | undefined,
   ) => Promise<ForgetResult | 'missing'>;
+
+  // Withdraws the grants of the runtime auth binding on a session's host,
+  // and answers false for no such session.
+  readonly revokeSessionAuth: (id: SessionID) => Promise<boolean>;
+
+  // Binds a session's host to its agent's current auth selection, and
+  // answers the new revision, or null for no such session.
+  readonly updateSessionAuth: (id: SessionID) => Promise<number | null>;
   readonly updateSession: (id: SessionID, name?: string, pinned?: boolean) => boolean | 'child_pin';
   readonly quitDaemon: () => void;
   readonly ackSession: (id: SessionID) => boolean;

package/src/daemon/daemon.ts

@@ -69,6 +69,7 @@ import { loadListenerTokens } from './load-listener-tokens';
 import { loadTranscriptPage } from './load-transcript-page';
 import { makeHookRunner } from './make-hook-runner';
 import type { HookScope } from './make-hook-runner';
+import { makeNonBlockingLog } from './make-non-blocking-log';
 import { materializeWorkspace } from './materialize-workspace';
 import { mintMessageID } from './mint-message-id';
 import { mintSessionID } from './mint-session-id';
@@ -77,6 +78,7 @@ import { PermissionRegistry } from './permission-registry';
 import { requireGitTransports } from './require-git-transports';
 import { restoreFleet } from './restore-fleet';
 import { runEjectHandoff } from './run-eject-handoff';
+import { RuntimeAuthBinder } from './runtime-auth-binder';
 import { ScreenModel } from './screen-model';
 import { SessionRuntime } from './session-runtime';
 import { SessionManager } from './sessions';
@@ -191,6 +193,16 @@ interface ListenOptions {
   // How many delayed handshakes may wait at once across every address; 64
   // when unset.
   readonly maxDelayedHandshakes?: number;
+
+  // The clock the refusal log reads, Date.now when unset, and how long it
+  // folds repeated refusals from one peer into one line; a minute when
+  // unset.
+  readonly now?: () => number;
+  readonly refusalLogIntervalMs?: number;
+
+  // How many peers and kinds of refusal the refusal log tracks at once;
+  // 1024 when unset.
+  readonly maxRefusalWindows?: number;
 }
 
 export interface DaemonHandle {
@@ -230,6 +242,17 @@ const HANDSHAKE_FAILURE_DELAY_MS = 10_000;
 // refused at once.
 const MAX_DELAYED_HANDSHAKES = 64;
 
+// How long the TCP listener folds repeated refusals from one peer into one
+// log line.
+const REFUSAL_LOG_INTERVAL_MS = 60_000;
+
+// How many peers and kinds of refusal the TCP listener's refusal log tracks
+// at once.
+const MAX_REFUSAL_WINDOWS = 1024;
+
+// Where the TCP listener logs when the daemon is given no log.
+const STDERR_FD = 2;
+
 // How long startup waits for a daemon that is shutting down to release the
 // state lock before refusing to start.
 const LOCK_WAIT_MS = 2000;
@@ -278,6 +301,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
   // that stopped mid-effect is settled, so no retry can race either.
   await store.reconcileMaterializations(Date.now());
   await store.reconcileIdempotencyKeys(Date.now());
+  await store.reconcileAuthBindings(Date.now());
 
   await tryRemoveExpiredIdempotencyKeys(store);
 
@@ -317,6 +341,14 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
     mgr.log = opts.log;
   }
 
+  const authBinder = new RuntimeAuthBinder(store);
+
+  mgr.authBinder = authBinder;
+
+  // Settled in the background, since it reaches impd: each binding a
+  // stopped daemon left mid-change stays blocked until it is settled.
+  void tryReconcileAuthBindings(authBinder, store, targetsByID, mgr.log);
+
   const clients = new Set<DaemonConnection>();
 
   const runHooks = makeHookRunner(opts.hooks ?? {});
@@ -1272,7 +1304,11 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
         arch: process.arch,
         build: opts.build,
       },
-      agents: buildAgentList(mgr.collectAdapters(), (bin) => Bun.which(bin) !== null),
+      agents: buildAgentList(
+        mgr.collectAdapters(),
+        (bin) => Bun.which(bin) !== null,
+        targets.some((target) => target.provider?.brokerAuth !== undefined),
+      ),
       targets: buildTargetList(targets, defaultTarget),
       spawnDefaults: { agent: 'claude', target: defaultTarget },
       configRevision,
@@ -1324,6 +1360,9 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
       mgr.requireExecution({ target, targetIdentity: null }, 'transfer');
       mgr.requireExecution({ target, targetIdentity: null }, 'run');
     },
+    requireAgentTarget: (agent, target) => {
+      mgr.requireAgentTarget(agent, target);
+    },
     findSource: (id) => sources.find((source) => source.id === id) ?? null,
     collectAlternateGitURLs: (url) => [
       ...new Set(sources.flatMap((source) => source.findAlternateURLs?.(url) ?? [])),
@@ -1446,6 +1485,8 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
 
       return { forgotten: true, destroyed };
     },
+    revokeSessionAuth: (id) => mgr.revokeAuth(id),
+    updateSessionAuth: (id) => mgr.updateAuth(id),
     ejectSession: (id, prompt) => {
       const s = mgr.sessions.find((x) => x.id === id);
 
@@ -1494,6 +1535,14 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
         return 'no_transcript';
       }
 
+      const listed = mgr.sessions.find((s) => s.id === id);
+
+      // Refused before the headless run stops, so a refusal leaves it as
+      // it was.
+      if (listed !== undefined) {
+        mgr.requireAgentTarget(listed.agent, listed.target);
+      }
+
       const runtime = runtimes.get(id);
 
       runtime?.stopHeadlessRun();
@@ -2010,6 +2059,10 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
           return connection;
         },
         closeConnection: detachConnection,
+        log: opts.log ?? makeNonBlockingLog(STDERR_FD),
+        now: opts.listen.now ?? Date.now,
+        refusalLogIntervalMs: opts.listen.refusalLogIntervalMs ?? REFUSAL_LOG_INTERVAL_MS,
+        maxRefusalWindows: opts.listen.maxRefusalWindows ?? MAX_REFUSAL_WINDOWS,
       });
     } catch (error) {
       await releaseResources();
@@ -2197,6 +2250,36 @@ async function tryRemoveExpiredIdempotencyKeys(store: StateStore): Promise<boole
   return true;
 }
 
+// Settles the runtime auth bindings a stopped daemon left mid-change, each
+// through its target's broker; a host with a fleet entry is listed, and a
+// failure is logged and leaves its binding blocked.
+async function tryReconcileAuthBindings(
+  binder: RuntimeAuthBinder,
+  store: StateStore,
+  targets: ReadonlyMap<string, ExecutionTarget>,
+  log: (line: string) => void,
+): Promise<boolean> {
+  try {
+    const fleet = await store.loadFleet();
+
+    const listed = new Set(fleet.map((entry) => entry.hostKey ?? entry.sessionID));
+
+    await binder.reconcileBindings(
+      (target) => targets.get(target)?.provider?.brokerAuth ?? null,
+      listed,
+      log,
+    );
+  } catch (error) {
+    log(
+      `atc could not settle runtime auth bindings (${error instanceof Error ? error.message : String(error)})`,
+    );
+
+    return false;
+  }
+
+  return true;
+}
+
 interface ConfirmToken {
   readonly session: SessionID;
   readonly expiresAt: number;

package/src/daemon/execution-provider.ts

@@ -1,3 +1,6 @@
+import type { DaemonError } from '../protocol/daemon-error';
+import type { BrokerAuthHost } from './broker-auth-host';
+
 /**
  * The host a session's harness runs on: it starts a process in a
  * pseudo-terminal and, as its capabilities declare, unpacks files into its
@@ -22,6 +25,11 @@ export interface ExecutionProvider {
   // host has none. Absent on the daemon's own machine.
   readonly guest?: GuestLayout;
 
+  // How a harness here can take its credential from impd's broker instead
+  // of holding it. Absent on a host with no broker, which never starts a
+  // session that needs one.
+  readonly brokerAuth?: BrokerAuthHost;
+
   // Readies the host a harness is about to start on: a remote host is
   // created when missing, woken when asleep, and held awake while its
   // harnesses run. Rejects with the refusal before any harness starts.
@@ -41,8 +49,12 @@ export interface ExecutionProvider {
 
   // Puts a host to sleep with every harness on it kept inside, so a revive
   // finds each one as it was. Rejects with `host_leased` when another owner
-  // keeps the host awake, and leaves the host as it was then.
-  readonly suspendHost: (host: string) => Promise<void>;
+  // keeps the host awake, and leaves the host as it was then. A sleep runs
+  // after any readying of the host before it, and a readying waits for it.
+  // isIdle makes it a sleep of an idle host only: it is checked when the
+  // sleep starts and again just before the host sleeps, and a host that a
+  // harness or a readying keeps busy stays awake with `host_unavailable`.
+  readonly suspendHost: (host: string, isIdle?: () => boolean) => Promise<void>;
 
   // Deletes a host and everything on it, harnesses included. Nothing brings
   // a destroyed host back.
@@ -65,6 +77,10 @@ export interface HostRequest {
   // Whether the harness about to start needs atc inside the host, which a
   // provider that ships its own binary installs when missing.
   readonly installATC?: boolean;
+
+  // Whether the daemon has nothing running or starting on the host, which
+  // the provider checks before it gives the host's lease back on its own.
+  readonly isIdle?: () => boolean;
 }
 
 export interface GuestLayout {
@@ -132,6 +148,20 @@ export interface HarnessSpec {
   readonly cols: number;
   readonly rows: number;
 
+  // Whether the harness must not start unless the host's credential broker
+  // is ready: the host refuses the start and runs nothing otherwise, on
+  // every start, a revive's included.
+  readonly requireBroker?: boolean;
+
+  // Admits each start or attach of a harness that requires the broker by
+  // calling send, which hands the request to the host, or rejects with the
+  // refusal that ends the harness instead, sending nothing. send gets the
+  // admission's ticket.
+  readonly admit?: (
+    kind: 'start' | 'attach',
+    send: (ticket: LaunchTicket) => void,
+  ) => Promise<void>;
+
   // Takes each connection a process of the harness opens to the daemon. A
   // remote provider relays them from a socket inside the host that serves
   // this harness alone, and points the harness's ATC_SOCKET at it.
@@ -143,6 +173,18 @@ export interface HarnessSpec {
  * lines: each line the process writes arrives whole, and each line the
  * daemon writes reaches the process in order.
  */
+/**
+ * One admitted request of a harness behind the broker. check runs just
+ * before the request goes out and returns the refusal that stops it
+ * unsent, or null to let it go; release gives the admission up once its
+ * connection ends without the request going out. Each runs at most once
+ * to any effect.
+ */
+export interface LaunchTicket {
+  readonly check: () => DaemonError | null;
+  readonly release: () => void;
+}
+
 export interface HarnessRelay {
   readonly onLine: (listener: (line: string) => void) => void;
   readonly onClose: (listener: () => void) => void;
@@ -176,6 +218,12 @@ export interface HarnessHandle {
   // a provider that can send one; absent on a provider that cannot.
   readonly killForced?: () => void;
 
+  // Resolves once the harness's process has started, or a running one was
+  // attached, and rejects with the refusal when the host ends the harness
+  // or the daemon lets go of it first. Absent on a provider whose harness
+  // starts at once.
+  readonly waitForStart?: () => Promise<void>;
+
   // Resolves true once the harness's process has exited, and false when the
   // wait runs out first or the harness stops being followed without an
   // exit, such as a host that went to sleep with the process inside.

package/src/daemon/format-log-field.ts

@@ -0,0 +1,38 @@
+// The most characters of a field a log line keeps; a longer one is cut and
+// ends in `...`.
+const MAX_FIELD_CHARS = 64;
+
+/**
+ * Formats a value for one `key=value` field of a log line. Every character
+ * outside printable ASCII, and a space, `"`, `=`, or `\`, is written as a
+ * `\u{hex}` escape, so a value from the network can neither move the
+ * terminal, start a new line, nor forge another field. The value is cut to
+ * 64 characters before it is escaped.
+ */
+export function formatLogField(value: string): string {
+  let formatted = '';
+  let kept = 0;
+
+  // Iterating a string steps by code point, so a character outside the
+  // basic plane counts and escapes as one.
+  for (const char of value) {
+    if (kept === MAX_FIELD_CHARS) {
+      return `${formatted}...`;
+    }
+
+    formatted += isPlainChar(char) ? char : formatEscape(char);
+    kept++;
+  }
+
+  return formatted;
+}
+
+function isPlainChar(char: string): boolean {
+  const code = char.codePointAt(0) ?? 0;
+
+  return code > 0x20 && code < 0x7f && char !== '"' && char !== '=' && char !== '\\';
+}
+
+function formatEscape(char: string): string {
+  return `\\u{${(char.codePointAt(0) ?? 0).toString(16)}}`;
+}

package/src/daemon/imp-client-port.ts

@@ -1,10 +1,11 @@
 import { createImpClient, openExecSession, openReverseForward } from '@zgeoff/imp-client';
-import type { ExecOutcome, ImpClient } from '@zgeoff/imp-client';
+import type { ExecOutcome, ExecSessionOptions, ImpClient } from '@zgeoff/imp-client';
 import { isRecord } from '../shared/report';
 import type {
   ImpCommand,
   ImpCommandResult,
   ImpCreateSpec,
+  ImpExecRequirement,
   ImpFeatures,
   ImpIdentity,
   ImpLease,
@@ -63,6 +64,7 @@ export class ImpClientPort implements ImpPort {
       leases: features?.['leases'] === true,
       grantableTokens: features?.['grantableTokens'] === true,
       secretRebind: features?.['secretRebind'] === true,
+      execRequire: features?.['execRequire'] === true,
     };
   };
 
@@ -199,6 +201,7 @@ export class ImpClientPort implements ImpPort {
   readonly openSession = (
     request: ImpSessionRequest,
     handlers: ImpSessionHandlers,
+    gate?: () => boolean,
   ): ImpSessionConnection => {
     const token = this.tryReadToken();
 
@@ -217,34 +220,14 @@ export class ImpClientPort implements ImpPort {
     const session = openExecSession({
       baseUrl: this.url,
       token,
-      start:
-        request.kind === 'start'
-          ? {
-              name: request.name,
-              session: request.session,
-              argv: request.argv,
-              tty: true,
-              env: request.env,
-              cwd: request.cwd,
-              cols: request.cols,
-              rows: request.rows,
-              ...(request.resumeFrom === undefined ? {} : { resumeFrom: request.resumeFrom }),
-            }
-          : {
-              name: request.name,
-              session: request.session,
-              cols: request.cols,
-              rows: request.rows,
-              wake: request.wake,
-              ...(request.resumeFrom === undefined ? {} : { resumeFrom: request.resumeFrom }),
-            },
+      start: buildExecStart(request),
       onStarted: (started) => {
         handlers.onStarted({ created: started.created, output: started.output });
       },
       onOutput: (_channel, data) => {
         handlers.onOutput(data);
       },
-      connect: (url, headers) => new WebSocket(url, { headers }),
+      connect: (url, headers) => openGatedSocket(url, headers, gate),
     });
 
     return {
@@ -389,6 +372,41 @@ function toPortError(error: unknown): ImpPortError {
   return new ImpPortError('UNREACHABLE', message);
 }
 
+// A start or an attach as the client takes it, with the requirements impd
+// checks before the command runs or the attach joins it.
+type ExecStartWithRequire = ExecSessionOptions['start'] & {
+  readonly require?: readonly ImpExecRequirement[];
+};
+
+// The client sends every field of a start or an attach as it is, so a list
+// of requirements reaches impd though the client's types lack it.
+function buildExecStart(request: ImpSessionRequest): ExecStartWithRequire {
+  if (request.kind === 'attach') {
+    return {
+      name: request.name,
+      session: request.session,
+      cols: request.cols,
+      rows: request.rows,
+      wake: request.wake,
+      ...(request.resumeFrom === undefined ? {} : { resumeFrom: request.resumeFrom }),
+      ...(request.require === undefined ? {} : { require: request.require }),
+    };
+  }
+
+  return {
+    name: request.name,
+    session: request.session,
+    argv: request.argv,
+    tty: true,
+    env: request.env,
+    cwd: request.cwd,
+    cols: request.cols,
+    rows: request.rows,
+    ...(request.resumeFrom === undefined ? {} : { resumeFrom: request.resumeFrom }),
+    ...(request.require === undefined ? {} : { require: request.require }),
+  };
+}
+
 // oxlint-disable-next-line prefer-readonly-parameter-types -- a promise is a live handle
 async function waitForSessionOutcome(outcome: Promise<ExecOutcome>): Promise<ImpSessionOutcome> {
   const ended = await outcome;
@@ -469,3 +487,33 @@ function openRelay(accept: RelayAccept): ImpRelayConnection {
     },
   };
 }
+
+// The client sends its request from the socket's open listener. The gate
+// listens first, so a closed gate, or one that throws, stops that
+// listener and closes the socket before anything goes out.
+function openGatedSocket(
+  url: string,
+  headers: Readonly<Record<string, string>>,
+  gate: (() => boolean) | undefined,
+): WebSocket {
+  const socket = new WebSocket(url, { headers });
+
+  if (gate !== undefined) {
+    socket.addEventListener('open', (event) => {
+      if (!tryPassGate(gate)) {
+        event.stopImmediatePropagation();
+        socket.close(1000, 'closed before sending');
+      }
+    });
+  }
+
+  return socket;
+}
+
+function tryPassGate(gate: () => boolean): boolean {
+  try {
+    return gate();
+  } catch {
+    return false;
+  }
+}