@zgeoff/atc 2.24.0 → 2.26.0

package/src/daemon/start-tcp-listener.ts

@@ -1,6 +1,8 @@
 import type { DaemonConnection, TCPPeer } from './daemon-connection';
 import { findTokenFingerprint } from './find-token-fingerprint';
+import { formatLogField } from './format-log-field';
 import { HandshakeThrottle } from './handshake-throttle';
+import { RefusalLog } from './refusal-log';
 
 // The slice of an accepted socket a protocol connection writes to and ends.
 interface ListenerSocket {
@@ -26,6 +28,16 @@ interface TCPListenerOptions {
 
   // oxlint-disable-next-line prefer-readonly-parameter-types -- a connection is a live object the daemon releases
   readonly closeConnection: (connection: DaemonConnection) => void;
+
+  // Where the listener start and each refusal are logged, one line at a
+  // time, with the clock and the window that summarize repeated refusals
+  // from one peer.
+  readonly log: (line: string) => void;
+  readonly now: () => number;
+  readonly refusalLogIntervalMs: number;
+
+  // How many peers and kinds of refusal the refusal log tracks at once.
+  readonly maxRefusalWindows: number;
 }
 
 export interface TCPListener {
@@ -55,6 +67,13 @@ export function startTCPListener(opts: TCPListenerOptions): TCPListener {
   const throttle = new HandshakeThrottle(opts.failureDelayMs);
   const connections = new Set<DaemonConnection>();
 
+  const refusals = new RefusalLog({
+    log: opts.log,
+    now: opts.now,
+    intervalMs: opts.refusalLogIntervalMs,
+    maxWindows: opts.maxRefusalWindows,
+  });
+
   let delayed = 0;
 
   // Ends the delayed handshake of each open socket once it closes.
@@ -77,6 +96,12 @@ export function startTCPListener(opts: TCPListenerOptions): TCPListener {
             if (delay > 0 && delayed >= opts.maxDelayedHandshakes) {
               throttle.recordFailure(address, Date.now());
 
+              refusals.record({
+                event: 'handshake_refused',
+                peer: address,
+                reason: 'delay_cap_full',
+              });
+
               return null;
             }
 
@@ -96,6 +121,12 @@ export function startTCPListener(opts: TCPListenerOptions): TCPListener {
               delayed--;
 
               if (waited === 'closed') {
+                refusals.record({
+                  event: 'handshake_refused',
+                  peer: address,
+                  reason: 'closed_during_delay',
+                });
+
                 return null;
               }
             }
@@ -107,12 +138,22 @@ export function startTCPListener(opts: TCPListenerOptions): TCPListener {
 
             if (fingerprint === null) {
               throttle.recordFailure(address, Date.now());
+
+              refusals.record({
+                event: 'handshake_refused',
+                peer: address,
+                reason: presented === null ? 'missing_token' : 'unauthorized',
+              });
             }
 
             return fingerprint;
           },
-          recordFailure: () => {
+          recordFailure: (reason) => {
             throttle.recordFailure(address, Date.now());
+            refusals.record({ event: 'handshake_refused', peer: address, reason });
+          },
+          recordRefusedPrincipal: () => {
+            refusals.record({ event: 'principal_refused', peer: address });
           },
         };
 
@@ -136,6 +177,10 @@ export function startTCPListener(opts: TCPListenerOptions): TCPListener {
     },
   });
 
+  opts.log(
+    `atc tcp event=listening host=${formatLogField(server.hostname)} port=${String(server.port)}`,
+  );
+
   return {
     port: server.port,
     setTokens(next) {
@@ -160,6 +205,7 @@ export function startTCPListener(opts: TCPListenerOptions): TCPListener {
       }
 
       server.stop(true);
+      refusals.drain();
     },
   };
 }

package/src/daemon/verify-broker-authority.ts

@@ -15,8 +15,9 @@ export interface BrokerActivation {
 /**
  * The gate before atc grants or relies on a brokered credential. It reads
  * impd's features, then the token's identity, and writes nothing, so a
- * refusal leaves impd as it was. It rejects unless impd has both grantable
- * tokens and secret rebinds, the token may manage each imp and reaches no
+ * refusal leaves impd as it was. It rejects unless impd has grantable
+ * tokens, secret rebinds and exec requirements, so a start can refuse to
+ * run without a ready broker, the token may manage each imp and reaches no
  * imp outside the namespace whose imp names start with the prefix, and the
  * token may grant every bound secret.
  * Whether each secret's rules match the binding is a separate comparison.
@@ -28,11 +29,15 @@ export async function verifyBrokerAuthority(
 ): Promise<void> {
   const features = await port.readFeatures();
 
-  if (!features.grantableTokens || !features.secretRebind) {
+  if (!features.grantableTokens || !features.secretRebind || !features.execRequire) {
     throw new BrokerAuthorityError(
       'auth_impd_too_old',
-      'impd lacks grantable tokens or secret rebinds; it must be 0.27.0 or later',
-      { grantableTokens: features.grantableTokens, secretRebind: features.secretRebind },
+      'impd lacks grantable tokens, secret rebinds or exec requirements; it must be 0.30.0 or later',
+      {
+        grantableTokens: features.grantableTokens,
+        secretRebind: features.secretRebind,
+        execRequire: features.execRequire,
+      },
     );
   }
 

package/src/mcp/mcp-tools.ts

@@ -213,6 +213,7 @@ const AGENTS_OUTPUT: Readonly<Record<string, unknown>> = {
           label: { type: 'string' },
           kind: { type: 'string' },
           installed: { type: 'boolean' },
+          brokerAuth: { type: 'boolean' },
           capabilities: {
             type: 'object',
             properties: {
@@ -249,6 +250,7 @@ const AGENTS_OUTPUT: Readonly<Record<string, unknown>> = {
             type: 'object',
             additionalProperties: { type: 'boolean' },
           },
+          brokerAuth: { type: 'boolean' },
         },
         required: ['id', 'provider', 'identity', 'available', 'default', 'capabilities'],
       },

package/src/mcp/require-daemon-features.ts

@@ -23,6 +23,7 @@ const FEATURE_USES: Readonly<Record<DaemonFeature, string>> = {
   'git.probe': 'git.probe',
   'transport.tcp': 'a TCP connection to the daemon',
   'idempotency.replayOnly': 'a resend that only replays a held idempotency key',
+  'session.auth': 'session.auth.revoke and session.auth.rebind',
 };
 
 /**

package/src/protocol/daemon-features.ts

@@ -73,6 +73,10 @@ export const DAEMON_FEATURES = [
   // replays a key the daemon holds and refuses one it does not hold with
   // `idempotency_key_unknown`, running nothing.
   'idempotency.replayOnly',
+
+  // `session.auth.revoke` and `session.auth.rebind` exist, open to the
+  // daemon's owner only.
+  'session.auth',
 ] as const;
 
 export type DaemonFeature = (typeof DAEMON_FEATURES)[number];

package/src/protocol/protocol.ts

@@ -49,6 +49,23 @@ const ERROR_CODES = [
   'host_unavailable',
   'auth_not_configured',
   'auth_target_unsupported',
+  'auth_impd_too_old',
+  'auth_token_scope',
+  'auth_token_too_broad',
+  'auth_imp_out_of_scope',
+  'auth_secret_not_grantable',
+  'auth_secret_mismatch',
+  'auth_runtime_mismatch',
+  'auth_runtime_exists',
+  'auth_grant_missing',
+  'auth_grants_mismatch',
+  'auth_rebind_required',
+  'auth_blocked',
+  'auth_binding_mismatch',
+  'auth_binding_invalid',
+  'auth_revocation_pending',
+  'broker_not_ready',
+  'auth_placeholder_unsupported',
   'host_leased',
   'confirmation_required',
   'confirm_token_invalid',

package/src/protocol/request-param-schemas.ts

@@ -204,6 +204,11 @@ export const REQUEST_PARAM_SCHEMAS = {
       .min(1, 'session.forget confirmToken must not be empty')
       .optional(),
   }),
+
+  // Owner-only: withdraw the grants of the runtime auth binding on the
+  // session's host, or bind that host to its agent's current selection.
+  'session.auth.revoke': SESSION_DEFAULTED,
+  'session.auth.rebind': SESSION_DEFAULTED,
   'session.update': SESSION_DEFAULTED.extend({
     name: buildOptionalString(),
     pinned: buildOptionalBoolean(),

package/src/shared/collect-gateways.ts

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import type { AgentID } from './agent-id';
 import { buildOptionalStringArray } from './build-optional-string-array';
 import type { AuthProfile } from './collect-auth-profiles';
+import { isBrokerVariable } from './is-broker-variable';
 import { isRecord } from './report';
 import { resolveAuthProfiles } from './resolve-auth-profiles';
 
@@ -251,28 +252,6 @@ function collectEnvProblems(source: string, keys: readonly string[]): string[] {
     .map((key) => `${source} must not set ${key}`);
 }
 
-// Variables impd sets in a brokered exec to route requests through the
-// broker and trust its CA. impd lets a variable the caller sets win, so a
-// configured one would route around the broker or mask a failed CA install.
-const BROKER_VARIABLES: ReadonlySet<string> = new Set([
-  'HTTPS_PROXY',
-  'HTTP_PROXY',
-  'ALL_PROXY',
-  'NO_PROXY',
-  'NODE_USE_ENV_PROXY',
-  'SSL_CERT_FILE',
-  'SSL_CERT_DIR',
-  'NODE_EXTRA_CA_CERTS',
-  'GIT_SSL_CAINFO',
-  'REQUESTS_CA_BUNDLE',
-  'CURL_CA_BUNDLE',
-]);
-
-// Proxy and CA variables are read in either case by some clients.
-function isBrokerVariable(key: string): boolean {
-  return BROKER_VARIABLES.has(key.toUpperCase());
-}
-
 function collectPlaceholderProblems(env: Readonly<Record<string, string>>): string[] {
   return Object.keys(env)
     .filter((key) => isBrokerVariable(key) || key === BASE_URL_VARIABLE)

package/src/shared/is-broker-variable.ts

@@ -0,0 +1,24 @@
+/**
+ * Whether a variable is one impd sets in a brokered exec to route requests
+ * through the broker and trust its CA. impd lets a variable the caller
+ * sets win, so a caller's own value would route around the broker or mask
+ * a failed CA install. Some clients read proxy and CA variables in either
+ * case, so the check ignores case.
+ */
+export function isBrokerVariable(key: string): boolean {
+  return BROKER_VARIABLES.has(key.toUpperCase());
+}
+
+const BROKER_VARIABLES: ReadonlySet<string> = new Set([
+  'HTTPS_PROXY',
+  'HTTP_PROXY',
+  'ALL_PROXY',
+  'NO_PROXY',
+  'NODE_USE_ENV_PROXY',
+  'SSL_CERT_FILE',
+  'SSL_CERT_DIR',
+  'NODE_EXTRA_CA_CERTS',
+  'GIT_SSL_CAINFO',
+  'REQUESTS_CA_BUNDLE',
+  'CURL_CA_BUNDLE',
+]);

package/src/store/state-store.ts

@@ -1054,6 +1054,17 @@ export class StateStore {
     return row === undefined ? null : toRuntimeAuthBinding(row);
   }
 
+  // Every host's binding, by host key.
+  async collectAuthBindings(): Promise<RuntimeAuthBinding[]> {
+    const rows = await this.db
+      .selectFrom('runtime_auth_binding')
+      .selectAll()
+      .orderBy('host_key')
+      .execute();
+
+    return rows.map((row) => toRuntimeAuthBinding(row));
+  }
+
   // Writes one secret's grant row for a host, or moves the existing one to
   // the given phase, revision and attempt.
   async upsertAuthGrant(grant: Omit<RuntimeAuthGrant, 'updatedAt'>, at: number): Promise<void> {