@zgeoff/atc 2.26.7 → 2.27.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.26.7",
+  "version": "2.27.0",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",

package/src/agents/agent-adapter.ts

@@ -21,10 +21,11 @@ export interface SpawnOptions {
 }
 
 /**
- * The per-session model and effort a spawn asks for, already checked
- * against what the agent advertises.
+ * The per-launch choices a spawn asks for. Model and effort are checked
+ * against what the agent advertises; workspace trust requires a verified clone.
  */
 export interface SpawnOverrides {
+  readonly trustClonedWorkspace?: boolean;
   readonly model?: string;
   readonly effort?: string;
 }
@@ -227,6 +228,10 @@ export interface AgentAdapter {
   // broker is null.
   readonly planGuestSpawn?: (opts: SpawnOptions, guest: GuestPaths) => GuestSpawnPlan | null;
 
+  // Guest-relative seed files for the exact root of a verified clone.
+  // Absent or null means the adapter cannot accept workspace trust.
+  readonly planGuestWorkspaceTrust?: (root: string) => Readonly<Record<string, string>> | null;
+
   // The credential this agent takes from impd's broker, or null when it
   // takes none. Absent: it takes none.
   readonly findAuthSelection?: () => AuthSelection | null;

package/src/agents/gateway-adapter.ts

@@ -241,6 +241,23 @@ export class GatewayAdapter implements AgentAdapter {
     };
   }
 
+  planGuestWorkspaceTrust(root: string): Readonly<Record<string, string>> | null {
+    if (this.gateway.auth === undefined) {
+      return null;
+    }
+
+    return {
+      [CONFIG_SEED_FILE]: JSON.stringify(
+        {
+          ...ONBOARDED_CONFIG,
+          projects: { [root]: { hasTrustDialogAccepted: true } },
+        },
+        null,
+        2,
+      ),
+    };
+  }
+
   normalizeHook(e: HookEvent): AdapterEvent {
     return this.claude.normalizeHook(e);
   }

package/src/daemon/daemon-connection.ts

@@ -1008,7 +1008,12 @@ export class DaemonConnection {
         namedBy: data.name === '' ? 'auto' : 'user',
         agent,
         parent,
-        overrides: overrides.overrides,
+        overrides: {
+          ...overrides.overrides,
+          ...(data.trustClonedWorkspace === undefined
+            ? {}
+            : { trustClonedWorkspace: data.trustClonedWorkspace }),
+        },
         target,
         workspace: data.workspace ?? null,
       };

package/src/daemon/sessions.ts

@@ -893,6 +893,10 @@ export class SessionManager {
     const execution = this.requireExecution({ target, targetIdentity: null }, 'spawn');
     const provider = execution.provider;
 
+    const trustClonedWorkspace =
+      overrides.trustClonedWorkspace ??
+      this.targets.get(target)?.options['trustClonedWorkspace'] === true;
+
     // The repository root resolves before the process starts: resolving it
     // can throw, and a spawn that throws must leave nothing running. A
     // remote directory is not on the daemon's machine, so it is its own root.
@@ -900,6 +904,24 @@ export class SessionManager {
     const hostKey = this.pickHostKey(id, parent, target, execution.identity);
     const auth = this.resolveHarnessAuth(adapter, provider, target);
 
+    if (trustClonedWorkspace) {
+      if (materialize === null) {
+        throw new DaemonError('bad_args', 'trustClonedWorkspace requires a workspace source');
+      }
+
+      if (
+        provider.kind !== 'imp' ||
+        !provider.remote ||
+        auth === null ||
+        adapter.planGuestWorkspaceTrust === undefined
+      ) {
+        throw new DaemonError(
+          'unsupported',
+          'trustClonedWorkspace requires a brokered Claude gateway on an imp target',
+        );
+      }
+    }
+
     if (hostKey !== id) {
       await this.requireSharedBinding(hostKey, auth?.binding ?? null);
     }
@@ -938,6 +960,24 @@ export class SessionManager {
         authSetup,
       );
 
+    const trustWorkspace = trustClonedWorkspace
+      ? async (root: string) => {
+          const planned = adapter.planGuestWorkspaceTrust?.(root);
+
+          if (planned === undefined || planned === null || provider.guest === undefined) {
+            throw new DaemonError('unsupported', 'this adapter cannot trust a cloned workspace');
+          }
+
+          const files = Object.entries(planned).map(([path, content]) => ({ path, content }));
+
+          await provider.transferArchive(
+            buildTarArchive(files),
+            `${provider.guest.dir}/sessions/${id}`,
+            hostKey,
+          );
+        }
+      : null;
+
     // The host stays readying until its workspace is in place, so nothing
     // gives its lease back or puts it to sleep in between.
     const prepared = await this.withHostReadying(hostKey, async () => {
@@ -954,6 +994,7 @@ export class SessionManager {
         execution.identity,
         materialize,
         setupHost,
+        trustWorkspace,
       );
     });
 
@@ -1428,8 +1469,12 @@ export class SessionManager {
     targetIdentity: string,
     materialize: SpawnMaterializer,
     setupHost: () => Promise<HarnessSetup>,
+    trustWorkspace: ((root: string) => Promise<void>) | null,
   ): Promise<{ readonly setup: HarnessSetup; readonly materialized: MaterializedSpawn | null }> {
-    const readied: { setup: HarnessSetup | null } = { setup: null };
+    const readied: { setup: HarnessSetup | null; root: string | null } = {
+      setup: null,
+      root: null,
+    };
 
     try {
       const materialized = await materialize(
@@ -1441,6 +1486,8 @@ export class SessionManager {
               ? await this.claimHostDir(provider, id, hostKey, target, dir)
               : await this.resolveHostDir(provider, null, dir);
 
+            readied.root = landing;
+
             return { host: hostKey, dir: landing };
           },
           removeClaim: (landing) => this.removeClaimedDir(provider, id, hostKey, target, landing),
@@ -1450,6 +1497,36 @@ export class SessionManager {
 
       readied.setup ??= await setupHost();
 
+      if (trustWorkspace !== null) {
+        if (materialized === null || readied.root === null) {
+          throw new DaemonError(
+            'bad_args',
+            'trustClonedWorkspace requires a successfully cloned workspace',
+          );
+        }
+
+        try {
+          await trustWorkspace(readied.root);
+        } catch (error) {
+          let removed = false;
+
+          try {
+            removed = await this.removeClaimedDir(provider, id, hostKey, target, readied.root);
+          } catch {
+            // A failed rollback retains the spawn's claim for reconciliation.
+          }
+
+          if (!removed) {
+            throw new EffectRemainsError(
+              'workspace trust setup failed and its clone could not be removed',
+              { cause: error },
+            );
+          }
+
+          throw error;
+        }
+      }
+
       return { setup: readied.setup, materialized };
     } catch (error) {
       if (readied.setup !== null) {

package/src/mcp/mcp-tools.ts

@@ -60,6 +60,9 @@ const SPAWN_INPUT: Readonly<Record<string, unknown>> = z.toJSONSchema(
     workspace: SPAWN_SCHEMA.shape.workspace.describe(
       "Where the session's working directory comes from. Omit it to run the session in cwd as it stands. With it, atc materializes a clean checkout into cwd on the target, which must not exist yet: {kind:'path', path, allowDirty?} checks out the pushed HEAD of a git checkout on the atc host, refusing uncommitted changes unless allowDirty is 'warn'; {kind:'git', url, ref or sha, credentialRef?} checks out a branch, tag, or full commit of a repository, with credentialRef {kind:'env', name} naming the atc daemon's environment variable that holds its token. A directory outside git runs in place only on a target on the atc host itself (provider local-pty), with cwd equal to its path. Submodules and Git LFS are refused, and so is a URL that carries a credential.",
     ),
+    trustClonedWorkspace: SPAWN_SCHEMA.shape.trustClonedWorkspace.describe(
+      'Trust the exact verified clone for this launch. An explicit true or false overrides the configured target trustClonedWorkspace default; omitting both keeps trust off. Requires a workspace source, an imp target, and a brokered Claude gateway with isolated guest config; other launches are refused. Accepts repository configuration and helpers without changing tool permission mode. Existing guest config is preserved.',
+    ),
     detached: z
       .boolean()
       .optional()
@@ -403,6 +406,7 @@ export const MCP_TOOLS: readonly MCPToolDefinition[] = [
         idempotencyKey: 'spawn.idempotency',
         target: 'spawn.target',
         workspace: 'spawn.workspace',
+        trustClonedWorkspace: 'spawn.workspace.trust',
       },
     },
   },

package/src/mcp/require-daemon-features.ts

@@ -19,6 +19,7 @@ const FEATURE_USES: Readonly<Record<DaemonFeature, string>> = {
   'report.get': 'atc_report_get',
   'request.principal': 'the target limits of a remote MCP client',
   'spawn.workspace': "atc_session_spawn's workspace",
+  'spawn.workspace.trust': "atc_session_spawn's trustClonedWorkspace",
   sources: 'sources.list and sources.interpret',
   'git.probe': 'git.probe',
   'transport.tcp': 'a TCP connection to the daemon',

package/src/mcp/run-tool.ts

@@ -54,6 +54,9 @@ export function runTool(
         ...(key === undefined ? {} : { idempotencyKey: key }),
         ...(args['target'] === undefined ? {} : { target: args['target'] }),
         ...(args['workspace'] === undefined ? {} : { workspace: args['workspace'] }),
+        ...(args['trustClonedWorkspace'] === undefined
+          ? {}
+          : { trustClonedWorkspace: args['trustClonedWorkspace'] }),
         cols: 100,
         rows: 30,
       };
@@ -71,7 +74,16 @@ export function runTool(
       const workspaceFeatures: readonly DaemonFeature[] =
         args['workspace'] === undefined ? [] : ['spawn.workspace'];
 
-      const required = [...optionFeatures, ...keyFeatures, ...targetFeatures, ...workspaceFeatures];
+      const trustFeatures: readonly DaemonFeature[] =
+        args['trustClonedWorkspace'] === undefined ? [] : ['spawn.workspace.trust'];
+
+      const required = [
+        ...optionFeatures,
+        ...keyFeatures,
+        ...targetFeatures,
+        ...workspaceFeatures,
+        ...trustFeatures,
+      ];
 
       const ok =
         nested && ctx.callerSessionID !== null

package/src/protocol/daemon-features.ts

@@ -47,6 +47,9 @@ export const DAEMON_FEATURES = [
   // `workspace` its checkout was materialized from.
   'spawn.workspace',
 
+  // `session.spawn` takes an explicit trust decision for a cloned imp workspace.
+  'spawn.workspace.trust',
+
   // `session.forget` exists, and a kill of a session asleep on a target that
   // can destroy its host answers `confirmation_required`.
   'session.forget',

package/src/protocol/request-param-schemas.ts

@@ -185,6 +185,9 @@ export const REQUEST_PARAM_SCHEMAS = {
     // session in cwd as it stands, and a source materializes a clean
     // checkout into cwd first.
     workspace: WORKSPACE_SOURCE.optional(),
+    trustClonedWorkspace: z
+      .boolean({ error: 'session.spawn trustClonedWorkspace must be a boolean' })
+      .optional(),
 
     // The session the new one is a sub-session of; absent or empty spawns a
     // top-level session.

package/src/shared/collect-targets.ts

@@ -135,6 +135,19 @@ function collectTargetEntries(raw: unknown): TargetEntries {
       continue;
     }
 
+    if (
+      entry['trustClonedWorkspace'] !== undefined &&
+      typeof entry['trustClonedWorkspace'] !== 'boolean'
+    ) {
+      errors.push({
+        scope: 'target',
+        target: id,
+        problem: `target ${JSON.stringify(id)} must give trustClonedWorkspace as a boolean`,
+      });
+
+      continue;
+    }
+
     const { provider: _, ...options } = entry;
 
     targets.push({ id, provider, options });