@zgeoff/atc 2.26.7 → 2.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.26.7",
+  "version": "2.28.0",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",

package/src/agents/agent-adapter.ts

@@ -21,10 +21,11 @@ export interface SpawnOptions {
 }
 
 /**
- * The per-session model and effort a spawn asks for, already checked
- * against what the agent advertises.
+ * The per-launch choices a spawn asks for. Model and effort are checked
+ * against what the agent advertises; workspace trust requires a verified clone.
  */
 export interface SpawnOverrides {
+  readonly trustClonedWorkspace?: boolean;
   readonly model?: string;
   readonly effort?: string;
 }
@@ -227,6 +228,10 @@ export interface AgentAdapter {
   // broker is null.
   readonly planGuestSpawn?: (opts: SpawnOptions, guest: GuestPaths) => GuestSpawnPlan | null;
 
+  // Guest-relative seed files for the exact root of a verified clone.
+  // Absent or null means the adapter cannot accept workspace trust.
+  readonly planGuestWorkspaceTrust?: (root: string) => Readonly<Record<string, string>> | null;
+
   // The credential this agent takes from impd's broker, or null when it
   // takes none. Absent: it takes none.
   readonly findAuthSelection?: () => AuthSelection | null;

package/src/agents/gateway-adapter.ts

@@ -241,6 +241,23 @@ export class GatewayAdapter implements AgentAdapter {
     };
   }
 
+  planGuestWorkspaceTrust(root: string): Readonly<Record<string, string>> | null {
+    if (this.gateway.auth === undefined) {
+      return null;
+    }
+
+    return {
+      [CONFIG_SEED_FILE]: JSON.stringify(
+        {
+          ...ONBOARDED_CONFIG,
+          projects: { [root]: { hasTrustDialogAccepted: true } },
+        },
+        null,
+        2,
+      ),
+    };
+  }
+
   normalizeHook(e: HookEvent): AdapterEvent {
     return this.claude.normalizeHook(e);
   }

package/src/client/spawn-picker.ts

@@ -19,9 +19,19 @@ import { KEY, planTextEdit } from './keys';
 import { pickRefusalStep } from './pick-refusal-step';
 import { resolvePathInput } from './resolve-path-input';
 import { resolveWorkspaceRoot } from './resolve-workspace-root';
-import { ansi, cols, drawPicker } from './ui';
-
-type PickerStep = 'agent' | 'dir' | 'source' | 'ref' | 'target' | 'confirm' | 'name' | 'prompt';
+import { splitToWidth } from './split-to-width';
+import { ansi, cols, drawPicker, getPickerWidth } from './ui';
+
+type PickerStep =
+  | 'agent'
+  | 'dir'
+  | 'source'
+  | 'ref'
+  | 'target'
+  | 'confirm'
+  | 'name'
+  | 'prompt'
+  | 'spawned';
 
 // What the flow borrows from the client that owns the screen, the daemon
 // connection and the fleet mirror.
@@ -226,6 +236,12 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
 
   private pending: PendingRequest | null = null;
 
+  // A session the daemon started with warnings, and those warnings, shown
+  // before the flow attaches it.
+  private spawned: TMirror | null = null;
+
+  private spawnWarnings: readonly string[] = [];
+
   private requestSeq = 0;
 
   // The flow's generation. Opening the flow and every way out of it moves
@@ -281,6 +297,12 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
   applyKey(buf: Buffer) {
     this.refusal = null;
 
+    if (this.step === 'spawned') {
+      this.applySpawnedKey(buf);
+
+      return;
+    }
+
     const edit = planTextEdit(buf, this.input, {
       isLeaderKey: this.deps.isLeaderKey,
       moves:
@@ -387,6 +409,14 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
       this.renderTargetStep(verb);
     } else if (this.step === 'confirm') {
       this.renderConfirmStep();
+    } else if (this.step === 'spawned') {
+      drawPicker({
+        title: `${verb}: started`,
+        items: this.spawnWarnings.flatMap((w) => splitToWidth(w, getPickerWidth() - 4)),
+        selected: -1,
+        input: '',
+        hint: '⏎ attach · esc back',
+      });
     } else if (this.step === 'name') {
       const where = this.isGitFlow() ? this.formatDestination() : formatDir(this.dir);
 
@@ -1714,9 +1744,49 @@ export class SpawnPicker<TMirror extends { readonly id: string }> {
     this.stopFlow();
     this.deps.upsertMirror(session);
 
+    const warnings = spawned.answer['warnings'];
+
+    // A workspace that left changes behind says so before the session's
+    // screen takes over.
+    if (Array.isArray(warnings) && warnings.length > 0) {
+      this.spawned = session;
+      this.spawnWarnings = warnings.filter((w): w is string => typeof w === 'string');
+      this.step = 'spawned';
+
+      process.stdout.write(ansi.clear);
+      this.render();
+
+      return;
+    }
+
     await this.deps.attach(session.id);
   }
 
+  // The started step takes Enter to attach the session and Esc or the
+  // leader to return to the screen the flow came from; the session runs
+  // either way.
+  private applySpawnedKey(buf: Buffer) {
+    const edit = planTextEdit(buf, '', { isLeaderKey: this.deps.isLeaderKey, moves: false });
+
+    if (edit.kind !== 'submit' && edit.kind !== 'cancel' && edit.kind !== 'leader') {
+      return;
+    }
+
+    const session = this.spawned;
+
+    this.spawned = null;
+    this.spawnWarnings = [];
+    this.step = 'agent';
+
+    if (edit.kind === 'submit' && session !== null) {
+      void this.deps.attach(session.id);
+
+      return;
+    }
+
+    this.deps.toBase();
+  }
+
   // A refused git workspace spawn returns to the step that can fix it. Any
   // other refusal keeps the picker on the step that sent it, with the
   // entered text back in the input, so the user can fix the cause and retry

package/src/client/split-to-width.ts

@@ -0,0 +1,47 @@
+/**
+ * Splits text into rows of at most `width` characters, breaking at spaces
+ * and counting a grapheme cluster as one character. A word wider than a
+ * row breaks at the row's edge, never inside a character.
+ */
+export function splitToWidth(text: string, width: number): string[] {
+  if (width <= 0) {
+    return [text];
+  }
+
+  const segmenter = new Intl.Segmenter();
+
+  const rows: string[] = [];
+  let row: string[] = [];
+
+  for (const word of text.split(' ')) {
+    let rest = Array.from(segmenter.segment(word), (part) => part.segment);
+
+    while (rest.length > width) {
+      if (row.length > 0) {
+        rows.push(row.join(''));
+
+        row = [];
+      }
+
+      rows.push(rest.slice(0, width).join(''));
+
+      rest = rest.slice(width);
+    }
+
+    if (row.length === 0) {
+      row = rest;
+    } else if (row.length + 1 + rest.length <= width) {
+      row = [...row, ' ', ...rest];
+    } else {
+      rows.push(row.join(''));
+
+      row = rest;
+    }
+  }
+
+  if (row.length > 0) {
+    rows.push(row.join(''));
+  }
+
+  return rows;
+}

package/src/client/ui.ts

@@ -65,6 +65,14 @@ export function cols(): number {
   return process.stdout.columns || 80;
 }
 
+/**
+ * The width of the picker box, borders included. An item row holds 4
+ * columns fewer.
+ */
+export function getPickerWidth(): number {
+  return Math.min(cols() - 4, 90);
+}
+
 export function rows(): number {
   return process.stdout.rows || 24;
 }
@@ -393,7 +401,7 @@ export interface PickerView {
 }
 
 export function drawPicker(view: PickerView) {
-  const width = Math.min(cols() - 4, 90);
+  const width = getPickerWidth();
   const rowsList: Row[] = [boxTop(width, view.title)];
   const shown = view.items.slice(0, 10);
 

package/src/daemon/daemon-connection.ts

@@ -1008,7 +1008,12 @@ export class DaemonConnection {
         namedBy: data.name === '' ? 'auto' : 'user',
         agent,
         parent,
-        overrides: overrides.overrides,
+        overrides: {
+          ...overrides.overrides,
+          ...(data.trustClonedWorkspace === undefined
+            ? {}
+            : { trustClonedWorkspace: data.trustClonedWorkspace }),
+        },
         target,
         workspace: data.workspace ?? null,
       };

package/src/daemon/materialize-workspace.ts

@@ -326,7 +326,7 @@ async function resolveSource(
     await requireNoOriginRewriteCredentials(source.path);
 
     const resolved = await resolvePathSource(source.path, {
-      allowDirty: source.allowDirty ?? 'refuse',
+      ...(source.allowDirty === undefined ? {} : { allowDirty: source.allowDirty }),
       transports,
     });
 

package/src/daemon/sessions.ts

@@ -893,6 +893,10 @@ export class SessionManager {
     const execution = this.requireExecution({ target, targetIdentity: null }, 'spawn');
     const provider = execution.provider;
 
+    const trustClonedWorkspace =
+      overrides.trustClonedWorkspace ??
+      this.targets.get(target)?.options['trustClonedWorkspace'] === true;
+
     // The repository root resolves before the process starts: resolving it
     // can throw, and a spawn that throws must leave nothing running. A
     // remote directory is not on the daemon's machine, so it is its own root.
@@ -900,6 +904,24 @@ export class SessionManager {
     const hostKey = this.pickHostKey(id, parent, target, execution.identity);
     const auth = this.resolveHarnessAuth(adapter, provider, target);
 
+    if (trustClonedWorkspace) {
+      if (materialize === null) {
+        throw new DaemonError('bad_args', 'trustClonedWorkspace requires a workspace source');
+      }
+
+      if (
+        provider.kind !== 'imp' ||
+        !provider.remote ||
+        auth === null ||
+        adapter.planGuestWorkspaceTrust === undefined
+      ) {
+        throw new DaemonError(
+          'unsupported',
+          'trustClonedWorkspace requires a brokered Claude gateway on an imp target',
+        );
+      }
+    }
+
     if (hostKey !== id) {
       await this.requireSharedBinding(hostKey, auth?.binding ?? null);
     }
@@ -938,6 +960,24 @@ export class SessionManager {
         authSetup,
       );
 
+    const trustWorkspace = trustClonedWorkspace
+      ? async (root: string) => {
+          const planned = adapter.planGuestWorkspaceTrust?.(root);
+
+          if (planned === undefined || planned === null || provider.guest === undefined) {
+            throw new DaemonError('unsupported', 'this adapter cannot trust a cloned workspace');
+          }
+
+          const files = Object.entries(planned).map(([path, content]) => ({ path, content }));
+
+          await provider.transferArchive(
+            buildTarArchive(files),
+            `${provider.guest.dir}/sessions/${id}`,
+            hostKey,
+          );
+        }
+      : null;
+
     // The host stays readying until its workspace is in place, so nothing
     // gives its lease back or puts it to sleep in between.
     const prepared = await this.withHostReadying(hostKey, async () => {
@@ -954,6 +994,7 @@ export class SessionManager {
         execution.identity,
         materialize,
         setupHost,
+        trustWorkspace,
       );
     });
 
@@ -1428,8 +1469,12 @@ export class SessionManager {
     targetIdentity: string,
     materialize: SpawnMaterializer,
     setupHost: () => Promise<HarnessSetup>,
+    trustWorkspace: ((root: string) => Promise<void>) | null,
   ): Promise<{ readonly setup: HarnessSetup; readonly materialized: MaterializedSpawn | null }> {
-    const readied: { setup: HarnessSetup | null } = { setup: null };
+    const readied: { setup: HarnessSetup | null; root: string | null } = {
+      setup: null,
+      root: null,
+    };
 
     try {
       const materialized = await materialize(
@@ -1441,6 +1486,8 @@ export class SessionManager {
               ? await this.claimHostDir(provider, id, hostKey, target, dir)
               : await this.resolveHostDir(provider, null, dir);
 
+            readied.root = landing;
+
             return { host: hostKey, dir: landing };
           },
           removeClaim: (landing) => this.removeClaimedDir(provider, id, hostKey, target, landing),
@@ -1450,6 +1497,36 @@ export class SessionManager {
 
       readied.setup ??= await setupHost();
 
+      if (trustWorkspace !== null) {
+        if (materialized === null || readied.root === null) {
+          throw new DaemonError(
+            'bad_args',
+            'trustClonedWorkspace requires a successfully cloned workspace',
+          );
+        }
+
+        try {
+          await trustWorkspace(readied.root);
+        } catch (error) {
+          let removed = false;
+
+          try {
+            removed = await this.removeClaimedDir(provider, id, hostKey, target, readied.root);
+          } catch {
+            // A failed rollback retains the spawn's claim for reconciliation.
+          }
+
+          if (!removed) {
+            throw new EffectRemainsError(
+              'workspace trust setup failed and its clone could not be removed',
+              { cause: error },
+            );
+          }
+
+          throw error;
+        }
+      }
+
       return { setup: readied.setup, materialized };
     } catch (error) {
       if (readied.setup !== null) {

package/src/mcp/mcp-tools.ts

@@ -58,7 +58,10 @@ const SPAWN_INPUT: Readonly<Record<string, unknown>> = z.toJSONSchema(
       'Execution target for the new session, one of the target ids in atc_agents_list. Omit it to run on the default target (spawnDefaults.target). An unknown or unavailable target is refused; atc never runs the session on another target instead.',
     ),
     workspace: SPAWN_SCHEMA.shape.workspace.describe(
-      "Where the session's working directory comes from. Omit it to run the session in cwd as it stands. With it, atc materializes a clean checkout into cwd on the target, which must not exist yet: {kind:'path', path, allowDirty?} checks out the pushed HEAD of a git checkout on the atc host, refusing uncommitted changes unless allowDirty is 'warn'; {kind:'git', url, ref or sha, credentialRef?} checks out a branch, tag, or full commit of a repository, with credentialRef {kind:'env', name} naming the atc daemon's environment variable that holds its token. A directory outside git runs in place only on a target on the atc host itself (provider local-pty), with cwd equal to its path. Submodules and Git LFS are refused, and so is a URL that carries a credential.",
+      "Where the session's working directory comes from. Omit it to run the session in cwd as it stands. With it, atc materializes a clean checkout into cwd on the target, which must not exist yet: {kind:'path', path, allowDirty?} checks out the pushed HEAD of a git checkout on the atc host, leaving its uncommitted and untracked changes behind with a warning, or refusing them when allowDirty is 'refuse'; {kind:'git', url, ref or sha, credentialRef?} checks out a branch, tag, or full commit of a repository, with credentialRef {kind:'env', name} naming the atc daemon's environment variable that holds its token. A directory outside git runs in place only on a target on the atc host itself (provider local-pty), with cwd equal to its path. Submodules and Git LFS are refused, and so is a URL that carries a credential.",
+    ),
+    trustClonedWorkspace: SPAWN_SCHEMA.shape.trustClonedWorkspace.describe(
+      'Trust the exact verified clone for this launch. An explicit true or false overrides the configured target trustClonedWorkspace default; omitting both keeps trust off. Requires a workspace source, an imp target, and a brokered Claude gateway with isolated guest config; other launches are refused. Accepts repository configuration and helpers without changing tool permission mode. Existing guest config is preserved.',
     ),
     detached: z
       .boolean()
@@ -403,6 +406,7 @@ export const MCP_TOOLS: readonly MCPToolDefinition[] = [
         idempotencyKey: 'spawn.idempotency',
         target: 'spawn.target',
         workspace: 'spawn.workspace',
+        trustClonedWorkspace: 'spawn.workspace.trust',
       },
     },
   },

package/src/mcp/require-daemon-features.ts

@@ -19,6 +19,7 @@ const FEATURE_USES: Readonly<Record<DaemonFeature, string>> = {
   'report.get': 'atc_report_get',
   'request.principal': 'the target limits of a remote MCP client',
   'spawn.workspace': "atc_session_spawn's workspace",
+  'spawn.workspace.trust': "atc_session_spawn's trustClonedWorkspace",
   sources: 'sources.list and sources.interpret',
   'git.probe': 'git.probe',
   'transport.tcp': 'a TCP connection to the daemon',

package/src/mcp/run-tool.ts

@@ -54,6 +54,9 @@ export function runTool(
         ...(key === undefined ? {} : { idempotencyKey: key }),
         ...(args['target'] === undefined ? {} : { target: args['target'] }),
         ...(args['workspace'] === undefined ? {} : { workspace: args['workspace'] }),
+        ...(args['trustClonedWorkspace'] === undefined
+          ? {}
+          : { trustClonedWorkspace: args['trustClonedWorkspace'] }),
         cols: 100,
         rows: 30,
       };
@@ -71,7 +74,16 @@ export function runTool(
       const workspaceFeatures: readonly DaemonFeature[] =
         args['workspace'] === undefined ? [] : ['spawn.workspace'];
 
-      const required = [...optionFeatures, ...keyFeatures, ...targetFeatures, ...workspaceFeatures];
+      const trustFeatures: readonly DaemonFeature[] =
+        args['trustClonedWorkspace'] === undefined ? [] : ['spawn.workspace.trust'];
+
+      const required = [
+        ...optionFeatures,
+        ...keyFeatures,
+        ...targetFeatures,
+        ...workspaceFeatures,
+        ...trustFeatures,
+      ];
 
       const ok =
         nested && ctx.callerSessionID !== null

package/src/protocol/daemon-features.ts

@@ -47,6 +47,9 @@ export const DAEMON_FEATURES = [
   // `workspace` its checkout was materialized from.
   'spawn.workspace',
 
+  // `session.spawn` takes an explicit trust decision for a cloned imp workspace.
+  'spawn.workspace.trust',
+
   // `session.forget` exists, and a kill of a session asleep on a target that
   // can destroy its host answers `confirmation_required`.
   'session.forget',

package/src/protocol/request-param-schemas.ts

@@ -54,8 +54,9 @@ const GIT_SHA = z.string().regex(COMMIT_ID, 'a git workspace sha is a full commi
  * Where a spawn's working directory comes from, materialized as a clean
  * checkout into the spawn's `cwd` on its execution target. A `path` source
  * is a directory on the daemon's host, resolved to its origin URL and
- * pushed HEAD; `allowDirty: 'warn'` resolves a tree with uncommitted
- * changes to HEAD and leaves the changes behind with a warning. A `git`
+ * pushed HEAD. A tree with uncommitted or untracked changes resolves to
+ * HEAD and leaves the changes behind with a warning, unless `allowDirty`
+ * is `'refuse'`, which refuses it. A `git`
  * source is a repository URL with a branch or tag `ref`, a full commit
  * `sha`, or both, and an optional `credentialRef` naming the daemon
  * environment variable that holds its token. With both, the sha is the
@@ -185,6 +186,9 @@ export const REQUEST_PARAM_SCHEMAS = {
     // session in cwd as it stands, and a source materializes a clean
     // checkout into cwd first.
     workspace: WORKSPACE_SOURCE.optional(),
+    trustClonedWorkspace: z
+      .boolean({ error: 'session.spawn trustClonedWorkspace must be a boolean' })
+      .optional(),
 
     // The session the new one is a sub-session of; absent or empty spawns a
     // top-level session.

package/src/shared/collect-targets.ts

@@ -135,6 +135,19 @@ function collectTargetEntries(raw: unknown): TargetEntries {
       continue;
     }
 
+    if (
+      entry['trustClonedWorkspace'] !== undefined &&
+      typeof entry['trustClonedWorkspace'] !== 'boolean'
+    ) {
+      errors.push({
+        scope: 'target',
+        target: id,
+        problem: `target ${JSON.stringify(id)} must give trustClonedWorkspace as a boolean`,
+      });
+
+      continue;
+    }
+
     const { provider: _, ...options } = entry;
 
     targets.push({ id, provider, options });

package/src/workspace/resolve-path-source.ts

@@ -39,8 +39,9 @@ interface PathSourceRefusal {
  * can clone, so a workspace never carries files that exist only here. The
  * commit is HEAD, and it must already be on origin: a remote-tracking ref
  * under origin contains it, or origin advertises it as a ref tip. A tree
- * with uncommitted or untracked changes is refused, or with `allowDirty:
- * 'warn'` resolves to HEAD and leaves those changes behind with a warning.
+ * with uncommitted or untracked changes resolves to HEAD and leaves those
+ * changes behind, with a warning that counts them; `allowDirty: 'refuse'`
+ * refuses it instead. The changes are never copied.
  * Submodules are refused. The URL is origin's, with any credential stripped.
  */
 export async function resolvePathSource(
@@ -81,7 +82,9 @@ export async function resolvePathSource(
     return { ok: false, code: 'has_submodules', message: `${root} uses submodules` };
   }
 
-  const status = await runGit(['status', '--porcelain', '--untracked-files=normal'], { cwd: root });
+  // Every untracked file is listed on its own, so an untracked directory
+  // counts each file inside it.
+  const status = await runGit(['status', '--porcelain', '--untracked-files=all'], { cwd: root });
 
   if (status.exitCode !== 0) {
     return {
@@ -91,10 +94,11 @@ export async function resolvePathSource(
     };
   }
 
-  const dirty = status.stdout.trim() !== '';
+  const changed = countChangedPaths(status.stdout);
+  const dirty = changed > 0;
   const warnings: string[] = [];
 
-  if (dirty && options.allowDirty !== 'warn') {
+  if (dirty && options.allowDirty === 'refuse') {
     return {
       ok: false,
       code: 'workspace_dirty',
@@ -103,7 +107,10 @@ export async function resolvePathSource(
   }
 
   if (dirty) {
-    warnings.push(`uncommitted and untracked changes in ${root} stay behind; using ${sha}`);
+    // The commit leads, so a display that cuts the note short keeps it.
+    warnings.push(
+      `cloned commit ${sha.slice(0, 12)}; left ${changed} uncommitted or untracked ${changed === 1 ? 'path' : 'paths'} behind in ${root}`,
+    );
   }
 
   const origin = await runGit(['ls-remote', '--get-url', 'origin'], { cwd: root });
@@ -150,6 +157,14 @@ function hasSubmodules(listing: string): boolean {
     .some((line) => line.startsWith('160000 ') || line.endsWith('\t.gitmodules'));
 }
 
+/**
+ * How many paths a porcelain status listing holds. Only the count leaves
+ * this module: a path's name can itself be sensitive.
+ */
+function countChangedPaths(porcelain: string): number {
+  return porcelain.split('\n').filter((line) => line.trim() !== '').length;
+}
+
 /**
  * Whether origin already has the commit. A local remote-tracking ref proves
  * it without network access; failing that, origin's advertised ref tips are