@zgeoff/atc 2.30.1 → 2.31.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.30.1",
+  "version": "2.31.1",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",
@@ -76,7 +76,10 @@
     "hono": ">=4.13.5",
     "ip-address": "10.7.2",
     "js-yaml": ">=4.3.2 <5",
-    "qs": "6.16.0"
+    "proxy-addr": "2.0.8",
+    "qs": "6.16.0",
+    "smol-toml": "1.9.0",
+    "tinypool": "2.1.2"
   },
   "packageManager": "bun@1.3.10"
 }

package/src/agents/agent-adapter.ts

@@ -232,6 +232,12 @@ export interface AgentAdapter {
   // Absent or null means the adapter cannot accept workspace trust.
   readonly planGuestWorkspaceTrust?: (root: string) => Readonly<Record<string, string>> | null;
 
+  // Accepts folder trust for the exact root of a verified clone on the
+  // daemon's machine, in the agent's own config, and resolves to a function
+  // that takes it back for a launch that fails before the agent starts.
+  // Absent means the adapter cannot accept workspace trust there.
+  readonly updateLocalWorkspaceTrust?: (root: string) => Promise<() => Promise<void>>;
+
   // The credential this agent takes from impd's broker, or null when it
   // takes none. Absent: it takes none.
   readonly findAuthSelection?: () => AuthSelection | null;

package/src/agents/claude-adapter.ts

@@ -30,8 +30,10 @@ import { findFlagValue } from './find-flag-value';
 import { makeClaudeHeadlessRunner } from './make-claude-headless-runner';
 import type { ClaudeHeadlessRun } from './make-claude-headless-runner';
 import { parseClaudeTranscriptLine } from './parse-claude-transcript-line';
-import { planTypedLineInput } from './plan-typed-line-input';
+import { planPastedLineInput } from './plan-pasted-line-input';
+import { resolveClaudeGlobalConfigPath } from './resolve-claude-global-config-path';
 import { resolveClaudePermissionMode } from './resolve-claude-permission-mode';
+import { updateClaudeProjectTrust } from './update-claude-project-trust';
 import { writeATCBridge } from './write-atc-bridge';
 import { writeHookSettings } from './write-hook-settings';
 
@@ -62,8 +64,9 @@ export class ClaudeAdapter implements AgentAdapter {
 
   readonly parseTranscriptLine = parseClaudeTranscriptLine;
 
-  // Claude's TUI submits a line typed with its newline in one write.
-  readonly planLineInput = planTypedLineInput;
+  // Claude's TUI takes a long burst of input as a paste and keeps its
+  // newline in the composer, so a line is pasted and then submitted.
+  readonly planLineInput = planPastedLineInput;
 
   readonly profile: AgentProfile;
 
@@ -153,6 +156,12 @@ export class ClaudeAdapter implements AgentAdapter {
     return this.bridgeDir;
   }
 
+  // A session on the daemon's machine reads the user's own Claude config,
+  // so trust for the clone is that config's entry for the clone alone.
+  updateLocalWorkspaceTrust(root: string): Promise<() => Promise<void>> {
+    return updateClaudeProjectTrust(resolveClaudeGlobalConfigPath(), root);
+  }
+
   normalizeHook(e: HookEvent): AdapterEvent {
     const parsed = CLAUDE_HOOK_PAYLOAD_SCHEMA.safeParse(e.payload);
     const payload: ClaudeHookPayload = parsed.success ? parsed.data : {};

package/src/agents/gateway-adapter.ts

@@ -33,7 +33,7 @@ import { findFlagValue } from './find-flag-value';
 import { makeClaudeHeadlessRunner } from './make-claude-headless-runner';
 import type { ClaudeHeadlessRun } from './make-claude-headless-runner';
 import { parseClaudeTranscriptLine } from './parse-claude-transcript-line';
-import { planTypedLineInput } from './plan-typed-line-input';
+import { planPastedLineInput } from './plan-pasted-line-input';
 import { resolveClaudePermissionMode } from './resolve-claude-permission-mode';
 import { writeATCBridge } from './write-atc-bridge';
 import { writeHookSettings } from './write-hook-settings';
@@ -60,7 +60,7 @@ export class GatewayAdapter implements AgentAdapter {
   readonly parseTranscriptLine = parseClaudeTranscriptLine;
 
   // The gateway runs the Claude CLI, whose TUI takes a line the same way.
-  readonly planLineInput = planTypedLineInput;
+  readonly planLineInput = planPastedLineInput;
 
   readonly takesMessages = true;
 

package/src/agents/plan-pasted-line-input.ts

@@ -13,9 +13,14 @@ const PASTE_END = '\u001B[201~';
  * arrive. Paste markers inside the text are dropped, so the text can neither
  * end the paste early nor start one of its own. A TUI that has not turned
  * bracketed paste on gets the text unmarked, and may still read both writes
- * as one burst.
+ * as one burst. Empty text is the carriage return alone, which submits what
+ * the composer holds and adds nothing to it.
  */
 export function planPastedLineInput(text: string, modes: TerminalInputModes): readonly string[] {
+  if (text === '') {
+    return ['\r'];
+  }
+
   const unmarked = text.replaceAll(PASTE_START, '').replaceAll(PASTE_END, '');
 
   return modes.bracketedPaste ? [`${PASTE_START}${unmarked}${PASTE_END}`, '\r'] : [unmarked, '\r'];

package/src/agents/resolve-claude-global-config-path.ts

@@ -0,0 +1,18 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveHomeDir } from '../shared/resolve-home-dir';
+
+/**
+ * The file the Claude CLI on the daemon's machine keeps its global state
+ * in, folder trust included, resolved as the CLI resolves it: a legacy
+ * `.config.json` in its config folder when one exists, otherwise
+ * `.claude.json` in `$CLAUDE_CONFIG_DIR`, or in the user's home when that
+ * is unset or empty.
+ */
+export function resolveClaudeGlobalConfigPath(): string {
+  const configDir = process.env['CLAUDE_CONFIG_DIR'];
+  const custom = configDir !== undefined && configDir !== '' ? configDir : null;
+  const legacy = join(custom ?? join(resolveHomeDir(), '.claude'), '.config.json');
+
+  return existsSync(legacy) ? legacy : join(custom ?? resolveHomeDir(), '.claude.json');
+}

package/src/agents/update-claude-project-trust.ts

@@ -0,0 +1,119 @@
+import { randomUUID } from 'node:crypto';
+import { readFile, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { isRecord } from '../shared/report';
+import { withClaudeConfigLock } from './with-claude-config-lock';
+
+/**
+ * Accepts the Claude CLI's folder trust for one exact directory in its
+ * global config, under the lock the CLI writes that config under. Only the
+ * directory's entry in `projects` changes: every other key keeps its value,
+ * and an entry already trusted leaves the file as it is. The write lands
+ * through a rename, so a reader sees the old file or the new one, never
+ * part of either.
+ *
+ * Resolves to a function that takes the trust back, for a launch that
+ * fails before the CLI starts: it puts back the entry as it was, unless
+ * something has changed the entry since, which leaves it as it stands.
+ */
+export async function updateClaudeProjectTrust(
+  configPath: string,
+  root: string,
+): Promise<() => Promise<void>> {
+  const previous = await withClaudeConfigLock(configPath, async () => {
+    const config = await loadClaudeConfig(configPath);
+
+    const projects = isRecord(config['projects']) ? config['projects'] : {};
+    const entry = projects[root];
+
+    if (isRecord(entry) && entry['hasTrustDialogAccepted'] === true) {
+      return null;
+    }
+
+    const base = isRecord(entry) ? entry : {};
+
+    await writeClaudeConfig(configPath, {
+      ...config,
+      projects: { ...projects, [root]: { ...base, hasTrustDialogAccepted: true } },
+    });
+
+    return { entry: isRecord(entry) ? entry : null };
+  });
+
+  if (previous === null) {
+    return () => Promise.resolve();
+  }
+
+  const written = JSON.stringify({
+    ...previous.entry,
+    hasTrustDialogAccepted: true,
+  });
+
+  return () =>
+    withClaudeConfigLock(configPath, async () => {
+      const config = await loadClaudeConfig(configPath);
+
+      const projects = isRecord(config['projects']) ? config['projects'] : {};
+
+      if (JSON.stringify(projects[root]) !== written) {
+        return;
+      }
+
+      const { [root]: _trusted, ...others } = projects;
+
+      await writeClaudeConfig(configPath, {
+        ...config,
+        projects: previous.entry === null ? others : { ...others, [root]: previous.entry },
+      });
+    });
+}
+
+// The config as the CLI last wrote it; a missing file is an empty config,
+// and one that does not parse to an object throws rather than be replaced.
+async function loadClaudeConfig(configPath: string): Promise<Record<string, unknown>> {
+  let raw: string;
+
+  try {
+    raw = await readFile(configPath, 'utf8');
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return {};
+    }
+
+    throw error;
+  }
+
+  const parsed: unknown = JSON.parse(raw);
+
+  if (!isRecord(parsed)) {
+    throw new Error(`${configPath} does not hold a JSON object`);
+  }
+
+  return parsed;
+}
+
+// Writes the config in the CLI's own layout, beside the file it replaces
+// and with that file's mode, then renames it into place. A config path
+// that is a symlink keeps the link and replaces the file it points at.
+async function writeClaudeConfig(
+  configPath: string,
+  config: Readonly<Record<string, unknown>>,
+): Promise<void> {
+  const target = await realpath(configPath).catch(() => configPath);
+
+  const mode = await stat(target).then(
+    (stats) => stats.mode & 0o777,
+    () => 0o600,
+  );
+
+  const temp = join(dirname(target), `.atc-trust-${randomUUID()}.tmp`);
+
+  try {
+    await writeFile(temp, JSON.stringify(config, null, 2), { mode, flag: 'wx' });
+    await rename(temp, target);
+  } catch (error) {
+    await rm(temp, { force: true });
+
+    throw error;
+  }
+}

package/src/agents/with-claude-config-lock.ts

@@ -0,0 +1,135 @@
+import { mkdir, rmdir, stat, utimes } from 'node:fs/promises';
+import { dirname } from 'node:path';
+
+// A lock older than this belongs to a holder that died: the Claude CLI's
+// lock library refreshes a held lock's age well inside it.
+const STALE_MS = 10_000;
+
+// How often a held lock's age is refreshed, well inside the stale age.
+const REFRESH_MS = 1000;
+
+// How long a caller waits for the lock before it gives up.
+const WAIT_MS = 5000;
+const RETRY_MS = 50;
+
+/**
+ * Runs the callback while holding the lock the Claude CLI takes before it
+ * writes its global config: a directory beside the file named for it with
+ * a `.lock` suffix, created with `mkdir` so only one holder succeeds. The
+ * config's folder is created first when it does not exist yet. A lock left
+ * by a dead holder is taken over once it goes stale, and a held lock's age
+ * is refreshed while the callback runs so no one takes it over. Release
+ * removes the lock only while it is still the directory this call created.
+ * Waiting longer than a few seconds throws without running the callback.
+ */
+export async function withClaudeConfigLock<T>(
+  configPath: string,
+  run: () => Promise<T>,
+): Promise<T> {
+  const lockPath = `${configPath}.lock`;
+  const deadline = Date.now() + WAIT_MS;
+
+  await mkdir(dirname(configPath), { recursive: true });
+
+  let held = await tryCreateLockDir(lockPath);
+
+  while (held === null) {
+    if (Date.now() > deadline) {
+      throw new Error(`timed out waiting for the Claude config lock ${lockPath}`);
+    }
+
+    await Bun.sleep(RETRY_MS);
+
+    held = await tryCreateLockDir(lockPath);
+  }
+
+  let owned: OwnedLock = held;
+  let refreshing = Promise.resolve();
+
+  const timer = setInterval(() => {
+    refreshing = (async () => {
+      const refreshed = await refreshOwnedLock(lockPath, owned);
+
+      owned = refreshed ?? owned;
+    })();
+  }, REFRESH_MS);
+
+  try {
+    return await run();
+  } finally {
+    clearInterval(timer);
+
+    await refreshing;
+
+    const isOwned = await isOwnedLock(lockPath, owned);
+
+    if (isOwned) {
+      await rmdir(lockPath).catch(() => {});
+    }
+  }
+}
+
+// The lock directory a holder created, as its inode and the age it last
+// gave it; a directory created in its place after a takeover can reuse
+// the inode but not that age.
+interface OwnedLock {
+  readonly ino: number;
+  readonly mtimeMs: number;
+}
+
+// Creates the lock directory and resolves to it while this call holds the
+// lock, or null; a stale directory is removed so the next try can take it.
+async function tryCreateLockDir(lockPath: string): Promise<OwnedLock | null> {
+  try {
+    await mkdir(lockPath);
+
+    const created = await stat(lockPath);
+
+    return { ino: created.ino, mtimeMs: created.mtimeMs };
+  } catch (error) {
+    if (!isExistsError(error)) {
+      throw error;
+    }
+  }
+
+  const existing = await stat(lockPath).catch(() => null);
+
+  if (existing !== null && Date.now() - existing.mtimeMs > STALE_MS) {
+    await rmdir(lockPath).catch(() => {});
+  }
+
+  return null;
+}
+
+function isExistsError(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'EEXIST';
+}
+
+// Moves the lock's age forward while it is still the directory this call
+// created, and resolves to the lock as it then stands; null leaves the
+// lock to go stale, as a holder that stopped refreshing it does.
+async function refreshOwnedLock(lockPath: string, owned: OwnedLock): Promise<OwnedLock | null> {
+  const isOwned = await isOwnedLock(lockPath, owned);
+
+  if (!isOwned) {
+    return null;
+  }
+
+  try {
+    const now = new Date();
+
+    await utimes(lockPath, now, now);
+
+    const refreshed = await stat(lockPath);
+
+    return { ino: refreshed.ino, mtimeMs: refreshed.mtimeMs };
+  } catch {
+    return null;
+  }
+}
+
+async function isOwnedLock(lockPath: string, owned: OwnedLock): Promise<boolean> {
+  const current = await stat(lockPath).catch(() => null);
+
+  return current !== null && current.ino === owned.ino && current.mtimeMs === owned.mtimeMs;
+}

package/src/daemon/sessions.ts

@@ -926,15 +926,19 @@ export class SessionManager {
         throw new DaemonError('bad_args', 'trustClonedWorkspace requires a workspace source');
       }
 
-      if (
-        provider.kind !== 'imp' ||
-        !provider.remote ||
-        auth === null ||
-        adapter.planGuestWorkspaceTrust === undefined
-      ) {
+      const isLocalTrust =
+        !provider.remote && auth === null && adapter.updateLocalWorkspaceTrust !== undefined;
+
+      const isGuestTrust =
+        provider.kind === 'imp' &&
+        provider.remote &&
+        auth !== null &&
+        adapter.planGuestWorkspaceTrust !== undefined;
+
+      if (!isLocalTrust && !isGuestTrust) {
         throw new DaemonError(
           'unsupported',
-          'trustClonedWorkspace requires a brokered Claude gateway on an imp target',
+          'trustClonedWorkspace requires stock Claude on the local target or a brokered Claude gateway on an imp target',
         );
       }
     }
@@ -978,8 +982,24 @@ export class SessionManager {
         hostKey === id,
       );
 
+    // Takes back trust a spawn accepted in the user's own agent config when
+    // the spawn fails before its harness starts.
+    const localTrust: { remove: (() => Promise<void>) | null } = { remove: null };
+
     const trustWorkspace = trustClonedWorkspace
       ? async (root: string) => {
+          if (!provider.remote) {
+            const update = adapter.updateLocalWorkspaceTrust;
+
+            if (update === undefined) {
+              throw new DaemonError('unsupported', 'this adapter cannot trust a cloned workspace');
+            }
+
+            localTrust.remove = await update.call(adapter, root);
+
+            return;
+          }
+
           const planned = adapter.planGuestWorkspaceTrust?.(root);
 
           if (planned === undefined || planned === null || provider.guest === undefined) {
@@ -1045,6 +1065,7 @@ export class SessionManager {
         },
       });
     } catch (error) {
+      await this.removeLocalTrust(localTrust.remove, id);
       await this.removeFailedSpawnEffects(provider, id, hostKey, target, readied);
 
       throw error;
@@ -1621,6 +1642,28 @@ export class SessionManager {
     }
   }
 
+  // Takes back the trust a failed spawn accepted in the user's own agent
+  // config. A take-back that fails is logged and leaves the entry, so the
+  // spawn's own failure is the one it reports.
+  private async removeLocalTrust(
+    remove: (() => Promise<void>) | null,
+    id: SessionID,
+  ): Promise<void> {
+    if (remove === null) {
+      return;
+    }
+
+    try {
+      await remove();
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+
+      this.log(
+        `atc: the spawn of session ${id} failed to start and taking back its workspace trust failed too: ${reason}`,
+      );
+    }
+  }
+
   // Takes back what a spawn readied when it fails once its host is ready,
   // before or after its session lists. An attempt that provisioned the
   // host takes back its imp and binding; a host of the spawn's own without

package/src/mcp/mcp-tools.ts

@@ -61,7 +61,7 @@ const SPAWN_INPUT: Readonly<Record<string, unknown>> = z.toJSONSchema(
       "Where the session's working directory comes from. Omit it to run the session in cwd as it stands. With it, atc materializes a clean checkout into cwd on the target, which must not exist yet: {kind:'path', path, allowDirty?} checks out the pushed HEAD of a git checkout on the atc host, leaving its uncommitted and untracked changes behind with a warning, or refusing them when allowDirty is 'refuse'; {kind:'git', url, ref or sha, credentialRef?} checks out a branch, tag, or full commit of a repository, with credentialRef {kind:'env', name} naming the atc daemon's environment variable that holds its token. A directory outside git runs in place only on a target on the atc host itself (provider local-pty), with cwd equal to its path. Submodules and Git LFS are refused, and so is a URL that carries a credential.",
     ),
     trustClonedWorkspace: SPAWN_SCHEMA.shape.trustClonedWorkspace.describe(
-      'Trust the exact verified clone for this launch. An explicit true or false overrides the configured target trustClonedWorkspace default; omitting both keeps trust off. Requires a workspace source, an imp target, and a brokered Claude gateway with isolated guest config; other launches are refused. Accepts repository configuration and helpers without changing tool permission mode. Existing guest config is preserved.',
+      "Trust the exact verified clone for this launch. An explicit true or false overrides the configured target trustClonedWorkspace default; omitting both keeps trust off. Requires a workspace source and either stock Claude on the local target, which adds trust for the clone root alone to the user's Claude config, or a brokered Claude gateway with isolated guest config on an imp target; other launches are refused. Accepts repository configuration and helpers without changing tool permission mode. Existing guest config is preserved.",
     ),
     detached: z
       .boolean()

package/src/shared/collect-auth-profiles.ts

@@ -2,11 +2,14 @@ import { isRecord } from './report';
 
 /**
  * A named reference to a credential impd holds: the secret's name, never
- * its value, and the rule impd applies when a request reaches the host,
- * plus the profiles a session selecting this one needs beside it. Only
- * the `custom` kind and the `bearer` scheme are bound.
+ * its value, and the profiles a session selecting this one needs beside
+ * it. A `custom` profile holds the one rule impd applies when a request
+ * reaches its host, always a bearer header. A `github` profile holds no
+ * rule: impd's `github` kind fixes its hosts and headers.
  */
-export interface AuthProfile {
+export type AuthProfile = CustomAuthProfile | GitHubAuthProfile;
+
+interface CustomAuthProfile {
   readonly name: string;
   readonly secret: string;
   readonly kind: 'custom';
@@ -16,6 +19,13 @@ export interface AuthProfile {
   readonly dependencies: readonly string[];
 }
 
+interface GitHubAuthProfile {
+  readonly name: string;
+  readonly secret: string;
+  readonly kind: 'github';
+  readonly dependencies: readonly string[];
+}
+
 interface AuthProfiles {
   readonly profiles: ReadonlyMap<string, AuthProfile>;
   readonly errors: readonly string[];
@@ -78,15 +88,33 @@ function parseAuthProfile(name: string, entry: unknown): AuthProfile | string {
   const header = entry['header'];
   const scheme = entry['scheme'];
   const dependencies = entry['dependencies'];
+  const kind = entry['kind'] ?? 'custom';
 
-  if (entry['kind'] !== undefined && entry['kind'] !== 'custom') {
-    return 'kind must be custom, the one kind atc binds';
+  if (kind !== 'custom' && kind !== 'github') {
+    return 'kind must be custom or github, the kinds atc binds';
   }
 
   if (typeof secret !== 'string' || !SECRET_NAME.test(secret)) {
     return 'secret must be a lowercase letter followed by up to 30 lowercase letters, digits or hyphens';
   }
 
+  if (
+    dependencies !== undefined &&
+    (!Array.isArray(dependencies) || !dependencies.every((dep) => typeof dep === 'string'))
+  ) {
+    return 'dependencies must be an array of profile names';
+  }
+
+  if (kind === 'github') {
+    const extra = ['host', 'header', 'scheme', 'user'].find((key) => entry[key] !== undefined);
+
+    if (extra !== undefined) {
+      return `${extra} cannot be set on a github profile, whose hosts and headers impd's github kind fixes`;
+    }
+
+    return { name, secret, kind, dependencies: dependencies ?? [] };
+  }
+
   if (typeof host !== 'string' || host.length > BROKER_HOST_MAX || !BROKER_HOST.test(host)) {
     return 'host must be a lowercase hostname such as api.example.com';
   }
@@ -103,13 +131,6 @@ function parseAuthProfile(name: string, entry: unknown): AuthProfile | string {
     return 'user pairs only with the basic scheme, which atc does not bind';
   }
 
-  if (
-    dependencies !== undefined &&
-    (!Array.isArray(dependencies) || !dependencies.every((dep) => typeof dep === 'string'))
-  ) {
-    return 'dependencies must be an array of profile names';
-  }
-
   return {
     name,
     secret,

package/src/shared/resolve-auth-profiles.ts

@@ -1,12 +1,14 @@
 import type { AuthProfile } from './collect-auth-profiles';
 
 /**
- * How impd applies one secret to requests for one host.
+ * How impd applies one secret to requests for one host. Only a basic rule
+ * holds a user.
  */
 interface AuthRule {
   readonly host: string;
   readonly header: string;
-  readonly scheme: 'bearer';
+  readonly scheme: 'basic' | 'bearer';
+  readonly user?: string;
 }
 
 /**
@@ -15,7 +17,7 @@ interface AuthRule {
  */
 export interface ResolvedAuthSecret {
   readonly secret: string;
-  readonly kind: 'custom';
+  readonly kind: AuthProfile['kind'];
   readonly rules: readonly AuthRule[];
 }
 
@@ -49,11 +51,18 @@ export type AuthProfileResolution =
   | { readonly resolved: ResolvedAuthProfiles }
   | { readonly problem: AuthProfileProblem };
 
+// One rule of a profile, with the profile it came from.
+interface ProfileRule {
+  readonly profile: AuthProfile;
+  readonly rule: AuthRule;
+}
+
 /**
  * Expands the selected profiles through their dependencies, then checks
  * the whole expanded set: each host must get exactly one rule, so a
- * credential is never picked by order. Two profiles holding the identical
- * secret and rule for a host merge into one rule.
+ * credential is never picked by order, and each secret one kind. Two
+ * profiles holding the identical secret and rule for a host merge into one
+ * rule.
  */
 export function resolveAuthProfiles(
   profiles: ReadonlyMap<string, AuthProfile>,
@@ -73,21 +82,37 @@ export function resolveAuthProfiles(
 
   const ordered = [...reached.values()].toSorted((a, b) => (a.name < b.name ? -1 : 1));
 
-  const byHost = new Map<string, AuthProfile>();
+  const byHost = new Map<string, ProfileRule>();
+  const kinds = new Map<string, AuthProfile>();
 
   for (const profile of ordered) {
-    const other = byHost.get(profile.host);
+    const kindOwner = kinds.get(profile.secret);
 
-    if (other === undefined) {
-      byHost.set(profile.host, profile);
-    } else if (!hasSameRule(other, profile)) {
+    if (kindOwner === undefined) {
+      kinds.set(profile.secret, profile);
+    } else if (kindOwner.kind !== profile.kind) {
       return {
         problem: {
           code: 'auth_collision',
-          message: `profiles ${other.name} and ${profile.name} both send a credential to ${profile.host}`,
+          message: `profiles ${kindOwner.name} and ${profile.name} bind secret ${profile.secret} as different kinds`,
         },
       };
     }
+
+    for (const rule of getProfileRules(profile)) {
+      const other = byHost.get(rule.host);
+
+      if (other === undefined) {
+        byHost.set(rule.host, { profile, rule });
+      } else if (!hasSameRule(other, { profile, rule })) {
+        return {
+          problem: {
+            code: 'auth_collision',
+            message: `profiles ${other.profile.name} and ${profile.name} both send a credential to ${rule.host}`,
+          },
+        };
+      }
+    }
   }
 
   return {
@@ -156,31 +181,50 @@ function isAuthProfileProblem(
   return 'code' in value;
 }
 
-function hasSameRule(left: AuthProfile, right: AuthProfile): boolean {
+// The rules impd's github kind applies: git over HTTPS on github.com takes
+// Basic auth for x-access-token, and the REST and upload APIs take a bearer
+// token.
+const GITHUB_RULES: readonly AuthRule[] = [
+  { host: 'api.github.com', header: 'authorization', scheme: 'bearer' },
+  { host: 'github.com', header: 'authorization', scheme: 'basic', user: 'x-access-token' },
+  { host: 'uploads.github.com', header: 'authorization', scheme: 'bearer' },
+];
+
+// The rules impd holds for a profile's secret on the hosts it covers.
+function getProfileRules(profile: AuthProfile): readonly AuthRule[] {
+  if (profile.kind === 'github') {
+    return GITHUB_RULES;
+  }
+
+  return [{ host: profile.host, header: profile.header, scheme: profile.scheme }];
+}
+
+function hasSameRule(left: ProfileRule, right: ProfileRule): boolean {
   return (
-    left.secret === right.secret &&
-    left.header === right.header &&
-    left.scheme === right.scheme &&
-    left.kind === right.kind
+    left.profile.secret === right.profile.secret &&
+    left.profile.kind === right.profile.kind &&
+    left.rule.header === right.rule.header &&
+    left.rule.scheme === right.rule.scheme &&
+    left.rule.user === right.rule.user
   );
 }
 
 // One entry per secret, sorted by secret, each with its rules sorted by host.
-function buildSecrets(profiles: readonly AuthProfile[]): ResolvedAuthSecret[] {
-  const rules = new Map<string, AuthRule[]>();
+function buildSecrets(entries: readonly ProfileRule[]): ResolvedAuthSecret[] {
+  const bySecret = new Map<string, { kind: AuthProfile['kind']; rules: AuthRule[] }>();
 
-  for (const profile of profiles) {
-    const list = rules.get(profile.secret) ?? [];
+  for (const item of entries) {
+    const entry = bySecret.get(item.profile.secret) ?? { kind: item.profile.kind, rules: [] };
 
-    list.push({ host: profile.host, header: profile.header, scheme: profile.scheme });
-    rules.set(profile.secret, list);
+    entry.rules.push(item.rule);
+    bySecret.set(item.profile.secret, entry);
   }
 
-  return [...rules.entries()]
+  return [...bySecret.entries()]
     .toSorted(([a], [b]) => (a < b ? -1 : 1))
-    .map(([secret, list]) => ({
+    .map(([secret, entry]) => ({
       secret,
-      kind: 'custom',
-      rules: list.toSorted((a, b) => (a.host < b.host ? -1 : 1)),
+      kind: entry.kind,
+      rules: entry.rules.toSorted((a, b) => (a.host < b.host ? -1 : 1)),
     }));
 }