@zgeoff/atc 2.31.0 → 2.31.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.31.0",
+  "version": "2.31.1",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",

package/src/agents/agent-adapter.ts

@@ -232,6 +232,12 @@ export interface AgentAdapter {
   // Absent or null means the adapter cannot accept workspace trust.
   readonly planGuestWorkspaceTrust?: (root: string) => Readonly<Record<string, string>> | null;
 
+  // Accepts folder trust for the exact root of a verified clone on the
+  // daemon's machine, in the agent's own config, and resolves to a function
+  // that takes it back for a launch that fails before the agent starts.
+  // Absent means the adapter cannot accept workspace trust there.
+  readonly updateLocalWorkspaceTrust?: (root: string) => Promise<() => Promise<void>>;
+
   // The credential this agent takes from impd's broker, or null when it
   // takes none. Absent: it takes none.
   readonly findAuthSelection?: () => AuthSelection | null;

package/src/agents/claude-adapter.ts

@@ -30,8 +30,10 @@ import { findFlagValue } from './find-flag-value';
 import { makeClaudeHeadlessRunner } from './make-claude-headless-runner';
 import type { ClaudeHeadlessRun } from './make-claude-headless-runner';
 import { parseClaudeTranscriptLine } from './parse-claude-transcript-line';
-import { planTypedLineInput } from './plan-typed-line-input';
+import { planPastedLineInput } from './plan-pasted-line-input';
+import { resolveClaudeGlobalConfigPath } from './resolve-claude-global-config-path';
 import { resolveClaudePermissionMode } from './resolve-claude-permission-mode';
+import { updateClaudeProjectTrust } from './update-claude-project-trust';
 import { writeATCBridge } from './write-atc-bridge';
 import { writeHookSettings } from './write-hook-settings';
 
@@ -62,8 +64,9 @@ export class ClaudeAdapter implements AgentAdapter {
 
   readonly parseTranscriptLine = parseClaudeTranscriptLine;
 
-  // Claude's TUI submits a line typed with its newline in one write.
-  readonly planLineInput = planTypedLineInput;
+  // Claude's TUI takes a long burst of input as a paste and keeps its
+  // newline in the composer, so a line is pasted and then submitted.
+  readonly planLineInput = planPastedLineInput;
 
   readonly profile: AgentProfile;
 
@@ -153,6 +156,12 @@ export class ClaudeAdapter implements AgentAdapter {
     return this.bridgeDir;
   }
 
+  // A session on the daemon's machine reads the user's own Claude config,
+  // so trust for the clone is that config's entry for the clone alone.
+  updateLocalWorkspaceTrust(root: string): Promise<() => Promise<void>> {
+    return updateClaudeProjectTrust(resolveClaudeGlobalConfigPath(), root);
+  }
+
   normalizeHook(e: HookEvent): AdapterEvent {
     const parsed = CLAUDE_HOOK_PAYLOAD_SCHEMA.safeParse(e.payload);
     const payload: ClaudeHookPayload = parsed.success ? parsed.data : {};

package/src/agents/gateway-adapter.ts

@@ -33,7 +33,7 @@ import { findFlagValue } from './find-flag-value';
 import { makeClaudeHeadlessRunner } from './make-claude-headless-runner';
 import type { ClaudeHeadlessRun } from './make-claude-headless-runner';
 import { parseClaudeTranscriptLine } from './parse-claude-transcript-line';
-import { planTypedLineInput } from './plan-typed-line-input';
+import { planPastedLineInput } from './plan-pasted-line-input';
 import { resolveClaudePermissionMode } from './resolve-claude-permission-mode';
 import { writeATCBridge } from './write-atc-bridge';
 import { writeHookSettings } from './write-hook-settings';
@@ -60,7 +60,7 @@ export class GatewayAdapter implements AgentAdapter {
   readonly parseTranscriptLine = parseClaudeTranscriptLine;
 
   // The gateway runs the Claude CLI, whose TUI takes a line the same way.
-  readonly planLineInput = planTypedLineInput;
+  readonly planLineInput = planPastedLineInput;
 
   readonly takesMessages = true;
 

package/src/agents/plan-pasted-line-input.ts

@@ -13,9 +13,14 @@ const PASTE_END = '\u001B[201~';
  * arrive. Paste markers inside the text are dropped, so the text can neither
  * end the paste early nor start one of its own. A TUI that has not turned
  * bracketed paste on gets the text unmarked, and may still read both writes
- * as one burst.
+ * as one burst. Empty text is the carriage return alone, which submits what
+ * the composer holds and adds nothing to it.
  */
 export function planPastedLineInput(text: string, modes: TerminalInputModes): readonly string[] {
+  if (text === '') {
+    return ['\r'];
+  }
+
   const unmarked = text.replaceAll(PASTE_START, '').replaceAll(PASTE_END, '');
 
   return modes.bracketedPaste ? [`${PASTE_START}${unmarked}${PASTE_END}`, '\r'] : [unmarked, '\r'];

package/src/agents/resolve-claude-global-config-path.ts

@@ -0,0 +1,18 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveHomeDir } from '../shared/resolve-home-dir';
+
+/**
+ * The file the Claude CLI on the daemon's machine keeps its global state
+ * in, folder trust included, resolved as the CLI resolves it: a legacy
+ * `.config.json` in its config folder when one exists, otherwise
+ * `.claude.json` in `$CLAUDE_CONFIG_DIR`, or in the user's home when that
+ * is unset or empty.
+ */
+export function resolveClaudeGlobalConfigPath(): string {
+  const configDir = process.env['CLAUDE_CONFIG_DIR'];
+  const custom = configDir !== undefined && configDir !== '' ? configDir : null;
+  const legacy = join(custom ?? join(resolveHomeDir(), '.claude'), '.config.json');
+
+  return existsSync(legacy) ? legacy : join(custom ?? resolveHomeDir(), '.claude.json');
+}

package/src/agents/update-claude-project-trust.ts

@@ -0,0 +1,119 @@
+import { randomUUID } from 'node:crypto';
+import { readFile, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { isRecord } from '../shared/report';
+import { withClaudeConfigLock } from './with-claude-config-lock';
+
+/**
+ * Accepts the Claude CLI's folder trust for one exact directory in its
+ * global config, under the lock the CLI writes that config under. Only the
+ * directory's entry in `projects` changes: every other key keeps its value,
+ * and an entry already trusted leaves the file as it is. The write lands
+ * through a rename, so a reader sees the old file or the new one, never
+ * part of either.
+ *
+ * Resolves to a function that takes the trust back, for a launch that
+ * fails before the CLI starts: it puts back the entry as it was, unless
+ * something has changed the entry since, which leaves it as it stands.
+ */
+export async function updateClaudeProjectTrust(
+  configPath: string,
+  root: string,
+): Promise<() => Promise<void>> {
+  const previous = await withClaudeConfigLock(configPath, async () => {
+    const config = await loadClaudeConfig(configPath);
+
+    const projects = isRecord(config['projects']) ? config['projects'] : {};
+    const entry = projects[root];
+
+    if (isRecord(entry) && entry['hasTrustDialogAccepted'] === true) {
+      return null;
+    }
+
+    const base = isRecord(entry) ? entry : {};
+
+    await writeClaudeConfig(configPath, {
+      ...config,
+      projects: { ...projects, [root]: { ...base, hasTrustDialogAccepted: true } },
+    });
+
+    return { entry: isRecord(entry) ? entry : null };
+  });
+
+  if (previous === null) {
+    return () => Promise.resolve();
+  }
+
+  const written = JSON.stringify({
+    ...previous.entry,
+    hasTrustDialogAccepted: true,
+  });
+
+  return () =>
+    withClaudeConfigLock(configPath, async () => {
+      const config = await loadClaudeConfig(configPath);
+
+      const projects = isRecord(config['projects']) ? config['projects'] : {};
+
+      if (JSON.stringify(projects[root]) !== written) {
+        return;
+      }
+
+      const { [root]: _trusted, ...others } = projects;
+
+      await writeClaudeConfig(configPath, {
+        ...config,
+        projects: previous.entry === null ? others : { ...others, [root]: previous.entry },
+      });
+    });
+}
+
+// The config as the CLI last wrote it; a missing file is an empty config,
+// and one that does not parse to an object throws rather than be replaced.
+async function loadClaudeConfig(configPath: string): Promise<Record<string, unknown>> {
+  let raw: string;
+
+  try {
+    raw = await readFile(configPath, 'utf8');
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return {};
+    }
+
+    throw error;
+  }
+
+  const parsed: unknown = JSON.parse(raw);
+
+  if (!isRecord(parsed)) {
+    throw new Error(`${configPath} does not hold a JSON object`);
+  }
+
+  return parsed;
+}
+
+// Writes the config in the CLI's own layout, beside the file it replaces
+// and with that file's mode, then renames it into place. A config path
+// that is a symlink keeps the link and replaces the file it points at.
+async function writeClaudeConfig(
+  configPath: string,
+  config: Readonly<Record<string, unknown>>,
+): Promise<void> {
+  const target = await realpath(configPath).catch(() => configPath);
+
+  const mode = await stat(target).then(
+    (stats) => stats.mode & 0o777,
+    () => 0o600,
+  );
+
+  const temp = join(dirname(target), `.atc-trust-${randomUUID()}.tmp`);
+
+  try {
+    await writeFile(temp, JSON.stringify(config, null, 2), { mode, flag: 'wx' });
+    await rename(temp, target);
+  } catch (error) {
+    await rm(temp, { force: true });
+
+    throw error;
+  }
+}

package/src/agents/with-claude-config-lock.ts

@@ -0,0 +1,135 @@
+import { mkdir, rmdir, stat, utimes } from 'node:fs/promises';
+import { dirname } from 'node:path';
+
+// A lock older than this belongs to a holder that died: the Claude CLI's
+// lock library refreshes a held lock's age well inside it.
+const STALE_MS = 10_000;
+
+// How often a held lock's age is refreshed, well inside the stale age.
+const REFRESH_MS = 1000;
+
+// How long a caller waits for the lock before it gives up.
+const WAIT_MS = 5000;
+const RETRY_MS = 50;
+
+/**
+ * Runs the callback while holding the lock the Claude CLI takes before it
+ * writes its global config: a directory beside the file named for it with
+ * a `.lock` suffix, created with `mkdir` so only one holder succeeds. The
+ * config's folder is created first when it does not exist yet. A lock left
+ * by a dead holder is taken over once it goes stale, and a held lock's age
+ * is refreshed while the callback runs so no one takes it over. Release
+ * removes the lock only while it is still the directory this call created.
+ * Waiting longer than a few seconds throws without running the callback.
+ */
+export async function withClaudeConfigLock<T>(
+  configPath: string,
+  run: () => Promise<T>,
+): Promise<T> {
+  const lockPath = `${configPath}.lock`;
+  const deadline = Date.now() + WAIT_MS;
+
+  await mkdir(dirname(configPath), { recursive: true });
+
+  let held = await tryCreateLockDir(lockPath);
+
+  while (held === null) {
+    if (Date.now() > deadline) {
+      throw new Error(`timed out waiting for the Claude config lock ${lockPath}`);
+    }
+
+    await Bun.sleep(RETRY_MS);
+
+    held = await tryCreateLockDir(lockPath);
+  }
+
+  let owned: OwnedLock = held;
+  let refreshing = Promise.resolve();
+
+  const timer = setInterval(() => {
+    refreshing = (async () => {
+      const refreshed = await refreshOwnedLock(lockPath, owned);
+
+      owned = refreshed ?? owned;
+    })();
+  }, REFRESH_MS);
+
+  try {
+    return await run();
+  } finally {
+    clearInterval(timer);
+
+    await refreshing;
+
+    const isOwned = await isOwnedLock(lockPath, owned);
+
+    if (isOwned) {
+      await rmdir(lockPath).catch(() => {});
+    }
+  }
+}
+
+// The lock directory a holder created, as its inode and the age it last
+// gave it; a directory created in its place after a takeover can reuse
+// the inode but not that age.
+interface OwnedLock {
+  readonly ino: number;
+  readonly mtimeMs: number;
+}
+
+// Creates the lock directory and resolves to it while this call holds the
+// lock, or null; a stale directory is removed so the next try can take it.
+async function tryCreateLockDir(lockPath: string): Promise<OwnedLock | null> {
+  try {
+    await mkdir(lockPath);
+
+    const created = await stat(lockPath);
+
+    return { ino: created.ino, mtimeMs: created.mtimeMs };
+  } catch (error) {
+    if (!isExistsError(error)) {
+      throw error;
+    }
+  }
+
+  const existing = await stat(lockPath).catch(() => null);
+
+  if (existing !== null && Date.now() - existing.mtimeMs > STALE_MS) {
+    await rmdir(lockPath).catch(() => {});
+  }
+
+  return null;
+}
+
+function isExistsError(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'EEXIST';
+}
+
+// Moves the lock's age forward while it is still the directory this call
+// created, and resolves to the lock as it then stands; null leaves the
+// lock to go stale, as a holder that stopped refreshing it does.
+async function refreshOwnedLock(lockPath: string, owned: OwnedLock): Promise<OwnedLock | null> {
+  const isOwned = await isOwnedLock(lockPath, owned);
+
+  if (!isOwned) {
+    return null;
+  }
+
+  try {
+    const now = new Date();
+
+    await utimes(lockPath, now, now);
+
+    const refreshed = await stat(lockPath);
+
+    return { ino: refreshed.ino, mtimeMs: refreshed.mtimeMs };
+  } catch {
+    return null;
+  }
+}
+
+async function isOwnedLock(lockPath: string, owned: OwnedLock): Promise<boolean> {
+  const current = await stat(lockPath).catch(() => null);
+
+  return current !== null && current.ino === owned.ino && current.mtimeMs === owned.mtimeMs;
+}

package/src/daemon/sessions.ts

@@ -926,15 +926,19 @@ export class SessionManager {
         throw new DaemonError('bad_args', 'trustClonedWorkspace requires a workspace source');
       }
 
-      if (
-        provider.kind !== 'imp' ||
-        !provider.remote ||
-        auth === null ||
-        adapter.planGuestWorkspaceTrust === undefined
-      ) {
+      const isLocalTrust =
+        !provider.remote && auth === null && adapter.updateLocalWorkspaceTrust !== undefined;
+
+      const isGuestTrust =
+        provider.kind === 'imp' &&
+        provider.remote &&
+        auth !== null &&
+        adapter.planGuestWorkspaceTrust !== undefined;
+
+      if (!isLocalTrust && !isGuestTrust) {
         throw new DaemonError(
           'unsupported',
-          'trustClonedWorkspace requires a brokered Claude gateway on an imp target',
+          'trustClonedWorkspace requires stock Claude on the local target or a brokered Claude gateway on an imp target',
         );
       }
     }
@@ -978,8 +982,24 @@ export class SessionManager {
         hostKey === id,
       );
 
+    // Takes back trust a spawn accepted in the user's own agent config when
+    // the spawn fails before its harness starts.
+    const localTrust: { remove: (() => Promise<void>) | null } = { remove: null };
+
     const trustWorkspace = trustClonedWorkspace
       ? async (root: string) => {
+          if (!provider.remote) {
+            const update = adapter.updateLocalWorkspaceTrust;
+
+            if (update === undefined) {
+              throw new DaemonError('unsupported', 'this adapter cannot trust a cloned workspace');
+            }
+
+            localTrust.remove = await update.call(adapter, root);
+
+            return;
+          }
+
           const planned = adapter.planGuestWorkspaceTrust?.(root);
 
           if (planned === undefined || planned === null || provider.guest === undefined) {
@@ -1045,6 +1065,7 @@ export class SessionManager {
         },
       });
     } catch (error) {
+      await this.removeLocalTrust(localTrust.remove, id);
       await this.removeFailedSpawnEffects(provider, id, hostKey, target, readied);
 
       throw error;
@@ -1621,6 +1642,28 @@ export class SessionManager {
     }
   }
 
+  // Takes back the trust a failed spawn accepted in the user's own agent
+  // config. A take-back that fails is logged and leaves the entry, so the
+  // spawn's own failure is the one it reports.
+  private async removeLocalTrust(
+    remove: (() => Promise<void>) | null,
+    id: SessionID,
+  ): Promise<void> {
+    if (remove === null) {
+      return;
+    }
+
+    try {
+      await remove();
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+
+      this.log(
+        `atc: the spawn of session ${id} failed to start and taking back its workspace trust failed too: ${reason}`,
+      );
+    }
+  }
+
   // Takes back what a spawn readied when it fails once its host is ready,
   // before or after its session lists. An attempt that provisioned the
   // host takes back its imp and binding; a host of the spawn's own without

package/src/mcp/mcp-tools.ts

@@ -61,7 +61,7 @@ const SPAWN_INPUT: Readonly<Record<string, unknown>> = z.toJSONSchema(
       "Where the session's working directory comes from. Omit it to run the session in cwd as it stands. With it, atc materializes a clean checkout into cwd on the target, which must not exist yet: {kind:'path', path, allowDirty?} checks out the pushed HEAD of a git checkout on the atc host, leaving its uncommitted and untracked changes behind with a warning, or refusing them when allowDirty is 'refuse'; {kind:'git', url, ref or sha, credentialRef?} checks out a branch, tag, or full commit of a repository, with credentialRef {kind:'env', name} naming the atc daemon's environment variable that holds its token. A directory outside git runs in place only on a target on the atc host itself (provider local-pty), with cwd equal to its path. Submodules and Git LFS are refused, and so is a URL that carries a credential.",
     ),
     trustClonedWorkspace: SPAWN_SCHEMA.shape.trustClonedWorkspace.describe(
-      'Trust the exact verified clone for this launch. An explicit true or false overrides the configured target trustClonedWorkspace default; omitting both keeps trust off. Requires a workspace source, an imp target, and a brokered Claude gateway with isolated guest config; other launches are refused. Accepts repository configuration and helpers without changing tool permission mode. Existing guest config is preserved.',
+      "Trust the exact verified clone for this launch. An explicit true or false overrides the configured target trustClonedWorkspace default; omitting both keeps trust off. Requires a workspace source and either stock Claude on the local target, which adds trust for the clone root alone to the user's Claude config, or a brokered Claude gateway with isolated guest config on an imp target; other launches are refused. Accepts repository configuration and helpers without changing tool permission mode. Existing guest config is preserved.",
     ),
     detached: z
       .boolean()