@zgeoff/atc 2.38.0 → 2.40.0

package/README.md

@@ -91,11 +91,12 @@ zoxide is installed. A typed path such as `~/pro` completes like a shell. Inside
 your statusline gains a fleet segment, so `● 2 need you: auth-bug` is visible without opening the
 list.
 
-If the daemon dies, press `R` on the home screen and every session respawns from its transcript.
-After you upgrade atc, the status bar shows `⟳ update ready`, and `u` restarts the daemon and
-restores the fleet when you are ready. The bar shows `⟳ restarting daemon` until the restart
-finishes. When the running daemon speaks another protocol version, `atc` asks before it restarts the
-daemon, since the restart ends every session the daemon hosts.
+When the daemon restarts, it restores the fleet by itself and every session respawns from its
+transcript; set `restoreFleetOnRestart` to `false` to wait for `R` on the home screen instead. After
+you upgrade atc, the status bar shows `⟳ update ready`, and `u` restarts the daemon and restores the
+fleet when you are ready. The bar shows `⟳ restarting daemon` until the restart finishes. When the
+running daemon speaks another protocol version, `atc` asks before it restarts the daemon, since the
+restart ends every session the daemon hosts.
 
 atc runs inside zellij or tmux. Give the pane locked mode so the leader key reaches atc.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.38.0",
+  "version": "2.40.0",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",

package/src/agents/agent-adapter.ts

@@ -31,7 +31,6 @@ export interface SpawnOverrides {
   readonly trustClonedWorkspace?: boolean;
   readonly model?: string;
   readonly effort?: string;
-  readonly resumeInterruptedTurns?: boolean;
 }
 
 export interface SpawnPlan {
@@ -86,6 +85,22 @@ export interface GuestSpawnPlan extends SpawnPlan {
   readonly env?: Readonly<Record<string, string>>;
 }
 
+/**
+ * The project settings files the agent applies on top of what atc passes
+ * it, and the refusal for a file whose content would override or route
+ * around a sign-in through impd's broker, or null when it holds nothing
+ * that would. `files` are relative to the directory a harness starts in;
+ * `rootFiles` are relative to that directory, each directory above it, and
+ * the main checkout of the git worktree it lies in, since the agent reads
+ * them at a repository's root. `findRefusal` takes the file's absolute path
+ * on the host.
+ */
+export interface ProjectSettingsCheck {
+  readonly files: readonly string[];
+  readonly rootFiles: readonly string[];
+  readonly findRefusal: (path: string, content: string) => DaemonError | null;
+}
+
 export interface TranscriptToolUse {
   readonly name: string;
   readonly input: string;
@@ -269,6 +284,11 @@ export interface AgentAdapter {
   // The command that exits 0 inside a remote host when the agent there can
   // sign in without a person. Absent: atc runs no check.
   readonly planAuthCheck?: () => readonly string[];
+
+  // The project settings a remote launch behind impd's broker reads in
+  // the directory the harness starts in, before it starts. Absent: atc
+  // reads none.
+  readonly planProjectSettingsCheck?: () => ProjectSettingsCheck;
   readonly normalizeHook: (e: HookEvent) => AdapterEvent;
   readonly loadName: (
     source: string,

package/src/agents/build-claude-project-settings-check.ts

@@ -0,0 +1,74 @@
+import { DaemonError } from '../protocol/daemon-error';
+import { isSubscriptionOverrideVariable } from '../shared/is-subscription-override-variable';
+import { isRecord } from '../shared/report';
+import type { ProjectSettingsCheck } from './agent-adapter';
+
+/**
+ * The check of a Claude CLI session's project settings before a launch
+ * behind impd's broker. The CLI applies a repository's
+ * `.claude/settings.json` from the directory it starts in, and its
+ * `.claude/settings.local.json` from there and from the repository's root
+ * or a worktree's main checkout, once the folder is trusted; a person can
+ * accept that trust inside the session. Each file refuses the launch when
+ * its `env` block sets a variable that would override the sign-in or route
+ * around the broker, or when it sets `apiKeyHelper`. A file that is not a
+ * JSON object refuses it too, since what the CLI would take from it is
+ * unknown. A refusal holds the setting's name, never its value.
+ */
+export function buildClaudeProjectSettingsCheck(agent: string): ProjectSettingsCheck {
+  return {
+    files: ['.claude/settings.json', LOCAL_SETTINGS_FILE],
+    rootFiles: [LOCAL_SETTINGS_FILE],
+    findRefusal: (file, content) => {
+      const setting = findOverrideSetting(content);
+
+      if (setting === null) {
+        return null;
+      }
+
+      const message =
+        setting === UNPARSEABLE
+          ? `agent '${agent}' signs in through impd's broker, but ${file} is not a JSON object, so atc cannot check it for settings that would override that sign-in`
+          : `agent '${agent}' signs in through impd's broker, but ${file} sets ${setting}, which would override or route around that sign-in`;
+
+      return new DaemonError('auth_target_unsupported', message, {
+        agent,
+        problem: 'project_settings_conflict',
+        file,
+        setting,
+      });
+    },
+  };
+}
+
+const LOCAL_SETTINGS_FILE = '.claude/settings.local.json';
+const UNPARSEABLE = '(unparseable)';
+
+// The first setting a project settings file holds that would override the
+// sign-in, as `env.<variable>` or `apiKeyHelper`, the unparseable marker
+// for content that is not a JSON object, or null when it holds none.
+function findOverrideSetting(content: string): string | null {
+  let parsed: unknown;
+
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return UNPARSEABLE;
+  }
+
+  if (!isRecord(parsed) || Array.isArray(parsed)) {
+    return UNPARSEABLE;
+  }
+
+  if (parsed['apiKeyHelper'] !== undefined) {
+    return 'apiKeyHelper';
+  }
+
+  const env = parsed['env'];
+
+  const variable = isRecord(env)
+    ? Object.keys(env).find((key) => isSubscriptionOverrideVariable(key))
+    : undefined;
+
+  return variable === undefined ? null : `env.${variable}`;
+}

package/src/agents/claude-adapter.ts

@@ -23,6 +23,7 @@ import type {
   GuestSpawnPlan,
   HeadlessRunner,
   NameUpdate,
+  ProjectSettingsCheck,
   ResumeCheck,
   SpawnOptionSpecs,
   SpawnOptions,
@@ -34,6 +35,7 @@ import { buildClaudeConfigSeed } from './build-claude-config-seed';
 import { buildClaudeGuestLaunch } from './build-claude-guest-launch';
 import { buildClaudeMCPConfig } from './build-claude-mcp-config';
 import { buildClaudeOverrideArgs } from './build-claude-override-args';
+import { buildClaudeProjectSettingsCheck } from './build-claude-project-settings-check';
 import { buildHookSettings } from './build-hook-settings';
 import type { HookSettingsProfile } from './build-hook-settings';
 import { buildRestoreModeArgs } from './build-restore-mode-args';
@@ -226,6 +228,12 @@ export class ClaudeAdapter implements AgentAdapter {
     return buildClaudeConfigSeed(root);
   }
 
+  // The repository's own settings files outrank what the session's user
+  // settings hold, so a launch behind impd's broker reads them first.
+  planProjectSettingsCheck(): ProjectSettingsCheck {
+    return buildClaudeProjectSettingsCheck(this.id);
+  }
+
   // A settings file of the session's own per binding revision carries the
   // placeholder, and so does the CLI's environment. The configured
   // arguments go without a permission mode, so the mode the session's own

package/src/agents/gateway-adapter.ts

@@ -17,6 +17,7 @@ import type {
   GuestSpawnPlan,
   HeadlessRunner,
   NameUpdate,
+  ProjectSettingsCheck,
   ResumeCheck,
   SpawnOptionSpecs,
   SpawnOptions,
@@ -26,6 +27,7 @@ import { buildATCBridgeFiles } from './build-atc-bridge-files';
 import { buildClaudeConfigSeed } from './build-claude-config-seed';
 import { buildClaudeGuestLaunch } from './build-claude-guest-launch';
 import { buildClaudeOverrideArgs } from './build-claude-override-args';
+import { buildClaudeProjectSettingsCheck } from './build-claude-project-settings-check';
 import { buildHookSettings } from './build-hook-settings';
 import { buildRestoreModeArgs } from './build-restore-mode-args';
 import { ClaudeAdapter } from './claude-adapter';
@@ -335,6 +337,12 @@ export class GatewayAdapter implements AgentAdapter {
     ];
   }
 
+  // The repository's own settings files reach the CLI as well, so a launch
+  // behind impd's broker reads them first.
+  planProjectSettingsCheck(): ProjectSettingsCheck {
+    return buildClaudeProjectSettingsCheck(this.id);
+  }
+
   private buildBrokerRefusal(reason: string): DaemonError {
     return new DaemonError(
       'auth_target_unsupported',

package/src/build-migrated-config.ts

@@ -3,6 +3,7 @@ import { parseConfig } from './shared/config';
 import { formatJSONKind } from './shared/format-json-kind';
 import { formatMixedAgentKeys } from './shared/format-mixed-agent-keys';
 import { LEGACY_AGENT_KEYS } from './shared/legacy-agent-keys';
+import { REMOVED_CONFIG_KEYS } from './shared/removed-config-keys';
 import { isRecord } from './shared/report';
 
 /**
@@ -17,7 +18,8 @@ type MigratedConfig =
 
 /**
  * Rewrites a config.json that uses the old agent keys so it holds the same
- * agents under `agents`. The old keys are removed and `agents` takes the
+ * agents under `agents`, and drops every key atc no longer reads. A file
+ * that holds `agents` and a removed key is rewritten without the key. The old keys are removed and `agents` takes the
  * place of the first of them, or the end of the file when it sets none. Each
  * entry holds only the fields that differ from a default. Values are copied
  * and never reported, so a note names a key and a reason only.
@@ -31,11 +33,26 @@ export function buildMigratedConfig(raw: unknown): MigratedConfig {
   }
 
   const present = Object.keys(raw).filter((key) => LEGACY_AGENT_KEYS.includes(key));
+  const removed = REMOVED_CONFIG_KEYS.filter((key) => Object.hasOwn(raw, key));
+
+  const removedNotes = removed.map(
+    (key) => `atc config migrate: ${key} is dropped: atc no longer reads it`,
+  );
 
   if (Object.hasOwn(raw, 'agents')) {
-    return present.length === 0
-      ? { kind: 'current' }
-      : { kind: 'unusable', detail: formatMixedAgentKeys(present) };
+    if (present.length > 0) {
+      return { kind: 'unusable', detail: formatMixedAgentKeys(present) };
+    }
+
+    if (removed.length === 0) {
+      return { kind: 'current' };
+    }
+
+    return {
+      kind: 'migrated',
+      text: `${JSON.stringify(Object.fromEntries(Object.entries(raw).filter(([key]) => !removed.includes(key))), null, 2)}\n`,
+      notes: removedNotes,
+    };
   }
 
   const config = parseConfig(raw);
@@ -49,6 +66,10 @@ export function buildMigratedConfig(raw: unknown): MigratedConfig {
   let placed = false;
 
   for (const [key, value] of Object.entries(raw)) {
+    if (removed.includes(key)) {
+      continue;
+    }
+
     if (!LEGACY_AGENT_KEYS.includes(key)) {
       migrated[key] = value;
     } else if (!placed) {
@@ -64,7 +85,10 @@ export function buildMigratedConfig(raw: unknown): MigratedConfig {
   return {
     kind: 'migrated',
     text: `${JSON.stringify(migrated, null, 2)}\n`,
-    notes: collectDroppedGateways(raw['gateways'], config.agents, config.agentErrors),
+    notes: [
+      ...collectDroppedGateways(raw['gateways'], config.agents, config.agentErrors),
+      ...removedNotes,
+    ],
   };
 }
 

package/src/cli.ts

@@ -435,6 +435,12 @@ async function runDaemon(listenArg: string | null, tokenFile: string | null): Pr
     );
   }
 
+  if (cfg.removedKeys.length > 0) {
+    console.error(
+      `atc daemon: config: config.json sets ${cfg.removedKeys.join(', ')}, which atc no longer reads; run 'atc config migrate' to drop it`,
+    );
+  }
+
   const sources = sourceOrder.buildSources(
     builtinSources.collectBuiltinSources({
       roots: cfg.dirs.roots,
@@ -489,7 +495,7 @@ async function runDaemon(listenArg: string | null, tokenFile: string | null): Pr
         ? {}
         : { listen: { host: listen.host, port: listen.port, tokenFile } }),
       restoreBootTimeoutMs,
-      resumeInterruptedTurns: cfg.resumeInterruptedTurns,
+      restoreFleetOnRestart: cfg.restoreFleetOnRestart,
       ...(Number.isFinite(graceOverride) && graceOverride >= 0
         ? { tapGraceMs: graceOverride }
         : {}),

package/src/daemon/daemon-connection.ts

@@ -1034,9 +1034,6 @@ export class DaemonConnection {
           ...(data.trustClonedWorkspace === undefined
             ? {}
             : { trustClonedWorkspace: data.trustClonedWorkspace }),
-          ...(data.resumeInterruptedTurns === undefined
-            ? {}
-            : { resumeInterruptedTurns: data.resumeInterruptedTurns }),
         },
         target,
         workspace: data.workspace ?? null,

package/src/daemon/daemon.ts

@@ -162,10 +162,9 @@ export interface DaemonOptions {
   readonly restoreBootTimeoutMs?: number;
   readonly tapGraceMs?: number;
 
-  // Whether a fleet restore sends a session that was mid-turn when the
-  // previous daemon stopped one message to carry on, for a session spawned
-  // without its own choice; off when unset.
-  readonly resumeInterruptedTurns?: boolean;
+  // Whether the daemon restores the stored fleet by itself once it is
+  // listening, when that fleet holds sessions; off when unset.
+  readonly restoreFleetOnRestart?: boolean;
 
   // How long a confirm token from `session.forget` stays usable.
   readonly forgetConfirmMs?: number;
@@ -291,11 +290,6 @@ const LOCK_WAIT_MS = 2000;
  * because transports guarantee byte integrity and such a line means a buggy
  * or hostile peer.
  */
-// The sender and opening of the message a restore sends a session whose
-// turn the previous daemon's stop cut off.
-const RESUME_SENDER = 'atc';
-const RESUME_LEAD = 'atc restarted the daemon';
-
 export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
   let stopDaemon: (() => Promise<void>) | null = null;
 
@@ -1327,37 +1321,6 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
     return record;
   };
 
-  const startedAt = new Date().toISOString();
-
-  // Sends a restored session the message that carries on a turn the
-  // previous daemon's stop cut off. A resume message still pending from an
-  // earlier restart covers this one, so a session never holds two.
-  const sendResumeMessage = async (s: Session): Promise<void> => {
-    const pending = await store.collectPendingMessages(buildMessageOwner(s));
-
-    if (
-      pending.some((record) => record.from === RESUME_SENDER && record.text.startsWith(RESUME_LEAD))
-    ) {
-      return;
-    }
-
-    const refusal = findMessageRefusal(s.id);
-
-    if (refusal !== null) {
-      mgr.log(`atc sent session ${s.id} no resume message (${refusal})`);
-
-      return;
-    }
-
-    await writeAcceptedMessage(
-      s.id,
-      RESUME_SENDER,
-      `${RESUME_LEAD} at ${startedAt}; your last turn was interrupted. Check the state of anything you had in flight, then continue.`,
-      mintMessageID(),
-      () => {},
-    );
-  };
-
   // A retried send answers with the message's current status, so a caller
   // that lost the first answer learns where its message stands now.
   const loadMessageReplay = async (
@@ -1396,6 +1359,44 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
 
   const sources = opts.sources ?? [];
 
+  // The restore in flight, from its first call until its staggered terminal
+  // adoption finishes. A restore requested meanwhile joins it, so the fleet
+  // never registers twice at once.
+  let fleetRestore: Promise<number> | null = null;
+
+  const runFleetRestore = (cols: number, rows: number): Promise<number> => {
+    if (fleetRestore !== null) {
+      return fleetRestore;
+    }
+
+    const restored = Promise.withResolvers<number>();
+
+    fleetRestore = restored.promise;
+
+    void (async () => {
+      try {
+        const result = await restoreFleet({
+          mgr,
+          store,
+          findRuntime,
+          cols,
+          rows,
+          capMs: opts.restoreBootTimeoutMs ?? 0,
+        });
+
+        restored.resolve(result.restored);
+
+        await result.settled;
+      } catch (error) {
+        restored.reject(error);
+      } finally {
+        fleetRestore = null;
+      }
+    })();
+
+    return restored.promise;
+  };
+
   const ctx: DaemonContext = {
     build: opts.build,
     daemonID: store.daemonID,
@@ -1825,17 +1826,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
     getEffectiveDims: (sessionID) =>
       attachments.findEffectiveDims(sessionID) ??
       runtimes.get(sessionID)?.dims ?? { cols: 80, rows: 24 },
-    restoreFleet: (cols, rows) =>
-      restoreFleet({
-        mgr,
-        store,
-        findRuntime,
-        cols,
-        rows,
-        capMs: opts.restoreBootTimeoutMs ?? 0,
-        resumeInterruptedTurns: opts.resumeInterruptedTurns ?? false,
-        sendResumeMessage,
-      }),
+    restoreFleet: runFleetRestore,
     readSessionRecord: async (id, access) => {
       const s = mgr.sessions.find((x) => x.id === id);
 
@@ -2275,6 +2266,27 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
     listenPort: tcpListener?.port ?? null,
   });
 
+  // The stored fleet restores once per start, at the size a restored
+  // terminal takes until its first attach resizes it. A failure is logged
+  // and never stops the daemon.
+  const tryRunFleetRestore = async (): Promise<void> => {
+    try {
+      await runFleetRestore(80, 24);
+    } catch (error) {
+      mgr.log(
+        `atc could not restore the fleet (${error instanceof Error ? error.message : String(error)})`,
+      );
+    }
+  };
+
+  if (opts.restoreFleetOnRestart === true) {
+    const stored = await store.loadFleet();
+
+    if (stored.length > 0) {
+      void tryRunFleetRestore();
+    }
+  }
+
   return {
     stop: stopDaemon,
     countClients: () => clients.size,

package/src/daemon/restore-fleet.ts

@@ -16,12 +16,15 @@ export interface RestoreFleetParams {
   // it has booted before moving on regardless; zero waits on the signal
   // alone.
   readonly capMs: number;
+}
+
+export interface RestoreFleetResult {
+  // How many sessions the restore registered.
+  readonly restored: number;
 
-  // Whether a session spawned without its own choice gets one message to
-  // carry on a turn the previous daemon's stop cut off, and how that
-  // message is sent once the session's terminal is adopted.
-  readonly resumeInterruptedTurns: boolean;
-  readonly sendResumeMessage: (s: Session) => Promise<void>;
+  // Resolves once the staggered terminal adoption behind the restore has
+  // finished, also when it failed, and at once when nothing was queued.
+  readonly settled: Promise<void>;
 }
 
 /**
@@ -29,18 +32,15 @@ export interface RestoreFleetParams {
  * the rest by recency, registers every one as a terminal-less session so
  * the whole fleet lists at once, then adopts terminals one at a time,
  * waiting for each session to report it has booted before starting the
- * next. A session that was mid-turn when the previous daemon stopped, and
- * that resumes interrupted turns, gets one message to carry on once its
- * terminal is adopted.
+ * next.
  */
-export async function restoreFleet(params: RestoreFleetParams): Promise<number> {
+export async function restoreFleet(params: RestoreFleetParams): Promise<RestoreFleetResult> {
   const mgr = params.mgr;
   const store = params.store;
   const findRuntime = params.findRuntime;
   const cols = params.cols;
   const rows = params.rows;
   const capMs = params.capMs;
-  const sendResumeMessage = params.sendResumeMessage;
 
   const hasLiveSession = (entry: FleetEntry) =>
     mgr.sessions.some(
@@ -92,33 +92,11 @@ export async function restoreFleet(params: RestoreFleetParams): Promise<number>
     .filter((r) => r.revive || r.session.state !== 'exited')
     .map((r) => r.session);
 
-  // Only a session this restore registers comes from the previous daemon's
-  // fleet; a listed one this daemon already ran is revived by hand. The
-  // trail is read before any terminal is adopted, since a revived agent's
-  // own events move it on.
-  const interrupted = await collectInterruptedTurns(
-    mgr,
-    store,
-    registered.filter((r) => !r.revive && r.session.state !== 'exited').map((r) => r.session),
-    params.resumeInterruptedTurns,
-  );
-
   // A session whose target refuses to start a terminal stays listed without
-  // one, and the restore moves on to the next. A resume message that fails
-  // to send is logged, and the session runs on without it.
+  // one, and the restore moves on to the next.
   const adoptQueued = async (s: Session): Promise<boolean> => {
     const adopted = await tryAdoptTerminal(mgr, s.id, cols, rows);
 
-    if (adopted !== null && interrupted.has(s.id)) {
-      try {
-        await sendResumeMessage(s);
-      } catch (error) {
-        mgr.log(
-          `atc could not send session ${s.id} its resume message (${error instanceof Error ? error.message : String(error)})`,
-        );
-      }
-    }
-
     return adopted !== null;
   };
 
@@ -159,7 +137,7 @@ export async function restoreFleet(params: RestoreFleetParams): Promise<number>
   const [first, ...rest] = queued;
 
   if (first === undefined) {
-    return registered.length;
+    return { restored: registered.length, settled: Promise.resolve() };
   }
 
   // The first terminal attaches before the restore answers so a caller can
@@ -200,42 +178,17 @@ export async function restoreFleet(params: RestoreFleetParams): Promise<number>
 
   const firstBooted = firstAdopted ? first : null;
 
-  void adoptRest(firstBooted);
-
-  return registered.length;
-}
-
-// The sessions whose last turn event in the trail is a submitted prompt:
-// the previous daemon stopped while their turn ran. A session's own choice
-// beats the config, and an agent that takes no atc messages has no path for
-// the resume message. Only a harness on the daemon's own machine ends with
-// the daemon; one on a host with a lifecycle of its own runs on, so its
-// turn was never cut off and a revive attaches to it as it stands.
-async function collectInterruptedTurns(
-  mgr: SessionManager,
-  store: StateStore,
-  sessions: readonly Session[],
-  configured: boolean,
-): Promise<ReadonlySet<SessionID>> {
-  const interrupted = new Set<SessionID>();
-
-  for (const s of sessions) {
-    if (
-      !(s.resumeInterruptedTurns ?? configured) ||
-      s.attachment !== 'local' ||
-      mgr.findAdapter(s.agent)?.takesMessages !== true
-    ) {
-      continue;
-    }
-
-    const kind = await store.findLatestTurnKind(s.id, s.agentSessionID);
-
-    if (kind === 'prompt-submitted') {
-      interrupted.add(s.id);
+  const adoptRestLogged = async (): Promise<void> => {
+    try {
+      await adoptRest(firstBooted);
+    } catch (error) {
+      mgr.log(
+        `atc could not finish restoring the fleet (${error instanceof Error ? error.message : String(error)})`,
+      );
     }
-  }
+  };
 
-  return interrupted;
+  return { restored: registered.length, settled: adoptRestLogged() };
 }
 
 // A stored entry matches a listed session by its atc session id, or by its

package/src/daemon/sessions.ts

@@ -27,6 +27,7 @@ import { truncateDetail } from '../shared/truncate-detail';
 import { truncateToBytes } from '../shared/truncate-to-bytes';
 import type { FleetEntry, FleetEntryUpdate, FleetStore } from '../store/fleet-entry';
 import type { SessionWorkspace } from '../store/workspace-materialization';
+import { REPOSITORY_ENV_VARS } from '../workspace/repository-env-vars';
 import type { BrokerAuthHost } from './broker-auth-host';
 import { buildAuthBinding } from './build-auth-binding';
 import type { AuthBinding } from './build-auth-binding';
@@ -184,10 +185,6 @@ export interface Session {
   // The epoch of the session's latest harness start or attach, which the
   // daemon's bridge to that harness is bound to; 0 before the first.
   bridgeEpoch: number;
-
-  // Whether a fleet restore sends the session one message to carry on a
-  // turn a daemon restart cut off; absent follows the daemon's config.
-  resumeInterruptedTurns?: boolean;
 }
 
 // A session's ready workspace and the variables its harnesses go without.
@@ -241,6 +238,31 @@ const RESOLVE_DIR_SCRIPT = `p=$1; s=; while [ ! -d "$p" ]; do s=/\${p##*/}$s; p=
 const REMOVE_DIR_SCRIPT =
   'cd -P -- "$1" || exit 3; [ "$(pwd -P; printf x)" = "$2" ] || exit 4; find . -mindepth 1 -maxdepth 1 -exec rm -rf -- {} + || exit 5; cd / && rmdir -- "$1"';
 
+// Enters a directory as the host resolves it and prints, each followed by
+// a NUL, every path where something, even a dangling symlink, stands: each
+// start file in that directory, then each root file in that directory,
+// every directory above it, and the main checkout of the git worktree it
+// lies in. A `--` argument ends the start files. A directory that does not
+// exist exits with the absent status.
+const FIND_PROJECT_SETTINGS_SCRIPT = `cd -P -- "$1" 2>/dev/null || exit 3; shift; d=$(pwd -P)
+emit() { if [ -e "$1" ] || [ -L "$1" ]; then printf '%s\\0' "$1"; fi; }
+while [ "$#" -gt 0 ] && [ "$1" != -- ]; do emit "\${d%/}/$1"; shift; done; [ "$#" -gt 0 ] && shift
+m=$(git -c safe.directory='*' -c core.fsmonitor=false rev-parse --path-format=absolute --git-common-dir 2>/dev/null) && m=\${m%/.git} || m=
+for n in "$@"; do p=$d; while :; do emit "\${p%/}/$n"; [ "$p" = / ] && break; p=\${p%/*}; [ -n "$p" ] || p=/; done; [ -z "$m" ] || emit "\${m%/}/$n"; done
+exit 0`;
+
+// Prints at most one byte more than the largest project settings file atc
+// reads, following a symlink, and fails with the special-file status for
+// anything but a regular file there, such as a FIFO or a device that would
+// never end.
+const READ_SETTINGS_FILE = '[ -f "$1" ] || exit 4; exec head -c 1048577 -- "$1"';
+const ABSENT_DIR_EXIT = 3;
+
+// Runs git on the directory it starts in, whatever repository the daemon's
+// environment pins git to.
+const GIT_ENV_ARGV = ['env', ...[...REPOSITORY_ENV_VARS].flatMap((name) => ['-u', name])];
+const MAX_SETTINGS_BYTES = 1_048_576;
+
 // A readied host's harness plan, and the auth attempt that provisioned the
 // host, if one did.
 interface HarnessSetup {
@@ -580,9 +602,6 @@ export class SessionManager {
       attachment: this.hasHostLifecycle(target) ? 'detached' : 'local',
       hostKey: entry.hostKey ?? entry.sessionID,
       bridgeEpoch: 0,
-      ...(entry.resumeInterruptedTurns === undefined
-        ? {}
-        : { resumeInterruptedTurns: entry.resumeInterruptedTurns }),
     };
 
     this.sessions.push(session);
@@ -693,6 +712,7 @@ export class SessionManager {
           ...(s.effort === undefined ? {} : { effort: s.effort }),
         },
         authSetup,
+        s.cwd,
       );
 
       plan = setup.plan;
@@ -999,6 +1019,10 @@ export class SessionManager {
       }
     }
 
+    // A spawn that builds its workspace reads the workspace's project
+    // settings once it is built, not when the host is readied before it.
+    const startDir = materialize === null ? cwd : null;
+
     const setupHost = () =>
       this.setupHarnessOnHost(
         adapter,
@@ -1008,9 +1032,17 @@ export class SessionManager {
         target,
         { prompt, resume, ...overrides },
         authSetup,
+        startDir,
         hostKey === id,
       );
 
+    // A launch behind the broker reads the project settings of the clone it
+    // starts in, once the clone is on the host and before it is trusted.
+    const checkWorkspace =
+      auth === null
+        ? null
+        : (root: string) => this.requireProjectSettings(adapter, provider, hostKey, target, root);
+
     // Takes back trust a spawn accepted in the user's own agent config when
     // the spawn fails before its harness starts.
     const localTrust: { remove: (() => Promise<void>) | null } = { remove: null };
@@ -1061,6 +1093,7 @@ export class SessionManager {
         execution.identity,
         materialize,
         setupHost,
+        checkWorkspace,
         trustWorkspace,
       );
     });
@@ -1139,9 +1172,6 @@ export class SessionManager {
       suspended: false,
       hostKey,
       bridgeEpoch: binding.epoch,
-      ...(overrides.resumeInterruptedTurns === undefined
-        ? {}
-        : { resumeInterruptedTurns: overrides.resumeInterruptedTurns }),
     };
 
     this.attachHarness(session, pty, this.hasHostLifecycle(target));
@@ -1591,7 +1621,9 @@ export class SessionManager {
   // Materializes a spawn's workspace, readying its host once the source
   // resolves, or after the workspace for a directory that runs as it
   // stands, and returns the directory it created, null for one that runs
-  // as it stands. A failure once the host is ready takes it back.
+  // as it stands. A clone is checked and then trusted, either as the caller
+  // asks, and a failure there removes it. A failure once the host is ready
+  // takes it back.
   private async materializeOnSpawnHost(
     provider: ExecutionProvider,
     id: SessionID,
@@ -1601,6 +1633,7 @@ export class SessionManager {
     targetIdentity: string,
     materialize: SpawnMaterializer,
     setupHost: () => Promise<HarnessSetup>,
+    checkWorkspace: ((root: string) => Promise<void>) | null,
     trustWorkspace: ((root: string) => Promise<void>) | null,
   ): Promise<{
     readonly setup: HarnessSetup;
@@ -1644,16 +1677,17 @@ export class SessionManager {
 
       readied.setup ??= await setupHost();
 
-      if (trustWorkspace !== null) {
-        if (materialized === null || readied.root === null) {
-          throw new DaemonError(
-            'bad_args',
-            'trustClonedWorkspace requires a successfully cloned workspace',
-          );
-        }
+      if (trustWorkspace !== null && (materialized === null || readied.root === null)) {
+        throw new DaemonError(
+          'bad_args',
+          'trustClonedWorkspace requires a successfully cloned workspace',
+        );
+      }
 
+      if (materialized !== null && readied.root !== null) {
         try {
-          await trustWorkspace(readied.root);
+          await checkWorkspace?.(readied.root);
+          await trustWorkspace?.(readied.root);
         } catch (error) {
           let removed = false;
 
@@ -1665,7 +1699,7 @@ export class SessionManager {
 
           if (!removed) {
             throw new EffectRemainsError(
-              'workspace trust setup failed and its clone could not be removed',
+              'workspace setup failed and its clone could not be removed',
               { cause: error },
             );
           }
@@ -1906,9 +1940,10 @@ export class SessionManager {
     target: string,
     options: SpawnOptions,
     auth: HarnessAuthSetup | null,
+    dir: string,
   ): Promise<{ readonly plan: HarnessPlan; readonly attemptID: string | null }> {
     return this.withHostReadying(hostKey, () =>
-      this.setupHarnessOnHost(adapter, provider, id, hostKey, target, options, auth, false),
+      this.setupHarnessOnHost(adapter, provider, id, hostKey, target, options, auth, dir, false),
     );
   }
 
@@ -1938,6 +1973,11 @@ export class SessionManager {
     options: SpawnOptions,
     auth: HarnessAuthSetup | null,
 
+    // The directory the harness starts in, whose project settings a launch
+    // behind the broker reads once the host is ready; null for a spawn
+    // whose workspace is built after this, which reads them once it is.
+    cwd: string | null,
+
     // Whether the host is a spawn's new host of its own, which a failure
     // once it is readied destroys.
     isNewHost: boolean,
@@ -2000,6 +2040,10 @@ export class SessionManager {
 
     try {
       await this.setupGuest(adapter, provider, hostKey, target, dir, plan.files);
+
+      if (auth !== null && cwd !== null) {
+        await this.requireProjectSettings(adapter, provider, hostKey, target, cwd);
+      }
     } catch (error) {
       if (attemptID !== null || isNewHost) {
         await this.destroyFailedSpawnHost(provider, id, hostKey, attemptID);
@@ -2135,6 +2179,84 @@ export class SessionManager {
     }
   }
 
+  // Reads each project settings file the agent applies for a harness behind
+  // the broker, from the directory it starts in as the host resolves it, and
+  // throws the agent's refusal for one that would override its sign-in. An
+  // absent file passes; one the host holds but cannot read, that is not a
+  // regular file, or that is larger than any settings file refuses, since
+  // what the agent would take from it is unknown. A relative directory is
+  // under the host's home.
+  private async requireProjectSettings(
+    adapter: AgentAdapter,
+    provider: ExecutionProvider,
+    hostKey: SessionID,
+    target: string,
+    cwd: string,
+  ): Promise<void> {
+    const check = adapter.planProjectSettingsCheck?.();
+
+    if (check === undefined) {
+      return;
+    }
+
+    // The host resolves the directory as given, since a lexical join would
+    // drop a parent step after a symlink that the host follows.
+    const home = posix.isAbsolute(cwd) ? null : await this.resolveHostHome(provider, hostKey);
+    const dir = home === null ? cwd : `${home}/${cwd}`;
+
+    const found = await provider.runCommand({
+      argv: [
+        ...GIT_ENV_ARGV,
+        'sh',
+        '-c',
+        FIND_PROJECT_SETTINGS_SCRIPT,
+        'sh',
+        dir,
+        ...check.files,
+        '--',
+        ...check.rootFiles,
+      ],
+      cwd: '/',
+      host: hostKey,
+    });
+
+    if (found.exitCode === ABSENT_DIR_EXIT) {
+      return;
+    }
+
+    if (found.exitCode !== 0) {
+      throw this.buildUnreadableSettingsRefusal(adapter.id, target, dir);
+    }
+
+    const paths = new Set(found.stdout.split('\0').filter((path) => path !== ''));
+
+    for (const path of paths) {
+      const read = await provider.runCommand({
+        argv: ['sh', '-c', READ_SETTINGS_FILE, 'sh', path],
+        cwd: '/',
+        host: hostKey,
+      });
+
+      if (read.exitCode !== 0 || Buffer.byteLength(read.stdout) > MAX_SETTINGS_BYTES) {
+        throw this.buildUnreadableSettingsRefusal(adapter.id, target, path);
+      }
+
+      const refusal = check.findRefusal(path, read.stdout);
+
+      if (refusal !== null) {
+        throw new DaemonError(refusal.code, refusal.message, { ...refusal.data, target });
+      }
+    }
+  }
+
+  private buildUnreadableSettingsRefusal(agent: string, target: string, path: string): DaemonError {
+    return new DaemonError(
+      'auth_target_unsupported',
+      `agent '${agent}' signs in through impd's broker on target '${target}', but atc cannot read ${path} there as a settings file to check it for settings that would override that sign-in`,
+      { agent, target, problem: 'project_settings_unreadable', file: path },
+    );
+  }
+
   // A sub-session runs on its parent's host when its resolved target, name
   // and identity both, is the one its parent is bound to and that target's
   // hosts have a lifecycle, so one host serves a top-level session and
@@ -2918,9 +3040,6 @@ export class SessionManager {
         targetIdentity: s.targetIdentity,
         ...(s.desired === 'run' ? {} : { desired: s.desired }),
         ...(s.hostKey === s.id ? {} : { hostKey: s.hostKey }),
-        ...(s.resumeInterruptedTurns === undefined
-          ? {}
-          : { resumeInterruptedTurns: s.resumeInterruptedTurns }),
       });
     }
 

package/src/mcp/mcp-tools.ts

@@ -65,9 +65,6 @@ const SPAWN_INPUT: Readonly<Record<string, unknown>> = z.toJSONSchema(
     trustClonedWorkspace: SPAWN_SCHEMA.shape.trustClonedWorkspace.describe(
       "Trust the exact verified clone for this launch. An explicit true or false overrides the configured target trustClonedWorkspace default; omitting both keeps trust off. Requires a workspace source and either stock Claude on the local target, which adds trust for the clone root alone to the user's Claude config, or, on an imp target, a brokered Claude gateway or stock Claude signed in through the broker, each with isolated guest config; other launches are refused. Accepts repository configuration and helpers without changing tool permission mode. Existing guest config is preserved.",
     ),
-    resumeInterruptedTurns: SPAWN_SCHEMA.shape.resumeInterruptedTurns.describe(
-      "Whether atc sends the session one message to carry on when a daemon restart cuts off its turn. The message goes out when the fleet is restored, only to a session whose last recorded event was a submitted prompt, and only to an agent that takes atc messages. Omit it to follow the daemon's resumeInterruptedTurns config, which is off by default.",
-    ),
     detached: z
       .boolean()
       .optional()
@@ -423,7 +420,6 @@ export const MCP_TOOLS: readonly MCPToolDefinition[] = [
         target: 'spawn.target',
         workspace: 'spawn.workspace',
         trustClonedWorkspace: 'spawn.workspace.trust',
-        resumeInterruptedTurns: 'spawn.resumeInterruptedTurns',
       },
     },
   },

package/src/mcp/require-daemon-features.ts

@@ -26,7 +26,6 @@ const FEATURE_USES: Readonly<Record<DaemonFeature, string>> = {
   'transport.tcp': 'a TCP connection to the daemon',
   'idempotency.replayOnly': 'a resend that only replays a held idempotency key',
   'session.auth': 'session.auth.revoke and session.auth.rebind',
-  'spawn.resumeInterruptedTurns': "atc_session_spawn's resumeInterruptedTurns",
 };
 
 /**

package/src/mcp/run-tool.ts

@@ -58,9 +58,6 @@ export function runTool(
         ...(args['trustClonedWorkspace'] === undefined
           ? {}
           : { trustClonedWorkspace: args['trustClonedWorkspace'] }),
-        ...(args['resumeInterruptedTurns'] === undefined
-          ? {}
-          : { resumeInterruptedTurns: args['resumeInterruptedTurns'] }),
         cols: 100,
         rows: 30,
       };
@@ -81,9 +78,6 @@ export function runTool(
       const trustFeatures: readonly DaemonFeature[] =
         args['trustClonedWorkspace'] === undefined ? [] : ['spawn.workspace.trust'];
 
-      const resumeFeatures: readonly DaemonFeature[] =
-        args['resumeInterruptedTurns'] === undefined ? [] : ['spawn.resumeInterruptedTurns'];
-
       // Only a daemon that picks a git workspace's directory takes one
       // without a cwd.
       const autoDirFeatures: readonly DaemonFeature[] =
@@ -97,7 +91,6 @@ export function runTool(
         ...targetFeatures,
         ...workspaceFeatures,
         ...trustFeatures,
-        ...resumeFeatures,
         ...autoDirFeatures,
       ];
 

package/src/protocol/daemon-features.ts

@@ -85,9 +85,6 @@ export const DAEMON_FEATURES = [
   // `session.auth.revoke` and `session.auth.rebind` exist, open to the
   // daemon's owner only.
   'session.auth',
-
-  // `session.spawn` takes `resumeInterruptedTurns`.
-  'spawn.resumeInterruptedTurns',
 ] as const;
 
 export type DaemonFeature = (typeof DAEMON_FEATURES)[number];

package/src/protocol/request-param-schemas.ts

@@ -196,12 +196,6 @@ export const REQUEST_PARAM_SCHEMAS = {
       .boolean({ error: 'session.spawn trustClonedWorkspace must be a boolean' })
       .optional(),
 
-    // Whether a fleet restore after a daemon restart sends the session one
-    // message to carry on an interrupted turn; absent follows the config.
-    resumeInterruptedTurns: z
-      .boolean({ error: 'session.spawn resumeInterruptedTurns must be a boolean' })
-      .optional(),
-
     // The session the new one is a sub-session of; absent or empty spawns a
     // top-level session.
     parent: z.preprocess(

package/src/shared/config.ts

@@ -23,6 +23,7 @@ import { formatJSONKind } from './format-json-kind';
 import { formatMixedAgentKeys } from './format-mixed-agent-keys';
 import { LEGACY_AGENT_KEYS } from './legacy-agent-keys';
 import { pickDefaultAgent } from './pick-default-agent';
+import { REMOVED_CONFIG_KEYS } from './removed-config-keys';
 import { isRecord } from './report';
 import { resolveHomeDir } from './resolve-home-dir';
 
@@ -65,10 +66,12 @@ export interface Config {
   // The workspace config problems, one line each.
   workspaceErrors: readonly string[];
 
-  // Whether a fleet restore after a daemon restart sends a session that
-  // was mid-turn one message to carry on; a spawn can override it per
-  // session.
-  resumeInterruptedTurns: boolean;
+  // Whether the daemon restores the stored fleet by itself after a restart.
+  restoreFleetOnRestart: boolean;
+
+  // The keys the file sets that atc no longer reads, in the order the file
+  // holds them. Values are never recorded.
+  removedKeys: readonly string[];
 }
 
 /**
@@ -117,7 +120,8 @@ const DEFAULTS: Config = {
   principals: null,
   principalErrors: [],
   workspaceErrors: [],
-  resumeInterruptedTurns: false,
+  restoreFleetOnRestart: true,
+  removedKeys: [],
 };
 
 const configDir = join(resolveHomeDir(), '.config', 'atc');
@@ -158,7 +162,7 @@ const CONFIG_SCHEMA = z.object({
   targets: z.unknown().optional(),
   defaultTarget: z.unknown().optional(),
   principals: z.unknown().optional(),
-  resumeInterruptedTurns: buildOptionalBoolean(),
+  restoreFleetOnRestart: buildOptionalBoolean(),
 });
 
 /**
@@ -259,6 +263,7 @@ export function renderDefaultConfig(): string {
     principals: _principals,
     principalErrors: _principalErrors,
     workspaceErrors: _workspaceErrors,
+    removedKeys: _removedKeys,
     workspaces,
     ...written
   } = DEFAULTS;
@@ -354,7 +359,8 @@ export function parseConfig(raw: unknown, file: string = configFile): Config {
     principals: principals.principals,
     principalErrors: principals.errors,
     workspaceErrors: workspaces.errors,
-    resumeInterruptedTurns: parsed.data.resumeInterruptedTurns ?? DEFAULTS.resumeInterruptedTurns,
+    restoreFleetOnRestart: parsed.data.restoreFleetOnRestart ?? DEFAULTS.restoreFleetOnRestart,
+    removedKeys: REMOVED_CONFIG_KEYS.filter((key) => Object.hasOwn(raw, key)),
   };
 }
 

package/src/shared/removed-config-keys.ts

@@ -0,0 +1,5 @@
+/**
+ * The config.json keys atc once read and no longer does. A file that still
+ * sets one loads with a warning, and `atc config migrate` drops it.
+ */
+export const REMOVED_CONFIG_KEYS: readonly string[] = ['resumeInterruptedTurns'];

package/src/store/fleet-entry.ts

@@ -67,11 +67,6 @@ export interface FleetEntry {
   // parent's when the two share one host. A row without one runs on a host
   // of its own.
   readonly hostKey?: SessionID;
-
-  // Whether a fleet restore after a daemon restart sends the session one
-  // message to carry on a turn the restart cut off; a row without one
-  // follows the daemon's config.
-  readonly resumeInterruptedTurns?: boolean;
 }
 
 export interface FleetStore {

package/src/store/run-migrations.ts

@@ -34,10 +34,6 @@ interface FleetTable {
   // its parent's when the two share one host. Null for a row from before
   // hosts were recorded, which runs on its own.
   host_key: string | null;
-
-  // Whether a restore sends the session one message to carry on an
-  // interrupted turn: 1 or 0 as the spawn chose, null to follow the config.
-  resume_interrupted_turns: number | null;
 }
 
 interface EventsTable {

package/src/store/state-store.ts

@@ -38,7 +38,6 @@ import type {
 
 // Spelled as the partial index's predicate so SQLite can match them.
 const TRAIL_FILTER = sql<boolean>`kind IS NOT NULL AND kind != 'heartbeat'`;
-const TURN_KINDS = ['prompt-submitted', 'turn-done', 'needs-input', 'ended'];
 
 /**
  * Some sessions' slice of the event trail: rows under their atc ids, plus
@@ -211,7 +210,6 @@ export class StateStore {
         'workspace.withheld_env',
         'fleet.desired',
         'fleet.host_key',
-        'fleet.resume_interrupted_turns',
       ])
       .execute();
 
@@ -241,9 +239,6 @@ export class StateStore {
         ...buildWithheldEnvField(row.withheld_env),
         ...(row.desired === 'sleep' || row.desired === 'stop' ? { desired: row.desired } : {}),
         ...(row.host_key === null ? {} : { hostKey: toSessionID(row.host_key) }),
-        ...(row.resume_interrupted_turns === null
-          ? {}
-          : { resumeInterruptedTurns: row.resume_interrupted_turns !== 0 }),
       });
     }
 
@@ -351,10 +346,6 @@ export class StateStore {
             target_identity: entry.targetIdentity ?? null,
             desired: entry.desired ?? null,
             host_key: entry.hostKey ?? null,
-            resume_interrupted_turns:
-              entry.resumeInterruptedTurns === undefined
-                ? null
-                : Number(entry.resumeInterruptedTurns),
           })
           .execute();
 
@@ -548,31 +539,6 @@ export class StateStore {
     return row?.ts === null || row?.ts === undefined ? null : Date.parse(row.ts);
   }
 
-  // The kind of the session's latest event that moves a turn: a prompt
-  // submitted, a turn done, a request for input, or the session's end.
-  // Null when the trail holds none. Matches the session by either id, as
-  // the activity read does.
-  async findLatestTurnKind(
-    atcID: SessionID,
-    agentSessionID: AgentSessionID | undefined,
-  ): Promise<string | null> {
-    const row = await this.db
-      .selectFrom('events')
-      .select('kind')
-      .where('kind', 'in', TURN_KINDS)
-      .where((eb) =>
-        eb.or([
-          eb('atc_id', '=', atcID),
-          ...(agentSessionID === undefined ? [] : [eb('session_id', '=', agentSessionID)]),
-        ]),
-      )
-      .orderBy('id', 'desc')
-      .limit(1)
-      .executeTakeFirst();
-
-    return row?.kind ?? null;
-  }
-
   async recordSpawnDir(cwd: string, grant: SpawnTarget): Promise<void> {
     await this.db
       .insertInto('spawn_history')