@zgeoff/atc 3.4.2 → 3.6.0

package/src/daemon/daemon.ts

@@ -82,6 +82,7 @@ import { mintMessageID } from './mint-message-id';
 import { mintSessionID } from './mint-session-id';
 import { parseReport } from './parse-report';
 import { PermissionRegistry } from './permission-registry';
+import { PublishedRecords } from './published-records';
 import { requireGitTransports } from './require-git-transports';
 import { restoreFleet } from './restore-fleet';
 import type { RestoreSettled } from './restore-fleet';
@@ -228,6 +229,10 @@ export interface DaemonOptions {
   // services it uses; none when unset.
   readonly sources?: readonly SourceProvider[];
 
+  // The gh executable that checks a pull request a session's scope
+  // declares; `gh` on PATH when unset.
+  readonly ghBin?: string;
+
   // The transports a git workspace source may use and git may fetch over,
   // or the invalid list the config holds, which refuses every git
   // operation; https and ssh when unset.
@@ -422,6 +427,16 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
     mgr.log = opts.log;
   }
 
+  const records = new PublishedRecords({
+    store,
+    daemonID: store.daemonID,
+    localDir: join(stateDir, 'records'),
+    ghBin: opts.ghBin ?? 'gh',
+    now: () => Date.now(),
+  });
+
+  mgr.records = records;
+
   const authBinder = new RuntimeAuthBinder(store);
 
   mgr.authBinder = authBinder;
@@ -1159,6 +1174,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
           targetIdentity: string,
         ) => Promise<Readonly<{
           workspace: SessionWorkspace;
+          branch: string | null;
           withheldEnv: readonly string[];
         }> | null>)
       | null,
@@ -1180,6 +1196,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
       materialize,
       requireInReach,
       p.autoDir,
+      p.scope,
     );
 
     const runtime = runtimes.get(s.id);
@@ -1623,6 +1640,8 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
       });
     },
     updateSession: (id, name, pinned) => mgr.updateSession(id, name, pinned),
+    updateSessionScope: (id, scope) => mgr.updateScope(id, scope),
+    isCallerTree: (id, caller) => mgr.isCallerTree(id, caller),
     quitDaemon: () => {
       // The ok response for the quit request must flush before the sockets
       // close under it.
@@ -1960,6 +1979,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
       const linked = access !== null || shared ? undefined : s.agentSessionID;
 
       const lastEventAt = await store.loadLastActivityAt(s.id, linked);
+      const sessionRecord = await records.findRecord(s.id);
 
       return {
         session,
@@ -1967,6 +1987,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
         lastActivityAt: lastEventAt ?? createdAt,
         pending,
         result,
+        sessionRecord,
       };
     },
     loadSessionTranscript: async (id, from, limit) => {

package/src/daemon/find-host-branch.ts

@@ -0,0 +1,28 @@
+import type { ExecutionProvider } from './execution-provider';
+import { runHostGit } from './run-host-git';
+
+/**
+ * The branch a directory on a session's host has checked out; null for a
+ * detached checkout, a directory outside git, or a remote host that runs
+ * no commands.
+ */
+export async function findHostBranch(
+  provider: ExecutionProvider,
+  host: string,
+  dir: string,
+): Promise<string | null> {
+  if (provider.remote && !provider.capabilities.run) {
+    return null;
+  }
+
+  const head = await runHostGit(provider, host, dir, [
+    'symbolic-ref',
+    '--quiet',
+    '--short',
+    'HEAD',
+  ]);
+
+  const branch = head.stdout.trim();
+
+  return head.exitCode === 0 && branch !== '' ? branch : null;
+}

package/src/daemon/materialize-workspace.ts

@@ -76,6 +76,9 @@ type MaterializedWorkspace = { readonly kind: 'in_place' } | ReadyWorkspace;
 interface ReadyWorkspace {
   readonly kind: 'ready';
   readonly workspace: SessionWorkspace;
+
+  // The branch the checkout is on, null for a detached checkout.
+  readonly branch: string | null;
   readonly warnings: readonly string[];
 
   // The variables every harness the session starts goes without.
@@ -298,6 +301,7 @@ async function runMaterialization(
       ...(ref === null ? {} : { ref }),
       materializedAt,
     },
+    branch: clone.branch,
     warnings: pinned.warnings,
   };
 }
@@ -532,6 +536,7 @@ async function recordPhase(
 
 interface CleanClone {
   readonly sha: string;
+  readonly branch: string | null;
   readonly archive: Uint8Array;
 }
 
@@ -580,7 +585,7 @@ async function createCleanClone(
     throw new DaemonError(outcome.code, outcome.message, { phase: 'cloning' });
   }
 
-  return { sha: clone.sha, archive };
+  return { sha: clone.sha, branch: clone.branch, archive };
 }
 
 function toDaemonError(error: unknown, code: ErrorCode, phase: MaterializationPhase): DaemonError {

package/src/daemon/merge-recorded-scope.ts

@@ -0,0 +1,50 @@
+import type { RecordedScope } from '../protocol/published-record';
+import type { CheckedScope } from './check-session-scope';
+
+/**
+ * Adds each checked entry the recorded scope lacks, keeping the order the
+ * entries arrived in. A worktree matches by path, a branch by name and
+ * repository, and a pull request by repository and number. Returns the
+ * recorded scope itself when every entry is already there.
+ */
+export function mergeRecordedScope(recorded: RecordedScope, added: CheckedScope): RecordedScope {
+  const worktrees = mergeEntries(recorded.worktrees, added.worktrees, (w) => w.path);
+  const branches = mergeEntries(recorded.branches, added.branches, (b) => `${b.repo}\n${b.name}`);
+
+  const pullRequests = mergeEntries(
+    recorded.pullRequests,
+    added.pullRequests,
+    (pr) => `${pr.repo.toLowerCase()}#${pr.number}`,
+  );
+
+  if (
+    worktrees === recorded.worktrees &&
+    branches === recorded.branches &&
+    pullRequests === recorded.pullRequests
+  ) {
+    return recorded;
+  }
+
+  return { workspace: recorded.workspace, worktrees, branches, pullRequests };
+}
+
+function mergeEntries<T>(
+  recorded: readonly T[],
+  added: readonly T[],
+  toKey: (entry: T) => string,
+): readonly T[] {
+  const seen = new Set(recorded.map((entry) => toKey(entry)));
+
+  const fresh: T[] = [];
+
+  for (const entry of added) {
+    const key = toKey(entry);
+
+    if (!seen.has(key)) {
+      seen.add(key);
+      fresh.push(entry);
+    }
+  }
+
+  return fresh.length === 0 ? recorded : [...recorded, ...fresh];
+}

package/src/daemon/published-records.ts

@@ -0,0 +1,269 @@
+import { randomUUID } from 'node:crypto';
+import { chmod, mkdir, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import type { DeclaredScope } from '../protocol/parse-declared-scope';
+import type { PublishedRecord, RecordedScope } from '../protocol/published-record';
+import type { SessionID } from '../shared/session-id';
+import type { SessionWorkspace } from '../store/workspace-materialization';
+import { checkSessionScope } from './check-session-scope';
+import type { CheckedScope } from './check-session-scope';
+import type { ExecutionProvider } from './execution-provider';
+import { findHostBranch } from './find-host-branch';
+import { mergeRecordedScope } from './merge-recorded-scope';
+
+/**
+ * Where the state store keeps each session's published record.
+ */
+interface PublishedRecordStore {
+  readonly findPublishedRecord: (sessionID: SessionID) => Promise<PublishedRecord | null>;
+  readonly writePublishedRecord: (record: PublishedRecord) => Promise<void>;
+  readonly removePublishedRecord: (sessionID: SessionID) => Promise<void>;
+}
+
+/**
+ * One session as its record sees it: the host it runs on, the directory
+ * it runs in, and what its workspace was materialized from.
+ */
+export interface RecordSubject {
+  readonly session: SessionID;
+  readonly target: string;
+  readonly provider: ExecutionProvider;
+  readonly host: SessionID;
+  readonly dir: string;
+  readonly workspace: SessionWorkspace | null;
+
+  // The branch atc checked the workspace out on, when atc materialized it;
+  // absent leaves the host to show the directory's branch.
+  readonly branch?: string | null;
+}
+
+interface PublishedRecordsOptions {
+  readonly store: PublishedRecordStore;
+  readonly daemonID: string;
+
+  // The directory on the daemon's machine each local copy lands in.
+  readonly localDir: string;
+
+  // The gh executable that checks a declared pull request.
+  readonly ghBin: string;
+  readonly now: () => number;
+}
+
+const EMPTY_SCOPE: CheckedScope = { worktrees: [], branches: [], pullRequests: [] };
+
+// Writes a record copy into a directory on a remote host: the content to a
+// staged file, made read-only, then renamed over the copy.
+const PLACE_COPY =
+  'umask 022 && mkdir -p "$1" && printf "%s" "$4" > "$1/$3" && chmod 0444 "$1/$3" && mv -f "$1/$3" "$1/$2"';
+
+/**
+ * Publishes each session's record: the state store holds it, and the
+ * session's provider places a read-only copy where the session reads it.
+ * Only the daemon writes either, from what it checked itself.
+ */
+export class PublishedRecords {
+  private readonly options: PublishedRecordsOptions;
+
+  // The change under way for each session, which the next change to the
+  // same record waits on, so two additions never write over each other.
+  private readonly changes = new Map<SessionID, Promise<void>>();
+
+  constructor(options: PublishedRecordsOptions) {
+    this.options = options;
+  }
+
+  // Checks a spawn's declared scope on its readied host, records it with
+  // the workspace the session runs in, and places the copy. Returns the
+  // copy's path on the host.
+  async createRecord(subject: RecordSubject, declared: DeclaredScope | null): Promise<string> {
+    const checked = declared === null ? EMPTY_SCOPE : await this.checkScope(subject, declared);
+
+    const workspace = await this.buildWorkspace(subject);
+
+    const record = this.buildRecord(subject, { workspace, ...checked }, 1);
+
+    await this.options.store.writePublishedRecord(record);
+
+    return this.writeCopy(subject, record);
+  }
+
+  // Places the stored copy again before a harness starts on a revived or
+  // restored session, recording a fresh one for a session without one.
+  async restoreCopy(subject: RecordSubject): Promise<string> {
+    const stored = await this.options.store.findPublishedRecord(subject.session);
+
+    if (stored === null) {
+      return this.createRecord(subject, null);
+    }
+
+    return this.writeCopy(subject, stored);
+  }
+
+  // Checks an added scope on the session's host, adds each entry the record
+  // lacks, and places the changed copy. A scope that adds nothing leaves
+  // the record and its revision as they were.
+  async updateScope(subject: RecordSubject, declared: DeclaredScope): Promise<PublishedRecord> {
+    const before = this.changes.get(subject.session);
+    const turn = Promise.withResolvers<void>();
+
+    this.changes.set(subject.session, turn.promise);
+
+    try {
+      await before;
+
+      return await this.writeScope(subject, declared);
+    } finally {
+      turn.resolve();
+
+      if (this.changes.get(subject.session) === turn.promise) {
+        this.changes.delete(subject.session);
+      }
+    }
+  }
+
+  findRecord(sessionID: SessionID): Promise<PublishedRecord | null> {
+    return this.options.store.findPublishedRecord(sessionID);
+  }
+
+  // Where the copy of a session on the daemon's own machine lies, the only
+  // machine a headless turn runs on.
+  getLocalPath(sessionID: SessionID): string {
+    return join(this.options.localDir, `${sessionID}.json`);
+  }
+
+  // Drops a session's record and its copy on the daemon's machine.
+  async remove(sessionID: SessionID): Promise<void> {
+    await this.options.store.removePublishedRecord(sessionID);
+
+    await rm(this.getLocalPath(sessionID), { force: true });
+  }
+
+  private async writeScope(
+    subject: RecordSubject,
+    declared: DeclaredScope,
+  ): Promise<PublishedRecord> {
+    const stored = await this.options.store.findPublishedRecord(subject.session);
+
+    let current = stored;
+
+    current ??= await this.buildFirstRecord(subject);
+
+    const checked = await this.checkScope(subject, declared);
+
+    const merged = mergeRecordedScope(current.scope, checked);
+
+    // A change that adds nothing still places the copy, so a retry after a
+    // failed copy write brings the copy level with the store.
+    if (stored !== null && merged === current.scope) {
+      await this.writeCopy(subject, stored);
+
+      return stored;
+    }
+
+    const record = this.buildRecord(subject, merged, current.revision + 1);
+
+    await this.options.store.writePublishedRecord(record);
+    await this.writeCopy(subject, record);
+
+    return record;
+  }
+
+  // The record a session without one starts from, at revision 0 so its
+  // first change records revision 1.
+  private async buildFirstRecord(subject: RecordSubject): Promise<PublishedRecord> {
+    const workspace = await this.buildWorkspace(subject);
+
+    return this.buildRecord(subject, { workspace, ...EMPTY_SCOPE }, 0);
+  }
+
+  private checkScope(subject: RecordSubject, declared: DeclaredScope): Promise<CheckedScope> {
+    return checkSessionScope(
+      {
+        provider: subject.provider,
+        host: subject.host,
+        dir: subject.dir,
+        repoURL: subject.workspace?.repoURL ?? null,
+        declared,
+      },
+      this.options.ghBin,
+    );
+  }
+
+  private async buildWorkspace(subject: RecordSubject): Promise<RecordedScope['workspace']> {
+    const branch = await this.findBranch(subject);
+
+    return {
+      path: subject.dir,
+      branch,
+      repoURL: subject.workspace?.repoURL ?? null,
+      sha: subject.workspace?.sha ?? null,
+    };
+  }
+
+  // The branch atc checked a workspace out on, else the branch of a
+  // directory on the daemon's machine. A remote directory atc did not
+  // materialize records none, so a spawn there runs no command on the host
+  // before its harness starts.
+  private findBranch(subject: RecordSubject): Promise<string | null> {
+    if (subject.branch !== undefined) {
+      return Promise.resolve(subject.branch);
+    }
+
+    return subject.provider.remote
+      ? Promise.resolve(null)
+      : findHostBranch(subject.provider, subject.host, subject.dir);
+  }
+
+  private buildRecord(
+    subject: RecordSubject,
+    scope: RecordedScope,
+    revision: number,
+  ): PublishedRecord {
+    return {
+      format: 'atc.session-record',
+      version: 1,
+      session: subject.session,
+      daemonID: this.options.daemonID,
+      target: subject.target,
+      revision,
+      updatedAt: new Date(this.options.now()).toISOString(),
+      scope,
+    };
+  }
+
+  // Replaces the copy through a rename, so a reader never sees half of it.
+  private async writeCopy(subject: RecordSubject, record: PublishedRecord): Promise<string> {
+    const content = `${JSON.stringify(record, null, 2)}\n`;
+    const name = `${subject.session}.json`;
+
+    if (!subject.provider.remote) {
+      const dir = this.options.localDir;
+      const path = this.getLocalPath(subject.session);
+      const staged = join(dir, `.${name}.${randomUUID()}`);
+
+      await mkdir(dir, { recursive: true, mode: 0o700 });
+      await chmod(dir, 0o700);
+      await writeFile(staged, content, { mode: 0o444, flag: 'wx' });
+      await rename(staged, path);
+
+      return path;
+    }
+
+    // One command writes the copy beside its place and renames it there.
+    // A remote host runs it as the user its provider runs commands as,
+    // root on an imp, so the copy and its directory belong to that user.
+    const dir = `${subject.provider.guest?.dir ?? '/tmp/atc'}/records`;
+
+    const placed = await subject.provider.runCommand({
+      argv: ['sh', '-c', PLACE_COPY, 'sh', dir, name, `.${name}.${randomUUID()}`, content],
+      cwd: '/',
+      host: subject.host,
+    });
+
+    if (placed.exitCode !== 0) {
+      throw new Error(`placing the session record in ${dir} failed: ${placed.stderr.trim()}`);
+    }
+
+    return `${dir}/${name}`;
+  }
+}

package/src/daemon/request-access-classes.ts

@@ -34,6 +34,7 @@ export const REQUEST_ACCESS_CLASSES: Readonly<Record<RequestMethod, RequestAcces
   'session.auth.revoke': 'owner',
   'session.auth.rebind': 'owner',
   'session.update': 'principal',
+  'session.scope.add': 'principal',
   'session.attach': 'principal',
   'session.detach': 'principal',
   'session.input': 'principal',

package/src/daemon/run-host-git.ts

@@ -0,0 +1,52 @@
+import { REPOSITORY_ENV_VARS } from '../workspace/repository-env-vars';
+import type { CommandResult, ExecutionProvider } from './execution-provider';
+
+// The git options every check runs with: every directory counts as safe,
+// since a host's files may belong to another user than the one the command
+// runs as, and no fsmonitor starts.
+const GIT_OPTIONS = ['-c', 'safe.directory=*', '-c', 'core.fsmonitor=false'];
+
+// A remote host runs git without the variables that would point it at
+// another repository than the directory it is given.
+const CLEAN_ENV = ['env', ...[...REPOSITORY_ENV_VARS].flatMap((name) => ['-u', name])];
+
+/**
+ * Runs git against a directory on a session's host and returns what it
+ * printed. A provider on the daemon's own machine shares the daemon's
+ * filesystem, so the daemon runs git there itself; a remote host runs it
+ * through the provider.
+ */
+export async function runHostGit(
+  provider: ExecutionProvider,
+  host: string,
+  dir: string,
+  args: readonly string[],
+): Promise<CommandResult> {
+  if (provider.remote) {
+    return provider.runCommand({
+      argv: [...CLEAN_ENV, 'git', ...GIT_OPTIONS, '-C', dir, ...args],
+      cwd: '/',
+      host,
+    });
+  }
+
+  const env = Object.fromEntries(
+    Object.entries(process.env).filter(([name]) => !REPOSITORY_ENV_VARS.has(name)),
+  );
+
+  const proc = Bun.spawn(['git', ...GIT_OPTIONS, '-C', dir, ...args], {
+    cwd: '/',
+    env,
+    stdin: 'ignore',
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+
+  return { exitCode, stdout, stderr };
+}