@monster-orange/den 0.0.0 → 0.2.0

package/src/ui/server/public/workspace-picker.js

@@ -0,0 +1,69 @@
+/**
+ * Workspace pill / picker models.
+ *
+ * Pure and DOM-free (like perf-report.js) so the shape of the header's
+ * workspace menu is unit-testable under Jest's node environment; header.js
+ * owns everything that touches the DOM.
+ *
+ * Input is always the `/api/workspaces` payload:
+ *   { workspaces: { [name]: config }, active: string[] | string, focus?: string }
+ * `active` is an array since multi-active workspaces; older payloads sent a
+ * single string, which both helpers still accept.
+ */
+
+/** Active workspace names, normalised to an array. */
+function activeNames(data) {
+  const active = data?.active;
+  if (Array.isArray(active)) return active.filter(Boolean);
+  return active ? [active] : [];
+}
+
+/** Focused workspace name: explicit focus → first active → null. */
+function focusName(data) {
+  const active = activeNames(data);
+  if (data?.focus) return data.focus;
+  return active[0] ?? null;
+}
+
+/**
+ * Label + tooltip for the header pill.
+ * Falls back to "default" so the pill never renders empty.
+ */
+export function buildWorkspacePillModel(data) {
+  const active = activeNames(data);
+  const label = focusName(data) ?? "default";
+  return {
+    label,
+    // Only worth spelling out when more than one workspace is active —
+    // otherwise the pill text already says everything.
+    title:
+      active.length > 1
+        ? `Active: ${active.join(", ")} · Focus: ${label}`
+        : "Switch workspace",
+  };
+}
+
+/**
+ * Menu model for the pill's dropdown: every known workspace, active ones
+ * first (they are the likely targets), each side alphabetical so the list
+ * order is stable across polls.
+ */
+export function buildWorkspaceMenuModel(data) {
+  const active = new Set(activeNames(data));
+  const focus = focusName(data);
+  // Union of the catalog and the active set: a workspace listed as active but
+  // missing from `workspaces` still has to be selectable (and visible).
+  const names = new Set([...Object.keys(data?.workspaces ?? {}), ...active]);
+
+  const items = [...names].map((name) => ({
+    name,
+    active: active.has(name),
+    focused: name === focus,
+  }));
+  items.sort(
+    (a, b) =>
+      Number(b.active) - Number(a.active) || a.name.localeCompare(b.name),
+  );
+
+  return { focus, items };
+}

package/src/ui/server/readonly-routes.ts

@@ -0,0 +1,200 @@
+/**
+ * Read-only status endpoints (GET only):
+ *
+ *   /api/stacks          what `stack ls` + `stack health` show
+ *                        ?workspace=<den workspace>  ?health=0 skips docker
+ *   /api/edge            what `edge status` shows: up/down, routes, cert names
+ *   /api/security/plan   the security CLI's own dry run for ?env&mode&service:
+ *                        target discovery and the owned-host check, nothing run
+ *   /api/activity        the audit trail for one service (?address=repo/svc) or
+ *                        repo (?repo=): execs and syncs, yours and agents',
+ *                        newest first (the graph panel's Activity tab)
+ *
+ * The MCP server's `stacks`, `edge_status` and `run_tests` (its security
+ * pre-flight) read these. Collaborators are injectable for tests.
+ */
+import * as http from "http";
+import { readEdgeConfig } from "../../shared/edge/config.js";
+import { edgeStatus, type EdgeStatus } from "../../shared/edge/status.js";
+import { getWorkspaceByName } from "../../shared/environment-manager/workspaces.js";
+import {
+  loadStackContext,
+  resolveStackWorkspaces,
+  stackStatuses,
+  type StackStatus,
+} from "../../shared/stacks/status.js";
+import { send400, sendJson } from "./http-helpers.js";
+import { recentActions, type AuditEntry } from "./audit.js";
+
+export interface SecurityPlanArgs {
+  env: string;
+  mode: string;
+  service?: string;
+}
+
+export interface SecurityPlanResult {
+  exitCode: number;
+  log: string[];
+  errors: string[];
+}
+
+export interface ReadonlyRouteDeps {
+  workspaceExists: (name: string) => boolean;
+  stacks: (opts: { workspace: string | null; health: boolean }) => {
+    workspace: string;
+    stackWorkspace: string;
+    stacks: StackStatus[];
+  };
+  edge: () => EdgeStatus;
+  actions: () => AuditEntry[];
+  securityPlan: (args: SecurityPlanArgs) => Promise<SecurityPlanResult>;
+}
+
+export const defaultReadonlyRouteDeps: ReadonlyRouteDeps = {
+  workspaceExists: (name) => !!getWorkspaceByName(name),
+  stacks: ({ workspace, health }) => {
+    const ws = resolveStackWorkspaces(workspace);
+    const ctx = loadStackContext(ws.denWorkspace);
+    return {
+      workspace: ws.denWorkspace,
+      stackWorkspace: ws.stackWorkspace,
+      stacks: stackStatuses(ctx, { health }),
+    };
+  },
+  edge: () => edgeStatus(readEdgeConfig()),
+  actions: recentActions,
+  securityPlan: async ({ env, mode, service }) => {
+    // The CLI's own entrypoint in --dry-run: the same discovery, mode
+    // ceiling and owned-host check, with no token minted and nothing run.
+    const { runSecurityCli, defaultEntrypointDeps } =
+      await import("../../pillars/security/run.js");
+    const log: string[] = [];
+    const errors: string[] = [];
+    const argv = [`--env=${env}`, `--mode=${mode}`, "--dry-run"];
+    if (service) argv.push(`--service=${service}`);
+    const exitCode = await runSecurityCli(argv, {
+      ...defaultEntrypointDeps(),
+      log: (m) => log.push(m),
+      logError: (m) => errors.push(m),
+    });
+    return { exitCode, log, errors };
+  },
+};
+
+const SAFE_NAME = /^[A-Za-z0-9._/-]{1,128}$/;
+
+/**
+ * The entries about one service or repo. An exec's detail starts with the
+ * address ("shop/api up (local) [id]"); a sync names its repo ("· repo=shop").
+ */
+export function activityFor(
+  entries: AuditEntry[],
+  target: { address?: string; repo?: string },
+): AuditEntry[] {
+  const matches = (e: AuditEntry): boolean => {
+    if (target.address)
+      return e.verb === "exec" && e.detail.startsWith(target.address + " ");
+    const repo = target.repo ?? "";
+    if (e.verb === "exec") return e.detail.startsWith(repo + "/");
+    if (e.verb === "sync") return e.detail.split(" ").includes(`repo=${repo}`);
+    return false;
+  };
+  return entries.filter(matches).reverse();
+}
+const MODES = ["baseline", "api", "full", "all"];
+
+/** Handles the routes above; false when `pathname` is not one of them. */
+export async function handleReadonlyRoutes(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+  pathname: string,
+  url: URL,
+  deps: ReadonlyRouteDeps = defaultReadonlyRouteDeps,
+): Promise<boolean> {
+  if (
+    pathname !== "/api/stacks" &&
+    pathname !== "/api/edge" &&
+    pathname !== "/api/activity" &&
+    pathname !== "/api/security/plan"
+  )
+    return false;
+  if (req.method !== "GET") {
+    res.writeHead(405, { Allow: "GET" });
+    res.end("read-only");
+    return true;
+  }
+
+  if (pathname === "/api/stacks") {
+    const workspace = url.searchParams.get("workspace") || null;
+    if (workspace && !deps.workspaceExists(workspace)) {
+      send400(res, `unknown workspace "${workspace}"`);
+      return true;
+    }
+    try {
+      sendJson(
+        res,
+        deps.stacks({
+          workspace,
+          health: url.searchParams.get("health") !== "0",
+        }),
+      );
+    } catch (e) {
+      sendJson(res, { error: (e as Error).message }, 500);
+    }
+    return true;
+  }
+
+  if (pathname === "/api/edge") {
+    try {
+      sendJson(res, { configured: true, ...deps.edge() });
+    } catch (e) {
+      // No edge configured is a state, not a server error.
+      sendJson(res, { configured: false, error: (e as Error).message });
+    }
+    return true;
+  }
+
+  if (pathname === "/api/activity") {
+    const address = url.searchParams.get("address") ?? undefined;
+    const repo = url.searchParams.get("repo") ?? undefined;
+    const name = address ?? repo;
+    if (!name || !SAFE_NAME.test(name)) {
+      send400(res, "address or repo is required");
+      return true;
+    }
+    sendJson(res, { entries: activityFor(deps.actions(), { address, repo }) });
+    return true;
+  }
+
+  // /api/security/plan
+  const env = url.searchParams.get("env") ?? "";
+  const mode = url.searchParams.get("mode") ?? "baseline";
+  const service = url.searchParams.get("service") ?? undefined;
+  if (!SAFE_NAME.test(env)) {
+    send400(res, "env is required");
+    return true;
+  }
+  if (!MODES.includes(mode)) {
+    send400(res, `mode must be one of ${MODES.join(", ")}`);
+    return true;
+  }
+  if (service !== undefined && !SAFE_NAME.test(service)) {
+    send400(res, "invalid service");
+    return true;
+  }
+  try {
+    const plan = await deps.securityPlan({
+      env,
+      mode,
+      ...(service ? { service } : {}),
+    });
+    sendJson(res, { ok: plan.exitCode === 0, ...plan });
+  } catch (e) {
+    sendJson(
+      res,
+      { ok: false, exitCode: 1, log: [], errors: [(e as Error).message] },
+      500,
+    );
+  }
+  return true;
+}

package/src/ui/server/release-deploy-session.ts

@@ -0,0 +1,246 @@
+/**
+ * Deploy session manager for the Release tab.
+ *
+ * A deploy is a long-running, server-side thing (dispatch → gate → monitor) that
+ * MUST outlive any single browser page. Den's tabs are separate full-page
+ * navigations, so if the deploy were tied to the SSE request (as the first cut
+ * was), navigating away from Release would both lose the log AND abort den's
+ * monitoring of a real, already-dispatched deploy.
+ *
+ * This decouples them: `start()` runs the deploy in the background against an
+ * in-memory replay buffer; browser clients `attach()` to REPLAY the log so far
+ * and then stream live events. Re-attaching after a reload restores the full
+ * log. The deploy runs to completion regardless of who is (or isn't) attached;
+ * only an explicit `dismiss()` (the user closing the log) stops it.
+ *
+ * Sessions run CONCURRENTLY. Deploys of different systems are independent —
+ * they dispatch to different repos and GitHub scopes its own `concurrency:`
+ * group per repo-and-environment — so a global lock only stopped the operator
+ * from doing things that were never in conflict. The one real collision is
+ * dispatching the SAME repo to the SAME environment twice while the first is
+ * still in flight, which `conflicts()` rejects.
+ */
+
+import {
+  releaseService,
+  type DeployPlanEntry,
+  type ReleaseEvent,
+} from "./release-service.js";
+import {
+  recordInvocation,
+  recordFailure,
+} from "../../shared/dev-metrics/emit.js";
+
+/** Public (serializable) view of a session — no subscribers/internal flags. */
+export interface DeploySessionInfo {
+  id: string;
+  label: string;
+  env: string;
+  mode: string;
+  status: "running" | "done";
+  ok: boolean | null;
+  startedAt: number;
+  endedAt: number | null;
+  /** Repos this session deploys — lets the UI disable just their buttons. */
+  repos: string[];
+}
+
+type Subscriber = (ev: ReleaseEvent) => void;
+
+interface Session extends DeploySessionInfo {
+  events: ReleaseEvent[];
+  subs: Set<Subscriber>;
+  dismissed: boolean;
+}
+
+// A deploy log is modest (dispatch/gate/monitor lines); cap the replay buffer so
+// a pathologically long-running deploy can't grow it without bound.
+const MAX_EVENTS = 5000;
+
+// Finished sessions are retained so a reload can restore their log. Cap how
+// many, so a long session of many deploys can't grow the map without bound.
+const MAX_FINISHED_SESSIONS = 20;
+
+function newId(): string {
+  return `dep_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+}
+
+class DeploySessionManager {
+  private sessions = new Map<string, Session>();
+
+  private info(s: Session): DeploySessionInfo {
+    const { events: _e, subs: _s, dismissed: _d, ...info } = s;
+    void _e;
+    void _s;
+    void _d;
+    return info;
+  }
+
+  /** All restorable sessions (running or finished), newest first. */
+  active(): DeploySessionInfo[] {
+    return [...this.sessions.values()]
+      .filter((s) => !s.dismissed)
+      .sort((a, b) => b.startedAt - a.startedAt)
+      .map((s) => this.info(s));
+  }
+
+  /** True while ANY deploy is live. Kept for callers that just need a flag. */
+  busy(): boolean {
+    return [...this.sessions.values()].some(
+      (s) => !s.dismissed && s.status === "running",
+    );
+  }
+
+  /**
+   * Repos in `plan` that already have a live deploy to `env` — dispatching the
+   * same repo+env twice would race two runs against one GitHub concurrency
+   * group. Different repos, or the same repo to a different env, do not
+   * conflict. Empty array means the deploy is safe to start.
+   */
+  conflicts(env: string, plan: DeployPlanEntry[]): string[] {
+    const live = new Set<string>();
+    for (const s of this.sessions.values()) {
+      if (s.dismissed || s.status !== "running" || s.env !== env) continue;
+      for (const r of s.repos) live.add(r);
+    }
+    return plan.map((p) => p.repo).filter((r) => live.has(r));
+  }
+
+  /**
+   * Start a deploy in the background. `notices` are emitted into the log before
+   * the deploy begins (e.g. the header line and a hotfix warning). Callers
+   * should check `conflicts()` first — this does not re-check.
+   */
+  start(opts: {
+    env: string;
+    mode: string;
+    label: string;
+    plan: DeployPlanEntry[];
+    notices?: ReleaseEvent[];
+  }): DeploySessionInfo {
+    const session: Session = {
+      id: newId(),
+      label: opts.label,
+      env: opts.env,
+      mode: opts.mode,
+      status: "running",
+      ok: null,
+      startedAt: Date.now(),
+      endedAt: null,
+      repos: opts.plan.map((p) => p.repo),
+      events: [],
+      subs: new Set(),
+      dismissed: false,
+    };
+    this.sessions.set(session.id, session);
+    this.prune();
+
+    const emit = (ev: ReleaseEvent): void => {
+      session.events.push(ev);
+      if (session.events.length > MAX_EVENTS) {
+        session.events.splice(0, session.events.length - MAX_EVENTS);
+      }
+      for (const sub of session.subs) {
+        try {
+          sub(ev);
+        } catch {
+          /* a dead subscriber must not break the fan-out */
+        }
+      }
+    };
+
+    for (const n of opts.notices ?? []) emit(n);
+
+    const startedAt = session.startedAt;
+    // Decoupled from any client. aborted() fires only when the user dismisses
+    // the log, giving an escape hatch for a stuck monitor; navigation does not.
+    void releaseService
+      .deploy(opts.env, opts.plan, emit, () => session.dismissed)
+      .then((ok) => {
+        session.ok = ok;
+        recordInvocation({
+          command: "release.deploy",
+          surface: "ux",
+          durationMs: Date.now() - startedAt,
+          exit: ok ? 0 : 1,
+          extra: { mode: opts.mode, env: opts.env, repos: opts.plan.length },
+        });
+      })
+      .catch((e) => {
+        session.ok = false;
+        recordFailure({
+          command: "release.deploy",
+          surface: "ux",
+          reason:
+            (e as { constructor?: { name?: string } })?.constructor?.name ??
+            "Error",
+        });
+        emit({
+          type: "log",
+          level: "error",
+          text: `Deploy error: ${(e as Error).message}`,
+        });
+        emit({ type: "done", ok: false, summary: "Deploy error." });
+      })
+      .finally(() => {
+        session.status = "done";
+        session.endedAt = Date.now();
+        // Dismissed mid-run: nothing can attach to it now, so drop it once the
+        // deploy loop has actually exited.
+        if (session.dismissed) this.sessions.delete(session.id);
+      });
+
+    return this.info(session);
+  }
+
+  /**
+   * Bound the map. Finished sessions are kept so a reload can still restore the
+   * log, but not forever — drop the oldest finished ones past the cap. Running
+   * sessions are never pruned.
+   */
+  private prune(): void {
+    const finished = [...this.sessions.values()]
+      .filter((s) => s.status === "done")
+      .sort((a, b) => (a.endedAt ?? 0) - (b.endedAt ?? 0));
+    const excess = finished.length - MAX_FINISHED_SESSIONS;
+    for (let i = 0; i < excess; i++) this.sessions.delete(finished[i].id);
+  }
+
+  /**
+   * Attach a subscriber to session `id`: replays every buffered event (the full
+   * log, terminal `done` included when finished) then streams live ones.
+   * Returns an unsubscribe fn, or null if the session is gone/dismissed.
+   */
+  attach(id: string, sub: Subscriber): (() => void) | null {
+    const s = this.sessions.get(id);
+    if (!s || s.dismissed) return null;
+    for (const ev of s.events) {
+      try {
+        sub(ev);
+      } catch {
+        /* ignore */
+      }
+    }
+    s.subs.add(sub);
+    return () => {
+      s.subs.delete(sub);
+    };
+  }
+
+  /**
+   * Dismiss (close) session `id`: signals the deploy to stop monitoring and
+   * removes it from restore. A finished session's slot is freed immediately; a
+   * running one frees once its loop exits.
+   */
+  dismiss(id: string): boolean {
+    const s = this.sessions.get(id);
+    if (!s) return false;
+    s.dismissed = true;
+    // A finished session can go now; a running one is dropped by its own
+    // .finally() once the deploy loop notices the dismissal and exits.
+    if (s.status === "done") this.sessions.delete(id);
+    return true;
+  }
+}
+
+export const deploySessions = new DeploySessionManager();