@monster-orange/den 0.1.0 → 0.2.0

package/src/ui/cli/index.ts

@@ -101,6 +101,7 @@ import {
   getReposRoot,
   mergeUserConfig,
   readDenConfig,
+  isProductionEnv,
   readUserConfig,
 } from "../../shared/den-config.js";
 import { deriveGraph } from "../../shared/environment-manager/derivation/derive-graph.js";
@@ -120,7 +121,7 @@ import {
 } from "./applications-command.js";
 import { loadApplications } from "../../shared/environment-manager/load-applications.js";
 import { hasRuntime, repoKind } from "../../shared/repo-kind.js";
-import type { RepoKind } from "../../shared/types/index.js";
+import type { RepoKind, ValidationResult } from "../../shared/types/index.js";
 import { localCommandsFor } from "../../shared/stacks/manifest-commands.js";
 import {
   buildUpPlan,
@@ -131,7 +132,15 @@ import * as fs from "fs";
 import { readManifest } from "../../shared/manifest/read-manifest.js";
 import * as nodePath from "path";
 import { runInit } from "./init.js";
-import { validateManifest } from "../../shared/manifest/validate-manifest.js";
+import {
+  validateManifest,
+  validateManifestLayers,
+} from "../../shared/manifest/validate-manifest.js";
+import {
+  placementRefusal,
+  placementSuffix,
+  servicePlacement,
+} from "../../shared/manifest/placement.js";
 import {
   getDistRoot,
   getEngineRoot,
@@ -290,6 +299,13 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
       "This org's HTTPS edge: own CA + cert, routes at <name>.<edge.domain>.",
     ],
   },
+  mcp: {
+    usage: "mcp [--port <web port>]",
+    lines: [
+      "An MCP server over stdio for agents: a client of the running web server",
+      `(\`${product().cli} web up\`). Read tools always; actions only as named in mcp.actions.`,
+    ],
+  },
   "local-dev": {
     usage: "local-dev [on|off]",
     lines: [
@@ -345,6 +361,7 @@ const TELEMETRY_COMMANDS = new Set<string>([
   "stack",
   "apps",
   "applications",
+  "mcp",
 ]);
 
 /** Map a raw command token to a PII-safe, registered telemetry command name. */
@@ -362,6 +379,52 @@ function telemetryReason(error: unknown): string {
   return name && name !== "Object" ? name : "Error";
 }
 
+/** Print one manifest's validation: a status line, then each issue. */
+function printValidation(
+  label: string,
+  result: ValidationResult,
+  layer?: string,
+): void {
+  const tag = layer ? `${layer}, ` : "";
+  const plural = (n: number, word: string): string =>
+    `${n} ${word}${n === 1 ? "" : "s"}`;
+  if (result.valid && result.warnings.length === 0) {
+    console.log(
+      chalk.green(`  ✓  ${label}`) +
+        chalk.gray(`  (${tag}v${result.version}, no issues)`),
+    );
+  } else if (result.valid) {
+    console.log(
+      chalk.yellow(`  ⚠  ${label}`) +
+        chalk.gray(
+          `  (${tag}v${result.version}, ${plural(result.warnings.length, "warning")})`,
+        ),
+    );
+  } else {
+    console.log(
+      chalk.red(`  ✗  ${label}`) +
+        chalk.gray(
+          `  (${tag}v${result.version}, ${plural(result.errors.length, "error")}${result.warnings.length > 0 ? `, ${plural(result.warnings.length, "warning")}` : ""})`,
+        ),
+    );
+  }
+
+  for (const err of result.errors) {
+    const path = err.path ? chalk.gray(err.path) + "  " : "";
+    console.log(`  ${chalk.red("ERROR")}   ${path}${err.message}`);
+    if (err.suggestion) {
+      console.log(`            ${chalk.gray("→ " + err.suggestion)}`);
+    }
+  }
+  for (const warn of result.warnings) {
+    const path = warn.path ? chalk.gray(warn.path) + "  " : "";
+    console.log(`  ${chalk.yellow("WARNING")} ${path}${warn.message}`);
+    if (warn.suggestion) {
+      console.log(`            ${chalk.gray("→ " + warn.suggestion)}`);
+    }
+  }
+}
+
 class DenCLI {
   private static readonly serviceCommands = new Set([
     "up",
@@ -631,6 +694,15 @@ class DenCLI {
           cmdApps(args.slice(1));
           break;
 
+        case "mcp": {
+          // bin/den routes `mcp` to its own entry (stdout is the protocol);
+          // this covers the CLI run directly from a checkout.
+          await import("./mcp-stdout-guard.js");
+          const { runMcp } = await import("../mcp/server.js");
+          await runMcp(args.slice(1));
+          break;
+        }
+
         case "--help":
         case "-h":
           this.displayHelp();
@@ -1304,6 +1376,25 @@ class DenCLI {
         printPartialState();
         return;
       }
+      // R13: a remote service is never started or stopped from here. Said,
+      // not failed, so a workspace or app up/down carries on past it.
+      const placed = resolveService(address, workspace);
+      const remote = placed
+        ? placementRefusal(
+            address,
+            servicePlacement(
+              readManifest(placed.repoPath),
+              placed.subsystem,
+              "local",
+            ),
+            (e) => isProductionEnv(e),
+            command === "down" ? "stop" : "start",
+          )
+        : null;
+      if (remote) {
+        console.log(chalk.gray(`  • ${remote}`));
+        continue;
+      }
       if (command === "up" && !seedAddresses.has(address)) {
         const resolved = resolveService(address, workspace);
         if (resolved) {
@@ -2442,9 +2533,14 @@ class DenCLI {
     for (const r of results) {
       const healthStr = formatHealthLabel(r.health);
       const reasonStr = formatHealthReason(r);
+      const placed = placementSuffix({
+        runs: r.runs ?? "none",
+        target: r.target ?? null,
+      });
 
       table.push([
-        this.labelWithAutostart(r.address, noAutostart),
+        this.labelWithAutostart(r.address, noAutostart) +
+          (placed ? chalk.cyan(`  ${placed}`) : ""),
         r.mode === "dev-managed"
           ? chalk.blue("dev-managed")
           : chalk.magenta("managed"),
@@ -2606,13 +2702,19 @@ class DenCLI {
         /* ignore */
       }
 
+      const placed = placementSuffix({
+        runs: r.runs ?? "none",
+        target: r.target ?? null,
+      });
       table.push([
-        this.labelWithAutostart(r.address, noAutostart),
+        this.labelWithAutostart(r.address, noAutostart) +
+          (placed ? chalk.cyan(`  ${placed}`) : ""),
         r.mode === "dev-managed"
           ? chalk.blue("dev-managed")
           : chalk.magenta("managed"),
         healthStr,
-        cmds.join(", "),
+        // A remote service's commands are never run from here.
+        placed ? chalk.gray("—") : cmds.join(", "),
       ]);
     }
 
@@ -3415,10 +3517,26 @@ class DenCLI {
         req.on("error", reject);
       });
     } else {
-      const filePath = fs.existsSync(target)
-        ? fs.lstatSync(target).isDirectory()
-          ? nodePath.join(target, `${product().manifestYml}`)
-          : target
+      const isDir = fs.existsSync(target) && fs.lstatSync(target).isDirectory();
+      // A repo folder: validate each layer that applies to it (its own or the
+      // held manifest, then manifests/<repo>.override.yml, then the merge).
+      if (isDir) {
+        const layered = validateManifestLayers(nodePath.resolve(target));
+        if (layered.layers.length > 0) {
+          console.log();
+          for (const l of layered.layers)
+            printValidation(
+              chalk.bold(l.file ?? "merged"),
+              l.result,
+              l.layer === "merged" ? "merged" : l.layer,
+            );
+          console.log();
+          if (!layered.valid) process.exit(1);
+          return;
+        }
+      }
+      const filePath = isDir
+        ? nodePath.join(target, `${product().manifestYml}`)
         : target;
 
       if (!fs.existsSync(filePath)) {
@@ -3434,42 +3552,7 @@ class DenCLI {
     );
 
     console.log();
-    if (result.valid && result.warnings.length === 0) {
-      console.log(
-        chalk.green(`  ✓  ${label}`) +
-          chalk.gray(`  (v${result.version}, no issues)`),
-      );
-    } else if (result.valid) {
-      console.log(
-        chalk.yellow(`  ⚠  ${label}`) +
-          chalk.gray(
-            `  (v${result.version}, ${result.warnings.length} warning${result.warnings.length === 1 ? "" : "s"})`,
-          ),
-      );
-    } else {
-      console.log(
-        chalk.red(`  ✗  ${label}`) +
-          chalk.gray(
-            `  (v${result.version}, ${result.errors.length} error${result.errors.length === 1 ? "" : "s"}${result.warnings.length > 0 ? `, ${result.warnings.length} warning${result.warnings.length === 1 ? "" : "s"}` : ""})`,
-          ),
-      );
-    }
-
-    for (const err of result.errors) {
-      const path = err.path ? chalk.gray(err.path) + "  " : "";
-      console.log(`  ${chalk.red("ERROR")}   ${path}${err.message}`);
-      if (err.suggestion) {
-        console.log(`            ${chalk.gray("→ " + err.suggestion)}`);
-      }
-    }
-    for (const warn of result.warnings) {
-      const path = warn.path ? chalk.gray(warn.path) + "  " : "";
-      console.log(`  ${chalk.yellow("WARNING")} ${path}${warn.message}`);
-      if (warn.suggestion) {
-        console.log(`            ${chalk.gray("→ " + warn.suggestion)}`);
-      }
-    }
-
+    printValidation(label, result);
     console.log();
     if (!result.valid) process.exit(1);
   }
@@ -3559,6 +3642,9 @@ class DenCLI {
     console.log(
       "  create <name> [dir]  Scaffold a new distribution of your own (--title, --cli, --env-prefix)",
     );
+    console.log(
+      "  mcp [--port <n>]     MCP server (stdio) for agents, over the running web server",
+    );
     console.log();
     console.log("  workspace list       List workspaces");
     console.log(

package/src/ui/cli/mcp-main.ts

@@ -0,0 +1,13 @@
+/**
+ * Entry point for `<cli> mcp` (bin/den routes `mcp` here). Kept apart from
+ * the main CLI so nothing but the MCP protocol is ever written to stdout.
+ */
+import "./mcp-stdout-guard.js";
+import { runMcp } from "../mcp/server.js";
+
+runMcp(process.argv.slice(2)).catch((error: unknown) => {
+  process.stderr.write(
+    `mcp: ${error instanceof Error ? error.message : String(error)}\n`,
+  );
+  process.exit(1);
+});

package/src/ui/cli/mcp-stdout-guard.ts

@@ -0,0 +1,10 @@
+/**
+ * Imported first by the `mcp` entry: stdout carries the MCP protocol only,
+ * so anything that logs through console goes to stderr instead.
+ */
+const toStderr = (...args: unknown[]): void => console.error(...args);
+console.log = toStderr;
+console.info = toStderr;
+console.debug = toStderr;
+
+export {};

package/src/ui/cli/stack-command.ts

@@ -6,15 +6,8 @@
  * https://<route>.<stack>.<edge.domain>.
  */
 import chalk from "chalk";
-import { readEdgeConfig } from "../../shared/edge/config.js";
 import { routeUrl } from "../../shared/edge/render.js";
 import { edgeUp } from "../../shared/edge/runtime.js";
-import { readStacks } from "../../shared/stacks/config.js";
-import {
-  getFocusedWorkspaceName,
-  getWorkspaceByName,
-} from "../../shared/environment-manager/workspaces.js";
-import { stackWorkspace } from "../../shared/stacks/render.js";
 import { projectName, startOrder } from "../../shared/stacks/render.js";
 import {
   stackDown,
@@ -22,44 +15,26 @@ import {
   stackLogs,
   stackPs,
   stackUp,
-  type StackContext,
 } from "../../shared/stacks/runtime.js";
+import { loadStackContext, stackStatuses } from "../../shared/stacks/status.js";
 
-function workspaceFlag(args: string[]): {
-  fkWs: string;
-  ws: string;
-  service?: string;
-  rest: string[];
-} {
+function serviceFlag(args: string[]): { service?: string; rest: string[] } {
   const rest: string[] = [];
-  // The global -w/--workspace is parsed (and checked) before we run and
-  // arrives as DEN_WORKSPACE_OVERRIDE.
-  const fkWs =
-    process.env.DEN_WORKSPACE_OVERRIDE ||
-    getFocusedWorkspaceName() ||
-    "default";
   let service: string | undefined;
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--service") service = args[++i];
     else rest.push(args[i]);
   }
-  const ws = process.env.DEN_STACK_WORKSPACE || stackWorkspace(fkWs);
-  if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(ws))
-    throw new Error(
-      `workspace "${ws}" must be lowercase letters, digits and dashes`,
-    );
-  return { fkWs, ws, service, rest };
+  return { service, rest };
 }
 
 export async function cmdStack(argv: string[]): Promise<void> {
-  const { fkWs, ws, service, rest } = workspaceFlag(argv);
+  const { service, rest } = serviceFlag(argv);
   const [sub = "ls", ...args] = rest;
-  const edge = readEdgeConfig();
-  // Repo manifests come from that den workspace's checkouts.
-  const stacks = readStacks(undefined, {
-    workspace: getWorkspaceByName(fkWs) ? fkWs : undefined,
-  });
-  const ctx: StackContext = { edge, stacks, workspace: ws };
+  // The global -w/--workspace is parsed (and checked) before we run and
+  // arrives as DEN_WORKSPACE_OVERRIDE; loadStackContext reads it.
+  const ctx = loadStackContext();
+  const { edge, stacks } = ctx;
   const names = args.filter((a) => !a.startsWith("-"));
   const pick = () => {
     if (!names.length)
@@ -71,17 +46,15 @@ export async function cmdStack(argv: string[]): Promise<void> {
 
   switch (sub) {
     case "ls":
-      for (const s of Object.values(stacks)) {
+      for (const s of stackStatuses(ctx)) {
         console.log(
           chalk.bold(`${s.name}`) +
             chalk.gray(
-              `  ${s.repo}${s.dir ? `/${s.dir}` : ""}  project ${projectName(s.name, ws)}`,
+              `  ${s.repo}${s.dir ? `/${s.dir}` : ""}  project ${s.project}`,
             ),
         );
-        for (const route of Object.keys(s.routes))
-          console.log(
-            `  ${routeUrl(`${route}.${s.name}`, edge)}  → ${s.routes[route]}`,
-          );
+        for (const route of s.routes)
+          console.log(`  ${route.url}  → ${route.target}`);
         if (s.uses.length)
           console.log(chalk.gray(`  uses ${s.uses.join(", ")}`));
       }
@@ -90,7 +63,7 @@ export async function cmdStack(argv: string[]): Promise<void> {
       // Re-render the edge so its cert covers every stack, then start the stacks.
       await edgeUp(edge);
       for (const n of startOrder(pick(), stacks)) {
-        console.log(chalk.cyan(`\n▶ ${n} (${projectName(n, ws)})`));
+        console.log(chalk.cyan(`\n▶ ${n} (${projectName(n, ctx.workspace)})`));
         stackUp(ctx, stacks[n], { build: args.includes("--build") });
         for (const route of Object.keys(stacks[n].routes))
           console.log(chalk.green(`  ✓ ${routeUrl(`${route}.${n}`, edge)}`));

package/src/ui/cli/test-runner.ts

@@ -447,10 +447,16 @@ export class TestRunner {
   ): CommandStep[] {
     const names = options.modules ?? [];
     const script = "src/pillars/security/run.ts";
+    // An explicitly chosen stronger mode is passed on; the entrypoint's
+    // per-env ceiling refuses it where it isn't allowed.
+    const mode =
+      options.securityMode && options.securityMode !== "baseline"
+        ? [`--mode=${options.securityMode}`]
+        : [];
     if (names.length === 0) {
       return [
         {
-          ...tsxCommand(script, `--env=${options.environment}`),
+          ...tsxCommand(script, `--env=${options.environment}`, ...mode),
           env: baseEnv,
           label: "Run all security scans",
         },
@@ -461,6 +467,7 @@ export class TestRunner {
         script,
         `--env=${options.environment}`,
         `--service=${name}`,
+        ...mode,
       ),
       env: baseEnv,
       label: `Run security scan ${name}`,