@monster-orange/den 0.1.0 → 0.2.1

package/src/ui/server/public/services.html

@@ -847,6 +847,11 @@
           const branchBadge = s.branch
             ? `<span class="badge branch">${s.branch}</span>`
             : "";
+          // Which manifest layers built this card: repo or held, + override.
+          const layersBadge =
+            Array.isArray(s.manifestLayers) && s.manifestLayers.length > 0
+              ? `<span class="badge layers" title="Manifest layers applied">manifest: ${s.manifestLayers.join(" + ")}</span>`
+              : "";
           return `
           <div class="service-card${isSub ? " subservice" : ""}">
             <div class="service-card-header">
@@ -857,7 +862,7 @@
                 <a class="site-link" id="site-${s.repo}-${s.service}" target="_blank" rel="noopener" hidden></a>
               </div>
             </div>
-            <div class="service-meta">${modeBadge}${branchBadge}${unclonedBadge}</div>
+            <div class="service-meta">${modeBadge}${branchBadge}${layersBadge}${unclonedBadge}</div>
             <div class="cmd-row">
               ${hasCaps ? cmdButtons + logsButton : `<span style="color:var(--muted);font-size:11px">${emptyNote}</span>`}
             </div>

package/src/ui/server/readonly-routes.ts

@@ -0,0 +1,209 @@
+/**
+ * Read-only status endpoints (GET only):
+ *
+ *   /api/stacks          what `stack ls` + `stack health` show
+ *                        ?workspace=<den workspace>  ?health=0 skips docker
+ *   /api/edge            what `edge status` shows: up/down, routes, cert names
+ *   /api/security/plan   the security CLI's own dry run for ?env&mode&service:
+ *                        target discovery and the owned-host check, nothing run
+ *   /api/activity        the audit trail for one service (?address=repo/svc) or
+ *                        repo (?repo=): execs and syncs, yours and agents',
+ *                        newest first (the graph panel's Activity tab)
+ *
+ * The MCP server's `stacks`, `edge_status` and `run_tests` (its security
+ * pre-flight) read these. Collaborators are injectable for tests.
+ */
+import * as http from "http";
+import { readEdgeConfig } from "../../shared/edge/config.js";
+import { edgeStatus, type EdgeStatus } from "../../shared/edge/status.js";
+import { getWorkspaceByName } from "../../shared/environment-manager/workspaces.js";
+import {
+  loadStackContext,
+  resolveStackWorkspaces,
+  stackStatuses,
+  type StackStatus,
+} from "../../shared/stacks/status.js";
+import { send400, sendJson } from "./http-helpers.js";
+import { recentActions, type AuditEntry } from "./audit.js";
+
+export interface SecurityPlanArgs {
+  env: string;
+  mode: string;
+  service?: string;
+}
+
+export interface SecurityPlanResult {
+  exitCode: number;
+  log: string[];
+  errors: string[];
+}
+
+export interface ReadonlyRouteDeps {
+  workspaceExists: (name: string) => boolean;
+  stacks: (opts: { workspace: string | null; health: boolean }) => {
+    workspace: string;
+    stackWorkspace: string;
+    stacks: StackStatus[];
+  };
+  edge: () => EdgeStatus;
+  actions: () => AuditEntry[];
+  securityPlan: (args: SecurityPlanArgs) => Promise<SecurityPlanResult>;
+}
+
+export const defaultReadonlyRouteDeps: ReadonlyRouteDeps = {
+  workspaceExists: (name) => !!getWorkspaceByName(name),
+  stacks: ({ workspace, health }) => {
+    const ws = resolveStackWorkspaces(workspace);
+    const ctx = loadStackContext(ws.denWorkspace);
+    return {
+      workspace: ws.denWorkspace,
+      stackWorkspace: ws.stackWorkspace,
+      stacks: stackStatuses(ctx, { health }),
+    };
+  },
+  edge: () => edgeStatus(readEdgeConfig()),
+  actions: recentActions,
+  securityPlan: async ({ env, mode, service }) => {
+    // The CLI's own entrypoint in --dry-run: the same discovery, mode
+    // ceiling and owned-host check, with no token minted and nothing run.
+    const { runSecurityCli, defaultEntrypointDeps } =
+      await import("../../pillars/security/run.js");
+    const log: string[] = [];
+    const errors: string[] = [];
+    const argv = [`--env=${env}`, `--mode=${mode}`, "--dry-run"];
+    if (service) argv.push(`--service=${service}`);
+    const exitCode = await runSecurityCli(argv, {
+      ...defaultEntrypointDeps(),
+      log: (m) => log.push(m),
+      logError: (m) => errors.push(m),
+    });
+    return { exitCode, log, errors };
+  },
+};
+
+const SAFE_NAME = /^[A-Za-z0-9._/-]{1,128}$/;
+
+/**
+ * The entries about one service or repo. An exec's detail starts with the
+ * address ("shop/api up (local) [id]"); a sync names its repo ("· repo=shop").
+ */
+export function activityFor(
+  entries: AuditEntry[],
+  target: { address?: string; repo?: string },
+): AuditEntry[] {
+  // A repo-level entry ("core down (local)") is an attempt on the repo
+  // without naming a service, as agents usually do: it shows for the repo
+  // and for each of its services.
+  const repoLevel = (e: AuditEntry, repo: string): boolean =>
+    e.verb === "exec" && e.detail.startsWith(repo + " ");
+  const matches = (e: AuditEntry): boolean => {
+    if (target.address)
+      return (
+        (e.verb === "exec" && e.detail.startsWith(target.address + " ")) ||
+        repoLevel(e, target.address.split("/")[0])
+      );
+    const repo = target.repo ?? "";
+    if (e.verb === "exec")
+      return e.detail.startsWith(repo + "/") || repoLevel(e, repo);
+    if (e.verb === "sync") return e.detail.split(" ").includes(`repo=${repo}`);
+    return false;
+  };
+  return entries.filter(matches).reverse();
+}
+const MODES = ["baseline", "api", "full", "all"];
+
+/** Handles the routes above; false when `pathname` is not one of them. */
+export async function handleReadonlyRoutes(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+  pathname: string,
+  url: URL,
+  deps: ReadonlyRouteDeps = defaultReadonlyRouteDeps,
+): Promise<boolean> {
+  if (
+    pathname !== "/api/stacks" &&
+    pathname !== "/api/edge" &&
+    pathname !== "/api/activity" &&
+    pathname !== "/api/security/plan"
+  )
+    return false;
+  if (req.method !== "GET") {
+    res.writeHead(405, { Allow: "GET" });
+    res.end("read-only");
+    return true;
+  }
+
+  if (pathname === "/api/stacks") {
+    const workspace = url.searchParams.get("workspace") || null;
+    if (workspace && !deps.workspaceExists(workspace)) {
+      send400(res, `unknown workspace "${workspace}"`);
+      return true;
+    }
+    try {
+      sendJson(
+        res,
+        deps.stacks({
+          workspace,
+          health: url.searchParams.get("health") !== "0",
+        }),
+      );
+    } catch (e) {
+      sendJson(res, { error: (e as Error).message }, 500);
+    }
+    return true;
+  }
+
+  if (pathname === "/api/edge") {
+    try {
+      sendJson(res, { configured: true, ...deps.edge() });
+    } catch (e) {
+      // No edge configured is a state, not a server error.
+      sendJson(res, { configured: false, error: (e as Error).message });
+    }
+    return true;
+  }
+
+  if (pathname === "/api/activity") {
+    const address = url.searchParams.get("address") ?? undefined;
+    const repo = url.searchParams.get("repo") ?? undefined;
+    const name = address ?? repo;
+    if (!name || !SAFE_NAME.test(name)) {
+      send400(res, "address or repo is required");
+      return true;
+    }
+    sendJson(res, { entries: activityFor(deps.actions(), { address, repo }) });
+    return true;
+  }
+
+  // /api/security/plan
+  const env = url.searchParams.get("env") ?? "";
+  const mode = url.searchParams.get("mode") ?? "baseline";
+  const service = url.searchParams.get("service") ?? undefined;
+  if (!SAFE_NAME.test(env)) {
+    send400(res, "env is required");
+    return true;
+  }
+  if (!MODES.includes(mode)) {
+    send400(res, `mode must be one of ${MODES.join(", ")}`);
+    return true;
+  }
+  if (service !== undefined && !SAFE_NAME.test(service)) {
+    send400(res, "invalid service");
+    return true;
+  }
+  try {
+    const plan = await deps.securityPlan({
+      env,
+      mode,
+      ...(service ? { service } : {}),
+    });
+    sendJson(res, { ok: plan.exitCode === 0, ...plan });
+  } catch (e) {
+    sendJson(
+      res,
+      { ok: false, exitCode: 1, log: [], errors: [(e as Error).message] },
+      500,
+    );
+  }
+  return true;
+}

package/src/ui/server/ui-assets.ts

@@ -0,0 +1,73 @@
+/**
+ * Static assets the graph needs beyond the pages themselves:
+ *   - the graph's own modules in public/ (UI_MODULES), served like header.js;
+ *   - browser libraries the UI loads, served by Den's own server from
+ * node_modules (never a CDN), so the UI works offline. Each is a pinned
+ * dependency in package.json. npm hoists Den's dependencies into a
+ * distribution's node_modules, so the lookup walks up from the engine root,
+ * like engineBin does.
+ */
+import * as fs from "fs";
+import * as http from "http";
+import * as path from "path";
+import { getEngineRoot } from "../../shared/paths.js";
+import { serveFile } from "./http-helpers.js";
+
+/** The graph's modules in public/, each served at /<name>. */
+export const UI_MODULES: readonly string[] = [
+  "/graph.js",
+  "/graph-model.js",
+  "/panel.js",
+  "/graph.css",
+];
+
+/** URL path → file inside node_modules. */
+export const VENDOR_ASSETS: Readonly<Record<string, string>> = {
+  "/vendor/elk.bundled.js": "elkjs/lib/elk.bundled.js",
+};
+
+/** The installed file for a vendored URL path, or null. */
+export function vendorAssetFile(
+  pathname: string,
+  engineRoot: string = getEngineRoot(),
+): string | null {
+  const rel = Object.hasOwn(VENDOR_ASSETS, pathname)
+    ? VENDOR_ASSETS[pathname]
+    : undefined;
+  if (!rel) return null;
+  let dir = path.resolve(engineRoot);
+  for (;;) {
+    const candidate = path.join(dir, "node_modules", rel);
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+/** Serves a UI module or vendored asset; false when `pathname` is neither. */
+export function serveUiAsset(
+  res: http.ServerResponse,
+  pathname: string,
+  publicDir: string,
+): boolean {
+  if (UI_MODULES.includes(pathname)) {
+    serveFile(res, path.join(publicDir, pathname.slice(1)));
+    return true;
+  }
+  if (!pathname.startsWith("/vendor/")) return false;
+  const file = vendorAssetFile(pathname);
+  if (!file) {
+    res.writeHead(404, { "Content-Type": "text/plain" });
+    res.end("Not found");
+    return true;
+  }
+  // Pinned versions: the bytes only change with Den itself. Not run through
+  // the product-token fill the UI's own scripts get.
+  res.writeHead(200, {
+    "Content-Type": "application/javascript",
+    "Cache-Control": "public, max-age=86400",
+  });
+  res.end(fs.readFileSync(file));
+  return true;
+}

package/src/ui/server/workspace-routes.ts

@@ -69,6 +69,10 @@ import {
   orderForUp,
 } from "../../shared/environment-manager/derivation/derived-up.js";
 import { readManifest } from "../../shared/manifest/read-manifest.js";
+import {
+  placementRefusal,
+  servicePlacement,
+} from "../../shared/manifest/placement.js";
 import {
   checkRepoSecrets,
   describeSecretsCheck,
@@ -85,6 +89,11 @@ import {
 import { getReposRoot, readUserConfig } from "../../shared/den-config.js";
 import { getDistRoot } from "../../shared/paths.js";
 import { getSudoEnv, prewarmSudo } from "./sudo-store.js";
+import {
+  devManagedPaths,
+  selectSyncTargets,
+} from "../../shared/environment-manager/sync-targets.js";
+import { actorFromHeaders, recordAction } from "./audit.js";
 import {
   GIT_REMOTE_TIMEOUT_MS,
   DETACH_WINDOW_MS,
@@ -1472,6 +1481,22 @@ export async function handleWorkspaceRoutes(
             return;
           }
         }
+        // R13: a remote service is part of the app but never run from here.
+        const remote = placementRefusal(
+          address,
+          servicePlacement(
+            readManifest(resolved.repoPath),
+            resolved.subsystem,
+            "local",
+          ),
+          () => false,
+          cmd,
+        );
+        if (remote) {
+          emit({ type: "line", text: `  ${remote}` });
+          runNext(i + 1);
+          return;
+        }
         const svcCmds = localCommandsFor(resolved, ws.name);
         const hasCmd =
           cmd === "down" ||
@@ -1906,14 +1931,20 @@ export async function handleWorkspaceRoutes(
     // Optional ?repo=<name> syncs a single system (the card's ⟳ sync action);
     // omitted syncs the whole workspace (the master ⟳ Sync button).
     const onlyRepo = url.searchParams.get("repo");
-    // Only sync managed services. Deduplicate by repoPath.
-    const seen = new Set<string>();
-    const targets = services.filter((s) => {
-      if (s.mode !== "managed") return false;
-      if (onlyRepo && s.repoName !== onlyRepo) return false;
-      if (seen.has(s.repoPath)) return false;
-      seen.add(s.repoPath);
-      return true;
+    // Only managed clones, deduplicated by path; never a dev-managed checkout
+    // (see sync-targets.ts), and a refusal is said out loud.
+    const { targets, refused } = selectSyncTargets(services, {
+      onlyRepo,
+      devManaged: devManagedPaths(readWorkspacesFile()),
+    });
+    for (const r of refused)
+      emit({
+        type: "line",
+        text: `  ${r.repoName}: not synced — ${r.reason}`,
+      });
+    recordAction(actorFromHeaders(req.headers), {
+      verb: "sync",
+      detail: `${ws.name}${onlyRepo ? ` · repo=${onlyRepo}` : ""} · ${targets.length} managed repo(s)`,
     });
 
     if (targets.length === 0) {