@monster-orange/den 0.1.0 → 0.2.1

package/src/shared/redact.ts

@@ -0,0 +1,107 @@
+/**
+ * Secret redaction, in two forms:
+ *
+ * - Known values (`redactValues`, `containsValue`): a run holds the live
+ *   secret it minted (a bearer token, an agent key) and strips or refuses
+ *   that exact string. The journeys and security pillars use these.
+ * - Secret-shaped values (`redactSecrets`): text from somewhere we don't
+ *   control (service logs, command output) is scrubbed by pattern before it
+ *   leaves Den, e.g. through the MCP server. Patterns err on the side of
+ *   redacting: a hidden harmless value costs less than a leaked key.
+ */
+
+export const REDACTED = "[REDACTED]";
+
+/** Replace every occurrence of each non-empty value in `text`. */
+export function redactValues(
+  text: string,
+  values: readonly (string | undefined)[],
+): string {
+  let out = text;
+  for (const v of values) if (v) out = out.split(v).join(REDACTED);
+  return out;
+}
+
+/** Whether `text` contains any non-empty value. */
+export function containsValue(
+  text: string,
+  values: readonly (string | undefined)[],
+): boolean {
+  return values.some((v) => !!v && text.includes(v));
+}
+
+/** Key names whose values are secrets (matched anywhere in the key). */
+const SECRET_KEY =
+  "[\\w.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|credentials?|cookie)[\\w.-]*";
+
+interface Pattern {
+  name: string;
+  re: RegExp;
+  replace: string | ((...m: string[]) => string);
+}
+
+/**
+ * Order matters: whole blocks first, then structured forms (URLs, auth
+ * headers), then bare token shapes, then generic key=value.
+ */
+export const SECRET_PATTERNS: readonly Pattern[] = [
+  {
+    name: "private-key block",
+    re: /-----BEGIN ([A-Z0-9 ]*)PRIVATE KEY-----[\s\S]*?-----END \1PRIVATE KEY-----/g,
+    replace: (_m, kind) =>
+      `-----BEGIN ${kind}PRIVATE KEY-----${REDACTED}-----END ${kind}PRIVATE KEY-----`,
+  },
+  {
+    // A block cut off by a tail window: redact to the end of the text.
+    name: "private-key block (unterminated)",
+    re: /-----BEGIN ([A-Z0-9 ]*)PRIVATE KEY-----(?![\s\S]*-----END)(?!\[REDACTED\])[\s\S]*$/g,
+    replace: (_m, kind) => `-----BEGIN ${kind}PRIVATE KEY-----${REDACTED}`,
+  },
+  {
+    name: "URL credentials",
+    re: /\b([a-z][a-z0-9+.-]*:\/\/)([^\s:@/]+):([^\s@/]+)@/gi,
+    replace: (_m, scheme, user, pass) =>
+      pass === REDACTED ? _m : `${scheme}${user}:${REDACTED}@`,
+  },
+  {
+    name: "bearer token",
+    re: /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{8,}/gi,
+    replace: (_m, scheme) => `${scheme} ${REDACTED}`,
+  },
+  {
+    name: "JWT",
+    re: /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g,
+    replace: REDACTED,
+  },
+  {
+    name: "AWS access key id",
+    re: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[A-Z0-9]{16}\b/g,
+    replace: REDACTED,
+  },
+  {
+    name: "well-known token prefix",
+    re: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|[sr]k_(?:live|test)_[A-Za-z0-9]{10,}|sk-[A-Za-z0-9_-]{20,})/g,
+    replace: REDACTED,
+  },
+  {
+    name: "key=value secret",
+    re: new RegExp(
+      `\\b(${SECRET_KEY})(["']?\\s*[:=]\\s*)(\\[REDACTED\\]|"[^"]*"|'[^']*'|[^\\s,;&'"}\\]]+)`,
+      "gi",
+    ),
+    replace: (_m, key, sep, value) => {
+      const q = value[0] === '"' || value[0] === "'" ? value[0] : "";
+      return `${key}${sep}${q}${REDACTED}${q}`;
+    },
+  },
+];
+
+/** Redact every secret-shaped value in `text` (see SECRET_PATTERNS). */
+export function redactSecrets(text: string): string {
+  let out = text;
+  for (const p of SECRET_PATTERNS) {
+    const r = p.replace;
+    out = typeof r === "string" ? out.replace(p.re, r) : out.replace(p.re, r);
+  }
+  return out;
+}

package/src/shared/stacks/manifest-commands.ts

@@ -8,6 +8,7 @@ import { getDistRoot } from "../paths.js";
 import { readManifest } from "../manifest/read-manifest.js";
 import type { RawManifest } from "../types/index.js";
 import { manifestStackName } from "./config.js";
+import { containerName, parseTarget, projectName } from "./render.js";
 
 import { product } from "../product.js";
 type CommandDef = string | { cmd: string; detachable?: boolean };
@@ -63,6 +64,35 @@ export function composeHealthCmd(
     : `${base} --service ${JSON.stringify(subsystem)}`;
 }
 
+/**
+ * The containers a compose-stack service runs as, best match first ([] when
+ * the repo isn't a compose stack). Any other manifest service names a compose
+ * service; the primary one also falls back to its routes' target services.
+ * `stackWorkspace` is the Compose project suffix (see resolveStackWorkspaces).
+ */
+export function composeServiceContainers(
+  manifest: RawManifest,
+  subsystem: string,
+  repoName: string,
+  stackWorkspace: string,
+): string[] {
+  if (!manifest.compose) return [];
+  const project = projectName(
+    manifestStackName(manifest, repoName),
+    stackWorkspace,
+  );
+  const services = [subsystem];
+  if (isPrimary(manifest, subsystem))
+    for (const target of Object.values(manifest.compose.routes ?? {})) {
+      try {
+        services.push(parseTarget(target).service);
+      } catch {
+        /* a malformed route is reported by the stack commands */
+      }
+    }
+  return [...new Set(services)].map((svc) => containerName(project, svc));
+}
+
 /** Declared local commands layered over the synthesized compose ones. */
 export function effectiveLocalCommands(
   manifest: RawManifest,

package/src/shared/stacks/status.ts

@@ -0,0 +1,99 @@
+/**
+ * Read-only stack status: what `stack ls` and `stack health` show, as data.
+ * The CLI prints it; the web server serves it at /api/stacks (and through it
+ * the MCP `stacks` tool).
+ */
+import { readEdgeConfig } from "../edge/config.js";
+import { routeUrl } from "../edge/render.js";
+import {
+  getFocusedWorkspaceName,
+  getWorkspaceByName,
+} from "../environment-manager/workspaces.js";
+import { readStacks } from "./config.js";
+import { projectName, stackWorkspace } from "./render.js";
+import { stackHealth, type StackContext } from "./runtime.js";
+
+export interface StackRoute {
+  name: string;
+  url: string;
+  /** `<service>:<container port>`. */
+  target: string;
+}
+
+export interface StackStatus {
+  name: string;
+  repo: string;
+  dir: string | null;
+  /** The Compose project: `<stack>-<workspace>`. */
+  project: string;
+  routes: StackRoute[];
+  uses: string[];
+  /** Container health (only when asked for: it runs `docker ps`). */
+  health?: { ok: boolean; detail: string };
+}
+
+const WS_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+
+/**
+ * The den workspace stacks read their manifests from, and the Compose
+ * project suffix they run under. `denWorkspace` defaults to the CLI's
+ * -w override, then the focused workspace, then `default`.
+ */
+export function resolveStackWorkspaces(
+  denWorkspace?: string | null,
+  env: NodeJS.ProcessEnv = process.env,
+): { denWorkspace: string; stackWorkspace: string } {
+  const fkWs =
+    denWorkspace ||
+    env.DEN_WORKSPACE_OVERRIDE ||
+    getFocusedWorkspaceName() ||
+    "default";
+  const ws = env.DEN_STACK_WORKSPACE || stackWorkspace(fkWs);
+  if (!WS_RE.test(ws))
+    throw new Error(
+      `workspace "${ws}" must be lowercase letters, digits and dashes`,
+    );
+  return { denWorkspace: fkWs, stackWorkspace: ws };
+}
+
+/** The edge, the known stacks and the project suffix for one workspace. */
+export function loadStackContext(denWorkspace?: string | null): StackContext {
+  const { denWorkspace: fkWs, stackWorkspace: ws } =
+    resolveStackWorkspaces(denWorkspace);
+  const edge = readEdgeConfig();
+  // Repo manifests come from that den workspace's checkouts.
+  const stacks = readStacks(undefined, {
+    workspace: getWorkspaceByName(fkWs) ? fkWs : undefined,
+  });
+  return { edge, stacks, workspace: ws };
+}
+
+/** Each stack's name, project, routes and (optionally) container health. */
+export function stackStatuses(
+  ctx: StackContext,
+  opts: { health?: boolean; healthOf?: typeof stackHealth } = {},
+): StackStatus[] {
+  const healthOf = opts.healthOf ?? stackHealth;
+  return Object.values(ctx.stacks).map((s) => {
+    const status: StackStatus = {
+      name: s.name,
+      repo: s.repo,
+      dir: s.dir ?? null,
+      project: projectName(s.name, ctx.workspace),
+      routes: Object.entries(s.routes).map(([route, target]) => ({
+        name: route,
+        url: routeUrl(`${route}.${s.name}`, ctx.edge),
+        target,
+      })),
+      uses: [...s.uses],
+    };
+    if (opts.health) {
+      try {
+        status.health = healthOf(ctx, s);
+      } catch (e) {
+        status.health = { ok: false, detail: (e as Error).message };
+      }
+    }
+    return status;
+  });
+}

package/src/shared/types/index.ts

@@ -164,6 +164,8 @@ export interface ValidationError {
   message: string;
   /** Optional remediation hint, e.g. "Did you mean X?" */
   suggestion?: string;
+  /** The manifest layer file the error is in, when validating by layer. */
+  file?: string;
 }
 
 export interface ValidationResult {
@@ -266,6 +268,27 @@ export interface ServiceManagementConfig {
   depends_on?: DependsOnEntry[];
   /** OWASP ZAP options: `openapi` per env turns on the API scan; `skip` leaves it out. */
   security?: { openapi?: Partial<Record<Environment, string>>; skip?: boolean };
+  /**
+   * Where the service runs, per env (R13): `local` (on this machine) or
+   * `remote` (deployed elsewhere; Den never starts, stops, scans or execs
+   * it). Unset envs fall back to the defaults in manifest/placement.ts.
+   */
+  runs?: Partial<Record<Environment, ServiceRunsValue>>;
+  /** Where a remote service runs: the env, an account label, a URL to probe. */
+  target?: ServiceTargetConfig;
+}
+
+export type ServiceRunsValue = "local" | "remote";
+
+export interface ServiceTargetConfig {
+  /** One of the org's environments. */
+  env: string;
+  /** A label for where it is deployed (e.g. a cloud account). */
+  account?: string;
+  /** Probed for health when target.env declares no health check. */
+  url?: string;
+  /** Status codes that count as up when probing `url` (default any 2xx). */
+  expect?: number | number[];
 }
 
 export interface ServiceLink {

package/src/ui/cli/applications-command.ts

@@ -14,6 +14,31 @@ import type {
 } from "../../shared/applications.js";
 
 import { product } from "../../shared/product.js";
+import type {
+  Placement,
+  RollupPlacement,
+} from "../../shared/manifest/placement.js";
+
+/** An application's placement line: "⇄ hybrid: <summary>", "☁ remote", or "". */
+export function describeAppPlacement(a: {
+  placement: RollupPlacement;
+  summary: string;
+}): string {
+  if (a.placement === "hybrid") return `⇄ hybrid: ${a.summary}`;
+  if (a.placement === "remote") return "☁ remote";
+  return "";
+}
+
+/** A repo's suffix over its services: "☁ remote (dev)", "⇄ hybrid", or "". */
+export function describeRepoPlacement(services: Placement[]): string {
+  const runs = new Set(services.map((s) => s.runs).filter((r) => r !== "none"));
+  if (runs.size > 1) return "⇄ hybrid";
+  if (!runs.has("remote")) return "";
+  const envs = [
+    ...new Set(services.flatMap((s) => (s.target ? [s.target.env] : []))),
+  ].sort();
+  return `☁ remote (${envs.join(", ")})`;
+}
 /** "feature-items (module) → ships in core-api" */
 export function describeContributor(c: ApplicationContributor): string {
   return `${c.repo} (${c.kind}) → ${c.contributesTo.length ? `ships in ${c.contributesTo.join(", ")}` : "no consumer known"}`;
@@ -92,15 +117,22 @@ export function cmdApps(args: string[]): void {
     const owner = a.owner ? chalk.gray(`  · ${a.owner}`) : "";
     const kind =
       a.source === "repo" ? chalk.gray("  (repo is the application)") : "";
-    console.log(`    ${chalk.bold.cyan(a.name)}${title}${owner}${kind}`);
+    const placed = describeAppPlacement(a);
+    console.log(
+      `    ${chalk.bold.cyan(a.name)}${title}${owner}${kind}${placed ? chalk.cyan(`  ${placed}`) : ""}`,
+    );
     if (a.description) console.log(chalk.gray(`      ${a.description}`));
     const width = Math.max(0, ...a.repos.map((r) => r.length));
     for (const repo of a.repos) {
       const subs = a.services[repo]
         .map((addr) => (addr.includes("/") ? addr.split("/")[1] : addr))
         .filter((s) => s !== repo);
+      const where = describeRepoPlacement(
+        a.services[repo].flatMap((addr) => a.placements[addr] ?? []),
+      );
+      const suffix = where ? chalk.cyan(`  ${where}`) : "";
       console.log(
-        `      ${subs.length ? `${repo.padEnd(width)}${chalk.gray(`  ${subs.join(", ")}`)}` : repo}`,
+        `      ${subs.length ? `${repo.padEnd(width)}${chalk.gray(`  ${subs.join(", ")}`)}` : repo}${suffix}`,
       );
     }
     for (const c of a.contributors)

package/src/ui/cli/edge-command.ts

@@ -4,20 +4,18 @@
  * This org's HTTPS edge: own CA + cert, routes at `<name>.<edge.domain>`.
  */
 import chalk from "chalk";
-import * as fs from "fs";
-import * as path from "path";
 import { readBrand } from "../../shared/brand.js";
 import { readEdgeConfig } from "../../shared/edge/config.js";
 import { edgeDomains, edgeNames, routeUrl } from "../../shared/edge/render.js";
 import {
   caDir,
   caTrusted,
-  containerState,
   edgeDown,
   edgeUp,
   trustCa,
   untrustCa,
 } from "../../shared/edge/runtime.js";
+import { edgeStatus } from "../../shared/edge/status.js";
 
 export async function cmdEdge(args: string[]): Promise<void> {
   const sub = args[0] ?? "status";
@@ -60,27 +58,19 @@ export async function cmdEdge(args: string[]): Promise<void> {
       process.exitCode = untrustCa(cfg);
       return;
     case "routes":
-      for (const [name, url] of Object.entries(cfg.routes))
-        console.log(`${routeUrl(name, cfg).padEnd(52)} → ${url}`);
+      for (const r of edgeStatus(cfg).routes)
+        console.log(`${r.url.padEnd(52)} → ${r.upstream}`);
       return;
     case "status": {
-      console.log(chalk.bold(`${readBrand().name} edge — ${cfg.org}`));
-      console.log(
-        `  container  ${n.container}: ${containerState(n.container)}`,
-      );
+      const st = edgeStatus(cfg);
+      console.log(chalk.bold(`${readBrand().name} edge — ${st.org}`));
+      console.log(`  container  ${st.container}: ${st.state}`);
       console.log(`  ports      ${published}`);
+      console.log(`  domains    ${st.domains.join(", ")} (+ every subdomain)`);
       console.log(
-        `  domains    ${edgeDomains(cfg).join(", ")} (+ every subdomain)`,
-      );
-      const trusted = caTrusted(cfg);
-      console.log(
-        `  CA         ${caDir(cfg)} — ${trusted === null ? "unknown" : trusted ? "trusted" : "NOT trusted"}`,
+        `  CA         ${caDir(cfg)} — ${st.caTrusted === null ? "unknown" : st.caTrusted ? "trusted" : "NOT trusted"}`,
       );
-      const stamp = path.join(cfg.stateDir, "certs", "names.txt");
-      if (fs.existsSync(stamp))
-        console.log(
-          `  cert       ${fs.readFileSync(stamp, "utf-8").split("\n").join(", ")}`,
-        );
+      if (st.certIssued) console.log(`  cert       ${st.certNames.join(", ")}`);
       return;
     }
     default:

package/src/ui/cli/graph-command.ts

@@ -23,6 +23,10 @@ import {
 } from "../../shared/environment-manager/workspaces.js";
 import { readCatalog } from "../../shared/environment-manager/catalog.js";
 import { readManifest } from "../../shared/manifest/read-manifest.js";
+import {
+  repoPlacement,
+  type RollupPlacement,
+} from "../../shared/manifest/placement.js";
 import type { AliasResolver } from "../../shared/environment-manager/derivation/alias.js";
 import { loadAliasResolver } from "../../shared/environment-manager/derivation/load-alias.js";
 import {
@@ -170,6 +174,8 @@ export function renderText(
     annotations?: Map<string, string>;
     /** Node for the repo the command was run from — marked with a leading `*`. */
     currentRepo?: string;
+    /** repo → placement (R13): remote and hybrid nodes are marked. */
+    placements?: Map<string, NodePlacement>;
   } = {},
 ): string {
   const showEvidence = opts.showEvidence ?? true;
@@ -197,7 +203,10 @@ export function renderText(
     // green — both bold so they stand out from the plain-white edge bullets.
     const isOff = !!ann && ann.includes("auto-start off");
     const paint = isOff ? chalk.yellow : chalk.greenBright;
-    const styledAnn = ann ? "  " + paint(ann) : "";
+    const placed = placementMark(opts.placements?.get(node));
+    const styledAnn =
+      (placed ? "  " + chalk.cyan(placed) : "") +
+      (ann ? "  " + paint(ann) : "");
     // The repo the command was run from gets a leading `▸`; others a 2-space
     // gutter so node names stay aligned. A single-width glyph (not an emoji,
     // which is double-width + terminal-dependent) keeps the column stable.
@@ -229,9 +238,45 @@ export function renderText(
   return lines.join("\n");
 }
 
-export function renderDot(graph: DerivedGraph): string {
+/** A repo's placement on the graph: local, remote (with envs), or hybrid. */
+export interface NodePlacement {
+  placement: RollupPlacement;
+  envs: string[];
+}
+
+/** "☁ remote (dev)", "⇄ hybrid", or "" for a local (or runtime-less) node. */
+export function placementMark(p: NodePlacement | undefined): string {
+  if (!p) return "";
+  if (p.placement === "remote") return `☁ remote (${p.envs.join(", ")})`;
+  if (p.placement === "hybrid") return "⇄ hybrid";
+  return "";
+}
+
+/** Each node's placement from its manifest, viewed locally. */
+export function nodePlacements(nodes: string[]): Map<string, NodePlacement> {
+  const ctx = buildContext();
+  const out = new Map<string, NodePlacement>();
+  for (const node of nodes) {
+    const src = repoSource(node, ctx);
+    if (!src?.exists) continue;
+    out.set(node, repoPlacement(readManifest(src.path), "local"));
+  }
+  return out;
+}
+
+export function renderDot(
+  graph: DerivedGraph,
+  placements?: Map<string, NodePlacement>,
+): string {
   const lines = [`digraph ${product().cli} {`, "  rankdir=LR;"];
-  for (const node of graph.nodes) lines.push(`  "${node}";`);
+  for (const node of graph.nodes) {
+    const p = placements?.get(node);
+    lines.push(
+      p?.placement === "remote"
+        ? `  "${node}" [style=dashed, label="${node} ☁ ${p.envs.join(", ")}"];`
+        : `  "${node}";`,
+    );
+  }
   for (const e of graph.edges) {
     const style = e.kind === "event" ? "dashed" : "solid";
     const color = e.blocking === "hard" ? "red" : "black";
@@ -442,7 +487,7 @@ export async function cmdGraph(args: string[]): Promise<void> {
     return;
   }
   if (flags.format === "dot") {
-    console.log(renderDot(filtered));
+    console.log(renderDot(filtered, nodePlacements(filtered.nodes)));
     return;
   }
 
@@ -458,6 +503,7 @@ export async function cmdGraph(args: string[]): Promise<void> {
     renderText(filtered, {
       annotations: bootAnnotations(graph.nodes),
       currentRepo,
+      placements: nodePlacements(graph.nodes),
     }),
   );
   console.log("\n" + renderTargetWarnings(graph.nodes));