@monster-orange/den 0.1.0 → 0.2.1

package/src/ui/cli/mcp-connect.ts

@@ -0,0 +1,350 @@
+/**
+ * `<cli> mcp connect | disconnect | clients | config`: register this
+ * distribution's MCP server with a developer's agents. Planning lives in
+ * ../mcp/connect.ts; this file does the I/O.
+ */
+import { spawnSync } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import chalk from "chalk";
+import {
+  MCP_CLIENTS,
+  findClient,
+  genericSnippet,
+  jsonHasEntry,
+  mergeJsonConfig,
+  serverSpec,
+  type ConnectAction,
+  type ConnectEnv,
+  type McpClient,
+  type Scope,
+  type ServerSpec,
+} from "../mcp/connect.js";
+import { product } from "../../shared/product.js";
+import { getDistRoot } from "../../shared/paths.js";
+import { readWebPort } from "../../shared/edge/config.js";
+import { DEFAULT_PORT } from "../../shared/constants.js";
+import { readMcpConfig } from "../../shared/den-config.js";
+
+export const MCP_CONNECT_SUBCOMMANDS = [
+  "connect",
+  "disconnect",
+  "clients",
+  "config",
+] as const;
+
+function onPath(bin: string): boolean {
+  const exts =
+    process.platform === "win32"
+      ? (process.env.PATHEXT ?? ".EXE;.CMD").split(";")
+      : [""];
+  for (const dir of (process.env.PATH ?? "").split(path.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      try {
+        fs.accessSync(path.join(dir, bin + ext), fs.constants.X_OK);
+        return true;
+      } catch {
+        /* next */
+      }
+    }
+  }
+  return false;
+}
+
+function connectEnv(projectDir: string): ConnectEnv {
+  return {
+    home: os.homedir(),
+    platform: process.platform,
+    appData: process.env.APPDATA,
+    projectDir,
+    which: onPath,
+    exists: (p) => fs.existsSync(p),
+  };
+}
+
+interface Flags {
+  clients: string[];
+  all: boolean;
+  project: string | null;
+  port?: number;
+  dryRun: boolean;
+}
+
+function parseFlags(argv: string[]): Flags {
+  const f: Flags = { clients: [], all: false, project: null, dryRun: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--all" || a === "-a") f.all = true;
+    else if (a === "--dry-run" || a === "-n") f.dryRun = true;
+    else if (a === "--project" || a === "-p") {
+      const next = argv[i + 1];
+      if (next && !next.startsWith("-") && !findClient(next)) {
+        f.project = path.resolve(next);
+        i++;
+      } else f.project = process.env.DEN_INVOKE_CWD ?? process.cwd();
+    } else if (a === "--port") {
+      const n = Number(argv[++i]);
+      if (!Number.isInteger(n) || n < 1 || n > 65535)
+        throw new Error(`--port must be a port number`);
+      f.port = n;
+    } else if (a.startsWith("-")) throw new Error(`unknown flag ${a}`);
+    else f.clients.push(a);
+  }
+  return f;
+}
+
+function spec(port?: number): ServerSpec {
+  const cli = product().cli;
+  const s = serverSpec({
+    cli,
+    distRoot: getDistRoot(),
+    nodeBinDir: path.dirname(process.execPath),
+    platform: process.platform,
+    port,
+  });
+  if (!fs.existsSync(s.command))
+    throw new Error(
+      `${s.command} does not exist: run this from a distribution with a bin/${cli} shim`,
+    );
+  return s;
+}
+
+const show = (argv: string[]): string =>
+  argv.map((a) => (/^[\w./:=@-]+$/.test(a) ? a : `'${a}'`)).join(" ");
+
+function run(argv: string[]): { code: number; out: string } {
+  const r = spawnSync(argv[0], argv.slice(1), { encoding: "utf-8" });
+  return {
+    code: r.status ?? 1,
+    out: `${r.stdout ?? ""}${r.stderr ?? ""}`.trim(),
+  };
+}
+
+function readText(file: string): string | null {
+  try {
+    return fs.readFileSync(file, "utf-8");
+  } catch {
+    return null;
+  }
+}
+
+/** Write `text` to `file` atomically, keeping the previous copy as .bak. */
+function writeConfig(file: string, text: string): void {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  if (fs.existsSync(file)) fs.copyFileSync(file, `${file}.bak`);
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, text);
+  fs.renameSync(tmp, file);
+}
+
+function apply(
+  a: ConnectAction,
+  remove: boolean,
+  dryRun: boolean,
+): { ok: boolean; said: string } {
+  if (a.kind === "json") {
+    const before = readText(a.file);
+    const after = mergeJsonConfig(
+      before,
+      a.key,
+      a.name,
+      remove ? null : a.entry,
+    );
+    if (!dryRun) writeConfig(a.file, after);
+    return {
+      ok: true,
+      said: `${dryRun ? "would write" : remove ? "removed from" : "wrote"} ${a.file}`,
+    };
+  }
+  if (remove) {
+    if (!a.remove)
+      return {
+        ok: false,
+        said: "remove it from the client's own MCP settings",
+      };
+    if (dryRun) return { ok: true, said: `would run ${show(a.remove)}` };
+    const r = run(a.remove);
+    return { ok: r.code === 0, said: r.out || show(a.remove) };
+  }
+  if (dryRun) return { ok: true, said: `would run ${show(a.add)}` };
+  if (a.remove) run(a.remove);
+  const r = run(a.add);
+  return {
+    ok: r.code === 0,
+    said:
+      r.code === 0 ? `ran ${a.add[0]} ${a.add.slice(1, 3).join(" ")}` : r.out,
+  };
+}
+
+function status(
+  c: McpClient,
+  s: ServerSpec,
+  scope: Scope,
+  env: ConnectEnv,
+): string {
+  const a = c.plan(s, scope, env);
+  if (a.kind === "json") {
+    const st = jsonHasEntry(readText(a.file), a.key, a.name, a.entry);
+    return st === "connected"
+      ? chalk.green("connected")
+      : st === "different"
+        ? chalk.yellow("connected (different command: reconnect)")
+        : chalk.gray("not connected");
+  }
+  if (!a.check) return chalk.gray("unknown (check the client's MCP list)");
+  return run(a.check).code === 0
+    ? chalk.green("connected")
+    : chalk.gray("not connected");
+}
+
+async function webServerLine(port?: number): Promise<string> {
+  let p = port;
+  if (p === undefined) {
+    try {
+      p = readWebPort();
+    } catch {
+      p = DEFAULT_PORT;
+    }
+  }
+  const url = `http://localhost:${p}`;
+  try {
+    const r = await fetch(`${url}/api/server-info`, {
+      signal: AbortSignal.timeout(1500),
+    });
+    const info = (await r.json()) as { version?: string };
+    return (
+      chalk.green(`web server up at ${url}`) +
+      (info.version ? chalk.gray(` (Den ${info.version})`) : "")
+    );
+  } catch {
+    return chalk.yellow(
+      `web server not running at ${url}: agents get read errors until \`${product().cli} web up\``,
+    );
+  }
+}
+
+function usage(): string {
+  const cli = product().cli;
+  return [
+    `Usage:`,
+    `  ${cli} mcp clients                       which agents are installed and connected`,
+    `  ${cli} mcp connect [<client>...|--all]   register ${cli}'s MCP server (user scope)`,
+    `        [--project [dir]]                  in a project's config instead (default: here)`,
+    `        [--port <n>] [--dry-run]`,
+    `  ${cli} mcp disconnect <client>... [--project [dir]]`,
+    `  ${cli} mcp config [--port <n>]           JSON for any other MCP client`,
+    ``,
+    `Clients: ${MCP_CLIENTS.map((c) => c.id).join(", ")}`,
+  ].join("\n");
+}
+
+export async function runMcpConnect(argv: string[]): Promise<number> {
+  const [sub, ...rest] = argv;
+  if (rest.includes("-h") || rest.includes("--help")) {
+    console.log(usage());
+    return 0;
+  }
+  let flags: Flags;
+  try {
+    flags = parseFlags(rest);
+  } catch (e) {
+    console.error(chalk.red(`${(e as Error).message}\n`) + usage());
+    return 1;
+  }
+  const s = spec(flags.port);
+  const scope: Scope = flags.project ? "project" : "user";
+  const env = connectEnv(
+    flags.project ?? process.env.DEN_INVOKE_CWD ?? process.cwd(),
+  );
+
+  if (sub === "config") {
+    console.log(genericSnippet(s));
+    return 0;
+  }
+
+  if (sub === "clients") {
+    console.log(
+      chalk.bold(
+        `\n  ${product().title} MCP server: ${s.command} ${s.args.join(" ")}`,
+      ),
+    );
+    console.log(`  ${await webServerLine(flags.port)}`);
+    const actions = readMcpConfig().actions;
+    console.log(
+      chalk.gray(
+        `  tools: read${actions.length ? ` + actions ${actions.join(", ")}` : " only (mcp.actions is empty)"}\n`,
+      ),
+    );
+    for (const c of MCP_CLIENTS) {
+      const here = c.detect(env);
+      const st =
+        here && c.scopes.includes(scope)
+          ? status(c, s, scope, env)
+          : chalk.gray(here ? `no ${scope} scope` : "not installed");
+      console.log(
+        `  ${here ? "●" : "○"} ${c.id.padEnd(15)} ${c.title.padEnd(24)} ${st}`,
+      );
+    }
+    console.log(
+      chalk.gray(
+        `\n  Connect: ${product().cli} mcp connect <client>   (or --all for every installed one)\n`,
+      ),
+    );
+    return 0;
+  }
+
+  if (sub !== "connect" && sub !== "disconnect") {
+    console.log(usage());
+    return 1;
+  }
+  const remove = sub === "disconnect";
+  let targets: McpClient[];
+  if (flags.all)
+    targets = MCP_CLIENTS.filter(
+      (c) => c.detect(env) && c.scopes.includes(scope),
+    );
+  else {
+    const unknown = flags.clients.filter((id) => !findClient(id));
+    if (unknown.length) {
+      console.error(
+        chalk.red(`unknown client: ${unknown.join(", ")}\n`) + usage(),
+      );
+      return 1;
+    }
+    targets = flags.clients.map((id) => findClient(id)!);
+  }
+  if (targets.length === 0) {
+    console.log(usage());
+    return 1;
+  }
+
+  let failed = 0;
+  for (const c of targets) {
+    if (!c.scopes.includes(scope)) {
+      console.log(`  ${chalk.yellow("•")} ${c.title}: no ${scope} scope`);
+      failed++;
+      continue;
+    }
+    try {
+      const r = apply(c.plan(s, scope, env), remove, flags.dryRun);
+      console.log(
+        `  ${r.ok ? chalk.green("✓") : chalk.red("✗")} ${c.title}: ${r.said}`,
+      );
+      if (!r.ok) failed++;
+    } catch (e) {
+      console.log(`  ${chalk.red("✗")} ${c.title}: ${(e as Error).message}`);
+      failed++;
+    }
+  }
+  if (!remove && !flags.dryRun && failed < targets.length) {
+    console.log(
+      chalk.gray(
+        `\n  Restart the agent (or start a new session) to load "${s.name}".`,
+      ),
+    );
+    console.log(`  ${await webServerLine(flags.port)}\n`);
+  }
+  return failed ? 1 : 0;
+}

package/src/ui/cli/mcp-main.ts

@@ -0,0 +1,13 @@
+/**
+ * Entry point for `<cli> mcp` (bin/den routes `mcp` here). Kept apart from
+ * the main CLI so nothing but the MCP protocol is ever written to stdout.
+ */
+import "./mcp-stdout-guard.js";
+import { runMcp } from "../mcp/server.js";
+
+runMcp(process.argv.slice(2)).catch((error: unknown) => {
+  process.stderr.write(
+    `mcp: ${error instanceof Error ? error.message : String(error)}\n`,
+  );
+  process.exit(1);
+});

package/src/ui/cli/mcp-stdout-guard.ts

@@ -0,0 +1,10 @@
+/**
+ * Imported first by the `mcp` entry: stdout carries the MCP protocol only,
+ * so anything that logs through console goes to stderr instead.
+ */
+const toStderr = (...args: unknown[]): void => console.error(...args);
+console.log = toStderr;
+console.info = toStderr;
+console.debug = toStderr;
+
+export {};

package/src/ui/cli/named-target.ts

@@ -0,0 +1,11 @@
+/**
+ * Whether `address` ("repo" or "repo/service") is something the user named on
+ * the command line: the address itself, or the repo it belongs to.
+ */
+export function isNamedTarget(
+  address: string,
+  named: readonly string[],
+): boolean {
+  const repo = address.split("/")[0];
+  return named.some((n) => n === address || n === repo);
+}

package/src/ui/cli/stack-command.ts

@@ -6,15 +6,8 @@
  * https://<route>.<stack>.<edge.domain>.
  */
 import chalk from "chalk";
-import { readEdgeConfig } from "../../shared/edge/config.js";
 import { routeUrl } from "../../shared/edge/render.js";
 import { edgeUp } from "../../shared/edge/runtime.js";
-import { readStacks } from "../../shared/stacks/config.js";
-import {
-  getFocusedWorkspaceName,
-  getWorkspaceByName,
-} from "../../shared/environment-manager/workspaces.js";
-import { stackWorkspace } from "../../shared/stacks/render.js";
 import { projectName, startOrder } from "../../shared/stacks/render.js";
 import {
   stackDown,
@@ -22,44 +15,26 @@ import {
   stackLogs,
   stackPs,
   stackUp,
-  type StackContext,
 } from "../../shared/stacks/runtime.js";
+import { loadStackContext, stackStatuses } from "../../shared/stacks/status.js";
 
-function workspaceFlag(args: string[]): {
-  fkWs: string;
-  ws: string;
-  service?: string;
-  rest: string[];
-} {
+function serviceFlag(args: string[]): { service?: string; rest: string[] } {
   const rest: string[] = [];
-  // The global -w/--workspace is parsed (and checked) before we run and
-  // arrives as DEN_WORKSPACE_OVERRIDE.
-  const fkWs =
-    process.env.DEN_WORKSPACE_OVERRIDE ||
-    getFocusedWorkspaceName() ||
-    "default";
   let service: string | undefined;
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--service") service = args[++i];
     else rest.push(args[i]);
   }
-  const ws = process.env.DEN_STACK_WORKSPACE || stackWorkspace(fkWs);
-  if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(ws))
-    throw new Error(
-      `workspace "${ws}" must be lowercase letters, digits and dashes`,
-    );
-  return { fkWs, ws, service, rest };
+  return { service, rest };
 }
 
 export async function cmdStack(argv: string[]): Promise<void> {
-  const { fkWs, ws, service, rest } = workspaceFlag(argv);
+  const { service, rest } = serviceFlag(argv);
   const [sub = "ls", ...args] = rest;
-  const edge = readEdgeConfig();
-  // Repo manifests come from that den workspace's checkouts.
-  const stacks = readStacks(undefined, {
-    workspace: getWorkspaceByName(fkWs) ? fkWs : undefined,
-  });
-  const ctx: StackContext = { edge, stacks, workspace: ws };
+  // The global -w/--workspace is parsed (and checked) before we run and
+  // arrives as DEN_WORKSPACE_OVERRIDE; loadStackContext reads it.
+  const ctx = loadStackContext();
+  const { edge, stacks } = ctx;
   const names = args.filter((a) => !a.startsWith("-"));
   const pick = () => {
     if (!names.length)
@@ -71,17 +46,15 @@ export async function cmdStack(argv: string[]): Promise<void> {
 
   switch (sub) {
     case "ls":
-      for (const s of Object.values(stacks)) {
+      for (const s of stackStatuses(ctx)) {
         console.log(
           chalk.bold(`${s.name}`) +
             chalk.gray(
-              `  ${s.repo}${s.dir ? `/${s.dir}` : ""}  project ${projectName(s.name, ws)}`,
+              `  ${s.repo}${s.dir ? `/${s.dir}` : ""}  project ${s.project}`,
             ),
         );
-        for (const route of Object.keys(s.routes))
-          console.log(
-            `  ${routeUrl(`${route}.${s.name}`, edge)}  → ${s.routes[route]}`,
-          );
+        for (const route of s.routes)
+          console.log(`  ${route.url}  → ${route.target}`);
         if (s.uses.length)
           console.log(chalk.gray(`  uses ${s.uses.join(", ")}`));
       }
@@ -90,7 +63,7 @@ export async function cmdStack(argv: string[]): Promise<void> {
       // Re-render the edge so its cert covers every stack, then start the stacks.
       await edgeUp(edge);
       for (const n of startOrder(pick(), stacks)) {
-        console.log(chalk.cyan(`\n▶ ${n} (${projectName(n, ws)})`));
+        console.log(chalk.cyan(`\n▶ ${n} (${projectName(n, ctx.workspace)})`));
         stackUp(ctx, stacks[n], { build: args.includes("--build") });
         for (const route of Object.keys(stacks[n].routes))
           console.log(chalk.green(`  ✓ ${routeUrl(`${route}.${n}`, edge)}`));

package/src/ui/cli/test-runner.ts

@@ -447,10 +447,16 @@ export class TestRunner {
   ): CommandStep[] {
     const names = options.modules ?? [];
     const script = "src/pillars/security/run.ts";
+    // An explicitly chosen stronger mode is passed on; the entrypoint's
+    // per-env ceiling refuses it where it isn't allowed.
+    const mode =
+      options.securityMode && options.securityMode !== "baseline"
+        ? [`--mode=${options.securityMode}`]
+        : [];
     if (names.length === 0) {
       return [
         {
-          ...tsxCommand(script, `--env=${options.environment}`),
+          ...tsxCommand(script, `--env=${options.environment}`, ...mode),
           env: baseEnv,
           label: "Run all security scans",
         },
@@ -461,6 +467,7 @@ export class TestRunner {
         script,
         `--env=${options.environment}`,
         `--service=${name}`,
+        ...mode,
       ),
       env: baseEnv,
       label: `Run security scan ${name}`,