@monster-orange/den 0.2.0 → 0.2.2

package/src/ui/server/index.ts

@@ -135,6 +135,7 @@ import {
   actorFromHeaders,
   actorSuffix,
   recordAction,
+  recordAgentRefusal,
   setAuditSink,
 } from "./audit.js";
 import { handleReadonlyRoutes } from "./readonly-routes.js";
@@ -409,6 +410,7 @@ import { parseChangelog } from "./changelog-parser.js";
 import { GitHubService } from "./github-service.js";
 import { EditorManager, SUPPORTED_LANGUAGES } from "./editor-manager.js";
 import { handleWorkspaceRoutes } from "./workspace-routes.js";
+import { isLifecycleExecCmd, streamLifecycleExec } from "./lifecycle-exec.js";
 import { readEdgeConfig, readWebPort } from "../../shared/edge/config.js";
 import {
   linksFor,
@@ -730,6 +732,25 @@ async function handleRequest(
     }
   }
 
+  // ── API: an agent's refused call (F2) ─────────────────────────────────────
+  // The MCP server's guards refuse some calls before they reach an action
+  // route; it reports them here so the activity trail shows failed attempts.
+  // Agents only (the audit header), and the entry is all it can write.
+  if (pathname === "/api/activity" && req.method === "POST") {
+    const actor = actorFromHeaders(req.headers);
+    if (!actor) return sendJson(res, { error: "agents only" }, 403);
+    const raw = await readBody(req).catch(() => "");
+    if (raw.length > 4096) return send400(res, "report too large");
+    let report: Record<string, unknown> = {};
+    try {
+      report = JSON.parse(raw || "{}") as Record<string, unknown>;
+    } catch {
+      return send400(res, "invalid JSON");
+    }
+    const entry = recordAgentRefusal(actor, report);
+    return sendJson(res, { recorded: true, ts: entry.ts });
+  }
+
   // ── API: stacks, edge, security plan (read-only; see readonly-routes.ts) ──
   if (await handleReadonlyRoutes(req, res, pathname, url)) return;
 
@@ -1361,7 +1382,15 @@ async function handleRequest(
     const emit = (obj: unknown): void => {
       res.write(`data: ${JSON.stringify(obj)}\n\n`);
     };
+    // Every fail here is before anything ran: a refusal or a lookup miss.
+    // Recorded, so failed attempts show in the activity trail (F2).
     const fail = (msg: string): void => {
+      recordAction(actorFromHeaders(req.headers), {
+        verb: "exec",
+        detail: `${repoName}/${svcName} ${cmdName} (${env})`,
+        outcome: "refused",
+        reason: msg,
+      });
       emit({ type: "error", text: msg });
       emit({ type: "done", exitCode: 1, duration: 0 });
       res.end();
@@ -1393,13 +1422,65 @@ async function handleRequest(
         `${repoName}/${svcName}`,
         servicePlacement(manifest, resolved.subsystem, env),
         (e) => isProductionEnv(e),
-        cmdName === "down" ? "stop" : "start",
+        cmdName,
       );
       if (refusal) return fail(refusal);
       if (manifest) {
         cmdDef =
           manifest.services?.[resolved.subsystem]?.commands?.[env]?.[cmdName];
       }
+      // Lifecycle commands run through the service runner, as the CLI's do:
+      // restart without a declared restart is down + up, up on a healthy
+      // service starts nothing, down honours workspace ownership.
+      if (env === "local" && isLifecycleExecCmd(cmdName)) {
+        if (cmdDef && isInteractiveServiceCommand(cmdDef))
+          return fail(
+            `"${cmdName}" requires an interactive terminal (HITL).\n` +
+              `Run in your terminal:\n  ${product().cli} ${cmdName} ${resolved.address}`,
+          );
+        const execId = shortRunId();
+        const execDesc = `${repoName}/${svcName} ${cmdName} (${env})`;
+        const execActor = actorFromHeaders(req.headers);
+        recordAction(execActor, {
+          verb: "exec",
+          detail: `${execDesc} [${execId}]`,
+        });
+        prewarmSudo();
+        void streamLifecycleExec(
+          {
+            resolved,
+            cmd: cmdName,
+            workspace: wsParam ?? undefined,
+            env: { E2E_ENVIRONMENT: env, ...getSudoEnv() },
+            emit: (e) => {
+              if (e.type === "line" && typeof e.text === "string")
+                mirrorLine(execId, e.text);
+              emit(e);
+            },
+            end: () => res.end(),
+            onClientClose: (fn) => res.on("close", fn),
+            onExit: (exitCode, duration) => {
+              serverLog(
+                `■ exec ${execDesc} · exit=${exitCode} · ${formatDuration(duration)} [${execId}]${actorSuffix(execActor)}`,
+                "lifecycle",
+                execActor ? actorLabel(execActor) : undefined,
+              );
+              recordInvocation({
+                command: "service.exec",
+                surface: "ux",
+                durationMs: duration,
+                exit: exitCode,
+                extra: { action: cmdName, env },
+              });
+            },
+          },
+          {
+            run: runServiceCommand,
+            health: (r) => checkServiceHealth(r, "local"),
+          },
+        );
+        return;
+      }
     }
 
     if (!cmdDef) {
@@ -1412,7 +1493,7 @@ async function handleRequest(
             `${repoName}/${svcName}`,
             servicePlacement(repo.manifest, svcName, env),
             (e) => isProductionEnv(e),
-            cmdName === "down" ? "stop" : "start",
+            cmdName,
           )
         : null;
       if (refusal) return fail(refusal);

package/src/ui/server/lifecycle-exec.ts

@@ -0,0 +1,188 @@
+/**
+ * `/api/service/exec` for the lifecycle commands (up, down, restart): run
+ * through the service runner, as the CLI does, instead of executing the
+ * manifest's command string directly. That gives the web UI and MCP the CLI's
+ * semantics:
+ *
+ *   - restart without a declared `restart` is down + up;
+ *   - up on a service that is already healthy starts nothing ("already up");
+ *   - up attaches to a running shared instance instead of starting a second;
+ *   - down honours workspace ownership (refcounted).
+ *
+ * Events are the route's existing SSE shapes: line, started, service-exited,
+ * error, done; plus `ready` once a detached start is up: its health check
+ * passes (`checked: true`), or, with no health check, its launcher is still
+ * running after a settle window (`checked: false`). A launcher that keeps
+ * running in the foreground (a dev server) never sends `service-exited`, so
+ * `ready` is how a caller knows the start worked.
+ */
+import type { ChildProcess } from "child_process";
+import type { ResolvedService } from "../../shared/types/index.js";
+import type {
+  RunCommandOptions,
+  RunCommandResult,
+} from "../../shared/environment-manager/service-runner.js";
+import type { ServiceHealthResult } from "../../shared/environment-manager/health.js";
+
+export const LIFECYCLE_EXEC_CMDS = ["up", "down", "restart"] as const;
+export type LifecycleExecCmd = (typeof LIFECYCLE_EXEC_CMDS)[number];
+
+export function isLifecycleExecCmd(c: string): c is LifecycleExecCmd {
+  return (LIFECYCLE_EXEC_CMDS as readonly string[]).includes(c);
+}
+
+export interface LifecycleExecDeps {
+  run: (o: RunCommandOptions) => RunCommandResult;
+  health: (r: ResolvedService) => Promise<ServiceHealthResult>;
+  /** Health poll interval after a detached start (default 1s). */
+  pollMs?: number;
+  /** Stop polling after this long (default 120s). */
+  readyTimeoutMs?: number;
+  /** With no health check: ready after this long still running (default 5s). */
+  settleMs?: number;
+  /**
+   * Restart: a green check counts only after the check went red (the old
+   * instance stopped) or this long has passed (default 5s).
+   */
+  restartMinMs?: number;
+}
+
+export interface LifecycleExecOptions {
+  resolved: ResolvedService;
+  cmd: LifecycleExecCmd;
+  workspace?: string;
+  env: NodeJS.ProcessEnv;
+  emit: (e: Record<string, unknown>) => void;
+  /** Called once, after the final `done` event. */
+  end: () => void;
+  /** Registers a callback for the client going away. */
+  onClientClose: (fn: () => void) => void;
+  /** Called with the exit code when the command completes. */
+  onExit?: (exitCode: number, durationMs: number) => void;
+}
+
+export async function streamLifecycleExec(
+  o: LifecycleExecOptions,
+  deps: LifecycleExecDeps,
+): Promise<void> {
+  const { resolved, cmd, emit } = o;
+  const start = Date.now();
+  let finished = false;
+  let clientGone = false;
+  const finish = (exitCode: number, explained = false): void => {
+    if (finished) return;
+    finished = true;
+    const duration = Date.now() - start;
+    o.onExit?.(exitCode, duration);
+    if (clientGone) return;
+    if (exitCode !== 0 && !explained)
+      emit({ type: "error", text: `Command failed (exit ${exitCode})` });
+    emit({ type: "done", exitCode, duration });
+    o.end();
+  };
+
+  let proc: ChildProcess | null = null;
+  let onServiceExitHook: (() => void) | undefined;
+  o.onClientClose(() => {
+    clientGone = true;
+    try {
+      proc?.kill();
+    } catch {
+      /* already exited */
+    }
+  });
+
+  // Up on a healthy service is a no-op: starting a second copy only fails on
+  // its port (and an agent waits out the detach window to learn that).
+  if (cmd === "up") {
+    const h = await deps.health(resolved).catch(() => null);
+    if (h?.health === "ok") {
+      emit({
+        type: "line",
+        text: `${resolved.address} is already up (healthy) — nothing to start`,
+      });
+      finish(0);
+      return;
+    }
+  }
+
+  const result = deps.run({
+    address: resolved.address,
+    command: cmd,
+    workspace: o.workspace,
+    runtime: "daemon",
+    env: o.env,
+    onLine: (text) => {
+      if (!clientGone) emit({ type: "line", text });
+    },
+    onClose: finish,
+    onServiceExit: (exitCode) => {
+      onServiceExitHook?.();
+      if (clientGone) return;
+      emit({
+        type: "service-exited",
+        exitCode,
+        repoName: resolved.repoName,
+        subsystem: resolved.subsystem,
+      });
+    },
+  });
+  proc = result.proc;
+
+  // Backstop: the route refuses an interactive command before calling this,
+  // so the runner should never hand back a TTY-bound process here.
+  if (result.interactive) {
+    try {
+      proc.kill();
+    } catch {
+      /* already exited */
+    }
+    emit({
+      type: "error",
+      text: `"${cmd}" requires an interactive terminal (HITL). Run it from your terminal.`,
+    });
+    finish(1, true);
+    return;
+  }
+  if (result.detachable) {
+    // The runner has already said where the log is.
+    emit({ type: "started", detached: true });
+    watchReady();
+  }
+
+  function watchReady(): void {
+    const pollMs = deps.pollMs ?? 1000;
+    const timeoutMs = deps.readyTimeoutMs ?? 120_000;
+    const settleMs = deps.settleMs ?? 5000;
+    const restartMinMs = deps.restartMinMs ?? 5000;
+    const t0 = Date.now();
+    let exited = false;
+    let sawDown = false;
+    const prevExit = onServiceExitHook;
+    onServiceExitHook = () => {
+      exited = true;
+      prevExit?.();
+    };
+    const tick = async (): Promise<void> => {
+      if (finished || clientGone || exited) return;
+      const elapsed = Date.now() - t0;
+      if (elapsed > timeoutMs) return;
+      const h = await deps.health(resolved).catch(() => null);
+      if (finished || clientGone || exited) return;
+      if (h?.health === "ok") {
+        if (cmd !== "restart" || sawDown || elapsed >= restartMinMs) {
+          emit({ type: "ready", checked: true });
+          return;
+        }
+      } else if (h?.health === "error") {
+        sawDown = true;
+      } else if (elapsed >= settleMs) {
+        // No health check to wait for: still running after the settle window.
+        emit({ type: "ready", checked: false });
+        return;
+      }
+      setTimeout(() => void tick(), pollMs);
+    };
+    setTimeout(() => void tick(), pollMs);
+  }
+}

package/src/ui/server/public/graph.css

@@ -906,6 +906,10 @@ path.dg-e.dim {
 .dg ol.act span:last-child {
   overflow-wrap: anywhere;
 }
+.dg ol.act .refused {
+  color: var(--red);
+  font-style: normal;
+}
 .dg-who {
   font-size: 11.5px;
   padding: 0 7px;

package/src/ui/server/public/panel.js

@@ -54,6 +54,9 @@ const repoEntry = (r) => entryOf(C.model(), r.repo);
 const anyHere = (r) => r.services.some(runsHere);
 const LIFECYCLE = ["up", "down", "restart"];
 
+/** Restart is the declared command, or down + up when both exist (as the CLI). */
+const canRestart = (s) => has(s, "restart") || (has(s, "up") && has(s, "down"));
+
 export const ACTIONS = [
   // ── service ──
   {
@@ -97,7 +100,7 @@ export const ACTIONS = [
     label: "Restart",
     for: ["service"],
     tier: "common",
-    when: (s) => runsHere(s) && has(s, "restart"),
+    when: (s) => runsHere(s) && canRestart(s),
     run: (s) => C.hooks.runCmd(s, "restart"),
   },
   {
@@ -133,7 +136,7 @@ export const ACTIONS = [
     label: "Restart",
     for: ["repo"],
     tier: "common",
-    when: (r) => runsHere(repoEntry(r)) && has(repoEntry(r), "restart"),
+    when: (r) => runsHere(repoEntry(r)) && canRestart(repoEntry(r)),
     run: (r) => C.hooks.runCmd(repoEntry(r), "restart"),
   },
   {
@@ -778,7 +781,7 @@ function activityList(x) {
     .then(({ entries = [] }) => {
       if (!live) return;
       el.innerHTML = entries.length
-        ? `<ol class="act">${entries.map((a) => `<li><time datetime="${esc(a.ts)}">${esc(hhmm(a.ts))}</time><span class="dg-who ${a.actor === "agent" ? "agent" : ""}">${esc(a.actor === "agent" ? "[agent]" + (a.client ? " " + a.client : "") : "you")}</span><span>${esc(a.verb)} ${esc(a.detail)}</span></li>`).join("")}</ol>`
+        ? `<ol class="act">${entries.map((a) => `<li><time datetime="${esc(a.ts)}">${esc(hhmm(a.ts))}</time><span class="dg-who ${a.actor === "agent" ? "agent" : ""}">${esc(a.actor === "agent" ? "[agent]" + (a.client ? " " + a.client : "") : "you")}</span><span>${esc(a.verb)} ${esc(a.detail)}${a.outcome === "refused" ? ` <em class="refused">refused: ${esc(a.reason || "")}</em>` : ""}</span></li>`).join("")}</ol>`
         : none(
             "No actions yet. Starts, restarts and syncs, yours and agents', show here.",
           );

package/src/ui/server/readonly-routes.ts

@@ -91,11 +91,20 @@ export function activityFor(
   entries: AuditEntry[],
   target: { address?: string; repo?: string },
 ): AuditEntry[] {
+  // A repo-level entry ("core down (local)") is an attempt on the repo
+  // without naming a service, as agents usually do: it shows for the repo
+  // and for each of its services.
+  const repoLevel = (e: AuditEntry, repo: string): boolean =>
+    e.verb === "exec" && e.detail.startsWith(repo + " ");
   const matches = (e: AuditEntry): boolean => {
     if (target.address)
-      return e.verb === "exec" && e.detail.startsWith(target.address + " ");
+      return (
+        (e.verb === "exec" && e.detail.startsWith(target.address + " ")) ||
+        repoLevel(e, target.address.split("/")[0])
+      );
     const repo = target.repo ?? "";
-    if (e.verb === "exec") return e.detail.startsWith(repo + "/");
+    if (e.verb === "exec")
+      return e.detail.startsWith(repo + "/") || repoLevel(e, repo);
     if (e.verb === "sync") return e.detail.split(" ").includes(`repo=${repo}`);
     return false;
   };

package/src/ui/server/workspace-routes.ts

@@ -1490,7 +1490,7 @@ export async function handleWorkspaceRoutes(
             "local",
           ),
           () => false,
-          cmd === "down" ? "stop" : "start",
+          cmd,
         );
         if (remote) {
           emit({ type: "line", text: `  ${remote}` });