@monster-orange/den 0.2.1 → 0.2.3

package/src/ui/cli/index.ts

@@ -96,7 +96,14 @@ import {
   getWaitDeps,
 } from "../../shared/environment-manager/dag.js";
 import { waitForReady } from "../../shared/environment-manager/readiness.js";
-import { resolveService } from "../../shared/environment-manager/service-runner.js";
+import {
+  canonicalServiceAddress,
+  previewServiceCommand,
+  previewServiceSecretEnv,
+  prepareServiceSecretEnv,
+  resolveService,
+  type ServiceCommandPreview,
+} from "../../shared/environment-manager/service-runner.js";
 import { getGitHubCoords } from "../../shared/smoke/git-remote.js";
 import {
   getReposRoot,
@@ -157,6 +164,7 @@ import {
 import { cleanupStaleTabs } from "../../shared/cli-tabs.js";
 import { cmdConfig } from "./config-command.js";
 import { cmdEdge } from "./edge-command.js";
+import { cmdService } from "./service-command.js";
 import { cmdStack } from "./stack-command.js";
 import { cmdWeb, displayWebHelp } from "./web-command.js";
 import { cmdGraph } from "./graph-command.js";
@@ -191,14 +199,15 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
   down: {
     usage: "down [repo] [flags]",
     lines: [
-      "Stop the cwd (or named) repo's derived dependency closure, in reverse order.",
+      "Stop the cwd (or named) repo; --with-deps also stops what it sits on (its",
+      "derived closure, in reverse order), naming anything else that uses it.",
       "-a/--all stops EVERY workspace system (reverse derived order, cwd-agnostic;",
       "every down script runs — no already-stopped skip).",
-      "Flags: -a/--all · -A/--app <app> · -n/--dry-run (print order, stop nothing) · --manifest (legacy depends_on)",
+      "Flags: -a/--all · -A/--app <app> · --with-deps · -n/--dry-run (print order, stop nothing) · --manifest (legacy depends_on)",
     ],
   },
   restart: {
-    usage: "restart [service...] [-A <app>]",
+    usage: "restart [service...] [-A <app>] [-n|--dry-run]",
     lines: [
       `Restart the given services, or every repo in an application (\`${product().cli} apps\`).`,
     ],
@@ -301,10 +310,18 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
     ],
   },
   mcp: {
-    usage: "mcp [--port <web port>]",
+    usage: "mcp [--port <web port>] [--list | --call <tool> ['<json args>']]",
     lines: [
       "An MCP server over stdio for agents: a client of the running web server",
       `(\`${product().cli} web up\`). Read tools always; actions only as named in mcp.actions.`,
+      "--list prints the tool names; --call runs one tool and prints its result.",
+    ],
+  },
+  service: {
+    usage: "service [install|status|print|uninstall]",
+    lines: [
+      "The web UI as a macOS launchd service, started at login. Label and logs:",
+      "config web.service { label, logs }.",
     ],
   },
   "local-dev": {
@@ -363,6 +380,7 @@ const TELEMETRY_COMMANDS = new Set<string>([
   "apps",
   "applications",
   "mcp",
+  "service",
 ]);
 
 /** Map a raw command token to a PII-safe, registered telemetry command name. */
@@ -380,6 +398,20 @@ function telemetryReason(error: unknown): string {
   return name && name !== "Object" ? name : "Error";
 }
 
+/**
+ * What was typed, with each service alias (a manifest service key or a
+ * compose stack name) mapped to its service's address, so the derived graph,
+ * ownership and the daemon registry all see one name. Flags pass through; an
+ * ambiguous alias throws, naming the candidates. `limit` maps only the first
+ * n positional args.
+ */
+function canonicalTargets(args: string[], limit = Infinity): string[] {
+  let seen = 0;
+  return args.map((a) =>
+    a.startsWith("-") || seen++ >= limit ? a : canonicalServiceAddress(a),
+  );
+}
+
 /** Print one manifest's validation: a status line, then each issue. */
 function printValidation(
   label: string,
@@ -685,6 +717,10 @@ class DenCLI {
           await cmdEdge(args.slice(1));
           break;
 
+        case "service":
+          process.exitCode = await cmdService(args.slice(1));
+          break;
+
         case "stack":
           await cmdStack(args.slice(1));
           break;
@@ -1318,6 +1354,11 @@ class DenCLI {
        * as part of a workspace or app run is said and skipped.
        */
       named?: readonly string[];
+      /**
+       * `-n`/`--dry-run` (and `--plan` on this path): print what would run,
+       * in order, and run nothing. Read-only on every path.
+       */
+      dryRun?: boolean;
     },
   ): Promise<void> {
     // How long to show startup output before handing control back to the menu
@@ -1328,6 +1369,22 @@ class DenCLI {
       getFocusedWorkspaceName() ??
       undefined;
     const force = opts?.force ?? false;
+    // R13: why a remote service is not run here, or null.
+    const remoteRefusal = (address: string): string | null => {
+      const placed = resolveService(address, workspace);
+      return placed
+        ? placementRefusal(
+            address,
+            servicePlacement(
+              readManifest(placed.repoPath),
+              placed.subsystem,
+              "local",
+            ),
+            (e) => isProductionEnv(e),
+            command,
+          )
+        : null;
+    };
 
     // Resolve dependency order. Derived mode supplies the order directly;
     // otherwise topo-sort manifest depends_on (`down` → reverse).
@@ -1341,8 +1398,17 @@ class DenCLI {
         const startupOrder = ws
           ? resolveStartupOrder(addresses, catalog, ws.config, ws.name)
           : addresses;
+        // Only up pulls in dependencies (a service needs them to start).
+        // Down and restart act on what was named: its dependencies may be
+        // serving other running services.
+        const namedOnly = (): string[] => {
+          const kept = startupOrder.filter((a) => addresses.includes(a));
+          return [...kept, ...addresses.filter((a) => !kept.includes(a))];
+        };
         if (command === "down") {
-          ordered = [...startupOrder].reverse();
+          ordered = namedOnly().reverse();
+        } else if (command !== "up") {
+          ordered = namedOnly();
         } else {
           ordered = startupOrder;
           if (ordered.length > addresses.length) {
@@ -1358,6 +1424,56 @@ class DenCLI {
       }
     }
 
+    if (opts?.dryRun) {
+      // The same lookup a real run makes, so the dry run says what it does.
+      const previews = ordered.map((a): ServiceCommandPreview => {
+        const remote = remoteRefusal(a);
+        if (!remote) return previewServiceCommand(a, command, workspace);
+        // As the loop below: a named remote target fails, any other is
+        // said and skipped.
+        return isNamedTarget(a, opts?.named ?? [])
+          ? { kind: "error", address: a, note: remote }
+          : {
+              kind: "nothing",
+              address: a,
+              note: `${a} (remote, skipped): ${remote}`,
+            };
+      });
+      const doing =
+        { up: "starting", down: "stopping", restart: "restarting" }[command] ??
+        `running "${command}" on`;
+      const runs = previews
+        .filter((p) => p.kind === "run" || p.kind === "via-repo")
+        .map((p) => p.address);
+      console.log(
+        chalk.cyan(
+          `\n  Would ${command}: ${[...new Set(runs)].join(" → ") || "(nothing)"}`,
+        ),
+      );
+      for (const p of previews) {
+        if (p.kind === "via-repo" || p.kind === "nothing")
+          console.log(chalk.gray(`  ${p.note}`));
+        if (p.kind === "error") console.log(chalk.red(`  ✗ ${p.note}`));
+      }
+      // R16: key names only. A dry run never asks the secrets provider.
+      for (const a of new Set(runs)) {
+        const sec = previewServiceSecretEnv(a, command, workspace);
+        if (!sec) continue;
+        const parts = [
+          ...(sec.service.length ? [sec.service.join(", ")] : []),
+          ...(sec.compose.length ? [`compose: ${sec.compose.join(", ")}`] : []),
+        ];
+        console.log(
+          chalk.gray(
+            `  ${sec.address}: would inject secret_env ${parts.join("; ")} (names only; not resolved in a dry run)`,
+          ),
+        );
+      }
+      if (previews.some((p) => p.kind === "error")) process.exitCode = 1;
+      console.log(chalk.gray(`  (--dry-run: not ${doing} anything)\n`));
+      return;
+    }
+
     // Build a catalog + workspace reference once per run for readiness lookups.
     const catalog = readCatalog();
     const ws = getActiveWorkspace();
@@ -1398,19 +1514,7 @@ class DenCLI {
       }
       // R13: a remote service is never started or stopped from here. Said,
       // not failed, so a workspace or app up/down carries on past it.
-      const placed = resolveService(address, workspace);
-      const remote = placed
-        ? placementRefusal(
-            address,
-            servicePlacement(
-              readManifest(placed.repoPath),
-              placed.subsystem,
-              "local",
-            ),
-            (e) => isProductionEnv(e),
-            command,
-          )
-        : null;
+      const remote = remoteRefusal(address);
       if (remote) {
         if (isNamedTarget(address, opts?.named ?? [])) {
           console.log(chalk.red(`  ✗ ${remote}`));
@@ -1502,7 +1606,22 @@ class DenCLI {
         }
       }
 
+      // R16: resolve the service's secret_env before anything spawns. A
+      // missing key fails this target; nothing starts with a partial set.
+      const secrets = await prepareServiceSecretEnv(
+        address,
+        command,
+        workspace,
+      );
+
       const started = await new Promise<boolean>((resolve) => {
+        if (!secrets.ok) {
+          console.log(chalk.red(`  ✗ ${command} ${chalk.bold(address)}`));
+          for (const l of secrets.message.split("\n"))
+            console.log(chalk.gray(`      ${l}`));
+          resolve(false);
+          return;
+        }
         const spinner = ora(`${command} ${chalk.bold(address)}...`).start();
         let detachTimer: ReturnType<typeof setTimeout> | null = null;
         let settled = false;
@@ -1584,6 +1703,7 @@ class DenCLI {
           runtime,
           workspace,
           force: command === "down" ? force : false,
+          secretEnv: secrets.secretEnv,
           onLine: (line) => {
             spinner.text = `${command} ${chalk.bold(address)}: ${chalk.gray(line.slice(0, 80))}`;
             const trimmed = line.trim();
@@ -1629,6 +1749,9 @@ class DenCLI {
         }
       });
 
+      // Any target that failed makes the whole command fail (scripts and
+      // agents read the exit code).
+      if (!started) process.exitCode = 1;
       if (plan?.failFast && !started) {
         console.log(
           chalk.red(
@@ -1817,7 +1940,12 @@ class DenCLI {
       return;
     }
     if (dryRun) {
-      console.log(chalk.gray("  (--dry-run: not starting anything)\n"));
+      await this.runServicesCommand(
+        order,
+        "up",
+        { order },
+        { named, dryRun: true },
+      );
       return;
     }
     // Check the secrets backend first so any first-clone `make setup` (and the up
@@ -1862,10 +1990,13 @@ class DenCLI {
     seed: string,
     dryRun: boolean,
     force = false,
+    withDeps = false,
   ): Promise<void> {
     const full = deriveGraph({ scope: "all" });
+    // Only the named repo, unless --with-deps: what it sits on may be
+    // serving other running systems (the same rule as a named service).
     const upOrder = this.runtimeOnly(
-      deriveStartTargets(full, seed).order,
+      withDeps ? deriveStartTargets(full, seed).order : [seed],
       "stopped",
     );
     if (upOrder.length === 0) return;
@@ -1876,6 +2007,9 @@ class DenCLI {
     // still running on them. Name them rather than letting them fall over
     // silently.
     const inClosure = new Set(order);
+    // Only what really stops here puts dependents at risk: a remote service
+    // is refused (R13), so it stops nothing.
+    const stopsHere = new Set(order.filter((a) => !this.isRemote(a, "down")));
     const atRisk = [
       ...new Set(
         full.edges
@@ -1883,14 +2017,16 @@ class DenCLI {
             (e) =>
               e.kind !== "jwks" &&
               e.ordering !== false &&
-              inClosure.has(e.to) &&
+              stopsHere.has(e.to) &&
               !inClosure.has(e.from),
           )
           .map((e) => e.from),
       ),
     ].sort();
     console.log(
-      chalk.cyan(`\n  Derived down for ${chalk.bold(seed)} (+ dependencies)`),
+      chalk.cyan(
+        `\n  Derived down for ${chalk.bold(seed)}${withDeps ? " (+ dependencies)" : ""}`,
+      ),
     );
     console.log(chalk.gray(`  Order: ${order.join(" → ")}\n`));
     if (atRisk.length > 0) {
@@ -1902,7 +2038,12 @@ class DenCLI {
       );
     }
     if (dryRun) {
-      console.log(chalk.gray("  (--dry-run: not stopping anything)\n"));
+      await this.runServicesCommand(
+        order,
+        "down",
+        { order },
+        { force, named: [seed], dryRun: true },
+      );
       return;
     }
     await this.runServicesCommand(
@@ -1913,6 +2054,24 @@ class DenCLI {
     );
   }
 
+  /** Whether `address` runs remotely, so `command` is refused here (R13). */
+  private isRemote(address: string, command: string): boolean {
+    const placed = resolveService(address);
+    return (
+      !!placed &&
+      placementRefusal(
+        address,
+        servicePlacement(
+          readManifest(placed.repoPath),
+          placed.subsystem,
+          "local",
+        ),
+        (e) => isProductionEnv(e),
+        command,
+      ) !== null
+    );
+  }
+
   /** Workspace repos with no runtime (modules, libraries) → their kind. */
   private noRuntimeRepos(): Map<string, RepoKind> {
     const out = new Map<string, RepoKind>();
@@ -2337,9 +2496,10 @@ class DenCLI {
     // Tokens after a `--` terminator belong to a child command — they must
     // never be read as up's own flags (`den up -- -a` is NOT `up -a`).
     const terminator = args.indexOf("--");
-    const { app, rest: ownArgs } = takeAppFlag(
+    const { app, rest } = takeAppFlag(
       terminator === -1 ? args : args.slice(0, terminator),
     );
+    const ownArgs = canonicalTargets(rest);
     const dryRun = ownArgs.includes("--dry-run") || ownArgs.includes("-n");
     const plan = ownArgs.includes("--plan");
     const pull = ownArgs.includes("--pull");
@@ -2396,11 +2556,17 @@ class DenCLI {
       await this.runDerivedUp(seed, include, dryRun, plan, pull);
       return;
     }
-    await this.cmdServiceUpManifest(ownArgs.filter((a) => !a.startsWith("-")));
+    await this.cmdServiceUpManifest(
+      ownArgs.filter((a) => !a.startsWith("-")),
+      dryRun || plan,
+    );
   }
 
   /** Legacy: start the given services via manifest depends_on. */
-  private async cmdServiceUpManifest(addresses: string[]): Promise<void> {
+  private async cmdServiceUpManifest(
+    addresses: string[],
+    dryRun = false,
+  ): Promise<void> {
     // Resolve targets BEFORE the secrets preflight — otherwise running
     // `den up` from a non-service dir (e.g. the den repo root) triggers
     // an interactive sign-in just to print "nothing to do".
@@ -2427,9 +2593,10 @@ class DenCLI {
       }
       return;
     }
-    preflightSecrets();
+    if (!dryRun) preflightSecrets();
     await this.runServicesCommand(targets, "up", undefined, {
       named: addresses,
+      dryRun,
     });
   }
 
@@ -2438,9 +2605,10 @@ class DenCLI {
     // never be read as down's own flags (`den down -- -a` must NOT tear
     // down the whole workspace).
     const terminator = args.indexOf("--");
-    const { app, rest: ownArgs } = takeAppFlag(
+    const { app, rest } = takeAppFlag(
       terminator === -1 ? args : args.slice(0, terminator),
     );
+    const ownArgs = canonicalTargets(rest);
     const dryRun = ownArgs.includes("--dry-run") || ownArgs.includes("-n");
     const force = ownArgs.includes("--force") || ownArgs.includes("-f");
     if (app) {
@@ -2482,7 +2650,12 @@ class DenCLI {
     const seed = forceManifest ? undefined : this.derivedSeed(seedArg);
 
     if (seed) {
-      await this.runDerivedDown(seed, dryRun, force);
+      await this.runDerivedDown(
+        seed,
+        dryRun,
+        force,
+        ownArgs.includes("--with-deps"),
+      );
       return;
     }
     const addresses = ownArgs.filter((a) => !a.startsWith("-"));
@@ -2493,27 +2666,30 @@ class DenCLI {
     await this.runServicesCommand(targets, "down", undefined, {
       force,
       named: addresses,
+      dryRun,
     });
   }
 
   private async cmdServiceRestart(argv: string[]): Promise<void> {
     const { app, rest: args } = takeAppFlag(argv);
-    preflightSecrets();
+    const dryRun = args.includes("--dry-run") || args.includes("-n");
+    if (!dryRun) preflightSecrets();
     if (app) {
       const order =
         this.allWorkspaceOrder(focusedAppRepos(app))?.rawOrder ?? [];
-      await this.runServicesCommand(order, "restart");
+      await this.runServicesCommand(order, "restart", undefined, { dryRun });
       return;
     }
     // Drop flag tokens so a bare `den restart --foo` doesn't treat the flag
     // as a service address (matches cmdServiceUp/cmdServiceDown).
-    const filtered = args.filter((a) => !a.startsWith("-"));
+    const filtered = canonicalTargets(args.filter((a) => !a.startsWith("-")));
     const addresses =
       filtered.length > 0
         ? filtered
         : this.resolveNoArgServiceTargets("restart");
     await this.runServicesCommand(addresses, "restart", undefined, {
       named: filtered,
+      dryRun,
     });
   }
 
@@ -2622,7 +2798,7 @@ class DenCLI {
   private async cmdLogs(args: string[]): Promise<void> {
     await this.ensureWorkspaceSeeded();
     const alias = loadAliasResolver();
-    const target = resolveLogsTarget(args, alias);
+    const target = resolveLogsTarget(canonicalTargets(args, 1), alias);
     if (target.kind === "unknown-repo") {
       console.log(chalk.red(`\n  Unknown repo: ${target.arg}\n`));
       process.exit(1);
@@ -3688,6 +3864,12 @@ class DenCLI {
     console.log(
       "  mcp [--port <n>]     MCP server (stdio) for agents, over the running web server",
     );
+    console.log(
+      "  mcp --call <tool>    Call one MCP tool and print its result (--list: tool names)",
+    );
+    console.log(
+      "  service install      Run the web UI as a launchd service (status, print, uninstall)",
+    );
     console.log();
     console.log("  workspace list       List workspaces");
     console.log(

package/src/ui/cli/service-command.ts

@@ -0,0 +1,131 @@
+/**
+ * `service install | status | print | uninstall`
+ *
+ * The web UI as a macOS launchd service, over Den's service/install.sh. The
+ * label and log directory come from the org config's `web.service`
+ * (readWebServiceConfig), with the script's own defaults, so a distribution
+ * no longer wraps the script in its Makefile.
+ *
+ * `install` (which also restarts a running service) says the service is
+ * running only once the web server answers /api/server-info with JSON: a
+ * fresh server takes a few seconds to start, and answers empty until then.
+ */
+import { spawnSync } from "child_process";
+import * as os from "os";
+import * as path from "path";
+import {
+  readDenConfig,
+  readWebServiceConfig,
+  type DenConfig,
+} from "../../shared/den-config.js";
+import { readWebPort } from "../../shared/edge/config.js";
+import { getDistRoot, getEngineRoot } from "../../shared/paths.js";
+
+/** Runs a command with extra env vars; returns its exit code. */
+export type ServiceRunner = (
+  cmd: string,
+  args: string[],
+  env: Record<string, string>,
+) => number;
+
+const SUBCOMMANDS = ["install", "status", "print", "uninstall"] as const;
+
+const defaultRunner: ServiceRunner = (cmd, args, env) =>
+  spawnSync(cmd, args, { stdio: "inherit", env: { ...process.env, ...env } })
+    .status ?? 1;
+
+/** How long `install` waits for the web server to answer. */
+export const READY_TIMEOUT_MS = 30_000;
+
+/**
+ * Poll `url` until it answers 2xx with a JSON object, or `timeoutMs` passes.
+ * Each attempt is bounded too, so a hung connection cannot outlast it.
+ */
+export async function waitForServerInfo(
+  url: string,
+  timeoutMs: number = READY_TIMEOUT_MS,
+  intervalMs = 500,
+): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const left = deadline - Date.now();
+    if (left <= 0) return false;
+    try {
+      const res = await fetch(url, {
+        signal: AbortSignal.timeout(Math.min(2_000, left)),
+      });
+      if (res.ok) {
+        const body: unknown = JSON.parse(await res.text());
+        if (body !== null && typeof body === "object") return true;
+      }
+    } catch {
+      /* not up yet: refused, empty or partial body */
+    }
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+}
+
+export interface ServiceDeps {
+  run?: ServiceRunner;
+  config?: DenConfig;
+  distRoot?: string;
+  engineRoot?: string;
+  home?: string;
+  platform?: NodeJS.Platform;
+  /** The web UI port (default: config web.port). */
+  webPort?: number;
+  /** Readiness poller (default: waitForServerInfo). */
+  waitReady?: (url: string, timeoutMs: number) => Promise<boolean>;
+  log?: (line: string) => void;
+}
+
+/** Run `service <sub>`; returns the exit code. */
+export async function cmdService(
+  args: string[],
+  deps: ServiceDeps = {},
+): Promise<number> {
+  const sub = args[0];
+  if (!(SUBCOMMANDS as readonly string[]).includes(sub ?? ""))
+    throw new Error(
+      `${sub ? `Unknown service command "${sub}". ` : ""}Use: ${SUBCOMMANDS.join(" | ")}`,
+    );
+  // print only writes the plist; the rest talk to launchd.
+  if (sub !== "print" && (deps.platform ?? process.platform) !== "darwin")
+    throw new Error(
+      "the web UI service is a launchd LaunchAgent: macOS only (print works anywhere)",
+    );
+  const distRoot = deps.distRoot ?? getDistRoot();
+  const { label, logs } = readWebServiceConfig(
+    deps.config ?? readDenConfig(),
+    distRoot,
+    deps.home ?? os.homedir(),
+  );
+  const script = path.join(
+    deps.engineRoot ?? getEngineRoot(),
+    "service",
+    "install.sh",
+  );
+  const code = (deps.run ?? defaultRunner)("bash", [script, sub!], {
+    DEN_ROOT: distRoot,
+    DEN_SERVICE_LABEL: label,
+    DEN_SERVICE_LOGS: logs,
+    // The script then leaves saying "running" to us (after the poll below).
+    ...(sub === "install" ? { DEN_SERVICE_READY_CHECK: "external" } : {}),
+  });
+  if (sub !== "install" || code !== 0) return code;
+
+  const log = deps.log ?? ((l: string) => console.log(l));
+  const port = deps.webPort ?? readWebPort(distRoot);
+  const url = `http://localhost:${port}/api/server-info`;
+  if (await (deps.waitReady ?? waitForServerInfo)(url, READY_TIMEOUT_MS)) {
+    log(
+      `✓ ${label} running at http://localhost:${port} (logs: ${path.join(logs, "web.log")})`,
+    );
+    return 0;
+  }
+  log(
+    `✗ ${label} installed but not answering yet: check ${logs} ` +
+      `(${url} gave no JSON within ${READY_TIMEOUT_MS / 1000}s)`,
+  );
+  return 1;
+}