@monster-orange/den 0.2.1 → 0.2.3

package/src/ui/cli/stack-command.ts

@@ -8,15 +8,20 @@
 import chalk from "chalk";
 import { routeUrl } from "../../shared/edge/render.js";
 import { edgeUp } from "../../shared/edge/runtime.js";
+import { getSecretsProvider } from "../../shared/secrets/index.js";
+import type { SecretsProvider } from "../../shared/secrets/types.js";
 import { projectName, startOrder } from "../../shared/stacks/render.js";
 import {
+  resolveStackSecretEnv,
   stackDown,
   stackHealth,
   stackLogs,
   stackPs,
+  stackRestartService,
   stackUp,
 } from "../../shared/stacks/runtime.js";
 import { loadStackContext, stackStatuses } from "../../shared/stacks/status.js";
+import type { StackConfig } from "../../shared/stacks/types.js";
 
 function serviceFlag(args: string[]): { service?: string; rest: string[] } {
   const rest: string[] = [];
@@ -28,6 +33,29 @@ function serviceFlag(args: string[]): { service?: string; rest: string[] } {
   return { service, rest };
 }
 
+/**
+ * Every named stack's `secret_env`, resolved before anything starts or
+ * stops: one missing key fails the whole command with nothing changed.
+ * The provider is only asked when some stack declares secret_env.
+ */
+export async function resolveStacksSecretEnv(
+  targets: StackConfig[],
+  provider: () => SecretsProvider = getSecretsProvider,
+): Promise<Map<string, Record<string, string>>> {
+  const out = new Map<string, Record<string, string>>();
+  const needing = targets.filter((s) => Object.keys(s.secretEnv ?? {}).length);
+  if (!needing.length) return out;
+  const p = provider();
+  const failures: string[] = [];
+  for (const s of needing) {
+    const r = await resolveStackSecretEnv(s, p);
+    if (r.ok) out.set(s.name, r.env);
+    else failures.push(r.message);
+  }
+  if (failures.length) throw new Error(failures.join("\n"));
+  return out;
+}
+
 export async function cmdStack(argv: string[]): Promise<void> {
   const { service, rest } = serviceFlag(argv);
   const [sub = "ls", ...args] = rest;
@@ -61,23 +89,46 @@ export async function cmdStack(argv: string[]): Promise<void> {
       return;
     case "up": {
       // Re-render the edge so its cert covers every stack, then start the stacks.
+      const order = startOrder(pick(), stacks);
+      const secrets = await resolveStacksSecretEnv(order.map((n) => stacks[n]));
       await edgeUp(edge);
-      for (const n of startOrder(pick(), stacks)) {
+      for (const n of order) {
         console.log(chalk.cyan(`\n▶ ${n} (${projectName(n, ctx.workspace)})`));
-        stackUp(ctx, stacks[n], { build: args.includes("--build") });
+        stackUp(ctx, stacks[n], {
+          build: args.includes("--build"),
+          secretEnv: secrets.get(n),
+        });
         for (const route of Object.keys(stacks[n].routes))
           console.log(chalk.green(`  ✓ ${routeUrl(`${route}.${n}`, edge)}`));
       }
       return;
     }
-    case "restart":
+    case "restart": {
+      // Resolved before the down: a missing secret leaves the stack running.
+      const secrets = await resolveStacksSecretEnv(
+        pick().map((n) => stacks[n]),
+      );
+      if (service) {
+        // One compose service, in place: no edge re-render, no recreate.
+        for (const n of pick()) {
+          console.log(chalk.cyan(`↻ ${n} ${service}`));
+          stackRestartService(ctx, stacks[n], service, {
+            secretEnv: secrets.get(n),
+          });
+        }
+        return;
+      }
       await edgeUp(edge);
       for (const n of pick()) {
         console.log(chalk.cyan(`↻ ${n}`));
         stackDown(ctx, stacks[n]);
-        stackUp(ctx, stacks[n], { build: args.includes("--build") });
+        stackUp(ctx, stacks[n], {
+          build: args.includes("--build"),
+          secretEnv: secrets.get(n),
+        });
       }
       return;
+    }
     case "health": {
       let ok = true;
       for (const n of pick()) {

package/src/ui/mcp/connect.ts

@@ -107,10 +107,12 @@ export const MCP_CLIENTS: readonly McpClient[] = [
               "claude",
               "mcp",
               "add",
+              // The name first: claude's -e takes several values, so a name
+              // after the env pairs is read as one more pair.
+              s.name,
               "--scope",
               "user",
               ...envFlags("-e", s.env),
-              s.name,
               "--",
               s.command,
               ...s.args,

package/src/ui/mcp/server.ts

@@ -115,15 +115,78 @@ function parsePort(argv: string[]): number | undefined {
 export const MCP_USAGE = (cli: string): string =>
   [
     `Usage: ${cli} mcp [--port <web port>]`,
+    `       ${cli} mcp --list`,
+    `       ${cli} mcp --call <tool> ['<json args>']`,
     "",
     `An MCP server over stdio for agents, a client of the running web server`,
     `(\`${cli} web up\`; default port: config web.port). Read tools always;`,
     "actions only as named in the org config's mcp.actions. See docs/distributions.md.",
     "",
+    "--list prints the tool names; --call runs one tool through the same guards,",
+    "prints its text result and exits 1 if the tool reports an error.",
+    "",
     `Register it with your agents: ${cli} mcp clients, then ${cli} mcp connect <client> (or --all).`,
   ].join("\n");
 
-/** Run `<cli> mcp` until stdin closes. */
+/** A one-shot invocation: `--list`, or `--call <tool> [json]`. */
+export type OneShot =
+  | { kind: "list" }
+  | { kind: "call"; tool: string; args: Record<string, unknown> };
+
+/** The one-shot `argv` asks for, or null for the stdio server. */
+export function parseOneShot(argv: string[]): OneShot | null {
+  const i = argv.indexOf("--call");
+  if (i !== -1) {
+    const tool = argv[i + 1];
+    if (!tool || tool.startsWith("-"))
+      throw new Error("--call needs a tool name: --call <tool> ['<json>']");
+    const raw = argv[i + 2];
+    if (raw === undefined || raw.startsWith("--"))
+      return { kind: "call", tool, args: {} };
+    let args: unknown;
+    try {
+      args = JSON.parse(raw);
+    } catch (e) {
+      throw new Error(
+        `--call ${tool}: arguments are not JSON (${(e as Error).message})`,
+      );
+    }
+    if (args === null || typeof args !== "object" || Array.isArray(args))
+      throw new Error(`--call ${tool}: arguments must be a JSON object`);
+    return { kind: "call", tool, args: args as Record<string, unknown> };
+  }
+  return argv.includes("--list") ? { kind: "list" } : null;
+}
+
+export interface OneShotOptions {
+  cfg: ResolvedMcpConfig;
+  cli: string;
+  api: DenApi;
+  out?: (text: string) => void;
+  err?: (text: string) => void;
+}
+
+/**
+ * Run a one-shot through the tool layer the stdio server uses (callTool:
+ * mcp.actions, every guard, redaction). Returns the exit code.
+ */
+export async function runOneShot(
+  shot: OneShot,
+  opts: OneShotOptions,
+): Promise<number> {
+  const out = opts.out ?? ((t: string) => process.stdout.write(t));
+  if (shot.kind === "list") {
+    const names = toolsFor(opts.cfg).map((t) => t.name);
+    out(names.length ? `${names.join("\n")}\n` : "");
+    return 0;
+  }
+  const ctx: ToolContext = { api: opts.api, cfg: opts.cfg, cli: opts.cli };
+  const r = await callTool(shot.tool, shot.args, ctx);
+  out(r.text.endsWith("\n") ? r.text : `${r.text}\n`);
+  return r.isError ? 1 : 0;
+}
+
+/** Run `<cli> mcp` until stdin closes (or one `--call` / `--list`). */
 export async function runMcp(argv: string[]): Promise<void> {
   const cli = product().cli;
   if (argv.includes("-h") || argv.includes("--help")) {
@@ -140,6 +203,24 @@ export async function runMcp(argv: string[]): Promise<void> {
   }
   const cfg = readMcpConfig();
   const baseUrl = `http://localhost:${port}`;
+  const shot = parseOneShot(argv);
+  if (shot) {
+    // Recorded like any MCP action: actor agent, this process, one session.
+    const session = randomUUID();
+    const api = createDenApi({
+      baseUrl,
+      cli,
+      headers: () =>
+        agentAuditHeaders({
+          client: `${cli} mcp --call`,
+          clientVersion: engineVersion() ?? "unknown",
+          mcpPid: process.pid,
+          session,
+        }),
+    });
+    process.exitCode = await runOneShot(shot, { cfg, cli, api });
+    return;
+  }
   const server = createDenMcpServer({ cfg, baseUrl, cli });
   await server.connect(new StdioServerTransport());
   process.stderr.write(

package/src/ui/server/index.ts

@@ -68,6 +68,7 @@ import {
 } from "../../shared/environment-manager/health.js";
 import {
   runServiceCommand,
+  prepareServiceSecretEnv,
   resolveService,
   listDaemons,
   unregisterDaemon,
@@ -1477,6 +1478,8 @@ async function handleRequest(
           {
             run: runServiceCommand,
             health: (r) => checkServiceHealth(r, "local"),
+            secretEnv: (address, cmd, workspace) =>
+              prepareServiceSecretEnv(address, cmd, workspace),
           },
         );
         return;

package/src/ui/server/lifecycle-exec.ts

@@ -21,6 +21,7 @@ import type { ResolvedService } from "../../shared/types/index.js";
 import type {
   RunCommandOptions,
   RunCommandResult,
+  ServiceSecretEnvResult,
 } from "../../shared/environment-manager/service-runner.js";
 import type { ServiceHealthResult } from "../../shared/environment-manager/health.js";
 
@@ -34,6 +35,16 @@ export function isLifecycleExecCmd(c: string): c is LifecycleExecCmd {
 export interface LifecycleExecDeps {
   run: (o: RunCommandOptions) => RunCommandResult;
   health: (r: ResolvedService) => Promise<ServiceHealthResult>;
+  /**
+   * R16: resolve the service's secret_env (prepareServiceSecretEnv). Unset,
+   * nothing is resolved, and the runner refuses to start a service that
+   * declares secret_env.
+   */
+  secretEnv?: (
+    address: string,
+    cmd: LifecycleExecCmd,
+    workspace?: string,
+  ) => Promise<ServiceSecretEnvResult>;
   /** Health poll interval after a detached start (default 1s). */
   pollMs?: number;
   /** Stop polling after this long (default 120s). */
@@ -106,12 +117,24 @@ export async function streamLifecycleExec(
     }
   }
 
+  // R16: all of the service's secret_env, or nothing starts. The message
+  // names keys, refs and the provider, never a value.
+  const secrets = deps.secretEnv
+    ? await deps.secretEnv(resolved.address, cmd, o.workspace)
+    : { ok: true as const, secretEnv: undefined };
+  if (!secrets.ok) {
+    if (!clientGone) emit({ type: "error", text: secrets.message });
+    finish(1, true);
+    return;
+  }
+
   const result = deps.run({
     address: resolved.address,
     command: cmd,
     workspace: o.workspace,
     runtime: "daemon",
     env: o.env,
+    secretEnv: secrets.secretEnv,
     onLine: (text) => {
       if (!clientGone) emit({ type: "line", text });
     },

package/src/ui/server/workspace-routes.ts

@@ -44,6 +44,7 @@ import {
   checkServiceHealth,
   claimHealthyService,
   runServiceCommand,
+  prepareServiceSecretEnv,
   resolveService,
   hasRunningOpctlContainers,
   releaseWorkspaceDaemons,
@@ -1411,6 +1412,10 @@ export async function handleWorkspaceRoutes(
     const startTime = Date.now();
     let overallExit = 0;
     let ranCount = 0;
+    // R16: each started service's resolved secret_env, by position in
+    // `ordered`. Resolved before a restart's down, so a missing key leaves
+    // the service running; the values only go into the runner's spawn env.
+    const preparedSecrets = new Map<number, Record<string, string>>();
 
     // Run services sequentially in dependency order
     const runNext = (i: number): void => {
@@ -1508,6 +1513,32 @@ export async function handleWorkspaceRoutes(
         }
       }
 
+      if ((cmd === "up" || cmd === "restart") && !preparedSecrets.has(i)) {
+        void (async () => {
+          // Phase 2 of a restart is a true `up`, so resolve for that.
+          const r = await prepareServiceSecretEnv(address, "up", ws.name);
+          if (cancelled) return;
+          if (!r.ok) {
+            ranCount++;
+            overallExit = 1;
+            emit({ type: "label", text: address });
+            emit({ type: "error", text: r.message });
+            emit({
+              type: "svc-done",
+              address,
+              exitCode: 1,
+              repoName: svcRepoName,
+              subsystem: svcSubsystem,
+            });
+            runNext(i + 1);
+            return;
+          }
+          preparedSecrets.set(i, r.secretEnv);
+          runNext(i);
+        })();
+        return;
+      }
+
       ranCount++;
 
       emit({ type: "label", text: address });
@@ -1540,6 +1571,7 @@ export async function handleWorkspaceRoutes(
           // the UI just hides the command they came here to watch.
           runtime: "daemon",
           env: getSudoEnv(),
+          secretEnv: preparedSecrets.get(i),
           onLine: (line) => emit({ type: "line", text: line }),
           onClose: (exitCode) => {
             // Release outer-scope refs so the disconnect handler no longer