@monster-orange/den 0.2.2 → 0.2.4

package/src/ui/cli/index.ts

@@ -5,6 +5,11 @@
  * Main entry point for the interactive CLI
  */
 
+import { composeStacksNotice } from "./workspace-notes.js";
+import {
+  runningComposeProjects,
+  runningWorkspaceStacks,
+} from "../../shared/stacks/status.js";
 import { isNamedTarget } from "./named-target.js";
 import chalk from "chalk";
 import oraSpinner from "ora";
@@ -46,7 +51,9 @@ import {
   isWorkspaceActive,
   activateWorkspace,
   deactivateWorkspace,
+  getActiveWorkspaces,
   setActiveWorkspace,
+  setFocusedWorkspace,
   createWorkspace,
   deleteWorkspaceConfig,
   parseAddress,
@@ -99,6 +106,8 @@ import { waitForReady } from "../../shared/environment-manager/readiness.js";
 import {
   canonicalServiceAddress,
   previewServiceCommand,
+  previewServiceSecretEnv,
+  prepareServiceSecretEnv,
   resolveService,
   type ServiceCommandPreview,
 } from "../../shared/environment-manager/service-runner.js";
@@ -193,6 +202,58 @@ const DEN_HELP_DESCRIPTION = `  ${product().title} - local-first test, service,
  * Concise `<command> -h` help for commands without a dedicated help renderer.
  * Flag-heavy commands (up, graph, use-local, use-managed) have richer handlers.
  */
+/** `workspace` subcommands, for `workspace --help` and `workspace <sub> --help`. */
+const WORKSPACE_SUBCOMMANDS: {
+  name: string;
+  usage: string;
+  lines: string[];
+}[] = [
+  {
+    name: "list",
+    usage: "list",
+    lines: ["every workspace, the active set and the focus"],
+  },
+  {
+    name: "activate",
+    usage: "activate <n>",
+    lines: ["add a workspace to the active set"],
+  },
+  {
+    name: "deactivate",
+    usage: "deactivate <n>",
+    lines: [
+      "remove it from the active set and stop the services",
+      "only it owns. Only services {cli} tracks: compose",
+      "stacks keep running; stop them with `{cli} down <repo>`",
+    ],
+  },
+  {
+    name: "focus",
+    usage: "focus <n>",
+    lines: ["make an active workspace the default for commands"],
+  },
+  {
+    name: "use",
+    usage: "use <n>",
+    lines: ["activate and focus a workspace"],
+  },
+  {
+    name: "create",
+    usage: "create [n]",
+    lines: ["create an empty workspace"],
+  },
+  {
+    name: "delete",
+    usage: "delete <n>",
+    lines: ["delete a workspace (and its directory)"],
+  },
+  {
+    name: "code",
+    usage: "code [n]",
+    lines: ["open it in your editor (VS Code: a .code-workspace)"],
+  },
+];
+
 const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
   down: {
     usage: "down [repo] [flags]",
@@ -250,8 +311,16 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
     lines: ["Check managed repos for upstream updates and offer to pull."],
   },
   workspace: {
-    usage: "workspace <list|use|create|delete|code> [name]",
-    lines: ["Manage workspaces (named sets of services + their modes)."],
+    usage: `workspace <${WORKSPACE_SUBCOMMANDS.map((c) => c.name).join("|")}> [name]`,
+    lines: [
+      "Manage workspaces (named sets of services + their modes).",
+      "",
+      ...WORKSPACE_SUBCOMMANDS.flatMap((c) =>
+        c.lines.map(
+          (line, i) => `  ${(i === 0 ? c.usage : "").padEnd(16)}  ${line}`,
+        ),
+      ),
+    ],
   },
   run: {
     usage: "run [options]",
@@ -581,7 +650,7 @@ class DenCLI {
       !["-h", "--help", "-v", "--version"].includes(command) &&
       (ownArgs.includes("-h") || ownArgs.includes("--help"))
     ) {
-      this.printCommandHelp(command);
+      this.printCommandHelp(command, ownArgs[1]);
       return;
     }
 
@@ -1453,6 +1522,20 @@ class DenCLI {
           console.log(chalk.gray(`  ${p.note}`));
         if (p.kind === "error") console.log(chalk.red(`  ✗ ${p.note}`));
       }
+      // R16: key names only. A dry run never asks the secrets provider.
+      for (const a of new Set(runs)) {
+        const sec = previewServiceSecretEnv(a, command, workspace);
+        if (!sec) continue;
+        const parts = [
+          ...(sec.service.length ? [sec.service.join(", ")] : []),
+          ...(sec.compose.length ? [`compose: ${sec.compose.join(", ")}`] : []),
+        ];
+        console.log(
+          chalk.gray(
+            `  ${sec.address}: would inject secret_env ${parts.join("; ")} (names only; not resolved in a dry run)`,
+          ),
+        );
+      }
       if (previews.some((p) => p.kind === "error")) process.exitCode = 1;
       console.log(chalk.gray(`  (--dry-run: not ${doing} anything)\n`));
       return;
@@ -1590,7 +1673,22 @@ class DenCLI {
         }
       }
 
+      // R16: resolve the service's secret_env before anything spawns. A
+      // missing key fails this target; nothing starts with a partial set.
+      const secrets = await prepareServiceSecretEnv(
+        address,
+        command,
+        workspace,
+      );
+
       const started = await new Promise<boolean>((resolve) => {
+        if (!secrets.ok) {
+          console.log(chalk.red(`  ✗ ${command} ${chalk.bold(address)}`));
+          for (const l of secrets.message.split("\n"))
+            console.log(chalk.gray(`      ${l}`));
+          resolve(false);
+          return;
+        }
         const spinner = ora(`${command} ${chalk.bold(address)}...`).start();
         let detachTimer: ReturnType<typeof setTimeout> | null = null;
         let settled = false;
@@ -1672,6 +1770,7 @@ class DenCLI {
           runtime,
           workspace,
           force: command === "down" ? force : false,
+          secretEnv: secrets.secretEnv,
           onLine: (line) => {
             spinner.text = `${command} ${chalk.bold(address)}: ${chalk.gray(line.slice(0, 80))}`;
             const trimmed = line.trim();
@@ -2343,7 +2442,19 @@ class DenCLI {
   }
 
   /** Help for `<command> -h`: dedicated renderer for flag-heavy commands, else the table. */
-  private printCommandHelp(command: string): void {
+  private printCommandHelp(command: string, sub?: string): void {
+    // `workspace <sub> --help`: that subcommand only.
+    const wsSub =
+      command === "workspace"
+        ? WORKSPACE_SUBCOMMANDS.find((c) => c.name === sub)
+        : undefined;
+    if (wsSub) {
+      console.log(`\n  ${product().cli} workspace ${wsSub.usage}\n`);
+      for (const line of wsSub.lines)
+        console.log(`  ${line.replaceAll("{cli}", product().cli)}`);
+      console.log();
+      return;
+    }
     switch (command) {
       case "up":
         return this.printUpHelp();
@@ -2366,7 +2477,8 @@ class DenCLI {
       return;
     }
     console.log(`\n  ${product().cli} ${entry.usage}\n`);
-    for (const line of entry.lines) console.log(`  ${line}`);
+    for (const line of entry.lines)
+      console.log(`  ${line.replaceAll("{cli}", product().cli)}`.trimEnd());
     console.log();
   }
 
@@ -3469,9 +3581,36 @@ class DenCLI {
             }
           }
         }
+        // Deactivate releases tracked daemons only; say what it left up.
+        // One docker ps for this workspace and every other active one.
+        let up: ReturnType<typeof runningComposeProjects> | undefined;
+        const running = () =>
+          up === undefined ? (up = runningComposeProjects()) : up;
+        const stacks = runningWorkspaceStacks(name, running);
+        const heldBy = new Map<string, string[]>();
+        if (stacks?.length)
+          for (const other of getActiveWorkspaces())
+            for (const s of runningWorkspaceStacks(other, running) ?? [])
+              heldBy.set(s.project, [...(heldBy.get(s.project) ?? []), other]);
+        const stacksNote = composeStacksNotice(product().cli, stacks, heldBy);
+        if (stacksNote) console.log(chalk.yellow(`    ${stacksNote}`));
         console.log("");
         break;
       }
+      case "focus": {
+        const name = args[1];
+        if (!name) {
+          console.log(
+            chalk.red(`Usage: ${product().cli} workspace focus <name>`),
+          );
+          return;
+        }
+        setFocusedWorkspace(name);
+        console.log(
+          chalk.green(`\n  ✓ Focused workspace: ${chalk.bold(name)}\n`),
+        );
+        break;
+      }
       case "use": {
         const name = args[1];
         if (!name) {
@@ -3579,7 +3718,7 @@ class DenCLI {
       default:
         console.log(
           chalk.gray(
-            `Usage: ${product().cli} workspace <list|activate|deactivate|use|create|delete|code> [name]`,
+            `Usage: ${product().cli} workspace <list|activate|deactivate|focus|use|create|delete|code> [name]`,
           ),
         );
     }
@@ -3839,7 +3978,6 @@ class DenCLI {
       "  service install      Run the web UI as a launchd service (status, print, uninstall)",
     );
     console.log();
-    console.log("  workspace list       List workspaces");
     console.log(
       "  workspace list           List workspaces (active set + focus)",
     );
@@ -3847,11 +3985,14 @@ class DenCLI {
     console.log(
       "  workspace deactivate <n> Remove workspace from the active set",
     );
+    console.log(
+      "  workspace focus <n>      Focus an active workspace (the default)",
+    );
     console.log("  workspace use <n>        Activate and focus a workspace");
-    console.log("  workspace create [n] Create a new workspace");
-    console.log("  workspace delete <n> Delete a workspace");
+    console.log("  workspace create [n]     Create a new workspace");
+    console.log("  workspace delete <n>     Delete a workspace");
     console.log(
-      "  workspace code [n]   Open workspace in VS Code (generates .code-workspace)",
+      "  workspace code [n]       Open workspace in VS Code (generates .code-workspace)",
     );
     console.log("\nTest commands:");
     console.log(

package/src/ui/cli/mcp-connect.ts

@@ -25,7 +25,7 @@ import { product } from "../../shared/product.js";
 import { getDistRoot } from "../../shared/paths.js";
 import { readWebPort } from "../../shared/edge/config.js";
 import { DEFAULT_PORT } from "../../shared/constants.js";
-import { readMcpConfig } from "../../shared/den-config.js";
+import { readDenConfig, readMcpConfig } from "../../shared/den-config.js";
 
 export const MCP_CONNECT_SUBCOMMANDS = [
   "connect",
@@ -199,6 +199,78 @@ function status(
     : chalk.gray("not connected");
 }
 
+/** How long `mcp connect` waits for /api/server-info before giving up. */
+export const WEB_PROBE_TIMEOUT_MS = 1500;
+
+/** What a probe of the web server's /api/server-info found. */
+export type WebProbe =
+  | { kind: "up"; version?: string }
+  /** Something accepted the connection but sent no answer in time. */
+  | { kind: "timeout" }
+  /** Nothing answered: connection refused, or not the web server. */
+  | { kind: "down" };
+
+export async function probeWebServer(
+  url: string,
+  timeoutMs: number = WEB_PROBE_TIMEOUT_MS,
+  fetchImpl: typeof fetch = fetch,
+): Promise<WebProbe> {
+  try {
+    const r = await fetchImpl(`${url}/api/server-info`, {
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    const info = (await r.json()) as { version?: string };
+    return { kind: "up", version: info.version };
+  } catch (e) {
+    return (e as Error).name === "TimeoutError"
+      ? { kind: "timeout" }
+      : { kind: "down" };
+  }
+}
+
+/** Whether the org config runs the web UI as a service (`web.service`). */
+function webRunsAsService(): boolean {
+  try {
+    return readDenConfig().web?.service !== undefined;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The status line for a probe. A server that is up but slow is "not
+ * answering", never "not running"; and when the web UI runs as a service
+ * (`web.service`), the advice is the service's status, not `web up`.
+ */
+export function webServerMessage(
+  probe: WebProbe,
+  url: string,
+  opts: { cli: string; asService: boolean; timeoutMs?: number },
+): string {
+  if (probe.kind === "up")
+    return (
+      chalk.green(`web server up at ${url}`) +
+      (probe.version ? chalk.gray(` (Den ${probe.version})`) : "")
+    );
+  const svc = `\`${opts.cli} service status\``;
+  if (probe.kind === "timeout") {
+    const secs = (opts.timeoutMs ?? WEB_PROBE_TIMEOUT_MS) / 1000;
+    return chalk.yellow(
+      `web server at ${url} is not answering within ${secs}s (busy or stuck): ` +
+        `agents' reads wait on it too; if it stays slow, ` +
+        (opts.asService
+          ? `check ${svc}`
+          : `restart it with \`${opts.cli} web restart\``),
+    );
+  }
+  return chalk.yellow(
+    `web server not running at ${url}: agents get read errors until ` +
+      (opts.asService
+        ? `the service is up (check ${svc})`
+        : `\`${opts.cli} web up\``),
+  );
+}
+
 async function webServerLine(port?: number): Promise<string> {
   let p = port;
   if (p === undefined) {
@@ -209,20 +281,10 @@ async function webServerLine(port?: number): Promise<string> {
     }
   }
   const url = `http://localhost:${p}`;
-  try {
-    const r = await fetch(`${url}/api/server-info`, {
-      signal: AbortSignal.timeout(1500),
-    });
-    const info = (await r.json()) as { version?: string };
-    return (
-      chalk.green(`web server up at ${url}`) +
-      (info.version ? chalk.gray(` (Den ${info.version})`) : "")
-    );
-  } catch {
-    return chalk.yellow(
-      `web server not running at ${url}: agents get read errors until \`${product().cli} web up\``,
-    );
-  }
+  return webServerMessage(await probeWebServer(url), url, {
+    cli: product().cli,
+    asService: webRunsAsService(),
+  });
 }
 
 function usage(): string {

package/src/ui/cli/stack-command.ts

@@ -8,8 +8,11 @@
 import chalk from "chalk";
 import { routeUrl } from "../../shared/edge/render.js";
 import { edgeUp } from "../../shared/edge/runtime.js";
+import { getSecretsProvider } from "../../shared/secrets/index.js";
+import type { SecretsProvider } from "../../shared/secrets/types.js";
 import { projectName, startOrder } from "../../shared/stacks/render.js";
 import {
+  resolveStackSecretEnv,
   stackDown,
   stackHealth,
   stackLogs,
@@ -18,6 +21,7 @@ import {
   stackUp,
 } from "../../shared/stacks/runtime.js";
 import { loadStackContext, stackStatuses } from "../../shared/stacks/status.js";
+import type { StackConfig } from "../../shared/stacks/types.js";
 
 function serviceFlag(args: string[]): { service?: string; rest: string[] } {
   const rest: string[] = [];
@@ -29,6 +33,29 @@ function serviceFlag(args: string[]): { service?: string; rest: string[] } {
   return { service, rest };
 }
 
+/**
+ * Every named stack's `secret_env`, resolved before anything starts or
+ * stops: one missing key fails the whole command with nothing changed.
+ * The provider is only asked when some stack declares secret_env.
+ */
+export async function resolveStacksSecretEnv(
+  targets: StackConfig[],
+  provider: () => SecretsProvider = getSecretsProvider,
+): Promise<Map<string, Record<string, string>>> {
+  const out = new Map<string, Record<string, string>>();
+  const needing = targets.filter((s) => Object.keys(s.secretEnv ?? {}).length);
+  if (!needing.length) return out;
+  const p = provider();
+  const failures: string[] = [];
+  for (const s of needing) {
+    const r = await resolveStackSecretEnv(s, p);
+    if (r.ok) out.set(s.name, r.env);
+    else failures.push(r.message);
+  }
+  if (failures.length) throw new Error(failures.join("\n"));
+  return out;
+}
+
 export async function cmdStack(argv: string[]): Promise<void> {
   const { service, rest } = serviceFlag(argv);
   const [sub = "ls", ...args] = rest;
@@ -62,21 +89,32 @@ export async function cmdStack(argv: string[]): Promise<void> {
       return;
     case "up": {
       // Re-render the edge so its cert covers every stack, then start the stacks.
+      const order = startOrder(pick(), stacks);
+      const secrets = await resolveStacksSecretEnv(order.map((n) => stacks[n]));
       await edgeUp(edge);
-      for (const n of startOrder(pick(), stacks)) {
+      for (const n of order) {
         console.log(chalk.cyan(`\n▶ ${n} (${projectName(n, ctx.workspace)})`));
-        stackUp(ctx, stacks[n], { build: args.includes("--build") });
+        stackUp(ctx, stacks[n], {
+          build: args.includes("--build"),
+          secretEnv: secrets.get(n),
+        });
         for (const route of Object.keys(stacks[n].routes))
           console.log(chalk.green(`  ✓ ${routeUrl(`${route}.${n}`, edge)}`));
       }
       return;
     }
-    case "restart":
+    case "restart": {
+      // Resolved before the down: a missing secret leaves the stack running.
+      const secrets = await resolveStacksSecretEnv(
+        pick().map((n) => stacks[n]),
+      );
       if (service) {
         // One compose service, in place: no edge re-render, no recreate.
         for (const n of pick()) {
           console.log(chalk.cyan(`↻ ${n} ${service}`));
-          stackRestartService(ctx, stacks[n], service);
+          stackRestartService(ctx, stacks[n], service, {
+            secretEnv: secrets.get(n),
+          });
         }
         return;
       }
@@ -84,9 +122,13 @@ export async function cmdStack(argv: string[]): Promise<void> {
       for (const n of pick()) {
         console.log(chalk.cyan(`↻ ${n}`));
         stackDown(ctx, stacks[n]);
-        stackUp(ctx, stacks[n], { build: args.includes("--build") });
+        stackUp(ctx, stacks[n], {
+          build: args.includes("--build"),
+          secretEnv: secrets.get(n),
+        });
       }
       return;
+    }
     case "health": {
       let ok = true;
       for (const n of pick()) {

package/src/ui/cli/workspace-notes.ts

@@ -0,0 +1,43 @@
+/**
+ * What `<cli> workspace deactivate` says about what it leaves running: it
+ * releases only the daemons Den tracks, so a compose stack started from one
+ * of the workspace's repos keeps running until `<cli> down <repo>`. A stack
+ * another active workspace still holds is named as in use, never with a
+ * command that would stop it.
+ */
+import type { WorkspaceStack } from "../../shared/stacks/status.js";
+
+/**
+ * The note for `stacks`: the running ones (null when docker could not be
+ * asked, so it is said generically), or nothing when none is running.
+ * `heldBy` maps a Compose project to the other active workspaces that hold
+ * it.
+ */
+export function composeStacksNotice(
+  cli: string,
+  stacks: WorkspaceStack[] | null,
+  heldBy: ReadonlyMap<string, string[]> = new Map(),
+): string | null {
+  if (stacks === null)
+    return `compose stacks keep running: stop them with \`${cli} down <repo>\``;
+  if (stacks.length === 0) return null;
+  const held = stacks.filter((s) => heldBy.get(s.project)?.length);
+  // `down <repo>` stops all of a repo's stacks: never suggest it for a repo
+  // with a stack still in use.
+  const heldRepos = new Set(held.map((s) => s.repo));
+  const free = stacks.filter((s) => !heldRepos.has(s.repo));
+  const inUse = held.map(
+    (s) => `${s.project} (still in ${heldBy.get(s.project)!.join(", ")})`,
+  );
+  const parts: string[] = [];
+  if (free.length) {
+    const repos = [...new Set(free.map((s) => s.repo))];
+    parts.push(
+      `compose stacks keep running (${free.map((s) => s.project).join(", ")}): ` +
+        `stop them with ${repos.map((r) => `\`${cli} down ${r}\``).join(", ")}`,
+    );
+  }
+  if (inUse.length)
+    parts.push(`in use by another workspace: ${inUse.join(", ")}`);
+  return parts.join("; ");
+}

package/src/ui/mcp/connect.ts

@@ -107,10 +107,12 @@ export const MCP_CLIENTS: readonly McpClient[] = [
               "claude",
               "mcp",
               "add",
+              // The name first: claude's -e takes several values, so a name
+              // after the env pairs is read as one more pair.
+              s.name,
               "--scope",
               "user",
               ...envFlags("-e", s.env),
-              s.name,
               "--",
               s.command,
               ...s.args,

package/src/ui/server/graph-order.ts

@@ -0,0 +1,22 @@
+/**
+ * The dependency graph's top-down repo order (entry repo first, infra last),
+ * which the health row and /api/services rank by.
+ *
+ * Deriving the graph walks every repo's sources (fingerprints, scans), so it
+ * is far too slow to redo on each 5s poll. In the web server it is kept for
+ * 30s and then recomputed after the request that noticed, never inside it
+ * (read-cache.ts); a stale order only means a briefly stale sort.
+ */
+import { deriveGraph } from "../../shared/environment-manager/derivation/derive-graph.js";
+import { orderForDown } from "../../shared/environment-manager/derivation/derived-up.js";
+import { cachedReadStale } from "../../shared/read-cache.js";
+
+const GRAPH_ORDER_MAX_AGE_MS = 30_000;
+
+export function graphOrder(workspace: string | undefined): string[] {
+  return cachedReadStale(
+    `graph-order:${workspace ?? ""}`,
+    GRAPH_ORDER_MAX_AGE_MS,
+    () => orderForDown(deriveGraph({ scope: "all", workspace })),
+  );
+}