@monster-orange/den 0.2.2 → 0.2.4

package/src/ui/server/index.ts

@@ -39,7 +39,6 @@ import type {
 import { getRunDonePayload } from "./perf-report.js";
 import { readCatalog } from "../../shared/environment-manager/catalog.js";
 import {
-  readWorkspacesFile,
   getActiveWorkspace,
   getActiveWorkspaces,
   getFocusedWorkspaceName,
@@ -49,10 +48,7 @@ import {
   resolveDepAddress,
   parseAddress,
   readManifestAnyBranch,
-  noAutostartRepos,
 } from "../../shared/environment-manager/workspaces.js";
-import { deriveGraph } from "../../shared/environment-manager/derivation/derive-graph.js";
-import { orderForDown } from "../../shared/environment-manager/derivation/derived-up.js";
 import { findServiceContainer } from "../../shared/environment-manager/service-container.js";
 import {
   resolveHistorySource,
@@ -65,15 +61,17 @@ import {
 import {
   pingHttp,
   pingShell,
+  prewarmHealthTls,
 } from "../../shared/environment-manager/health.js";
 import {
   runServiceCommand,
+  prepareServiceSecretEnv,
   resolveService,
   listDaemons,
   unregisterDaemon,
   checkServiceHealth,
   loadDaemonsFromFile,
-  pruneDeadDaemons,
+  pruneDeadDaemonsAsync,
   isInteractiveServiceCommand,
   rewriteLegacyOpctlKillCommandForContainer,
   shouldDetachServiceCommand,
@@ -141,6 +139,10 @@ import {
 import { handleReadonlyRoutes } from "./readonly-routes.js";
 import { serveUiAsset } from "./ui-assets.js";
 import { graphPrefs, mergeGraphPrefs } from "./graph-prefs.js";
+import { singleFlight } from "./single-flight.js";
+import { graphOrder } from "./graph-order.js";
+import { clearReadCache, enableReadCache } from "../../shared/read-cache.js";
+import { buildServicesList, type ServicesList } from "./services-list.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -208,6 +210,17 @@ function viewerRewrite(
 
 const HEALTH_CACHE_TTL_MS = 8_000;
 const healthCache = new Map<string, { results: HealthResult[]; at: number }>();
+/** The full-env health run in flight per cache key: concurrent polls join it. */
+const healthInFlight = new Map<string, Promise<HealthResult[]>>();
+/** /api/services builds, shared by concurrent polls and reused briefly. */
+/** The startup sweep of stale daemon records (see below the routes). */
+let startupPrune: Promise<void> = Promise.resolve();
+const SERVICES_CACHE_TTL_MS = 2_000;
+// Manifests, the edge config and the derived graph order are reused across
+// a request and the polls after it (cleared by any mutating request).
+const READ_CACHE_TTL_MS = 5_000;
+enableReadCache(READ_CACHE_TTL_MS);
+const servicesCache = singleFlight<ServicesList>(SERVICES_CACHE_TTL_MS);
 /** A workspace-scoped run covers a different service set than the default one. */
 function healthCacheKey(env: Environment, workspace: string | null): string {
   return `${env}|${workspace ?? "*"}`;
@@ -533,6 +546,15 @@ async function handleRequest(
 ): Promise<void> {
   const url = new URL(req.url ?? "/", `http://localhost:${PORT}`);
   const pathname = url.pathname;
+  // A mutating request may change what /api/services would list (exec and
+  // sync stream over GET, for EventSource).
+  if (
+    (req.method !== "GET" && req.method !== "HEAD") ||
+    /\/(exec|sync)$/.test(pathname)
+  ) {
+    servicesCache.clear();
+    clearReadCache();
+  }
 
   // ── Request logging ────────────────────────────────────────────────────────
   // /api/health fires on the UI's 5s polling interval forever — it dominates
@@ -1018,9 +1040,7 @@ async function handleRequest(
     // direction as the graph (and `den status`). orderForDown is the reverse
     // of the deps-first startup order.
     const rank = new Map(
-      orderForDown(
-        deriveGraph({ scope: "all", workspace: workspaces[0]?.name }),
-      ).map((repo, i) => [repo, i]),
+      graphOrder(workspaces[0]?.name).map((repo, i) => [repo, i]),
     );
     const sortedEntries = [...entries].sort((a, b) => {
       const ra = rank.get(a.repo) ?? Number.MAX_SAFE_INTEGER;
@@ -1142,9 +1162,17 @@ async function handleRequest(
     if (hit && Date.now() - hit.at < HEALTH_CACHE_TTL_MS) {
       return sendJson(res, hit.results.map(forViewer));
     }
-    const results = await computeHealth(env, null, undefined, wsParam);
-    healthCache.set(cacheKey, { results, at: Date.now() });
-    return sendJson(res, results.map(forViewer));
+    let run = healthInFlight.get(cacheKey);
+    if (!run) {
+      run = computeHealth(env, null, undefined, wsParam)
+        .then((results) => {
+          healthCache.set(cacheKey, { results, at: Date.now() });
+          return results;
+        })
+        .finally(() => healthInFlight.delete(cacheKey));
+      healthInFlight.set(cacheKey, run);
+    }
+    return sendJson(res, (await run).map(forViewer));
   }
 
   // Same checks, streamed: each result is sent the moment it lands so the fast
@@ -1195,169 +1223,15 @@ async function handleRequest(
     const env = (url.searchParams.get("env") ?? "local") as Environment;
     // Optional: caller may request services for a specific (non-active) workspace.
     const wsOverride = url.searchParams.get("workspace") ?? null;
-
-    // Conventional lifecycle locally: `down` is opctl-conventional (stops
-    // running containers with no declared command, no-ops gracefully), and
-    // `restart` is orchestrated by the exec runner as down → verify → up — so
-    // every service with an `up` can offer both even when the manifest doesn't
-    // declare them.
-    const withDown = (cmds: string[]): string[] => {
-      if (env !== "local") return cmds;
-      const out = [...cmds];
-      if (!out.includes("down")) out.push("down");
-      if (!out.includes("restart") && out.includes("up")) out.push("restart");
-      return out;
-    };
-
-    // Legacy: discovered repos from .den/ symlinks / registered-repos.json
-    const legacyRepos = discoverRepos();
-    const legacyEntries = legacyRepos.flatMap((repo) => {
-      const manifestLayers = loadManifest(repo.repoPath).layers;
-      return Object.entries(repo.manifest.services ?? {}).map(
-        ([svcName, svc]) => ({
-          repo: repo.repoName,
-          service: svcName,
-          address: `${repo.repoName}/${svcName}`,
-          repoPath: repo.repoPath,
-          commands: withDown(Object.keys(svc.commands?.[env] ?? {})),
-          logs: svc.logs?.[env] ?? null,
-          mode: "dev-managed" as const,
-          branch: null as string | null,
-          fromCatalog: false,
-          isEntrypoint: repo.manifest.entrypoint === svcName,
-          autostart: true, // legacy discovery has no workspace entry to toggle
-          deps: (svc.depends_on ?? []).map(depService),
-          cloned: true, // legacy discovery only ever finds on-disk repos
-          manifestLayers,
-          ...servicePlacement(repo.manifest, svcName, env),
-        }),
-      );
-    });
-
-    // Catalog entries (workspace-aware)
-    const catalog = readCatalog();
-    const wsFile = wsOverride ? readWorkspacesFile() : null;
-    const ws = wsOverride
-      ? wsFile?.workspaces[wsOverride]
-        ? { name: wsOverride, config: wsFile!.workspaces[wsOverride] }
-        : null
-      : getActiveWorkspace();
-    const getCurrentBranch = (repoPath: string): string | null => {
-      try {
-        return execSync("git rev-parse --abbrev-ref HEAD", {
-          cwd: repoPath,
-          encoding: "utf-8",
-          stdio: ["ignore", "pipe", "ignore"],
-          timeout: GIT_REMOTE_TIMEOUT_MS,
-        }).trim();
-      } catch {
-        return null;
-      }
-    };
-
-    const noAutostart = ws
-      ? noAutostartRepos(ws.config, catalog)
-      : new Set<string>();
-    const daemonOwners = new Map(
-      listDaemons().map((d) => [d.address, d.workspaces ?? []] as const),
-    );
-    // Modules and libraries have no runtime: no card, health or commands.
-    // They show as contributors on the Applications tab instead.
-    const catalogEntries = ws
-      ? listWorkspaceServices(ws.config, catalog, ws.name)
-          .filter((r) => hasRuntime(repoKind(r.repoPath)))
-          .flatMap((resolved) => {
-            // The manifest and the layers it was built from: repo or held,
-            // plus override when manifests/<repo>.override.yml applied.
-            const { manifest, layers: manifestLayers } = loadManifest(
-              resolved.repoPath,
-            );
-            const svc = manifest?.services?.[resolved.subsystem];
-            if (!manifest || !svc) {
-              // Workspace membership is config-driven: a managed entry
-              // whose clone isn't on disk yet (or a checkout without a usable
-              // manifest) must still render everywhere — flagged `cloned:false`
-              // so the UI can offer Sync/clone instead of dropping the system.
-              // `branch` comes from the workspace entry; never probe git on a
-              // path that may not exist.
-              return [
-                {
-                  repo: resolved.repoName,
-                  service: resolved.subsystem,
-                  address: resolved.address,
-                  repoPath: resolved.repoPath,
-                  commands: [] as string[],
-                  logs: null,
-                  mode: resolved.mode,
-                  branch: resolved.branch,
-                  fromCatalog: true,
-                  isEntrypoint: false,
-                  autostart: !noAutostart.has(resolved.repoName),
-                  owners: daemonOwners.get(resolved.address) ?? [],
-                  deps: [] as string[],
-                  cloned: fs.existsSync(resolved.repoPath),
-                  manifestLayers,
-                  ...servicePlacement(null, resolved.subsystem, env),
-                },
-              ];
-            }
-            return [
-              {
-                repo: resolved.repoName,
-                service: resolved.subsystem,
-                address: resolved.address,
-                repoPath: resolved.repoPath,
-                commands: withDown(Object.keys(svc.commands?.[env] ?? {})),
-                logs: svc.logs?.[env] ?? null,
-                mode: resolved.mode,
-                branch: resolved.branch ?? getCurrentBranch(resolved.repoPath),
-                fromCatalog: true,
-                isEntrypoint: manifest.entrypoint === resolved.subsystem,
-                autostart: !noAutostart.has(resolved.repoName),
-                owners: daemonOwners.get(resolved.address) ?? [],
-                deps: (svc.depends_on ?? []).map((d) =>
-                  resolveDepAddress(depService(d), catalog, ws.config, ws.name),
-                ),
-                cloned: true,
-                manifestLayers,
-                ...servicePlacement(manifest, resolved.subsystem, env),
-              },
-            ];
-          })
-      : [];
-
-    // Merge: catalog entries take precedence over legacy for same repo.
-    // When a workspace filter is active, also exclude legacy entries not in
-    // the workspace (legacy discovery is not workspace-scoped).
-    const catalogRepos = new Set(Object.keys(catalog));
-    const wsServiceKeys = ws ? new Set(Object.keys(ws.config.services)) : null;
-    const merged = [
-      ...legacyEntries.filter((e) => {
-        if (catalogRepos.has(e.repo)) return false;
-        if (wsServiceKeys && !wsServiceKeys.has(e.repo)) return false;
-        return true;
-      }),
-      ...catalogEntries,
-    ];
-
-    // Attach the dependency-graph position so consumers can present systems
-    // top-down (entry repo first, infra-stack last) — the same order the
-    // health row and `den status` use. Added as a FIELD rather than by
-    // re-sorting the array, because four pages consume this payload and some
-    // rely on the current order.
-    const graphRank = new Map(
-      orderForDown(deriveGraph({ scope: "all", workspace: ws?.name })).map(
-        (repo, i) => [repo, i],
-      ),
-    );
-    const infraRepo = readDenConfig()?.graph?.infra?.repo ?? null;
+    // Every open tab polls this: concurrent requests share one build, and a
+    // settled one is reused briefly (any mutating request clears it).
     return sendJson(
       res,
-      merged.map((e) => ({
-        ...e,
-        graphRank: graphRank.get(e.repo) ?? Number.MAX_SAFE_INTEGER,
-        infra: infraRepo !== null && e.repo === infraRepo,
-      })),
+      await servicesCache.get(
+        `${env}|${wsOverride ?? ""}`,
+        () => buildServicesList(env, wsOverride),
+        url.searchParams.get("refresh") === "1",
+      ),
     );
   }
 
@@ -1477,6 +1351,8 @@ async function handleRequest(
           {
             run: runServiceCommand,
             health: (r) => checkServiceHealth(r, "local"),
+            secretEnv: (address, cmd, workspace) =>
+              prepareServiceSecretEnv(address, cmd, workspace),
           },
         );
         return;
@@ -1833,6 +1709,7 @@ async function handleRequest(
 
   // ── API: running daemons list ──────────────────────────────────────────────
   if (pathname === "/api/service/daemons") {
+    await startupPrune;
     const daemons = listDaemons().map((d) => ({
       address: d.address,
       repoName: d.repoName,
@@ -3203,15 +3080,20 @@ server.on("error", (err: NodeJS.ErrnoException) => {
 // service stopped outside den — otherwise reopen as tabs in the web UI and
 // clutter the shutdown prompt. Container liveness (not health) is the signal: a
 // service's shared-infra health check stays green even when the service is down.
-// Runs synchronously at startup so /api/service/daemons never hands the UI a
-// stale entry on its first load.
+// The container listing runs as async child processes (a sync `docker ps`
+// here held the event loop at startup); /api/service/daemons waits for it,
+// so the UI never gets a stale entry on its first load.
 loadDaemonsFromFile();
-const prunedDaemons = pruneDeadDaemons();
-if (prunedDaemons.length > 0) {
-  console.error(
-    `Cleared ${prunedDaemons.length} stale daemon(s): ${prunedDaemons.join(", ")}`,
-  );
-}
+startupPrune = pruneDeadDaemonsAsync()
+  .then((pruned) => {
+    if (pruned.length > 0)
+      console.error(
+        `Cleared ${pruned.length} stale daemon(s): ${pruned.join(", ")}`,
+      );
+  })
+  .catch((e: unknown) => {
+    console.error(`[server] stale-daemon sweep failed: ${String(e)}`);
+  });
 
 // Background recovery: after a short delay (long enough for services to be
 // responding), health-check each loaded daemon. Removal requires strong
@@ -3269,6 +3151,16 @@ process.on("unhandledRejection", (reason) => {
   console.error("[server] unhandled rejection (continuing):", reason);
 });
 
+// Build, before serving, what the first health poll and /api/services would
+// otherwise build inside a request: the dependency-graph order and the HTTPS
+// checks' trust context (both synchronous).
+try {
+  for (const ws of getActiveWorkspaces()) graphOrder(ws);
+  prewarmHealthTls();
+} catch (e) {
+  serverLog(`  ⚠ cache warm-up failed: ${(e as Error).message}`);
+}
+
 // Bind loopback only — this UI runs privileged local actions (sudo-backed
 // service commands), so it must not be reachable from the LAN. Opt out with
 // DEN_BIND_HOST=0.0.0.0 for deliberate exposure.
@@ -3372,7 +3264,20 @@ async function stopDaemons(): Promise<void> {
 
 async function handleShutdown(signal: string): Promise<void> {
   clearSudoPassword();
-  const daemons = listDaemons();
+  // The registry lives in the state dir, which is resolved from the
+  // distribution root on every call: if that can no longer be found (den.yml
+  // moved or removed while the server ran), still exit. Never product() here:
+  // it resolves the same root.
+  let daemons: ReturnType<typeof listDaemons>;
+  try {
+    daemons = listDaemons();
+  } catch (e) {
+    console.error(
+      `\n[server] ${signal}: cannot read the running-services registry ` +
+        `(${(e as Error).message}); exiting and leaving any services running.`,
+    );
+    process.exit(0);
+  }
   if (daemons.length === 0) {
     process.exit(0);
   }
@@ -3416,16 +3321,29 @@ async function handleShutdown(signal: string): Promise<void> {
   process.exit(0);
 }
 
+/**
+ * Run the shutdown for `signal`. A failure still ends the process: the guard
+ * below ignores every later signal, so a shutdown that rejected would leave
+ * the server running and deaf to SIGTERM (a service manager then waits out
+ * its timeout and SIGKILLs it).
+ */
+function shutdownOn(signal: string): void {
+  handleShutdown(signal).catch((e: unknown) => {
+    console.error(`[server] ${signal}: shutdown failed (exiting):`, e);
+    process.exit(1);
+  });
+}
+
 let _shuttingDown = false;
 process.on("SIGINT", () => {
   if (_shuttingDown) return;
   _shuttingDown = true;
   console.log(""); // newline after ^C
-  void handleShutdown("SIGINT");
+  shutdownOn("SIGINT");
 });
 
 process.on("SIGTERM", () => {
   if (_shuttingDown) return;
   _shuttingDown = true;
-  void handleShutdown("SIGTERM");
+  shutdownOn("SIGTERM");
 });

package/src/ui/server/lifecycle-exec.ts

@@ -21,6 +21,7 @@ import type { ResolvedService } from "../../shared/types/index.js";
 import type {
   RunCommandOptions,
   RunCommandResult,
+  ServiceSecretEnvResult,
 } from "../../shared/environment-manager/service-runner.js";
 import type { ServiceHealthResult } from "../../shared/environment-manager/health.js";
 
@@ -34,6 +35,16 @@ export function isLifecycleExecCmd(c: string): c is LifecycleExecCmd {
 export interface LifecycleExecDeps {
   run: (o: RunCommandOptions) => RunCommandResult;
   health: (r: ResolvedService) => Promise<ServiceHealthResult>;
+  /**
+   * R16: resolve the service's secret_env (prepareServiceSecretEnv). Unset,
+   * nothing is resolved, and the runner refuses to start a service that
+   * declares secret_env.
+   */
+  secretEnv?: (
+    address: string,
+    cmd: LifecycleExecCmd,
+    workspace?: string,
+  ) => Promise<ServiceSecretEnvResult>;
   /** Health poll interval after a detached start (default 1s). */
   pollMs?: number;
   /** Stop polling after this long (default 120s). */
@@ -106,12 +117,24 @@ export async function streamLifecycleExec(
     }
   }
 
+  // R16: all of the service's secret_env, or nothing starts. The message
+  // names keys, refs and the provider, never a value.
+  const secrets = deps.secretEnv
+    ? await deps.secretEnv(resolved.address, cmd, o.workspace)
+    : { ok: true as const, secretEnv: undefined };
+  if (!secrets.ok) {
+    if (!clientGone) emit({ type: "error", text: secrets.message });
+    finish(1, true);
+    return;
+  }
+
   const result = deps.run({
     address: resolved.address,
     command: cmd,
     workspace: o.workspace,
     runtime: "daemon",
     env: o.env,
+    secretEnv: secrets.secretEnv,
     onLine: (text) => {
       if (!clientGone) emit({ type: "line", text });
     },

package/src/ui/server/services-list.ts

@@ -0,0 +1,210 @@
+/**
+ * The /api/services payload: every service of the legacy-discovered repos and
+ * of the requested (or active) workspace, with commands, branch, deps and
+ * graph rank.
+ *
+ * Built off the request path's critical section: the per-repo branch lookups
+ * (`git rev-parse`, ~40ms each) run as async child processes in parallel
+ * instead of one execSync after another. With ~a dozen repos the sequential
+ * version held the event loop for 0.5-1.5s, so every other request (even
+ * /api/server-info, which answers in ~1ms) waited behind it.
+ */
+import { execFile } from "child_process";
+import * as fs from "fs";
+import type { Environment } from "../../shared/types/index.js";
+import { discoverRepos } from "../../pillars/smoke/discover.js";
+import { readCatalog } from "../../shared/environment-manager/catalog.js";
+import {
+  getActiveWorkspace,
+  listWorkspaceServices,
+  noAutostartRepos,
+  readWorkspacesFile,
+  resolveDepAddress,
+} from "../../shared/environment-manager/workspaces.js";
+import { graphOrder } from "./graph-order.js";
+import { listDaemons } from "../../shared/environment-manager/service-runner.js";
+import { loadManifest } from "../../shared/manifest/read-manifest.js";
+import { servicePlacement } from "../../shared/manifest/placement.js";
+import { depService } from "../../shared/manifest/deps.js";
+import { hasRuntime, repoKind } from "../../shared/repo-kind.js";
+import { readDenConfig } from "../../shared/den-config.js";
+import { GIT_REMOTE_TIMEOUT_MS } from "../../shared/constants.js";
+
+/** `repoPath`'s checked-out branch, or null (not a checkout, git failed). */
+export function currentBranch(repoPath: string): Promise<string | null> {
+  return new Promise((resolve) => {
+    execFile(
+      "git",
+      ["rev-parse", "--abbrev-ref", "HEAD"],
+      { cwd: repoPath, encoding: "utf-8", timeout: GIT_REMOTE_TIMEOUT_MS },
+      (err, stdout) => resolve(err ? null : stdout.trim()),
+    );
+  });
+}
+
+export async function buildServicesList(
+  env: Environment,
+  wsOverride: string | null,
+) {
+  // Conventional lifecycle locally: `down` is opctl-conventional (stops
+  // running containers with no declared command, no-ops gracefully), and
+  // `restart` is orchestrated by the exec runner as down → verify → up — so
+  // every service with an `up` can offer both even when the manifest doesn't
+  // declare them.
+  const withDown = (cmds: string[]): string[] => {
+    if (env !== "local") return cmds;
+    const out = [...cmds];
+    if (!out.includes("down")) out.push("down");
+    if (!out.includes("restart") && out.includes("up")) out.push("restart");
+    return out;
+  };
+
+  // Legacy: discovered repos from .den/ symlinks / registered-repos.json
+  const legacyRepos = discoverRepos();
+  const legacyEntries = legacyRepos.flatMap((repo) => {
+    const manifestLayers = loadManifest(repo.repoPath).layers;
+    return Object.entries(repo.manifest.services ?? {}).map(
+      ([svcName, svc]) => ({
+        repo: repo.repoName,
+        service: svcName,
+        address: `${repo.repoName}/${svcName}`,
+        repoPath: repo.repoPath,
+        commands: withDown(Object.keys(svc.commands?.[env] ?? {})),
+        logs: svc.logs?.[env] ?? null,
+        mode: "dev-managed" as const,
+        branch: null as string | null,
+        fromCatalog: false,
+        isEntrypoint: repo.manifest.entrypoint === svcName,
+        autostart: true, // legacy discovery has no workspace entry to toggle
+        deps: (svc.depends_on ?? []).map(depService),
+        cloned: true, // legacy discovery only ever finds on-disk repos
+        manifestLayers,
+        ...servicePlacement(repo.manifest, svcName, env),
+      }),
+    );
+  });
+
+  // Catalog entries (workspace-aware)
+  const catalog = readCatalog();
+  const wsFile = wsOverride ? readWorkspacesFile() : null;
+  const ws = wsOverride
+    ? wsFile?.workspaces[wsOverride]
+      ? { name: wsOverride, config: wsFile.workspaces[wsOverride] }
+      : null
+    : getActiveWorkspace();
+
+  // One lookup per checkout, all in flight at once; filled in below.
+  const branches = new Map<string, Promise<string | null>>();
+  const branchOf = (repoPath: string): Promise<string | null> => {
+    let p = branches.get(repoPath);
+    if (!p) branches.set(repoPath, (p = currentBranch(repoPath)));
+    return p;
+  };
+
+  const noAutostart = ws
+    ? noAutostartRepos(ws.config, catalog)
+    : new Set<string>();
+  const daemonOwners = new Map(
+    listDaemons().map((d) => [d.address, d.workspaces ?? []] as const),
+  );
+  // Modules and libraries have no runtime: no card, health or commands.
+  // They show as contributors on the Applications tab instead.
+  const pendingBranches: Promise<void>[] = [];
+  const catalogEntries = ws
+    ? listWorkspaceServices(ws.config, catalog, ws.name)
+        .filter((r) => hasRuntime(repoKind(r.repoPath)))
+        .flatMap((resolved) => {
+          // The manifest and the layers it was built from: repo or held,
+          // plus override when manifests/<repo>.override.yml applied.
+          const { manifest, layers: manifestLayers } = loadManifest(
+            resolved.repoPath,
+          );
+          const svc = manifest?.services?.[resolved.subsystem];
+          if (!manifest || !svc) {
+            // Workspace membership is config-driven: a managed entry
+            // whose clone isn't on disk yet (or a checkout without a usable
+            // manifest) must still render everywhere — flagged `cloned:false`
+            // so the UI can offer Sync/clone instead of dropping the system.
+            // `branch` comes from the workspace entry; never probe git on a
+            // path that may not exist.
+            return [
+              {
+                repo: resolved.repoName,
+                service: resolved.subsystem,
+                address: resolved.address,
+                repoPath: resolved.repoPath,
+                commands: [] as string[],
+                logs: null,
+                mode: resolved.mode,
+                branch: resolved.branch as string | null,
+                fromCatalog: true,
+                isEntrypoint: false,
+                autostart: !noAutostart.has(resolved.repoName),
+                owners: daemonOwners.get(resolved.address) ?? [],
+                deps: [] as string[],
+                cloned: fs.existsSync(resolved.repoPath),
+                manifestLayers,
+                ...servicePlacement(null, resolved.subsystem, env),
+              },
+            ];
+          }
+          const entry = {
+            repo: resolved.repoName,
+            service: resolved.subsystem,
+            address: resolved.address,
+            repoPath: resolved.repoPath,
+            commands: withDown(Object.keys(svc.commands?.[env] ?? {})),
+            logs: svc.logs?.[env] ?? null,
+            mode: resolved.mode,
+            branch: resolved.branch as string | null,
+            fromCatalog: true,
+            isEntrypoint: manifest.entrypoint === resolved.subsystem,
+            autostart: !noAutostart.has(resolved.repoName),
+            owners: daemonOwners.get(resolved.address) ?? [],
+            deps: (svc.depends_on ?? []).map((d) =>
+              resolveDepAddress(depService(d), catalog, ws.config, ws.name),
+            ),
+            cloned: true,
+            manifestLayers,
+            ...servicePlacement(manifest, resolved.subsystem, env),
+          };
+          if (entry.branch == null)
+            pendingBranches.push(
+              branchOf(resolved.repoPath).then((b) => {
+                entry.branch = b;
+              }),
+            );
+          return [entry];
+        })
+    : [];
+
+  // Merge: catalog entries take precedence over legacy for same repo.
+  // When a workspace filter is active, also exclude legacy entries not in
+  // the workspace (legacy discovery is not workspace-scoped).
+  const catalogRepos = new Set(Object.keys(catalog));
+  const wsServiceKeys = ws ? new Set(Object.keys(ws.config.services)) : null;
+  const merged = [
+    ...legacyEntries.filter((e) => {
+      if (catalogRepos.has(e.repo)) return false;
+      if (wsServiceKeys && !wsServiceKeys.has(e.repo)) return false;
+      return true;
+    }),
+    ...catalogEntries,
+  ];
+
+  // Attach the dependency-graph position so consumers can present systems
+  // top-down (entry repo first, infra-stack last) — the same order the
+  // health row and `den status` use. Added as a FIELD rather than by
+  // re-sorting the array, because four pages consume this payload and some
+  // rely on the current order.
+  const graphRank = new Map(graphOrder(ws?.name).map((repo, i) => [repo, i]));
+  const infraRepo = readDenConfig()?.graph?.infra?.repo ?? null;
+  await Promise.all(pendingBranches);
+  return merged.map((e) => ({
+    ...e,
+    graphRank: graphRank.get(e.repo) ?? Number.MAX_SAFE_INTEGER,
+    infra: infraRepo !== null && e.repo === infraRepo,
+  }));
+}
+
+export type ServicesList = Awaited<ReturnType<typeof buildServicesList>>;