@monster-orange/den 0.2.3 → 0.2.4

package/CHANGELOG.md

@@ -4,6 +4,117 @@ All notable changes to Den are documented here. Each release lists the
 config and manifest changes a distribution must make to move to it under
 **Migrations**.
 
+## [0.2.4] - 2026-11-04
+
+### Fixed
+
+- **`GET /api/services` no longer blocks the web server.** It looked up
+  each workspace checkout's branch with a synchronous `git rev-parse`, one
+  after another (~40ms each), so with a dozen repos every request held the
+  event loop for 0.5-1.5s and everything else waited behind it: the UI,
+  the MCP server's reads, and `/api/server-info`, which `<cli> mcp connect`
+  probes with a 1.5s timeout. The lookups now run as async child processes
+  in parallel; concurrent requests (one per open tab) share one build, and
+  a settled build is reused for 2s (`?refresh=1` forces a new one; any
+  mutating request clears it). Concurrent `/api/health` polls also share
+  one run instead of each starting its own.
+- **`<cli> mcp connect` / `mcp clients` tell a slow web server from a
+  stopped one.** A server that accepts the connection but does not answer
+  within 1.5s is reported as "not answering within 1.5s", not "not
+  running". When the org config sets `web.service` (the web UI runs as a
+  launchd service), the advice is `<cli> service status` instead of
+  `<cli> web up`.
+- **Web server shutdown no longer leaks an unhandled rejection, or hangs.**
+  On SIGTERM/SIGINT the server reads the running-services registry, whose
+  path resolves the distribution root again; if that walk fails (the dist's
+  den.yml moved or removed while the server ran), the async shutdown
+  rejected unhandled ("unhandled rejection (continuing): Error: cannot
+  locate the distribution root: walked up from
+  <dist>/node_modules/@monster-orange/den/src/ui/server") and, its signal
+  guard already set, the process never exited, so a service manager had to
+  wait out its timeout and kill it. The shutdown now logs the failure and
+  exits.
+- **Deactivating a workspace no longer stops a service that moved to
+  another workspace.** A daemon's owners were the workspaces recorded when
+  it started, so a repo moved from `default` into `ws-b` while its daemon
+  ran was still "owned" only by `default`, and `workspace deactivate
+  default` stopped it. Release now re-derives the owners from the current
+  workspaces.yml membership: a daemon is stopped only when no active
+  workspace still lists its repo, and otherwise its recorded owners become
+  the active workspaces that do.
+- **`<cli> workspace --help` lists every subcommand**: activate,
+  deactivate and focus were missing (and `workspace focus <name>` now
+  exists in the CLI, as it did in the web UI). Deactivate's help and output
+  say that it releases only the services Den tracks: compose stacks of the
+  workspace's repos keep running, and the output names the running ones
+  with `<cli> down <repo>` for each (from one `docker ps`; a generic line
+  when docker can't be asked).
+- **The first `/api/health/stream` (and `/api/health`) cycle no longer
+  blocks the web server for a second.** Resolving the manifest of a repo
+  without its own (a held manifest under `manifests/`) looked up the
+  checkout's origin with a synchronous `git config --get
+  remote.origin.url`, one repo after another (~40-100ms each), so a
+  server's first health run held the event loop for 1-1.5s. The origin is
+  now read from the checkout's git config file (worktrees and
+  subdirectories included), never by spawning git. Parsed manifests are
+  also reused while the file is unchanged: one request read the same
+  manifests several times, and parsing them held the loop ~100-200ms per
+  health run.
+- **`GET /api/workspaces/available-repos` no longer blocks the web
+  server.** It ran `git remote get-url origin` (and, for managed clones,
+  `git rev-parse`) synchronously per checkout; the lookups are now async
+  and in parallel, and concurrent requests share one walk (reused for 2s;
+  `?refresh=1` forces a new one, any mutating request clears it).
+- **`workspace deactivate` names the compose stacks a repo runs itself.**
+  It only knew Den stacks (a manifest's `compose:` section, project
+  `<stack>-<workspace>`), so a distribution whose repos start their own
+  compose projects (`make up`) got no line at all. A running project now
+  counts when Compose started it from inside one of the workspace's
+  checkouts (its `com.docker.compose.project.working_dir` label), as well
+  as when it is a Den stack's project.
+- **`<cli> workspace <sub> --help`** prints that subcommand's help, not the
+  whole `workspace` help.
+- **No synchronous directory walks or spawns on the web server's hot
+  request paths** (`/api/workspaces/available-repos`, the `/api/health`
+  stream). On a loaded machine (load average ~50) the dev.1 fixes still
+  left stalls of 1-5s; a CPU profile showed why:
+  - available-repos recursed into every directory without a manifest file
+    of its own, so in a distribution whose repos use held manifests it
+    walked each repo's whole tree (to depth 4) with `readdirSync` /
+    `existsSync`: seconds per call. It now never descends into a git
+    checkout or `node_modules`, and the walk is `fs.promises`.
+  - The distribution root (and so `product()`) was re-resolved on every
+    call, a den.yml `existsSync` per `*_ROOT` variable each time, hundreds
+    of times per request. It is now resolved once per set of inputs (the
+    env vars and entry script it reads); the engine root likewise.
+  - Manifests, the edge config and the derived graph order are reused
+    across a request and the polls after it (5s; any mutating request
+    clears them), and the graph order is recomputed after a request, never
+    inside one.
+  - HTTPS health checks built a TLS context from ~150 root certificates on
+    every check; one context is built once, at startup.
+  - The startup sweep of stale daemon records ran `docker ps` / `opctl
+    container ls` synchronously; it is async now (concurrent callers share
+    one call), and `/api/service/daemons` waits for it.
+  A new test runs the server with a spy on every synchronous fs and
+  child_process call and fails if either route makes a sync spawn or
+  directory walk, or any sync call outside a short allowlist of single
+  config-file reads.
+- **The web UI service no longer runs at background priority.**
+  `service install` wrote `ProcessType: Background` into the LaunchAgent,
+  so macOS ran the UI server on efficiency cores with throttled I/O: on a
+  busy machine its first requests stalled for 5-11s. It is now
+  `Interactive`, and `service status` shows launchd's spawn type.
+- **`workspace deactivate` never suggests stopping a stack another active
+  workspace still holds.** Such a stack is listed as "in use by another
+  workspace: <project> (still in <ws>)" instead of with a `down <repo>`
+  command, and a repo with a stack still in use gets no `down` suggestion.
+
+### Migrations
+
+- Re-run `<cli> service install` to pick up the new LaunchAgent priority
+  (`<cli> service status` should show `spawn type = interactive`).
+
 ## [0.2.3] - 2026-11-04
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monster-orange/den",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Den: a local multi-repo dev orchestrator, HTTPS edge and E2E harness",
   "type": "module",
   "bin": {

package/service/install.sh

@@ -65,7 +65,9 @@ data = {
     "RunAtLoad": True,
     "KeepAlive": True,
     "ThrottleInterval": 10,
-    "ProcessType": "Background",
+    # Interactive, not Background: macOS gives Background agents efficiency
+    # cores and throttled I/O, and the UI stalled for seconds under load.
+    "ProcessType": "Interactive",
     "StandardOutPath": f"{logs}/web.log",
     "StandardErrorPath": f"{logs}/web.log",
 }
@@ -115,7 +117,7 @@ case "${1:-install}" in
   status)
     # launchctl's own "Could not find service" is noise when it isn't loaded.
     if out="$(launchctl print "$DOMAIN/$LABEL" 2>/dev/null)"; then
-      printf '%s\n' "$out" | grep -E '^\s*(state|pid|last exit code|runs)'
+      printf '%s\n' "$out" | grep -E '^\s*(state|pid|last exit code|runs|spawn type)'
     else
       echo "$LABEL is not loaded"
     fi

package/src/shared/edge/config.ts

@@ -31,6 +31,7 @@ import * as yaml from "yaml";
 import { brandSlug, defaultBrand } from "../brand.js";
 import { DEFAULT_PORT } from "../constants.js";
 import { getDistRoot } from "../paths.js";
+import { cachedRead } from "../read-cache.js";
 import { readManifestStacks } from "../stacks/config.js";
 import { getActiveWorkspaces } from "../environment-manager/workspaces.js";
 import { assertDomain } from "./render.js";
@@ -154,6 +155,21 @@ function manifestStackNames(): string[] {
 }
 
 export function readEdgeConfig(root: string = getDistRoot()): EdgeConfig {
+  // The web server reads this on every request (open links, health rows);
+  // reused for the read cache's TTL there, read fresh everywhere else. An
+  // error is cached as such: most instances have no edge block at all.
+  const r = cachedRead(`edge-config:${root}`, () => {
+    try {
+      return { config: computeEdgeConfig(root) };
+    } catch (e) {
+      return { error: (e as Error).message };
+    }
+  });
+  if ("error" in r) throw new Error(r.error);
+  return r.config;
+}
+
+function computeEdgeConfig(root: string): EdgeConfig {
   const { team: t, user: u } = layers(root);
   const team = (t.edge ?? {}) as RawEdge;
   const user = (u.edge ?? {}) as RawEdge;

package/src/shared/environment-manager/health.ts

@@ -175,6 +175,36 @@ export function __setExtraCaForTests(pems: string[] | null): void {
   _extraCa = pems;
 }
 
+/**
+ * One TLS context with the public roots plus extraCa(), built once. Passing
+ * `ca` per request made Node parse ~150 root certificates on every HTTPS
+ * health check, synchronously: tens of ms per check, per poll.
+ */
+/** Build the HTTPS checks' trust context now (web server startup). */
+export function prewarmHealthTls(): void {
+  trustContext();
+}
+
+let _trust: {
+  ca: string[];
+  context: tls.SecureContext;
+  agent: https.Agent;
+} | null = null;
+function trustContext(): { context: tls.SecureContext; agent: https.Agent } {
+  const extra = extraCa();
+  if (_trust?.ca !== extra) {
+    _trust?.agent.destroy();
+    _trust = {
+      ca: extra,
+      context: tls.createSecureContext({
+        ca: [...tls.rootCertificates, ...extra],
+      }),
+      agent: new https.Agent({ keepAlive: false }),
+    };
+  }
+  return _trust;
+}
+
 /**
  * HTTPS check. Connects to the c-ares-resolved IP (see above) but keeps the
  * hostname for SNI and certificate verification; rewriting the URL to the IP,
@@ -201,7 +231,12 @@ async function pingHttps(parsed: URL, timeoutMs: number): Promise<PingResult> {
       {
         method: "GET",
         servername: isIpLiteral(host) ? undefined : host,
-        ca: [...tls.rootCertificates, ...extraCa()],
+        // tls.connect's option, passed through by the agent (not in the
+        // https.RequestOptions type).
+        ...({ secureContext: trustContext().context } as https.RequestOptions),
+        // Its own agent: a socket kept alive under one trust set must never
+        // be reused for a check under another.
+        agent: trustContext().agent,
         lookup: (_h, opts, cb) => {
           // Node may ask for all addresses (autoSelectFamily).
           if ((opts as { all?: boolean }).all)

package/src/shared/environment-manager/opctl.ts

@@ -10,7 +10,7 @@
  *     repo's dev/up op, captured at spawn time and/or parsed on demand.
  */
 
-import { execFileSync, execSync } from "child_process";
+import { execFile, execFileSync, execSync } from "child_process";
 import * as fs from "fs";
 import * as path from "path";
 import { parse as parseYaml } from "yaml";
@@ -333,3 +333,85 @@ export function diffSpawnedContainers(
   for (const c of after) if (!had.has(c.base)) fresh.add(c.base);
   return [...fresh];
 }
+
+// ── Async variants (the web server) ──────────────────────────────────────────
+// The sync calls above block the event loop for the whole `docker ps` /
+// `opctl container ls` (hundreds of ms on a loaded machine). The server uses
+// these instead; concurrent callers share one in-flight call.
+
+function execOut(cmd: string, args: string[]): Promise<string | null> {
+  return new Promise((resolve) => {
+    execFile(
+      cmd,
+      args,
+      { encoding: "utf-8", timeout: 5_000, maxBuffer: 16 * 1024 * 1024 },
+      (err, stdout) => resolve(err ? null : stdout),
+    );
+  });
+}
+
+function shared<T>(run: () => Promise<T>): () => Promise<T> {
+  let inFlight: Promise<T> | null = null;
+  return () =>
+    (inFlight ??= run().finally(() => {
+      inFlight = null;
+    }));
+}
+
+/** Whether `opctl` is on PATH, without spawning a shell. Cached. */
+export async function isOpctlAvailableAsync(): Promise<boolean> {
+  if (opctlAvailableCache !== null) return opctlAvailableCache;
+  for (const dir of (process.env.PATH ?? "").split(path.delimiter)) {
+    if (!dir) continue;
+    try {
+      await fs.promises.access(path.join(dir, "opctl"), fs.constants.X_OK);
+      return (opctlAvailableCache = true);
+    } catch {
+      /* next */
+    }
+  }
+  return (opctlAvailableCache = false);
+}
+
+/** runningDockerNames, async; null when docker is unavailable. */
+export const runningDockerNamesAsync = shared(
+  async (): Promise<string[] | null> => {
+    const out = await execOut("docker", ["ps", "--format", "{{.Names}}"]);
+    return out === null
+      ? null
+      : out
+          .split("\n")
+          .map((l) => l.trim())
+          .filter(Boolean);
+  },
+);
+
+/** listRunningOpctlContainers, async. */
+export const listRunningOpctlContainersAsync = shared(
+  async (): Promise<{ name: string; base: string }[]> => {
+    const byBase = new Map<string, { name: string; base: string }>();
+    const [opctlOut, dockerNames] = await Promise.all([
+      isOpctlAvailableAsync().then((ok) =>
+        ok ? execOut("opctl", ["container", "ls"]) : null,
+      ),
+      runningDockerNamesAsync(),
+    ]);
+    if (opctlOut !== null) {
+      const lines = opctlOut.split("\n");
+      const firstToken = lines[0]?.trim().split(/\s+/)[0];
+      const body =
+        firstToken === "NAME" || firstToken === "ID" ? lines.slice(1) : lines;
+      for (const line of body) {
+        const name = line.trim().split(/\s+/)[0];
+        if (!name) continue;
+        const base = name.replace(/-[0-9a-f]{8}$/i, "");
+        byBase.set(base, { name, base });
+      }
+    }
+    for (const name of dockerNames ?? []) {
+      const m = name.match(DOCKER_OPCTL_NAME);
+      if (m && !byBase.has(m[1])) byBase.set(m[1], { name, base: m[1] });
+    }
+    return [...byBase.values()];
+  },
+);

package/src/shared/environment-manager/service-runner.ts

@@ -44,6 +44,8 @@ import {
   inspectOpctlContainer,
   isOpctlAvailable,
   listRunningOpctlContainers,
+  listRunningOpctlContainersAsync,
+  isOpctlAvailableAsync,
 } from "./opctl.js";
 import {
   getActiveWorkspace,
@@ -357,6 +359,24 @@ export function activeDaemonOwners(
   return (record?.workspaces ?? []).filter((w) => active.has(w));
 }
 
+/** Whether workspace `name`'s current config lists `daemon`'s service. */
+function workspaceContainsDaemon(
+  name: string,
+  daemon: Pick<DaemonRecord, "address" | "repoName">,
+): boolean {
+  const services = getWorkspaceByName(name)?.config.services ?? {};
+  return daemon.address in services || daemon.repoName in services;
+}
+
+/** Replace a running daemon's owners (re-derived from membership). */
+function setDaemonOwners(address: string, workspaces: string[]): void {
+  loadDaemonsFromFile();
+  const existing = _daemonRegistry.get(address);
+  if (!existing) return;
+  _daemonRegistry.set(address, { ...existing, workspaces });
+  saveDaemonsFile(getDaemonsFile());
+}
+
 /** Outcome of releasing one daemon during a workspace deactivation. */
 export interface DaemonRelease {
   address: string;
@@ -382,15 +402,19 @@ export async function releaseWorkspaceDaemons(
   const owned = listDaemons().filter((d) =>
     (d.workspaces ?? []).includes(workspace),
   );
-  const active = new Set(getActiveWorkspaces());
+  const active = getActiveWorkspaces();
   const releases: DaemonRelease[] = [];
 
   for (const daemon of owned) {
-    const remaining = activeDaemonOwners(daemon, active).filter(
-      (w) => w !== workspace,
+    // Owners re-derived from the CURRENT membership, not the ones recorded at
+    // start: a repo moved into another workspace while its daemon ran belongs
+    // to that workspace now, and one moved out no longer belongs to this one.
+    // Stopped only when no active workspace still contains it.
+    const remaining = active.filter(
+      (w) => w !== workspace && workspaceContainsDaemon(w, daemon),
     );
     if (remaining.length > 0) {
-      detachDaemonOwner(daemon.address, workspace);
+      setDaemonOwners(daemon.address, remaining);
       onLine(
         `detached "${workspace}" from ${daemon.address} — still running for [${remaining.join(", ")}]`,
       );
@@ -639,6 +663,27 @@ export function pruneDeadDaemons(): string[] {
   const running = isOpctlAvailable()
     ? new Set(listRunningOpctlContainers().map((c) => c.base))
     : null;
+  return pruneAgainst(daemons, running);
+}
+
+/**
+ * pruneDeadDaemons without blocking: the container listing runs as async
+ * child processes (the web server's startup, which used to hold the event
+ * loop for the `docker ps`).
+ */
+export async function pruneDeadDaemonsAsync(): Promise<string[]> {
+  const daemons = listDaemons();
+  if (daemons.length === 0) return [];
+  const running = (await isOpctlAvailableAsync())
+    ? new Set((await listRunningOpctlContainersAsync()).map((c) => c.base))
+    : null;
+  return pruneAgainst(daemons, running);
+}
+
+function pruneAgainst(
+  daemons: DaemonRecord[],
+  running: Set<string> | null,
+): string[] {
   const pruned: string[] = [];
   for (const d of daemons) {
     try {

package/src/shared/git/origin-url.ts

@@ -0,0 +1,77 @@
+/**
+ * A checkout's `origin` URL, read from its git config file instead of by
+ * running `git`. Callers on the web server's request path (manifest
+ * resolution for every repo without its own manifest) used to spawn
+ * `git config --get remote.origin.url` synchronously, one repo after another:
+ * ~40-100ms each, which held the event loop for a second on a cold server.
+ *
+ * Same answer as `git -C <dir> config --get remote.origin.url` for ordinary
+ * checkouts and linked worktrees: the repo is found by walking up from `dir`
+ * to the first `.git` (a directory, or a `gitdir:` file), and a worktree's
+ * config is its common dir's.
+ */
+import * as fs from "fs";
+import * as path from "path";
+
+/** The git directory for `start` (walking up), or null outside a repo. */
+export function findGitDir(start: string): string | null {
+  let dir = path.resolve(start);
+  for (;;) {
+    const dotGit = path.join(dir, ".git");
+    try {
+      const st = fs.statSync(dotGit);
+      if (st.isDirectory()) return dotGit;
+      if (st.isFile()) {
+        const m = /^gitdir:\s*(.+?)\s*$/m.exec(
+          fs.readFileSync(dotGit, "utf-8"),
+        );
+        if (m) return path.resolve(dir, m[1]);
+      }
+    } catch {
+      /* no .git here: keep walking */
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+/** The `url` of `[remote "origin"]` in a git config file's text, or null. */
+export function originUrlFromConfig(text: string): string | null {
+  let inOrigin = false;
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith(";")) continue;
+    if (line.startsWith("[")) {
+      inOrigin = /^\[\s*remote\s+"origin"\s*\]$/i.test(line);
+      continue;
+    }
+    if (!inOrigin) continue;
+    const m = /^url\s*=\s*(.*)$/i.exec(line);
+    if (m) {
+      const value = m[1].replace(/\s+[#;].*$/, "").trim();
+      return value.replace(/^"(.*)"$/, "$1") || null;
+    }
+  }
+  return null;
+}
+
+/** `dir`'s origin URL, or null (not a checkout, or no origin). Never spawns. */
+export function readOriginUrl(dir: string): string | null {
+  const gitDir = findGitDir(dir);
+  if (!gitDir) return null;
+  let common = gitDir;
+  try {
+    const rel = fs.readFileSync(path.join(gitDir, "commondir"), "utf-8").trim();
+    if (rel) common = path.resolve(gitDir, rel);
+  } catch {
+    /* not a linked worktree */
+  }
+  try {
+    return originUrlFromConfig(
+      fs.readFileSync(path.join(common, "config"), "utf-8"),
+    );
+  } catch {
+    return null;
+  }
+}

package/src/shared/manifest/read-manifest.ts

@@ -15,7 +15,8 @@
 
 import * as fs from "fs";
 import * as path from "path";
-import { execFileSync } from "child_process";
+import { readOriginUrl } from "../git/origin-url.js";
+import { cachedRead } from "../read-cache.js";
 import { getDistRoot } from "../paths.js";
 import { parse as parseYaml } from "yaml";
 import type { RawManifest } from "../types/index.js";
@@ -48,21 +49,15 @@ const originCache = new Map<string, string | null>();
 /** Repo name of `repoPath`'s git origin (`…/<name>.git`), cached. */
 export function originRepoName(repoPath: string): string | null {
   if (originCache.has(repoPath)) return originCache.get(repoPath)!;
-  let name: string | null = null;
-  try {
-    const url = execFileSync(
-      "git",
-      ["-C", repoPath, "config", "--get", "remote.origin.url"],
-      { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 2000 },
-    ).trim();
-    name =
-      url
+  // Read from the git config file, never by spawning git: this runs on the
+  // web server's request path for every repo without its own manifest.
+  const url = readOriginUrl(repoPath);
+  const name = url
+    ? url
         .replace(/\.git$/, "")
         .split(/[/:]/)
-        .pop() || null;
-  } catch {
-    /* not a git checkout, or no origin */
-  }
+        .pop() || null
+    : null;
   originCache.set(repoPath, name);
   return name;
 }
@@ -169,6 +164,29 @@ export function parseManifestText(
   return parsed as Record<string, unknown>;
 }
 
+/**
+ * Parsed manifests by file, reused while the file's text is unchanged. A
+ * single web request reads the same manifests several times (kind, health
+ * plan, stack names, edge links), and parsing YAML is the expensive part:
+ * it held the event loop ~100-200ms per /api/health run. Callers get their
+ * own copy, so mutating a result never leaks into the cache.
+ */
+const parsedCache = new Map<
+  string,
+  { raw: string; parsed: Record<string, unknown> | null }
+>();
+
+function parseCached(
+  file: string,
+  raw: string,
+): Record<string, unknown> | null {
+  const hit = parsedCache.get(file);
+  if (hit && hit.raw === raw) return hit.parsed && structuredClone(hit.parsed);
+  const parsed = parseManifestText(file, raw);
+  parsedCache.set(file, { raw, parsed });
+  return parsed && structuredClone(parsed);
+}
+
 /** The message for an override that has no base to apply to. */
 export function orphanOverrideMessage(): string {
   return `an override with no base manifest is not a manifest: add a ${product().manifestYml} to the repo, or to manifests/`;
@@ -198,7 +216,7 @@ function combine(
 ): ManifestLoad {
   const out: ManifestLoad = { manifest: null, layers: [], ...at };
   const parse = (file: string, raw: string): Record<string, unknown> => {
-    const parsed = parseManifestText(file, raw);
+    const parsed = parseCached(file, raw);
     if (!parsed) throw new Error(`${file}: not a map`);
     return parsed;
   };
@@ -224,6 +242,12 @@ function combine(
 
 /** Resolve, read and merge `repoPath`'s manifest layers. Never throws. */
 export function loadManifest(repoPath: string): ManifestLoad {
+  // The web server resolves the same manifests many times per request; it
+  // reuses them for the read cache's TTL (see read-cache.ts).
+  return cachedRead(`manifest:${repoPath}`, () => loadManifestFresh(repoPath));
+}
+
+function loadManifestFresh(repoPath: string): ManifestLoad {
   const at = locate(repoPath);
   try {
     return combine(

package/src/shared/paths.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import {
   loadProfile,
+  onProfileCacheReset,
   PROFILE_FILE,
   readEnv,
   type ProductProfile,
@@ -74,6 +75,34 @@ function rootFromEnv(): string | null {
  * anchor fails loudly.
  */
 export function getDistRoot(): string {
+  // Resolved once per set of inputs: the walk and its den.yml checks used to
+  // run on every call (hundreds per web request, via product()). The inputs
+  // are the env vars it reads and the entry script; change any and it
+  // re-resolves. A failure is never cached.
+  const key = distRootKey();
+  if (distRootMemo?.key === key) return distRootMemo.root;
+  const root = resolveDistRoot();
+  distRootMemo = { key, root };
+  return root;
+}
+
+let distRootMemo: { key: string; root: string } | null = null;
+
+/** Everything getDistRoot's answer depends on, as one string. */
+function distRootKey(): string {
+  let key = `${process.argv[1] ?? ""}\0${process.env.DEN_PROFILE ?? ""}`;
+  for (const name in process.env)
+    if (name.endsWith("_ROOT")) key += `\0${name}=${process.env[name]}`;
+  return key;
+}
+
+/** Forget the resolved root (tests that rebuild a root in place). */
+export function resetDistRootCache(): void {
+  distRootMemo = null;
+}
+onProfileCacheReset(resetDistRootCache);
+
+function resolveDistRoot(): string {
   const fromEnv = rootFromEnv();
   if (fromEnv) return fromEnv;
   const start = entryDir();
@@ -128,6 +157,19 @@ function isProductRootVar(dir: string, key: string): boolean {
  * node_modules/@monster-orange/den; in Den's own checkout, its root.
  */
 export function getEngineRoot(): string {
+  const key = `${process.env.DEN_ENGINE_ROOT ?? ""}\0${process.argv[1] ?? ""}\0${process.cwd()}`;
+  if (engineRootMemo?.key === key) return engineRootMemo.root;
+  const root = resolveEngineRoot();
+  engineRootMemo = { key, root };
+  return root;
+}
+
+let engineRootMemo: { key: string; root: string } | null = null;
+onProfileCacheReset(() => {
+  engineRootMemo = null;
+});
+
+function resolveEngineRoot(): string {
   const env = process.env.DEN_ENGINE_ROOT?.trim();
   if (env) return path.resolve(env);
   for (const start of [entryDir(), process.cwd()]) {

package/src/shared/product.ts

@@ -35,10 +35,16 @@ function withDerived(p: ProductProfile): Product {
   };
 }
 
+let derived: { profile: ProductProfile; product: Product } | null = null;
+
 /** The running product. Never throws. */
 export function product(): Product {
   try {
-    return withDerived(loadProfile(getDistRoot()));
+    const profile = loadProfile(getDistRoot());
+    // Same profile object (loadProfile caches it): same derived names.
+    if (derived?.profile !== profile)
+      derived = { profile, product: withDerived(profile) };
+    return derived.product;
   } catch {
     const pinned = process.env.DEN_PROFILE?.trim();
     try {

package/src/shared/profile.ts

@@ -122,8 +122,16 @@ export function loadProfile(root: string): ProductProfile {
   return cached.profile;
 }
 
+const resetHooks: (() => void)[] = [];
+
+/** Run `hook` whenever resetProfileCache runs (caches derived from it). */
+export function onProfileCacheReset(hook: () => void): void {
+  resetHooks.push(hook);
+}
+
 export function resetProfileCache(): void {
   cached = null;
+  for (const hook of resetHooks) hook();
 }
 
 /** `${PREFIX}_${key}`: the env-var name this distribution uses for `key`. */