@monster-orange/den 0.2.3 → 0.2.5

package/src/shared/manifest/read-manifest.ts

@@ -15,7 +15,8 @@
 
 import * as fs from "fs";
 import * as path from "path";
-import { execFileSync } from "child_process";
+import { readOriginUrl } from "../git/origin-url.js";
+import { cachedRead } from "../read-cache.js";
 import { getDistRoot } from "../paths.js";
 import { parse as parseYaml } from "yaml";
 import type { RawManifest } from "../types/index.js";
@@ -48,21 +49,15 @@ const originCache = new Map<string, string | null>();
 /** Repo name of `repoPath`'s git origin (`…/<name>.git`), cached. */
 export function originRepoName(repoPath: string): string | null {
   if (originCache.has(repoPath)) return originCache.get(repoPath)!;
-  let name: string | null = null;
-  try {
-    const url = execFileSync(
-      "git",
-      ["-C", repoPath, "config", "--get", "remote.origin.url"],
-      { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 2000 },
-    ).trim();
-    name =
-      url
+  // Read from the git config file, never by spawning git: this runs on the
+  // web server's request path for every repo without its own manifest.
+  const url = readOriginUrl(repoPath);
+  const name = url
+    ? url
         .replace(/\.git$/, "")
         .split(/[/:]/)
-        .pop() || null;
-  } catch {
-    /* not a git checkout, or no origin */
-  }
+        .pop() || null
+    : null;
   originCache.set(repoPath, name);
   return name;
 }
@@ -169,6 +164,29 @@ export function parseManifestText(
   return parsed as Record<string, unknown>;
 }
 
+/**
+ * Parsed manifests by file, reused while the file's text is unchanged. A
+ * single web request reads the same manifests several times (kind, health
+ * plan, stack names, edge links), and parsing YAML is the expensive part:
+ * it held the event loop ~100-200ms per /api/health run. Callers get their
+ * own copy, so mutating a result never leaks into the cache.
+ */
+const parsedCache = new Map<
+  string,
+  { raw: string; parsed: Record<string, unknown> | null }
+>();
+
+function parseCached(
+  file: string,
+  raw: string,
+): Record<string, unknown> | null {
+  const hit = parsedCache.get(file);
+  if (hit && hit.raw === raw) return hit.parsed && structuredClone(hit.parsed);
+  const parsed = parseManifestText(file, raw);
+  parsedCache.set(file, { raw, parsed });
+  return parsed && structuredClone(parsed);
+}
+
 /** The message for an override that has no base to apply to. */
 export function orphanOverrideMessage(): string {
   return `an override with no base manifest is not a manifest: add a ${product().manifestYml} to the repo, or to manifests/`;
@@ -198,7 +216,7 @@ function combine(
 ): ManifestLoad {
   const out: ManifestLoad = { manifest: null, layers: [], ...at };
   const parse = (file: string, raw: string): Record<string, unknown> => {
-    const parsed = parseManifestText(file, raw);
+    const parsed = parseCached(file, raw);
     if (!parsed) throw new Error(`${file}: not a map`);
     return parsed;
   };
@@ -224,6 +242,12 @@ function combine(
 
 /** Resolve, read and merge `repoPath`'s manifest layers. Never throws. */
 export function loadManifest(repoPath: string): ManifestLoad {
+  // The web server resolves the same manifests many times per request; it
+  // reuses them for the read cache's TTL (see read-cache.ts).
+  return cachedRead(`manifest:${repoPath}`, () => loadManifestFresh(repoPath));
+}
+
+function loadManifestFresh(repoPath: string): ManifestLoad {
   const at = locate(repoPath);
   try {
     return combine(

package/src/shared/paths.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import {
   loadProfile,
+  onProfileCacheReset,
   PROFILE_FILE,
   readEnv,
   type ProductProfile,
@@ -74,6 +75,34 @@ function rootFromEnv(): string | null {
  * anchor fails loudly.
  */
 export function getDistRoot(): string {
+  // Resolved once per set of inputs: the walk and its den.yml checks used to
+  // run on every call (hundreds per web request, via product()). The inputs
+  // are the env vars it reads and the entry script; change any and it
+  // re-resolves. A failure is never cached.
+  const key = distRootKey();
+  if (distRootMemo?.key === key) return distRootMemo.root;
+  const root = resolveDistRoot();
+  distRootMemo = { key, root };
+  return root;
+}
+
+let distRootMemo: { key: string; root: string } | null = null;
+
+/** Everything getDistRoot's answer depends on, as one string. */
+function distRootKey(): string {
+  let key = `${process.argv[1] ?? ""}\0${process.env.DEN_PROFILE ?? ""}`;
+  for (const name in process.env)
+    if (name.endsWith("_ROOT")) key += `\0${name}=${process.env[name]}`;
+  return key;
+}
+
+/** Forget the resolved root (tests that rebuild a root in place). */
+export function resetDistRootCache(): void {
+  distRootMemo = null;
+}
+onProfileCacheReset(resetDistRootCache);
+
+function resolveDistRoot(): string {
   const fromEnv = rootFromEnv();
   if (fromEnv) return fromEnv;
   const start = entryDir();
@@ -128,6 +157,19 @@ function isProductRootVar(dir: string, key: string): boolean {
  * node_modules/@monster-orange/den; in Den's own checkout, its root.
  */
 export function getEngineRoot(): string {
+  const key = `${process.env.DEN_ENGINE_ROOT ?? ""}\0${process.argv[1] ?? ""}\0${process.cwd()}`;
+  if (engineRootMemo?.key === key) return engineRootMemo.root;
+  const root = resolveEngineRoot();
+  engineRootMemo = { key, root };
+  return root;
+}
+
+let engineRootMemo: { key: string; root: string } | null = null;
+onProfileCacheReset(() => {
+  engineRootMemo = null;
+});
+
+function resolveEngineRoot(): string {
   const env = process.env.DEN_ENGINE_ROOT?.trim();
   if (env) return path.resolve(env);
   for (const start of [entryDir(), process.cwd()]) {

package/src/shared/product.ts

@@ -35,10 +35,16 @@ function withDerived(p: ProductProfile): Product {
   };
 }
 
+let derived: { profile: ProductProfile; product: Product } | null = null;
+
 /** The running product. Never throws. */
 export function product(): Product {
   try {
-    return withDerived(loadProfile(getDistRoot()));
+    const profile = loadProfile(getDistRoot());
+    // Same profile object (loadProfile caches it): same derived names.
+    if (derived?.profile !== profile)
+      derived = { profile, product: withDerived(profile) };
+    return derived.product;
   } catch {
     const pinned = process.env.DEN_PROFILE?.trim();
     try {

package/src/shared/profile.ts

@@ -122,8 +122,16 @@ export function loadProfile(root: string): ProductProfile {
   return cached.profile;
 }
 
+const resetHooks: (() => void)[] = [];
+
+/** Run `hook` whenever resetProfileCache runs (caches derived from it). */
+export function onProfileCacheReset(hook: () => void): void {
+  resetHooks.push(hook);
+}
+
 export function resetProfileCache(): void {
   cached = null;
+  for (const hook of resetHooks) hook();
 }
 
 /** `${PREFIX}_${key}`: the env-var name this distribution uses for `key`. */

package/src/shared/read-cache.ts

@@ -0,0 +1,77 @@
+/**
+ * A short-lived cache for the web server's repeated reads (manifests, the
+ * edge config, the derived graph), so a request does not re-stat and
+ * re-read the same files dozens of times, and polls a few seconds apart
+ * share one read.
+ *
+ * Off unless the web server enables it: a CLI command and the tests read
+ * fresh every time, as before. The server clears it on every mutating
+ * request, so a write made through the UI is seen by the very next read;
+ * an edit made outside the server (an editor, the CLI) is seen within the
+ * TTL. Values are cloned on the way out, so a caller that mutates its copy
+ * never changes what the next caller gets.
+ */
+
+let ttlMs = 0;
+const entries = new Map<string, { at: number; value: unknown }>();
+/** cachedReadStale's values: kept across a clear, only marked stale. */
+const stale = new Map<string, { at: number; value: unknown }>();
+const refreshing = new Set<string>();
+
+/** Turn the cache on (web server only). */
+export function enableReadCache(ms: number): void {
+  ttlMs = ms;
+}
+
+/** Drop every cached read (after a mutation, or in tests). */
+export function clearReadCache(): void {
+  entries.clear();
+  for (const e of stale.values()) e.at = 0;
+}
+
+function copy<T>(v: T): T {
+  return v !== null && typeof v === "object" ? structuredClone(v) : v;
+}
+
+/** `load()`'s value for `key`, reused for the TTL when the cache is on. */
+export function cachedRead<T>(key: string, load: () => T): T {
+  if (ttlMs <= 0) return load();
+  const hit = entries.get(key);
+  if (hit && Date.now() - hit.at < ttlMs) return copy(hit.value as T);
+  const value = load();
+  entries.set(key, { at: Date.now(), value });
+  return copy(value);
+}
+
+/**
+ * Like cachedRead, but past the TTL it still answers with the last value at
+ * once and recomputes after the current request (setImmediate), so no
+ * request waits on the recompute. For expensive, slow-changing results
+ * (the derived dependency graph) whose staleness only affects ordering.
+ */
+export function cachedReadStale<T>(
+  key: string,
+  maxAgeMs: number,
+  load: () => T,
+): T {
+  if (ttlMs <= 0) return load();
+  const hit = stale.get(key);
+  if (!hit) {
+    const value = load();
+    stale.set(key, { at: Date.now(), value });
+    return copy(value);
+  }
+  if (Date.now() - hit.at >= maxAgeMs && !refreshing.has(key)) {
+    refreshing.add(key);
+    setImmediate(() => {
+      try {
+        stale.set(key, { at: Date.now(), value: load() });
+      } catch {
+        /* keep the last good value */
+      } finally {
+        refreshing.delete(key);
+      }
+    });
+  }
+  return copy(hit.value as T);
+}

package/src/shared/stacks/compose-health.ts

@@ -0,0 +1,150 @@
+/**
+ * Compose-stack health answered in-process, from one `docker ps` listing
+ * shared by every check that runs at the same time.
+ *
+ * Den gives a compose repo with no declared check a `<cli> stack health`
+ * shell check (composeHealthCmd), one per manifest service. Spawned, each
+ * was a full CLI start: 17-19 tsx processes per health cycle for three
+ * stacks, which on a loaded machine (load 35-55) ran past their budget and
+ * read as down. The checks Den generates itself are now judged here, with
+ * the verdict `stack health` gives; a distribution's own shell checks still
+ * run as shell commands.
+ */
+import { execFile } from "child_process";
+import type { RawManifest } from "../types/index.js";
+import { manifestStackName } from "./config.js";
+import { composeHealthCmd } from "./manifest-commands.js";
+import { projectName } from "./render.js";
+import { judgeStackRows, type ComposeRow } from "./runtime.js";
+import { resolveStackWorkspaces } from "./status.js";
+
+export { judgeStackRows, type ComposeRow };
+
+/** A Den-generated compose health check: what to look for in the listing. */
+export interface ComposeHealthTarget {
+  /** The Compose project (`<stack>-<stack workspace>`). */
+  project: string;
+  /** A compose service to check on its own; unset: the whole stack. */
+  service?: string;
+  /** The equivalent `<cli> stack health` command (shown as the check). */
+  cmd: string;
+}
+
+/** A health verdict; `ok: null` when docker could not be asked. */
+export interface ComposeVerdict {
+  ok: boolean | null;
+  detail: string;
+  /** With ok null: docker gave no answer within the budget. */
+  pending?: boolean;
+}
+
+/** The compose health check Den generates for this service, or null. */
+export function composeHealthTarget(
+  manifest: RawManifest,
+  subsystem: string,
+  repoName: string,
+  workspace: string,
+): ComposeHealthTarget | null {
+  const cmd = composeHealthCmd(manifest, subsystem, repoName, workspace);
+  if (!cmd) return null;
+  const project = projectName(
+    manifestStackName(manifest, repoName),
+    resolveStackWorkspaces(workspace).stackWorkspace,
+  );
+  const service = cmd.includes(" --service ") ? subsystem : undefined;
+  return { project, ...(service ? { service } : {}), cmd };
+}
+
+/** Budget for the shared listing; past it the checks are pending. */
+export const COMPOSE_LISTING_TIMEOUT_MS = 5_000;
+
+type Listing = { rows: ComposeRow[] } | { error: string; pending?: boolean };
+
+let inFlight: Promise<Listing> | null = null;
+
+/**
+ * Every compose container, from one `docker ps -a`. Concurrent callers share
+ * the call in flight, so a health cycle lists once however many checks it has.
+ */
+export function composeListing(): Promise<Listing> {
+  return (inFlight ??= listOnce().finally(() => {
+    inFlight = null;
+  }));
+}
+
+function listOnce(): Promise<Listing> {
+  return new Promise((done) => {
+    // Backstop: execFile reports only once the pipes close, which a killed
+    // process's children can hold open; the checks must not wait on that.
+    const guard = setTimeout(
+      () =>
+        resolve({
+          error: `docker gave no answer within ${COMPOSE_LISTING_TIMEOUT_MS / 1000}s`,
+          pending: true,
+        }),
+      COMPOSE_LISTING_TIMEOUT_MS + 500,
+    );
+    let settled = false;
+    const resolve = (l: Listing): void => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(guard);
+      done(l);
+    };
+    execFile(
+      "docker",
+      [
+        "ps",
+        "-a",
+        "--filter",
+        "label=com.docker.compose.project",
+        "--format",
+        '{{.Label "com.docker.compose.project"}}\t{{.Label "com.docker.compose.service"}}\t{{.State}}\t{{.Status}}',
+      ],
+      {
+        encoding: "utf-8",
+        timeout: COMPOSE_LISTING_TIMEOUT_MS,
+        maxBuffer: 16 * 1024 * 1024,
+      },
+      (err, stdout, stderr) => {
+        if (err) {
+          const killed = (err as { killed?: boolean }).killed === true;
+          return resolve(
+            killed
+              ? {
+                  error: `docker gave no answer within ${COMPOSE_LISTING_TIMEOUT_MS / 1000}s`,
+                  pending: true,
+                }
+              : {
+                  error:
+                    String(stderr || err.message).trim() || "docker ps failed",
+                },
+          );
+        }
+        const rows = stdout
+          .split("\n")
+          .filter(Boolean)
+          .map((line) => {
+            const [project = "", service = "", state = "", status = ""] =
+              line.split("\t");
+            return { project, service, state, status };
+          });
+        resolve({ rows });
+      },
+    );
+  });
+}
+
+/** The health of one Den-generated compose check, from the shared listing. */
+export async function composeHealth(
+  target: ComposeHealthTarget,
+): Promise<ComposeVerdict> {
+  const listing = await composeListing();
+  if ("error" in listing)
+    return {
+      ok: null,
+      detail: `container state unknown: ${listing.error}`,
+      ...(listing.pending ? { pending: true } : {}),
+    };
+  return judgeStackRows(listing.rows, target.project, target.service);
+}

package/src/shared/stacks/runtime.ts

@@ -364,39 +364,86 @@ export function stackLogs(
 
 /**
  * Health of a running stack: ok when it has containers, all are running, and
- * none reports a failing or pending Docker healthcheck.
+ * none reports a failing or pending Docker healthcheck. `ok: null` when
+ * docker could not be asked: container state unknown is not "not running".
  */
 export function stackHealth(
   ctx: StackContext,
   s: StackConfig,
   service?: string,
-): { ok: boolean; detail: string } {
+): { ok: boolean | null; detail: string } {
   const project = projectName(s.name, ctx.workspace);
-  const r = run("docker", [
-    "ps",
-    "-a",
-    "--filter",
-    `label=com.docker.compose.project=${project}`,
-    ...(service
-      ? ["--filter", `label=com.docker.compose.service=${service}`]
-      : []),
-    "--format",
-    '{{.Label "com.docker.compose.service"}}\t{{.State}}\t{{.Status}}',
-  ]);
-  if (r.code !== 0) return { ok: false, detail: r.err || "docker ps failed" };
-  const rows = r.out.split("\n").filter(Boolean);
-  if (!rows.length)
+  let r: ReturnType<typeof run>;
+  try {
+    r = run("docker", [
+      "ps",
+      "-a",
+      "--filter",
+      `label=com.docker.compose.project=${project}`,
+      ...(service
+        ? ["--filter", `label=com.docker.compose.service=${service}`]
+        : []),
+      "--format",
+      '{{.Label "com.docker.compose.service"}}\t{{.State}}\t{{.Status}}',
+    ]);
+  } catch (e) {
+    return {
+      ok: null,
+      detail: `container state unknown: ${(e as Error).message}`,
+    };
+  }
+  if (r.code !== 0)
+    return {
+      ok: null,
+      detail: `container state unknown: ${r.err.trim() || "docker ps failed"}`,
+    };
+  const rows = r.out
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => {
+      const [svc = "", state = "", status = ""] = line.split("\t");
+      return { project, service: svc, state, status };
+    });
+  return judgeStackRows(rows, project, service);
+}
+
+/** One compose container, as a `docker ps` listing reports it. */
+export interface ComposeRow {
+  project: string;
+  service: string;
+  state: string;
+  status: string;
+}
+
+/**
+ * The verdict `stack health` gives for `project` (and `service`): ok when it
+ * has containers, all running, none with a failing or starting Docker
+ * healthcheck. Shared by the CLI and the in-process check (compose-health).
+ */
+export function judgeStackRows(
+  rows: ComposeRow[],
+  project: string,
+  service?: string,
+): { ok: boolean; detail: string } {
+  const mine = rows.filter(
+    (r) => r.project === project && (!service || r.service === service),
+  );
+  if (!mine.length)
     return {
       ok: false,
       detail: `${project}${service ? `/${service}` : ""}: not running`,
     };
-  const bad = rows.filter((row) => {
-    const [, state, status] = row.split("\t");
-    return (
-      state !== "running" || /\((unhealthy|health: starting)\)/.test(status)
-    );
-  });
+  const bad = mine.filter(
+    (r) =>
+      r.state !== "running" ||
+      /\((unhealthy|health: starting)\)/.test(r.status),
+  );
   return bad.length
-    ? { ok: false, detail: bad.join("; ") }
-    : { ok: true, detail: `${rows.length} container(s) running` };
+    ? {
+        ok: false,
+        detail: bad
+          .map((r) => `${r.service}\t${r.state}\t${r.status}`)
+          .join("; "),
+      }
+    : { ok: true, detail: `${mine.length} container(s) running` };
 }

package/src/shared/stacks/status.ts

@@ -3,13 +3,18 @@
  * The CLI prints it; the web server serves it at /api/stacks (and through it
  * the MCP `stacks` tool).
  */
+import { spawnSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import { readCatalog } from "../environment-manager/catalog.js";
 import { readEdgeConfig } from "../edge/config.js";
 import { routeUrl } from "../edge/render.js";
 import {
   getFocusedWorkspaceName,
   getWorkspaceByName,
+  listWorkspaceServices,
 } from "../environment-manager/workspaces.js";
-import { readStacks } from "./config.js";
+import { readManifestStacks, readStacks } from "./config.js";
 import { projectName, stackWorkspace } from "./render.js";
 import { stackHealth, type StackContext } from "./runtime.js";
 
@@ -29,7 +34,8 @@ export interface StackStatus {
   routes: StackRoute[];
   uses: string[];
   /** Container health (only when asked for: it runs `docker ps`). */
-  health?: { ok: boolean; detail: string };
+  /** `ok: null`: docker could not be asked, so the state is unknown. */
+  health?: { ok: boolean | null; detail: string };
 }
 
 const WS_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
@@ -91,9 +97,112 @@ export function stackStatuses(
       try {
         status.health = healthOf(ctx, s);
       } catch (e) {
-        status.health = { ok: false, detail: (e as Error).message };
+        status.health = { ok: null, detail: (e as Error).message };
       }
     }
     return status;
   });
 }
+
+/** A running Compose project started from one of a workspace's repos. */
+export interface WorkspaceStack {
+  /** The Den stack name, or the project name for a stack the repo runs. */
+  name: string;
+  repo: string;
+  project: string;
+}
+
+/** A running Compose project and the directory it was started from. */
+export interface RunningProject {
+  project: string;
+  /** `com.docker.compose.project.working_dir`; "" when unlabelled. */
+  workingDir: string;
+}
+
+/**
+ * The Compose projects with running containers, from one `docker ps`; null
+ * when docker can't be asked (not installed, daemon down, too slow).
+ */
+export function runningComposeProjects(): RunningProject[] | null {
+  const r = spawnSync(
+    "docker",
+    [
+      "ps",
+      "--format",
+      '{{.Label "com.docker.compose.project"}}\t{{.Label "com.docker.compose.project.working_dir"}}',
+    ],
+    { encoding: "utf-8", timeout: 5_000, stdio: ["ignore", "pipe", "ignore"] },
+  );
+  if (r.error || r.status !== 0) return null;
+  const seen = new Map<string, RunningProject>();
+  for (const line of (r.stdout ?? "").split("\n")) {
+    const [project = "", workingDir = ""] = line.trim().split("\t");
+    if (project && !seen.has(project))
+      seen.set(project, { project, workingDir: workingDir.trim() });
+  }
+  return [...seen.values()];
+}
+
+/** `p` and its realpath (compose may record either form). */
+function pathForms(p: string): string[] {
+  try {
+    const real = fs.realpathSync(p);
+    return real === p ? [p] : [p, real];
+  } catch {
+    return [p];
+  }
+}
+
+/**
+ * `workspace`'s running compose stacks: what `workspace deactivate` leaves
+ * up, since it releases only the daemons Den tracks. A project counts when
+ * it is a Den stack one of the workspace's repos declares (`compose:`, named
+ * by projectName), or when Compose started it from inside one of the
+ * workspace's checkouts (its working_dir label): the stacks a repo runs
+ * itself, e.g. from `make up`. Null when docker could not be asked.
+ */
+export function runningWorkspaceStacks(
+  workspace: string,
+  running: () => RunningProject[] | null = runningComposeProjects,
+): WorkspaceStack[] | null {
+  const ws = getWorkspaceByName(workspace);
+  if (!ws) return [];
+  const denStacks = new Map<string, { name: string; repo: string }>();
+  const checkouts: { repo: string; forms: string[] }[] = [];
+  try {
+    const { stackWorkspace: suffix } = resolveStackWorkspaces(workspace);
+    for (const s of Object.values(readManifestStacks(workspace)))
+      denStacks.set(projectName(s.name, suffix), {
+        name: s.name,
+        repo: s.repo,
+      });
+    const seen = new Set<string>();
+    for (const svc of listWorkspaceServices(ws.config, readCatalog(), ws.name))
+      if (svc.repoPath && !seen.has(svc.repoPath)) {
+        seen.add(svc.repoPath);
+        checkouts.push({ repo: svc.repoName, forms: pathForms(svc.repoPath) });
+      }
+  } catch {
+    return null; // an unreadable manifest or workspace name: can't tell
+  }
+  if (denStacks.size === 0 && checkouts.length === 0) return [];
+  const up = running();
+  if (!up) return null;
+  const inside = (dir: string, root: string): boolean =>
+    dir === root || dir.startsWith(`${root}${path.sep}`);
+  const out: WorkspaceStack[] = [];
+  for (const { project, workingDir } of up) {
+    const den = denStacks.get(project);
+    if (den) {
+      out.push({ ...den, project });
+      continue;
+    }
+    if (!workingDir) continue;
+    const dirs = pathForms(workingDir);
+    const owner = checkouts.find((c) =>
+      c.forms.some((root) => dirs.some((d) => inside(d, root))),
+    );
+    if (owner) out.push({ name: project, repo: owner.repo, project });
+  }
+  return out;
+}

package/src/ui/cli/health-display.ts

@@ -13,6 +13,7 @@ export function healthLabelText(health: HealthState): string {
 export function formatHealthLabel(health: HealthState): string {
   if (health === "ok") return chalk.green("● ok");
   if (health === "error") return chalk.red("● down");
+  if (health === "pending") return chalk.gray("● pending");
   return chalk.gray("● unknown");
 }