@monster-orange/den 0.2.5 → 0.2.6

package/src/ui/cli/service-command.ts

@@ -9,6 +9,11 @@
  * `install` (which also restarts a running service) says the service is
  * running only once the web server answers /api/server-info with JSON: a
  * fresh server takes a few seconds to start, and answers empty until then.
+ *
+ * `install --plan` is read-only: it prints the plist install would write
+ * (install.sh print), the label, the paths and whose server answers on the
+ * port, and writes and loads nothing; exit 1 when that server is foreign.
+ * `status` also names a foreign server on the port.
  */
 import { spawnSync } from "child_process";
 import * as os from "os";
@@ -20,6 +25,17 @@ import {
 } from "../../shared/den-config.js";
 import { readWebPort } from "../../shared/edge/config.js";
 import { getDistRoot, getEngineRoot } from "../../shared/paths.js";
+import { product } from "../../shared/product.js";
+import {
+  classifyServerInfo,
+  ForeignServerError,
+  foreignServerMessage,
+  identifyServer,
+  ownServer,
+  pickAnotherPortHint,
+  type OwnServer,
+  type ServerIdentity,
+} from "./server-identity.js";
 
 /** Runs a command with extra env vars; returns its exit code. */
 export type ServiceRunner = (
@@ -30,6 +46,14 @@ export type ServiceRunner = (
 
 const SUBCOMMANDS = ["install", "status", "print", "uninstall"] as const;
 
+/** The flags each subcommand takes; any other is refused before acting. */
+const SUBCOMMAND_FLAGS: Record<(typeof SUBCOMMANDS)[number], string[]> = {
+  install: ["--plan"],
+  status: [],
+  print: [],
+  uninstall: [],
+};
+
 const defaultRunner: ServiceRunner = (cmd, args, env) =>
   spawnSync(cmd, args, { stdio: "inherit", env: { ...process.env, ...env } })
     .status ?? 1;
@@ -39,12 +63,15 @@ export const READY_TIMEOUT_MS = 30_000;
 
 /**
  * Poll `url` until it answers 2xx with a JSON object, or `timeoutMs` passes.
- * Each attempt is bounded too, so a hung connection cannot outlast it.
+ * Each attempt is bounded too, so a hung connection cannot outlast it. A
+ * server that is not `own`'s (another distribution's, on the same port) is
+ * never "running": that throws ForeignServerError at once.
  */
 export async function waitForServerInfo(
   url: string,
   timeoutMs: number = READY_TIMEOUT_MS,
   intervalMs = 500,
+  own: OwnServer = ownServer(),
 ): Promise<boolean> {
   const deadline = Date.now() + timeoutMs;
   for (;;) {
@@ -56,9 +83,15 @@ export async function waitForServerInfo(
       });
       if (res.ok) {
         const body: unknown = JSON.parse(await res.text());
-        if (body !== null && typeof body === "object") return true;
+        if (body !== null && typeof body === "object") {
+          const id = classifyServerInfo(body, own);
+          if (id.kind === "foreign")
+            throw new ForeignServerError(Number(new URL(url).port), id.who);
+          return true;
+        }
       }
-    } catch {
+    } catch (e) {
+      if (e instanceof ForeignServerError) throw e;
       /* not up yet: refused, empty or partial body */
     }
     await new Promise((r) => setTimeout(r, intervalMs));
@@ -74,9 +107,32 @@ export interface ServiceDeps {
   platform?: NodeJS.Platform;
   /** The web UI port (default: config web.port). */
   webPort?: number;
-  /** Readiness poller (default: waitForServerInfo). */
-  waitReady?: (url: string, timeoutMs: number) => Promise<boolean>;
+  /**
+   * Readiness poller (default: waitForServerInfo). Throws
+   * ForeignServerError when another distribution's server answers.
+   */
+  waitReady?: (
+    url: string,
+    timeoutMs: number,
+    own: OwnServer,
+  ) => Promise<boolean>;
   log?: (line: string) => void;
+  /** Whose server answers on a port (default: identifyServer). */
+  identify?: (port: number, own: OwnServer) => Promise<ServerIdentity>;
+}
+
+/** One line on whose server answers on `port`. */
+export function identityLine(port: number, id: ServerIdentity): string {
+  switch (id.kind) {
+    case "none":
+      return `port ${port}: free (nothing listening)`;
+    case "unresponsive":
+      return `port ${port}: something accepted the connection but did not answer`;
+    case "ours":
+      return `port ${port}: this distribution's server${id.version ? ` (Den ${id.version})` : ""}${id.pid ? `, pid ${id.pid}` : ""}`;
+    case "foreign":
+      return `${foreignServerMessage(port, id.who)}; not this distribution's server`;
+  }
 }
 
 /** Run `service <sub>`; returns the exit code. */
@@ -84,13 +140,30 @@ export async function cmdService(
   args: string[],
   deps: ServiceDeps = {},
 ): Promise<number> {
-  const sub = args[0];
+  const sub = args[0] as (typeof SUBCOMMANDS)[number] | undefined;
   if (!(SUBCOMMANDS as readonly string[]).includes(sub ?? ""))
     throw new Error(
       `${sub ? `Unknown service command "${sub}". ` : ""}Use: ${SUBCOMMANDS.join(" | ")}`,
     );
-  // print only writes the plist; the rest talk to launchd.
-  if (sub !== "print" && (deps.platform ?? process.platform) !== "darwin")
+  // A typo'd --plan must not install for real.
+  const extra = args
+    .slice(1)
+    .filter((a) => !SUBCOMMAND_FLAGS[sub!].includes(a));
+  if (extra.length)
+    throw new Error(
+      `service ${sub}: unknown argument${extra.length > 1 ? "s" : ""} ${extra.join(" ")}` +
+        (SUBCOMMAND_FLAGS[sub!].length
+          ? ` (takes ${SUBCOMMAND_FLAGS[sub!].join(", ")})`
+          : ""),
+    );
+  const plan = sub === "install" && args.includes("--plan");
+  // print (and install --plan) only write the plist to stdout; the rest
+  // talk to launchd.
+  if (
+    sub !== "print" &&
+    !plan &&
+    (deps.platform ?? process.platform) !== "darwin"
+  )
     throw new Error(
       "the web UI service is a launchd LaunchAgent: macOS only (print works anywhere)",
     );
@@ -105,19 +178,70 @@ export async function cmdService(
     "service",
     "install.sh",
   );
-  const code = (deps.run ?? defaultRunner)("bash", [script, sub!], {
+  const env = {
     DEN_ROOT: distRoot,
     DEN_SERVICE_LABEL: label,
     DEN_SERVICE_LOGS: logs,
+  };
+  const run = deps.run ?? defaultRunner;
+  const log = deps.log ?? ((l: string) => console.log(l));
+  const port = deps.webPort ?? readWebPort(distRoot);
+  const own: OwnServer = { root: distRoot, product: product().name };
+  const identify =
+    deps.identify ?? ((p: number, o: OwnServer) => identifyServer(p, o));
+
+  if (plan) {
+    const home = deps.home ?? os.homedir();
+    log(`service install --plan (read-only: nothing is written or loaded)`);
+    log(`  label:   ${label}`);
+    log(
+      `  plist:   ${path.join(home, "Library", "LaunchAgents", `${label}.plist`)}`,
+    );
+    log(`  logs:    ${path.join(logs, "web.log")}`);
+    log(`  root:    ${distRoot}`);
+    log(`  engine:  ${path.dirname(path.dirname(script))}`);
+    log(`  url:     http://localhost:${port}`);
+    const id = await identify(port, own);
+    log(`  server:  ${identityLine(port, id)}`);
+    log(`  plist it would write:`);
+    // install.sh print writes the plist to stdout only.
+    const code = run("bash", [script, "print"], env);
+    if (code !== 0) return code;
+    if (id.kind === "foreign") {
+      log(`✗ install would refuse this port: ${pickAnotherPortHint()}`);
+      return 1;
+    }
+    return 0;
+  }
+
+  const code = run("bash", [script, sub!], {
+    ...env,
     // The script then leaves saying "running" to us (after the poll below).
     ...(sub === "install" ? { DEN_SERVICE_READY_CHECK: "external" } : {}),
   });
+  if (sub === "status") {
+    const id = await identify(port, own);
+    if (id.kind === "foreign") log(`✗ ${identityLine(port, id)}`);
+    return code;
+  }
   if (sub !== "install" || code !== 0) return code;
 
-  const log = deps.log ?? ((l: string) => console.log(l));
-  const port = deps.webPort ?? readWebPort(distRoot);
   const url = `http://localhost:${port}/api/server-info`;
-  if (await (deps.waitReady ?? waitForServerInfo)(url, READY_TIMEOUT_MS)) {
+  const waitReady =
+    deps.waitReady ??
+    ((u: string, t: number, o: OwnServer) => waitForServerInfo(u, t, 500, o));
+  let ready: boolean;
+  try {
+    ready = await waitReady(url, READY_TIMEOUT_MS, own);
+  } catch (e) {
+    if (!(e instanceof ForeignServerError)) throw e;
+    log(
+      `✗ ${label} installed, but ${foreignServerMessage(e.port, e.who)}, ` +
+        `so it cannot serve there: ${pickAnotherPortHint()}`,
+    );
+    return 1;
+  }
+  if (ready) {
     log(
       `✓ ${label} running at http://localhost:${port} (logs: ${path.join(logs, "web.log")})`,
     );

package/src/ui/cli/spinner.ts

@@ -0,0 +1,48 @@
+/**
+ * The CLI's progress spinners (ora).
+ *
+ * Spinners are progress, not diagnostics: on a terminal they animate on
+ * stderr as usual; piped (CI, scripts) their lines go to stdout so stderr
+ * carries only real warnings and errors.
+ *
+ * They animate only on a terminal with a known, non-zero width. ora
+ * divides each line's width by the column count to know how many lines to
+ * clear before the next frame: on a pty that reports 0 columns (one nobody
+ * sized, as agent shells and some CI runners give) that is Infinity and the
+ * spinner clears lines forever. Without a usable terminal a spinner prints
+ * plain lines instead: its text once on start, and the final line.
+ */
+import oraSpinner, { type Ora } from "ora";
+
+/** A stream as a spinner sees it: a TTY, maybe, with a width, maybe. */
+export interface SpinnerStream extends NodeJS.WritableStream {
+  isTTY?: boolean;
+  columns?: number;
+}
+
+/** Whether a spinner can draw frames on `stream`. */
+export function canAnimate(stream: SpinnerStream): boolean {
+  return (
+    stream.isTTY === true &&
+    typeof stream.columns === "number" &&
+    Number.isFinite(stream.columns) &&
+    stream.columns > 0
+  );
+}
+
+function defaultStream(): SpinnerStream {
+  return process.stderr.isTTY ? process.stderr : process.stdout;
+}
+
+/** A spinner showing `text`, on stderr (a terminal) or stdout (piped). */
+export function spinner(
+  text: string,
+  stream: SpinnerStream = defaultStream(),
+): Ora {
+  return oraSpinner({
+    text,
+    stream: stream as NodeJS.WritableStream,
+    // Unset, ora decides (never under CI or TERM=dumb); false: plain lines.
+    ...(canAnimate(stream) ? {} : { isEnabled: false }),
+  });
+}

package/src/ui/cli/web-command.ts

@@ -13,6 +13,12 @@ import { getDistRoot, getEngineRoot, getStateDir } from "../../shared/paths.js";
 import { hasDenUiMarker } from "../../shared/ui-marker.js";
 import { engineBin, engineModuleFile } from "../../shared/engine.js";
 import { readWebPort } from "../../shared/edge/config.js";
+import {
+  ownServer,
+  processCwd,
+  refuseForeignServer,
+  samePath,
+} from "./server-identity.js";
 
 import { product } from "../../shared/product.js";
 interface WebCommandOptions {
@@ -569,21 +575,55 @@ async function waitForPidsExit(pids: number[]): Promise<boolean> {
   return false;
 }
 
-function findDenWebPids(port: number): number[] {
+/**
+ * Whether `pid` may be this distribution's server by where it runs: a web
+ * server runs from its distribution root, so one whose working directory
+ * is another root is never ours, even when its command line matches (two
+ * distributions on one linked engine run the same entry point). An
+ * unreadable directory does not decide.
+ */
+function runsFromRoot(pid: number, root: string): boolean {
+  const cwd = processCwd(pid);
+  if (!cwd) return true;
+  return samePath(cwd, root);
+}
+
+function isOurWebPid(pid: number, root: string): boolean {
+  const command = commandForPid(pid);
+  return (
+    !!command &&
+    isDenWebCommand(command, webRoots(root)) &&
+    runsFromRoot(pid, root)
+  );
+}
+
+/**
+ * Our server's pids on `port`. `vouched` is the pid of a server the
+ * identity check (server-info: our root, or an older server run from our
+ * root) found ours: it is stopped when it listens on the port even if its
+ * command line names no entry point we recognise. Before, an older Den
+ * installed elsewhere, or a hand-started server, matched no command line,
+ * so `web down` said "not running" and `web restart` "already running".
+ */
+function findDenWebPids(port: number, vouched?: number): number[] {
   const root = getDistRoot();
   const pids = new Set<number>();
   const state = readWebServerState();
-  if (state?.port === port && state.pid) {
-    const command = commandForPid(state.pid);
-    if (command && isDenWebCommand(command, webRoots(state.root || root))) {
-      pids.add(state.pid);
-    }
+  const listeners = listListeningPids(port);
+  // The state file may be shared by distributions of one product name: a
+  // record of another root's server is not ours to stop.
+  if (
+    state?.port === port &&
+    state.pid &&
+    samePath(state.root || root, root) &&
+    (isOurWebPid(state.pid, root) ||
+      (state.pid === vouched && listeners.includes(state.pid)))
+  ) {
+    pids.add(state.pid);
   }
 
-  for (const pid of listListeningPids(port)) {
-    if (isDenWebCommand(commandForPid(pid), webRoots(root))) {
-      pids.add(pid);
-    }
+  for (const pid of listeners) {
+    if (pid === vouched || isOurWebPid(pid, root)) pids.add(pid);
   }
 
   return Array.from(pids);
@@ -611,8 +651,11 @@ export function killWebProcess(pid: number, signal: NodeJS.Signals): void {
   }
 }
 
-async function stopDenWebServer(port: number): Promise<StopServerResult> {
-  const pids = findDenWebPids(port);
+async function stopDenWebServer(
+  port: number,
+  vouched?: number,
+): Promise<StopServerResult> {
+  const pids = findDenWebPids(port, vouched);
   if (pids.length === 0) {
     const state = readWebServerState();
     if (state?.port === port) removeWebServerState();
@@ -636,22 +679,25 @@ async function stopDenWebServer(port: number): Promise<StopServerResult> {
   return { stopped: forced, forced: true, pids };
 }
 
-async function stopBrokenDenWebServer(port: number): Promise<boolean> {
-  return (await stopDenWebServer(port)).stopped;
+async function stopBrokenDenWebServer(
+  port: number,
+  vouched?: number,
+): Promise<boolean> {
+  return (await stopDenWebServer(port, vouched)).stopped;
 }
 
 function recordRunningDenWebServer(port: number): void {
   const root = getDistRoot();
   const state = readWebServerState();
-  if (state?.port === port && state.pid) {
-    const command = commandForPid(state.pid);
-    if (command && isDenWebCommand(command, webRoots(state.root || root)))
-      return;
-  }
+  if (
+    state?.port === port &&
+    state.pid &&
+    samePath(state.root || root, root) &&
+    isOurWebPid(state.pid, root)
+  )
+    return;
 
-  const pids = listListeningPids(port).filter((pid) =>
-    isDenWebCommand(commandForPid(pid), webRoots(root)),
-  );
+  const pids = listListeningPids(port).filter((pid) => isOurWebPid(pid, root));
   const pid = pids[0];
   if (!pid) return;
 
@@ -965,8 +1011,13 @@ export async function cmdWeb(args: string[]): Promise<void> {
 
   const url = buildDenWebUrl(options.port);
 
+  // Never act on another distribution's server: not "already running", and
+  // never a signal to it (down, restart).
+  const identity = await refuseForeignServer(options.port, ownServer());
+  const vouched = identity.kind === "ours" ? identity.pid : undefined;
+
   if (options.action === "down") {
-    const stopped = await stopDenWebServer(options.port);
+    const stopped = await stopDenWebServer(options.port, vouched);
     if (stopped.stopped) {
       const mode = stopped.forced ? "force stopped" : "stopped";
       console.log(
@@ -988,7 +1039,7 @@ export async function cmdWeb(args: string[]): Promise<void> {
   }
 
   if (options.action === "restart") {
-    const stopped = await stopDenWebServer(options.port);
+    const stopped = await stopDenWebServer(options.port, vouched);
     if (stopped.pids.length > 0 && !stopped.stopped) {
       throw new Error(
         `Could not stop ${product().title} web on port ${options.port}.`,
@@ -1015,7 +1066,7 @@ export async function cmdWeb(args: string[]): Promise<void> {
       ),
     );
     console.log(chalk.gray(`  Restarting ${product().title} web...`));
-    const stopped = await stopBrokenDenWebServer(options.port);
+    const stopped = await stopBrokenDenWebServer(options.port, vouched);
     if (!stopped) {
       throw new Error(
         `Could not stop the broken ${product().title} web server on port ${options.port}.`,

package/src/ui/mcp/api.ts

@@ -3,8 +3,19 @@
  * server holds no state of its own: agents and the web UI share the server's
  * state and its guards. This client can reach only the routes below, and it
  * sends the agent's audit headers (see shared/agent-actor.ts) on every call.
+ *
+ * With `identity`, it first makes sure the server on the port is this
+ * distribution's (server-identity.ts): another distribution's server (or an
+ * older Den from another root) on the configured port gets no request, and
+ * every tool says whose server it is instead of serving its data.
  */
 import { product } from "../../shared/product.js";
+import {
+  foreignServerMessage,
+  identifyServer,
+  type OwnServer,
+  type ServerIdentity,
+} from "../cli/server-identity.js";
 import { LIFECYCLE_CMDS, Refusal } from "./guards.js";
 
 export type Query = Record<string, string | string[] | undefined>;
@@ -20,6 +31,47 @@ export class DenWebDown extends Error {
   }
 }
 
+/** Another distribution's server answers on the port: no data from it. */
+export class ForeignWebServer extends Error {
+  constructor(
+    readonly port: number,
+    readonly who: string,
+  ) {
+    super(
+      `${foreignServerMessage(port, who)}; not this distribution's server. ` +
+        `Nothing was read from it. Point web.port (or --port) at this distribution's server.`,
+    );
+    this.name = "ForeignWebServer";
+  }
+}
+
+/** Something answers on the port but would not say whose server it is. */
+export class UnidentifiedWebServer extends Error {
+  constructor(readonly port: number) {
+    super(
+      `the server on port ${port} did not answer /api/server-info in time, ` +
+        `so it is not known to be this distribution's; nothing was read from it. Try again.`,
+    );
+    this.name = "UnidentifiedWebServer";
+  }
+}
+
+/** How long a positive identity check is trusted. */
+export const IDENTITY_TTL_MS = 30_000;
+/** The identity probe's budget: longer than the CLI's, a busy server is ours too. */
+export const IDENTITY_TIMEOUT_MS = 5_000;
+
+export interface IdentityCheck {
+  /** This distribution: its root and product. */
+  own: OwnServer;
+  /** Default identifyServer. */
+  identify?: (port: number, own: OwnServer) => Promise<ServerIdentity>;
+  /** Default IDENTITY_TTL_MS. */
+  ttlMs?: number;
+  /** Default Date.now. */
+  now?: () => number;
+}
+
 /** The web server answered with an error status. */
 export class DenHttpError extends Error {
   constructor(
@@ -157,8 +209,44 @@ export function createDenApi(opts: {
   baseUrl: string;
   cli: string;
   headers: () => Record<string, string>;
+  /** Check whose server it is before any request (the MCP server does). */
+  identity?: IdentityCheck;
 }): DenApi {
   const { baseUrl, cli } = opts;
+  const { hostname } = new URL(baseUrl);
+  const port = Number(new URL(baseUrl).port) || 80;
+  let vouchedAt: number | null = null;
+  let checking: Promise<void> | null = null;
+
+  /** Throws unless the server on the port is ours (cached briefly). */
+  async function ensureOurs(): Promise<void> {
+    const check = opts.identity;
+    if (!check) return;
+    const now = check.now ?? Date.now;
+    if (
+      vouchedAt !== null &&
+      now() - vouchedAt < (check.ttlMs ?? IDENTITY_TTL_MS)
+    )
+      return;
+    checking ??= (async () => {
+      const id = await (
+        check.identify ??
+        ((p: number, o: OwnServer) =>
+          identifyServer(p, o, IDENTITY_TIMEOUT_MS, hostname))
+      )(port, check.own);
+      if (id.kind === "ours") {
+        vouchedAt = now();
+        return;
+      }
+      vouchedAt = null;
+      if (id.kind === "foreign") throw new ForeignWebServer(port, id.who);
+      if (id.kind === "none") throw new DenWebDown(baseUrl, cli);
+      throw new UnidentifiedWebServer(port);
+    })().finally(() => {
+      checking = null;
+    });
+    return checking;
+  }
 
   async function request(
     method: string,
@@ -168,6 +256,7 @@ export function createDenApi(opts: {
     body?: unknown,
   ): Promise<Response> {
     assertAllowedRequest(method, path, query);
+    await ensureOurs();
     try {
       const res = await fetch(buildUrl(baseUrl, path, query), {
         method,
@@ -184,7 +273,11 @@ export function createDenApi(opts: {
       }
       return res;
     } catch (e) {
-      if (isConnectionError(e)) throw new DenWebDown(baseUrl, cli);
+      if (isConnectionError(e)) {
+        // Whatever answers next on the port is checked again.
+        vouchedAt = null;
+        throw new DenWebDown(baseUrl, cli);
+      }
       throw e;
     }
   }

package/src/ui/mcp/server.ts

@@ -18,7 +18,9 @@ import { engineVersion } from "../../shared/paths.js";
 import { product } from "../../shared/product.js";
 import { DEFAULT_PORT } from "../../shared/constants.js";
 import { createDenApi, type DenApi } from "./api.js";
+import { ownServer } from "../cli/server-identity.js";
 import { callTool, toolsFor, type ToolContext } from "./tools.js";
+import { plural } from "../../shared/plural.js";
 
 export interface DenMcpOptions {
   cfg: ResolvedMcpConfig;
@@ -56,6 +58,8 @@ export function createDenMcpServer(opts: DenMcpOptions): McpServer {
     createDenApi({
       baseUrl: opts.baseUrl,
       cli: opts.cli,
+      // Serve nothing from another distribution's server on the port.
+      identity: { own: ownServer() },
       headers: () =>
         agentAuditHeaders({
           client: client()?.name ?? "unknown",
@@ -210,6 +214,7 @@ export async function runMcp(argv: string[]): Promise<void> {
     const api = createDenApi({
       baseUrl,
       cli,
+      identity: { own: ownServer() },
       headers: () =>
         agentAuditHeaders({
           client: `${cli} mcp --call`,
@@ -224,7 +229,7 @@ export async function runMcp(argv: string[]): Promise<void> {
   const server = createDenMcpServer({ cfg, baseUrl, cli });
   await server.connect(new StdioServerTransport());
   process.stderr.write(
-    `${cli} mcp: ${toolsFor(cfg).length} tools ` +
+    `${cli} mcp: ${plural(toolsFor(cfg).length, "tool")} ` +
       `(${cfg.actions.length ? `actions: ${cfg.actions.join(", ")}` : "read only"}) → ${baseUrl}\n`,
   );
 }

package/src/ui/mcp/tools.ts

@@ -14,6 +14,8 @@ import { redactSecrets } from "../../shared/redact.js";
 import {
   DenHttpError,
   DenWebDown,
+  ForeignWebServer,
+  UnidentifiedWebServer,
   type DenApi,
   type Query,
   type StreamResult,
@@ -154,7 +156,7 @@ const READ_TOOLS: DenTool[] = [
   read(
     "status",
     "Service health",
-    "Health of every service in the workspace (what `status` shows): up/down, mode, and what was checked: `url` for an HTTP check, `check` for a shell command.",
+    "Health of every service in the workspace (what `status` shows): up/down, mode, and what was checked: `url` for an HTTP check, `check` for a shell command or a container check (`container <project>/<service>`).",
     { env: envArg, workspace: workspaceArg },
     (a, { api }) =>
       api.get("/api/health", { env: envOf(a), workspace: str(a.workspace) }),
@@ -636,7 +638,9 @@ export async function callTool(
     const msg =
       e instanceof Refusal
         ? `Refused: ${e.message}`
-        : e instanceof DenWebDown
+        : e instanceof DenWebDown ||
+            e instanceof ForeignWebServer ||
+            e instanceof UnidentifiedWebServer
           ? e.message
           : `Error: ${(e as Error).message}`;
     return { text: redactSecrets(msg), isError: true };

package/src/ui/server/health-row.ts

@@ -1,15 +1,18 @@
 /**
  * The fields of a /api/health row that say what was checked. `url` is only
  * ever a URL (or null): a shell check's command (a compose stack's
- * `<cli> stack health …`, or any declared shell check) goes in `check`.
+ * `<cli> stack health …`, or any declared shell check) goes in `check`, as
+ * does a container check's `container <project>/<service>` (or
+ * `container <name>`).
  */
-export type HealthCheckType = "shell" | "http" | "none";
+export type HealthCheckType = "shell" | "http" | "container" | "none";
 
 export function healthCheckFields(
   checkType: HealthCheckType,
   target: string,
 ): { url: string | null; check?: string } {
-  if (checkType === "shell") return { url: null, check: target };
+  if (checkType === "shell" || checkType === "container")
+    return { url: null, check: target };
   if (checkType === "http") return { url: target };
   return { url: null };
 }