@monster-orange/den 0.2.5 → 0.2.7

package/src/scripts/register-repos.ts

@@ -29,6 +29,7 @@ import {
 } from "../shared/environment-manager/default-workspace.js";
 
 import { product } from "../shared/product.js";
+import { plural } from "../shared/plural.js";
 // Anchored to the den root, NOT process.cwd() — this script WRITES
 // config/local/* and a cwd-derived root once put den files in another repo.
 const ROOT = getDistRoot();
@@ -179,7 +180,7 @@ async function legacyScanAndSelect(): Promise<void> {
         fs.readFileSync(REGISTERED_FILE, "utf-8"),
       ) as string[];
       console.log(
-        `  Current: ${existing.length} repo(s) registered for testing\n`,
+        `  Current: ${plural(existing.length, "repo")} registered for testing\n`,
       );
     } catch {
       /* corrupt file — start fresh */
@@ -223,7 +224,7 @@ async function legacyScanAndSelect(): Promise<void> {
   fs.writeFileSync(REGISTERED_FILE, JSON.stringify(selected, null, 2) + "\n");
 
   console.log(
-    `\n  Registered ${selected.length} repo(s) → config/local/registered-repos.json`,
+    `\n  Registered ${plural(selected.length, "repo")} → config/local/registered-repos.json`,
   );
   console.log("  Run `make register-repos` again at any time to update.\n");
 }
@@ -282,7 +283,7 @@ async function main(): Promise<void> {
     console.log(
       "  Local Dev is enabled but no workspace exists yet. Your first" +
         ` \`${product().cli}\` command\n  seeds the default workspace with every standard` +
-        ` system repo, all managed\n  out of the box (${plan.repos.length} repos):\n`,
+        ` system repo, all managed\n  out of the box (${plural(plan.repos.length, "repo")}):\n`,
     );
     console.log(`    ${plan.repos.join(", ")}\n`);
     console.log(

package/src/shared/den-config.ts

@@ -636,6 +636,8 @@ export interface ResolvedWorkspaceBlueprint {
   branch: string;
   autostartOff: string[];
   focus: boolean;
+  /** `org:` (ORG-1a): the org this workspace belongs to, when the blueprint names one. */
+  org?: string;
 }
 
 /** Which blueprint shape the distribution uses, and its workspaces. */
@@ -644,7 +646,7 @@ export interface WorkspaceBlueprints {
   workspaces: ResolvedWorkspaceBlueprint[];
 }
 
-const BLUEPRINT_KEYS = ["branch", "repos", "autostart_off"];
+const BLUEPRINT_KEYS = ["branch", "repos", "autostart_off", "org"];
 
 function blueprintStrings(where: string, key: string, v: unknown): string[] {
   if (v === undefined) return [];
@@ -674,12 +676,15 @@ function resolveBlueprint(
     throw new Error(`${where}.branch must be a branch name`);
   if (bp.focus !== undefined && typeof bp.focus !== "boolean")
     throw new Error(`${where}.focus must be true or false`);
+  if (bp.org !== undefined && (typeof bp.org !== "string" || !bp.org.trim()))
+    throw new Error(`${where}.org must be an org id (a key of orgs:)`);
   return {
     name,
     repos: blueprintStrings(where, "repos", bp.repos),
     branch,
     autostartOff: blueprintStrings(where, "autostart_off", bp.autostart_off),
     focus: bp.focus === true,
+    ...(typeof bp.org === "string" ? { org: bp.org.trim() } : {}),
   };
 }
 
@@ -864,6 +869,38 @@ export function readReleaseConfig(): ReleaseConfig {
   return cfg;
 }
 
+/**
+ * `release.org` as configured (den.yml, then user.yml), without the
+ * `github_org` fallback readReleaseConfig fills in. An explicit value is the
+ * release owner of every repo (REL-1); unset, each repo's own catalog owner is.
+ */
+export function readExplicitReleaseOrg(): string | undefined {
+  const den = mergeReleaseLayer(
+    DEFAULT_RELEASE_CONFIG,
+    readDenConfig().release,
+  );
+  const org = mergeReleaseLayer(den, readUserConfig().release).org;
+  return typeof org === "string" && org.trim() ? org.trim() : undefined;
+}
+
+/**
+ * The GitHub owner a repo is released from (REL-1): an explicit
+ * `release.org` wins, then the repo's non-empty catalog owner, then
+ * `github_org`. "" when none is known.
+ */
+export function releaseOwnerFor(opts: {
+  explicitOrg?: string;
+  catalogOwner?: string;
+  githubOrg?: string;
+}): string {
+  return (
+    opts.explicitOrg?.trim() ||
+    opts.catalogOwner?.trim() ||
+    opts.githubOrg?.trim() ||
+    ""
+  );
+}
+
 /**
  * Persist a personal release override to config/local/user.yml (gitignored).
  * Used by the Release tab's wave editor — team defaults stay in den.yml.

package/src/shared/environment-manager/catalog.ts

@@ -55,7 +55,8 @@ export function upsertCatalogEntry(
 /**
  * GitHub slug to clone `repoName` from.
  *
- * The catalog's `gh` when set, else the conventional `<github_org>/<repo>` —
+ * The catalog's `gh` when set, else the conventional `<org>/<repo>`, where
+ * `<org>` is the workspace's resolved org (`github_org` when none is given) —
  * the same rule `seedDefaultWorkspace` uses. Entries written by the
  * dev-managed add flow carry `gh: ""`, so a repo can be IN the catalog and
  * still have no slug; deriving it (rather than refusing to clone) is what lets
@@ -64,10 +65,16 @@ export function upsertCatalogEntry(
 export function resolveRepoGhSlug(
   repoName: string,
   catalog: ServiceCatalog = readCatalog(),
+  /**
+   * The owner for a repo with no `gh`: the workspace's resolved org
+   * (`() => githubOrgFor(ws)`, ORG-1a). Called only when needed, so a repo
+   * with a slug never needs an org. Defaults to `github_org`.
+   */
+  owner: () => string = () => requireGithubOrg(),
 ): string {
   const gh = catalog[repoName]?.gh?.trim();
   if (gh) return gh;
-  return `${requireGithubOrg()}/${repoName}`;
+  return `${owner()}/${repoName}`;
 }
 
 export function removeCatalogEntry(repoName: string): void {

package/src/shared/environment-manager/default-workspace.ts

@@ -5,7 +5,8 @@
  * all managed. On a fresh clone (no local workspace) den offers — once —
  * to seed the `default` workspace from it so `den graph` / `den up` show the
  * full system graph immediately; `den init` (run in the den root) re-seeds.
- * Catalog clone URLs derive as `<github_org>/<repo>`. Switch any repo to a local
+ * Catalog clone URLs derive as `<org>/<repo>`, with the workspace's resolved org
+ * (workspace-org.ts; `github_org` unless the blueprint or catalog says otherwise). Switch any repo to a local
  * checkout with `den use-local <repo>`.
  */
 import {
@@ -16,9 +17,13 @@ import {
 import { readCatalog, writeCatalog } from "./catalog.js";
 import {
   readWorkspaceBlueprints,
-  requireGithubOrg,
   type ResolvedWorkspaceBlueprint,
 } from "../den-config.js";
+import {
+  githubOrgFor,
+  readOrgContext,
+  type OrgContext,
+} from "./workspace-org.js";
 import type {
   ServiceCatalog,
   WorkspaceConfig,
@@ -47,10 +52,6 @@ export function defaultWorkspaceRepos(): string[] {
   return singleBlueprint()?.repos ?? [];
 }
 
-function org(): string {
-  return requireGithubOrg();
-}
-
 function blueprintServices(
   bp: ResolvedWorkspaceBlueprint,
   repos: string[] = bp.repos,
@@ -70,14 +71,41 @@ function blueprintServices(
   return services;
 }
 
+/**
+ * The clone slug seeding would give each repo the catalog has no `gh` for:
+ * `<org>/<repo>` with its workspace's resolved org. A repo in several
+ * workspaces takes the first one's. Reads only; throws when a repo needs an
+ * org and none resolves (no org anywhere and no `github_org`).
+ */
+export function catalogFill(
+  workspaces: { name: string; repos: string[] }[],
+  catalog: ServiceCatalog = readCatalog(),
+  ctx: OrgContext = readOrgContext(),
+): Map<string, string> {
+  const fill = new Map<string, string>();
+  for (const ws of workspaces)
+    for (const repo of ws.repos) {
+      if (catalog[repo]?.gh || fill.has(repo)) continue;
+      fill.set(repo, `${githubOrgFor(ws.name, ctx)}/${repo}`);
+    }
+  return fill;
+}
+
+/**
+ * Give each blueprint repo with no clone URL `<org>/<repo>`, where `<org>` is
+ * its workspace's resolved org (ORG-1a: the blueprint's `org:`, else the
+ * catalog owners, else `github_org`), so a client workspace never clones
+ * from the default org on a fresh machine. The org is resolved only for a
+ * repo that needs one, and before anything is written: an unresolvable org
+ * throws with the catalog untouched.
+ */
 function fillCatalog(
-  repos: string[],
+  workspaces: { name: string; repos: string[] }[],
   catalog: ServiceCatalog = readCatalog(),
 ): void {
-  const o = org();
-  for (const repo of repos) {
-    if (!catalog[repo]?.gh) catalog[repo] = { gh: `${o}/${repo}` };
-  }
+  const fill = catalogFill(workspaces, catalog);
+  if (fill.size === 0) return;
+  for (const [repo, gh] of fill) catalog[repo] = { gh };
   writeCatalog(catalog);
 }
 
@@ -117,6 +145,53 @@ export function defaultWorkspaceHasServices(): boolean {
   );
 }
 
+function sameEntry(a: unknown, b: unknown): boolean {
+  if (a === b) return true;
+  if (typeof a !== "object" || typeof b !== "object" || !a || !b) return false;
+  const ka = Object.keys(a).sort();
+  const kb = Object.keys(b).sort();
+  return (
+    ka.length === kb.length &&
+    ka.every(
+      (k, i) =>
+        k === kb[i] &&
+        sameEntry(
+          (a as Record<string, unknown>)[k],
+          (b as Record<string, unknown>)[k],
+        ),
+    )
+  );
+}
+
+/**
+ * Whether seeding now would change nothing: every workspace the blueprint
+ * seeds holds exactly what seeding writes (same repos, all managed on the
+ * blueprint's branch, same autostart defaults), records the blueprint as
+ * applied, and (multi blueprint) is active. A workspace the user changed
+ * since (a repo switched to a local checkout, one added or removed) is not
+ * "already seeded": seeding would reset it.
+ */
+export function blueprintAlreadySeeded(
+  file: WorkspacesFile = readWorkspacesFile(),
+): boolean {
+  const bps = blueprintWorkspaces();
+  if (bps.length === 0) return false;
+  const multi = isMultiBlueprint();
+  return bps.every((bp) => {
+    const name = multi ? bp.name : "default";
+    const ws = file.workspaces[name];
+    if (!ws) return false;
+    if (multi && !(file.active ?? []).includes(name)) return false;
+    const applied = ws.seeded_repos ?? [];
+    if (
+      applied.length !== bp.repos.length ||
+      bp.repos.some((r, i) => applied[i] !== r)
+    )
+      return false;
+    return sameEntry(ws.services ?? {}, blueprintServices(bp));
+  });
+}
+
 /**
  * Seed (or reset) the `default` workspace from the blueprint — every repo as a
  * bare, first-class managed entry on `branch` — and ensure the catalog has
@@ -131,6 +206,9 @@ export function seedDefaultWorkspace(): string[] {
   if (!bp) return [];
   const repos = bp.repos;
 
+  // The catalog first: it is what can fail (no github_org), and a failure
+  // must leave the workspaces as they were, not reset and uncloneable.
+  fillCatalog([{ name: "default", repos }]);
   const file = readWorkspacesFile();
   file.workspaces.default = {
     ...(file.workspaces.default ?? {}),
@@ -142,7 +220,6 @@ export function seedDefaultWorkspace(): string[] {
     file.focus = "default";
   }
   writeWorkspacesFile(file);
-  fillCatalog(repos);
   return repos;
 }
 
@@ -155,6 +232,7 @@ export function seedDefaultWorkspace(): string[] {
 export function seedBlueprintWorkspaces(): { name: string; repos: string[] }[] {
   const bps = blueprintWorkspaces();
   if (bps.length === 0) return [];
+  fillCatalog(bps);
   const file = readWorkspacesFile();
   for (const bp of bps) {
     const prev: WorkspaceConfig | undefined = file.workspaces[bp.name];
@@ -176,7 +254,6 @@ export function seedBlueprintWorkspaces(): { name: string; repos: string[] }[] {
   file.active = [...names, ...kept.filter((n) => !names.includes(n))];
   file.focus = (bps.find((b) => b.focus) ?? bps[0]).name;
   writeWorkspacesFile(file);
-  fillCatalog([...new Set(bps.flatMap((b) => b.repos))]);
   return bps.map((b) => ({ name: b.name, repos: [...b.repos] }));
 }
 
@@ -230,7 +307,8 @@ export function topUpDefaultWorkspace(): string[] {
 
   def.seeded_repos = [...repos];
   writeWorkspacesFile(file);
-  if (missing.length > 0) fillCatalog(missing, catalog);
+  if (missing.length > 0)
+    fillCatalog([{ name: "default", repos: missing }], catalog);
   return missing;
 }
 

package/src/shared/environment-manager/health.ts

@@ -12,7 +12,10 @@ import { readEdgeConfig } from "../edge/config.js";
 import {
   composeHealth,
   composeHealthTarget,
+  containerHealth,
   type ComposeHealthTarget,
+  type ComposeVerdict,
+  type ContainerHealthTarget,
 } from "../stacks/compose-health.js";
 import * as fs from "fs";
 import * as os from "os";
@@ -38,7 +41,11 @@ import {
   listWorkspaceServices,
   readManifestAnyBranch,
 } from "./workspaces.js";
-import type { ResolvedService, ServiceCatalog } from "../types/index.js";
+import type {
+  ResolvedService,
+  ServiceCatalog,
+  ServiceHealthConfig,
+} from "../types/index.js";
 import type { Environment } from "../types/index.js";
 
 import { product } from "../product.js";
@@ -223,6 +230,28 @@ function trustContext(): { context: tls.SecureContext; agent: https.Agent } {
   return _trust;
 }
 
+/**
+ * The body a reverse proxy sends for a host it has no route for: Traefik's
+ * default 404 (Go's http.NotFound). Behind a shared edge a stopped service
+ * answers with this instead of refusing the connection, so a 4xx-means-up
+ * rule would show it healthy. A service's own 404 carries its own body.
+ */
+const EDGE_NO_ROUTE_BODY = "404 page not found";
+
+/** Up: 2xx, or a 4xx from the service itself (auth/route proves it answers). */
+function statusOk(status: number, body404?: string): boolean {
+  if (status === 404 && body404?.trim() === EDGE_NO_ROUTE_BODY) return false;
+  return status < 300 || (status >= 400 && status < 500);
+}
+
+/** The PingResult for `status`, naming an edge 404 as "no route". */
+function statusResult(status: number, body404?: string): PingResult {
+  const ok = statusOk(status, body404);
+  return ok || status !== 404
+    ? { ok, status }
+    : { ok, status, error: "no route (edge 404)" };
+}
+
 /**
  * HTTPS check. Connects to the c-ares-resolved IP (see above) but keeps the
  * hostname for SNI and certificate verification; rewriting the URL to the IP,
@@ -269,11 +298,23 @@ async function pingHttps(parsed: URL, timeoutMs: number): Promise<PingResult> {
       },
       (res) => {
         const status = res.statusCode ?? 0;
-        res.resume(); // discard the body
-        done({
-          ok: status < 300 || (status >= 400 && status < 500),
-          status,
+        if (status !== 404) {
+          res.resume(); // discard the body
+          done({ ok: statusOk(status), status });
+          return;
+        }
+        // A 404: read a little of the body to tell the edge's own "no
+        // route" from the service's 404.
+        let body = "";
+        res.setEncoding("utf8");
+        res.on("data", (c: string) => {
+          if (body.length < 64) body += c;
+          if (body.length >= 64) res.destroy();
         });
+        const finish = () => done(statusResult(status, body));
+        res.on("end", finish);
+        res.on("close", finish);
+        res.on("error", finish);
       },
     );
     const timer = setTimeout(() => {
@@ -327,11 +368,20 @@ async function pingOnce(
     // (e.g. VPN / /etc/hosts) returning 301 on port 80 for services that actually run
     // on a different port — the previous `< 500` check showed those as green.
     // 5xx = unhealthy (service errored).
-    const ok = res.status < 300 || (res.status >= 400 && res.status < 500);
-    // Discard the body: only the status matters, and unconsumed bodies pin
-    // sockets in the long-lived web server (one leak per poll adds up).
+    // A 404 may be the edge's own "no route" (see EDGE_NO_ROUTE_BODY): read
+    // a little of it. Otherwise discard the body: only the status matters,
+    // and unconsumed bodies pin sockets in the long-lived web server.
+    if (res.status === 404) {
+      let body = "";
+      try {
+        body = (await res.text()).slice(0, 64);
+      } catch {
+        /* unreadable body: judge by the status alone */
+      }
+      return statusResult(res.status, body);
+    }
     void res.body?.cancel().catch(() => {});
-    return { ok, status: res.status };
+    return { ok: statusOk(res.status), status: res.status };
   } catch (e: unknown) {
     clearTimeout(timer);
     const err = e as Error;
@@ -595,12 +645,39 @@ export async function pingShellCheck(
   compose: ComposeHealthTarget | null,
 ): Promise<PingResult> {
   if (!compose || cmd !== compose.cmd) return pingShell(cmd, extraEnv, cwd);
-  const v = await composeHealth(compose);
+  return verdictPing(await composeHealth(compose));
+}
+
+/**
+ * A compose or container verdict as a ping. One conversion for both, so a
+ * docker that could not be asked reads the same: `ok: null`, pending (and so
+ * down on a repeat) only when the listing ran past its budget.
+ */
+function verdictPing(v: ComposeVerdict): PingResult {
   if (v.ok === true) return { ok: true };
   if (v.ok === false) return { ok: false, error: v.detail };
   return { ok: null, error: v.detail, ...(v.pending ? { pending: true } : {}) };
 }
 
+/**
+ * Run a `type: container` check: answered in-process from the shared docker
+ * listing (the one Den's compose checks use), never a docker call of its own.
+ */
+export async function pingContainerCheck(
+  target: ContainerHealthTarget,
+): Promise<PingResult> {
+  return verdictPing(await containerHealth(target));
+}
+
+/** The container a `type: container` health config names. */
+export function containerTarget(
+  h: Extract<ServiceHealthConfig, { type: "container" }>,
+): ContainerHealthTarget {
+  return h.container_name !== undefined
+    ? { container_name: h.container_name }
+    : { project: h.project, service: h.service };
+}
+
 /** A ping result as a ServiceHealthResult health state. */
 export function healthState(r: PingResult): ServiceHealthResult["health"] {
   return r.ok === true ? "ok" : r.ok === false ? "error" : "pending";
@@ -710,13 +787,15 @@ export async function checkServiceHealth(
   const result = await pingTwiceOnTimeout(() =>
     healthCfg.type === "shell"
       ? pingShellCheck(healthCfg.cmd, {}, resolved.repoPath, compose)
-      : pingHttp(
-          healthCfg.url,
-          env === "local" && plan.placement.runs !== "remote"
-            ? HEALTH_CHECK_TIMEOUT_MS
-            : HOSTED_HEALTH_CHECK_TIMEOUT_MS,
-          plan.expect,
-        ),
+      : healthCfg.type === "container"
+        ? pingContainerCheck(containerTarget(healthCfg))
+        : pingHttp(
+            healthCfg.url,
+            env === "local" && plan.placement.runs !== "remote"
+              ? HEALTH_CHECK_TIMEOUT_MS
+              : HOSTED_HEALTH_CHECK_TIMEOUT_MS,
+            plan.expect,
+          ),
   );
 
   return {

package/src/shared/environment-manager/service-runner.ts

@@ -69,7 +69,7 @@ import type {
   WorkspaceConfig,
 } from "../types/index.js";
 import type { ChildProcess } from "child_process";
-import { getStateDir } from "../paths.js";
+import { getDistRoot, getStateDir } from "../paths.js";
 
 import { product } from "../product.js";
 // Re-export so existing callers don't need to change their import path.
@@ -101,6 +101,33 @@ export interface DaemonRecord {
    * command. Optional for backward-compat with records written before this.
    */
   containers?: string[];
+  /**
+   * The distribution root (realpath) whose server or CLI registered this
+   * daemon. Every root of a product shares one daemons file, so startup
+   * pruning skips records stamped by another root. Missing on records
+   * written before 0.2.7.
+   */
+  root?: string;
+}
+
+/** This process's distribution root, as stamped on its daemon records. */
+function daemonRoot(): string | null {
+  try {
+    return fs.realpathSync(getDistRoot());
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Whose a daemon record is: this root's, another root's (all roots of a
+ * product share one daemons file), or unstamped (written before 0.2.7).
+ */
+export function daemonRootOf(
+  d: Pick<DaemonRecord, "root">,
+): "here" | "other" | "unstamped" {
+  if (!d.root) return "unstamped";
+  return d.root === daemonRoot() ? "here" : "other";
 }
 
 export type ServiceConflictReason = "identity_mismatch" | "orphan_containers";
@@ -263,8 +290,10 @@ export function registerDaemon(record: DaemonRecord): void {
     ? (existing?.workspaces ?? [])
     : [];
   const workspaces = [...new Set([...inherited, ...(record.workspaces ?? [])])];
+  const root = daemonRoot() ?? record.root;
   _daemonRegistry.set(record.address, {
     ...record,
+    ...(root ? { root } : {}),
     workspaces,
     branch: normalizeBranch(record.branch),
   });
@@ -296,9 +325,17 @@ export function updateDaemonContainers(
   saveDaemonsFile(getDaemonsFile());
 }
 
+/**
+ * This root's daemons (and unstamped legacy ones). Every root of a product
+ * shares one daemons file; another root's records stay in it untouched but
+ * are not listed, so this server never shows, stops, releases or sweeps
+ * them. Lookups by address (findDaemonByAddress) still see every record.
+ */
 export function listDaemons(): DaemonRecord[] {
   loadDaemonsFromFile();
-  return Array.from(_daemonRegistry.values());
+  return Array.from(_daemonRegistry.values()).filter(
+    (d) => daemonRootOf(d) !== "other",
+  );
 }
 
 export function findDaemonByAddress(address: string): DaemonRecord | undefined {
@@ -646,8 +683,11 @@ export function isDaemonVerifiablyDead(
  * clear stale entries from previous sessions. Otherwise they reopen as tabs in
  * the web UI and clutter the shutdown prompt.
  *
- * A daemon is dropped when:
- *  - its address no longer resolves to a workspace/catalog service, OR
+ * A daemon stamped by another root (all roots of a product share the file)
+ * is never touched. Otherwise it is dropped when:
+ *  - it was stamped by this root and its address no longer resolves to a
+ *    workspace/catalog service (an unstamped legacy record might belong to
+ *    another root, so this alone never drops one), OR
  *  - it is opctl-based (has captured containers or a discoverable dev-op) and
  *    NONE of its candidate containers are currently running.
  *
@@ -687,7 +727,13 @@ function pruneAgainst(
   const pruned: string[] = [];
   for (const d of daemons) {
     try {
-      if (!canResolveDaemonAddress(d)) {
+      const root = daemonRootOf(d);
+      // Another root's daemon: its services resolve in its workspaces, not
+      // ours, and its liveness is its own server's call.
+      if (root === "other") continue;
+      // An unresolvable address is only proof of staleness for a record
+      // this root wrote; an unstamped one may belong to another root.
+      if (root === "here" && !canResolveDaemonAddress(d)) {
         unregisterDaemon(d.address);
         pruned.push(d.address);
         continue;

package/src/shared/environment-manager/workspace-manager.ts

@@ -91,7 +91,8 @@ function gitCapture(cmd: string, cwd?: string): string {
   }).trim();
 }
 
-function ghCloneUrl(ghSlug: string): string {
+/** The HTTPS URL a managed clone of `ghSlug` is made from. */
+export function ghCloneUrl(ghSlug: string): string {
   return `https://github.com/${ghSlug}.git`;
 }