@monster-orange/den 0.2.5 → 0.2.7

package/src/ui/cli/index.ts

@@ -12,19 +12,12 @@ import {
 } from "../../shared/stacks/status.js";
 import { isNamedTarget } from "./named-target.js";
 import chalk from "chalk";
-import oraSpinner from "ora";
-
-/**
- * Spinners are progress, not diagnostics: on a terminal they animate on
- * stderr as usual; piped (CI, scripts) their lines go to stdout so stderr
- * carries only real warnings and errors.
- */
-const ora = (text: string) =>
-  oraSpinner({
-    text,
-    stream: process.stderr.isTTY ? process.stderr : process.stdout,
-  });
-import Table from "cli-table3";
+import { noun, plural } from "../../shared/plural.js";
+// Spinners: progress on stderr (a terminal) or stdout (piped); plain lines
+// where they cannot animate. See spinner.ts.
+import { spinner as ora } from "./spinner.js";
+import { newTable } from "./table.js";
+import { validateAll, validateAllFailed } from "./validate-all.js";
 import { cliPrompts } from "./prompts.js";
 import { resultsViewer } from "./results-viewer.js";
 import { testRunner } from "./test-runner.js";
@@ -87,6 +80,7 @@ import {
 import {
   blueprintWorkspaces,
   defaultWorkspaceNeedsSeeding,
+  blueprintAlreadySeeded,
   defaultWorkspaceHasServices,
   isMultiBlueprint,
   seedBlueprintWorkspaces,
@@ -146,7 +140,10 @@ import {
 } from "../../shared/environment-manager/up-plan.js";
 import { execSync } from "child_process";
 import * as fs from "fs";
-import { readManifest } from "../../shared/manifest/read-manifest.js";
+import {
+  heldManifestsDir,
+  readManifest,
+} from "../../shared/manifest/read-manifest.js";
 import * as nodePath from "path";
 import { runInit } from "./init.js";
 import {
@@ -175,6 +172,20 @@ import { cmdConfig } from "./config-command.js";
 import { cmdEdge } from "./edge-command.js";
 import { cmdService } from "./service-command.js";
 import { cmdStack } from "./stack-command.js";
+import {
+  cmdOrg,
+  orgFlag,
+  orgListRows,
+  printOrgWarnings,
+  registerOrg,
+  sameOrg,
+} from "./org-command.js";
+import {
+  buildSetupPlan,
+  renderClonePlan,
+  workspaceClonePlan,
+} from "./clone-plan.js";
+import { githubOrgFor } from "../../shared/environment-manager/workspace-org.js";
 import { cmdWeb, displayWebHelp } from "./web-command.js";
 import { cmdGraph } from "./graph-command.js";
 import { resolveLogsTarget, tailServiceLogs } from "./logs-command.js";
@@ -212,8 +223,11 @@ const WORKSPACE_SUBCOMMANDS: {
 }[] = [
   {
     name: "list",
-    usage: "list",
-    lines: ["every workspace, the active set and the focus"],
+    usage: "list [--org <id>]",
+    lines: [
+      "every workspace, the active set, the focus and its org;",
+      "--org <id> lists one org's workspaces",
+    ],
   },
   {
     name: "activate",
@@ -301,19 +315,31 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
     lines: ["List all registered services in the catalog."],
   },
   register: {
-    usage: "register [path]",
+    usage: "register [path] [--org <id>]",
     lines: [
       "With a path: add that checkout (dev-managed) under its manifest name.",
-      "Without one: pick the repo interactively.",
+      "Without one: pick the repo interactively. A managed clone is picked",
+      "from the focused workspace's org; --org <id> picks from another.",
     ],
   },
   setup: {
-    usage: "setup [service...] [--force|-f]",
+    usage: "setup [service...] [--force|-f] [--plan]",
     lines: [
       "Run 'make setup' once per system (clones missing managed repos first).",
       "Default targets MANAGED clones only — setup's codegen/installs",
       "shouldn't touch your own dev-managed checkouts uninvited.",
       "--force (-f) includes dev-managed repos; naming a service always works.",
+      "--plan prints each repo's org and clone URL and stops: nothing is",
+      "cloned, seeded or written (on a fresh machine: the blueprint's plan).",
+    ],
+  },
+  org: {
+    usage: "org list [--org <id>]",
+    lines: [
+      "Every org: its label, its workspaces, whether it is the default",
+      "(github_org), and any org warnings. A workspace's org is its own org:,",
+      "then the blueprint's org:, then its repos' one catalog owner, then",
+      "github_org.",
     ],
   },
   sync: {
@@ -446,6 +472,7 @@ const TELEMETRY_COMMANDS = new Set<string>([
   `use-managed`,
   "setup",
   "workspace",
+  "org",
   "sync",
   "init",
   "validate",
@@ -496,8 +523,6 @@ function printValidation(
   layer?: string,
 ): void {
   const tag = layer ? `${layer}, ` : "";
-  const plural = (n: number, word: string): string =>
-    `${n} ${word}${n === 1 ? "" : "s"}`;
   if (result.valid && result.warnings.length === 0) {
     console.log(
       chalk.green(`  ✓  ${label}`) +
@@ -754,6 +779,10 @@ class DenCLI {
           await this.cmdWorkspace(args.slice(1));
           break;
 
+        case "org":
+          cmdOrg(args.slice(1));
+          break;
+
         case "sync":
           await this.cmdSync(args.slice(1));
           break;
@@ -761,9 +790,23 @@ class DenCLI {
         case "init": {
           // In the den root, `init` seeds/resets the default workspace; pointed
           // at a service repo it scaffolds that repo's .den.yml (manifest init).
-          const initTarget = args[1] ?? getInvokeCwd();
-          if (nodePath.resolve(initTarget) === getDistRoot()) {
-            await this.seedDefaultWorkspaceFlow("init");
+          const initTarget =
+            args.slice(1).find((a) => !a.startsWith("-")) ?? getInvokeCwd();
+          // Compare real paths: a symlinked tmp or home (/var → /private/var)
+          // must not turn a seed into a manifest scaffold.
+          const real = (p: string) => {
+            try {
+              return fs.realpathSync(nodePath.resolve(p));
+            } catch {
+              return nodePath.resolve(p);
+            }
+          };
+          if (real(initTarget) === real(getDistRoot())) {
+            await this.seedDefaultWorkspaceFlow(
+              "init",
+              args.slice(1).includes("--reset"),
+              "init",
+            );
           } else {
             await runInit(initTarget);
           }
@@ -1097,7 +1140,14 @@ class DenCLI {
       if (!catalogEntry) continue;
       const branch = wsEntry.branch ?? "main";
       try {
-        ensureManagedServiceClone(repoName, catalogEntry.gh, branch);
+        // An entry with `gh: ""` clones from the workspace's org, as `up`
+        // does (and `setup --plan` says), instead of failing on an empty slug.
+        const ghSlug = resolveRepoGhSlug(repoName, catalog, () =>
+          githubOrgFor(ws.name),
+        );
+        if (!catalogEntry.gh?.trim())
+          upsertCatalogEntry(repoName, { ...catalogEntry, gh: ghSlug });
+        ensureManagedServiceClone(repoName, ghSlug, branch);
       } catch (err) {
         console.log(
           chalk.red(
@@ -1198,7 +1248,9 @@ class DenCLI {
       // Catalog entries written by the dev-managed add flow carry `gh: ""`, so
       // an entry can exist yet be unclonable. Derive the conventional slug and
       // persist the repair rather than cloning from an empty URL.
-      const ghSlug = resolveRepoGhSlug(repoName, catalog);
+      const ghSlug = resolveRepoGhSlug(repoName, catalog, () =>
+        githubOrgFor(ws.name),
+      );
       if (!catalog[repoName]?.gh) upsertCatalogEntry(repoName, { gh: ghSlug });
       try {
         // runSetup=false: clone only — setup is run below, hidden + non-interactive.
@@ -1901,6 +1953,25 @@ class DenCLI {
     return seed && knownRepos.has(seed) ? seed : undefined;
   }
 
+  /**
+   * `up --plan`'s clone half (ORG-1a): each repo's org and the URL a missing
+   * managed clone would come from. Read-only, like the rest of the plan.
+   */
+  private renderUpClonePlan(repos: readonly string[]): void {
+    const ws = getActiveWorkspace();
+    if (!ws) return;
+    const lines = renderClonePlan(
+      {
+        fromBlueprint: false,
+        workspaces: [workspaceClonePlan(ws.name, repos)],
+      },
+      product().cli,
+    );
+    console.log(chalk.bold("  Repos and clone URLs:\n"));
+    for (const line of lines) console.log(chalk.gray(`  ${line}`.trimEnd()));
+    console.log();
+  }
+
   /** Render the read-only `den up --plan` view: per-node command + flags. */
   private renderUpPlan(nodes: NodePlan[]): void {
     const tag = (n: NodePlan): string => {
@@ -2014,6 +2085,7 @@ class DenCLI {
       this.renderUpPlan(
         buildUpPlan(graph, rawOrder, { noAutostart: noAutostartSet }),
       );
+      this.renderUpClonePlan(rawOrder);
       return;
     }
     if (dryRun) {
@@ -2225,6 +2297,7 @@ class DenCLI {
       this.renderUpPlan(
         buildUpPlan(graph, rawOrder, { noAutostart: noAutostartSet }),
       );
+      this.renderUpClonePlan(rawOrder);
       return;
     }
     if (dryRun) {
@@ -2284,7 +2357,7 @@ class DenCLI {
     }
     console.log(
       chalk.cyan(
-        `\n  ${only ? "Application" : "Workspace-wide"} up — ${chalk.bold(String(order.length))} systems`,
+        `\n  ${only ? "Application" : "Workspace-wide"} up — ${chalk.bold(String(order.length))} ${noun(order.length, "system")}`,
       ),
     );
     console.log(chalk.gray(`  Order: ${order.join(" → ")}\n`));
@@ -2345,7 +2418,7 @@ class DenCLI {
     const order = [...target.rawOrder].reverse();
     console.log(
       chalk.cyan(
-        `\n  ${only ? "Application" : "Workspace-wide"} down — ${chalk.bold(String(order.length))} systems`,
+        `\n  ${only ? "Application" : "Workspace-wide"} down — ${chalk.bold(String(order.length))} ${noun(order.length, "system")}`,
       ),
     );
     console.log(chalk.gray(`  Order: ${order.join(" → ")}\n`));
@@ -2503,6 +2576,8 @@ class DenCLI {
    */
   private async seedDefaultWorkspaceFlow(
     reason: "auto" | "init",
+    reset = false,
+    via: "init" | "workspace seed" = "workspace seed",
   ): Promise<boolean> {
     const bps = blueprintWorkspaces();
     if (bps.length === 0) {
@@ -2516,13 +2591,43 @@ class DenCLI {
       return false;
     }
     const multi = isMultiBlueprint();
+    // A repeat seed: say so, and touch nothing.
+    if (blueprintAlreadySeeded()) {
+      console.log(
+        chalk.green(
+          multi
+            ? `\n  ✓ ${plural(bps.length, "workspace")} already seeded (${bps.map((b) => b.name).join(", ")}): nothing changed.\n`
+            : `\n  ✓ Default workspace already seeded — ${plural(bps[0].repos.length, "repo")} (managed): nothing changed.\n`,
+        ),
+      );
+      return false;
+    }
     const willReset = defaultWorkspaceHasServices();
     const interactive = !!(process.stdin.isTTY && process.stdout.isTTY);
+    // A reset replaces every entry, dev-managed checkouts included. On a TTY
+    // the user is asked (default No); without one there is nobody to ask, so
+    // only an explicit --reset may do it (SEED-0).
+    if (willReset && !interactive && !reset) {
+      const what = multi
+        ? "the blueprint's workspaces"
+        : "the default workspace";
+      console.error(
+        chalk.red(
+          `\n  ❌ Not resetting ${what}: it has entries, and a reset replaces them all\n` +
+            `     (your own dev-managed checkouts included) with managed clones.\n` +
+            `     Nothing changed. To reset anyway: ${product().cli} ${via} --reset\n`,
+        ),
+      );
+      process.exitCode = 1;
+      return false;
+    }
 
     for (const bp of bps) {
       const label = multi ? `Workspace ${bp.name}` : "Default workspace";
       console.log(
-        chalk.cyan(`\n  ${label} — ${bp.repos.length} repos, all managed:`),
+        chalk.cyan(
+          `\n  ${label} — ${plural(bp.repos.length, "repo")}, all managed:`,
+        ),
       );
       console.log(chalk.gray(`    ${bp.repos.join(", ")}`));
     }
@@ -2563,7 +2668,7 @@ class DenCLI {
       const focus = readWorkspacesFile().focus;
       console.log(
         chalk.green(
-          `  ✓ ${seeded.length} workspaces ready (${seeded.map((w) => w.name).join(", ")}), all active; focus: ${focus}. ` +
+          `  ✓ ${plural(seeded.length, "workspace")} ${willReset ? "reset to the blueprint" : "ready"} (${seeded.map((w) => w.name).join(", ")}), all active; focus: ${focus}. ` +
             `Run \`${product().cli} up <repo>\` to bring up its closure.\n`,
         ),
       );
@@ -2572,7 +2677,7 @@ class DenCLI {
     const seeded = seedDefaultWorkspace();
     console.log(
       chalk.green(
-        `  ✓ Default workspace ready — ${seeded.length} repos (managed). ` +
+        `  ✓ Default workspace ${willReset ? "reset to the blueprint" : "ready"} — ${plural(seeded.length, "repo")} (managed). ` +
           `Run \`${product().cli} up <repo>\` to bring up its closure.\n`,
       ),
     );
@@ -2602,7 +2707,7 @@ class DenCLI {
     if (added.length > 0) {
       console.log(
         chalk.gray(
-          `  default workspace: added standard repo(s) ${added.join(", ")} (managed)`,
+          `  default workspace: added standard ${noun(added.length, "repo")} ${added.join(", ")} (managed)`,
         ),
       );
     }
@@ -2861,7 +2966,7 @@ class DenCLI {
       chalk.cyan(`\n  Workspace: ${chalk.bold(ws?.name ?? "none")}\n`),
     );
 
-    const table = new Table({
+    const table = newTable({
       head: ["Service", "Mode", "Branch", "Health", "Reason"],
       style: { head: ["cyan"] },
     });
@@ -3023,7 +3128,7 @@ class DenCLI {
       return;
     }
 
-    const table = new Table({
+    const table = newTable({
       head: ["Service", "Mode", "Health", "Commands"],
       style: { head: ["cyan"] },
     });
@@ -3088,7 +3193,8 @@ class DenCLI {
     }
 
     const repoPathArg = args.find(
-      (a, i) => !a.startsWith("-") && !/^--(name|gh)$/.test(args[i - 1] ?? ""),
+      (a, i) =>
+        !a.startsWith("-") && !/^--(name|gh|org)$/.test(args[i - 1] ?? ""),
     );
     if (repoPathArg) {
       const flag = (n: string) => {
@@ -3104,7 +3210,7 @@ class DenCLI {
     if (source === "local") {
       await this.registerLinked(ws);
     } else {
-      await this.registerManaged(ws);
+      await this.registerManaged(ws, orgFlag(args));
     }
   }
 
@@ -3183,26 +3289,24 @@ class DenCLI {
     );
   }
 
-  /** List org repos via `gh`, let user pick one + branch → managed service. */
-  private async registerManaged(ws: {
-    name: string;
-    config: import("../../shared/types/index.js").WorkspaceConfig;
-  }): Promise<void> {
-    // Derive org from den's own git remote
-    const { fileURLToPath: ftu } = await import("url");
-    const { default: pathMod } = await import("path");
-    const distRoot = pathMod.resolve(
-      pathMod.dirname(ftu(import.meta.url)),
-      "../../..",
-    );
-    const denCoords = getGitHubCoords(distRoot);
-    // The instance's config names its org; the checkout's own remote is only a
-    // fallback (inside a package it would name the engine's repo, not the org's).
-    const org = readDenConfig().github_org ?? denCoords?.owner;
-    if (!org || !/^[A-Za-z0-9][A-Za-z0-9-]*$/.test(org)) {
+  /**
+   * List an org's repos via `gh`, let the user pick one + branch → managed
+   * service. The org is `--org <id>`, else the focused workspace's resolved
+   * org (ORG-1a). Never Den's own checkout or remote (SEC-0).
+   */
+  private async registerManaged(
+    ws: {
+      name: string;
+      config: import("../../shared/types/index.js").WorkspaceConfig;
+    },
+    orgArg?: string,
+  ): Promise<void> {
+    const org = registerOrg(ws.name, orgArg);
+    if (!org) {
       console.log(
         chalk.red(
-          `\n  ❌ No GitHub org to list: set github_org in ${product().configFile}\n`,
+          `\n  ❌ No GitHub org to list: set github_org in ${product().configFile}, ` +
+            `org: on workspace ${ws.name}, or pass --org <id>\n`,
         ),
       );
       return;
@@ -3459,6 +3563,15 @@ class DenCLI {
     const force = args.includes("--force") || args.includes("-f");
     const names = args.filter((a) => !a.startsWith("-"));
 
+    // `--plan`: each repo's org and clone URL, then stop. Read-only.
+    if (args.includes("--plan")) {
+      console.log(chalk.bold("\n  Setup plan (no changes will be made):\n"));
+      for (const line of renderClonePlan(buildSetupPlan(names), product().cli))
+        console.log(`  ${line}`.trimEnd());
+      console.log();
+      return;
+    }
+
     // Clone any managed repos that aren't on disk yet before reading manifests.
     this.cloneMissingManagedRepos();
 
@@ -3546,13 +3659,20 @@ class DenCLI {
 
     switch (sub) {
       case "list": {
-        const table = new Table({
-          head: ["Workspace", "Active", "Focus", "Services", "Type"],
+        const only = orgFlag(args.slice(1));
+        const { resolved, warnings } = orgListRows();
+        const orgOfWs = new Map(resolved.map((w) => [w.workspace, w.org]));
+        const table = newTable({
+          head: ["Workspace", "Org", "Active", "Focus", "Services", "Type"],
           style: { head: ["cyan"] },
         });
-        for (const [name, cfg] of Object.entries(file.workspaces)) {
+        const shown = Object.entries(file.workspaces).filter(
+          ([name]) => !only || sameOrg(orgOfWs.get(name) ?? null, only),
+        );
+        for (const [name, cfg] of shown) {
           table.push([
             chalk.bold(name),
+            orgOfWs.get(name) ?? chalk.gray("none"),
             activeSet.has(name) ? chalk.green("✓") : "",
             name === focus ? chalk.cyan("●") : "",
             Object.keys(cfg.services).join(", ") || chalk.gray("none"),
@@ -3560,6 +3680,14 @@ class DenCLI {
           ]);
         }
         console.log(table.toString());
+        if (only && shown.length === 0)
+          console.log(chalk.yellow(`  No workspace in org ${only}.`));
+        const names = new Set(shown.map(([n]) => n));
+        printOrgWarnings(
+          warnings.filter((w) =>
+            [...names].some((n) => w.startsWith(`workspace ${n}:`)),
+          ),
+        );
         break;
       }
       case "activate": {
@@ -3665,7 +3793,7 @@ class DenCLI {
         break;
       }
       case "seed": {
-        await this.seedDefaultWorkspaceFlow("init");
+        await this.seedDefaultWorkspaceFlow("init", args.includes("--reset"));
         break;
       }
       case "create": {
@@ -3802,7 +3930,7 @@ class DenCLI {
     if (missing.length > 0) {
       console.log(
         chalk.cyan(
-          `\n  Cloning ${missing.length} managed repo(s) not on disk yet: ${missing.join(", ")}`,
+          `\n  Cloning ${plural(missing.length, "managed repo")} not on disk yet: ${missing.join(", ")}`,
         ),
       );
       await this.ensureManagedClonesFor(missing);
@@ -3858,7 +3986,15 @@ class DenCLI {
   // ── den validate ────────────────────────────────────────────────────────
 
   private async cmdValidate(args: string[]): Promise<void> {
-    const target = args[0] ?? getInvokeCwd();
+    const positional = args.filter((a) => !a.startsWith("-"));
+    const held = args.includes("--held");
+    // Bare `validate` in the distribution root (which has no manifest of its
+    // own), or `--held`: every manifest the distribution uses.
+    if (held || (positional.length === 0 && this.invokedInDistRoot())) {
+      this.validateEverything(held);
+      return;
+    }
+    const target = positional[0] ?? getInvokeCwd();
     const fs = await import("fs");
     const nodePath = await import("path");
 
@@ -3924,6 +4060,78 @@ class DenCLI {
     if (!result.valid) process.exit(1);
   }
 
+  /** Whether the CLI was run from the distribution root (real paths). */
+  private invokedInDistRoot(): boolean {
+    const real = (p: string) => {
+      try {
+        return fs.realpathSync(nodePath.resolve(p));
+      } catch {
+        return nodePath.resolve(p);
+      }
+    };
+    return (
+      real(getInvokeCwd()) === real(getDistRoot()) &&
+      !fs.existsSync(nodePath.join(getDistRoot(), product().manifestYml))
+    );
+  }
+
+  /** `validate` (bare, in the root) / `validate --held`: see validate-all.ts. */
+  private validateEverything(held: boolean): void {
+    const results = validateAll({ held, validate: validateManifestLayers });
+    console.log();
+    if (results.length === 0) {
+      console.log(
+        chalk.yellow(
+          held
+            ? `  No manifests in ${heldManifestsDir()}.`
+            : "  No repos in any workspace and no held manifests.",
+        ),
+      );
+      console.log();
+      return;
+    }
+    const width = Math.max(...results.map((r) => r.repo.length));
+    for (const r of results) {
+      const where = r.checkout ?? "manifests/";
+      const ws = r.workspaces.length ? `  [${r.workspaces.join(", ")}]` : "";
+      const note = r.note ? `  (${r.note})` : "";
+      const head = `${r.repo.padEnd(width)}  ${r.source.padEnd(15)} ${where}${ws}${note}`;
+      if (r.missing) {
+        console.log(chalk.yellow(`  ⚠  ${head}`));
+        continue;
+      }
+      const warnings = r.result.layers.reduce(
+        (n, l) => n + l.result.warnings.length,
+        0,
+      );
+      if (r.result.valid && warnings === 0) {
+        console.log(chalk.green(`  ✓  ${head}`));
+        continue;
+      }
+      console.log(
+        r.result.valid
+          ? chalk.yellow(`  ⚠  ${head}`)
+          : chalk.red(`  ✗  ${head}`),
+      );
+      for (const l of r.result.layers)
+        if (!l.result.valid || l.result.warnings.length)
+          printValidation(
+            `    ${l.file ?? "merged"}`,
+            l.result,
+            l.layer === "merged" ? "merged" : l.layer,
+          );
+    }
+    const failed = results.filter((r) => !r.missing && !r.result.valid).length;
+    const missing = results.filter((r) => r.missing).length;
+    console.log();
+    console.log(
+      `  ${plural(results.length, held ? "manifest" : "repo")}: ${failed ? chalk.red(`${failed} failed`) : chalk.green("all valid")}` +
+        (missing ? chalk.yellow(`, ${missing} with no manifest to check`) : ""),
+    );
+    console.log();
+    if (validateAllFailed(results)) process.exitCode = 1;
+  }
+
   // ── den local-dev ───────────────────────────────────────────────────────
 
   private async cmdLocalDev(arg?: string): Promise<void> {
@@ -4004,7 +4212,9 @@ class DenCLI {
       "  register [path]      Register a repo in the service catalog",
     );
     console.log();
-    console.log("  setup [service...]   Run make setup for services");
+    console.log(
+      "  setup [service...]   Run make setup for services (--plan: orgs + clone URLs, no changes)",
+    );
     console.log("  sync [service...]    Check for updates and offer to pull");
     console.log(
       "  create <name> [dir]  Scaffold a new distribution of your own (--title, --cli, --env-prefix)",
@@ -4035,6 +4245,9 @@ class DenCLI {
     console.log(
       "  workspace code [n]       Open workspace in VS Code (generates .code-workspace)",
     );
+    console.log(
+      "  org list [--org <id>]    List orgs: label, workspaces, default, warnings",
+    );
     console.log("\nTest commands:");
     console.log(
       "  menu                 Open the interactive menu (pillar/module/env picker)",