@monster-orange/den 0.2.6 → 0.2.7

package/CHANGELOG.md

@@ -4,6 +4,123 @@ All notable changes to Den are documented here. Each release lists the
 config and manifest changes a distribution must make to move to it under
 **Migrations**.
 
+## [0.2.7] - 2026-11-05
+
+### Added
+
+- **A workspace belongs to an org** (0.2.7-dev.2, ORG-1a). Its org is
+  `org:` on the workspace in workspaces.yml, else `org:` on the blueprint
+  workspace (`defaults.workspaces.<n>.org`, the one new blueprint key), else
+  the one catalog owner of its repos (case-insensitive; `gh: ""` ignored),
+  else `github_org`, the default org. It is computed on read, never written
+  to workspaces.yml. A config with no `org:` resolves to `github_org` as
+  before, unless all of a workspace's repos have one other owner in the
+  catalog.
+- **`<cli> org list`** (0.2.7-dev.2, ORG-1a): each org's label, its
+  workspaces on this machine, which is the default, and the org warnings.
+  `<cli> workspace list` gains an Org column; `--org <id>` filters it.
+- **Org warnings, never errors** (0.2.7-dev.2, ORG-1a, C1): a workspace
+  whose repos span several owners, an `org:` naming an owner Den does not
+  know, a repo in another owner than its workspace's org, a workspaces.yml
+  `org:` that overrides the blueprint's. Shown by `org list` and
+  `workspace list`.
+- **`<cli> setup --plan`** (0.2.7-dev.2, ORG-1a): each repo's org and clone
+  URL, and whether it is cloned, then stop. On a fresh machine it plans the
+  blueprint's workspaces; once seeded, the focused workspace. `<cli> up
+  --plan` prints the same lines for its repos. Nothing is cloned, seeded or
+  written.
+- **`GET /api/orgs` entries gain `default` and `workspaces`**, and
+  `/api/<cli>/config` gains `default_org` (0.2.7-dev.2, ORG-1a). Every
+  existing field, entry and order is unchanged; `?repos=1` still maps each
+  repo to its owner string.
+- **`<cli> register --org <id>`** (0.2.7-dev.2, ORG-1a) lists another org's
+  repos for a managed clone.
+
+- **Bare `<cli> validate` checks every manifest** (0.2.7-dev.1, from a
+  consumer). In the distribution root, with no argument: each workspace repo
+  once per checkout (own or held, plus any override, then the merge), the
+  held manifest when there is no checkout, and held manifests no workspace
+  uses. One line per repo, details on failure, exit 1 if any fails, nothing
+  cloned. `--held` checks `manifests/` alone, independent of the machine. A
+  path argument works as before.
+
+### Changed
+
+- **A repo is released from its own org** (0.2.7-dev.2, REL-1). With no
+  `release.org`, a repo with no `gh:` in `release.repos` released from
+  `github_org`, so a client org's repo targeted the wrong owner. Its owner
+  is now an explicit `release.org` (unchanged: it still wins for every
+  repo), else the repo's non-empty catalog owner, else `github_org`.
+- **`register` lists the focused workspace's org** (0.2.7-dev.2, ORG-1a),
+  not `github_org` alone, and no longer falls back to the owner of Den's own
+  git remote (SEC-0): with no org it says how to set one.
+
+### Fixed
+
+- **A second root's server leaves the first root's services alone**
+  (0.2.7-dev.3, dev.4). Every root of a product shares one daemons file.
+  A server's two startup sweeps (the stale-daemon prune and the health
+  reaper) dropped any record whose address did not resolve in its own
+  workspaces, so starting a scratch root's server silently forgot another
+  root's running dev server; an interactive Ctrl-C stopped every service in
+  the file, and deactivating a workspace released any record with the same
+  workspace name. Records are now stamped with the root that started them
+  and a server lists, stops, releases and sweeps only its own (other roots'
+  records stay in the file untouched). An older unstamped record is never
+  dropped just for not resolving; it still goes when its containers are
+  verifiably gone or two health checks fail. The reaper now logs what it
+  removes.
+- **A service the edge has no route for is no longer healthy** (0.2.7-dev.2).
+  A health URL served through the edge answered the edge's own
+  `404 page not found` when the service had no route, and Den counted any
+  404 as up. That exact 404 is now down with "no route (edge 404)", over
+  HTTP and HTTPS; a 404 from the service itself is still up.
+- **A client workspace no longer clones from the default org** (0.2.7-dev.2,
+  ORG-1a). Seeding, `up` and the web sync gave a repo with no clone URL
+  `<github_org>/<repo>`; it is now `<org>/<repo>` with its workspace's org.
+- **`<cli> setup` clones a catalog entry with `gh: ""`** from its
+  workspace's org (0.2.7-dev.2), as `up` does, instead of failing on an
+  empty slug.
+- **A seed without a terminal no longer resets a workspace that has
+  entries** (SEED-0). `<cli> init` and `<cli> workspace seed` from a script
+  or `make` replaced every entry of the default (or blueprint) workspaces with
+  managed clones, your own dev-managed checkouts included, without asking.
+  Without a TTY they now refuse (exit 1, nothing written) and name
+  `--reset`; on a TTY they still ask, default No. `init --reset` and
+  `workspace seed --reset` reset as before.
+- **A failed seed leaves the workspaces as they were** (0.2.7-dev.1, from a
+  consumer). Seeding wrote workspaces.yml, then filled the catalog, which
+  fails with no `github_org`: the workspace was reset and nothing could be
+  cloned. The catalog comes first now, and the org is needed only for a repo
+  with no clone URL in the catalog.
+- **A seed refusal names the command that was run** (`init --reset` or
+  `workspace seed --reset`).
+- **A `DEN_ROOT` with no den.yml is a one-line error** (exit 2), not a stack
+  trace from deep in module loading.
+- **Piped output carries no ANSI from tables** (`status`, `services`, test
+  results). cli-table3 coloured borders and head cells itself, ignoring
+  NO_COLOR and a pipe.
+- **`<cli> mcp --call` validates its arguments** against the tool's schema,
+  strictly: an unknown or misspelt key, or a bad value, exits 2 with the
+  problem and the keys the tool takes, and calls nothing.
+- **The web UI service survives a removed nvm version.** Install prefers a
+  stable node of the same major version over a version manager's (or uses
+  `DEN_SERVICE_NODE`), and warns when it must keep one. `service status`
+  exits 1, naming it, when the installed node no longer exists.
+
+- **`<cli> init` in the distribution root seeds even through a symlinked
+  path** (`/var` → `/private/var`, a symlinked home). It compared paths
+  without resolving links and ran the manifest scaffolder instead.
+
+### Migrations
+
+- A script that relied on a non-interactive seed resetting a changed
+  workspace must pass `--reset`.
+- Optional (ORG-1a): to put a blueprint workspace in an org other than the
+  one its catalog owners give, add `org: <id>` to it under
+  `defaults.workspaces`. Pin Den 0.2.7 or later first: an older Den rejects
+  the key. Nothing else needs changing.
+
 ## [0.2.6] - 2026-11-04
 
 ### Fixed

package/bin/den

@@ -49,6 +49,15 @@ if [ "${1:-}" = "mcp" ] && ! case "${2:-}" in connect|disconnect|clients|config)
   built="dist/src/ui/cli/mcp-main.js"
 fi
 
+# A DEN_ROOT that names no distribution is a usage error, not a crash: say
+# so here, before any module resolves paths from it at import time.
+# (`create` needs no distribution.)
+if [ -n "${DEN_ROOT:-}" ] && [ "$entry" != "src/ui/cli/create-main.ts" ] && [ ! -f "$DEN_ROOT/den.yml" ]; then
+  echo "den: DEN_ROOT is set to \"$DEN_ROOT\" but that directory has no den.yml." >&2
+  echo "     Point it at your distribution's checkout, or unset it." >&2
+  exit 2
+fi
+
 # Escape hatch: force the compiled build (e.g. to test the prod artifact).
 if [ "${DEN_USE_DIST:-}" = "1" ] && [ -f "$DEN_ENGINE_ROOT/$built" ]; then
   exec node "$DEN_ENGINE_ROOT/$built" "$@"

package/docs/distributions.md

@@ -104,6 +104,23 @@ naming the file each error is in, then checks the merged result:
   ERROR   services.api.commands.local.down  unknown key "down": not in the base manifest
 ```
 
+Run with no argument in the distribution root, `<cli> validate` checks every
+manifest the distribution uses, and never clones:
+
+- each repo of every workspace, once per checkout path, with the
+  workspaces that use it and where its base comes from (`own`, `held`,
+  `+ override`);
+- a repo with no checkout on disk falls back to its held manifest, marked
+  `held only, no checkout`. With no held manifest either it is a warning, not
+  a failure;
+- each held manifest in `manifests/` that no workspace uses.
+
+It prints one line per repo, details only for a layer with errors or
+warnings, and exits 1 if any fails. `<cli> validate --held` checks only
+`manifests/`, as if nothing were checked out, so the result does not depend on
+the machine (use it in a CI or upgrade gate). An override whose base is the
+repo's own manifest is noted there, not checked.
+
 The web UI's Services cards show the layers each manifest was built from
 (`manifest: repo + override`), and `/api/services` returns them per service as
 `manifestLayers`, e.g. `["held", "override"]`. `DEN_MANIFESTS_DIR` points the
@@ -435,8 +452,8 @@ defaults:
       focus: true
 ```
 
-Each entry takes `repos`, `branch` and `autostart_off`, the same fields as
-`defaults.workspace`, plus `focus`. Seeding creates every named workspace
+Each entry takes `repos`, `branch`, `autostart_off` and `org`, the same
+fields as `defaults.workspace`, plus `focus`. Seeding creates every named workspace
 with its repos, activates them all, and focuses the one with `focus: true`
 (else the first). Set `defaults.workspace` or `defaults.workspaces`, not both:
 both at once is an error, as is more than one `focus: true`.
@@ -452,6 +469,68 @@ Once seeded, a repo that later joins `defaults.workspace.repos` is added to
 you removed from it or that another workspace holds. With
 `defaults.workspaces` nothing is topped up.
 
+To see what a setup would clone before it clones anything, run
+`acme setup --plan`: each repo with its org and clone URL, and whether it
+is cloned yet. On a fresh machine it plans the blueprint (every workspace
+`acme workspace seed` would create); once seeded, the focused workspace.
+`acme up --plan` lists the same lines for the repos it would start. Both
+are read-only: nothing is cloned, seeded or written.
+
+## Orgs
+
+A distribution can hold work for more than one org: each workspace belongs
+to one. An org's id is a key of `orgs:` or a GitHub owner, and today an org
+is the GitHub owner of the same name. `github_org` is the default org. A
+distribution that never mentions orgs has one org, the default, and every
+workspace is in it.
+
+```yaml
+github_org: acme
+orgs:
+  acme: { label: Acme }
+  globex: { label: Globex, color: "#0af" }
+defaults:
+  workspaces:
+    storefront:
+      repos: [shop-web, shop]
+    client:
+      org: globex # optional: the workspace's org
+      repos: [globex-web, globex-api]
+```
+
+A workspace's org is the first of:
+
+1. `org:` on the workspace in `config/local/workspaces.yml` (this machine)
+2. `org:` on the blueprint workspace of the same name (committed)
+3. the one owner of its repos in the catalog (`gh: <owner>/<repo>`; owners
+   compare case-insensitively, and a `gh: ""` counts as unknown)
+4. `github_org`
+
+It is worked out each time it is read and never written back. A repo with
+no clone URL is cloned from `<org>/<repo>` with its workspace's org: seeding
+the blueprint above gives `globex-web` `gh: globex/globex-web`, not
+`acme/...`. `acme register` picks a managed clone from the focused
+workspace's org, or from `--org <id>`.
+
+`acme org list` shows each org's label, its workspaces and which is the
+default. `acme workspace list` has an Org column, and `--org <id>` lists one
+org's workspaces. A workspace whose repos belong to several owners, an
+`org:` naming an owner Den does not know, or a repo in another owner than
+its workspace's org is a warning in both lists, never an error.
+`GET /api/orgs` adds `default` and `workspaces` to each entry, and
+`/api/<cli>/config` adds `default_org`.
+
+`org:` in the blueprint needs Den 0.2.7 or later: an older Den rejects the
+unknown key. Pin 0.2.7 before you commit it.
+
+## Releases
+
+The Release page dispatches each repo's CD workflow on GitHub. A repo's
+owner there is its own `gh: owner/repo` in `release.repos`, else
+`release.org` when it is set, else the repo's owner in the catalog, else
+`github_org`. Leave `release.org` unset when the repos belong to different
+orgs: each then releases from its own.
+
 ## The bin shim
 
 `bin/<cli>` is three lines of sh: it names the distribution root and runs
@@ -580,10 +659,17 @@ node_modules/@monster-orange/den/service/install.sh print       # the plist only
 | `DEN_ROOT`          | required in a distribution               |
 | `DEN_SERVICE_LABEL` | `local.<distribution dir name>.web`      |
 | `DEN_SERVICE_LOGS`  | `~/Library/Logs/<distribution dir name>` |
-
-The service runs the engine's server with the `node` on your `PATH` at install
-time, from the distribution root; re-run `install` after changing node versions
-or upgrading Den. Keep the label stable: it is how launchd knows the service.
+| `DEN_SERVICE_NODE`  | see below                                |
+
+The service runs the engine's server, from the distribution root, with the
+`node` on your `PATH` at install time. A version manager's node (nvm, fnm,
+volta, asdf, mise) lives under a versioned path that disappears when that
+version is removed, so install prefers `/opt/homebrew/bin/node` or
+`/usr/local/bin/node` when one has the same major version, and otherwise
+keeps the version manager's and warns. `DEN_SERVICE_NODE` names the node
+outright. `service status` exits 1 when the installed node no longer exists.
+Re-run `install` after changing node versions or upgrading Den. Keep the
+label stable: it is how launchd knows the service.
 
 ## MCP server
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monster-orange/den",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "Den: a local multi-repo dev orchestrator, HTTPS edge and E2E harness",
   "type": "module",
   "bin": {

package/service/install.sh

@@ -15,6 +15,7 @@
 #
 #   DEN_SERVICE_LABEL  launchd label (default local.<dist dir name>.web)
 #   DEN_SERVICE_LOGS   log directory (default ~/Library/Logs/<dist dir name>)
+#   DEN_SERVICE_NODE   the node the agent runs (default: see pick_node)
 #   DEN_SERVICE_READY_CHECK=external  install does not print "running": the
 #                      caller (`<cli> service install`) checks the server
 #                      answers first.
@@ -47,8 +48,36 @@ find_tsx() {
   done
 }
 
+# A version manager's node (nvm, fnm, volta, asdf, mise) lives under a
+# versioned path that disappears when that version is removed, and the agent
+# then fails to start with no clear reason. Prefer a stable install of the
+# same major version; otherwise keep it and say so.
+STABLE_NODES="${DEN_SERVICE_STABLE_NODES:-/opt/homebrew/bin/node /usr/local/bin/node}"
+node_major() { "$1" -p "process.versions.node.split('.')[0]" 2>/dev/null; }
+pick_node() {
+  if [ -n "${DEN_SERVICE_NODE:-}" ]; then
+    [ -x "$DEN_SERVICE_NODE" ] || { echo "✗ DEN_SERVICE_NODE ($DEN_SERVICE_NODE) is not executable" >&2; exit 1; }
+    echo "$DEN_SERVICE_NODE"; return
+  fi
+  local node; node="$(command -v node)" || { echo "✗ node is not on PATH" >&2; exit 1; }
+  case "$node" in
+    */.nvm/*|*/fnm/*|*/.fnm/*|*/.volta/*|*/.asdf/*|*/mise/*) ;;
+    *) echo "$node"; return ;;
+  esac
+  local want c; want="$(node_major "$node")"
+  for c in $STABLE_NODES; do
+    if [ -x "$c" ] && [ "$(node_major "$c")" = "$want" ]; then echo "$c"; return; fi
+  done
+  # Warn when installing; `print` writes the plist and nothing else.
+  if [ "${1:-}" = install ]; then
+    echo "⚠ the service will run $node, a version manager's node: it stops starting" >&2
+    echo "  when that version is removed. Re-run install after switching, or set DEN_SERVICE_NODE." >&2
+  fi
+  echo "$node"
+}
+
 write_plist() { # $1 = output file
-  NODE="$(command -v node)" || { echo "✗ node is not on PATH" >&2; exit 1; }
+  NODE="$(pick_node "$MODE")"
   TSX="$(find_tsx)" || { echo "✗ tsx not installed: run npm ci in $DIST" >&2; exit 1; }
   DOCKER_DIR="$(dirname "$(command -v docker || echo /usr/local/bin/docker)")"
   SVC_PATH="$(dirname "$NODE"):$DOCKER_DIR:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
@@ -79,7 +108,8 @@ else:
 PY
 }
 
-case "${1:-install}" in
+MODE="${1:-install}"
+case "$MODE" in
   install)
     mkdir -p "$LOGS" "$(dirname "$PLIST")"
     write_plist "$PLIST.new"
@@ -115,6 +145,15 @@ case "${1:-install}" in
     write_plist -
     ;;
   status)
+    # The node the agent was installed with may be gone (a removed nvm
+    # version): launchd then restarts it forever with no useful message.
+    if [ -f "$PLIST" ] && command -v plutil >/dev/null 2>&1; then
+      svc_node="$(plutil -extract ProgramArguments.0 raw -o - "$PLIST" 2>/dev/null || true)"
+      if [ -n "$svc_node" ] && [ ! -x "$svc_node" ]; then
+        echo "✗ $LABEL runs $svc_node, which no longer exists: re-run service install" >&2
+        exit 1
+      fi
+    fi
     # launchctl's own "Could not find service" is noise when it isn't loaded.
     if out="$(launchctl print "$DOMAIN/$LABEL" 2>/dev/null)"; then
       printf '%s\n' "$out" | grep -E '^\s*(state|pid|last exit code|runs|spawn type)'

package/src/shared/den-config.ts

@@ -636,6 +636,8 @@ export interface ResolvedWorkspaceBlueprint {
   branch: string;
   autostartOff: string[];
   focus: boolean;
+  /** `org:` (ORG-1a): the org this workspace belongs to, when the blueprint names one. */
+  org?: string;
 }
 
 /** Which blueprint shape the distribution uses, and its workspaces. */
@@ -644,7 +646,7 @@ export interface WorkspaceBlueprints {
   workspaces: ResolvedWorkspaceBlueprint[];
 }
 
-const BLUEPRINT_KEYS = ["branch", "repos", "autostart_off"];
+const BLUEPRINT_KEYS = ["branch", "repos", "autostart_off", "org"];
 
 function blueprintStrings(where: string, key: string, v: unknown): string[] {
   if (v === undefined) return [];
@@ -674,12 +676,15 @@ function resolveBlueprint(
     throw new Error(`${where}.branch must be a branch name`);
   if (bp.focus !== undefined && typeof bp.focus !== "boolean")
     throw new Error(`${where}.focus must be true or false`);
+  if (bp.org !== undefined && (typeof bp.org !== "string" || !bp.org.trim()))
+    throw new Error(`${where}.org must be an org id (a key of orgs:)`);
   return {
     name,
     repos: blueprintStrings(where, "repos", bp.repos),
     branch,
     autostartOff: blueprintStrings(where, "autostart_off", bp.autostart_off),
     focus: bp.focus === true,
+    ...(typeof bp.org === "string" ? { org: bp.org.trim() } : {}),
   };
 }
 
@@ -864,6 +869,38 @@ export function readReleaseConfig(): ReleaseConfig {
   return cfg;
 }
 
+/**
+ * `release.org` as configured (den.yml, then user.yml), without the
+ * `github_org` fallback readReleaseConfig fills in. An explicit value is the
+ * release owner of every repo (REL-1); unset, each repo's own catalog owner is.
+ */
+export function readExplicitReleaseOrg(): string | undefined {
+  const den = mergeReleaseLayer(
+    DEFAULT_RELEASE_CONFIG,
+    readDenConfig().release,
+  );
+  const org = mergeReleaseLayer(den, readUserConfig().release).org;
+  return typeof org === "string" && org.trim() ? org.trim() : undefined;
+}
+
+/**
+ * The GitHub owner a repo is released from (REL-1): an explicit
+ * `release.org` wins, then the repo's non-empty catalog owner, then
+ * `github_org`. "" when none is known.
+ */
+export function releaseOwnerFor(opts: {
+  explicitOrg?: string;
+  catalogOwner?: string;
+  githubOrg?: string;
+}): string {
+  return (
+    opts.explicitOrg?.trim() ||
+    opts.catalogOwner?.trim() ||
+    opts.githubOrg?.trim() ||
+    ""
+  );
+}
+
 /**
  * Persist a personal release override to config/local/user.yml (gitignored).
  * Used by the Release tab's wave editor — team defaults stay in den.yml.

package/src/shared/environment-manager/catalog.ts

@@ -55,7 +55,8 @@ export function upsertCatalogEntry(
 /**
  * GitHub slug to clone `repoName` from.
  *
- * The catalog's `gh` when set, else the conventional `<github_org>/<repo>` —
+ * The catalog's `gh` when set, else the conventional `<org>/<repo>`, where
+ * `<org>` is the workspace's resolved org (`github_org` when none is given) —
  * the same rule `seedDefaultWorkspace` uses. Entries written by the
  * dev-managed add flow carry `gh: ""`, so a repo can be IN the catalog and
  * still have no slug; deriving it (rather than refusing to clone) is what lets
@@ -64,10 +65,16 @@ export function upsertCatalogEntry(
 export function resolveRepoGhSlug(
   repoName: string,
   catalog: ServiceCatalog = readCatalog(),
+  /**
+   * The owner for a repo with no `gh`: the workspace's resolved org
+   * (`() => githubOrgFor(ws)`, ORG-1a). Called only when needed, so a repo
+   * with a slug never needs an org. Defaults to `github_org`.
+   */
+  owner: () => string = () => requireGithubOrg(),
 ): string {
   const gh = catalog[repoName]?.gh?.trim();
   if (gh) return gh;
-  return `${requireGithubOrg()}/${repoName}`;
+  return `${owner()}/${repoName}`;
 }
 
 export function removeCatalogEntry(repoName: string): void {

package/src/shared/environment-manager/default-workspace.ts

@@ -5,7 +5,8 @@
  * all managed. On a fresh clone (no local workspace) den offers — once —
  * to seed the `default` workspace from it so `den graph` / `den up` show the
  * full system graph immediately; `den init` (run in the den root) re-seeds.
- * Catalog clone URLs derive as `<github_org>/<repo>`. Switch any repo to a local
+ * Catalog clone URLs derive as `<org>/<repo>`, with the workspace's resolved org
+ * (workspace-org.ts; `github_org` unless the blueprint or catalog says otherwise). Switch any repo to a local
  * checkout with `den use-local <repo>`.
  */
 import {
@@ -16,9 +17,13 @@ import {
 import { readCatalog, writeCatalog } from "./catalog.js";
 import {
   readWorkspaceBlueprints,
-  requireGithubOrg,
   type ResolvedWorkspaceBlueprint,
 } from "../den-config.js";
+import {
+  githubOrgFor,
+  readOrgContext,
+  type OrgContext,
+} from "./workspace-org.js";
 import type {
   ServiceCatalog,
   WorkspaceConfig,
@@ -47,10 +52,6 @@ export function defaultWorkspaceRepos(): string[] {
   return singleBlueprint()?.repos ?? [];
 }
 
-function org(): string {
-  return requireGithubOrg();
-}
-
 function blueprintServices(
   bp: ResolvedWorkspaceBlueprint,
   repos: string[] = bp.repos,
@@ -70,14 +71,41 @@ function blueprintServices(
   return services;
 }
 
+/**
+ * The clone slug seeding would give each repo the catalog has no `gh` for:
+ * `<org>/<repo>` with its workspace's resolved org. A repo in several
+ * workspaces takes the first one's. Reads only; throws when a repo needs an
+ * org and none resolves (no org anywhere and no `github_org`).
+ */
+export function catalogFill(
+  workspaces: { name: string; repos: string[] }[],
+  catalog: ServiceCatalog = readCatalog(),
+  ctx: OrgContext = readOrgContext(),
+): Map<string, string> {
+  const fill = new Map<string, string>();
+  for (const ws of workspaces)
+    for (const repo of ws.repos) {
+      if (catalog[repo]?.gh || fill.has(repo)) continue;
+      fill.set(repo, `${githubOrgFor(ws.name, ctx)}/${repo}`);
+    }
+  return fill;
+}
+
+/**
+ * Give each blueprint repo with no clone URL `<org>/<repo>`, where `<org>` is
+ * its workspace's resolved org (ORG-1a: the blueprint's `org:`, else the
+ * catalog owners, else `github_org`), so a client workspace never clones
+ * from the default org on a fresh machine. The org is resolved only for a
+ * repo that needs one, and before anything is written: an unresolvable org
+ * throws with the catalog untouched.
+ */
 function fillCatalog(
-  repos: string[],
+  workspaces: { name: string; repos: string[] }[],
   catalog: ServiceCatalog = readCatalog(),
 ): void {
-  const o = org();
-  for (const repo of repos) {
-    if (!catalog[repo]?.gh) catalog[repo] = { gh: `${o}/${repo}` };
-  }
+  const fill = catalogFill(workspaces, catalog);
+  if (fill.size === 0) return;
+  for (const [repo, gh] of fill) catalog[repo] = { gh };
   writeCatalog(catalog);
 }
 
@@ -178,6 +206,9 @@ export function seedDefaultWorkspace(): string[] {
   if (!bp) return [];
   const repos = bp.repos;
 
+  // The catalog first: it is what can fail (no github_org), and a failure
+  // must leave the workspaces as they were, not reset and uncloneable.
+  fillCatalog([{ name: "default", repos }]);
   const file = readWorkspacesFile();
   file.workspaces.default = {
     ...(file.workspaces.default ?? {}),
@@ -189,7 +220,6 @@ export function seedDefaultWorkspace(): string[] {
     file.focus = "default";
   }
   writeWorkspacesFile(file);
-  fillCatalog(repos);
   return repos;
 }
 
@@ -202,6 +232,7 @@ export function seedDefaultWorkspace(): string[] {
 export function seedBlueprintWorkspaces(): { name: string; repos: string[] }[] {
   const bps = blueprintWorkspaces();
   if (bps.length === 0) return [];
+  fillCatalog(bps);
   const file = readWorkspacesFile();
   for (const bp of bps) {
     const prev: WorkspaceConfig | undefined = file.workspaces[bp.name];
@@ -223,7 +254,6 @@ export function seedBlueprintWorkspaces(): { name: string; repos: string[] }[] {
   file.active = [...names, ...kept.filter((n) => !names.includes(n))];
   file.focus = (bps.find((b) => b.focus) ?? bps[0]).name;
   writeWorkspacesFile(file);
-  fillCatalog([...new Set(bps.flatMap((b) => b.repos))]);
   return bps.map((b) => ({ name: b.name, repos: [...b.repos] }));
 }
 
@@ -277,7 +307,8 @@ export function topUpDefaultWorkspace(): string[] {
 
   def.seeded_repos = [...repos];
   writeWorkspacesFile(file);
-  if (missing.length > 0) fillCatalog(missing, catalog);
+  if (missing.length > 0)
+    fillCatalog([{ name: "default", repos: missing }], catalog);
   return missing;
 }
 

package/src/shared/environment-manager/health.ts

@@ -230,6 +230,28 @@ function trustContext(): { context: tls.SecureContext; agent: https.Agent } {
   return _trust;
 }
 
+/**
+ * The body a reverse proxy sends for a host it has no route for: Traefik's
+ * default 404 (Go's http.NotFound). Behind a shared edge a stopped service
+ * answers with this instead of refusing the connection, so a 4xx-means-up
+ * rule would show it healthy. A service's own 404 carries its own body.
+ */
+const EDGE_NO_ROUTE_BODY = "404 page not found";
+
+/** Up: 2xx, or a 4xx from the service itself (auth/route proves it answers). */
+function statusOk(status: number, body404?: string): boolean {
+  if (status === 404 && body404?.trim() === EDGE_NO_ROUTE_BODY) return false;
+  return status < 300 || (status >= 400 && status < 500);
+}
+
+/** The PingResult for `status`, naming an edge 404 as "no route". */
+function statusResult(status: number, body404?: string): PingResult {
+  const ok = statusOk(status, body404);
+  return ok || status !== 404
+    ? { ok, status }
+    : { ok, status, error: "no route (edge 404)" };
+}
+
 /**
  * HTTPS check. Connects to the c-ares-resolved IP (see above) but keeps the
  * hostname for SNI and certificate verification; rewriting the URL to the IP,
@@ -276,11 +298,23 @@ async function pingHttps(parsed: URL, timeoutMs: number): Promise<PingResult> {
       },
       (res) => {
         const status = res.statusCode ?? 0;
-        res.resume(); // discard the body
-        done({
-          ok: status < 300 || (status >= 400 && status < 500),
-          status,
+        if (status !== 404) {
+          res.resume(); // discard the body
+          done({ ok: statusOk(status), status });
+          return;
+        }
+        // A 404: read a little of the body to tell the edge's own "no
+        // route" from the service's 404.
+        let body = "";
+        res.setEncoding("utf8");
+        res.on("data", (c: string) => {
+          if (body.length < 64) body += c;
+          if (body.length >= 64) res.destroy();
         });
+        const finish = () => done(statusResult(status, body));
+        res.on("end", finish);
+        res.on("close", finish);
+        res.on("error", finish);
       },
     );
     const timer = setTimeout(() => {
@@ -334,11 +368,20 @@ async function pingOnce(
     // (e.g. VPN / /etc/hosts) returning 301 on port 80 for services that actually run
     // on a different port — the previous `< 500` check showed those as green.
     // 5xx = unhealthy (service errored).
-    const ok = res.status < 300 || (res.status >= 400 && res.status < 500);
-    // Discard the body: only the status matters, and unconsumed bodies pin
-    // sockets in the long-lived web server (one leak per poll adds up).
+    // A 404 may be the edge's own "no route" (see EDGE_NO_ROUTE_BODY): read
+    // a little of it. Otherwise discard the body: only the status matters,
+    // and unconsumed bodies pin sockets in the long-lived web server.
+    if (res.status === 404) {
+      let body = "";
+      try {
+        body = (await res.text()).slice(0, 64);
+      } catch {
+        /* unreadable body: judge by the status alone */
+      }
+      return statusResult(res.status, body);
+    }
     void res.body?.cancel().catch(() => {});
-    return { ok, status: res.status };
+    return { ok: statusOk(res.status), status: res.status };
   } catch (e: unknown) {
     clearTimeout(timer);
     const err = e as Error;