@monster-orange/den 0.2.6 → 0.2.7

package/src/ui/cli/results-viewer.ts

@@ -3,7 +3,7 @@
  * Display test results in CLI
  */
 
-import Table from "cli-table3";
+import { newTable } from "./table.js";
 import chalk from "chalk";
 import { resultReader } from "../../shared/results/result-reader.js";
 import type {
@@ -40,7 +40,7 @@ export class ResultsViewer {
     for (const pillar of pillars) {
       console.log(chalk.bold(`\n${this.formatPillarName(pillar)}:`));
 
-      const table = new Table({
+      const table = newTable({
         head: [
           chalk.cyan("Environment"),
           chalk.cyan("Total"),
@@ -115,7 +115,7 @@ export class ResultsViewer {
       return;
     }
 
-    const table = new Table({
+    const table = newTable({
       head: [
         chalk.cyan("Test"),
         chalk.cyan("Status"),
@@ -191,7 +191,7 @@ export class ResultsViewer {
       return;
     }
 
-    const table = new Table({
+    const table = newTable({
       head: [
         chalk.cyan("Journey"),
         chalk.cyan("Verdict"),
@@ -281,7 +281,7 @@ export class ResultsViewer {
       return;
     }
 
-    const table = new Table({
+    const table = newTable({
       head: [
         chalk.cyan("Test"),
         chalk.cyan("Runs"),

package/src/ui/cli/table.ts

@@ -0,0 +1,20 @@
+/**
+ * cli-table3 colours its borders (grey) and head cells (its own default, or
+ * the `style` given) through @colors/colors, which ignores Den's colour
+ * detection: piped `status` output carried ANSI codes from the table alone.
+ * Every CLI table goes through here, and takes no colour when chalk has none
+ * (not a TTY, NO_COLOR, FORCE_COLOR=0).
+ */
+import chalk from "chalk";
+import Table from "cli-table3";
+
+export function newTable(
+  opts: Table.TableConstructorOptions = {},
+  colour: boolean = chalk.level > 0,
+): Table.Table {
+  if (colour) return new Table(opts);
+  return new Table({
+    ...opts,
+    style: { ...(opts.style ?? {}), head: [], border: [] },
+  });
+}

package/src/ui/cli/validate-all.ts

@@ -0,0 +1,171 @@
+/**
+ * Bare `<cli> validate` in the distribution root: every manifest the
+ * distribution uses, without cloning anything.
+ *
+ * - Each repo of every workspace, once per distinct checkout path: its
+ *   layered manifest (own or held, then the override, then the merge).
+ * - A repo with no checkout on disk (a managed clone not made yet, a
+ *   dev-managed path that is gone) falls back to its held manifest, marked
+ *   "held only, no checkout"; with no held manifest either it is a warning,
+ *   not a failure.
+ * - Each held manifest (and override) in manifests/ that no repo above used.
+ *
+ * The layered validator comes in as `validate` (validateManifestLayers), so
+ * this file stays under the typecheck gate (see validate-layers.ts).
+ *
+ * `--held` checks only manifests/, as if nothing were checked out: a result
+ * that does not depend on the machine (an upgrade gate).
+ */
+import * as fs from "fs";
+import * as path from "path";
+import { product } from "../../shared/product.js";
+import { readCatalog } from "../../shared/environment-manager/catalog.js";
+import {
+  readWorkspacesFile,
+  resolveServiceSource,
+} from "../../shared/environment-manager/workspaces.js";
+import {
+  heldManifestsDir,
+  overrideSuffix,
+} from "../../shared/manifest/read-manifest.js";
+import type { LayeredValidation } from "../../shared/manifest/validate-layers.js";
+
+export interface RepoValidation {
+  repo: string;
+  /** The checkout validated, or null when only manifests/ was read. */
+  checkout: string | null;
+  /** Workspaces that use this checkout. */
+  workspaces: string[];
+  /** own | held, plus "+ override" when one layered on. */
+  source: string;
+  /** Set when there was no checkout and the held manifest stood in. */
+  note?: string;
+  /** No checkout and no held manifest: reported, not failed. */
+  missing?: boolean;
+  result: LayeredValidation;
+}
+
+/**
+ * A path that never exists, named after the repo, so the layer lookup finds
+ * only manifests/<repo>… and never a checkout's own manifest.
+ */
+function heldOnlyPath(repo: string): string {
+  return path.join(heldManifestsDir(), ".held-only", repo);
+}
+
+function sourceOf(result: LayeredValidation): string {
+  const base = result.layers.find(
+    (l) => l.layer === "repo" || l.layer === "held",
+  );
+  const own = base?.layer === "repo" ? "own" : base ? "held" : "none";
+  return result.layers.some((l) => l.layer === "override")
+    ? `${own} + override`
+    : own;
+}
+
+/** The repo keys manifests/ holds a manifest or an override for. */
+function heldKeys(): string[] {
+  const dir = heldManifestsDir();
+  if (!fs.existsSync(dir)) return [];
+  const yml = product().manifestYml;
+  const over = overrideSuffix();
+  const keys = new Set<string>();
+  for (const name of fs.readdirSync(dir)) {
+    if (name.endsWith(over)) keys.add(name.slice(0, -over.length));
+    else if (name.endsWith(yml)) keys.add(name.slice(0, -yml.length));
+  }
+  return [...keys].sort();
+}
+
+type Validate = (repoPath: string) => LayeredValidation;
+
+function heldOnly(repo: string, validate: Validate): RepoValidation {
+  const result = validate(heldOnlyPath(repo));
+  return {
+    repo,
+    checkout: null,
+    workspaces: [],
+    source: sourceOf(result),
+    result,
+  };
+}
+
+export function validateAll(opts: {
+  held?: boolean;
+  validate: Validate;
+}): RepoValidation[] {
+  const { validate } = opts;
+  if (opts.held)
+    return heldKeys().map((k) => {
+      const r = heldOnly(k, validate);
+      // An override with no held base layers onto the repo's own manifest,
+      // which --held deliberately does not read: noted, not failed.
+      const overrideOnly =
+        r.result.layers.length > 0 &&
+        r.result.layers.every((l) => l.layer === "override");
+      return overrideOnly
+        ? {
+            ...r,
+            source: "override",
+            missing: true,
+            note: "override only: its base is the repo's own manifest (not read with --held)",
+          }
+        : r;
+    });
+
+  const file = readWorkspacesFile();
+  const catalog = readCatalog();
+  // repo + checkout path → the workspaces that use it.
+  const seen = new Map<
+    string,
+    { repo: string; path: string; workspaces: string[] }
+  >();
+  for (const [ws, config] of Object.entries(file.workspaces)) {
+    for (const address of Object.keys(config.services ?? {})) {
+      const src = resolveServiceSource(address, ws, config, catalog);
+      const repo = src?.repoName ?? address.split("/")[0];
+      const p = src?.repoPath ? path.resolve(src.repoPath) : "";
+      const key = `${repo}\0${p}`;
+      const hit = seen.get(key);
+      if (hit) {
+        if (!hit.workspaces.includes(ws)) hit.workspaces.push(ws);
+      } else seen.set(key, { repo, path: p, workspaces: [ws] });
+    }
+  }
+
+  const out: RepoValidation[] = [];
+  const used = new Set<string>();
+  for (const { repo, path: p, workspaces } of seen.values()) {
+    used.add(repo);
+    if (p && fs.existsSync(p)) {
+      const result = validate(p);
+      out.push({
+        repo,
+        checkout: p,
+        workspaces,
+        source: sourceOf(result),
+        result,
+        ...(result.layers.length === 0 ? { missing: true } : {}),
+      });
+      continue;
+    }
+    const held = heldOnly(repo, validate);
+    out.push({
+      ...held,
+      checkout: p || null,
+      workspaces,
+      ...(held.result.layers.length
+        ? { note: "held only, no checkout" }
+        : { missing: true, note: "no checkout and no held manifest" }),
+    });
+  }
+  for (const key of heldKeys())
+    if (!used.has(key))
+      out.push({ ...heldOnly(key, validate), note: "held, in no workspace" });
+  return out;
+}
+
+/** Whether the run fails: any layer invalid, ignoring `missing` entries. */
+export function validateAllFailed(results: RepoValidation[]): boolean {
+  return results.some((r) => !r.missing && !r.result.valid);
+}

package/src/ui/mcp/server.ts

@@ -5,6 +5,7 @@
  *
  * stdout carries the protocol only: diagnostics go to stderr.
  */
+import { z } from "zod";
 import { randomUUID } from "crypto";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -185,7 +186,29 @@ export async function runOneShot(
     return 0;
   }
   const ctx: ToolContext = { api: opts.api, cfg: opts.cfg, cli: opts.cli };
-  const r = await callTool(shot.tool, shot.args, ctx);
+  // The stdio server validates arguments against each tool's schema (the
+  // SDK does it); a one-shot must too, and strictly: it is typed by hand, so
+  // an unknown or misspelt key is an error, not silently dropped.
+  let args = shot.args;
+  const tool = toolsFor(opts.cfg).find((t) => t.name === shot.tool);
+  if (tool) {
+    const parsed = z.object(tool.shape).strict().safeParse(args);
+    if (!parsed.success) {
+      const err = opts.err ?? ((t: string) => process.stderr.write(t));
+      const lines = parsed.error.issues.map((i) => {
+        const at = i.path.length ? i.path.join(".") : "(arguments)";
+        return `  ${at}: ${i.message}`;
+      });
+      const keys = Object.keys(tool.shape);
+      err(
+        `--call ${shot.tool}: invalid arguments\n${lines.join("\n")}\n` +
+          `  takes: ${keys.length ? keys.join(", ") : "no arguments"}\n`,
+      );
+      return 2;
+    }
+    args = parsed.data as Record<string, unknown>;
+  }
+  const r = await callTool(shot.tool, args, ctx);
   out(r.text.endsWith("\n") ? r.text : `${r.text}\n`);
   return r.isError ? 1 : 0;
 }

package/src/ui/server/daemon-reaper.ts

@@ -11,9 +11,11 @@
  * so an "error" health result is only acted on after a SECOND
  * consecutive "error" check separated by a retry delay. "unknown"
  * results and thrown checks always keep the entry (err on the side of
- * keeping). A daemon whose address no longer resolves to any
- * workspace/catalog service is process-death-equivalent evidence and is
- * removed directly.
+ * keeping). A daemon this root registered whose address no longer resolves
+ * to any workspace/catalog service is process-death-equivalent evidence and
+ * is removed directly. Records another root registered (all roots of a
+ * product share the file) are never touched, and an unstamped legacy record
+ * is not removed for being unresolvable.
  */
 
 import type { ServiceHealthResult } from "../../shared/environment-manager/health.js";
@@ -41,6 +43,12 @@ export interface DaemonReaperDeps {
   delay: (ms: number) => Promise<void>;
   /** Gap between the first "error" result and the confirming re-check. */
   retryDelayMs: number;
+  /**
+   * Which root wrote the record (`daemonRootOf`). Every root of a product
+   * shares one daemons file: another root's records are never swept here,
+   * and an unstamped (pre-0.2.7) one is not dropped for being unresolvable.
+   */
+  rootOf: (daemon: DaemonRecord) => "here" | "other" | "unstamped";
 }
 
 export interface DaemonReapResult {
@@ -92,9 +100,19 @@ export async function reapDeadDaemons(
   await Promise.allSettled(
     deps.listDaemons().map(async (daemon) => {
       try {
+        const root = deps.rootOf(daemon);
+        if (root === "other") {
+          kept.push(daemon.address);
+          return;
+        }
         const service = resolveForDaemon(deps, daemon);
         if (!service) {
-          // No longer in any owning workspace/catalog — nothing could restart it.
+          // No longer in any owning workspace/catalog — nothing could restart
+          // it. An unstamped record may be another root's, so it stays.
+          if (root === "unstamped") {
+            kept.push(daemon.address);
+            return;
+          }
           deps.unregisterDaemon(daemon.address);
           removed.push(daemon.address);
           return;

package/src/ui/server/index.ts

@@ -80,6 +80,7 @@ import {
   checkServiceHealth,
   loadDaemonsFromFile,
   pruneDeadDaemonsAsync,
+  daemonRootOf,
   isInteractiveServiceCommand,
   rewriteLegacyOpctlKillCommandForContainer,
   shouldDetachServiceCommand,
@@ -436,6 +437,11 @@ import {
   send404,
 } from "./http-helpers.js";
 import { orgOf, listOrgs } from "../../shared/manifest/service-links.js";
+import {
+  readOrgContext,
+  resolveAllWorkspaceOrgs,
+  withOrgMembership,
+} from "../../shared/environment-manager/workspace-org.js";
 import {
   readLatestSummary,
   securityReportsDir,
@@ -684,9 +690,18 @@ async function handleRequest(
 
   // ── API: environments ──────────────────────────────────────────────────────
   // Orgs the catalog's repos belong to, with config/den.yml display names.
+  // Each entry also says whether it is the default org (`github_org`) and
+  // which workspaces on this machine belong to it (ORG-1a). Nothing else
+  // changes: same entries, order and fields (ORG-SPEC C3).
   if (pathname === "/api/orgs") {
-    const catalog = readCatalog();
-    const orgs = listOrgs(catalog, readDenConfig().orgs ?? {});
+    const ctx = readOrgContext();
+    const catalog = ctx.catalog;
+    const orgs = withOrgMembership(
+      listOrgs(catalog, ctx.config.orgs ?? {}),
+      resolveAllWorkspaceOrgs(),
+      ctx.file,
+      ctx.config,
+    );
     if (url.searchParams.get("repos") !== "1") return sendJson(res, orgs);
     const repos = Object.fromEntries(
       Object.keys(catalog).map((r) => [r, orgOf(r, catalog)]),
@@ -2375,7 +2390,14 @@ async function handleRequest(
   // ── API: den config ────────────────────────────────────────────────────
   if (pathname === `/api/${product().cli}/config` && req.method === "GET") {
     // `org` resolved (id defaults to edge.org) for the header's org label.
-    return sendJson(res, { ...readDenConfig(), org: readOrg() });
+    const config = readDenConfig();
+    // `default_org` (ORG-1a) is the default work org, `github_org`; `org`
+    // stays the instance org (readOrg).
+    return sendJson(res, {
+      ...config,
+      org: readOrg(),
+      default_org: config.github_org?.trim() || null,
+    });
   }
 
   // ── API: server info + staleness (drives the header "stale server" pill) ────
@@ -3184,7 +3206,7 @@ void (async () => {
   await new Promise<void>((resolve) =>
     setTimeout(resolve, DAEMON_SHUTDOWN_GRACE_MS),
   );
-  await reapDeadDaemons({
+  const reaped = await reapDeadDaemons({
     listDaemons,
     resolveService,
     getActiveWorkspaces,
@@ -3192,7 +3214,12 @@ void (async () => {
     unregisterDaemon,
     delay: (ms) => new Promise<void>((resolve) => setTimeout(resolve, ms)),
     retryDelayMs: DAEMON_RETRY_DELAY_MS,
+    rootOf: daemonRootOf,
   });
+  if (reaped.removed.length > 0)
+    console.error(
+      `Reaped ${reaped.removed.length} stopped daemon(s): ${reaped.removed.join(", ")}`,
+    );
 })();
 
 const prunedSnapshots = pruneDeadSnapshots();

package/src/ui/server/release-service.ts

@@ -19,13 +19,16 @@ import { execFile } from "child_process";
 import { promisify } from "util";
 import { GH_API_TIMEOUT_MS } from "../../shared/constants.js";
 import {
+  readExplicitReleaseOrg,
   readReleaseConfig,
+  releaseOwnerFor,
   type ReleaseConfig,
   type ReleaseRepo,
   type ResolvedReleaseTarget,
   resolveReleaseTarget,
 } from "../../shared/den-config.js";
 import { readCatalog } from "../../shared/environment-manager/catalog.js";
+import { orgOf } from "../../shared/manifest/service-links.js";
 import { listReposWithManifests } from "../../shared/manifest/workspace-manifests.js";
 
 import { product } from "../../shared/product.js";
@@ -262,13 +265,23 @@ export class ReleaseService {
     };
   }
 
-  private org(cfg = this.config()): string {
-    return cfg.org ?? "";
+  /**
+   * The owner a repo is released from (REL-1): an explicit `release.org`
+   * (den.yml or user.yml) wins; otherwise the repo's own non-empty catalog
+   * owner, so a client org's repo releases from its own org; `github_org`
+   * (readReleaseConfig's fallback for `cfg.org`) last.
+   */
+  private ownerFor(repo: string, cfg: ReleaseConfig): string {
+    return releaseOwnerFor({
+      explicitOrg: readExplicitReleaseOrg(),
+      catalogOwner: orgOf(repo, readCatalog()),
+      githubOrg: cfg.org,
+    });
   }
 
   slug(repo: string, cfg = this.config()): string {
     const gh = cfg.repos.find((r) => r.name === repo)?.gh;
-    return gh && gh.includes("/") ? gh : `${this.org(cfg)}/${repo}`;
+    return gh && gh.includes("/") ? gh : `${this.ownerFor(repo, cfg)}/${repo}`;
   }
 
   /**

package/src/ui/server/workspace-routes.ts

@@ -65,6 +65,7 @@ import {
   getWaitDeps,
 } from "../../shared/environment-manager/dag.js";
 import { deriveGraph } from "../../shared/environment-manager/derivation/derive-graph.js";
+import { githubOrgFor } from "../../shared/environment-manager/workspace-org.js";
 import {
   deriveStartTargets,
   filterClosureForStart,
@@ -2158,7 +2159,9 @@ export async function handleWorkspaceRoutes(
         // flow writes one), which used to read as "not in the catalog" and
         // skip the clone entirely. Derive the conventional slug instead, and
         // persist it so every other flow (CLI up/setup) stops hitting this.
-        const ghSlug = resolveRepoGhSlug(svc.repoName);
+        const ghSlug = resolveRepoGhSlug(svc.repoName, readCatalog(), () =>
+          githubOrgFor(ws.name),
+        );
         if (!readCatalog()[svc.repoName]?.gh) {
           upsertCatalogEntry(svc.repoName, { gh: ghSlug });
         }