@monster-orange/den 0.2.6 → 0.2.8

package/src/shared/config-error.ts

@@ -0,0 +1,33 @@
+/**
+ * A distribution config that fails validation (ORG-1d's `orgs:` checks, for
+ * now). It is the user's to fix, not a crash: the CLI prints it and exits 1
+ * before doing anything, and the web server answers it as
+ * `{ ok: false, error, code: "config_invalid" }` with status 422.
+ *
+ * The message names config keys (`orgs.initech.repos`), never values a
+ * secret could hide in.
+ */
+export class ConfigError extends Error {
+  readonly code = "config_invalid";
+
+  constructor(message: string) {
+    super(message);
+    this.name = "ConfigError";
+  }
+}
+
+export function isConfigError(e: unknown): e is ConfigError {
+  return e instanceof ConfigError;
+}
+
+/** The web server's status for a ConfigError: the request was fine, the config is not. */
+export const CONFIG_ERROR_STATUS = 422;
+
+/** The JSON body for a ConfigError (the `{ok, error, code}` frame R26 extends). */
+export function configErrorBody(e: ConfigError): {
+  ok: false;
+  error: string;
+  code: "config_invalid";
+} {
+  return { ok: false, error: e.message, code: e.code };
+}

package/src/shared/den-config.ts

@@ -16,6 +16,8 @@ import type { Environment, ReleaseSourceConfig } from "./types/index.js";
 import { getDistRoot } from "./paths.js";
 import type { SecretsConfig } from "./secrets/index.js";
 import type { OrgConfig } from "./org.js";
+import { validateOrgSources, type WorkOrgsConfig } from "./org-sources.js";
+import { ConfigError, isConfigError } from "./config-error.js";
 import type { TestAccountsConfig } from "./auth/test-accounts.js";
 
 import { product } from "./product.js";
@@ -194,11 +196,13 @@ export interface DenConfig {
   /** GitHub org slug used to list org repos in the web UI (e.g. "Globex-Corp"). */
   github_org?: string;
   /**
-   * Display names (and an optional colour) for the GitHub orgs repos belong
-   * to, keyed by GitHub owner. Orgs are worked out from the catalog; this
-   * only names them.
+   * Work orgs, keyed by org id: a display name and an optional colour. An
+   * entry with neither `sources` nor `repos` is the GitHub owner of its own
+   * name (ORG-1a). ORG-1d: `sources: [{host, owner|group}]` binds the org to
+   * git-host owners, and `repos: [...]` lists repos outright. See
+   * src/shared/org-sources.ts.
    */
-  orgs?: Record<string, { label?: string; color?: string }>;
+  orgs?: WorkOrgsConfig;
   /** Derived-dependency-graph tuning (aliases + edge overrides). */
   graph?: GraphConfig;
   /**
@@ -412,6 +416,41 @@ export function requireGithubOrg(config: DenConfig = readDenConfig()): string {
   return org;
 }
 
+let checked: { key: string; error: ConfigError | null } | null = null;
+
+/**
+ * Throw the config's validation error (a ConfigError naming its keys), if it
+ * has one, without reading anything else. The CLI runs this before any
+ * command that touches orgs, the catalog, clones or releases, and the web
+ * server before every config-reading route, so a config that fails
+ * validation stops them all, not only those that happen to read `orgs:`.
+ * A missing file, or one that does not parse, is left to readDenConfig.
+ * Memoised on the file's mtime and size: the server checks per request.
+ */
+export function assertDenConfigValid(): void {
+  let key: string;
+  try {
+    const st = fs.statSync(DEN_CONFIG_PATH);
+    key = `${st.mtimeMs}:${st.size}`;
+  } catch {
+    return;
+  }
+  if (checked?.key !== key) {
+    let error: ConfigError | null = null;
+    try {
+      const parsed = yaml.parse(fs.readFileSync(DEN_CONFIG_PATH, "utf-8")) as {
+        orgs?: unknown;
+      } | null;
+      validateOrgSources(parsed?.orgs, product().configFile);
+    } catch (e) {
+      if (!isConfigError(e)) return;
+      error = e;
+    }
+    checked = { key, error };
+  }
+  if (checked.error) throw new ConfigError(checked.error.message);
+}
+
 /**
  * Read the effective den config, merging the shared deployment config with
  * per-engineer overrides from config/local/user.yml.
@@ -422,6 +461,9 @@ export function readDenConfig(): DenConfig {
   try {
     const raw = fs.readFileSync(DEN_CONFIG_PATH, "utf-8");
     const parsed = yaml.parse(raw) as Partial<DenConfig> | null;
+    // ORG-1d keys (orgs.<id>.sources / .repos) are checked here, where a bad
+    // value throws naming its key; configs without them are not touched.
+    validateOrgSources(parsed?.orgs, product().configFile);
     // `environments` may be malformed (scalar/object) in a hand-edited file —
     // fall back to the default set rather than throwing on .filter below.
     const envs = Array.isArray(parsed?.environments)
@@ -636,6 +678,8 @@ export interface ResolvedWorkspaceBlueprint {
   branch: string;
   autostartOff: string[];
   focus: boolean;
+  /** `org:` (ORG-1a): the org this workspace belongs to, when the blueprint names one. */
+  org?: string;
 }
 
 /** Which blueprint shape the distribution uses, and its workspaces. */
@@ -644,7 +688,7 @@ export interface WorkspaceBlueprints {
   workspaces: ResolvedWorkspaceBlueprint[];
 }
 
-const BLUEPRINT_KEYS = ["branch", "repos", "autostart_off"];
+const BLUEPRINT_KEYS = ["branch", "repos", "autostart_off", "org"];
 
 function blueprintStrings(where: string, key: string, v: unknown): string[] {
   if (v === undefined) return [];
@@ -674,12 +718,15 @@ function resolveBlueprint(
     throw new Error(`${where}.branch must be a branch name`);
   if (bp.focus !== undefined && typeof bp.focus !== "boolean")
     throw new Error(`${where}.focus must be true or false`);
+  if (bp.org !== undefined && (typeof bp.org !== "string" || !bp.org.trim()))
+    throw new Error(`${where}.org must be an org id (a key of orgs:)`);
   return {
     name,
     repos: blueprintStrings(where, "repos", bp.repos),
     branch,
     autostartOff: blueprintStrings(where, "autostart_off", bp.autostart_off),
     focus: bp.focus === true,
+    ...(typeof bp.org === "string" ? { org: bp.org.trim() } : {}),
   };
 }
 
@@ -864,6 +911,38 @@ export function readReleaseConfig(): ReleaseConfig {
   return cfg;
 }
 
+/**
+ * `release.org` as configured (den.yml, then user.yml), without the
+ * `github_org` fallback readReleaseConfig fills in. An explicit value is the
+ * release owner of every repo (REL-1); unset, each repo's own catalog owner is.
+ */
+export function readExplicitReleaseOrg(): string | undefined {
+  const den = mergeReleaseLayer(
+    DEFAULT_RELEASE_CONFIG,
+    readDenConfig().release,
+  );
+  const org = mergeReleaseLayer(den, readUserConfig().release).org;
+  return typeof org === "string" && org.trim() ? org.trim() : undefined;
+}
+
+/**
+ * The GitHub owner a repo is released from (REL-1): an explicit
+ * `release.org` wins, then the repo's non-empty catalog owner, then
+ * `github_org`. "" when none is known.
+ */
+export function releaseOwnerFor(opts: {
+  explicitOrg?: string;
+  catalogOwner?: string;
+  githubOrg?: string;
+}): string {
+  return (
+    opts.explicitOrg?.trim() ||
+    opts.catalogOwner?.trim() ||
+    opts.githubOrg?.trim() ||
+    ""
+  );
+}
+
 /**
  * Persist a personal release override to config/local/user.yml (gitignored).
  * Used by the Release tab's wave editor — team defaults stay in den.yml.

package/src/shared/environment-manager/catalog.ts

@@ -14,7 +14,13 @@ import * as path from "path";
 import * as yaml from "yaml";
 import type { ServiceCatalog, ServiceCatalogEntry } from "../types/index.js";
 import { getDistRoot } from "../paths.js";
-import { requireGithubOrg } from "../den-config.js";
+import { readDenConfig, requireGithubOrg } from "../den-config.js";
+import {
+  parseRemote,
+  repoSource,
+  type WorkOrgsConfig,
+} from "../org-sources.js";
+import { checkedRemote, isGitRemote } from "./git-remote.js";
 
 /** Fallback GitHub org when `config/den.yml` doesn't set `github_org`. */
 
@@ -55,7 +61,8 @@ export function upsertCatalogEntry(
 /**
  * GitHub slug to clone `repoName` from.
  *
- * The catalog's `gh` when set, else the conventional `<github_org>/<repo>` —
+ * The catalog's `gh` when set, else the conventional `<org>/<repo>`, where
+ * `<org>` is the workspace's resolved org (`github_org` when none is given) —
  * the same rule `seedDefaultWorkspace` uses. Entries written by the
  * dev-managed add flow carry `gh: ""`, so a repo can be IN the catalog and
  * still have no slug; deriving it (rather than refusing to clone) is what lets
@@ -64,10 +71,61 @@ export function upsertCatalogEntry(
 export function resolveRepoGhSlug(
   repoName: string,
   catalog: ServiceCatalog = readCatalog(),
+  /**
+   * The owner for a repo with no `gh`: the workspace's resolved org
+   * (`() => githubOrgFor(ws)`, ORG-1a). Called only when needed, so a repo
+   * with a slug never needs an org. Defaults to `github_org`.
+   */
+  owner: () => string = () => requireGithubOrg(),
 ): string {
   const gh = catalog[repoName]?.gh?.trim();
   if (gh) return gh;
-  return `${requireGithubOrg()}/${repoName}`;
+  return `${owner()}/${repoName}`;
+}
+
+/**
+ * What `repoName` clones from (ORG-1d): a GitHub slug or a git URL (see
+ * git-remote.ts). The repo's source decides: a GitHub source gives its slug
+ * (`gh`, else `<owner>/<repo>`). A repo with no source and a `remote:` gives
+ * that remote, through plain git. Anything else is the legacy GitHub slug
+ * (resolveRepoGhSlug), so a catalog without `remote:` clones as before.
+ */
+export function resolveRepoCloneSource(
+  repoName: string,
+  catalog: ServiceCatalog = readCatalog(),
+  owner: () => string = () => requireGithubOrg(),
+  orgs: WorkOrgsConfig | undefined = readDenConfig().orgs,
+): string {
+  const entry = catalog[repoName];
+  const gh = entry?.gh?.trim();
+  const remote = entry?.remote?.trim();
+  const src = repoSource(repoName, catalog, orgs ?? {});
+  if (src?.host === "github") {
+    if (gh) return gh;
+    const fromRemote = remote ? parseRemote(remote) : null;
+    return fromRemote?.host === "github"
+      ? `${fromRemote.owner}/${repoName}`
+      : `${src.owner ?? ""}/${repoName}`;
+  }
+  if (remote) return checkedRemote(repoName, remote);
+  if (src)
+    throw new Error(
+      `${repoName}: its org's source is on ${src.host}, which Den clones only ` +
+        `from a remote: — set ${repoName}.remote in the service catalog`,
+    );
+  return resolveRepoGhSlug(repoName, catalog, owner);
+}
+
+/**
+ * Whether a clone source may be written back as the catalog's `gh` (the
+ * empty-slug repair): only a GitHub slug, and only for an entry with no
+ * `gh` and no `remote` of its own.
+ */
+export function needsGhRepair(
+  entry: ServiceCatalogEntry | undefined,
+  source: string,
+): boolean {
+  return !isGitRemote(source) && !entry?.gh?.trim() && !entry?.remote?.trim();
 }
 
 export function removeCatalogEntry(repoName: string): void {

package/src/shared/environment-manager/default-workspace.ts

@@ -5,7 +5,8 @@
  * all managed. On a fresh clone (no local workspace) den offers — once —
  * to seed the `default` workspace from it so `den graph` / `den up` show the
  * full system graph immediately; `den init` (run in the den root) re-seeds.
- * Catalog clone URLs derive as `<github_org>/<repo>`. Switch any repo to a local
+ * Catalog clone URLs derive as `<org>/<repo>`, with the workspace's resolved org
+ * (workspace-org.ts; `github_org` unless the blueprint or catalog says otherwise). Switch any repo to a local
  * checkout with `den use-local <repo>`.
  */
 import {
@@ -16,9 +17,15 @@ import {
 import { readCatalog, writeCatalog } from "./catalog.js";
 import {
   readWorkspaceBlueprints,
-  requireGithubOrg,
   type ResolvedWorkspaceBlueprint,
 } from "../den-config.js";
+import {
+  githubOrgFor,
+  readOrgContext,
+  resolveWorkspaceOrg,
+  type OrgContext,
+} from "./workspace-org.js";
+import { orgHasGithub } from "../org-sources.js";
 import type {
   ServiceCatalog,
   WorkspaceConfig,
@@ -47,10 +54,6 @@ export function defaultWorkspaceRepos(): string[] {
   return singleBlueprint()?.repos ?? [];
 }
 
-function org(): string {
-  return requireGithubOrg();
-}
-
 function blueprintServices(
   bp: ResolvedWorkspaceBlueprint,
   repos: string[] = bp.repos,
@@ -70,14 +73,47 @@ function blueprintServices(
   return services;
 }
 
+/**
+ * The clone slug seeding would give each repo the catalog has no `gh` for:
+ * `<org>/<repo>` with its workspace's resolved org. A repo in several
+ * workspaces takes the first one's. Reads only; throws when a repo needs an
+ * org and none resolves (no org anywhere and no `github_org`).
+ */
+export function catalogFill(
+  workspaces: { name: string; repos: string[] }[],
+  catalog: ServiceCatalog = readCatalog(),
+  ctx: OrgContext = readOrgContext(),
+): Map<string, string> {
+  const fill = new Map<string, string>();
+  for (const ws of workspaces) {
+    // ORG-1d: an org with no GitHub source has no slug to give; its repos
+    // clone from their catalog `remote:`.
+    const org = resolveWorkspaceOrg(ws.name, ctx).org;
+    if (org && !orgHasGithub(org, ctx.config.orgs)) continue;
+    for (const repo of ws.repos) {
+      if (catalog[repo]?.gh || catalog[repo]?.remote || fill.has(repo))
+        continue;
+      fill.set(repo, `${githubOrgFor(ws.name, ctx)}/${repo}`);
+    }
+  }
+  return fill;
+}
+
+/**
+ * Give each blueprint repo with no clone URL `<org>/<repo>`, where `<org>` is
+ * its workspace's resolved org (ORG-1a: the blueprint's `org:`, else the
+ * catalog owners, else `github_org`), so a client workspace never clones
+ * from the default org on a fresh machine. The org is resolved only for a
+ * repo that needs one, and before anything is written: an unresolvable org
+ * throws with the catalog untouched.
+ */
 function fillCatalog(
-  repos: string[],
+  workspaces: { name: string; repos: string[] }[],
   catalog: ServiceCatalog = readCatalog(),
 ): void {
-  const o = org();
-  for (const repo of repos) {
-    if (!catalog[repo]?.gh) catalog[repo] = { gh: `${o}/${repo}` };
-  }
+  const fill = catalogFill(workspaces, catalog);
+  if (fill.size === 0) return;
+  for (const [repo, gh] of fill) catalog[repo] = { gh };
   writeCatalog(catalog);
 }
 
@@ -178,6 +214,9 @@ export function seedDefaultWorkspace(): string[] {
   if (!bp) return [];
   const repos = bp.repos;
 
+  // The catalog first: it is what can fail (no github_org), and a failure
+  // must leave the workspaces as they were, not reset and uncloneable.
+  fillCatalog([{ name: "default", repos }]);
   const file = readWorkspacesFile();
   file.workspaces.default = {
     ...(file.workspaces.default ?? {}),
@@ -189,7 +228,6 @@ export function seedDefaultWorkspace(): string[] {
     file.focus = "default";
   }
   writeWorkspacesFile(file);
-  fillCatalog(repos);
   return repos;
 }
 
@@ -202,6 +240,7 @@ export function seedDefaultWorkspace(): string[] {
 export function seedBlueprintWorkspaces(): { name: string; repos: string[] }[] {
   const bps = blueprintWorkspaces();
   if (bps.length === 0) return [];
+  fillCatalog(bps);
   const file = readWorkspacesFile();
   for (const bp of bps) {
     const prev: WorkspaceConfig | undefined = file.workspaces[bp.name];
@@ -223,7 +262,6 @@ export function seedBlueprintWorkspaces(): { name: string; repos: string[] }[] {
   file.active = [...names, ...kept.filter((n) => !names.includes(n))];
   file.focus = (bps.find((b) => b.focus) ?? bps[0]).name;
   writeWorkspacesFile(file);
-  fillCatalog([...new Set(bps.flatMap((b) => b.repos))]);
   return bps.map((b) => ({ name: b.name, repos: [...b.repos] }));
 }
 
@@ -277,7 +315,8 @@ export function topUpDefaultWorkspace(): string[] {
 
   def.seeded_repos = [...repos];
   writeWorkspacesFile(file);
-  if (missing.length > 0) fillCatalog(missing, catalog);
+  if (missing.length > 0)
+    fillCatalog([{ name: "default", repos: missing }], catalog);
   return missing;
 }
 

package/src/shared/environment-manager/git-remote.ts

@@ -0,0 +1,49 @@
+/**
+ * What a managed clone is made from (ORG-1d): a GitHub slug (`owner/repo`,
+ * cloned from github.com with the user's gh as credential helper) or a git
+ * URL from the catalog's `remote:` (cloned through plain git and the user's
+ * own credential helper, never Den's or gh's: SEC-0).
+ *
+ * Clone commands run through a shell, so a remote must pass REMOTE_RE: a URL
+ * with a known transport, scp-style `user@host:path`, or an absolute path,
+ * and nothing a shell or git would read as a command (`ext::`, quotes, `$`,
+ * spaces, a leading `-`).
+ */
+
+/** A GitHub slug, as the clone guards accept it. */
+export const SAFE_SLUG_RE = /^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/;
+
+const REMOTE_RE =
+  /^(?:(?:https?|ssh|git|file):\/\/[A-Za-z0-9._~@:%+/-]+|[A-Za-z0-9._-]+@[A-Za-z0-9.-]+:[A-Za-z0-9._~+/-]+|\/[A-Za-z0-9._~@+/-]+)$/;
+
+/** True when `spec` is a git URL rather than a GitHub slug. */
+export function isGitRemote(spec: string): boolean {
+  return !SAFE_SLUG_RE.test(spec);
+}
+
+/** True when `remote` is a git URL Den will hand to git. */
+export function isSafeRemote(remote: string): boolean {
+  return REMOTE_RE.test(remote) && !remote.includes("..");
+}
+
+/**
+ * `remote` for display: any user info (`https://user:token@host/…`) masked.
+ * Remotes can carry a token, so one is never printed as written.
+ */
+export function redactRemote(remote: string): string {
+  return remote.replace(/^([a-z+]+:\/\/)[^@/]+@/i, "$1***@");
+}
+
+/**
+ * The checked remote for `repo`, or a throw naming its catalog key (and not
+ * its value, which may hold a token).
+ */
+export function checkedRemote(repo: string, remote: string): string {
+  const r = remote.trim();
+  if (!isSafeRemote(r))
+    throw new Error(
+      `service catalog: ${repo}.remote is not a git URL Den can clone ` +
+        `(https://, ssh://, git://, file://, user@host:path or an absolute path)`,
+    );
+  return r;
+}

package/src/shared/environment-manager/health.ts

@@ -230,6 +230,28 @@ function trustContext(): { context: tls.SecureContext; agent: https.Agent } {
   return _trust;
 }
 
+/**
+ * The body a reverse proxy sends for a host it has no route for: Traefik's
+ * default 404 (Go's http.NotFound). Behind a shared edge a stopped service
+ * answers with this instead of refusing the connection, so a 4xx-means-up
+ * rule would show it healthy. A service's own 404 carries its own body.
+ */
+const EDGE_NO_ROUTE_BODY = "404 page not found";
+
+/** Up: 2xx, or a 4xx from the service itself (auth/route proves it answers). */
+function statusOk(status: number, body404?: string): boolean {
+  if (status === 404 && body404?.trim() === EDGE_NO_ROUTE_BODY) return false;
+  return status < 300 || (status >= 400 && status < 500);
+}
+
+/** The PingResult for `status`, naming an edge 404 as "no route". */
+function statusResult(status: number, body404?: string): PingResult {
+  const ok = statusOk(status, body404);
+  return ok || status !== 404
+    ? { ok, status }
+    : { ok, status, error: "no route (edge 404)" };
+}
+
 /**
  * HTTPS check. Connects to the c-ares-resolved IP (see above) but keeps the
  * hostname for SNI and certificate verification; rewriting the URL to the IP,
@@ -276,11 +298,23 @@ async function pingHttps(parsed: URL, timeoutMs: number): Promise<PingResult> {
       },
       (res) => {
         const status = res.statusCode ?? 0;
-        res.resume(); // discard the body
-        done({
-          ok: status < 300 || (status >= 400 && status < 500),
-          status,
+        if (status !== 404) {
+          res.resume(); // discard the body
+          done({ ok: statusOk(status), status });
+          return;
+        }
+        // A 404: read a little of the body to tell the edge's own "no
+        // route" from the service's 404.
+        let body = "";
+        res.setEncoding("utf8");
+        res.on("data", (c: string) => {
+          if (body.length < 64) body += c;
+          if (body.length >= 64) res.destroy();
         });
+        const finish = () => done(statusResult(status, body));
+        res.on("end", finish);
+        res.on("close", finish);
+        res.on("error", finish);
       },
     );
     const timer = setTimeout(() => {
@@ -334,11 +368,20 @@ async function pingOnce(
     // (e.g. VPN / /etc/hosts) returning 301 on port 80 for services that actually run
     // on a different port — the previous `< 500` check showed those as green.
     // 5xx = unhealthy (service errored).
-    const ok = res.status < 300 || (res.status >= 400 && res.status < 500);
-    // Discard the body: only the status matters, and unconsumed bodies pin
-    // sockets in the long-lived web server (one leak per poll adds up).
+    // A 404 may be the edge's own "no route" (see EDGE_NO_ROUTE_BODY): read
+    // a little of it. Otherwise discard the body: only the status matters,
+    // and unconsumed bodies pin sockets in the long-lived web server.
+    if (res.status === 404) {
+      let body = "";
+      try {
+        body = (await res.text()).slice(0, 64);
+      } catch {
+        /* unreadable body: judge by the status alone */
+      }
+      return statusResult(res.status, body);
+    }
     void res.body?.cancel().catch(() => {});
-    return { ok, status: res.status };
+    return { ok: statusOk(res.status), status: res.status };
   } catch (e: unknown) {
     clearTimeout(timer);
     const err = e as Error;

package/src/shared/environment-manager/service-runner.ts

@@ -69,7 +69,7 @@ import type {
   WorkspaceConfig,
 } from "../types/index.js";
 import type { ChildProcess } from "child_process";
-import { getStateDir } from "../paths.js";
+import { getDistRoot, getStateDir } from "../paths.js";
 
 import { product } from "../product.js";
 // Re-export so existing callers don't need to change their import path.
@@ -101,6 +101,33 @@ export interface DaemonRecord {
    * command. Optional for backward-compat with records written before this.
    */
   containers?: string[];
+  /**
+   * The distribution root (realpath) whose server or CLI registered this
+   * daemon. Every root of a product shares one daemons file, so startup
+   * pruning skips records stamped by another root. Missing on records
+   * written before 0.2.7.
+   */
+  root?: string;
+}
+
+/** This process's distribution root, as stamped on its daemon records. */
+function daemonRoot(): string | null {
+  try {
+    return fs.realpathSync(getDistRoot());
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Whose a daemon record is: this root's, another root's (all roots of a
+ * product share one daemons file), or unstamped (written before 0.2.7).
+ */
+export function daemonRootOf(
+  d: Pick<DaemonRecord, "root">,
+): "here" | "other" | "unstamped" {
+  if (!d.root) return "unstamped";
+  return d.root === daemonRoot() ? "here" : "other";
 }
 
 export type ServiceConflictReason = "identity_mismatch" | "orphan_containers";
@@ -263,8 +290,10 @@ export function registerDaemon(record: DaemonRecord): void {
     ? (existing?.workspaces ?? [])
     : [];
   const workspaces = [...new Set([...inherited, ...(record.workspaces ?? [])])];
+  const root = daemonRoot() ?? record.root;
   _daemonRegistry.set(record.address, {
     ...record,
+    ...(root ? { root } : {}),
     workspaces,
     branch: normalizeBranch(record.branch),
   });
@@ -296,9 +325,17 @@ export function updateDaemonContainers(
   saveDaemonsFile(getDaemonsFile());
 }
 
+/**
+ * This root's daemons (and unstamped legacy ones). Every root of a product
+ * shares one daemons file; another root's records stay in it untouched but
+ * are not listed, so this server never shows, stops, releases or sweeps
+ * them. Lookups by address (findDaemonByAddress) still see every record.
+ */
 export function listDaemons(): DaemonRecord[] {
   loadDaemonsFromFile();
-  return Array.from(_daemonRegistry.values());
+  return Array.from(_daemonRegistry.values()).filter(
+    (d) => daemonRootOf(d) !== "other",
+  );
 }
 
 export function findDaemonByAddress(address: string): DaemonRecord | undefined {
@@ -646,8 +683,11 @@ export function isDaemonVerifiablyDead(
  * clear stale entries from previous sessions. Otherwise they reopen as tabs in
  * the web UI and clutter the shutdown prompt.
  *
- * A daemon is dropped when:
- *  - its address no longer resolves to a workspace/catalog service, OR
+ * A daemon stamped by another root (all roots of a product share the file)
+ * is never touched. Otherwise it is dropped when:
+ *  - it was stamped by this root and its address no longer resolves to a
+ *    workspace/catalog service (an unstamped legacy record might belong to
+ *    another root, so this alone never drops one), OR
  *  - it is opctl-based (has captured containers or a discoverable dev-op) and
  *    NONE of its candidate containers are currently running.
  *
@@ -687,7 +727,13 @@ function pruneAgainst(
   const pruned: string[] = [];
   for (const d of daemons) {
     try {
-      if (!canResolveDaemonAddress(d)) {
+      const root = daemonRootOf(d);
+      // Another root's daemon: its services resolve in its workspaces, not
+      // ours, and its liveness is its own server's call.
+      if (root === "other") continue;
+      // An unresolvable address is only proof of staleness for a record
+      // this root wrote; an unstamped one may belong to another root.
+      if (root === "here" && !canResolveDaemonAddress(d)) {
         unregisterDaemon(d.address);
         pruned.push(d.address);
         continue;