@monster-orange/den 0.2.6 → 0.2.8

package/src/shared/environment-manager/workspace-manager.ts

@@ -22,6 +22,12 @@ import {
 } from "../process/spawn-streaming.js";
 import { buildServiceEnv } from "./service-env.js";
 import { assertSafeCloneDestination } from "./clone-guard.js";
+import {
+  SAFE_SLUG_RE,
+  isGitRemote,
+  isSafeRemote,
+  redactRemote,
+} from "./git-remote.js";
 import type { CommandDef } from "../types/index.js";
 
 // ── Terminal resolution (macOS) ──────────────────────────────────────────────
@@ -76,13 +82,45 @@ function resolveTerminalAppName(key: string): string | null {
 
 // ── Git helpers ───────────────────────────────────────────────────────────────
 
-function git(cmd: string, cwd?: string): void {
-  execSync(`git -c credential.helper="!gh auth git-credential" ${cmd}`, {
+const GH_CREDENTIAL = `-c credential.helper="!gh auth git-credential"`;
+
+/**
+ * Run git with gh as an extra credential helper (a GitHub clone), or as
+ * plain git (`gh` false: a clone from a catalog `remote:`, which gets only
+ * the user's own credential helper, never gh's: SEC-0).
+ */
+function git(cmd: string, cwd?: string, gh = true): void {
+  execSync(`git ${gh ? `${GH_CREDENTIAL} ` : ""}${cmd}`, {
     cwd,
     stdio: "inherit",
   });
 }
 
+/** Set in a clone made from a `remote:`; its later fetches stay plain git. */
+const PLAIN_MARK = "den.credential";
+
+/** Whether a clone's fetches use gh: every clone but one Den made from a `remote:`. */
+function usesGhCredential(repoPath: string): boolean {
+  try {
+    return (
+      execSync(`git config --local --get ${PLAIN_MARK}`, {
+        cwd: repoPath,
+        stdio: ["ignore", "pipe", "ignore"],
+        encoding: "utf-8",
+      }).trim() !== "git"
+    );
+  } catch {
+    return true; // unset: a GitHub clone, as every clone before ORG-1d
+  }
+}
+
+/** Clone `source` (a GitHub slug or a checked git URL) with its own credentials. */
+function gitClone(args: string, source: string, dest: string): void {
+  const plain = isGitRemote(source);
+  git(`clone ${args}"${cloneUrlOf(source)}" "${dest}"`, undefined, !plain);
+  if (plain) git(`config --local ${PLAIN_MARK} git`, dest, false);
+}
+
 function gitCapture(cmd: string, cwd?: string): string {
   return execSync(cmd, {
     cwd,
@@ -91,10 +129,21 @@ function gitCapture(cmd: string, cwd?: string): string {
   }).trim();
 }
 
-function ghCloneUrl(ghSlug: string): string {
+/** The HTTPS URL a managed clone of `ghSlug` is made from. */
+export function ghCloneUrl(ghSlug: string): string {
   return `https://github.com/${ghSlug}.git`;
 }
 
+/** The URL a clone of `source` is made from: a GitHub slug's, or the remote itself. */
+export function cloneUrlOf(source: string): string {
+  return isGitRemote(source) ? source : ghCloneUrl(source);
+}
+
+/** `source` for a log line: a slug as is, a remote with any user info masked. */
+function shown(source: string): string {
+  return isGitRemote(source) ? redactRemote(source) : source;
+}
+
 // ── Injection guards ──────────────────────────────────────────────────────────
 //
 // git() runs through a shell (execSync), so branch names and GitHub slugs
@@ -105,7 +154,7 @@ function ghCloneUrl(ghSlug: string): string {
 // the single choke point for every clone path.
 
 export const SAFE_BRANCH_RE = /^[a-zA-Z0-9._/-]+$/;
-export const SAFE_SLUG_RE = /^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/;
+export { SAFE_SLUG_RE };
 
 function assertSafeBranch(branch: string): void {
   if (!SAFE_BRANCH_RE.test(branch)) {
@@ -115,10 +164,12 @@ function assertSafeBranch(branch: string): void {
   }
 }
 
+/** A GitHub slug, or (ORG-1d) a git URL from a catalog `remote:`. */
 function assertSafeSlug(ghSlug: string): void {
+  if (isGitRemote(ghSlug) && isSafeRemote(ghSlug)) return;
   if (!SAFE_SLUG_RE.test(ghSlug)) {
     throw new Error(
-      `Invalid GitHub slug "${ghSlug}" — expected "owner/repo" using only letters, digits, ".", "_" and "-"`,
+      `Invalid GitHub slug "${redactRemote(ghSlug)}" — expected "owner/repo" using only letters, digits, ".", "_" and "-"`,
     );
   }
 }
@@ -426,17 +477,15 @@ export function ensureManagedServiceClone(
   if (!fs.existsSync(cloneDir)) {
     assertSafeCloneDestination(cloneDir, repoName);
     console.log(
-      `  ⬇ Cloning ${ghSlug}@${branch} → ${product().servicesDir}/${repoName}/${branch}/`,
+      `  ⬇ Cloning ${shown(ghSlug)}@${branch} → ${product().servicesDir}/${repoName}/${branch}/`,
     );
     fs.mkdirSync(path.join(DEN_SERVICES_DIR, repoName), {
       recursive: true,
     });
-    git(
-      `clone --filter=blob:none --branch "${branch}" "${ghCloneUrl(ghSlug)}" "${cloneDir}"`,
-    );
+    gitClone(`--filter=blob:none --branch "${branch}" `, ghSlug, cloneDir);
     if (runSetup) runSetupIfDefined(cloneDir);
   } else {
-    git("pull --ff-only", cloneDir);
+    git("pull --ff-only", cloneDir, usesGhCredential(cloneDir));
   }
 
   return cloneDir;
@@ -462,12 +511,10 @@ export function ensureManagedServiceCloneNewBranch(
   if (!fs.existsSync(cloneDir)) {
     assertSafeCloneDestination(cloneDir, repoName);
     console.log(
-      `  ⬇ Cloning ${ghSlug}@${baseBranch} → ${product().servicesDir}/${repoName}/${newBranch}/ (new branch: ${newBranch})`,
+      `  ⬇ Cloning ${shown(ghSlug)}@${baseBranch} → ${product().servicesDir}/${repoName}/${newBranch}/ (new branch: ${newBranch})`,
     );
     fs.mkdirSync(path.dirname(cloneDir), { recursive: true });
-    git(
-      `clone --filter=blob:none --branch "${baseBranch}" "${ghCloneUrl(ghSlug)}" "${cloneDir}"`,
-    );
+    gitClone(`--filter=blob:none --branch "${baseBranch}" `, ghSlug, cloneDir);
     git(`checkout -b "${newBranch}"`, cloneDir);
     runSetupIfDefined(cloneDir);
   }
@@ -495,15 +542,13 @@ export function ensureDevManagedClone(
   if (!fs.existsSync(targetDir)) {
     const leafName = path.basename(targetDir);
     assertSafeCloneDestination(targetDir, leafName);
-    console.log(`  ⬇ Cloning ${ghSlug}@${branch} → ${targetDir}/`);
+    console.log(`  ⬇ Cloning ${shown(ghSlug)}@${branch} → ${targetDir}/`);
     fs.mkdirSync(path.dirname(targetDir), { recursive: true });
     try {
-      git(
-        `clone --filter=blob:none --branch "${branch}" "${ghCloneUrl(ghSlug)}" "${targetDir}"`,
-      );
+      gitClone(`--filter=blob:none --branch "${branch}" `, ghSlug, targetDir);
     } catch {
       // Branch may not exist — clone default branch and checkout/create the branch
-      git(`clone --filter=blob:none "${ghCloneUrl(ghSlug)}" "${targetDir}"`);
+      gitClone(`--filter=blob:none `, ghSlug, targetDir);
       try {
         git(`checkout "${branch}"`, targetDir);
       } catch {
@@ -537,17 +582,15 @@ export function ensureWorkspaceClone(
   if (!fs.existsSync(cloneDir)) {
     assertSafeCloneDestination(cloneDir, repoName);
     console.log(
-      `  ⬇ Cloning ${ghSlug}@${branch} → ${product().workspacesDir}/${workspaceName}/${repoName}/`,
+      `  ⬇ Cloning ${shown(ghSlug)}@${branch} → ${product().workspacesDir}/${workspaceName}/${repoName}/`,
     );
     fs.mkdirSync(wsDir, { recursive: true });
 
     try {
-      git(
-        `clone --filter=blob:none --branch "${branch}" "${ghCloneUrl(ghSlug)}" "${cloneDir}"`,
-      );
+      gitClone(`--filter=blob:none --branch "${branch}" `, ghSlug, cloneDir);
     } catch {
       // Branch doesn't exist yet — clone main and create the branch
-      git(`clone --filter=blob:none "${ghCloneUrl(ghSlug)}" "${cloneDir}"`);
+      gitClone(`--filter=blob:none `, ghSlug, cloneDir);
       git(`checkout -b "${branch}"`, cloneDir);
       console.log(`  ✓ Created new branch ${branch} in ${repoName}`);
     }
@@ -659,7 +702,7 @@ export function pullRepo(repoPath: string): void {
   } catch {
     /* best-effort — a genuinely diverged clone still errors on the pull */
   }
-  git("pull --ff-only", repoPath);
+  git("pull --ff-only", repoPath, usesGhCredential(repoPath));
 }
 
 /**
@@ -681,7 +724,7 @@ export function fetchAndFastForward(repoPath: string): {
   pulled: boolean;
   error?: string;
 } {
-  const GH_CRED = `-c credential.helper="!gh auth git-credential"`;
+  const GH_CRED = usesGhCredential(repoPath) ? GH_CREDENTIAL : "";
   try {
     execSync(`git ${GH_CRED} fetch --quiet`, {
       cwd: repoPath,

package/src/shared/environment-manager/workspace-org.ts

@@ -0,0 +1,279 @@
+/**
+ * Which work org a workspace belongs to (ORG-1a, ORG-SPEC §2).
+ *
+ * An org is a key of `orgs:` or a GitHub owner. An org with no `sources`
+ * and no `repos` is the GitHub owner of the same name (ORG-1a); ORG-1d's
+ * keys make it any name (org-sources.ts), and a repo's org is orgOf's.
+ * `github_org` is the default org. A workspace's org resolves through this
+ * chain, first match wins:
+ *
+ *   1. `org:` on the workspace in workspaces.yml (per machine)
+ *   2. `org:` on the same-named blueprint workspace (`defaults.workspaces`)
+ *   3. the single non-empty catalog owner of its repos (case-insensitive)
+ *   4. `github_org`
+ *
+ * Computed on read and never written back to workspaces.yml, so an inferred
+ * org never looks like an explicit one. Every rule broken here is a warning,
+ * never an error (C1): an old config resolves as before, to `github_org`.
+ */
+import {
+  readDenConfig,
+  readWorkspaceBlueprints,
+  requireGithubOrg,
+  type DenConfig,
+  type ResolvedWorkspaceBlueprint,
+} from "../den-config.js";
+import { readCatalog } from "./catalog.js";
+import { parseAddress, readWorkspacesFile } from "./workspaces.js";
+import { orgOf } from "../manifest/service-links.js";
+import { githubOwnersOf, orgClaimingOwner } from "../org-sources.js";
+import { cachedRead } from "../read-cache.js";
+import type {
+  ServiceCatalog,
+  WorkspaceConfig,
+  WorkspacesFile,
+} from "../types/index.js";
+
+/** Which step of the chain gave the org. */
+export type OrgSource = "workspace" | "blueprint" | "catalog" | "default";
+
+export interface WorkspaceOrg {
+  workspace: string;
+  /** The resolved org id (the `orgs:` key's spelling when one matches), or null. */
+  org: string | null;
+  source: OrgSource | null;
+  /** Each broken org rule, as a sentence (C1: warnings, never errors). */
+  warnings: string[];
+}
+
+export interface OrgContext {
+  config: DenConfig;
+  catalog: ServiceCatalog;
+  file: WorkspacesFile;
+  blueprints: ResolvedWorkspaceBlueprint[];
+}
+
+const lower = (s: string): string => s.toLowerCase();
+
+/** The current config, catalog, workspaces.yml and blueprint. */
+export function readOrgContext(): OrgContext {
+  const config = readDenConfig();
+  let blueprints: ResolvedWorkspaceBlueprint[] = [];
+  try {
+    blueprints = readWorkspaceBlueprints(config).workspaces;
+  } catch {
+    // A malformed blueprint is reported where seeding reads it; it must not
+    // turn an org listing into a failure (C1).
+  }
+  return {
+    config,
+    catalog: readCatalog(),
+    file: readWorkspacesFile(),
+    blueprints,
+  };
+}
+
+/**
+ * `id` spelled as its `orgs:` key when one matches case-insensitively; a
+ * GitHub owner an ORG-1d source claims (`github_org: acme` with a source
+ * for acme) is that source's org.
+ */
+export function canonicalOrg(id: string, config: DenConfig): string {
+  const key = Object.keys(config.orgs ?? {}).find(
+    (k) => lower(k) === lower(id),
+  );
+  return key ?? orgClaimingOwner(id, config.orgs) ?? id;
+}
+
+/** The default org: `github_org`, or null when unset. */
+export function defaultOrg(config: DenConfig): string | null {
+  const d = config.github_org?.trim();
+  return d ? canonicalOrg(d, config) : null;
+}
+
+/** The repos a workspace holds; a workspace not set up yet holds its blueprint's. */
+function workspaceRepos(
+  ws: WorkspaceConfig | undefined,
+  bp: ResolvedWorkspaceBlueprint | undefined,
+  catalog: ServiceCatalog,
+): string[] {
+  const held = [
+    ...Object.keys(ws?.services ?? {}).map(
+      (k) => parseAddress(k, catalog).repoName,
+    ),
+    ...Object.keys(ws?.repos ?? {}),
+  ];
+  return [...new Set(held.length > 0 ? held : (bp?.repos ?? []))];
+}
+
+/** Owners Den knows of: `orgs:` keys, catalog owners and `github_org`. */
+function knownOrgs(ctx: OrgContext): Set<string> {
+  const ids = new Set(Object.keys(ctx.config.orgs ?? {}).map(lower));
+  for (const repo of Object.keys(ctx.catalog)) {
+    const o = orgOf(repo, ctx.catalog, ctx.config.orgs);
+    if (o) ids.add(lower(o));
+  }
+  const d = ctx.config.github_org?.trim();
+  if (d) ids.add(lower(d));
+  return ids;
+}
+
+/** Resolve one workspace's org through the chain. */
+export function resolveWorkspaceOrg(
+  name: string,
+  ctx: OrgContext,
+): WorkspaceOrg {
+  const warnings: string[] = [];
+  const ws = ctx.file.workspaces[name];
+  const bp = ctx.blueprints.find((b) => b.name === name);
+  const rawWsOrg = ws?.org as unknown;
+  const wsOrg =
+    typeof rawWsOrg === "string" && rawWsOrg.trim()
+      ? rawWsOrg.trim()
+      : undefined;
+  if (rawWsOrg !== undefined && rawWsOrg !== null && !wsOrg)
+    warnings.push(
+      `workspace ${name}: org in workspaces.yml is not an org id; ignored`,
+    );
+
+  const repos = workspaceRepos(ws, bp, ctx.catalog);
+  const owners = new Map<string, string>(); // lowercased → first spelling
+  for (const repo of repos) {
+    const o = orgOf(repo, ctx.catalog, ctx.config.orgs);
+    if (o && !owners.has(lower(o))) owners.set(lower(o), o);
+  }
+
+  let org: string | null = null;
+  let source: OrgSource | null = null;
+  if (wsOrg) {
+    org = wsOrg;
+    source = "workspace";
+    if (bp?.org && lower(bp.org) !== lower(wsOrg))
+      warnings.push(
+        `workspace ${name}: org ${wsOrg} in workspaces.yml overrides the blueprint's org ${bp.org}`,
+      );
+  } else if (bp?.org) {
+    org = bp.org;
+    source = "blueprint";
+  } else if (owners.size === 1) {
+    org = [...owners.values()][0];
+    source = "catalog";
+  } else {
+    org = ctx.config.github_org?.trim() || null;
+    source = org ? "default" : null;
+    if (owners.size > 1)
+      warnings.push(
+        `workspace ${name}: its repos belong to several owners (${[...owners.values()].join(", ")}); ` +
+          `using ${org ?? "no org"}. Set org: on the workspace to choose one`,
+      );
+  }
+  if (org) org = canonicalOrg(org, ctx.config);
+
+  if (
+    org &&
+    (source === "workspace" || source === "blueprint") &&
+    !knownOrgs(ctx).has(lower(org))
+  )
+    warnings.push(
+      `workspace ${name}: org ${org} is not in orgs:, the catalog or github_org`,
+    );
+
+  // A repo in another owner than its workspace's org. A mixed workspace with
+  // no org of its own already said so above.
+  if (
+    org &&
+    (owners.size <= 1 || source === "workspace" || source === "blueprint")
+  )
+    for (const repo of repos) {
+      const o = orgOf(repo, ctx.catalog, ctx.config.orgs);
+      if (o && lower(o) !== lower(org))
+        warnings.push(
+          `workspace ${name}: repo ${repo} belongs to ${o}, not the workspace's org ${org}`,
+        );
+    }
+
+  return { workspace: name, org, source, warnings };
+}
+
+/** Every workspace on this machine, then blueprint workspaces not set up yet. */
+function workspaceNames(ctx: OrgContext): string[] {
+  return [
+    ...new Set([
+      ...Object.keys(ctx.file.workspaces),
+      ...ctx.blueprints.map((b) => b.name),
+    ]),
+  ];
+}
+
+/** Every workspace's resolved org (cached for the web server's read TTL). */
+export function resolveAllWorkspaceOrgs(ctx?: OrgContext): WorkspaceOrg[] {
+  const compute = (c: OrgContext) =>
+    workspaceNames(c).map((n) => resolveWorkspaceOrg(n, c));
+  if (ctx) return compute(ctx);
+  return cachedRead("workspace-orgs", () => compute(readOrgContext()));
+}
+
+/**
+ * The GitHub owner to clone and register a workspace's repos under: its
+ * resolved org, which for a legacy org is that GitHub owner. An org with
+ * ORG-1d `sources` gives its first GitHub source's owner, and one with no
+ * GitHub source throws (its repos clone from `remote:`; discovery is off).
+ * With no org at all (no org anywhere and no `github_org`) this throws
+ * exactly as requireGithubOrg does, so an old config fails as before.
+ */
+export function githubOrgFor(workspace: string, ctx?: OrgContext): string {
+  const hit = ctx
+    ? resolveWorkspaceOrg(workspace, ctx)
+    : (resolveAllWorkspaceOrgs().find((w) => w.workspace === workspace) ??
+      resolveWorkspaceOrg(workspace, readOrgContext()));
+  if (!hit.org) return requireGithubOrg(ctx?.config);
+  const orgs = (ctx?.config ?? readDenConfig()).orgs;
+  const owner = githubOwnersOf(hit.org, orgs)[0];
+  if (owner) return owner;
+  throw new Error(
+    `org ${hit.org} has no GitHub source (orgs.${hit.org}.sources): ` +
+      `give workspace ${workspace}'s repos a remote: in the service catalog`,
+  );
+}
+
+export interface OrgEntry {
+  id: string;
+  label: string;
+  color?: string;
+}
+
+/**
+ * The org listing with `default` and `workspaces` added to each entry and
+ * nothing else changed (C3): same entries, same order, same fields. Only
+ * workspaces on this machine (workspaces.yml) are listed.
+ */
+export function withOrgMembership<T extends OrgEntry>(
+  orgs: T[],
+  resolved: WorkspaceOrg[],
+  file: WorkspacesFile,
+  config: DenConfig,
+): Array<T & { default: boolean; workspaces: string[] }> {
+  // The listing can hold one owner twice in different case (catalog owners
+  // are listed as spelled); an org lands on the entry spelled exactly like
+  // it, else the first that matches case-insensitively.
+  const entryFor = (id: string): number => {
+    const exact = orgs.findIndex((o) => o.id === id);
+    return exact !== -1
+      ? exact
+      : orgs.findIndex((o) => lower(o.id) === lower(id));
+  };
+  const d = defaultOrg(config);
+  const defaultAt = d === null ? -1 : entryFor(d);
+  const members = orgs.map((): string[] => []);
+  const local = new Set(Object.keys(file.workspaces));
+  for (const w of resolved) {
+    if (!w.org || !local.has(w.workspace)) continue;
+    const at = entryFor(w.org);
+    if (at !== -1) members[at].push(w.workspace);
+  }
+  return orgs.map((o, i) => ({
+    ...o,
+    default: i === defaultAt,
+    workspaces: members[i],
+  }));
+}

package/src/shared/manifest/service-links.ts

@@ -12,6 +12,7 @@ import type {
   ServiceCatalog,
   ServiceManagementConfig,
 } from "../types/index.js";
+import { orgOfRepo, type WorkOrgsConfig } from "../org-sources.js";
 
 export interface OpenLink {
   label: string;
@@ -63,11 +64,18 @@ export function linksFor(
   return out;
 }
 
-/** The GitHub owner a repo is catalogued under ("acme"), or "". */
-export function orgOf(repo: string, catalog: ServiceCatalog): string {
-  const gh = catalog[repo]?.gh ?? "";
-  const slash = gh.indexOf("/");
-  return slash > 0 ? gh.slice(0, slash) : "";
+/**
+ * The org a repo belongs to (ORG-1d): an org whose `repos` lists it, then an
+ * org with a source that claims its owner, then (legacy) its bare GitHub
+ * owner from `gh` ("acme"), else "". Without `orgs` (or with no ORG-1d keys
+ * in it) this is the repo's GitHub owner, as before.
+ */
+export function orgOf(
+  repo: string,
+  catalog: ServiceCatalog,
+  orgs: WorkOrgsConfig = {},
+): string {
+  return orgOfRepo(repo, catalog, orgs);
 }
 
 export interface OrgDisplay {
@@ -75,14 +83,18 @@ export interface OrgDisplay {
   color?: string;
 }
 
-/** Every org in the catalog with its display name, configured ones first. */
+/**
+ * Every org with its display name, configured ones first, then each
+ * catalogued repo's org. An owner a source claims is not an org of its own,
+ * so it is not listed.
+ */
 export function listOrgs(
   catalog: ServiceCatalog,
-  configured: Record<string, OrgDisplay> = {},
+  configured: WorkOrgsConfig = {},
 ): Array<{ id: string; label: string; color?: string }> {
   const ids = new Set<string>(Object.keys(configured));
   for (const repo of Object.keys(catalog)) {
-    const o = orgOf(repo, catalog);
+    const o = orgOf(repo, catalog, configured);
     if (o) ids.add(o);
   }
   return [...ids].map((id) => ({