@monster-orange/den 0.2.6 → 0.2.8

package/src/ui/cli/index.ts

@@ -16,7 +16,8 @@ import { noun, plural } from "../../shared/plural.js";
 // Spinners: progress on stderr (a terminal) or stdout (piped); plain lines
 // where they cannot animate. See spinner.ts.
 import { spinner as ora } from "./spinner.js";
-import Table from "cli-table3";
+import { newTable } from "./table.js";
+import { validateAll, validateAllFailed } from "./validate-all.js";
 import { cliPrompts } from "./prompts.js";
 import { resultsViewer } from "./results-viewer.js";
 import { testRunner } from "./test-runner.js";
@@ -31,10 +32,12 @@ import { moduleScanner } from "../../shared/test-discovery/module-scanner.js";
 import { resolvePerformanceModules } from "./module-selection.js";
 import {
   readCatalog,
-  resolveRepoGhSlug,
+  needsGhRepair,
+  resolveRepoCloneSource,
   upsertCatalogEntry,
 } from "../../shared/environment-manager/catalog.js";
 import { seedSecretsFromSibling } from "../../shared/environment-manager/secrets-check.js";
+import { upNeedsTarget } from "./up-args.js";
 import {
   readWorkspacesFile,
   writeWorkspacesFile,
@@ -108,6 +111,7 @@ import {
 } from "../../shared/environment-manager/service-runner.js";
 import { getGitHubCoords } from "../../shared/smoke/git-remote.js";
 import {
+  assertDenConfigValid,
   getReposRoot,
   mergeUserConfig,
   readDenConfig,
@@ -139,7 +143,10 @@ import {
 } from "../../shared/environment-manager/up-plan.js";
 import { execSync } from "child_process";
 import * as fs from "fs";
-import { readManifest } from "../../shared/manifest/read-manifest.js";
+import {
+  heldManifestsDir,
+  readManifest,
+} from "../../shared/manifest/read-manifest.js";
 import * as nodePath from "path";
 import { runInit } from "./init.js";
 import {
@@ -168,11 +175,26 @@ import { cmdConfig } from "./config-command.js";
 import { cmdEdge } from "./edge-command.js";
 import { cmdService } from "./service-command.js";
 import { cmdStack } from "./stack-command.js";
+import {
+  cmdOrg,
+  orgFlag,
+  orgListRows,
+  printOrgWarnings,
+  registerOrg,
+  sameOrg,
+} from "./org-command.js";
+import {
+  buildSetupPlan,
+  renderClonePlan,
+  workspaceClonePlan,
+} from "./clone-plan.js";
+import { githubOrgFor } from "../../shared/environment-manager/workspace-org.js";
 import { cmdWeb, displayWebHelp } from "./web-command.js";
 import { cmdGraph } from "./graph-command.js";
 import { resolveLogsTarget, tailServiceLogs } from "./logs-command.js";
 import {
   parseCliArgs,
+  takeWorkspaceFlags,
   unknownCommandFlags,
   workspaceFlagRequiresActive,
   type ParsedCliArgs,
@@ -205,8 +227,11 @@ const WORKSPACE_SUBCOMMANDS: {
 }[] = [
   {
     name: "list",
-    usage: "list",
-    lines: ["every workspace, the active set and the focus"],
+    usage: "list [--org <id>]",
+    lines: [
+      "every workspace, the active set, the focus and its org;",
+      "--org <id> lists one org's workspaces",
+    ],
   },
   {
     name: "activate",
@@ -294,19 +319,35 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
     lines: ["List all registered services in the catalog."],
   },
   register: {
-    usage: "register [path]",
+    usage: "register [path] [--org <id>] [-w <workspace>]",
     lines: [
       "With a path: add that checkout (dev-managed) under its manifest name.",
-      "Without one: pick the repo interactively.",
+      "Without one: pick the repo interactively. A managed clone is picked",
+      "from the focused workspace's org; --org <id> picks from another.",
+      "-w writes that workspace (active or not) and leaves focus alone.",
     ],
   },
   setup: {
-    usage: "setup [service...] [--force|-f]",
+    usage:
+      "setup [service...] [--force|-f] [--plan [-w <workspace>]... [--all-active]]",
     lines: [
       "Run 'make setup' once per system (clones missing managed repos first).",
       "Default targets MANAGED clones only — setup's codegen/installs",
       "shouldn't touch your own dev-managed checkouts uninvited.",
       "--force (-f) includes dev-managed repos; naming a service always works.",
+      "--plan prints each repo's org and clone URL and stops: nothing is",
+      "cloned, seeded or written (on a fresh machine: the blueprint's plan).",
+      "It plans the focused workspace; -w <workspace> (repeatable) plans those,",
+      "--all-active every active one. Repos only other workspaces hold are named.",
+    ],
+  },
+  org: {
+    usage: "org list [--org <id>]",
+    lines: [
+      "Every org: its label, its workspaces, whether it is the default",
+      "(github_org), and any org warnings. A workspace's org is its own org:,",
+      "then the blueprint's org:, then its repos' one catalog owner, then",
+      "github_org.",
     ],
   },
   sync: {
@@ -439,6 +480,7 @@ const TELEMETRY_COMMANDS = new Set<string>([
   `use-managed`,
   "setup",
   "workspace",
+  "org",
   "sync",
   "init",
   "validate",
@@ -453,6 +495,27 @@ const TELEMETRY_COMMANDS = new Set<string>([
   "service",
 ]);
 
+/**
+ * Commands that run with a config that fails validation: the web and MCP
+ * servers (each route or tool reports it), and those that read neither orgs,
+ * the catalog nor clones (manifest validate, create, the per-engineer
+ * config and local-dev toggles, saved results). Every other registered
+ * command checks the config first.
+ */
+const CONFIG_FREE_COMMANDS = new Set<string>([
+  "web",
+  "mcp",
+  "validate",
+  "create",
+  "config",
+  "local-dev",
+  "view-results",
+]);
+
+function configCheckedCommand(command: string): boolean {
+  return TELEMETRY_COMMANDS.has(command) && !CONFIG_FREE_COMMANDS.has(command);
+}
+
 /** Map a raw command token to a PII-safe, registered telemetry command name. */
 function telemetryCommandName(command?: string): string {
   if (!command) return "none";
@@ -675,6 +738,12 @@ class DenCLI {
     }
 
     try {
+      // A config that fails validation stops every command that touches
+      // orgs, the catalog, clones or releases before it reads or writes
+      // anything: some (sync over existing clones, register, workspace
+      // create) never read `orgs:` and used to carry on (ORG-1d).
+      if (command && configCheckedCommand(command)) assertDenConfigValid();
+
       switch (command) {
         case "run":
           await this.runTestsCommand(args.slice(1));
@@ -745,6 +814,10 @@ class DenCLI {
           await this.cmdWorkspace(args.slice(1));
           break;
 
+        case "org":
+          cmdOrg(args.slice(1));
+          break;
+
         case "sync":
           await this.cmdSync(args.slice(1));
           break;
@@ -752,9 +825,23 @@ class DenCLI {
         case "init": {
           // In the den root, `init` seeds/resets the default workspace; pointed
           // at a service repo it scaffolds that repo's .den.yml (manifest init).
-          const initTarget = args[1] ?? getInvokeCwd();
-          if (nodePath.resolve(initTarget) === getDistRoot()) {
-            await this.seedDefaultWorkspaceFlow("init");
+          const initTarget =
+            args.slice(1).find((a) => !a.startsWith("-")) ?? getInvokeCwd();
+          // Compare real paths: a symlinked tmp or home (/var → /private/var)
+          // must not turn a seed into a manifest scaffold.
+          const real = (p: string) => {
+            try {
+              return fs.realpathSync(nodePath.resolve(p));
+            } catch {
+              return nodePath.resolve(p);
+            }
+          };
+          if (real(initTarget) === real(getDistRoot())) {
+            await this.seedDefaultWorkspaceFlow(
+              "init",
+              args.slice(1).includes("--reset"),
+              "init",
+            );
           } else {
             await runInit(initTarget);
           }
@@ -1088,7 +1175,15 @@ class DenCLI {
       if (!catalogEntry) continue;
       const branch = wsEntry.branch ?? "main";
       try {
-        ensureManagedServiceClone(repoName, catalogEntry.gh, branch);
+        // An entry with `gh: ""` clones from the workspace's org, as `up`
+        // does (and `setup --plan` says), instead of failing on an empty slug.
+        // ORG-1d: a repo with no source and a `remote:` clones from it.
+        const ghSlug = resolveRepoCloneSource(repoName, catalog, () =>
+          githubOrgFor(ws.name),
+        );
+        if (needsGhRepair(catalogEntry, ghSlug))
+          upsertCatalogEntry(repoName, { ...catalogEntry, gh: ghSlug });
+        ensureManagedServiceClone(repoName, ghSlug, branch);
       } catch (err) {
         console.log(
           chalk.red(
@@ -1189,8 +1284,12 @@ class DenCLI {
       // Catalog entries written by the dev-managed add flow carry `gh: ""`, so
       // an entry can exist yet be unclonable. Derive the conventional slug and
       // persist the repair rather than cloning from an empty URL.
-      const ghSlug = resolveRepoGhSlug(repoName, catalog);
-      if (!catalog[repoName]?.gh) upsertCatalogEntry(repoName, { gh: ghSlug });
+      // ORG-1d: a repo with no source and a `remote:` clones from it.
+      const ghSlug = resolveRepoCloneSource(repoName, catalog, () =>
+        githubOrgFor(ws.name),
+      );
+      if (needsGhRepair(catalog[repoName], ghSlug))
+        upsertCatalogEntry(repoName, { ...catalog[repoName], gh: ghSlug });
       try {
         // runSetup=false: clone only — setup is run below, hidden + non-interactive.
         ensureManagedServiceClone(repoName, ghSlug, branch, false);
@@ -1427,6 +1526,8 @@ class DenCLI {
        * in order, and run nothing. Read-only on every path.
        */
       dryRun?: boolean;
+      /** `--plan`: a preview that would run nothing exits 1. */
+      plan?: boolean;
     },
   ): Promise<void> {
     // How long to show startup output before handing control back to the menu
@@ -1538,6 +1639,7 @@ class DenCLI {
         );
       }
       if (previews.some((p) => p.kind === "error")) process.exitCode = 1;
+      if (opts?.plan && runs.length === 0) process.exitCode = 1;
       console.log(chalk.gray(`  (--dry-run: not ${doing} anything)\n`));
       return;
     }
@@ -1892,6 +1994,25 @@ class DenCLI {
     return seed && knownRepos.has(seed) ? seed : undefined;
   }
 
+  /**
+   * `up --plan`'s clone half (ORG-1a): each repo's org and the URL a missing
+   * managed clone would come from. Read-only, like the rest of the plan.
+   */
+  private renderUpClonePlan(repos: readonly string[]): void {
+    const ws = getActiveWorkspace();
+    if (!ws) return;
+    const lines = renderClonePlan(
+      {
+        fromBlueprint: false,
+        workspaces: [workspaceClonePlan(ws.name, repos)],
+      },
+      product().cli,
+    );
+    console.log(chalk.bold("  Repos and clone URLs:\n"));
+    for (const line of lines) console.log(chalk.gray(`  ${line}`.trimEnd()));
+    console.log();
+  }
+
   /** Render the read-only `den up --plan` view: per-node command + flags. */
   private renderUpPlan(nodes: NodePlan[]): void {
     const tag = (n: NodePlan): string => {
@@ -1962,6 +2083,7 @@ class DenCLI {
           `\n  ${chalk.bold(seed)} has no derived dependencies to start.\n`,
         ),
       );
+      if (plan) process.exitCode = 1;
       return;
     }
     // Systems the user toggled to auto-start OFF in this workspace are not
@@ -2005,6 +2127,7 @@ class DenCLI {
       this.renderUpPlan(
         buildUpPlan(graph, rawOrder, { noAutostart: noAutostartSet }),
       );
+      this.renderUpClonePlan(rawOrder);
       return;
     }
     if (dryRun) {
@@ -2202,6 +2325,7 @@ class DenCLI {
           "\n  No services in the active workspace — nothing to start.\n",
         ),
       );
+      if (plan) process.exitCode = 1;
       return;
     }
     const { rawOrder, graph } = target;
@@ -2216,6 +2340,7 @@ class DenCLI {
       this.renderUpPlan(
         buildUpPlan(graph, rawOrder, { noAutostart: noAutostartSet }),
       );
+      this.renderUpClonePlan(rawOrder);
       return;
     }
     if (dryRun) {
@@ -2494,6 +2619,8 @@ class DenCLI {
    */
   private async seedDefaultWorkspaceFlow(
     reason: "auto" | "init",
+    reset = false,
+    via: "init" | "workspace seed" = "workspace seed",
   ): Promise<boolean> {
     const bps = blueprintWorkspaces();
     if (bps.length === 0) {
@@ -2520,6 +2647,23 @@ class DenCLI {
     }
     const willReset = defaultWorkspaceHasServices();
     const interactive = !!(process.stdin.isTTY && process.stdout.isTTY);
+    // A reset replaces every entry, dev-managed checkouts included. On a TTY
+    // the user is asked (default No); without one there is nobody to ask, so
+    // only an explicit --reset may do it (SEED-0).
+    if (willReset && !interactive && !reset) {
+      const what = multi
+        ? "the blueprint's workspaces"
+        : "the default workspace";
+      console.error(
+        chalk.red(
+          `\n  ❌ Not resetting ${what}: it has entries, and a reset replaces them all\n` +
+            `     (your own dev-managed checkouts included) with managed clones.\n` +
+            `     Nothing changed. To reset anyway: ${product().cli} ${via} --reset\n`,
+        ),
+      );
+      process.exitCode = 1;
+      return false;
+    }
 
     for (const bp of bps) {
       const label = multi ? `Workspace ${bp.name}` : "Default workspace";
@@ -2613,10 +2757,10 @@ class DenCLI {
   }
 
   private async cmdServiceUp(args: string[]): Promise<void> {
-    await this.ensureWorkspaceSeeded();
     // Tokens after a `--` terminator belong to a child command — they must
     // never be read as up's own flags (`den up -- -a` is NOT `up -a`).
     const terminator = args.indexOf("--");
+    await this.ensureWorkspaceSeeded();
     const { app, rest } = takeAppFlag(
       terminator === -1 ? args : args.slice(0, terminator),
     );
@@ -2680,6 +2824,7 @@ class DenCLI {
     await this.cmdServiceUpManifest(
       ownArgs.filter((a) => !a.startsWith("-")),
       dryRun || plan,
+      plan,
     );
   }
 
@@ -2687,6 +2832,7 @@ class DenCLI {
   private async cmdServiceUpManifest(
     addresses: string[],
     dryRun = false,
+    plan = false,
   ): Promise<void> {
     // Resolve targets BEFORE the secrets preflight — otherwise running
     // `den up` from a non-service dir (e.g. the den repo root) triggers
@@ -2705,6 +2851,16 @@ class DenCLI {
                 `  or run \`${product().cli} graph\` to see the workspace.\n`,
             ),
         );
+      } else if (process.env.DEN_WORKSPACE_OVERRIDE) {
+        // `up -w <ws>` with nothing to start: -w picks the workspace, not
+        // what in it to start. A usage error, not an empty plan.
+        console.error(
+          chalk.red(
+            `\n  ${upNeedsTarget(product().cli, process.env.DEN_WORKSPACE_OVERRIDE, plan)}\n`,
+          ),
+        );
+        process.exitCode = 2;
+        return;
       } else {
         console.log(
           chalk.yellow(
@@ -2712,12 +2868,15 @@ class DenCLI {
           ),
         );
       }
+      // A plan that resolves nothing is a failed plan (scripts check it).
+      if (plan) process.exitCode = 1;
       return;
     }
     if (!dryRun) preflightSecrets();
     await this.runServicesCommand(targets, "up", undefined, {
       named: addresses,
       dryRun,
+      plan,
     });
   }
 
@@ -2865,7 +3024,7 @@ class DenCLI {
       chalk.cyan(`\n  Workspace: ${chalk.bold(ws?.name ?? "none")}\n`),
     );
 
-    const table = new Table({
+    const table = newTable({
       head: ["Service", "Mode", "Branch", "Health", "Reason"],
       style: { head: ["cyan"] },
     });
@@ -3027,7 +3186,7 @@ class DenCLI {
       return;
     }
 
-    const table = new Table({
+    const table = newTable({
       head: ["Service", "Mode", "Health", "Commands"],
       style: { head: ["cyan"] },
     });
@@ -3072,15 +3231,29 @@ class DenCLI {
   private async cmdRegister(args: string[]): Promise<void> {
     if (args.includes("-h") || args.includes("--help")) {
       console.log(
-        `\n  ${product().cli} register [path] [--name <repo>] [--gh <owner/repo>]\n\n` +
+        `\n  ${product().cli} register [path] [--name <repo>] [--gh <owner/repo>] [-w <workspace>]\n\n` +
           "  With a path: add that checkout to the catalog and the focused\n" +
           "  workspace as your own (dev-managed) copy, without prompts. The name\n" +
           "  defaults to the manifest's name, then the folder name; the GitHub\n" +
-          "  slug to the git remote.\n" +
+          "  slug to the git remote. -w writes that workspace (active or not)\n" +
+          "  and leaves focus alone.\n" +
           "  Without a path: choose a local checkout or a managed clone interactively.\n",
       );
       return;
     }
+    const repoPathArg = args.find(
+      (a, i) =>
+        !a.startsWith("-") && !/^--(name|gh|org)$/.test(args[i - 1] ?? ""),
+    );
+    // Without a path, register prompts: with no terminal, say how to name one.
+    if (!repoPathArg && !process.stdin.isTTY) {
+      process.stderr.write(
+        `register needs a terminal (stdin is not a TTY); without one: ` +
+          `${product().cli} register <path> [--name <repo>] [--gh <owner/repo>] [-w <workspace>]\n`,
+      );
+      process.exitCode = 2;
+      return;
+    }
     const ws = getActiveWorkspace();
     if (!ws) {
       console.log(
@@ -3091,9 +3264,6 @@ class DenCLI {
       return;
     }
 
-    const repoPathArg = args.find(
-      (a, i) => !a.startsWith("-") && !/^--(name|gh)$/.test(args[i - 1] ?? ""),
-    );
     if (repoPathArg) {
       const flag = (n: string) => {
         const i = args.indexOf(n);
@@ -3108,7 +3278,7 @@ class DenCLI {
     if (source === "local") {
       await this.registerLinked(ws);
     } else {
-      await this.registerManaged(ws);
+      await this.registerManaged(ws, orgFlag(args));
     }
   }
 
@@ -3187,26 +3357,25 @@ class DenCLI {
     );
   }
 
-  /** List org repos via `gh`, let user pick one + branch → managed service. */
-  private async registerManaged(ws: {
-    name: string;
-    config: import("../../shared/types/index.js").WorkspaceConfig;
-  }): Promise<void> {
-    // Derive org from den's own git remote
-    const { fileURLToPath: ftu } = await import("url");
-    const { default: pathMod } = await import("path");
-    const distRoot = pathMod.resolve(
-      pathMod.dirname(ftu(import.meta.url)),
-      "../../..",
-    );
-    const denCoords = getGitHubCoords(distRoot);
-    // The instance's config names its org; the checkout's own remote is only a
-    // fallback (inside a package it would name the engine's repo, not the org's).
-    const org = readDenConfig().github_org ?? denCoords?.owner;
-    if (!org || !/^[A-Za-z0-9][A-Za-z0-9-]*$/.test(org)) {
+  /**
+   * List an org's repos via `gh`, let the user pick one + branch → managed
+   * service. The org is `--org <id>`, else the focused workspace's resolved
+   * org (ORG-1a). Never Den's own checkout or remote (SEC-0).
+   */
+  private async registerManaged(
+    ws: {
+      name: string;
+      config: import("../../shared/types/index.js").WorkspaceConfig;
+    },
+    orgArg?: string,
+  ): Promise<void> {
+    const org = registerOrg(ws.name, orgArg);
+    if (!org) {
       console.log(
         chalk.red(
-          `\n  ❌ No GitHub org to list: set github_org in ${product().configFile}\n`,
+          `\n  ❌ No GitHub org to list: set github_org in ${product().configFile}, ` +
+            `org: on workspace ${ws.name}, or pass --org <id> ` +
+            `(an org with no GitHub source in orgs.<id>.sources has none)\n`,
         ),
       );
       return;
@@ -3459,10 +3628,39 @@ class DenCLI {
     console.log(chalk.gray(`    revert: ${revert}\n`));
   }
 
-  private async cmdSetup(args: string[]): Promise<void> {
+  private async cmdSetup(rawArgs: string[]): Promise<void> {
+    // `-w <ws>` (repeatable) and `--all-active` pick the workspaces to plan.
+    const { workspaces: planWs, rest: args } = takeWorkspaceFlags(rawArgs);
+    const allActive = args.includes("--all-active");
     const force = args.includes("--force") || args.includes("-f");
     const names = args.filter((a) => !a.startsWith("-"));
 
+    // `--plan`: each repo's org and clone URL, then stop. Read-only.
+    if (args.includes("--plan")) {
+      let plan: ReturnType<typeof buildSetupPlan>;
+      try {
+        plan = buildSetupPlan(names, { workspaces: planWs, allActive });
+      } catch (e) {
+        console.error(chalk.red(`\n  ${(e as Error).message}\n`));
+        process.exitCode = 1;
+        return;
+      }
+      console.log(chalk.bold("\n  Setup plan (no changes will be made):\n"));
+      for (const line of renderClonePlan(plan, product().cli))
+        console.log(`  ${line}`.trimEnd());
+      console.log();
+      return;
+    }
+    if (planWs.length || allActive) {
+      console.error(
+        chalk.red(
+          `\n  -w and --all-active go with --plan: setup itself works on the focused workspace.\n`,
+        ),
+      );
+      process.exitCode = 1;
+      return;
+    }
+
     // Clone any managed repos that aren't on disk yet before reading manifests.
     this.cloneMissingManagedRepos();
 
@@ -3550,13 +3748,20 @@ class DenCLI {
 
     switch (sub) {
       case "list": {
-        const table = new Table({
-          head: ["Workspace", "Active", "Focus", "Services", "Type"],
+        const only = orgFlag(args.slice(1));
+        const { resolved, warnings } = orgListRows();
+        const orgOfWs = new Map(resolved.map((w) => [w.workspace, w.org]));
+        const table = newTable({
+          head: ["Workspace", "Org", "Active", "Focus", "Services", "Type"],
           style: { head: ["cyan"] },
         });
-        for (const [name, cfg] of Object.entries(file.workspaces)) {
+        const shown = Object.entries(file.workspaces).filter(
+          ([name]) => !only || sameOrg(orgOfWs.get(name) ?? null, only),
+        );
+        for (const [name, cfg] of shown) {
           table.push([
             chalk.bold(name),
+            orgOfWs.get(name) ?? chalk.gray("none"),
             activeSet.has(name) ? chalk.green("✓") : "",
             name === focus ? chalk.cyan("●") : "",
             Object.keys(cfg.services).join(", ") || chalk.gray("none"),
@@ -3564,6 +3769,14 @@ class DenCLI {
           ]);
         }
         console.log(table.toString());
+        if (only && shown.length === 0)
+          console.log(chalk.yellow(`  No workspace in org ${only}.`));
+        const names = new Set(shown.map(([n]) => n));
+        printOrgWarnings(
+          warnings.filter((w) =>
+            [...names].some((n) => w.startsWith(`workspace ${n}:`)),
+          ),
+        );
         break;
       }
       case "activate": {
@@ -3669,7 +3882,7 @@ class DenCLI {
         break;
       }
       case "seed": {
-        await this.seedDefaultWorkspaceFlow("init");
+        await this.seedDefaultWorkspaceFlow("init", args.includes("--reset"));
         break;
       }
       case "create": {
@@ -3862,7 +4075,15 @@ class DenCLI {
   // ── den validate ────────────────────────────────────────────────────────
 
   private async cmdValidate(args: string[]): Promise<void> {
-    const target = args[0] ?? getInvokeCwd();
+    const positional = args.filter((a) => !a.startsWith("-"));
+    const held = args.includes("--held");
+    // Bare `validate` in the distribution root (which has no manifest of its
+    // own), or `--held`: every manifest the distribution uses.
+    if (held || (positional.length === 0 && this.invokedInDistRoot())) {
+      this.validateEverything(held);
+      return;
+    }
+    const target = positional[0] ?? getInvokeCwd();
     const fs = await import("fs");
     const nodePath = await import("path");
 
@@ -3928,6 +4149,78 @@ class DenCLI {
     if (!result.valid) process.exit(1);
   }
 
+  /** Whether the CLI was run from the distribution root (real paths). */
+  private invokedInDistRoot(): boolean {
+    const real = (p: string) => {
+      try {
+        return fs.realpathSync(nodePath.resolve(p));
+      } catch {
+        return nodePath.resolve(p);
+      }
+    };
+    return (
+      real(getInvokeCwd()) === real(getDistRoot()) &&
+      !fs.existsSync(nodePath.join(getDistRoot(), product().manifestYml))
+    );
+  }
+
+  /** `validate` (bare, in the root) / `validate --held`: see validate-all.ts. */
+  private validateEverything(held: boolean): void {
+    const results = validateAll({ held, validate: validateManifestLayers });
+    console.log();
+    if (results.length === 0) {
+      console.log(
+        chalk.yellow(
+          held
+            ? `  No manifests in ${heldManifestsDir()}.`
+            : "  No repos in any workspace and no held manifests.",
+        ),
+      );
+      console.log();
+      return;
+    }
+    const width = Math.max(...results.map((r) => r.repo.length));
+    for (const r of results) {
+      const where = r.checkout ?? "manifests/";
+      const ws = r.workspaces.length ? `  [${r.workspaces.join(", ")}]` : "";
+      const note = r.note ? `  (${r.note})` : "";
+      const head = `${r.repo.padEnd(width)}  ${r.source.padEnd(15)} ${where}${ws}${note}`;
+      if (r.missing) {
+        console.log(chalk.yellow(`  ⚠  ${head}`));
+        continue;
+      }
+      const warnings = r.result.layers.reduce(
+        (n, l) => n + l.result.warnings.length,
+        0,
+      );
+      if (r.result.valid && warnings === 0) {
+        console.log(chalk.green(`  ✓  ${head}`));
+        continue;
+      }
+      console.log(
+        r.result.valid
+          ? chalk.yellow(`  ⚠  ${head}`)
+          : chalk.red(`  ✗  ${head}`),
+      );
+      for (const l of r.result.layers)
+        if (!l.result.valid || l.result.warnings.length)
+          printValidation(
+            `    ${l.file ?? "merged"}`,
+            l.result,
+            l.layer === "merged" ? "merged" : l.layer,
+          );
+    }
+    const failed = results.filter((r) => !r.missing && !r.result.valid).length;
+    const missing = results.filter((r) => r.missing).length;
+    console.log();
+    console.log(
+      `  ${plural(results.length, held ? "manifest" : "repo")}: ${failed ? chalk.red(`${failed} failed`) : chalk.green("all valid")}` +
+        (missing ? chalk.yellow(`, ${missing} with no manifest to check`) : ""),
+    );
+    console.log();
+    if (validateAllFailed(results)) process.exitCode = 1;
+  }
+
   // ── den local-dev ───────────────────────────────────────────────────────
 
   private async cmdLocalDev(arg?: string): Promise<void> {
@@ -4008,7 +4301,9 @@ class DenCLI {
       "  register [path]      Register a repo in the service catalog",
     );
     console.log();
-    console.log("  setup [service...]   Run make setup for services");
+    console.log(
+      "  setup [service...]   Run make setup for services (--plan: orgs + clone URLs, no changes)",
+    );
     console.log("  sync [service...]    Check for updates and offer to pull");
     console.log(
       "  create <name> [dir]  Scaffold a new distribution of your own (--title, --cli, --env-prefix)",
@@ -4039,6 +4334,9 @@ class DenCLI {
     console.log(
       "  workspace code [n]       Open workspace in VS Code (generates .code-workspace)",
     );
+    console.log(
+      "  org list [--org <id>]    List orgs: label, workspaces, default, warnings",
+    );
     console.log("\nTest commands:");
     console.log(
       "  menu                 Open the interactive menu (pillar/module/env picker)",