@monster-orange/den 0.2.6 → 0.2.8

package/src/ui/mcp/server.ts

@@ -5,6 +5,7 @@
  *
  * stdout carries the protocol only: diagnostics go to stderr.
  */
+import { z } from "zod";
 import { randomUUID } from "crypto";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -21,6 +22,7 @@ import { createDenApi, type DenApi } from "./api.js";
 import { ownServer } from "../cli/server-identity.js";
 import { callTool, toolsFor, type ToolContext } from "./tools.js";
 import { plural } from "../../shared/plural.js";
+import { parseScopeFlags, ScopeUsageError, type McpScope } from "./scope.js";
 
 export interface DenMcpOptions {
   cfg: ResolvedMcpConfig;
@@ -32,6 +34,8 @@ export interface DenMcpOptions {
   /** For tests: an API in place of the HTTP client. */
   api?: DenApi;
   log?: (line: string) => void;
+  /** `--workspace` + `--actor`: one workspace, one agent (AG-2a-core). */
+  scope?: McpScope;
 }
 
 export function createDenMcpServer(opts: DenMcpOptions): McpServer {
@@ -47,7 +51,11 @@ export function createDenMcpServer(opts: DenMcpOptions): McpServer {
         `through the running ${p.title} web server (\`${opts.cli} web up\`). ` +
         (opts.cfg.actions.length
           ? `Actions enabled: ${opts.cfg.actions.join(", ")}.`
-          : "Read-only: the org has enabled no actions (mcp.actions)."),
+          : "Read-only: the org has enabled no actions (mcp.actions).") +
+        (opts.scope
+          ? ` Scoped to workspace "${opts.scope.workspace}" as ${opts.scope.actor}: ` +
+            "a call naming another workspace is refused, and lists show this one only."
+          : ""),
     },
   );
 
@@ -66,9 +74,15 @@ export function createDenMcpServer(opts: DenMcpOptions): McpServer {
           clientVersion: client()?.version ?? "unknown",
           mcpPid: opts.pid ?? process.pid,
           session,
+          ...scopeInfo(opts.scope),
         }),
     });
-  const ctx: ToolContext = { api, cfg: opts.cfg, cli: opts.cli };
+  const ctx: ToolContext = {
+    api,
+    cfg: opts.cfg,
+    cli: opts.cli,
+    ...(opts.scope ? { scope: opts.scope } : {}),
+  };
 
   for (const t of tools) {
     server.registerTool(
@@ -89,6 +103,9 @@ export function createDenMcpServer(opts: DenMcpOptions): McpServer {
           const who = client();
           log(
             `[mcp] ${t.name} ${r.isError ? "refused/failed" : "ok"} · ` +
+              (opts.scope
+                ? `${opts.scope.actor} in ${opts.scope.workspace} · `
+                : "") +
               `${who?.name ?? "unknown"} ${who?.version ?? ""} · session ${session}` +
               (r.isError ? ` · ${r.text.split("\n")[0]}` : ""),
           );
@@ -103,6 +120,14 @@ export function createDenMcpServer(opts: DenMcpOptions): McpServer {
   return server;
 }
 
+/** The audit fields a scope adds to every call's headers (none unscoped). */
+function scopeInfo(scope: McpScope | undefined): {
+  agent?: string;
+  workspace?: string;
+} {
+  return scope ? { agent: scope.actor, workspace: scope.workspace } : {};
+}
+
 function parsePort(argv: string[]): number | undefined {
   const i = argv.indexOf("--port");
   const raw =
@@ -121,6 +146,7 @@ export const MCP_USAGE = (cli: string): string =>
     `Usage: ${cli} mcp [--port <web port>]`,
     `       ${cli} mcp --list`,
     `       ${cli} mcp --call <tool> ['<json args>']`,
+    `       ${cli} mcp --workspace <ws> --actor agent:<id> [...]`,
     "",
     `An MCP server over stdio for agents, a client of the running web server`,
     `(\`${cli} web up\`; default port: config web.port). Read tools always;`,
@@ -129,6 +155,11 @@ export const MCP_USAGE = (cli: string): string =>
     "--list prints the tool names; --call runs one tool through the same guards,",
     "prints its text result and exits 1 if the tool reports an error.",
     "",
+    "--workspace + --actor (both, or neither) scope the server to one workspace:",
+    "a call naming another is refused, lists show that one only, and every call",
+    "is recorded as agent:<id>. It binds cooperating agents only: the web",
+    "server's HTTP API does not check the scope yet.",
+    "",
     `Register it with your agents: ${cli} mcp clients, then ${cli} mcp connect <client> (or --all).`,
   ].join("\n");
 
@@ -166,6 +197,7 @@ export interface OneShotOptions {
   cfg: ResolvedMcpConfig;
   cli: string;
   api: DenApi;
+  scope?: McpScope;
   out?: (text: string) => void;
   err?: (text: string) => void;
 }
@@ -184,19 +216,59 @@ export async function runOneShot(
     out(names.length ? `${names.join("\n")}\n` : "");
     return 0;
   }
-  const ctx: ToolContext = { api: opts.api, cfg: opts.cfg, cli: opts.cli };
-  const r = await callTool(shot.tool, shot.args, ctx);
+  const ctx: ToolContext = {
+    api: opts.api,
+    cfg: opts.cfg,
+    cli: opts.cli,
+    ...(opts.scope ? { scope: opts.scope } : {}),
+  };
+  // The stdio server validates arguments against each tool's schema (the
+  // SDK does it); a one-shot must too, and strictly: it is typed by hand, so
+  // an unknown or misspelt key is an error, not silently dropped.
+  let args = shot.args;
+  const tool = toolsFor(opts.cfg).find((t) => t.name === shot.tool);
+  if (tool) {
+    const parsed = z.object(tool.shape).strict().safeParse(args);
+    if (!parsed.success) {
+      const err = opts.err ?? ((t: string) => process.stderr.write(t));
+      const lines = parsed.error.issues.map((i) => {
+        const at = i.path.length ? i.path.join(".") : "(arguments)";
+        return `  ${at}: ${i.message}`;
+      });
+      const keys = Object.keys(tool.shape);
+      err(
+        `--call ${shot.tool}: invalid arguments\n${lines.join("\n")}\n` +
+          `  takes: ${keys.length ? keys.join(", ") : "no arguments"}\n`,
+      );
+      return 2;
+    }
+    args = parsed.data as Record<string, unknown>;
+  }
+  const r = await callTool(shot.tool, args, ctx);
   out(r.text.endsWith("\n") ? r.text : `${r.text}\n`);
   return r.isError ? 1 : 0;
 }
 
 /** Run `<cli> mcp` until stdin closes (or one `--call` / `--list`). */
-export async function runMcp(argv: string[]): Promise<void> {
+export async function runMcp(rawArgv: string[]): Promise<void> {
   const cli = product().cli;
-  if (argv.includes("-h") || argv.includes("--help")) {
+  if (rawArgv.includes("-h") || rawArgv.includes("--help")) {
     process.stderr.write(`${MCP_USAGE(cli)}\n`);
     return;
   }
+  let scope: McpScope | null;
+  let argv: string[];
+  try {
+    ({ scope, rest: argv } = parseScopeFlags(rawArgv));
+  } catch (e) {
+    if (!(e instanceof ScopeUsageError)) throw e;
+    process.stderr.write(
+      `${cli} mcp: ${e.message}\n` +
+        `Usage: ${cli} mcp --workspace <ws> --actor agent:<id> [--port <n>] [--list | --call <tool> ['<json>']]\n`,
+    );
+    process.exitCode = 2;
+    return;
+  }
   let port = parsePort(argv);
   if (port === undefined) {
     try {
@@ -221,15 +293,28 @@ export async function runMcp(argv: string[]): Promise<void> {
           clientVersion: engineVersion() ?? "unknown",
           mcpPid: process.pid,
           session,
+          ...scopeInfo(scope ?? undefined),
         }),
     });
-    process.exitCode = await runOneShot(shot, { cfg, cli, api });
+    process.exitCode = await runOneShot(shot, {
+      cfg,
+      cli,
+      api,
+      ...(scope ? { scope } : {}),
+    });
     return;
   }
-  const server = createDenMcpServer({ cfg, baseUrl, cli });
+  const server = createDenMcpServer({
+    cfg,
+    baseUrl,
+    cli,
+    ...(scope ? { scope } : {}),
+  });
   await server.connect(new StdioServerTransport());
   process.stderr.write(
     `${cli} mcp: ${plural(toolsFor(cfg).length, "tool")} ` +
-      `(${cfg.actions.length ? `actions: ${cfg.actions.join(", ")}` : "read only"}) → ${baseUrl}\n`,
+      `(${cfg.actions.length ? `actions: ${cfg.actions.join(", ")}` : "read only"}) → ${baseUrl}` +
+      (scope ? ` · scoped to ${scope.workspace} as ${scope.actor}` : "") +
+      "\n",
   );
 }

package/src/ui/mcp/tools.ts

@@ -33,12 +33,27 @@ import {
   type ServiceEntryLike,
   type SecurityPlanLike,
 } from "./guards.js";
+import {
+  ScopeRefusal,
+  assertPathInScope,
+  assertScopeExists,
+  assertScopeFocused,
+  assertServicesInScope,
+  filterWorkspacesBody,
+  pinWorkspace,
+  type McpScope,
+} from "./scope.js";
 
 export interface ToolContext {
   api: DenApi;
   cfg: ResolvedMcpConfig;
   /** The CLI name, for messages (`<cli> web up`). */
   cli: string;
+  /**
+   * A scoped server's workspace and actor (AG-2a-core); absent, every tool
+   * behaves as it always has.
+   */
+  scope?: McpScope;
 }
 
 type Args = Record<string, unknown>;
@@ -193,7 +208,10 @@ const READ_TOOLS: DenTool[] = [
     "Workspaces",
     "Workspaces, which are active and which is focused.",
     {},
-    (_a, { api }) => api.get("/api/workspaces"),
+    async (_a, { api, scope }) => {
+      const body = await api.get("/api/workspaces");
+      return scope ? filterWorkspacesBody(body, scope) : body;
+    },
   ),
   read(
     "environments",
@@ -215,9 +233,19 @@ const READ_TOOLS: DenTool[] = [
         .describe("repo/service names"),
       env: envArg,
     },
-    async (a, { api, cfg }) => {
+    async (a, { api, cfg, scope }) => {
       const env = envOf(a);
       assertLogsEnv(env, cfg);
+      if (scope)
+        await assertServicesInScope(
+          "logs_search",
+          api,
+          scope,
+          (a.targets as string[]).map((t) => {
+            const slash = t.lastIndexOf("/");
+            return { repo: t.slice(0, slash), service: t.slice(slash + 1) };
+          }),
+        );
       return api.get("/api/logs/search", {
         q: String(a.q),
         env,
@@ -241,9 +269,13 @@ const READ_TOOLS: DenTool[] = [
         .describe("Lines to return (default 200)"),
       env: envArg,
     },
-    async (a, { api, cfg }) => {
+    async (a, { api, cfg, scope }) => {
       const env = envOf(a);
       assertLogsEnv(env, cfg);
+      if (scope)
+        await assertServicesInScope("logs_tail", api, scope, [
+          { repo: String(a.repo), service: String(a.service) },
+        ]);
       const n = (a.lines as number | undefined) ?? 200;
       const query: Query = { repo: String(a.repo), service: String(a.service) };
       const r =
@@ -270,11 +302,17 @@ const READ_TOOLS: DenTool[] = [
     "Available tests",
     "The test modules of a pillar, and which repos (branch + SHA) they come from.",
     { pillar: z.enum(PILLARS) },
-    async (a, { api }) => ({
-      modules: await api.get("/api/modules", { pillar: String(a.pillar) }),
-      sources: await api.get("/api/test-sources", { pillar: String(a.pillar) }),
-    }),
+    async (a, { api, scope }) => {
+      if (scope) await assertScopeFocused("tests_available", api, scope);
+      return {
+        modules: await api.get("/api/modules", { pillar: String(a.pillar) }),
+        sources: await api.get("/api/test-sources", {
+          pillar: String(a.pillar),
+        }),
+      };
+    },
   ),
+
   read(
     "security_latest",
     "Latest security scans",
@@ -307,13 +345,20 @@ const READ_TOOLS: DenTool[] = [
       path: z.string().optional().describe("Repo directory or manifest file"),
       content: z.string().optional().describe("Manifest YAML to validate"),
     },
-    async (a, { api }) => {
+    async (a, { api, scope }) => {
       if (str(a.content) !== undefined)
         return api.get("/api/manifest/validate", {}, "POST", {
           content: a.content,
         });
       if (str(a.path) === undefined)
         throw new Refusal("give a path or the manifest content.");
+      if (scope)
+        await assertPathInScope(
+          "manifest_validate",
+          api,
+          scope,
+          String(a.path),
+        );
       return api.get("/api/manifest/validate", { path: str(a.path) });
     },
   ),
@@ -447,19 +492,27 @@ const ACTION_TOOLS: Record<McpAction, DenTool> = {
     shape: {
       repo: z.string().optional().describe("One managed repo (default: all)"),
     },
-    async run(a, { api }) {
+    async run(a, { api, scope }) {
       const repo = str(a.repo);
+      // Scoped: the sync names the scoped workspace (the web server's own
+      // default is the focused one).
+      const ws = scope ? { workspace: scope.workspace } : {};
       if (repo) {
         const services = (await api.get("/api/services", {
           env: "local",
+          ...ws,
         })) as ServiceEntryLike[];
         assertSyncableRepo(repo, services);
       }
-      const r = await api.stream("/api/workspace/sync", repo ? { repo } : {}, {
-        method: "POST",
-        maxLines: 5000,
-        timeoutMs: 15 * 60_000,
-      });
+      const r = await api.stream(
+        "/api/workspace/sync",
+        repo ? { repo, ...ws } : { ...ws },
+        {
+          method: "POST",
+          maxLines: 5000,
+          timeoutMs: 15 * 60_000,
+        },
+      );
       return actionResult(r, 300);
     },
   },
@@ -478,13 +531,14 @@ const ACTION_TOOLS: Record<McpAction, DenTool> = {
         .optional()
         .describe("Security scan mode (default baseline)"),
     },
-    async run(a, { api, cfg }) {
+    async run(a, { api, cfg, scope }) {
       const pillar = String(a.pillar);
       const env = envOf(a);
       const modules = (a.modules as string[] | undefined) ?? [];
       const mode =
         pillar === "security" ? (str(a.mode) ?? "baseline") : undefined;
       assertRunTestsAllowed({ pillar, env, mode }, cfg);
+      if (scope) await assertScopeFocused("run_tests", api, scope);
       if (pillar === "security") {
         for (const service of modules.length ? modules : [undefined]) {
           const plan = (await api.get("/api/security/plan", {
@@ -599,6 +653,10 @@ async function reportRefusal(
       tool,
       ...(typeof args.repo === "string" ? { repo: args.repo } : {}),
       ...(typeof args.service === "string" ? { service: args.service } : {}),
+      ...(Array.isArray(args.targets) ? { targets: args.targets } : {}),
+      // A path (manifest_validate): the server records it under the catalog
+      // repo it is inside, never as the path itself.
+      ...(typeof args.path === "string" ? { path: args.path } : {}),
       reason,
     });
   } catch {
@@ -606,6 +664,27 @@ async function reportRefusal(
   }
 }
 
+/**
+ * A scoped server's arguments: the workspace exists (checked once per
+ * server), and a tool that takes a workspace gets the scoped one; naming
+ * another is refused.
+ */
+const verifiedScopes = new WeakSet<McpScope>();
+async function scopeArgs(
+  tool: DenTool,
+  args: Args,
+  ctx: ToolContext,
+  scope: McpScope,
+): Promise<Args> {
+  if (!verifiedScopes.has(scope)) {
+    await assertScopeExists(ctx.api, scope);
+    verifiedScopes.add(scope);
+  }
+  return "workspace" in tool.shape
+    ? pinWorkspace(tool.name, args, scope)
+    : args;
+}
+
 export async function callTool(
   name: string,
   args: Args,
@@ -618,7 +697,10 @@ export async function callTool(
       isError: true,
     };
   try {
-    const out = await tool.run(args, ctx);
+    const out = await tool.run(
+      ctx.scope ? await scopeArgs(tool, args, ctx, ctx.scope) : args,
+      ctx,
+    );
     const text = typeof out === "string" ? out : JSON.stringify(out, null, 2);
     return { text: redactSecrets(text), isError: false };
   } catch (e) {
@@ -633,7 +715,9 @@ export async function callTool(
       );
       return { text: redactSecrets(text), isError: true };
     }
-    if (e instanceof Refusal && tool.action)
+    // A call outside a scoped server's workspace is recorded whatever the
+    // tool: it is an attempt to cross the boundary (AG-2a-core).
+    if (e instanceof Refusal && (tool.action || e instanceof ScopeRefusal))
       await reportRefusal(ctx, name, args, e.message);
     const msg =
       e instanceof Refusal

package/src/ui/server/audit.ts

@@ -5,6 +5,7 @@
  * as the web-server log, so agent actions sit beside the UI's own; the
  * structured entries are kept in a small in-memory ring.
  */
+import * as path from "path";
 import {
   actorLabel,
   type Actor,
@@ -20,6 +21,10 @@ export interface AuditEntry {
   clientVersion?: string;
   mcpPid?: number | null;
   session?: string;
+  /** A scoped MCP server's actor, `agent:<id>` (AG-2a-core). */
+  agent?: string;
+  /** The workspace that scoped server is pinned to. */
+  workspace?: string;
   /** exec | run | sync, or the MCP tool name for a refused non-lifecycle call */
   verb: string;
   detail: string;
@@ -27,6 +32,11 @@ export interface AuditEntry {
   outcome?: "refused";
   /** Why it was refused (first line). */
   reason?: string;
+  /**
+   * The services (`repo/service`) or repos a refused non-lifecycle call
+   * named, so each one's activity list shows it (`GET /api/activity`).
+   */
+  addresses?: string[];
 }
 
 type Sink = (line: string, actor: AgentActor | null) => void;
@@ -52,6 +62,7 @@ export function recordAction(
     detail: string;
     outcome?: "refused";
     reason?: string;
+    addresses?: string[];
   },
 ): AuditEntry {
   const entry: AuditEntry = {
@@ -63,19 +74,28 @@ export function recordAction(
           clientVersion: actor.clientVersion,
           mcpPid: actor.mcpPid,
           session: actor.session,
+          ...(actor.agent ? { agent: actor.agent } : {}),
+          ...(actor.workspace ? { workspace: actor.workspace } : {}),
         }
       : {}),
     verb: action.verb,
     detail: action.detail,
     ...(action.outcome ? { outcome: action.outcome } : {}),
     ...(action.reason ? { reason: clean(action.reason, 300) } : {}),
+    ...(action.addresses?.length ? { addresses: action.addresses } : {}),
   };
   ring.push(entry);
   if (ring.length > RING_MAX) ring.shift();
   const mark = entry.outcome === "refused" ? "✗" : "▶";
   const why = entry.reason ? ` — refused: ${entry.reason}` : "";
+  // A refusal whose detail is its reason names what it touched instead.
+  const what = entry.addresses
+    ? entry.addresses.join(", ")
+    : entry.reason && action.detail === entry.reason
+      ? ""
+      : action.detail;
   sink?.(
-    `${mark} ${action.verb} ${action.detail}${why}${actorSuffix(actor)}`,
+    `${mark} ${action.verb}${what ? ` ${what}` : ""}${why}${actorSuffix(actor)}`,
     actor,
   );
   return entry;
@@ -92,12 +112,51 @@ function clean(v: unknown, max: number): string {
 
 const SAFE_PART = /^[A-Za-z0-9._-]{1,128}$/;
 const LIFECYCLE_TOOL = /^service_(up|down|restart)$/;
+/** At most this many targets of one refused call are recorded. */
+const MAX_ADDRESSES = 40;
+
+/** `repo/service` (or `repo`) when every part is a safe name, else "". */
+function safeAddress(repo: string, service = ""): string {
+  if (!SAFE_PART.test(repo)) return "";
+  return service && SAFE_PART.test(service) ? `${repo}/${service}` : repo;
+}
+
+/**
+ * What a refused call named: its `repo` (with `service`), else each of its
+ * `targets` (`repo/service`, as logs_search takes them), deduplicated.
+ */
+function refusedAddresses(report: {
+  repo?: unknown;
+  service?: unknown;
+  targets?: unknown;
+}): string[] {
+  const out: string[] = [];
+  if (typeof report.repo === "string") {
+    const a = safeAddress(
+      report.repo,
+      typeof report.service === "string" ? report.service : "",
+    );
+    if (a) out.push(a);
+  }
+  if (Array.isArray(report.targets))
+    for (const t of report.targets.slice(0, MAX_ADDRESSES)) {
+      if (typeof t !== "string") continue;
+      const slash = t.lastIndexOf("/");
+      const a =
+        slash > 0
+          ? safeAddress(t.slice(0, slash), t.slice(slash + 1))
+          : safeAddress(t);
+      if (a && !out.includes(a)) out.push(a);
+    }
+  return out;
+}
 
 /**
  * An MCP guard refused an agent's call before it reached an action route.
  * The agent's own report, so every field is sanitised: a lifecycle tool with
  * a valid repo becomes an "exec" entry for that service (what the panel's
- * activity list shows); anything else is recorded under the tool's name.
+ * activity list shows); anything else is recorded under the tool's name,
+ * with the refusal as its detail and the services it named as `addresses`.
  */
 export function recordAgentRefusal(
   actor: Actor,
@@ -105,6 +164,7 @@ export function recordAgentRefusal(
     tool?: unknown;
     repo?: unknown;
     service?: unknown;
+    targets?: unknown;
     reason?: unknown;
   },
 ): AuditEntry {
@@ -123,14 +183,41 @@ export function recordAgentRefusal(
       reason,
     });
   }
+  // Any other tool: the refusal is the detail, under every service or repo
+  // the call named (all of a logs_search's targets, in one entry).
   return recordAction(actor, {
     verb: tool,
-    detail: "",
+    detail: reason,
     outcome: "refused",
     reason,
+    addresses: refusedAddresses(report),
   });
 }
 
+/**
+ * The catalog repo a refused call's `path` is inside (manifest_validate), so
+ * the refusal shows in that repo's activity: the repo whose checkout is the
+ * path or holds it, the deepest when checkouts nest. Null for a relative
+ * path or one inside no repo. The path itself is never recorded.
+ */
+export function repoAtPath(
+  p: unknown,
+  repos: readonly { repoName: string; repoPath: string }[],
+): string | null {
+  if (typeof p !== "string" || p.length > 4096 || !path.isAbsolute(p))
+    return null;
+  const target = path.resolve(p);
+  let best: { repoName: string; depth: number } | null = null;
+  for (const r of repos) {
+    if (!r.repoPath || !path.isAbsolute(r.repoPath)) continue;
+    const root = path.resolve(r.repoPath);
+    if (target !== root && !target.startsWith(root + path.sep)) continue;
+    if (!best || root.length > best.depth)
+      best = { repoName: r.repoName, depth: root.length };
+  }
+  return best && SAFE_PART.test(best.repoName) ? best.repoName : null;
+}
+
 /** The most recent actions, oldest first. */
 export function recentActions(): AuditEntry[] {
   return ring.slice();

package/src/ui/server/daemon-reaper.ts

@@ -11,9 +11,11 @@
  * so an "error" health result is only acted on after a SECOND
  * consecutive "error" check separated by a retry delay. "unknown"
  * results and thrown checks always keep the entry (err on the side of
- * keeping). A daemon whose address no longer resolves to any
- * workspace/catalog service is process-death-equivalent evidence and is
- * removed directly.
+ * keeping). A daemon this root registered whose address no longer resolves
+ * to any workspace/catalog service is process-death-equivalent evidence and
+ * is removed directly. Records another root registered (all roots of a
+ * product share the file) are never touched, and an unstamped legacy record
+ * is not removed for being unresolvable.
  */
 
 import type { ServiceHealthResult } from "../../shared/environment-manager/health.js";
@@ -41,6 +43,12 @@ export interface DaemonReaperDeps {
   delay: (ms: number) => Promise<void>;
   /** Gap between the first "error" result and the confirming re-check. */
   retryDelayMs: number;
+  /**
+   * Which root wrote the record (`daemonRootOf`). Every root of a product
+   * shares one daemons file: another root's records are never swept here,
+   * and an unstamped (pre-0.2.7) one is not dropped for being unresolvable.
+   */
+  rootOf: (daemon: DaemonRecord) => "here" | "other" | "unstamped";
 }
 
 export interface DaemonReapResult {
@@ -92,9 +100,19 @@ export async function reapDeadDaemons(
   await Promise.allSettled(
     deps.listDaemons().map(async (daemon) => {
       try {
+        const root = deps.rootOf(daemon);
+        if (root === "other") {
+          kept.push(daemon.address);
+          return;
+        }
         const service = resolveForDaemon(deps, daemon);
         if (!service) {
-          // No longer in any owning workspace/catalog — nothing could restart it.
+          // No longer in any owning workspace/catalog — nothing could restart
+          // it. An unstamped record may be another root's, so it stays.
+          if (root === "unstamped") {
+            kept.push(daemon.address);
+            return;
+          }
           deps.unregisterDaemon(daemon.address);
           removed.push(daemon.address);
           return;

package/src/ui/server/github-service.ts

@@ -9,6 +9,7 @@ import { execFileSync, execSync } from "child_process";
 import * as path from "path";
 import { readDenConfig } from "../../shared/den-config.js";
 import { readCatalog } from "../../shared/environment-manager/catalog.js";
+import { githubOwnersOf } from "../../shared/org-sources.js";
 import {
   GH_API_TIMEOUT_MS,
   GIT_REMOTE_TIMEOUT_MS,
@@ -183,7 +184,11 @@ export class GitHubService {
     const config = readDenConfig();
     const orgs = new Set<string>();
     if (config.github_org) orgs.add(config.github_org);
-    for (const id of Object.keys(config.orgs ?? {})) orgs.add(id);
+    // A legacy `orgs:` key is a GitHub owner; an ORG-1d org lists its GitHub
+    // sources' owners, and one with no GitHub source adds none (discovery is
+    // hidden for it).
+    for (const id of Object.keys(config.orgs ?? {}))
+      for (const owner of githubOwnersOf(id, config.orgs)) orgs.add(owner);
     for (const entry of Object.values(readCatalog() ?? {})) {
       if (entry?.gh && entry.gh.includes("/")) {
         orgs.add(entry.gh.slice(0, entry.gh.indexOf("/")));