@monster-orange/den 0.2.6 → 0.2.8

package/src/ui/server/index.ts

@@ -50,6 +50,7 @@ import {
   getWorkspaceByName,
   isWorkspaceActive,
   listWorkspaceServices,
+  readWorkspacesFile,
   resolveDepAddress,
   parseAddress,
   readManifestAnyBranch,
@@ -80,6 +81,7 @@ import {
   checkServiceHealth,
   loadDaemonsFromFile,
   pruneDeadDaemonsAsync,
+  daemonRootOf,
   isInteractiveServiceCommand,
   rewriteLegacyOpctlKillCommandForContainer,
   shouldDetachServiceCommand,
@@ -95,6 +97,7 @@ import {
   getServiceLogPath,
 } from "../../shared/process/spawn-streaming.js";
 import {
+  assertDenConfigValid,
   readDenConfig,
   isProductionEnv,
   isLocalEnabled,
@@ -105,6 +108,11 @@ import {
   writeUserReleaseConfig,
   type ReleaseConfig,
 } from "../../shared/den-config.js";
+import {
+  CONFIG_ERROR_STATUS,
+  configErrorBody,
+  isConfigError,
+} from "../../shared/config-error.js";
 import { readOrg } from "../../shared/org.js";
 import { engineVersion, getDistRoot } from "../../shared/paths.js";
 import { enginePath } from "../../shared/engine.js";
@@ -142,6 +150,7 @@ import {
   actorSuffix,
   recordAction,
   recordAgentRefusal,
+  repoAtPath,
   setAuditSink,
 } from "./audit.js";
 import { handleReadonlyRoutes } from "./readonly-routes.js";
@@ -416,6 +425,26 @@ const STATIC_EXTS = new Set([
   ".woff2",
 ]);
 
+/** Every workspace's checkouts (active or not), for repoAtPath. */
+function allWorkspaceCheckouts(): ResolvedService[] {
+  const catalog = readCatalog();
+  return Object.entries(readWorkspacesFile().workspaces).flatMap(
+    ([name, config]) => listWorkspaceServices(config, catalog, name),
+  );
+}
+
+/**
+ * API routes that answer whatever the config holds: the identity probe the
+ * CLI and MCP use to find this server, its own log (where a config error is
+ * also written), the changelog, and restarting it.
+ */
+const CONFIG_FREE_ROUTES = new Set([
+  "/api/server-info",
+  "/api/server-log",
+  "/api/changelog",
+  "/api/web/restart",
+]);
+
 // ── Sudo password store ───────────────────────────────────────────────────────
 import {
   setSudoPassword,
@@ -436,6 +465,11 @@ import {
   send404,
 } from "./http-helpers.js";
 import { orgOf, listOrgs } from "../../shared/manifest/service-links.js";
+import {
+  readOrgContext,
+  resolveAllWorkspaceOrgs,
+  withOrgMembership,
+} from "../../shared/environment-manager/workspace-org.js";
 import {
   readLatestSummary,
   securityReportsDir,
@@ -603,6 +637,13 @@ async function handleRequest(
     }
   }
 
+  // ── Config validation ──────────────────────────────────────────────────────
+  // A config that fails validation answers every API route that reads it as
+  // the ConfigError the handler below maps to 422 JSON, before any route's own
+  // catch can turn it into a 400, a 500 or an empty list. Pages still load.
+  if (pathname.startsWith("/api/") && !CONFIG_FREE_ROUTES.has(pathname))
+    assertDenConfigValid();
+
   // ── Static UI ──────────────────────────────────────────────────────────────
   // Local Dev is the default page when local environment is enabled.
   if (
@@ -684,12 +725,24 @@ async function handleRequest(
 
   // ── API: environments ──────────────────────────────────────────────────────
   // Orgs the catalog's repos belong to, with config/den.yml display names.
+  // ORG-1d: a repo's org is an org listing it, else one whose source claims
+  // its owner, else its GitHub owner; a claimed owner is not listed. Service
+  // rows keep `org` as the repo's GitHub owner (C3).
+  // Each entry also says whether it is the default org (`github_org`) and
+  // which workspaces on this machine belong to it (ORG-1a). Nothing else
+  // changes: same entries, order and fields (ORG-SPEC C3).
   if (pathname === "/api/orgs") {
-    const catalog = readCatalog();
-    const orgs = listOrgs(catalog, readDenConfig().orgs ?? {});
+    const ctx = readOrgContext();
+    const catalog = ctx.catalog;
+    const orgs = withOrgMembership(
+      listOrgs(catalog, ctx.config.orgs ?? {}),
+      resolveAllWorkspaceOrgs(),
+      ctx.file,
+      ctx.config,
+    );
     if (url.searchParams.get("repos") !== "1") return sendJson(res, orgs);
     const repos = Object.fromEntries(
-      Object.keys(catalog).map((r) => [r, orgOf(r, catalog)]),
+      Object.keys(catalog).map((r) => [r, orgOf(r, catalog, ctx.config.orgs)]),
     );
     return sendJson(res, { orgs, repos });
   }
@@ -794,6 +847,17 @@ async function handleRequest(
     } catch {
       return send400(res, "invalid JSON");
     }
+    // A call that named a path (manifest_validate) is recorded under the
+    // catalog repo that path is inside, across every workspace's checkouts.
+    if (typeof report.repo !== "string" && report.path !== undefined) {
+      let repo: string | null = null;
+      try {
+        repo = repoAtPath(report.path, allWorkspaceCheckouts());
+      } catch {
+        /* unresolvable workspaces: recorded under the tool only */
+      }
+      if (repo) report = { ...report, repo };
+    }
     const entry = recordAgentRefusal(actor, report);
     return sendJson(res, { recorded: true, ts: entry.ts });
   }
@@ -2375,7 +2439,14 @@ async function handleRequest(
   // ── API: den config ────────────────────────────────────────────────────
   if (pathname === `/api/${product().cli}/config` && req.method === "GET") {
     // `org` resolved (id defaults to edge.org) for the header's org label.
-    return sendJson(res, { ...readDenConfig(), org: readOrg() });
+    const config = readDenConfig();
+    // `default_org` (ORG-1a) is the default work org, `github_org`; `org`
+    // stays the instance org (readOrg).
+    return sendJson(res, {
+      ...config,
+      org: readOrg(),
+      default_org: config.github_org?.trim() || null,
+    });
   }
 
   // ── API: server info + staleness (drives the header "stale server" pill) ────
@@ -3130,6 +3201,21 @@ const server = http.createServer((req, res) => {
   // rejection — which CRASHES the whole server on modern Node (freezing every
   // health dot) and leaves the request hanging. Fail the one request instead.
   handleRequest(req, res).catch((err) => {
+    // A config that fails validation is the user's to fix: name it to the
+    // caller as JSON (the {ok, error, code} frame), not a bare 500.
+    if (isConfigError(err)) {
+      serverLog(
+        `  ⚠ ${req.method} ${(req.url ?? "").split("?")[0]}: ${err.message}`,
+      );
+      try {
+        if (!res.headersSent)
+          return sendJson(res, configErrorBody(err), CONFIG_ERROR_STATUS);
+        res.end();
+      } catch {
+        /* socket already gone */
+      }
+      return;
+    }
     console.error(`[server] ${req.method} ${req.url} failed:`, err);
     try {
       if (!res.headersSent) {
@@ -3184,7 +3270,7 @@ void (async () => {
   await new Promise<void>((resolve) =>
     setTimeout(resolve, DAEMON_SHUTDOWN_GRACE_MS),
   );
-  await reapDeadDaemons({
+  const reaped = await reapDeadDaemons({
     listDaemons,
     resolveService,
     getActiveWorkspaces,
@@ -3192,7 +3278,12 @@ void (async () => {
     unregisterDaemon,
     delay: (ms) => new Promise<void>((resolve) => setTimeout(resolve, ms)),
     retryDelayMs: DAEMON_RETRY_DELAY_MS,
+    rootOf: daemonRootOf,
   });
+  if (reaped.removed.length > 0)
+    console.error(
+      `Reaped ${reaped.removed.length} stopped daemon(s): ${reaped.removed.join(", ")}`,
+    );
 })();
 
 const prunedSnapshots = pruneDeadSnapshots();

package/src/ui/server/public/panel.js

@@ -781,7 +781,7 @@ function activityList(x) {
     .then(({ entries = [] }) => {
       if (!live) return;
       el.innerHTML = entries.length
-        ? `<ol class="act">${entries.map((a) => `<li><time datetime="${esc(a.ts)}">${esc(hhmm(a.ts))}</time><span class="dg-who ${a.actor === "agent" ? "agent" : ""}">${esc(a.actor === "agent" ? "[agent]" + (a.client ? " " + a.client : "") : "you")}</span><span>${esc(a.verb)} ${esc(a.detail)}${a.outcome === "refused" ? ` <em class="refused">refused: ${esc(a.reason || "")}</em>` : ""}</span></li>`).join("")}</ol>`
+        ? `<ol class="act">${entries.map((a) => `<li><time datetime="${esc(a.ts)}">${esc(hhmm(a.ts))}</time><span class="dg-who ${a.actor === "agent" ? "agent" : ""}">${esc(a.actor === "agent" ? (a.agent ? "[" + a.agent + "]" : "[agent]") + (a.client ? " " + a.client : "") : "you")}</span><span>${esc(a.verb)} ${esc(a.detail)}${a.outcome === "refused" ? ` <em class="refused">refused: ${esc(a.reason || "")}</em>` : ""}</span></li>`).join("")}</ol>`
         : none(
             "No actions yet. Starts, restarts and syncs, yours and agents', show here.",
           );

package/src/ui/server/readonly-routes.ts

@@ -96,13 +96,22 @@ export function activityFor(
   // and for each of its services.
   const repoLevel = (e: AuditEntry, repo: string): boolean =>
     e.verb === "exec" && e.detail.startsWith(repo + " ");
+  // A refused non-lifecycle call (logs_tail, logs_search, …) is listed under
+  // each service or repo it named.
+  const named = (e: AuditEntry, hit: (a: string) => boolean): boolean =>
+    (e.addresses ?? []).some(hit);
   const matches = (e: AuditEntry): boolean => {
-    if (target.address)
+    if (target.address) {
+      const address = target.address;
+      const repo = address.split("/")[0];
       return (
-        (e.verb === "exec" && e.detail.startsWith(target.address + " ")) ||
-        repoLevel(e, target.address.split("/")[0])
+        (e.verb === "exec" && e.detail.startsWith(address + " ")) ||
+        repoLevel(e, repo) ||
+        named(e, (a) => a === address || a === repo)
       );
+    }
     const repo = target.repo ?? "";
+    if (named(e, (a) => a === repo || a.startsWith(repo + "/"))) return true;
     if (e.verb === "exec")
       return e.detail.startsWith(repo + "/") || repoLevel(e, repo);
     if (e.verb === "sync") return e.detail.split(" ").includes(`repo=${repo}`);

package/src/ui/server/release-service.ts

@@ -19,13 +19,22 @@ import { execFile } from "child_process";
 import { promisify } from "util";
 import { GH_API_TIMEOUT_MS } from "../../shared/constants.js";
 import {
+  readDenConfig,
+  readExplicitReleaseOrg,
   readReleaseConfig,
+  releaseOwnerFor,
   type ReleaseConfig,
   type ReleaseRepo,
   type ResolvedReleaseTarget,
   resolveReleaseTarget,
 } from "../../shared/den-config.js";
 import { readCatalog } from "../../shared/environment-manager/catalog.js";
+import { orgOf } from "../../shared/manifest/service-links.js";
+import {
+  ghOwnerOf,
+  isSourcedOrg,
+  orgHasGithub,
+} from "../../shared/org-sources.js";
 import { listReposWithManifests } from "../../shared/manifest/workspace-manifests.js";
 
 import { product } from "../../shared/product.js";
@@ -255,20 +264,31 @@ export class ReleaseService {
     const known = new Set(cfg.repos.map((r) => r.name));
     return {
       ...cfg,
-      repos: [
+      repos: releasableOnGithub([
         ...cfg.repos,
         ...manifestReleaseRepos().filter((r) => !known.has(r.name)),
-      ],
+      ]),
     };
   }
 
-  private org(cfg = this.config()): string {
-    return cfg.org ?? "";
+  /**
+   * The owner a repo is released from (REL-1): an explicit `release.org`
+   * (den.yml or user.yml) wins; otherwise the repo's own non-empty catalog
+   * owner, so a client org's repo releases from its own org; `github_org`
+   * (readReleaseConfig's fallback for `cfg.org`) last.
+   */
+  private ownerFor(repo: string, cfg: ReleaseConfig): string {
+    return releaseOwnerFor({
+      explicitOrg: readExplicitReleaseOrg(),
+      // The repo's GitHub owner, never its ORG-1d org id (which needn't be one).
+      catalogOwner: ghOwnerOf(readCatalog()[repo]),
+      githubOrg: cfg.org,
+    });
   }
 
   slug(repo: string, cfg = this.config()): string {
     const gh = cfg.repos.find((r) => r.name === repo)?.gh;
-    return gh && gh.includes("/") ? gh : `${this.org(cfg)}/${repo}`;
+    return gh && gh.includes("/") ? gh : `${this.ownerFor(repo, cfg)}/${repo}`;
   }
 
   /**
@@ -1109,6 +1129,21 @@ export async function readVersionSha(
   }
 }
 
+/**
+ * Release repos less those of an org with no GitHub source (ORG-1d): their
+ * release flow needs GitHub, so the Release page hides them rather than
+ * failing. With no ORG-1d keys every repo stays.
+ */
+export function releasableOnGithub(repos: ReleaseRepo[]): ReleaseRepo[] {
+  const orgs = readDenConfig().orgs ?? {};
+  if (!Object.values(orgs).some(isSourcedOrg)) return repos;
+  const catalog = readCatalog();
+  return repos.filter((r) => {
+    const org = orgOf(r.name, catalog, orgs);
+    return !org || orgHasGithub(org, orgs);
+  });
+}
+
 /** Workspace repos whose manifest has a `release:` block, as release repos. */
 export function manifestReleaseRepos(): ReleaseRepo[] {
   const catalog = readCatalog();

package/src/ui/server/workspace-routes.ts

@@ -65,6 +65,7 @@ import {
   getWaitDeps,
 } from "../../shared/environment-manager/dag.js";
 import { deriveGraph } from "../../shared/environment-manager/derivation/derive-graph.js";
+import { githubOrgFor } from "../../shared/environment-manager/workspace-org.js";
 import {
   deriveStartTargets,
   filterClosureForStart,
@@ -85,10 +86,12 @@ import { depService } from "../../shared/manifest/deps.js";
 import { waitForReady } from "../../shared/environment-manager/readiness.js";
 import {
   readCatalog,
-  resolveRepoGhSlug,
+  needsGhRepair,
+  resolveRepoCloneSource,
   upsertCatalogEntry,
 } from "../../shared/environment-manager/catalog.js";
 import { getReposRoot, readUserConfig } from "../../shared/den-config.js";
+import { redactRemote } from "../../shared/environment-manager/git-remote.js";
 import { getDistRoot } from "../../shared/paths.js";
 import { recordRemovedFromWorkspace } from "../../shared/environment-manager/default-workspace.js";
 import { getSudoEnv, prewarmSudo } from "./sudo-store.js";
@@ -319,7 +322,7 @@ async function buildAvailableRepos(wsOverride: string | null) {
       hasManifest: false,
       alreadyAdded,
       source: "catalog",
-      gh: entry.gh,
+      gh: entry.gh ?? null,
     });
   }
 
@@ -2158,14 +2161,18 @@ export async function handleWorkspaceRoutes(
         // flow writes one), which used to read as "not in the catalog" and
         // skip the clone entirely. Derive the conventional slug instead, and
         // persist it so every other flow (CLI up/setup) stops hitting this.
-        const ghSlug = resolveRepoGhSlug(svc.repoName);
-        if (!readCatalog()[svc.repoName]?.gh) {
-          upsertCatalogEntry(svc.repoName, { gh: ghSlug });
+        // ORG-1d: a repo with no source and a `remote:` clones from it.
+        const ghSlug = resolveRepoCloneSource(svc.repoName, readCatalog(), () =>
+          githubOrgFor(ws.name),
+        );
+        const entry = readCatalog()[svc.repoName];
+        if (needsGhRepair(entry, ghSlug)) {
+          upsertCatalogEntry(svc.repoName, { ...entry, gh: ghSlug });
         }
         const branch = (svc as { branch?: string | null }).branch ?? "main";
         emit({
           type: "line",
-          text: `  ${svc.repoName}: cloning ${ghSlug} (${branch})…`,
+          text: `  ${svc.repoName}: cloning ${redactRemote(ghSlug)} (${branch})…`,
         });
         try {
           // Synchronous (same helper the workspace-add flow uses) — the server