@monster-orange/den 0.2.7 → 0.2.8

package/src/ui/cli/clone-plan.ts

@@ -5,12 +5,22 @@
  *
  * On a fresh machine (no workspace set up yet, a blueprint in the config)
  * the plan is what `<cli> workspace seed` and then setup would do, for every
- * blueprint workspace. Otherwise it is the focused workspace's repos, the
- * ones setup works on.
+ * blueprint workspace (`-w` narrows it). Otherwise it is the focused
+ * workspace's repos, the ones setup works on, or the `-w` / `--all-active`
+ * ones; repos only other workspaces hold are named in a hint.
  */
 import * as fs from "fs";
 import * as path from "path";
-import { readCatalog } from "../../shared/environment-manager/catalog.js";
+import {
+  readCatalog,
+  resolveRepoCloneSource,
+} from "../../shared/environment-manager/catalog.js";
+import {
+  isGitRemote,
+  redactRemote,
+} from "../../shared/environment-manager/git-remote.js";
+import { readDenConfig } from "../../shared/den-config.js";
+import type { WorkOrgsConfig } from "../../shared/org-sources.js";
 import {
   blueprintWorkspaces,
   catalogFill,
@@ -32,6 +42,7 @@ import {
 } from "../../shared/environment-manager/workspace-org.js";
 import { orgOf } from "../../shared/manifest/service-links.js";
 import type { ServiceCatalog } from "../../shared/types/index.js";
+import { plural } from "../../shared/plural.js";
 
 export type ClonePlanState =
   | "cloned"
@@ -64,6 +75,39 @@ export interface ClonePlan {
   /** True when planned from the blueprint (nothing seeded yet). */
   fromBlueprint: boolean;
   workspaces: ClonePlanWorkspace[];
+  /** Repos held only by workspaces outside the plan, per workspace. */
+  outside?: { workspace: string; repos: string[] }[];
+}
+
+/** Which workspaces `setup --plan` plans (default: the focused one). */
+export interface PlanSelection {
+  /** `-w <ws>`, repeatable. */
+  workspaces?: readonly string[];
+  /** `--all-active`: every active workspace (plus any `-w` one). */
+  allActive?: boolean;
+}
+
+/**
+ * The branch a checkout has out, read from its HEAD file (no git process):
+ * the branch name, `detached <sha7>`, or null when it can't be read.
+ */
+export function checkoutBranch(dir: string): string | null {
+  try {
+    let gitDir = path.join(dir, ".git");
+    if (fs.statSync(gitDir).isFile()) {
+      // A worktree or submodule: .git names the real git dir.
+      const m = /^gitdir:\s*(.+)$/m.exec(fs.readFileSync(gitDir, "utf-8"));
+      if (!m) return null;
+      gitDir = path.resolve(dir, m[1].trim());
+    }
+    const head = fs.readFileSync(path.join(gitDir, "HEAD"), "utf-8").trim();
+    const ref = /^ref:\s*refs\/heads\/(.+)$/.exec(head);
+    if (ref) return ref[1];
+    if (/^[0-9a-f]{40,64}$/.test(head)) return `detached ${head.slice(0, 7)}`;
+    return null;
+  } catch {
+    return null;
+  }
 }
 
 const ownerOf = (slug: string): string => slug.slice(0, slug.indexOf("/"));
@@ -72,22 +116,33 @@ function cloneDir(repo: string, branch: string): string {
   return path.join(DEN_SERVICES_DIR, repo, branch);
 }
 
-/** The slug setup and up would clone `repo` from, or null without an org. */
-function slugFor(
+/**
+ * What setup and up would clone `repo` from (a GitHub slug, or an ORG-1d
+ * `remote:`), or null without an org. `owner` gives the slug's owner for a
+ * repo with neither `gh` nor `remote`.
+ */
+function sourceFor(
   repo: string,
-  workspace: string,
   catalog: ServiceCatalog,
   ctx: OrgContext,
+  owner: () => string,
 ): string | null {
-  const gh = catalog[repo]?.gh?.trim();
-  if (gh) return gh;
   try {
-    return `${githubOrgFor(workspace, ctx)}/${repo}`;
+    return resolveRepoCloneSource(repo, catalog, owner, ctx.config.orgs);
   } catch {
     return null;
   }
 }
 
+function slugFor(
+  repo: string,
+  workspace: string,
+  catalog: ServiceCatalog,
+  ctx: OrgContext,
+): string | null {
+  return sourceFor(repo, catalog, ctx, () => githubOrgFor(workspace, ctx));
+}
+
 function managedRow(
   repo: string,
   branch: string,
@@ -96,12 +151,13 @@ function managedRow(
 ): ClonePlanRow {
   const dir = cloneDir(repo, branch);
   const cloned = fs.existsSync(dir);
+  const remote = slug !== null && isGitRemote(slug);
   return {
     repo,
     mode: "managed",
     branch,
-    owner: slug ? ownerOf(slug) : null,
-    url: slug ? ghCloneUrl(slug) : null,
+    owner: !slug ? null : remote ? null : ownerOf(slug),
+    url: !slug ? null : remote ? redactRemote(slug) : ghCloneUrl(slug),
     state: cloned
       ? "cloned"
       : !slug
@@ -135,7 +191,9 @@ export function workspaceClonePlan(
       rows.push({
         repo: repoName,
         mode: "dev-managed",
-        branch,
+        // Den doesn't set a checkout's branch: say what it has out.
+        branch:
+          (entry.path && checkoutBranch(entry.path)) || "(branch unknown)",
         owner: owner || null,
         url: null,
         state: "checkout",
@@ -175,28 +233,88 @@ function blueprintClonePlan(ctx: OrgContext): ClonePlanWorkspace[] {
       managedRow(
         repo,
         bp.branch,
-        ctx.catalog[repo]?.gh?.trim() || fill.get(repo) || null,
+        sourceFor(repo, ctx.catalog, ctx, () => {
+          const slug = fill.get(repo);
+          if (!slug) throw new Error(`no org for ${repo}`);
+          return ownerOf(slug);
+        }),
         true, // seeding writes every blueprint repo into the catalog
       ),
     ),
   }));
 }
 
-/** `<cli> setup --plan`: the plan for `names` (every repo when empty). */
-export function buildSetupPlan(names: readonly string[] = []): ClonePlan {
+/**
+ * `<cli> setup --plan`: the plan for `names` (every repo when empty) in the
+ * selected workspaces. Throws on a workspace that does not exist.
+ */
+export function buildSetupPlan(
+  names: readonly string[] = [],
+  sel: PlanSelection = {},
+): ClonePlan {
   const ctx = readOrgContext();
-  if (isFreshWorkspaceSetup(ctx.file) && blueprintWorkspaces().length > 0)
-    return { fromBlueprint: true, workspaces: blueprintClonePlan(ctx) };
-  const ws = getActiveWorkspace();
-  if (!ws) return { fromBlueprint: false, workspaces: [] };
+  const want = [...new Set(sel.workspaces ?? [])];
+  if (isFreshWorkspaceSetup(ctx.file) && blueprintWorkspaces().length > 0) {
+    const all = blueprintClonePlan(ctx);
+    const unknown = want.filter((n) => !all.some((w) => w.name === n));
+    if (unknown.length)
+      throw new Error(
+        `no blueprint workspace named ${unknown.join(", ")} (the blueprint has ${all.map((w) => w.name).join(", ")})`,
+      );
+    return {
+      fromBlueprint: true,
+      workspaces: want.length ? all.filter((w) => want.includes(w.name)) : all,
+    };
+  }
+  const focused = getActiveWorkspace()?.name;
+  const planned = [
+    ...new Set(
+      sel.allActive
+        ? [...ctx.file.active, ...want]
+        : want.length
+          ? want
+          : focused
+            ? [focused]
+            : [],
+    ),
+  ];
+  const unknown = planned.filter((n) => !ctx.file.workspaces[n]);
+  if (unknown.length)
+    throw new Error(
+      `no workspace named ${unknown.join(", ")} (workspaces: ${Object.keys(ctx.file.workspaces).join(", ") || "none"})`,
+    );
+  const workspaces = planned.map((n) =>
+    workspaceClonePlan(n, names.length ? names : undefined, ctx),
+  );
   return {
     fromBlueprint: false,
-    workspaces: [
-      workspaceClonePlan(ws.name, names.length ? names : undefined, ctx),
-    ],
+    workspaces,
+    outside: outsideRepos(ctx, planned, workspaces),
   };
 }
 
+/** Repos that only workspaces outside `planned` hold, per workspace. */
+function outsideRepos(
+  ctx: OrgContext,
+  planned: readonly string[],
+  workspaces: readonly ClonePlanWorkspace[],
+): { workspace: string; repos: string[] }[] {
+  const inPlan = new Set(workspaces.flatMap((w) => w.rows.map((r) => r.repo)));
+  const out: { workspace: string; repos: string[] }[] = [];
+  for (const [name, ws] of Object.entries(ctx.file.workspaces)) {
+    if (planned.includes(name)) continue;
+    const repos = [
+      ...new Set(
+        Object.keys(ws?.services ?? {}).map(
+          (a) => parseAddress(a, ctx.catalog).repoName,
+        ),
+      ),
+    ].filter((r) => !inPlan.has(r));
+    if (repos.length) out.push({ workspace: name, repos });
+  }
+  return out;
+}
+
 const STATE_TEXT: Record<ClonePlanState, string> = {
   cloned: "cloned",
   "would-clone": "would clone",
@@ -210,6 +328,7 @@ export function renderClonePlan(
   plan: ClonePlan,
   cli: string,
   catalog: ServiceCatalog = readCatalog(),
+  orgs: WorkOrgsConfig | undefined = readDenConfig().orgs,
 ): string[] {
   const out: string[] = [];
   if (plan.fromBlueprint)
@@ -230,7 +349,7 @@ export function renderClonePlan(
             ? `  ${r.path}`
             : ""
           : "";
-      const owner = r.owner ?? orgOf(r.repo, catalog) ?? "";
+      const owner = r.owner ?? orgOf(r.repo, catalog, orgs) ?? "";
       out.push(
         `  ${r.repo}  ${r.mode} ${r.branch}  org: ${owner || "(unknown)"}` +
           `${r.url ? `  ${r.url}` : ""}  ${STATE_TEXT[r.state]}${where}`,
@@ -238,6 +357,18 @@ export function renderClonePlan(
     }
     for (const w of ws.warnings) out.push(`  ⚠ ${w}`);
   }
+  const outside = plan.outside ?? [];
+  if (outside.length) {
+    const n = new Set(outside.flatMap((o) => o.repos)).size;
+    out.push(
+      "",
+      `Not in this plan: ${plural(n, "repo")} in other workspaces: ` +
+        outside
+          .map((o) => `${o.workspace} (${o.repos.join(", ")})`)
+          .join(", ") +
+        `. Plan them with -w <workspace> or --all-active.`,
+    );
+  }
   out.push("", "Plan only: nothing was cloned, seeded or written.");
   return out;
 }

package/src/ui/cli/flag-parser.ts

@@ -61,11 +61,25 @@ const WORKSPACE_READ_COMMANDS = new Set([
   "stack",
 ]);
 
+/**
+ * Commands that edit one workspace's entries without changing what runs:
+ * `-w` picks the workspace to write, active or not, and leaves focus alone.
+ */
+const WORKSPACE_EDIT_COMMANDS = new Set(["register"]);
+
 const WORKSPACE_COMMANDS = new Set([
   ...WORKSPACE_MUTATION_COMMANDS,
   ...WORKSPACE_READ_COMMANDS,
+  ...WORKSPACE_EDIT_COMMANDS,
 ]);
 
+/**
+ * Commands that read `-w`/`--workspace` themselves, so it is left in their
+ * args: `setup --plan -w a -w b` takes several, and `mcp --workspace <ws>`
+ * scopes the MCP server (it never sets the CLI's workspace override).
+ */
+const OWN_WORKSPACE_FLAG_COMMANDS = new Set(["setup", "mcp"]);
+
 /** Whether `-w <name>` on this command requires `<name>` to be active. */
 export function workspaceFlagRequiresActive(command: string): boolean {
   return WORKSPACE_MUTATION_COMMANDS.has(command);
@@ -180,7 +194,7 @@ const COMMAND_FLAGS: Record<string, readonly string[]> = {
   ],
   restart: ["-A", "--app", "-n", "--dry-run"],
   logs: [],
-  setup: ["-f", "--force", "--plan"],
+  setup: ["-f", "--force", "--plan", "-w", "--workspace", "--all-active"],
   sync: [],
 };
 
@@ -200,8 +214,9 @@ export function unknownCommandFlags(command: string, args: string[]): string[] {
     (a) =>
       a.startsWith("-") &&
       !allowed.includes(a) &&
-      // `--app=<name>` is the one flag that also takes the = form.
-      !(allowed.includes("--app") && a.startsWith("--app=")),
+      // `--app=<name>` and `-w=`/`--workspace=` also take the = form.
+      !(allowed.includes("--app") && a.startsWith("--app=")) &&
+      !(allowed.includes("--workspace") && /^(-w|--workspace)=/.test(a)),
   );
 }
 
@@ -228,6 +243,16 @@ export function parseCliArgs(raw: string[]): ParsedCliArgs {
       continue;
     }
 
+    if (
+      parsed.command &&
+      OWN_WORKSPACE_FLAG_COMMANDS.has(parsed.command) &&
+      /^(-w|--workspace)(=|$)/.test(token)
+    ) {
+      parsed.args.push(token);
+      i += 1;
+      continue;
+    }
+
     const nextIndex = applyFlag(raw, i, parsed.flags);
     if (nextIndex !== null) {
       i = nextIndex;
@@ -245,3 +270,32 @@ export function parseCliArgs(raw: string[]): ParsedCliArgs {
   validateFlagScopes(parsed);
   return parsed;
 }
+
+/**
+ * Every `-w <ws>` / `--workspace <ws>` (and `=` form) in `args`, in order and
+ * repeatable, and the args without them. For a command that reads `-w`
+ * itself (OWN_WORKSPACE_FLAG_COMMANDS).
+ */
+export function takeWorkspaceFlags(args: readonly string[]): {
+  workspaces: string[];
+  rest: string[];
+} {
+  const workspaces: string[] = [];
+  const rest: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    const m = /^(-w|--workspace)(?:=(.*))?$/.exec(a);
+    if (!m) {
+      rest.push(a);
+      continue;
+    }
+    if (m[2] !== undefined) {
+      if (!m[2]) throw new Error(`${m[1]} requires a value`);
+      workspaces.push(m[2]);
+      continue;
+    }
+    workspaces.push(consumeFlagValue([...args], i, m[1]));
+    i++;
+  }
+  return { workspaces, rest };
+}

package/src/ui/cli/index.ts

@@ -32,10 +32,12 @@ import { moduleScanner } from "../../shared/test-discovery/module-scanner.js";
 import { resolvePerformanceModules } from "./module-selection.js";
 import {
   readCatalog,
-  resolveRepoGhSlug,
+  needsGhRepair,
+  resolveRepoCloneSource,
   upsertCatalogEntry,
 } from "../../shared/environment-manager/catalog.js";
 import { seedSecretsFromSibling } from "../../shared/environment-manager/secrets-check.js";
+import { upNeedsTarget } from "./up-args.js";
 import {
   readWorkspacesFile,
   writeWorkspacesFile,
@@ -109,6 +111,7 @@ import {
 } from "../../shared/environment-manager/service-runner.js";
 import { getGitHubCoords } from "../../shared/smoke/git-remote.js";
 import {
+  assertDenConfigValid,
   getReposRoot,
   mergeUserConfig,
   readDenConfig,
@@ -191,6 +194,7 @@ import { cmdGraph } from "./graph-command.js";
 import { resolveLogsTarget, tailServiceLogs } from "./logs-command.js";
 import {
   parseCliArgs,
+  takeWorkspaceFlags,
   unknownCommandFlags,
   workspaceFlagRequiresActive,
   type ParsedCliArgs,
@@ -315,15 +319,17 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
     lines: ["List all registered services in the catalog."],
   },
   register: {
-    usage: "register [path] [--org <id>]",
+    usage: "register [path] [--org <id>] [-w <workspace>]",
     lines: [
       "With a path: add that checkout (dev-managed) under its manifest name.",
       "Without one: pick the repo interactively. A managed clone is picked",
       "from the focused workspace's org; --org <id> picks from another.",
+      "-w writes that workspace (active or not) and leaves focus alone.",
     ],
   },
   setup: {
-    usage: "setup [service...] [--force|-f] [--plan]",
+    usage:
+      "setup [service...] [--force|-f] [--plan [-w <workspace>]... [--all-active]]",
     lines: [
       "Run 'make setup' once per system (clones missing managed repos first).",
       "Default targets MANAGED clones only — setup's codegen/installs",
@@ -331,6 +337,8 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
       "--force (-f) includes dev-managed repos; naming a service always works.",
       "--plan prints each repo's org and clone URL and stops: nothing is",
       "cloned, seeded or written (on a fresh machine: the blueprint's plan).",
+      "It plans the focused workspace; -w <workspace> (repeatable) plans those,",
+      "--all-active every active one. Repos only other workspaces hold are named.",
     ],
   },
   org: {
@@ -487,6 +495,27 @@ const TELEMETRY_COMMANDS = new Set<string>([
   "service",
 ]);
 
+/**
+ * Commands that run with a config that fails validation: the web and MCP
+ * servers (each route or tool reports it), and those that read neither orgs,
+ * the catalog nor clones (manifest validate, create, the per-engineer
+ * config and local-dev toggles, saved results). Every other registered
+ * command checks the config first.
+ */
+const CONFIG_FREE_COMMANDS = new Set<string>([
+  "web",
+  "mcp",
+  "validate",
+  "create",
+  "config",
+  "local-dev",
+  "view-results",
+]);
+
+function configCheckedCommand(command: string): boolean {
+  return TELEMETRY_COMMANDS.has(command) && !CONFIG_FREE_COMMANDS.has(command);
+}
+
 /** Map a raw command token to a PII-safe, registered telemetry command name. */
 function telemetryCommandName(command?: string): string {
   if (!command) return "none";
@@ -709,6 +738,12 @@ class DenCLI {
     }
 
     try {
+      // A config that fails validation stops every command that touches
+      // orgs, the catalog, clones or releases before it reads or writes
+      // anything: some (sync over existing clones, register, workspace
+      // create) never read `orgs:` and used to carry on (ORG-1d).
+      if (command && configCheckedCommand(command)) assertDenConfigValid();
+
       switch (command) {
         case "run":
           await this.runTestsCommand(args.slice(1));
@@ -1142,10 +1177,11 @@ class DenCLI {
       try {
         // An entry with `gh: ""` clones from the workspace's org, as `up`
         // does (and `setup --plan` says), instead of failing on an empty slug.
-        const ghSlug = resolveRepoGhSlug(repoName, catalog, () =>
+        // ORG-1d: a repo with no source and a `remote:` clones from it.
+        const ghSlug = resolveRepoCloneSource(repoName, catalog, () =>
           githubOrgFor(ws.name),
         );
-        if (!catalogEntry.gh?.trim())
+        if (needsGhRepair(catalogEntry, ghSlug))
           upsertCatalogEntry(repoName, { ...catalogEntry, gh: ghSlug });
         ensureManagedServiceClone(repoName, ghSlug, branch);
       } catch (err) {
@@ -1248,10 +1284,12 @@ class DenCLI {
       // Catalog entries written by the dev-managed add flow carry `gh: ""`, so
       // an entry can exist yet be unclonable. Derive the conventional slug and
       // persist the repair rather than cloning from an empty URL.
-      const ghSlug = resolveRepoGhSlug(repoName, catalog, () =>
+      // ORG-1d: a repo with no source and a `remote:` clones from it.
+      const ghSlug = resolveRepoCloneSource(repoName, catalog, () =>
         githubOrgFor(ws.name),
       );
-      if (!catalog[repoName]?.gh) upsertCatalogEntry(repoName, { gh: ghSlug });
+      if (needsGhRepair(catalog[repoName], ghSlug))
+        upsertCatalogEntry(repoName, { ...catalog[repoName], gh: ghSlug });
       try {
         // runSetup=false: clone only — setup is run below, hidden + non-interactive.
         ensureManagedServiceClone(repoName, ghSlug, branch, false);
@@ -1488,6 +1526,8 @@ class DenCLI {
        * in order, and run nothing. Read-only on every path.
        */
       dryRun?: boolean;
+      /** `--plan`: a preview that would run nothing exits 1. */
+      plan?: boolean;
     },
   ): Promise<void> {
     // How long to show startup output before handing control back to the menu
@@ -1599,6 +1639,7 @@ class DenCLI {
         );
       }
       if (previews.some((p) => p.kind === "error")) process.exitCode = 1;
+      if (opts?.plan && runs.length === 0) process.exitCode = 1;
       console.log(chalk.gray(`  (--dry-run: not ${doing} anything)\n`));
       return;
     }
@@ -2042,6 +2083,7 @@ class DenCLI {
           `\n  ${chalk.bold(seed)} has no derived dependencies to start.\n`,
         ),
       );
+      if (plan) process.exitCode = 1;
       return;
     }
     // Systems the user toggled to auto-start OFF in this workspace are not
@@ -2283,6 +2325,7 @@ class DenCLI {
           "\n  No services in the active workspace — nothing to start.\n",
         ),
       );
+      if (plan) process.exitCode = 1;
       return;
     }
     const { rawOrder, graph } = target;
@@ -2714,10 +2757,10 @@ class DenCLI {
   }
 
   private async cmdServiceUp(args: string[]): Promise<void> {
-    await this.ensureWorkspaceSeeded();
     // Tokens after a `--` terminator belong to a child command — they must
     // never be read as up's own flags (`den up -- -a` is NOT `up -a`).
     const terminator = args.indexOf("--");
+    await this.ensureWorkspaceSeeded();
     const { app, rest } = takeAppFlag(
       terminator === -1 ? args : args.slice(0, terminator),
     );
@@ -2781,6 +2824,7 @@ class DenCLI {
     await this.cmdServiceUpManifest(
       ownArgs.filter((a) => !a.startsWith("-")),
       dryRun || plan,
+      plan,
     );
   }
 
@@ -2788,6 +2832,7 @@ class DenCLI {
   private async cmdServiceUpManifest(
     addresses: string[],
     dryRun = false,
+    plan = false,
   ): Promise<void> {
     // Resolve targets BEFORE the secrets preflight — otherwise running
     // `den up` from a non-service dir (e.g. the den repo root) triggers
@@ -2806,6 +2851,16 @@ class DenCLI {
                 `  or run \`${product().cli} graph\` to see the workspace.\n`,
             ),
         );
+      } else if (process.env.DEN_WORKSPACE_OVERRIDE) {
+        // `up -w <ws>` with nothing to start: -w picks the workspace, not
+        // what in it to start. A usage error, not an empty plan.
+        console.error(
+          chalk.red(
+            `\n  ${upNeedsTarget(product().cli, process.env.DEN_WORKSPACE_OVERRIDE, plan)}\n`,
+          ),
+        );
+        process.exitCode = 2;
+        return;
       } else {
         console.log(
           chalk.yellow(
@@ -2813,12 +2868,15 @@ class DenCLI {
           ),
         );
       }
+      // A plan that resolves nothing is a failed plan (scripts check it).
+      if (plan) process.exitCode = 1;
       return;
     }
     if (!dryRun) preflightSecrets();
     await this.runServicesCommand(targets, "up", undefined, {
       named: addresses,
       dryRun,
+      plan,
     });
   }
 
@@ -3173,15 +3231,29 @@ class DenCLI {
   private async cmdRegister(args: string[]): Promise<void> {
     if (args.includes("-h") || args.includes("--help")) {
       console.log(
-        `\n  ${product().cli} register [path] [--name <repo>] [--gh <owner/repo>]\n\n` +
+        `\n  ${product().cli} register [path] [--name <repo>] [--gh <owner/repo>] [-w <workspace>]\n\n` +
           "  With a path: add that checkout to the catalog and the focused\n" +
           "  workspace as your own (dev-managed) copy, without prompts. The name\n" +
           "  defaults to the manifest's name, then the folder name; the GitHub\n" +
-          "  slug to the git remote.\n" +
+          "  slug to the git remote. -w writes that workspace (active or not)\n" +
+          "  and leaves focus alone.\n" +
           "  Without a path: choose a local checkout or a managed clone interactively.\n",
       );
       return;
     }
+    const repoPathArg = args.find(
+      (a, i) =>
+        !a.startsWith("-") && !/^--(name|gh|org)$/.test(args[i - 1] ?? ""),
+    );
+    // Without a path, register prompts: with no terminal, say how to name one.
+    if (!repoPathArg && !process.stdin.isTTY) {
+      process.stderr.write(
+        `register needs a terminal (stdin is not a TTY); without one: ` +
+          `${product().cli} register <path> [--name <repo>] [--gh <owner/repo>] [-w <workspace>]\n`,
+      );
+      process.exitCode = 2;
+      return;
+    }
     const ws = getActiveWorkspace();
     if (!ws) {
       console.log(
@@ -3192,10 +3264,6 @@ class DenCLI {
       return;
     }
 
-    const repoPathArg = args.find(
-      (a, i) =>
-        !a.startsWith("-") && !/^--(name|gh|org)$/.test(args[i - 1] ?? ""),
-    );
     if (repoPathArg) {
       const flag = (n: string) => {
         const i = args.indexOf(n);
@@ -3306,7 +3374,8 @@ class DenCLI {
       console.log(
         chalk.red(
           `\n  ❌ No GitHub org to list: set github_org in ${product().configFile}, ` +
-            `org: on workspace ${ws.name}, or pass --org <id>\n`,
+            `org: on workspace ${ws.name}, or pass --org <id> ` +
+            `(an org with no GitHub source in orgs.<id>.sources has none)\n`,
         ),
       );
       return;
@@ -3559,18 +3628,38 @@ class DenCLI {
     console.log(chalk.gray(`    revert: ${revert}\n`));
   }
 
-  private async cmdSetup(args: string[]): Promise<void> {
+  private async cmdSetup(rawArgs: string[]): Promise<void> {
+    // `-w <ws>` (repeatable) and `--all-active` pick the workspaces to plan.
+    const { workspaces: planWs, rest: args } = takeWorkspaceFlags(rawArgs);
+    const allActive = args.includes("--all-active");
     const force = args.includes("--force") || args.includes("-f");
     const names = args.filter((a) => !a.startsWith("-"));
 
     // `--plan`: each repo's org and clone URL, then stop. Read-only.
     if (args.includes("--plan")) {
+      let plan: ReturnType<typeof buildSetupPlan>;
+      try {
+        plan = buildSetupPlan(names, { workspaces: planWs, allActive });
+      } catch (e) {
+        console.error(chalk.red(`\n  ${(e as Error).message}\n`));
+        process.exitCode = 1;
+        return;
+      }
       console.log(chalk.bold("\n  Setup plan (no changes will be made):\n"));
-      for (const line of renderClonePlan(buildSetupPlan(names), product().cli))
+      for (const line of renderClonePlan(plan, product().cli))
         console.log(`  ${line}`.trimEnd());
       console.log();
       return;
     }
+    if (planWs.length || allActive) {
+      console.error(
+        chalk.red(
+          `\n  -w and --all-active go with --plan: setup itself works on the focused workspace.\n`,
+        ),
+      );
+      process.exitCode = 1;
+      return;
+    }
 
     // Clone any managed repos that aren't on disk yet before reading manifests.
     this.cloneMissingManagedRepos();