@monster-orange/den 0.2.7 → 0.3.0

package/src/ui/mcp/tools.ts

@@ -33,12 +33,27 @@ import {
   type ServiceEntryLike,
   type SecurityPlanLike,
 } from "./guards.js";
+import {
+  ScopeRefusal,
+  assertPathInScope,
+  assertScopeExists,
+  assertScopeFocused,
+  assertServicesInScope,
+  filterWorkspacesBody,
+  pinWorkspace,
+  type McpScope,
+} from "./scope.js";
 
 export interface ToolContext {
   api: DenApi;
   cfg: ResolvedMcpConfig;
   /** The CLI name, for messages (`<cli> web up`). */
   cli: string;
+  /**
+   * A scoped server's workspace and actor (AG-2a-core); absent, every tool
+   * behaves as it always has.
+   */
+  scope?: McpScope;
 }
 
 type Args = Record<string, unknown>;
@@ -193,7 +208,10 @@ const READ_TOOLS: DenTool[] = [
     "Workspaces",
     "Workspaces, which are active and which is focused.",
     {},
-    (_a, { api }) => api.get("/api/workspaces"),
+    async (_a, { api, scope }) => {
+      const body = await api.get("/api/workspaces");
+      return scope ? filterWorkspacesBody(body, scope) : body;
+    },
   ),
   read(
     "environments",
@@ -215,9 +233,19 @@ const READ_TOOLS: DenTool[] = [
         .describe("repo/service names"),
       env: envArg,
     },
-    async (a, { api, cfg }) => {
+    async (a, { api, cfg, scope }) => {
       const env = envOf(a);
       assertLogsEnv(env, cfg);
+      if (scope)
+        await assertServicesInScope(
+          "logs_search",
+          api,
+          scope,
+          (a.targets as string[]).map((t) => {
+            const slash = t.lastIndexOf("/");
+            return { repo: t.slice(0, slash), service: t.slice(slash + 1) };
+          }),
+        );
       return api.get("/api/logs/search", {
         q: String(a.q),
         env,
@@ -241,9 +269,13 @@ const READ_TOOLS: DenTool[] = [
         .describe("Lines to return (default 200)"),
       env: envArg,
     },
-    async (a, { api, cfg }) => {
+    async (a, { api, cfg, scope }) => {
       const env = envOf(a);
       assertLogsEnv(env, cfg);
+      if (scope)
+        await assertServicesInScope("logs_tail", api, scope, [
+          { repo: String(a.repo), service: String(a.service) },
+        ]);
       const n = (a.lines as number | undefined) ?? 200;
       const query: Query = { repo: String(a.repo), service: String(a.service) };
       const r =
@@ -270,11 +302,17 @@ const READ_TOOLS: DenTool[] = [
     "Available tests",
     "The test modules of a pillar, and which repos (branch + SHA) they come from.",
     { pillar: z.enum(PILLARS) },
-    async (a, { api }) => ({
-      modules: await api.get("/api/modules", { pillar: String(a.pillar) }),
-      sources: await api.get("/api/test-sources", { pillar: String(a.pillar) }),
-    }),
+    async (a, { api, scope }) => {
+      if (scope) await assertScopeFocused("tests_available", api, scope);
+      return {
+        modules: await api.get("/api/modules", { pillar: String(a.pillar) }),
+        sources: await api.get("/api/test-sources", {
+          pillar: String(a.pillar),
+        }),
+      };
+    },
   ),
+
   read(
     "security_latest",
     "Latest security scans",
@@ -307,13 +345,20 @@ const READ_TOOLS: DenTool[] = [
       path: z.string().optional().describe("Repo directory or manifest file"),
       content: z.string().optional().describe("Manifest YAML to validate"),
     },
-    async (a, { api }) => {
+    async (a, { api, scope }) => {
       if (str(a.content) !== undefined)
         return api.get("/api/manifest/validate", {}, "POST", {
           content: a.content,
         });
       if (str(a.path) === undefined)
         throw new Refusal("give a path or the manifest content.");
+      if (scope)
+        await assertPathInScope(
+          "manifest_validate",
+          api,
+          scope,
+          String(a.path),
+        );
       return api.get("/api/manifest/validate", { path: str(a.path) });
     },
   ),
@@ -447,19 +492,27 @@ const ACTION_TOOLS: Record<McpAction, DenTool> = {
     shape: {
       repo: z.string().optional().describe("One managed repo (default: all)"),
     },
-    async run(a, { api }) {
+    async run(a, { api, scope }) {
       const repo = str(a.repo);
+      // Scoped: the sync names the scoped workspace (the web server's own
+      // default is the focused one).
+      const ws = scope ? { workspace: scope.workspace } : {};
       if (repo) {
         const services = (await api.get("/api/services", {
           env: "local",
+          ...ws,
         })) as ServiceEntryLike[];
         assertSyncableRepo(repo, services);
       }
-      const r = await api.stream("/api/workspace/sync", repo ? { repo } : {}, {
-        method: "POST",
-        maxLines: 5000,
-        timeoutMs: 15 * 60_000,
-      });
+      const r = await api.stream(
+        "/api/workspace/sync",
+        repo ? { repo, ...ws } : { ...ws },
+        {
+          method: "POST",
+          maxLines: 5000,
+          timeoutMs: 15 * 60_000,
+        },
+      );
       return actionResult(r, 300);
     },
   },
@@ -478,13 +531,14 @@ const ACTION_TOOLS: Record<McpAction, DenTool> = {
         .optional()
         .describe("Security scan mode (default baseline)"),
     },
-    async run(a, { api, cfg }) {
+    async run(a, { api, cfg, scope }) {
       const pillar = String(a.pillar);
       const env = envOf(a);
       const modules = (a.modules as string[] | undefined) ?? [];
       const mode =
         pillar === "security" ? (str(a.mode) ?? "baseline") : undefined;
       assertRunTestsAllowed({ pillar, env, mode }, cfg);
+      if (scope) await assertScopeFocused("run_tests", api, scope);
       if (pillar === "security") {
         for (const service of modules.length ? modules : [undefined]) {
           const plan = (await api.get("/api/security/plan", {
@@ -547,13 +601,17 @@ export function versionBefore(a: string, b: string): boolean {
   return false;
 }
 
-/** The running web server's version, or undefined when it reports none. */
-async function webServerVersion(api: DenApi): Promise<string | undefined> {
+/** The running web server's /api/server-info, or null when it has none. */
+async function readServerInfo(
+  api: DenApi,
+): Promise<Record<string, unknown> | null> {
   try {
-    const info = (await api.get("/api/server-info")) as { version?: unknown };
-    return typeof info?.version === "string" ? info.version : undefined;
+    const info = (await api.get("/api/server-info")) as unknown;
+    return info && typeof info === "object"
+      ? (info as Record<string, unknown>)
+      : null;
   } catch (e) {
-    if (e instanceof DenHttpError) return undefined;
+    if (e instanceof DenHttpError) return null;
     throw e;
   }
 }
@@ -567,11 +625,13 @@ async function notFoundMessage(
   e: DenHttpError,
   tool: string,
   ctx: ToolContext,
+  info: () => Promise<Record<string, unknown> | null>,
 ): Promise<string> {
   const plain = `Error: ${tool}: the web server answered 404 for ${e.method} ${e.path}: ${e.body}`;
   const since = ROUTE_SINCE[e.path];
   if (!since) return plain;
-  const version = await webServerVersion(ctx.api);
+  const v = (await info())?.version;
+  const version = typeof v === "string" ? v : undefined;
   if (version !== undefined && !versionBefore(version, since)) return plain;
   return (
     `web server is Den ${version ?? `< ${since}`}; ` +
@@ -599,6 +659,10 @@ async function reportRefusal(
       tool,
       ...(typeof args.repo === "string" ? { repo: args.repo } : {}),
       ...(typeof args.service === "string" ? { service: args.service } : {}),
+      ...(Array.isArray(args.targets) ? { targets: args.targets } : {}),
+      // A path (manifest_validate): the server records it under the catalog
+      // repo it is inside, never as the path itself.
+      ...(typeof args.path === "string" ? { path: args.path } : {}),
       reason,
     });
   } catch {
@@ -606,6 +670,51 @@ async function reportRefusal(
   }
 }
 
+/**
+ * MD-2: when the web server runs an older engine than the one on disk (a
+ * pin upgraded Den under it), every failed call says so, naming both
+ * versions and the restart. Null when the engines agree or it can't tell.
+ */
+function staleEngineMessage(
+  tool: string,
+  ctx: ToolContext,
+  info: Record<string, unknown> | null,
+): string | null {
+  if (info?.engineStale !== true) return null;
+  const ver = (x: unknown) =>
+    x &&
+    typeof x === "object" &&
+    typeof (x as { version?: unknown }).version === "string"
+      ? (x as { version: string }).version
+      : "unknown";
+  return (
+    `Error: ${tool}: Den was updated to ${ver(info.onDisk)}, but the web server ` +
+    `is still running ${ver(info.loaded)}. Restart it: ${ctx.cli} web restart ` +
+    `(or your service restart).`
+  );
+}
+
+/**
+ * A scoped server's arguments: the workspace exists (checked once per
+ * server), and a tool that takes a workspace gets the scoped one; naming
+ * another is refused.
+ */
+const verifiedScopes = new WeakSet<McpScope>();
+async function scopeArgs(
+  tool: DenTool,
+  args: Args,
+  ctx: ToolContext,
+  scope: McpScope,
+): Promise<Args> {
+  if (!verifiedScopes.has(scope)) {
+    await assertScopeExists(ctx.api, scope);
+    verifiedScopes.add(scope);
+  }
+  return "workspace" in tool.shape
+    ? pinWorkspace(tool.name, args, scope)
+    : args;
+}
+
 export async function callTool(
   name: string,
   args: Args,
@@ -618,7 +727,10 @@ export async function callTool(
       isError: true,
     };
   try {
-    const out = await tool.run(args, ctx);
+    const out = await tool.run(
+      ctx.scope ? await scopeArgs(tool, args, ctx, ctx.scope) : args,
+      ctx,
+    );
     const text = typeof out === "string" ? out : JSON.stringify(out, null, 2);
     return { text: redactSecrets(text), isError: false };
   } catch (e) {
@@ -627,13 +739,28 @@ export async function callTool(
         text: redactSecrets(JSON.stringify(e.out, null, 2)),
         isError: true,
       };
+    // server-info is read lazily, once, and only after a call failed.
+    let infoRead: Promise<Record<string, unknown> | null> | null = null;
+    const info = () => (infoRead ??= readServerInfo(ctx.api).catch(() => null));
+    if (e instanceof DenHttpError) {
+      const stale = staleEngineMessage(name, ctx, await info());
+      if (stale)
+        return {
+          text: redactSecrets(
+            `${stale} (${e.method} ${e.path} answered ${e.status}: ${e.body})`,
+          ),
+          isError: true,
+        };
+    }
     if (e instanceof DenHttpError && e.status === 404) {
-      const text = await notFoundMessage(e, name, ctx).catch(
+      const text = await notFoundMessage(e, name, ctx, info).catch(
         (inner: Error) => `Error: ${inner.message}`,
       );
       return { text: redactSecrets(text), isError: true };
     }
-    if (e instanceof Refusal && tool.action)
+    // A call outside a scoped server's workspace is recorded whatever the
+    // tool: it is an attempt to cross the boundary (AG-2a-core).
+    if (e instanceof Refusal && (tool.action || e instanceof ScopeRefusal))
       await reportRefusal(ctx, name, args, e.message);
     const msg =
       e instanceof Refusal

package/src/ui/server/appearance-prefs.ts

@@ -0,0 +1,95 @@
+/**
+ * Appearance preferences: the theme and mode this engineer chose. Stored in
+ * the user config as `appearance:` and served by /api/settings, like the
+ * graph prefs. A pure UI preference: changing it writes this block of
+ * config/local/user.yml and nothing else (no edge, services or restart).
+ */
+
+export type ModePref = "system" | "dark" | "light";
+
+export interface AppearancePrefs {
+  /**
+   * A theme id, or null to follow the org default (the org config's
+   * `brand.theme`, else den). A named theme is pinned even when it is the
+   * org default today: you keep it when the org changes `brand.theme`.
+   */
+  theme: string | null;
+  /** system follows prefers-color-scheme. */
+  mode: ModePref;
+}
+
+export const APPEARANCE_DEFAULTS: AppearancePrefs = {
+  theme: null,
+  mode: "system",
+};
+
+export const MODES: readonly ModePref[] = ["system", "dark", "light"];
+const THEME_ID = /^[a-z][a-z0-9-]{1,39}$/;
+
+const isObject = (v: unknown): v is Record<string, unknown> =>
+  typeof v === "object" && v !== null && !Array.isArray(v);
+
+/**
+ * The stored block, normalised. A stored theme id is kept even when that
+ * theme is not installed now (resolution warns and falls back), so a theme
+ * that is briefly missing does not lose the preference.
+ */
+export function appearancePrefs(stored: unknown): AppearancePrefs {
+  const out: AppearancePrefs = { ...APPEARANCE_DEFAULTS };
+  if (!isObject(stored)) return out;
+  if (typeof stored.theme === "string" && THEME_ID.test(stored.theme))
+    out.theme = stored.theme;
+  if (MODES.includes(stored.mode as ModePref))
+    out.mode = stored.mode as ModePref;
+  return out;
+}
+
+/**
+ * Merge a POSTed (partial) block. `theme` must name an installed theme that
+ * validates; null or "" clears it ("Org default": follow the org); any bad
+ * field fails the whole patch.
+ *
+ * A theme picked by name is stored by name, even one that is the org
+ * default now (0.3.0-dev.11): that is a pin, and the menu shows it as one.
+ * Only "Org default" follows the org when it changes `brand.theme`.
+ */
+export function mergeAppearancePrefs(
+  current: AppearancePrefs,
+  patch: unknown,
+  isUsableTheme: (id: string) => boolean,
+): { ok: true; value: AppearancePrefs } | { ok: false; error: string } {
+  if (!isObject(patch))
+    return { ok: false, error: "appearance must be an object" };
+  const out: AppearancePrefs = { ...current };
+  for (const [key, v] of Object.entries(patch)) {
+    if (key === "mode") {
+      // null clears it to the default (0.3.0-dev.32), as theme's does.
+      if (v === null) out.mode = APPEARANCE_DEFAULTS.mode;
+      else if (!MODES.includes(v as ModePref))
+        return {
+          ok: false,
+          error: `appearance.mode must be one of ${MODES.map((m) => `"${m}"`).join(", ")}`,
+        };
+      else out.mode = v as ModePref;
+    } else if (key === "theme") {
+      if (v === null || v === "") out.theme = null;
+      else if (typeof v !== "string" || !THEME_ID.test(v) || !isUsableTheme(v))
+        return {
+          ok: false,
+          error: `appearance.theme: no valid installed theme "${String(v)}"`,
+        };
+      else out.theme = v;
+    } else return { ok: false, error: `unknown appearance setting "${key}"` };
+  }
+  return { ok: true, value: out };
+}
+
+/** What user.yml stores: only what differs from the defaults. */
+export function storedAppearance(
+  p: AppearancePrefs,
+): { theme?: string; mode?: ModePref } | undefined {
+  const out: { theme?: string; mode?: ModePref } = {};
+  if (p.theme) out.theme = p.theme;
+  if (p.mode !== APPEARANCE_DEFAULTS.mode) out.mode = p.mode;
+  return Object.keys(out).length ? out : undefined;
+}

package/src/ui/server/audit.ts

@@ -5,6 +5,7 @@
  * as the web-server log, so agent actions sit beside the UI's own; the
  * structured entries are kept in a small in-memory ring.
  */
+import * as path from "path";
 import {
   actorLabel,
   type Actor,
@@ -20,6 +21,10 @@ export interface AuditEntry {
   clientVersion?: string;
   mcpPid?: number | null;
   session?: string;
+  /** A scoped MCP server's actor, `agent:<id>` (AG-2a-core). */
+  agent?: string;
+  /** The workspace that scoped server is pinned to. */
+  workspace?: string;
   /** exec | run | sync, or the MCP tool name for a refused non-lifecycle call */
   verb: string;
   detail: string;
@@ -27,6 +32,11 @@ export interface AuditEntry {
   outcome?: "refused";
   /** Why it was refused (first line). */
   reason?: string;
+  /**
+   * The services (`repo/service`) or repos a refused non-lifecycle call
+   * named, so each one's activity list shows it (`GET /api/activity`).
+   */
+  addresses?: string[];
 }
 
 type Sink = (line: string, actor: AgentActor | null) => void;
@@ -52,6 +62,7 @@ export function recordAction(
     detail: string;
     outcome?: "refused";
     reason?: string;
+    addresses?: string[];
   },
 ): AuditEntry {
   const entry: AuditEntry = {
@@ -63,19 +74,28 @@ export function recordAction(
           clientVersion: actor.clientVersion,
           mcpPid: actor.mcpPid,
           session: actor.session,
+          ...(actor.agent ? { agent: actor.agent } : {}),
+          ...(actor.workspace ? { workspace: actor.workspace } : {}),
         }
       : {}),
     verb: action.verb,
     detail: action.detail,
     ...(action.outcome ? { outcome: action.outcome } : {}),
     ...(action.reason ? { reason: clean(action.reason, 300) } : {}),
+    ...(action.addresses?.length ? { addresses: action.addresses } : {}),
   };
   ring.push(entry);
   if (ring.length > RING_MAX) ring.shift();
   const mark = entry.outcome === "refused" ? "✗" : "▶";
   const why = entry.reason ? ` — refused: ${entry.reason}` : "";
+  // A refusal whose detail is its reason names what it touched instead.
+  const what = entry.addresses
+    ? entry.addresses.join(", ")
+    : entry.reason && action.detail === entry.reason
+      ? ""
+      : action.detail;
   sink?.(
-    `${mark} ${action.verb} ${action.detail}${why}${actorSuffix(actor)}`,
+    `${mark} ${action.verb}${what ? ` ${what}` : ""}${why}${actorSuffix(actor)}`,
     actor,
   );
   return entry;
@@ -92,12 +112,51 @@ function clean(v: unknown, max: number): string {
 
 const SAFE_PART = /^[A-Za-z0-9._-]{1,128}$/;
 const LIFECYCLE_TOOL = /^service_(up|down|restart)$/;
+/** At most this many targets of one refused call are recorded. */
+const MAX_ADDRESSES = 40;
+
+/** `repo/service` (or `repo`) when every part is a safe name, else "". */
+function safeAddress(repo: string, service = ""): string {
+  if (!SAFE_PART.test(repo)) return "";
+  return service && SAFE_PART.test(service) ? `${repo}/${service}` : repo;
+}
+
+/**
+ * What a refused call named: its `repo` (with `service`), else each of its
+ * `targets` (`repo/service`, as logs_search takes them), deduplicated.
+ */
+function refusedAddresses(report: {
+  repo?: unknown;
+  service?: unknown;
+  targets?: unknown;
+}): string[] {
+  const out: string[] = [];
+  if (typeof report.repo === "string") {
+    const a = safeAddress(
+      report.repo,
+      typeof report.service === "string" ? report.service : "",
+    );
+    if (a) out.push(a);
+  }
+  if (Array.isArray(report.targets))
+    for (const t of report.targets.slice(0, MAX_ADDRESSES)) {
+      if (typeof t !== "string") continue;
+      const slash = t.lastIndexOf("/");
+      const a =
+        slash > 0
+          ? safeAddress(t.slice(0, slash), t.slice(slash + 1))
+          : safeAddress(t);
+      if (a && !out.includes(a)) out.push(a);
+    }
+  return out;
+}
 
 /**
  * An MCP guard refused an agent's call before it reached an action route.
  * The agent's own report, so every field is sanitised: a lifecycle tool with
  * a valid repo becomes an "exec" entry for that service (what the panel's
- * activity list shows); anything else is recorded under the tool's name.
+ * activity list shows); anything else is recorded under the tool's name,
+ * with the refusal as its detail and the services it named as `addresses`.
  */
 export function recordAgentRefusal(
   actor: Actor,
@@ -105,6 +164,7 @@ export function recordAgentRefusal(
     tool?: unknown;
     repo?: unknown;
     service?: unknown;
+    targets?: unknown;
     reason?: unknown;
   },
 ): AuditEntry {
@@ -123,14 +183,41 @@ export function recordAgentRefusal(
       reason,
     });
   }
+  // Any other tool: the refusal is the detail, under every service or repo
+  // the call named (all of a logs_search's targets, in one entry).
   return recordAction(actor, {
     verb: tool,
-    detail: "",
+    detail: reason,
     outcome: "refused",
     reason,
+    addresses: refusedAddresses(report),
   });
 }
 
+/**
+ * The catalog repo a refused call's `path` is inside (manifest_validate), so
+ * the refusal shows in that repo's activity: the repo whose checkout is the
+ * path or holds it, the deepest when checkouts nest. Null for a relative
+ * path or one inside no repo. The path itself is never recorded.
+ */
+export function repoAtPath(
+  p: unknown,
+  repos: readonly { repoName: string; repoPath: string }[],
+): string | null {
+  if (typeof p !== "string" || p.length > 4096 || !path.isAbsolute(p))
+    return null;
+  const target = path.resolve(p);
+  let best: { repoName: string; depth: number } | null = null;
+  for (const r of repos) {
+    if (!r.repoPath || !path.isAbsolute(r.repoPath)) continue;
+    const root = path.resolve(r.repoPath);
+    if (target !== root && !target.startsWith(root + path.sep)) continue;
+    if (!best || root.length > best.depth)
+      best = { repoName: r.repoName, depth: root.length };
+  }
+  return best && SAFE_PART.test(best.repoName) ? best.repoName : null;
+}
+
 /** The most recent actions, oldest first. */
 export function recentActions(): AuditEntry[] {
   return ring.slice();

package/src/ui/server/daemon-reaper.ts

@@ -15,7 +15,9 @@
  * to any workspace/catalog service is process-death-equivalent evidence and
  * is removed directly. Records another root registered (all roots of a
  * product share the file) are never touched, and an unstamped legacy record
- * is not removed for being unresolvable.
+ * is not removed for being unresolvable. A record whose checkout is gone, or
+ * whose service moved to another checkout with nothing of it running
+ * (`staleReason`), is removed whatever the address's health says.
  */
 
 import type { ServiceHealthResult } from "../../shared/environment-manager/health.js";
@@ -49,6 +51,19 @@ export interface DaemonReaperDeps {
    * and an unstamped (pre-0.2.7) one is not dropped for being unresolvable.
    */
   rootOf: (daemon: DaemonRecord) => "here" | "other" | "unstamped";
+  /**
+   * Why a record describes nothing that can be running whatever its health
+   * (service-runner's daemonStaleReason: its checkout is gone, or the
+   * service moved to another checkout and none of its containers run), or
+   * null. Injected; omitted, no record is dropped for it. `running` is the
+   * container listing, taken once per sweep by `runningContainers`.
+   */
+  staleReason?: (
+    daemon: DaemonRecord,
+    running: Set<string> | null,
+  ) => string | null;
+  /** The running container base names (null: unverifiable), once a sweep. */
+  runningContainers?: () => Promise<Set<string> | null>;
 }
 
 export interface DaemonReapResult {
@@ -96,6 +111,11 @@ export async function reapDeadDaemons(
 ): Promise<DaemonReapResult> {
   const removed: string[] = [];
   const kept: string[] = [];
+  const running = deps.staleReason
+    ? await (deps.runningContainers?.() ?? Promise.resolve(null)).catch(
+        () => null,
+      )
+    : null;
 
   await Promise.allSettled(
     deps.listDaemons().map(async (daemon) => {
@@ -105,6 +125,14 @@ export async function reapDeadDaemons(
           kept.push(daemon.address);
           return;
         }
+        // Its checkout is gone, or the service has moved and nothing of
+        // the record's runs: whatever the address's health says (it is
+        // another checkout's), the record is stale.
+        if (deps.staleReason?.(daemon, running)) {
+          deps.unregisterDaemon(daemon.address);
+          removed.push(daemon.address);
+          return;
+        }
         const service = resolveForDaemon(deps, daemon);
         if (!service) {
           // No longer in any owning workspace/catalog — nothing could restart