@monster-orange/den 0.2.8 → 0.3.0

package/src/ui/cli/doctor-command.ts

@@ -0,0 +1,131 @@
+/**
+ * `doctor`: every strategy kind in the registry (secrets, tls), the
+ * strategy this distribution selects for it, whether nothing chose it
+ * (implicit), and its detect() result with the reason.
+ *
+ * Read-only: detect() is a PATH check, so doctor never spawns a backend
+ * CLI, never prompts, and never prints a secret value. Exit 1 when a
+ * strategy that will be used is unavailable or its config is invalid.
+ */
+import chalk from "chalk";
+import { readBrand } from "../../shared/brand.js";
+import { hasEdgeBlock, readEdgeConfig } from "../../shared/edge/config.js";
+import { edgeTlsWarnings, tlsStrategyFor } from "../../shared/edge/tls.js";
+import {
+  readSecretsConfig,
+  secretsStatus,
+} from "../../shared/secrets/index.js";
+import { strategyKinds } from "../../shared/strategies/registry.js";
+
+export interface DoctorRow {
+  kind: string;
+  /** The selected strategy id ("" when the config could not be read). */
+  selected: string;
+  implicit: boolean;
+  available: boolean;
+  reason?: string;
+  /** True when it will be used and cannot work: doctor exits 1. */
+  problem: boolean;
+  warnings: string[];
+}
+
+type Selector = (env: NodeJS.ProcessEnv) => DoctorRow;
+
+const SELECTORS: Record<string, Selector> = {
+  secrets(env) {
+    const st = secretsStatus(readSecretsConfig(), env);
+    return {
+      kind: "secrets",
+      selected: st.backend,
+      implicit: st.implicit,
+      available: st.detect.available,
+      reason: st.detect.reason,
+      // The implicit default is used only when a secret is asked for.
+      problem: !st.detect.available && !st.implicit,
+      warnings: [],
+    };
+  },
+  tls(env) {
+    if (!hasEdgeBlock())
+      return {
+        kind: "tls",
+        selected: "none",
+        implicit: false,
+        available: true,
+        reason: "no edge: block",
+        problem: false,
+        warnings: [],
+      };
+    try {
+      const cfg = readEdgeConfig();
+      const d = tlsStrategyFor(cfg).detect(env);
+      return {
+        kind: "tls",
+        selected: cfg.tls.strategy,
+        implicit: cfg.tlsFrom === "implicit",
+        available: d.available,
+        reason: d.reason,
+        problem: !d.available,
+        warnings: edgeTlsWarnings(cfg),
+      };
+    } catch (err) {
+      return {
+        kind: "tls",
+        selected: "",
+        implicit: false,
+        available: false,
+        reason: (err as Error).message,
+        problem: true,
+        warnings: [],
+      };
+    }
+  },
+};
+
+/**
+ * One row per registered kind (secrets, then tls, then any other kind in
+ * registration order). Never spawns, never throws.
+ */
+export function doctorRows(env: NodeJS.ProcessEnv = process.env): DoctorRow[] {
+  const kinds = strategyKinds();
+  const ordered = [
+    ...Object.keys(SELECTORS).filter((k) => kinds.includes(k)),
+    ...kinds.filter((k) => !(k in SELECTORS)),
+  ];
+  return ordered.map(
+    (kind) =>
+      SELECTORS[kind]?.(env) ?? {
+        kind,
+        selected: "",
+        implicit: false,
+        available: false,
+        reason: "no selector for this kind",
+        problem: false,
+        warnings: [],
+      },
+  );
+}
+
+export function formatDoctor(rows: DoctorRow[], title: string): string[] {
+  const lines = [chalk.bold(`${title} doctor: strategies`), ""];
+  const width = Math.max(...rows.map((r) => r.kind.length));
+  for (const r of rows) {
+    const sel = r.selected
+      ? `${r.selected}${r.implicit ? " (implicit)" : ""}`
+      : "(invalid config)";
+    const state = r.available
+      ? chalk.green("✓ available")
+      : (r.problem ? chalk.red : chalk.yellow)("✗ unavailable");
+    lines.push(
+      `  ${r.kind.padEnd(width)}  ${sel.padEnd(20)} ${state}${r.reason ? `: ${r.reason}` : ""}`,
+    );
+    for (const w of r.warnings) lines.push(chalk.yellow(`    ⚠ ${w}`));
+  }
+  return lines;
+}
+
+export function cmdDoctor(_args: string[]): number {
+  const rows = doctorRows();
+  for (const l of formatDoctor(rows, readBrand().name)) console.log(l);
+  return rows.some((r) => r.problem) ? 1 : 0;
+}

package/src/ui/cli/edge-command.ts

@@ -1,7 +1,11 @@
 /**
- * `edge up | down | status | trust | untrust | routes`
+ * `edge up [--take-over] | down | status | trust | untrust | routes`
  *
- * This org's HTTPS edge: own CA + cert, routes at `<name>.<edge.domain>`.
+ * This org's edge: routes at `<name>.<edge.domain>`, TLS as `edge.tls` says
+ * (none, mkcert or files). `trust` / `untrust` exist only under mkcert.
+ * `routes` lists Den's own routes, then the routers in the included
+ * dynamic files, each with its source file, then the stacks' routers
+ * (`stack-*.yml`, 0.3.0-dev.32), each marked "stack" with its file.
  */
 import chalk from "chalk";
 import { readBrand } from "../../shared/brand.js";
@@ -15,18 +19,37 @@ import {
   trustCa,
   untrustCa,
 } from "../../shared/edge/runtime.js";
-import { edgeStatus } from "../../shared/edge/status.js";
+import {
+  includedRouters,
+  stackRouters,
+  routerUrls,
+  type IncludedRouter,
+} from "../../shared/edge/included.js";
+import { edgeRoutes, edgeStatus } from "../../shared/edge/status.js";
+import { tlsYaml } from "../../shared/edge/tls.js";
+import { rejoinRunningStacks } from "../../shared/stacks/status.js";
+
+/** An included router's URLs (the hosts its rule names), else its name. */
+function includedUrl(r: IncludedRouter): string {
+  return r.hosts.length ? routerUrls(r).join(", ") : r.name;
+}
 
 export async function cmdEdge(args: string[]): Promise<void> {
   const sub = args[0] ?? "status";
   const cfg = readEdgeConfig();
   const n = edgeNames(cfg.org);
   const published = cfg.ports
-    ? `host :${cfg.ports.http} / :${cfg.ports.https}`
+    ? cfg.tls.strategy === "none"
+      ? `host :${cfg.ports.http} (http only)`
+      : `host :${cfg.ports.http} / :${cfg.ports.https}`
     : `not published (reach it on Docker network ${n.network})`;
   switch (sub) {
     case "up": {
-      const { certs } = await edgeUp(cfg);
+      // --take-over: the only way to replace an edge another state dir
+      // owns (0.3.0-dev.40); never implied.
+      const { certs } = await edgeUp(cfg, {
+        takeOver: args.includes("--take-over"),
+      });
       console.log(
         chalk.green(
           `✓ ${n.container} up — ${edgeDomains(cfg)
@@ -37,7 +60,7 @@ export async function cmdEdge(args: string[]): Promise<void> {
       console.log(`  ports  ${published}`);
       if (certs.issued)
         console.log(`  cert   issued for ${certs.names.join(", ")}`);
-      if (caTrusted(cfg) === false)
+      if (cfg.tls.strategy === "mkcert" && caTrusted(cfg) === false)
         console.log(
           chalk.yellow(
             "  CA not trusted yet — run `edge trust` (asks for your password once)",
@@ -45,6 +68,8 @@ export async function cmdEdge(args: string[]): Promise<void> {
         );
       for (const name of ["edge", ...Object.keys(cfg.routes)])
         console.log(`  ${routeUrl(name, cfg)}`);
+      // Running stacks' routes stay up: the edge rejoins their networks.
+      rejoinRunningStacks();
       return;
     }
     case "down":
@@ -57,10 +82,25 @@ export async function cmdEdge(args: string[]): Promise<void> {
     case "untrust":
       process.exitCode = untrustCa(cfg);
       return;
-    case "routes":
-      for (const r of edgeStatus(cfg).routes)
+    case "routes": {
+      for (const r of edgeRoutes(cfg))
         console.log(`${r.url.padEnd(52)} → ${r.upstream}`);
+      // Routers in the included dynamic files: Traefik serves them too.
+      const inc = includedRouters(cfg);
+      for (const r of inc.routers)
+        console.log(
+          `${includedUrl(r).padEnd(52)} → ${r.upstream || "?"}  (${r.file})`,
+        );
+      // Routers the stacks wrote (stack up): neither Den's nor included.
+      const stk = stackRouters(cfg);
+      for (const r of stk.routers)
+        console.log(
+          `${includedUrl(r).padEnd(52)} → ${r.upstream || "?"}  (stack: ${r.file})`,
+        );
+      for (const e of [...inc.errors, ...stk.errors])
+        console.log(chalk.yellow(`${e.file}: not read (${e.error})`));
       return;
+    }
     case "status": {
       const st = edgeStatus(cfg);
       console.log(chalk.bold(`${readBrand().name} edge — ${st.org}`));
@@ -68,14 +108,20 @@ export async function cmdEdge(args: string[]): Promise<void> {
       console.log(`  ports      ${published}`);
       console.log(`  domains    ${st.domains.join(", ")} (+ every subdomain)`);
       console.log(
-        `  CA         ${caDir(cfg)} — ${st.caTrusted === null ? "unknown" : st.caTrusted ? "trusted" : "NOT trusted"}`,
+        `  tls        ${tlsYaml(cfg.tls).replace(/^tls: /, "")}${cfg.tlsFrom === "implicit" ? " (implicit: edge.tls is not set)" : ""}`,
       );
+      if (cfg.tls.strategy !== "none")
+        console.log(
+          // Fronted (edge.publish: false): the proxy in front owns
+          // browser trust (BOOT-1), so this machine's trust is moot.
+          `  CA         ${caDir(cfg)} — ${!st.ports ? "not needed: fronted" : st.caTrusted === null ? "unknown" : st.caTrusted ? "trusted" : "NOT trusted"}`,
+        );
       if (st.certIssued) console.log(`  cert       ${st.certNames.join(", ")}`);
       return;
     }
     default:
       throw new Error(
-        `Unknown edge command "${sub}". Use: up | down | status | trust | untrust | routes`,
+        `Unknown edge command "${sub}". Use: up [--take-over] | down | status | trust | untrust | routes`,
       );
   }
 }

package/src/ui/cli/flag-parser.ts

@@ -12,6 +12,7 @@ export type CommandName =
   | "services"
   | "graph"
   | "register"
+  | "relocate"
   | "use-local"
   | "use-managed"
   | "setup"
@@ -63,9 +64,10 @@ const WORKSPACE_READ_COMMANDS = new Set([
 
 /**
  * Commands that edit one workspace's entries without changing what runs:
- * `-w` picks the workspace to write, active or not, and leaves focus alone.
+ * `-w` picks the workspace to write, whether or not it is active, and leaves
+ * focus alone.
  */
-const WORKSPACE_EDIT_COMMANDS = new Set(["register"]);
+const WORKSPACE_EDIT_COMMANDS = new Set(["register", "relocate"]);
 
 const WORKSPACE_COMMANDS = new Set([
   ...WORKSPACE_MUTATION_COMMANDS,
@@ -196,6 +198,9 @@ const COMMAND_FLAGS: Record<string, readonly string[]> = {
   logs: [],
   setup: ["-f", "--force", "--plan", "-w", "--workspace", "--all-active"],
   sync: [],
+  // The only override for an edge another state dir owns; a typo'd one
+  // must not be ignored.
+  edge: ["--take-over"],
 };
 
 /**

package/src/ui/cli/health-display.ts

@@ -2,6 +2,7 @@ import chalk from "chalk";
 import type { ServiceHealthResult } from "../../shared/environment-manager/health.js";
 
 import { product } from "../../shared/product.js";
+import type { RepoRollup } from "../../shared/health/rollup.js";
 type HealthState = ServiceHealthResult["health"];
 type HealthReasonInput = Pick<ServiceHealthResult, "health" | "healthDetail">;
 
@@ -62,3 +63,27 @@ export function formatHealthReason(result: HealthReasonInput): string {
   const reason = healthReasonText(result);
   return reason ? chalk.gray(reason.slice(0, 48)) : "";
 }
+
+/**
+ * A repo row's rolled-up state (rollupRepoHealth), the one the web UI's
+ * header and graph show: "● down", "● degraded", "● ok", "● unknown".
+ */
+export function formatRollupLabel(r: RepoRollup): string {
+  if (r.state === "down") return chalk.red("● down");
+  if (r.state === "degraded") return chalk.yellow("● degraded");
+  if (r.state === "ok") return chalk.green("● ok");
+  return chalk.gray("● unknown");
+}
+
+/**
+ * Why, for a repo row: the down services ("mailpit down"), and how many
+ * services aren't checked ("25 not checked"). Unchecked never means down.
+ */
+export function rollupReasonText(r: RepoRollup): string {
+  return [
+    r.down.length ? `${r.down.join(", ")} down` : "",
+    r.unchecked ? `${r.unchecked} not checked` : "",
+  ]
+    .filter(Boolean)
+    .join("; ");
+}