@monster-orange/den 0.2.8 → 0.4.0

package/src/ui/cli/create.ts

@@ -146,17 +146,26 @@ export function renderDistribution(
     ...bannerLines(title).map((l) => `    - "${l}"`),
     "",
     "# The GitHub org (or user) that owns the repos Den clones and lists.",
-    "github_org: your-github-org",
+    "# Unset, Den lists no GitHub repos (and never calls gh for them). E.g.",
+    "# github_org: example-org",
     "",
-    "# Secrets backend: env reads plain environment variables; doppler and",
-    "# 1password are the others.",
+    "# Secrets backend: none (this distribution needs no secrets store), or",
+    "# env (plain environment variables), doppler or 1password. A backend's",
+    "# refs say where Den's own features find their secrets, e.g.",
+    `#   refs: { sudo: { key: ${prefix}_LOCAL_ADMIN_PWD } }`,
     "secrets:",
-    "  provider: env",
+    "  provider: none",
     "",
-    "# This instance's HTTPS edge: https://<service>.<domain>.",
+    "# This instance's edge: <service>.<domain>, one Traefik for its routes.",
     "edge:",
     `  org: ${name}`,
     `  domain: ${name}.localhost`,
+    "  # TLS: none serves http only. For https, pick a strategy:",
+    "  #   tls: { strategy: mkcert }                  # a local CA, per machine",
+    "  #   tls: { strategy: mkcert, ca: ~/path/to/ca } # an existing mkcert CA",
+    "  #   tls: { strategy: files, include: edge/dynamic, mounts: { <host>: <container> } }",
+    "  #     # your own certs, in included Traefik config",
+    "  tls: none",
     "",
     "environments: [local]",
     "",
@@ -344,13 +353,21 @@ export function runCreate(argv: string[], cwd: string): number {
       denVersion: runningDenVersion(),
     });
     const cli = args.cli ?? args.name;
-    const rel = path.relative(cwd, args.dir) || ".";
+    // Relative only when the new directory is under the caller's cwd; a
+    // path that climbs out (../../..) is harder to read than the absolute one.
+    const rel = path.relative(cwd, args.dir);
+    const cdPath =
+      rel === ""
+        ? "."
+        : rel.startsWith("..") || path.isAbsolute(rel)
+          ? args.dir
+          : rel;
     console.log(
       `Created ${args.name} in ${args.dir} (${plural(written.length, "file")}).`,
     );
     console.log("");
     console.log("Next:");
-    console.log(`  cd ${rel}`);
+    console.log(`  cd ${cdPath}`);
     console.log("  npm install");
     console.log(`  ./bin/${cli} --help`);
     return 0;

package/src/ui/cli/doctor-command.ts

@@ -0,0 +1,260 @@
+/**
+ * `doctor`: every strategy kind in the registry (secrets, tls,
+ * session-backend, runtime), the strategy this distribution selects for it, whether
+ * nothing chose it (implicit), and its detect() result with the reason.
+ *
+ * Read-only: detect() is a PATH check (session-backend loads the optional
+ * PTY module, which runs nothing; runtime reads a CLI's version from its
+ * install, never by running it), so doctor never spawns a backend CLI,
+ * never prompts, and never prints a secret value. Exit 1 when a strategy
+ * that will be used is unavailable or its config is invalid. When agents
+ * are configured, a note says to run `<cli> doctor --probe`.
+ *
+ * `--probe` (opt-in, AG spec §5a-env) is the one exception to never
+ * spawning: it runs a short probe session through the session host for a
+ * plain session and each available runtime's agent env (env-probe.ts), and
+ * exits 1 when a runtime's scrubEnv name or a credential-shaped variable
+ * reaches one. Without the PTY module the probe is unavailable, not failed.
+ */
+import chalk from "chalk";
+import { readDenConfig, type DenConfig } from "../../shared/den-config.js";
+import { getStateDir } from "../../shared/paths.js";
+import { product } from "../../shared/product.js";
+import { listRecords } from "../../shared/agents/records.js";
+import { readBrand } from "../../shared/brand.js";
+import { hasEdgeBlock, readEdgeConfig } from "../../shared/edge/config.js";
+import { edgeTlsWarnings, tlsStrategyFor } from "../../shared/edge/tls.js";
+import {
+  readSecretsConfig,
+  secretsStatus,
+} from "../../shared/secrets/index.js";
+import {
+  DEN_PTY_ID,
+  SESSION_BACKEND_KIND,
+} from "../../shared/sessions/den-pty.js";
+import {
+  getStrategy,
+  strategyKinds,
+} from "../../shared/strategies/registry.js";
+import {
+  DEFAULT_RUNTIME_ID,
+  RUNTIME_KIND,
+} from "../../shared/agents/runtimes.js";
+
+export interface DoctorRow {
+  kind: string;
+  /** The selected strategy id ("" when the config could not be read). */
+  selected: string;
+  implicit: boolean;
+  available: boolean;
+  reason?: string;
+  /** True when it will be used and cannot work: doctor exits 1. */
+  problem: boolean;
+  warnings: string[];
+}
+
+type Selector = (env: NodeJS.ProcessEnv) => DoctorRow;
+
+const SELECTORS: Record<string, Selector> = {
+  secrets(env) {
+    const st = secretsStatus(readSecretsConfig(), env);
+    return {
+      kind: "secrets",
+      selected: st.backend,
+      implicit: st.implicit,
+      available: st.detect.available,
+      reason: st.detect.reason,
+      // The implicit default is used only when a secret is asked for.
+      problem: !st.detect.available && !st.implicit,
+      warnings: [],
+    };
+  },
+  tls(env) {
+    if (!hasEdgeBlock())
+      return {
+        kind: "tls",
+        selected: "none",
+        implicit: false,
+        available: true,
+        reason: "no edge: block",
+        problem: false,
+        warnings: [],
+      };
+    try {
+      const cfg = readEdgeConfig();
+      const d = tlsStrategyFor(cfg).detect(env);
+      return {
+        kind: "tls",
+        selected: cfg.tls.strategy,
+        implicit: cfg.tlsFrom === "implicit",
+        available: d.available,
+        reason: d.reason,
+        problem: !d.available,
+        warnings: edgeTlsWarnings(cfg),
+      };
+    } catch (err) {
+      return {
+        kind: "tls",
+        selected: "",
+        implicit: false,
+        available: false,
+        reason: (err as Error).message,
+        problem: true,
+        warnings: [],
+      };
+    }
+  },
+  // Agents' terminals (AG-3a). Only den-pty exists, so it is the implicit
+  // choice; unavailable is never a problem (nothing needs a session until
+  // one is started, and `sessions start` says why).
+  [SESSION_BACKEND_KIND](env) {
+    const d = getStrategy(SESSION_BACKEND_KIND, DEN_PTY_ID)?.detect(env) ?? {
+      available: false,
+      reason: "not registered",
+    };
+    return {
+      kind: SESSION_BACKEND_KIND,
+      selected: DEN_PTY_ID,
+      implicit: true,
+      available: d.available,
+      reason: d.reason,
+      problem: false,
+      warnings: [],
+    };
+  },
+  // Agents' CLIs (AG-2a): the default runtime, chosen per persona or agent,
+  // so it is implicit and its absence is never a problem (`agents start`
+  // says why it can't run).
+  [RUNTIME_KIND](env) {
+    const d = getStrategy(RUNTIME_KIND, DEFAULT_RUNTIME_ID)?.detect(env) ?? {
+      available: false,
+      reason: "not registered",
+    };
+    return {
+      kind: RUNTIME_KIND,
+      selected: DEFAULT_RUNTIME_ID,
+      implicit: true,
+      available: d.available,
+      reason: d.reason,
+      problem: false,
+      warnings: [],
+    };
+  },
+};
+
+/**
+ * One row per registered kind (secrets, then tls, then any other kind in
+ * registration order). Never spawns, never throws.
+ */
+export function doctorRows(env: NodeJS.ProcessEnv = process.env): DoctorRow[] {
+  const kinds = strategyKinds();
+  const ordered = [
+    ...Object.keys(SELECTORS).filter((k) => kinds.includes(k)),
+    ...kinds.filter((k) => !(k in SELECTORS)),
+  ];
+  return ordered.map(
+    (kind) =>
+      SELECTORS[kind]?.(env) ?? {
+        kind,
+        selected: "",
+        implicit: false,
+        available: false,
+        reason: "no selector for this kind",
+        problem: false,
+        warnings: [],
+      },
+  );
+}
+
+export function formatDoctor(rows: DoctorRow[], title: string): string[] {
+  const lines = [chalk.bold(`${title} doctor: strategies`), ""];
+  const width = Math.max(...rows.map((r) => r.kind.length));
+  for (const r of rows) {
+    const sel = r.selected
+      ? `${r.selected}${r.implicit ? " (implicit)" : ""}`
+      : "(invalid config)";
+    const state = r.available
+      ? chalk.green("✓ available")
+      : (r.problem ? chalk.red : chalk.yellow)("✗ unavailable");
+    lines.push(
+      `  ${r.kind.padEnd(width)}  ${sel.padEnd(20)} ${state}${r.reason ? `: ${r.reason}` : ""}`,
+    );
+    for (const w of r.warnings) lines.push(chalk.yellow(`    ⚠ ${w}`));
+  }
+  return lines;
+}
+
+/**
+ * Whether agents are configured here: an `agents:` block with anything in
+ * it (max_concurrent, persona_packs, an agent id), or an agent record.
+ */
+export function agentsConfigured(
+  config: DenConfig | null,
+  stateDir: string,
+): boolean {
+  const raw = config?.agents as unknown;
+  if (raw && typeof raw === "object" && Object.keys(raw).length) return true;
+  try {
+    return listRecords(stateDir).length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/** Informational lines after the rows: never a failure. */
+export function doctorNotes(cli: string, configured: boolean): string[] {
+  return configured
+    ? [
+        "",
+        `  ℹ agents are configured or have run here: run \`${cli} doctor --probe\` to verify agent env isolation`,
+      ]
+    : [];
+}
+
+function readConfigOrNull(): DenConfig | null {
+  try {
+    return readDenConfig();
+  } catch {
+    return null;
+  }
+}
+
+export async function cmdDoctor(args: string[]): Promise<number> {
+  const probe = args.includes("--probe");
+  const unknown = args.filter((a) => a !== "--probe");
+  if (unknown.length) {
+    console.error(
+      `✗ doctor: unknown argument ${unknown[0]} (doctor [--probe])`,
+    );
+    return 2;
+  }
+  const rows = doctorRows();
+  for (const l of formatDoctor(rows, readBrand().name)) console.log(l);
+  const cli = product().cli;
+  if (!probe) {
+    for (const l of doctorNotes(
+      cli,
+      agentsConfigured(readConfigOrNull(), getStateDir()),
+    ))
+      console.log(l);
+    return rows.some((r) => r.problem) ? 1 : 0;
+  }
+  const { runEnvProbe, formatProbe } = await import("./env-probe.js");
+  const { resolveDeps, plainSessionEnv } =
+    await import("./sessions-command.js");
+  const d = resolveDeps({});
+  const results = await runEnvProbe({
+    dist: d.dist,
+    cli: d.cli,
+    env: d.env,
+    pty: d.pty,
+    connect: d.connect,
+    plainEnv: (caller) => plainSessionEnv(caller),
+  });
+  console.log("");
+  console.log(chalk.bold(`${readBrand().name} doctor: session env probe`));
+  console.log("");
+  for (const l of formatProbe(results)) console.log(l);
+  const found = results.some((r) => r.findings.length);
+  return rows.some((r) => r.problem) || found ? 1 : 0;
+}

package/src/ui/cli/edge-command.ts

@@ -1,7 +1,11 @@
 /**
- * `edge up | down | status | trust | untrust | routes`
+ * `edge up [--take-over] | down | status | trust | untrust | routes`
  *
- * This org's HTTPS edge: own CA + cert, routes at `<name>.<edge.domain>`.
+ * This org's edge: routes at `<name>.<edge.domain>`, TLS as `edge.tls` says
+ * (none, mkcert or files). `trust` / `untrust` exist only under mkcert.
+ * `routes` lists Den's own routes, then the routers in the included
+ * dynamic files, each with its source file, then the stacks' routers
+ * (`stack-*.yml`, 0.3.0-dev.32), each marked "stack" with its file.
  */
 import chalk from "chalk";
 import { readBrand } from "../../shared/brand.js";
@@ -15,18 +19,37 @@ import {
   trustCa,
   untrustCa,
 } from "../../shared/edge/runtime.js";
-import { edgeStatus } from "../../shared/edge/status.js";
+import {
+  includedRouters,
+  stackRouters,
+  routerUrls,
+  type IncludedRouter,
+} from "../../shared/edge/included.js";
+import { edgeRoutes, edgeStatus } from "../../shared/edge/status.js";
+import { tlsYaml } from "../../shared/edge/tls.js";
+import { rejoinRunningStacks } from "../../shared/stacks/status.js";
+
+/** An included router's URLs (the hosts its rule names), else its name. */
+function includedUrl(r: IncludedRouter): string {
+  return r.hosts.length ? routerUrls(r).join(", ") : r.name;
+}
 
 export async function cmdEdge(args: string[]): Promise<void> {
   const sub = args[0] ?? "status";
   const cfg = readEdgeConfig();
   const n = edgeNames(cfg.org);
   const published = cfg.ports
-    ? `host :${cfg.ports.http} / :${cfg.ports.https}`
+    ? cfg.tls.strategy === "none"
+      ? `host :${cfg.ports.http} (http only)`
+      : `host :${cfg.ports.http} / :${cfg.ports.https}`
     : `not published (reach it on Docker network ${n.network})`;
   switch (sub) {
     case "up": {
-      const { certs } = await edgeUp(cfg);
+      // --take-over: the only way to replace an edge another state dir
+      // owns (0.3.0-dev.40); never implied.
+      const { certs } = await edgeUp(cfg, {
+        takeOver: args.includes("--take-over"),
+      });
       console.log(
         chalk.green(
           `✓ ${n.container} up — ${edgeDomains(cfg)
@@ -37,7 +60,7 @@ export async function cmdEdge(args: string[]): Promise<void> {
       console.log(`  ports  ${published}`);
       if (certs.issued)
         console.log(`  cert   issued for ${certs.names.join(", ")}`);
-      if (caTrusted(cfg) === false)
+      if (cfg.tls.strategy === "mkcert" && caTrusted(cfg) === false)
         console.log(
           chalk.yellow(
             "  CA not trusted yet — run `edge trust` (asks for your password once)",
@@ -45,6 +68,8 @@ export async function cmdEdge(args: string[]): Promise<void> {
         );
       for (const name of ["edge", ...Object.keys(cfg.routes)])
         console.log(`  ${routeUrl(name, cfg)}`);
+      // Running stacks' routes stay up: the edge rejoins their networks.
+      rejoinRunningStacks();
       return;
     }
     case "down":
@@ -57,10 +82,25 @@ export async function cmdEdge(args: string[]): Promise<void> {
     case "untrust":
       process.exitCode = untrustCa(cfg);
       return;
-    case "routes":
-      for (const r of edgeStatus(cfg).routes)
+    case "routes": {
+      for (const r of edgeRoutes(cfg))
         console.log(`${r.url.padEnd(52)} → ${r.upstream}`);
+      // Routers in the included dynamic files: Traefik serves them too.
+      const inc = includedRouters(cfg);
+      for (const r of inc.routers)
+        console.log(
+          `${includedUrl(r).padEnd(52)} → ${r.upstream || "?"}  (${r.file})`,
+        );
+      // Routers the stacks wrote (stack up): neither Den's nor included.
+      const stk = stackRouters(cfg);
+      for (const r of stk.routers)
+        console.log(
+          `${includedUrl(r).padEnd(52)} → ${r.upstream || "?"}  (stack: ${r.file})`,
+        );
+      for (const e of [...inc.errors, ...stk.errors])
+        console.log(chalk.yellow(`${e.file}: not read (${e.error})`));
       return;
+    }
     case "status": {
       const st = edgeStatus(cfg);
       console.log(chalk.bold(`${readBrand().name} edge — ${st.org}`));
@@ -68,14 +108,20 @@ export async function cmdEdge(args: string[]): Promise<void> {
       console.log(`  ports      ${published}`);
       console.log(`  domains    ${st.domains.join(", ")} (+ every subdomain)`);
       console.log(
-        `  CA         ${caDir(cfg)} — ${st.caTrusted === null ? "unknown" : st.caTrusted ? "trusted" : "NOT trusted"}`,
+        `  tls        ${tlsYaml(cfg.tls).replace(/^tls: /, "")}${cfg.tlsFrom === "implicit" ? " (implicit: edge.tls is not set)" : ""}`,
       );
+      if (cfg.tls.strategy !== "none")
+        console.log(
+          // Fronted (edge.publish: false): the proxy in front owns
+          // browser trust (BOOT-1), so this machine's trust is moot.
+          `  CA         ${caDir(cfg)} — ${!st.ports ? "not needed: fronted" : st.caTrusted === null ? "unknown" : st.caTrusted ? "trusted" : "NOT trusted"}`,
+        );
       if (st.certIssued) console.log(`  cert       ${st.certNames.join(", ")}`);
       return;
     }
     default:
       throw new Error(
-        `Unknown edge command "${sub}". Use: up | down | status | trust | untrust | routes`,
+        `Unknown edge command "${sub}". Use: up [--take-over] | down | status | trust | untrust | routes`,
       );
   }
 }