@monster-orange/den 0.4.0 → 0.4.1

package/src/ui/cli/flag-parser.ts

@@ -170,6 +170,27 @@ function validateFlagScopes(parsed: ParsedCliArgs): void {
   }
 }
 
+/**
+ * Subcommands that print their own `--help`: the dispatcher's
+ * `<command> --help` must not answer for them (`web sessions --help` printed
+ * the general web help). web-command.ts's WEB_SUBCOMMANDS_WITH_HELP and
+ * mcp-connect.ts's MCP_CONNECT_SUBCOMMANDS are the same lists (a test
+ * checks).
+ */
+export const SUBCOMMAND_OWN_HELP: Readonly<Record<string, readonly string[]>> =
+  {
+    web: ["token", "login", "sessions", "logout"],
+    mcp: ["connect", "disconnect", "clients", "config"],
+  };
+
+/** Whether `<command> <sub> --help` is the subcommand's own to answer. */
+export function ownsSubcommandHelp(
+  command: string,
+  sub: string | undefined,
+): boolean {
+  return !!sub && (SUBCOMMAND_OWN_HELP[command] ?? []).includes(sub);
+}
+
 // Dash-flags each mutation subcommand accepts (global flags — -w/--workspace,
 // -t/--tabs/--no-tabs, --skip-secrets — are consumed by parseCliArgs before
 // dispatch, and -h/--help is handled by the dispatcher). Commands not listed

package/src/ui/cli/index.ts

@@ -215,10 +215,12 @@ import {
 import { githubOrgFor } from "../../shared/environment-manager/workspace-org.js";
 import { cmdWeb, displayWebHelp } from "./web-command.js";
 import { cmdGraph } from "./graph-command.js";
+import { resolveTargetWorkspace } from "./target-workspace.js";
 import { resolveLogsTarget, tailServiceLogs } from "./logs-command.js";
 import {
   parseCliArgs,
   takeWorkspaceFlags,
+  ownsSubcommandHelp,
   unknownCommandFlags,
   workspaceFlagRequiresActive,
   type ParsedCliArgs,
@@ -311,19 +313,20 @@ const WORKSPACE_SUBCOMMANDS: {
 
 const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
   down: {
-    usage: "down [repo] [flags]",
+    usage: "down [repo] [-w <workspace>] [flags]",
     lines: [
       "Stop the cwd (or named) repo; --with-deps also stops what it sits on (its",
       "derived closure, in reverse order), naming anything else that uses it.",
       "-a/--all stops EVERY workspace system (reverse derived order, cwd-agnostic;",
       "every down script runs — no already-stopped skip).",
-      "Flags: -a/--all · -A/--app <app> · --with-deps · -n/--dry-run (print order, stop nothing) · --manifest (legacy depends_on)",
+      "Flags: -w/--workspace <ws> (that active workspace, not the focused one; focus stays) · -a/--all · -A/--app <app> · --with-deps · -n/--dry-run (print order, stop nothing) · --manifest (legacy depends_on)",
     ],
   },
   restart: {
-    usage: "restart [service...] [-A <app>] [-n|--dry-run]",
+    usage: "restart [service...] [-w <workspace>] [-A <app>] [-n|--dry-run]",
     lines: [
       `Restart the given services, or every repo in an application (\`${product().cli} apps\`).`,
+      "-w/--workspace <ws> acts in that active workspace instead of the focused one; focus stays.",
     ],
   },
   status: {
@@ -368,7 +371,7 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
   },
   setup: {
     usage:
-      "setup [service...] [--force|-f] [--plan [-w <workspace>]... [--all-active]]",
+      "setup [service...] [-w <workspace>] [--force|-f] [--plan [-w <workspace>]... [--all-active]]",
     lines: [
       "Run 'make setup' once per system (clones missing managed repos first).",
       "Default targets MANAGED clones only — setup's codegen/installs",
@@ -378,6 +381,7 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
       "cloned, seeded or written (on a fresh machine: the blueprint's plan).",
       "It plans the focused workspace; -w <workspace> (repeatable) plans those,",
       "--all-active every active one. Repos only other workspaces hold are named.",
+      "Without --plan, -w <workspace> sets up that workspace's systems instead of the focused one's.",
     ],
   },
   org: {
@@ -794,10 +798,13 @@ class DenCLI {
 
     // `<command> -h/--help` → that command's help (every command supports it).
     // (`-h`/`--help` AS the command falls through to the switch → global help.)
+    // A subcommand that prints its own help (`web sessions --help`, `mcp
+    // connect --help`) is dispatched instead: its help wins.
     if (
       command &&
       !["-h", "--help", "-v", "--version"].includes(command) &&
-      (ownArgs.includes("-h") || ownArgs.includes("--help"))
+      (ownArgs.includes("-h") || ownArgs.includes("--help")) &&
+      !ownsSubcommandHelp(command, ownArgs[1])
     ) {
       this.printCommandHelp(command, ownArgs[1]);
       return;
@@ -2731,6 +2738,10 @@ class DenCLI {
       "--manifest",
       `use legacy ${product().manifestYml} depends_on instead of the derived graph`,
     );
+    row(
+      "-w, --workspace <ws>",
+      "act in that (active) workspace instead of the focused one; focus stays",
+    );
     row("--skip-secrets", "skip the secrets-backend sign-in preflight");
     row("-h, --help", "show this help");
     console.log();
@@ -2976,7 +2987,44 @@ class DenCLI {
     }
   }
 
+  /**
+   * With no `-w`: the workspace the named services are in, when it isn't
+   * the focus (target-workspace.ts), set as this run's workspace. False
+   * (exit 1, said why) when a name is in no active workspace, in several,
+   * or the names are in different ones.
+   */
+  private pickTargetWorkspace(command: string, args: string[]): boolean {
+    if (process.env.DEN_WORKSPACE_OVERRIDE) return true;
+    const terminator = args.indexOf("--");
+    const own = terminator === -1 ? args : args.slice(0, terminator);
+    let rest: string[];
+    try {
+      const taken = takeAppFlag(own);
+      if (taken.app) return true; // -A names an application, not services
+      rest = taken.rest;
+    } catch {
+      return true; // the command itself reports a bad -A
+    }
+    const names = rest.filter((a) => !a.startsWith("-"));
+    const r = resolveTargetWorkspace(names, product().cli, command);
+    if (!r.ok) {
+      console.error(chalk.red(`\n  ✗ ${r.error}\n`));
+      process.exitCode = 1;
+      return false;
+    }
+    if (r.workspace) {
+      process.env.DEN_WORKSPACE_OVERRIDE = r.workspace;
+      console.log(
+        chalk.gray(
+          `\n  ${names.join(", ")}: in workspace ${r.workspace} (not the focus)`,
+        ),
+      );
+    }
+    return true;
+  }
+
   private async cmdServiceUp(args: string[]): Promise<void> {
+    if (!this.pickTargetWorkspace("up", args)) return;
     // Tokens after a `--` terminator belong to a child command — they must
     // never be read as up's own flags (`den up -- -a` is NOT `up -a`).
     const terminator = args.indexOf("--");
@@ -3101,6 +3149,7 @@ class DenCLI {
   }
 
   private async cmdServiceDown(args: string[]): Promise<void> {
+    if (!this.pickTargetWorkspace("down", args)) return;
     // Tokens after a `--` terminator belong to a child command — they must
     // never be read as down's own flags (`den down -- -a` must NOT tear
     // down the whole workspace).
@@ -3171,6 +3220,7 @@ class DenCLI {
   }
 
   private async cmdServiceRestart(argv: string[]): Promise<void> {
+    if (!this.pickTargetWorkspace("restart", argv)) return;
     const { app, rest: args } = takeAppFlag(argv);
     const dryRun = args.includes("--dry-run") || args.includes("-n");
     if (!dryRun) preflightSecrets();
@@ -4068,15 +4118,33 @@ class DenCLI {
       console.log();
       return;
     }
-    if (planWs.length || allActive) {
+    if (planWs.length > 1 || allActive) {
       console.error(
         chalk.red(
-          `\n  -w and --all-active go with --plan: setup itself works on the focused workspace.\n`,
+          `\n  More than one -w, and --all-active, go with --plan: setup itself works on one workspace (-w <workspace>, or the one the named repos are in, else the focus).\n`,
         ),
       );
       process.exitCode = 1;
       return;
     }
+    if (planWs.length === 1) {
+      const ws = planWs[0];
+      if (!readWorkspacesFile().workspaces[ws]) {
+        console.error(chalk.red(`\n  Workspace "${ws}" does not exist\n`));
+        process.exitCode = 1;
+        return;
+      }
+      if (!isWorkspaceActive(ws)) {
+        console.error(
+          chalk.red(
+            `\n  Workspace "${ws}" is not active — run \`${product().cli} workspace activate ${ws}\` first\n`,
+          ),
+        );
+        process.exitCode = 1;
+        return;
+      }
+      process.env.DEN_WORKSPACE_OVERRIDE = ws;
+    } else if (!this.pickTargetWorkspace("setup", args)) return;
 
     // Clone any managed repos that aren't on disk yet before reading manifests.
     this.cloneMissingManagedRepos();
@@ -4091,11 +4159,27 @@ class DenCLI {
       return;
     }
 
+    // A name the listing doesn't spell the same way (an alias, a bare repo
+    // listed only by subsystem) is matched as resolveService resolves it.
+    const matches = (name: string, s: (typeof services)[number]): boolean => {
+      if (name === s.address || name === s.repoName) return true;
+      const r = resolveService(name);
+      return !!r && (r.address === s.address || r.repoName === s.address);
+    };
+    const unmatched = names.filter((n) => !services.some((s) => matches(n, s)));
+    if (unmatched.length > 0) {
+      const ws = getActiveWorkspace()?.name ?? "default";
+      console.error(
+        chalk.red(
+          `\n  ✗ Not in workspace ${ws}: ${unmatched.join(", ")}. Nothing was set up.\n`,
+        ),
+      );
+      process.exitCode = 1;
+      return;
+    }
     let targets =
       names.length > 0
-        ? services.filter(
-            (s) => names.includes(s.address) || names.includes(s.repoName),
-          )
+        ? services.filter((s) => names.some((n) => matches(n, s)))
         : services;
 
     // Workspace-wide default: MANAGED clones only. `make setup` runs

package/src/ui/cli/sessions-command.ts

@@ -31,6 +31,10 @@ import {
   noHost,
   type HostClient,
 } from "../../shared/sessions/client.js";
+import {
+  ACTOR_TOKEN_ENV,
+  isPersonCredentialEnv,
+} from "../../shared/actor-token.js";
 import { DEN_PTY_ID } from "../../shared/sessions/den-pty.js";
 import { AGENT_ACTOR_ENV, buildSessionEnv } from "../../shared/sessions/env.js";
 import { runSessionHost } from "../../shared/sessions/host.js";
@@ -63,6 +67,7 @@ export const SESSIONS_HELP = {
     "    run argv in a PTY as <dist>-<ws>:<n> (cwd: here); capped by agents.max_concurrent",
     "    env: PATH, HOME, USER, LOGNAME, SHELL, TERM, COLORTERM, LANG, LC_*, TZ,",
     "    TMPDIR only; --keep-env NAME (exact, repeatable; audited) adds one",
+    "    (never a person's credential: DEN_PERSON_TOKEN, a web.secret path)",
     "{cli} sessions list [-w <ws>] [--json]",
     "{cli} sessions attach <name|id>",
     "    raw terminal; ctrl-] detaches and leaves it running",
@@ -387,6 +392,33 @@ async function start(args: string[], d: Resolved): Promise<number> {
     );
     return 1;
   }
+  // SEC-1 §5: a person's credential (DEN_PERSON_TOKEN, a person token, a
+  // path to web.secret) or an actor token is never forwarded. Refused, and
+  // audited by the session host (names only).
+  const forbidden = keep.filter(
+    (k) => k === ACTOR_TOKEN_ENV || isPersonCredentialEnv(k, d.env[k]),
+  );
+  if (forbidden.length) {
+    d.err(
+      `✗ --keep-env ${forbidden.join(", ")}: a person's credential (or an actor token) is never forwarded to a session`,
+    );
+    await withClient(d, (c) =>
+      c.start(
+        {
+          name: sessionName(d.dist, ws, name),
+          cwd,
+          argv: p.rest!,
+          env: {},
+          cols: 80,
+          rows: 24,
+        },
+        { refusedEnv: forbidden, actor: `user ${cliUser(d.env)}` },
+      ),
+    ).catch((e: unknown) => {
+      if (!(e instanceof HostError)) throw e;
+    });
+    return 1;
+  }
   const env = plainSessionEnv(d.env, keep);
   // Names only, never values: what was left out, so it can be asked for.
   const dropped = Object.keys(d.env)

package/src/ui/cli/target-workspace.ts

@@ -0,0 +1,105 @@
+/**
+ * Which workspace a lifecycle command (`setup`, `up`, `down`, `restart`)
+ * names its services in, when no `-w` says.
+ *
+ * The focused workspace is the default target (WS-6.1). A name it doesn't
+ * hold resolves across the other active workspaces, as the web API does
+ * with `&workspace=` (resolveService(address, workspace)):
+ *
+ *  - in the focus: the focus (nothing changes);
+ *  - in exactly one other active workspace: that one;
+ *  - in several: an error that lists them (`-w <workspace>` picks one);
+ *  - nowhere: an error (exit 1, never a silent exit 0).
+ *
+ * Every name must land in one workspace; names in different workspaces are
+ * an error (run them one workspace at a time, with `-w`).
+ */
+import {
+  resolveService,
+  serviceAliasCandidates,
+} from "../../shared/environment-manager/service-runner.js";
+import {
+  getActiveWorkspaces,
+  getFocusedWorkspaceName,
+} from "../../shared/environment-manager/workspaces.js";
+
+export type TargetWorkspace =
+  | { ok: true; workspace: string | null }
+  | { ok: false; error: string };
+
+/** Whether `name` names a service (a repo, an address or an alias) in `ws`. */
+export function nameResolvesIn(name: string, ws: string): boolean {
+  return (
+    resolveService(name, ws) !== null ||
+    serviceAliasCandidates(name, ws).length > 0
+  );
+}
+
+/**
+ * The workspace `names` resolve in, given the focus and the active set:
+ * `workspace: null` when it is the focus (or there are no names). Pure
+ * apart from `resolves`.
+ */
+export function targetWorkspaceFor(
+  names: readonly string[],
+  o: {
+    cli: string;
+    command: string;
+    focus: string | null;
+    active: readonly string[];
+    resolves: (name: string, ws: string) => boolean;
+  },
+): TargetWorkspace {
+  if (names.length === 0) return { ok: true, workspace: null };
+  const others = o.active.filter((w) => w !== o.focus);
+  const where = new Map<string, string>();
+  for (const name of names) {
+    if (o.focus && o.resolves(name, o.focus)) {
+      where.set(name, o.focus);
+      continue;
+    }
+    const hits = others.filter((w) => o.resolves(name, w));
+    if (hits.length === 0) {
+      const looked = [o.focus, ...others].filter(Boolean).join(", ");
+      return {
+        ok: false,
+        error: `"${name}" is not a service in any active workspace (${looked || "none active"}).`,
+      };
+    }
+    if (hits.length > 1)
+      return {
+        ok: false,
+        error:
+          `"${name}" is in more than one active workspace: ` +
+          `${hits.map((w) => `${w} (${o.cli} ${o.command} ${name} -w ${w})`).join(", ")}. ` +
+          "Name one with -w.",
+      };
+    where.set(name, hits[0]);
+  }
+  const workspaces = [...new Set(where.values())];
+  if (workspaces.length > 1)
+    return {
+      ok: false,
+      error:
+        "These names are in different workspaces: " +
+        `${[...where].map(([n, w]) => `${n} (${w})`).join(", ")}. ` +
+        `Run ${o.cli} ${o.command} once per workspace, with -w.`,
+    };
+  const ws = workspaces[0];
+  return { ok: true, workspace: ws === o.focus ? null : ws };
+}
+
+/** targetWorkspaceFor over this distribution's workspaces. */
+export function resolveTargetWorkspace(
+  names: readonly string[],
+  cli: string,
+  command: string,
+): TargetWorkspace {
+  return targetWorkspaceFor(names, {
+    cli,
+    command,
+    focus: getFocusedWorkspaceName(),
+    active: getActiveWorkspaces(),
+    resolves: nameResolvesIn,
+  });
+}