@monster-orange/den 0.4.0 → 0.4.2

package/src/shared/den-config.ts

@@ -244,10 +244,16 @@ export interface DenConfig {
    */
   mcp?: McpConfig;
   /**
-   * Agents: `max_concurrent` caps the sessions running at once in this
-   * distribution (default 4). See readAgentsConfig.
+   * Agents: `max_concurrent` caps the agents running at once in this
+   * distribution (default 4); plain sessions never count. See
+   * readAgentsConfig.
    */
   agents?: AgentsConfig;
+  /**
+   * Plain sessions (`<cli> sessions start`): `max_concurrent` caps those
+   * running at once (default 8); agents never count. See readSessionsConfig.
+   */
+  sessions?: SessionsConfig;
   /**
    * The web UI: `port` (read by edge/config.ts readWebPort) and `service`,
    * the launchd service `<cli> service` installs. See readWebServiceConfig.
@@ -558,6 +564,7 @@ export function readDenConfig(): DenConfig {
       security: parsed?.security,
       mcp: parsed?.mcp,
       agents: parsed?.agents,
+      sessions: parsed?.sessions,
       web: parsed?.web,
       test_accounts: parsed?.test_accounts,
       defaults: parsed?.defaults,
@@ -739,7 +746,7 @@ export function readMcpConfig(
 
 /** `agents:` in the org config. */
 export interface AgentsConfig {
-  /** Sessions that may run at once (default 4). */
+  /** Agents that may run at once (default 4); plain sessions never count. */
   max_concurrent?: number;
   /**
    * Persona packs (AG-2a): directories of persona files, relative to the
@@ -845,6 +852,48 @@ export function readAgentsConfig(
   return out;
 }
 
+/** `sessions:` in the org config: plain sessions (`<cli> sessions start`). */
+export interface SessionsConfig {
+  /** Plain sessions that may run at once (default 8); agents never count. */
+  max_concurrent?: number;
+}
+
+export const DEFAULT_SESSIONS_MAX_CONCURRENT = 8;
+
+/** `sessions:` with its defaults applied. */
+export interface ResolvedSessionsConfig {
+  maxConcurrent: number;
+}
+
+/**
+ * The effective sessions config. Anything malformed throws, naming the key,
+ * as readAgentsConfig does: a typo must not lift the cap.
+ */
+export function readSessionsConfig(
+  config: DenConfig = readDenConfig(),
+): ResolvedSessionsConfig {
+  const raw = (config.sessions ?? {}) as unknown;
+  if (!isMapping(raw))
+    throw new Error(`sessions: must be a mapping (got ${JSON.stringify(raw)})`);
+  for (const k of Object.keys(raw))
+    if (k !== "max_concurrent")
+      throw new Error(
+        `sessions.${k}: unknown key (sessions: takes max_concurrent)`,
+      );
+  const out: ResolvedSessionsConfig = {
+    maxConcurrent: DEFAULT_SESSIONS_MAX_CONCURRENT,
+  };
+  const max = raw.max_concurrent;
+  if (max !== undefined) {
+    if (typeof max !== "number" || !Number.isInteger(max) || max < 1)
+      throw new Error(
+        `sessions.max_concurrent: must be a whole number of at least 1 (got ${JSON.stringify(max)})`,
+      );
+    out.maxConcurrent = max;
+  }
+  return out;
+}
+
 // ── Web UI service (`<cli> service`) ──────────────────────────────────────────
 
 /** `web:` in the org config. */

package/src/shared/environment-manager/scope.ts

@@ -82,6 +82,28 @@ export function scopeView(scope?: ViewScope): ScopeView {
   };
 }
 
+/**
+ * WS-6.4: what health covers, whatever is in view: every active workspace,
+ * focused first. Scope only filters what is displayed (inViewMarker); it
+ * never narrows what is polled, so a workspace outside it still shows its
+ * real health on the Workspaces page.
+ */
+export function pollView(): ScopeView {
+  return scopeView(ALL_ACTIVE);
+}
+
+/**
+ * Whether a health row is in view: one of the workspaces that define it
+ * (`workspaces`, its owners) is in `view`. A row without owners counts as
+ * in view.
+ */
+export function inViewMarker(
+  view: ScopeView,
+): (owners: readonly string[] | undefined) => boolean {
+  const names = new Set(view.workspaces.map((w) => w.name));
+  return (owners) => !owners?.length || owners.some((o) => names.has(o));
+}
+
 /** A cache key for what is in view (the scope's workspaces, in order). */
 export function scopeKey(view: ScopeView): string {
   return view.workspaces.map((w) => w.name).join(",");

package/src/shared/environment-manager/service-runner.ts

@@ -400,6 +400,70 @@ export function findDaemonByAddress(address: string): DaemonRecord | undefined {
   return _daemonRegistry.get(address);
 }
 
+/**
+ * The other spelling of a single-service repo's daemon: "<repo>" and
+ * "<repo>/<svc>" name the same process (0.4.1-dev.5, a consumer's dev.4
+ * finding: `up <repo>` recorded "<repo>", `restart <repo>/<svc>` found no
+ * record, adopted the running process instead of restarting it, and left
+ * two records on one process group). Null for a repo with several
+ * services: each of its services is its own daemon.
+ */
+function singleServiceAlias(
+  resolved: Pick<ResolvedService, "address" | "repoName" | "subsystem"> & {
+    repoPath: string;
+  },
+): string | null {
+  const keys = Object.keys(readManifest(resolved.repoPath)?.services ?? {});
+  if (keys.length !== 1 || keys[0] !== resolved.subsystem) return null;
+  const full = `${resolved.repoName}/${resolved.subsystem}`;
+  if (resolved.address === resolved.repoName) return full;
+  if (resolved.address === full) return resolved.repoName;
+  return null;
+}
+
+/**
+ * Bring a single-service repo's record to the address this command uses,
+ * so every lookup by `resolved.address` finds it whichever spelling wrote
+ * it. A record only under the other spelling moves; a duplicate (two
+ * records on one process group, the dev.4 bug's leftover, or one of them
+ * dead or without a group) is merged into one, owners and containers
+ * unioned. Two records on two different live groups are left alone.
+ */
+export function reconcileDaemonAddress(resolved: ResolvedService): void {
+  const alias = singleServiceAlias(resolved);
+  if (!alias) return;
+  loadDaemonsFromFile();
+  const other = _daemonRegistry.get(alias);
+  if (!other || other.repoPath !== resolved.repoPath) return;
+  const own = _daemonRegistry.get(resolved.address);
+  if (own) {
+    const sameGroup =
+      own.pgid === undefined ||
+      other.pgid === undefined ||
+      own.pgid === other.pgid ||
+      isDaemonVerifiablyDead(other);
+    if (!sameGroup) return;
+  }
+  // The record carrying a process group is the one `down` can stop.
+  const keep =
+    own && (own.pgid !== undefined || other.pgid === undefined) ? own : other;
+  const drop = keep === own ? other : own;
+  const merged: DaemonRecord = {
+    ...keep,
+    address: resolved.address,
+    workspaces: [
+      ...new Set([...(keep.workspaces ?? []), ...(drop?.workspaces ?? [])]),
+    ],
+  };
+  const containers = [
+    ...new Set([...(keep.containers ?? []), ...(drop?.containers ?? [])]),
+  ];
+  if (containers.length > 0) merged.containers = containers;
+  _daemonRegistry.delete(alias);
+  _daemonRegistry.set(resolved.address, merged);
+  saveDaemonsFile(getDaemonsFile());
+}
+
 /** Add a workspace owner to a running daemon (share / attach). */
 export function attachDaemonOwner(address: string, workspace: string): void {
   loadDaemonsFromFile();
@@ -1344,6 +1408,12 @@ export interface RunCommandOptions {
   explicit?: boolean;
   /** For `down`: what it found to stop (see DownOutcome). */
   onDownOutcome?: (outcome: DownOutcome) => void;
+  /**
+   * Internal: this `up` is a restart's up step ("up"), or the up step of
+   * the restart a restart ran after adopting a process ("after-adopt").
+   * A restart never ends on an adoption: what it adopts it restarts.
+   */
+  restartStep?: "up" | "after-adopt";
 }
 
 /**
@@ -1506,6 +1576,7 @@ function settleDaemonRecord(
   record: DaemonRecord | undefined;
   outcome: "adopted" | "dropped" | "busy" | null;
 } {
+  reconcileDaemonAddress(resolved);
   const record = findDaemonByAddress(resolved.address);
   if (!record || !isLegacyRecord(record)) return { record, outcome: null };
   const outcome = settleLegacyRecord(record, resolved, workspace, onLine);
@@ -1674,7 +1745,12 @@ function restartAsDownThenUp(
         options.onClose(code);
         return;
       }
-      const up = runServiceCommand({ ...options, command: "up" });
+      const up = runServiceCommand({
+        ...options,
+        command: "up",
+        restartStep:
+          options.restartStep === "after-adopt" ? "after-adopt" : "up",
+      });
       tail = up.proc;
       if (stopTail) {
         try {
@@ -2052,6 +2128,9 @@ export function runServiceCommand(
   }
 
   const { repoPath, subsystem } = resolved;
+  // A single-service repo's record answers to "<repo>" and "<repo>/<svc>":
+  // every decision below reads it under this command's spelling.
+  reconcileDaemonAddress(resolved);
 
   const explicit = options.explicit ?? true;
   const reportDown = (outcome: DownOutcome): void =>
@@ -2217,6 +2296,16 @@ export function runServiceCommand(
           `${resolved.address} not started`,
         );
         if (holder === "adopted") {
+          // A restart's up step (its down found nothing recorded): the
+          // adopted process is the old instance, so it is restarted now,
+          // never left running as if restarted (0.4.1-dev.5).
+          if (options.restartStep === "up") {
+            onLine(`restarting the adopted process for ${resolved.address}`);
+            return restartAsDownThenUp(
+              { ...options, restartStep: "after-adopt" },
+              getServiceLogPath(resolved.repoName, resolved.subsystem),
+            );
+          }
           closeAsync(0);
           return dummy();
         }
@@ -2355,7 +2444,10 @@ export function runServiceCommand(
     resolved.repoName,
     workspace,
   );
-  let cmdDef = svcCommands[command];
+  // Own properties only (SEC-1 §6b.2): `constructor` is no command.
+  let cmdDef = Object.prototype.hasOwnProperty.call(svcCommands, command)
+    ? svcCommands[command]
+    : undefined;
   const requestedCmdDef = cmdDef;
 
   // `restart` fallback: synthesise `make down && make up` when no explicit

package/src/shared/profile.ts

@@ -70,8 +70,16 @@ const expandHome = (p: string): string =>
       ? path.join(os.homedir(), p.slice(2))
       : p;
 
-/** A profile from a `product:` block; unset fields derive from the name. */
-export function profileFrom(raw: RawProduct = {}): ProductProfile {
+/**
+ * A profile from a `product:` block; unset fields derive from the name. A
+ * relative `state_dir` resolves against `baseDir`: the directory holding
+ * den.yml (the distribution root), never the cwd, so an agent's CLI or MCP
+ * server started elsewhere reads the same state.
+ */
+export function profileFrom(
+  raw: RawProduct = {},
+  baseDir: string = process.cwd(),
+): ProductProfile {
   const name = str(raw.name) ?? "den";
   if (!SLUG.test(name))
     throw new Error(
@@ -91,7 +99,10 @@ export function profileFrom(raw: RawProduct = {}): ProductProfile {
     envPrefix,
     configFile: str(raw.config) ?? `config/${name}.yml`,
     manifestFiles: json === manifest ? [manifest] : [manifest, json],
-    stateDir: path.resolve(expandHome(str(raw.state_dir) ?? `~/.${name}`)),
+    stateDir: path.resolve(
+      baseDir,
+      expandHome(str(raw.state_dir) ?? `~/.${name}`),
+    ),
     servicesDir: str(raw.services_dir) ?? `.${name}-services`,
     workspacesDir: str(raw.workspaces_dir) ?? `${name}-workspaces`,
   };
@@ -106,7 +117,7 @@ export function readProfileFile(file: string): ProductProfile {
     if ((e as NodeJS.ErrnoException).code === "ENOENT") return profileFrom();
     throw new Error(`${file}: ${(e as Error).message}`);
   }
-  return profileFrom(raw?.product ?? {});
+  return profileFrom(raw?.product ?? {}, path.dirname(path.resolve(file)));
 }
 
 let cached: { key: string; profile: ProductProfile } | null = null;

package/src/shared/sessions/client.ts

@@ -16,6 +16,7 @@ import type {
   AttachHandlers,
   Attachment,
   SessionInfo,
+  SessionPool,
   SessionSignal,
   SessionSpec,
 } from "./types.js";
@@ -125,18 +126,31 @@ export class HostClient extends EventEmitter {
     spec: SessionSpec,
     opts: {
       limit?: number;
+      /**
+       * Which running sessions `limit` counts: agents (agents.max_concurrent)
+       * or plain ones (sessions.max_concurrent). Without it, all of them.
+       */
+      pool?: SessionPool;
       /** `--keep-env` names, for the host's audit line (never values). */
       keptEnv?: { name: string; credentialShaped: boolean }[];
       /** Who asked, for that line. */
       actor?: string;
+      /**
+       * `--keep-env` names Den refuses to forward (SEC-1 §5: a person's
+       * credential): the host records the refusal and starts nothing.
+       */
+      refusedEnv?: string[];
     } = {},
   ): Promise<SessionInfo> {
     const r = await this.request("start", {
       spec,
       ...(opts.limit !== undefined ? { limit: opts.limit } : {}),
-      ...(opts.keptEnv?.length
-        ? { keptEnv: opts.keptEnv, actor: opts.actor ?? "unknown" }
+      ...(opts.pool !== undefined ? { pool: opts.pool } : {}),
+      ...(opts.keptEnv?.length || opts.refusedEnv?.length
+        ? { actor: opts.actor ?? "unknown" }
         : {}),
+      ...(opts.keptEnv?.length ? { keptEnv: opts.keptEnv } : {}),
+      ...(opts.refusedEnv?.length ? { refusedEnv: opts.refusedEnv } : {}),
     });
     return r.info as SessionInfo;
   }

package/src/shared/sessions/den-pty.ts

@@ -21,6 +21,7 @@ import type {
   Attachment,
   SessionBackend,
   SessionInfo,
+  SessionPool,
   SessionRef,
   SessionSignal,
   SessionSpec,
@@ -32,8 +33,10 @@ export { BACKEND_ID as DEN_PTY_ID };
 export interface DenPtyOptions {
   /** A client of the running host (ensureHost). */
   client: HostClient;
-  /** Applied to every start: agents.max_concurrent. */
+  /** Applied to every start, counting `pool`'s running sessions. */
   limit?: number;
+  /** agents (agents.max_concurrent) or sessions (sessions.max_concurrent). */
+  pool?: SessionPool;
 }
 
 export class DenPtyBackend implements SessionBackend {
@@ -49,7 +52,12 @@ export class DenPtyBackend implements SessionBackend {
   }
 
   async start(spec: SessionSpec): Promise<SessionRef> {
-    return (await this.opts.client.start(spec, { limit: this.opts.limit })).ref;
+    return (
+      await this.opts.client.start(spec, {
+        limit: this.opts.limit,
+        ...(this.opts.pool ? { pool: this.opts.pool } : {}),
+      })
+    ).ref;
   }
   list(): Promise<SessionInfo[]> {
     return this.opts.client.list();

package/src/shared/sessions/env.ts

@@ -10,14 +10,21 @@
  *   4. `launch`: the runtime's launch env (LaunchOutput.env)
  *   5. `extra`: the persona's or runtime's declared env (none can declare
  *      one yet)
- *   6. `den`: Den's own markers (DEN_AGENT for an agent)
+ *   6. `den`: Den's own markers (DEN_AGENT, and SEC-1c's DEN_ACTOR_TOKEN
+ *      for an agent: the only way an actor token reaches a session; one
+ *      from anywhere above is dropped first)
  *   7. then `scrub` removes every name it matches, whatever put it back:
  *      each runtime's scrubEnv (den-claude: CLAUDECODE, CLAUDE_CODE_*).
+ *   8. and always (SEC-1 §5): a person's credential, DEN_PERSON_TOKEN or
+ *      any value that is a person token or names web.secret
+ *      (actor-token.ts isPersonCredentialEnv), whatever put it there.
  *
  * The session backend knows none of this: it is handed the result. Nothing
  * here logs or returns a value other than the env itself.
  */
 
+import { ACTOR_TOKEN_ENV, isPersonCredentialEnv } from "../actor-token.js";
+
 export const DEFAULT_TERM = "xterm-256color";
 
 /** Set in an agent's env: `agent:<id>`, so Den's CLI run inside knows. */
@@ -72,8 +79,11 @@ export function buildSessionEnv(i: SessionEnvInput): Record<string, string> {
   for (const [k, v] of Object.entries(i.caller))
     if (v !== undefined && (inSessionBase(k) || named.has(k))) env[k] = v;
   if (!env.TERM) env.TERM = DEFAULT_TERM;
-  Object.assign(env, i.launch ?? {}, i.extra ?? {}, i.den ?? {});
+  Object.assign(env, i.launch ?? {}, i.extra ?? {});
+  delete env[ACTOR_TOKEN_ENV];
+  Object.assign(env, i.den ?? {});
   const scrub = i.scrub ?? [];
-  for (const k of Object.keys(env)) if (matchesScrub(k, scrub)) delete env[k];
+  for (const [k, v] of Object.entries(env))
+    if (matchesScrub(k, scrub) || isPersonCredentialEnv(k, v)) delete env[k];
   return env;
 }

package/src/shared/sessions/host.ts

@@ -29,7 +29,12 @@ import {
   type Request,
 } from "./protocol.js";
 import type { PtyLoad, PtyProcess } from "./pty.js";
-import { SESSION_SIGNALS, type SessionInfo } from "./types.js";
+import {
+  SESSION_POOLS,
+  SESSION_SIGNALS,
+  type SessionInfo,
+  type SessionPool,
+} from "./types.js";
 
 export const BACKEND_ID = "den-pty";
 
@@ -58,6 +63,8 @@ interface Session {
   log: ScrollbackLog;
   /** aid → its connection. */
   attachments: Map<string, Conn>;
+  /** The cap it counts against (start's `pool`), when one was named. */
+  pool?: SessionPool;
 }
 
 class Conn {
@@ -82,6 +89,17 @@ class Refusal extends Error {
 const isInt = (n: unknown, min: number, max: number): n is number =>
   typeof n === "number" && Number.isInteger(n) && n >= min && n <= max;
 
+/**
+ * The cap refusal: "2 agents are running and agents.max_concurrent is 2".
+ * With no pool (an older client's limit) every session counts, and the key
+ * is agents.max_concurrent, as it was.
+ */
+function capMessage(live: number, limit: number, pool?: unknown): string {
+  const noun = pool === "agents" ? "agent" : "session";
+  const key = pool === "sessions" ? "sessions" : "agents";
+  return `${live} ${noun}${live === 1 ? " is" : "s are"} running and ${key}.max_concurrent is ${limit}`;
+}
+
 function pidAlive(pid: number): boolean {
   try {
     process.kill(pid, 0);
@@ -126,6 +144,17 @@ function keptEnvAudit(v: unknown): string {
     .join(", ");
 }
 
+/** A start's refused `--keep-env` names, printable: "A, B", or "". */
+function refusedEnvAudit(v: unknown): string {
+  if (!Array.isArray(v)) return "";
+  return v
+    .filter(
+      (k): k is string =>
+        typeof k === "string" && /^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(k),
+    )
+    .join(", ");
+}
+
 function printableActor(v: unknown): string {
   return (
     String(v ?? "unknown")
@@ -477,6 +506,18 @@ export class SessionHost {
     const { name, cwd, argv, env } = spec;
     if (typeof name !== "string" || !name)
       throw new Refusal("bad-request", "start needs a name");
+    // SEC-1 §5: a --keep-env the caller refused (a person's credential) is
+    // audited here, names only, and nothing starts.
+    const refusedEnv = refusedEnvAudit(req.refusedEnv);
+    if (refusedEnv || Array.isArray(req.refusedEnv)) {
+      this.log(
+        `session ${printableActor(name)} refused: --keep-env ${refusedEnv || "?"} (a person's credential is never forwarded) · by ${printableActor(req.actor)}`,
+      );
+      throw new Refusal(
+        "bad-request",
+        `--keep-env ${refusedEnv || "?"}: a person's credential is never forwarded to a session`,
+      );
+    }
     if (
       !Array.isArray(argv) ||
       !argv.length ||
@@ -505,20 +546,26 @@ export class SessionHost {
     );
     if (same.some((s) => !s.info.exited))
       throw new Refusal("exists", `${name} is already running`);
-    const live = [...this.sessions.values()].filter(
-      (s) => !s.info.exited,
-    ).length;
+    // A cap counts its own pool's running sessions: agents.max_concurrent
+    // the agents, sessions.max_concurrent the plain ones. A limit with no
+    // pool (an older client) counts every running session, as before.
+    const pool = req.pool;
+    if (pool !== undefined && !SESSION_POOLS.includes(pool as SessionPool))
+      throw new Refusal(
+        "bad-request",
+        `pool must be ${SESSION_POOLS.join(" or ")}`,
+      );
     if (req.limit !== undefined) {
       if (!isInt(req.limit, 1, 100_000))
         throw new Refusal(
           "bad-request",
           "limit must be a whole number of at least 1",
         );
+      const live = [...this.sessions.values()].filter(
+        (s) => !s.info.exited && (pool === undefined || s.pool === pool),
+      ).length;
       if (live >= req.limit)
-        throw new Refusal(
-          "cap",
-          `${live} session${live === 1 ? " is" : "s are"} running and agents.max_concurrent is ${req.limit}`,
-        );
+        throw new Refusal("cap", capMessage(live, req.limit, pool));
     }
     const load = this.opts.pty();
     if (!load.available) throw new Refusal("unavailable", load.reason);
@@ -559,6 +606,7 @@ export class SessionHost {
         },
       ),
       attachments: new Map(),
+      ...(pool !== undefined ? { pool: pool as SessionPool } : {}),
     };
     this.sessions.set(id, s);
     this.persist(s);

package/src/shared/sessions/types.ts

@@ -32,6 +32,14 @@ export interface SessionInfo {
   prompted?: boolean;
 }
 
+/**
+ * The cap a start counts against: `agents` (agents.max_concurrent) or
+ * `sessions` (sessions.max_concurrent, the plain ones), each counting only
+ * its own running sessions.
+ */
+export const SESSION_POOLS = ["agents", "sessions"] as const;
+export type SessionPool = (typeof SESSION_POOLS)[number];
+
 /** What to run. `env` is the whole environment: nothing is inherited. */
 export interface SessionSpec {
   name: string;