@monster-orange/den 0.4.14 → 0.4.16

package/src/ui/server/index.ts

@@ -48,6 +48,7 @@ import { readCatalog } from "../../shared/environment-manager/catalog.js";
 import {
   getActiveWorkspace,
   getActiveWorkspaces,
+  createWorkspace,
   getFocusedWorkspaceName,
   getWorkspaceByName,
   isWorkspaceActive,
@@ -112,6 +113,7 @@ import {
 import {
   assertDenConfigValid,
   readDenConfig,
+  readMcpConfig,
   isProductionEnv,
   isLocalEnabled,
   readUserConfig,
@@ -183,6 +185,11 @@ import {
   AUDIT_FILE,
 } from "./audit.js";
 import { handleReadonlyRoutes } from "./readonly-routes.js";
+import {
+  defaultOnboardRouteDeps,
+  handleOnboardRoutes,
+  type OnboardRouteDeps,
+} from "./onboard-routes.js";
 import {
   auditActorOf,
   bindRefusal,
@@ -226,14 +233,18 @@ import {
   sessionCookieName,
   sessionIdPrefix,
   WebSessionStore,
+  withApproveKey,
   type WebAuthConfig,
 } from "../../shared/web-session.js";
 import { serveUiAsset } from "./ui-assets.js";
+import { PERSON_GRANT_ROUTES, personGrantAllowed } from "./approvals.js";
+import { ClaimNonces, checkClaimCode } from "../../shared/claim-code.js";
 import {
   expiringTokenWarning,
   githubClientId,
   githubEndpoints,
   noClientIdMessage,
+  GITHUB_SIGNIN_DOCS,
 } from "../../shared/github-app.js";
 import { githubDeviceClient } from "../../shared/github-device.js";
 import { readWebOwner } from "../../shared/web-owner.js";
@@ -253,7 +264,9 @@ import {
   machineLabel,
   parseMachineName,
   sshCommand,
+  sshLogin,
   sshTarget,
+  sshUser,
 } from "../../shared/cli-command.js";
 import { graphPrefs, patchStoredGraph } from "./graph-prefs.js";
 import { agentsLayout, patchAgentsLayout } from "./agents-layout-pref.js";
@@ -612,6 +625,9 @@ setHtmlFill((html) => {
 
 // ── MD-2: the engine this server loaded, against the one on disk ─────────────
 const ENGINE = engineWatch(getEngineRoot);
+
+/** The onboarding routes' deps, made on first use. */
+let onboardDeps: OnboardRouteDeps | null = null;
 function engineCheck(): EngineCheck {
   return ENGINE.check();
 }
@@ -789,6 +805,8 @@ import {
   readBody,
   sendJson,
   serveFile,
+  serveUntrustedFile,
+  UNTRUSTED_FILE_HEADERS,
   send400,
   send404,
   setHtmlFill,
@@ -824,7 +842,19 @@ import { parseChangelog } from "./changelog-parser.js";
 // ── Extracted services ───────────────────────────────────────────────────────
 import { GitHubService } from "./github-service.js";
 import { EditorManager, SUPPORTED_LANGUAGES } from "./editor-manager.js";
-import { handleWorkspaceRoutes } from "./workspace-routes.js";
+import {
+  handleWorkspaceRoutes,
+  workspaceCreateRefusal,
+} from "./workspace-routes.js";
+import {
+  createApprovalQueue,
+  handleApprovalRoutes,
+  isApprovalPath,
+  type HeldActions,
+} from "./approval-routes.js";
+import { heldActions } from "./held-actions.js";
+import type { ApprovalQueue } from "./approvals.js";
+import { processPathRules } from "../cli/onboard-reads.js";
 import { handleAgentRoutes, startAgentUpkeep } from "./agent-routes.js";
 import {
   handleSessionList,
@@ -833,7 +863,11 @@ import {
   sendSessionHttp,
 } from "./session-routes.js";
 import { refuseUpgrade } from "./websocket.js";
-import { isLifecycleExecCmd, streamLifecycleExec } from "./lifecycle-exec.js";
+import {
+  collectLifecycleExec,
+  isLifecycleExecCmd,
+  streamLifecycleExec,
+} from "./lifecycle-exec.js";
 import { readEdgeConfig, readWebPort } from "../../shared/edge/config.js";
 import {
   edgeHttps,
@@ -1219,6 +1253,26 @@ function loggedPath(pathname: string): string {
   );
 }
 
+/**
+ * The account the signed-out page's ssh link logs in as (SEC-2a-UX):
+ * `web.ssh_user` (read now), else the account Den runs as; "" for none.
+ */
+function sshUserNow(): string {
+  let set: string | undefined;
+  try {
+    set = readWebAuthConfig(getDistRoot(), product().configFile).sshUser;
+  } catch {
+    set = WEB_AUTH.sshUser;
+  }
+  let osUser = "";
+  try {
+    osUser = os.userInfo().username;
+  } catch {
+    /* no account name: none on the page */
+  }
+  return sshUser(set, osUser);
+}
+
 /** The ssh target for this request: the Host it used, minus the port. */
 function sshTargetOf(req: http.IncomingMessage): string {
   return sshTarget(req.headers.host, os.hostname());
@@ -1245,22 +1299,28 @@ function closeSessionSockets(keys: Iterable<string>): void {
   }
 }
 
-/** A new session for this request and its Set-Cookie line (GitHub or a link). */
+/**
+ * A new session for this request: its Set-Cookie line, and its approval
+ * key (web-session.ts), which only this sign-in's own answer may carry.
+ */
 function startSession(
   req: http.IncomingMessage,
-  via: "github" | "link" | "code",
+  via: "github" | "link" | "code" | "claim",
   login?: string,
-): string {
+): { cookie: string; approveKey: string } {
   const g = checkRequest(req, GUARD, product().cli, product().title);
   const named = g.ok ? g.via : null;
-  const { id } = webSessions.create({
+  const { id, approveKey } = webSessions.create({
     userAgent: req.headers["user-agent"],
     host: req.headers.host,
     via,
     ...(g.ok && g.client ? { client: g.client } : {}),
     ...(login ? { login } : {}),
   });
-  return sessionSetCookie(id, requestIsHttps(req, named));
+  return {
+    cookie: sessionSetCookie(id, requestIsHttps(req, named)),
+    approveKey,
+  };
 }
 
 /** The edge hostnames that route here, and their URLs (Pair a device). */
@@ -1272,10 +1332,19 @@ function denEdgeRoutes(): { host: string; url: string }[] {
   }
 }
 
-/** What the signed-out page says about Sign in with GitHub. */
-function githubSigninState(): "ready" | "no_client_id" | "no_owner" {
-  if (!GITHUB_CLIENT_ID) return "no_client_id";
-  return readWebOwner(getStateDir()) ? "ready" : "no_owner";
+/**
+ * What the signed-out page says about Sign in with GitHub: its state, and
+ * (SEC-2a-UX) the owner's login once one is linked, for step 1's "Owner:
+ * @login".
+ */
+function githubSignin():
+  | { state: "no_client_id" | "no_owner" }
+  | { state: "ready"; ownerLogin: string } {
+  if (!GITHUB_CLIENT_ID) return { state: "no_client_id" };
+  const owner = readWebOwner(getStateDir());
+  return owner
+    ? { state: "ready", ownerLogin: owner.login }
+    : { state: "no_owner" };
 }
 
 /**
@@ -1366,6 +1435,8 @@ function sendSignedOut(
     toLocal || host === `localhost:${PORT}` ? [] : ["--origin", origin];
   const cmd = cliCommand(bin, "web", "login", ...loginArgs);
   const ssh = sshTargetOf(req);
+  const user = sshUserNow();
+  const gh = githubSignin();
   res.setHeader("Cache-Control", "no-store");
   sendErrorPage(req, res, {
     status: 401,
@@ -1381,14 +1452,18 @@ function sendSignedOut(
       machine: machineName(),
       ssh: {
         target: ssh,
+        // SEC-2a-UX: the account to log in as ("" for none).
+        user,
         // Open Terminal (ssh://) only for a name, never an IP literal.
         name: !isIpLiteral(ssh),
-        login: sshCommand(ssh, cmd),
+        login: sshCommand(sshLogin(ssh, user), cmd),
       },
       // SEC-2a: Sign in with GitHub, and why it can't be offered yet.
       github: {
-        state: githubSigninState(),
+        state: gh.state,
         owner: cliCommand(bin, "web", "owner", "link"),
+        ...(gh.state === "ready" ? { ownerLogin: gh.ownerLogin } : {}),
+        learnMore: GITHUB_SIGNIN_DOCS,
         ...(GITHUB_CLIENT_ID
           ? {}
           : { message: noClientIdMessage(product().cli) }),
@@ -1475,6 +1550,8 @@ async function handleAuth(
   url: URL,
   requestId: string,
 ): Promise<void> {
+  if (url.searchParams.has("claim"))
+    return handleClaim(req, res, url, requestId);
   const secret = webSecret.current();
   const c = url.searchParams.get("c") ?? "";
   const nonce = loginCodeNonce(c);
@@ -1566,25 +1643,74 @@ async function handleAuth(
       device: deviceName(req.headers["user-agent"]),
       ...(g.ok && g.client ? { client: g.client } : {}),
     });
-    res.setHeader("Set-Cookie", startSession(req, "link"));
+    const s = startSession(req, "link");
+    res.setHeader("Set-Cookie", s.cookie);
+    res.setHeader("Cache-Control", "no-store");
     return sendJson(res, {
       ok: true,
       next: safeNext(url.searchParams.get("next")),
+      approveKey: s.approveKey,
     });
   }
   // A link nobody waits on (`web login --no-wait`, or minted with no
   // server running): it signs in when opened, once, as before.
   if (post || !webSessions.consumeCode(check.nonce, check.expiresAt))
     return gone();
+  const s = startSession(req, "link");
   res.writeHead(303, {
-    Location: safeNext(url.searchParams.get("next")),
-    "Set-Cookie": startSession(req, "link"),
+    // The approval key in the fragment: it never reaches a server.
+    Location: withApproveKey(
+      safeNext(url.searchParams.get("next")),
+      s.approveKey,
+    ),
+    "Set-Cookie": s.cookie,
     "Cache-Control": "no-store",
     "Referrer-Policy": "no-referrer",
   });
   res.end();
 }
 
+/**
+ * `GET /auth?claim=<code>` (0.4.15): the setup link `<cli> web claim-link`
+ * prints at the end of an install. A valid, unused claim code (30 min,
+ * single use across restarts) becomes a session ("claimed with a setup
+ * link" in Linked devices), then a 303 to `/` with the session's approval
+ * key in the fragment and no claim in the address, no referrer. Anything
+ * else: the signed-out page, which says the link was used and never
+ * echoes the code. An agent's token never gets here (AGENT_FORBIDDEN).
+ */
+const CLAIM_NONCES = new ClaimNonces(getStateDir());
+function handleClaim(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+  url: URL,
+  requestId: string,
+): void {
+  res.setHeader("Referrer-Policy", "no-referrer");
+  res.setHeader("Cache-Control", "no-store");
+  const secret = webSecret.current();
+  const check =
+    req.method !== "POST" && secret
+      ? checkClaimCode(url.searchParams.get("claim") ?? "", secret)
+      : null;
+  if (!check?.ok || !CLAIM_NONCES.consume(check.nonce, check.expiresAt))
+    return sendSignedOut(req, res, {
+      pathname: "/auth",
+      search: "",
+      scope: "den",
+      expired: true,
+      requestId,
+      message: `This setup link was used or has expired. If you didn't open it yourself, someone else may have: check Settings › Access › Linked devices. Sign in below, or run \`${product().cli} web claim-link\` in your own terminal for a new one.`,
+    });
+  const s = startSession(req, "claim");
+  res.writeHead(303, {
+    // The approval key in the fragment: it never reaches a server.
+    Location: withApproveKey("/", s.approveKey),
+    "Set-Cookie": s.cookie,
+  });
+  res.end();
+}
+
 /** `web login`'s wait (login-waits.ts), by the CLI's id. */
 const LOGIN_WAIT_PATH = /^\/api\/web\/logins\/([A-Za-z0-9_-]{16,64})$/;
 const LOGIN_WAITS = new LoginWaits();
@@ -1606,6 +1732,109 @@ function declaredCommand<T>(
   return own(forEnv, cmd) ? forEnv![cmd] : undefined;
 }
 
+// ── ON-3: the writes held for the person (approval-routes.ts) ─────────────────
+let approvals: {
+  queue: ApprovalQueue;
+  actions: HeldActions;
+  enabled: () => boolean;
+} | null = null;
+/** The held writes and their queue, made on first use. */
+function approvalDeps(): {
+  queue: ApprovalQueue;
+  actions: HeldActions;
+  enabled: () => boolean;
+} {
+  if (approvals) return approvals;
+  const actions = heldActions({
+    rules: () => processPathRules(getStateDir()),
+    validate: (m) => validateManifest(m),
+    workspaceCreateRefusal,
+    createWorkspace: (name) => createWorkspace(name, { services: {} }),
+    workspaceExists: (name) =>
+      Object.prototype.hasOwnProperty.call(
+        readWorkspacesFile().workspaces ?? {},
+        name,
+      ),
+    defaultWorkspace: () => getFocusedWorkspaceName() ?? "default",
+    // The exec route's checks for a local `up` (R13 placement, HITL).
+    serviceTarget: (service, ws) => {
+      if (ws && !isWorkspaceActive(ws))
+        return {
+          ok: false,
+          error: `Workspace "${ws}" is not active — activate it first`,
+        };
+      const resolved = resolveService(service, ws);
+      if (!resolved)
+        return {
+          ok: false,
+          error: `Den doesn't know a service "${service}"${ws ? ` in workspace "${ws}"` : ""}; the services tool lists what it runs`,
+        };
+      const manifest = readManifest(resolved.repoPath);
+      const refusal = placementRefusal(
+        resolved.address,
+        servicePlacement(manifest, resolved.subsystem, "local"),
+        (e) => isProductionEnv(e),
+        "up",
+      );
+      if (refusal) return { ok: false, error: refusal };
+      const def = manifest
+        ? declaredCommand(
+            manifest.services?.[resolved.subsystem]?.commands,
+            "local",
+            "up",
+          )
+        : undefined;
+      if (def && isInteractiveServiceCommand(def))
+        return {
+          ok: false,
+          error: `"up" for ${resolved.address} needs an interactive terminal: the person runs \`${product().cli} up ${resolved.address}\``,
+        };
+      return { ok: true, address: resolved.address };
+    },
+    // `up` as /api/service/exec runs it, collected instead of streamed.
+    tryService: async (address, ws) => {
+      const resolved = resolveService(address, ws);
+      if (!resolved)
+        return {
+          ok: false,
+          exitCode: null,
+          ready: false,
+          lines: [`Den no longer knows a service "${address}"`],
+        };
+      prewarmSudo();
+      return collectLifecycleExec(
+        {
+          resolved,
+          cmd: "up",
+          workspace: ws,
+          env: { E2E_ENVIRONMENT: "local", ...getSudoEnv() },
+        },
+        {
+          run: runServiceCommand,
+          health: (r) => checkServiceHealth(r, "local"),
+          secretEnv: (a, c, w) => prepareServiceSecretEnv(a, c, w),
+        },
+      );
+    },
+  });
+  approvals = {
+    actions,
+    queue: createApprovalQueue(actions, () => getStateDir()),
+    // Read per ask: a config edit takes effect without a restart. A bad
+    // value throws, and the handler holds nothing then.
+    enabled: () => readMcpConfig().approvals,
+  };
+  return approvals;
+}
+/** The agent ids with a held write waiting (their rows say "waiting"). */
+function waitingAgentIds(): Set<string> {
+  const out = new Set<string>();
+  if (!approvals) return out;
+  for (const actor of approvals.queue.waitingActors())
+    if (actor.startsWith("agent:")) out.add(actor.slice("agent:".length));
+  return out;
+}
+
 /** A test module's name as a run takes it (SEC-1 §6b.2): never a path out. */
 const SAFE_MODULE_RE = /^[A-Za-z0-9_@][A-Za-z0-9._@/-]{0,127}$/;
 
@@ -1742,6 +1971,40 @@ async function handleRequest(
   // is a WebSocket (the server's upgrade handler): a plain GET of it is 426.
   if (pathname.startsWith("/api/sessions/"))
     return sendSessionHttp(req, res, pathname);
+  // ON-3: an agent's held writes; Allow from the person's browser only.
+  if (
+    guard.ok &&
+    isApprovalPath(pathname) &&
+    (await handleApprovalRoutes(req, res, pathname, guard, approvalDeps()))
+  )
+    return;
+  // 0.4.15: what lets another browser in needs the person, not just
+  // loopback (approvals.ts: an agent with a shell is on loopback too).
+  if (req.method === "POST" && PERSON_GRANT_ROUTES.includes(pathname)) {
+    const g = guard.ok ? guard : null;
+    const ok = g ? personGrantAllowed(req, g, printedCli()) : null;
+    if (!ok?.ok) {
+      recordAction(
+        auditActorOf(req),
+        {
+          verb: "person-grant",
+          detail: pathname,
+          outcome: "refused" as const,
+          reason: "signin_to_approve",
+        },
+        principalOf(req),
+      );
+      return sendJson(
+        res,
+        {
+          ok: false,
+          code: "signin_to_approve",
+          error: ok && !ok.ok ? ok.error : "Sign in first.",
+        },
+        403,
+      );
+    }
+  }
   // SEC-2a: Sign in with GitHub, the owner's link, Pair a device. Before
   // config validation, like the sign-in above.
   if (
@@ -1784,7 +2047,10 @@ async function handleRequest(
       },
       commands: (r, code) => {
         const approve = cliCommand(printedCli(), "web", "approve", code);
-        return { approve, ssh: sshCommand(sshTargetOf(r), approve) };
+        return {
+          approve,
+          ssh: sshCommand(sshLogin(sshTargetOf(r), sshUserNow()), approve),
+        };
       },
       audit: (r, verb, detail, refused) =>
         recordAction(
@@ -1924,7 +2190,9 @@ async function handleRequest(
   }
 
   // ── Playwright report ──────────────────────────────────────────────────────
-  if (pathname.startsWith("/report")) {
+  // A test run wrote it (an agent may have): sandboxed, never Den's origin.
+  // `/report/…` only: `/reports/security/…` is ZAP's, below.
+  if (pathname === "/report" || pathname.startsWith("/report/")) {
     const relPath = pathname.slice("/report".length) || "/index.html";
     const filePath = path.resolve(path.join(REPORT_DIR, relPath));
 
@@ -1945,7 +2213,7 @@ async function handleRequest(
         ? path.join(filePath, "index.html")
         : filePath;
 
-    return serveFile(res, target);
+    return serveUntrustedFile(res, target);
   }
 
   // ── API: environments ──────────────────────────────────────────────────────
@@ -2047,9 +2315,8 @@ async function handleRequest(
         "Content-Type": file.endsWith(".html")
           ? "text/html; charset=utf-8"
           : "application/json",
-        "Cache-Control": "no-store",
         // ZAP's report pulls its own scripts; keep it away from Den's origin data.
-        "Content-Security-Policy": "sandbox allow-scripts",
+        ...UNTRUSTED_FILE_HEADERS,
       });
       return res.end(body);
     } catch {
@@ -2097,6 +2364,21 @@ async function handleRequest(
   // ── API: stacks, edge, security plan (read-only; see readonly-routes.ts) ──
   if (await handleReadonlyRoutes(req, res, pathname, url)) return;
 
+  // ── API: onboarding reads (ON-3; see onboard-routes.ts) ──────────────────
+  if (
+    await handleOnboardRoutes(
+      req,
+      res,
+      pathname,
+      url,
+      (onboardDeps ??= defaultOnboardRouteDeps(
+        (m) => validateManifest(m),
+        ENGINE.loaded.version ?? engineVersion() ?? "unknown",
+      )),
+    )
+  )
+    return;
+
   // ── API: test sources ─────────────────────────────────────────────────────
   // Returns the repos that contribute tests for a given pillar, with their
   // current branch + short SHA. Lets the Tests UI show "you are testing
@@ -3804,6 +4086,10 @@ async function handleRequest(
       actor: null,
       signedIn: false,
       ...(g && !g.beyond ? { identity: { kind: "local" } } : {}),
+      // SEC-2a-UX: the signed-out page watches this, so Sign in with
+      // GitHub appears once an owner is linked, with no reload. The
+      // owner's login is what that page shows anyway.
+      ...(g?.beyond || !g ? { github: githubSignin() } : {}),
     });
   }
   // Sign out: this browser's session ends and its cookie is cleared.
@@ -4216,6 +4502,7 @@ async function handleRequest(
       res,
       pathname,
       guard.ok && (!guard.beyond || !!guard.session || !!guard.principal),
+      { waitingAgents: waitingAgentIds },
     )
   )
     return;

package/src/ui/server/lifecycle-exec.ts

@@ -209,3 +209,73 @@ export async function streamLifecycleExec(
     setTimeout(() => void tick(), pollMs);
   }
 }
+
+/** What a collected run said: how it ended and the end of its output. */
+export interface CollectedExec {
+  ok: boolean;
+  /** The command's exit code; null while a detached start still runs. */
+  exitCode: number | null;
+  /** Started and healthy (or, with no health check, still running). */
+  ready: boolean;
+  lines: string[];
+  error?: string;
+}
+
+/**
+ * Runs a lifecycle command as the route does, collecting its events
+ * instead of streaming them (ON-3's service_try): done at `ready`, at the
+ * launcher's exit (`service-exited`) or at `done`, whichever comes first,
+ * as service_up's stream stops. Then it lets go, as a closed stream does:
+ * a detached service keeps running; only the log tail stops.
+ */
+export function collectLifecycleExec(
+  o: Omit<LifecycleExecOptions, "emit" | "end" | "onClientClose">,
+  deps: LifecycleExecDeps,
+  keep = 30,
+): Promise<CollectedExec> {
+  return new Promise((resolve) => {
+    const lines: string[] = [];
+    const errors: string[] = [];
+    let closer: (() => void) | null = null;
+    let settled = false;
+    const settle = (r: Omit<CollectedExec, "lines" | "error">): void => {
+      if (settled) return;
+      settled = true;
+      closer?.();
+      resolve({
+        ...r,
+        lines: lines.slice(-keep),
+        ...(errors.length ? { error: errors.join("\n") } : {}),
+      });
+    };
+    void streamLifecycleExec(
+      {
+        ...o,
+        emit: (e) => {
+          if (e.type === "line" && typeof e.text === "string")
+            lines.push(e.text);
+          else if (e.type === "error" && typeof e.text === "string")
+            errors.push(e.text);
+          else if (e.type === "ready")
+            settle({ ok: true, exitCode: null, ready: true });
+          else if (e.type === "service-exited") {
+            const code = Number(e.exitCode);
+            settle({ ok: code === 0, exitCode: code, ready: false });
+          } else if (e.type === "done") {
+            const code = Number(e.exitCode);
+            settle({ ok: code === 0, exitCode: code, ready: false });
+          }
+          if (lines.length > keep * 4) lines.splice(0, lines.length - keep);
+        },
+        end: () => undefined,
+        onClientClose: (fn) => {
+          closer = fn;
+        },
+      },
+      deps,
+    ).catch((e: unknown) => {
+      errors.push(String((e as Error)?.message ?? e));
+      settle({ ok: false, exitCode: 1, ready: false });
+    });
+  });
+}