@monster-orange/den 0.4.14 → 0.4.16

package/src/ui/cli/agents-command.ts

@@ -64,6 +64,7 @@
  */
 import * as fs from "fs";
 import { DEFAULT_RUNTIME_ID } from "../../shared/agents/runtimes.js";
+import { ACTOR_TOKEN_ENV } from "../../shared/actor-token.js";
 import { initLoginPath } from "../../shared/agents/runtime-search.js";
 import { HostError } from "../../shared/sessions/client.js";
 import { checkHandback } from "../../shared/agents/handback.js";
@@ -77,6 +78,7 @@ import {
 import {
   AgentError,
   importAgent,
+  changePersona,
   listAgents,
   listConversations,
   listPersonas as personaList,
@@ -116,14 +118,14 @@ export {
 
 export const AGENTS_HELP = {
   usage:
-    "agents <list|start|stop|resume|relaunch|import|rm|personas|doctor|handback-check|handoff-check> ...",
+    "agents <list|start|stop|resume|relaunch|import|persona|rm|personas|doctor|handback-check|handoff-check> ...",
   lines: [
     "Agents: a persona and a workspace, run by a runtime in a session that",
     "outlives the web server (see `{cli} sessions`).",
     "",
     "{cli} agents list -w <ws> [--stopped] [--json]",
     "    --stopped: only the stopped, interrupted and exited ones",
-    "{cli} agents start -w <ws> --persona <p> [--runtime <r>] [--model <m>] [--id <id>]",
+    "{cli} agents start -w <ws> --persona <p> [--runtime <r>] [--model <m>] [--name <name>] [--id <id>]",
     "    runs in the workspace's dir as <dist>-<ws>:<id>; its MCP is pinned to <ws>",
     "    (plus agents.<id>.grants); capped by agents.max_concurrent",
     "{cli} agents stop <id> [-w <ws>] [--no-wait]",
@@ -142,11 +144,17 @@ export const AGENTS_HELP = {
     "    passes the check, a fresh conversation (same persona, workspace, folder,",
     "    grants) whose first prompt is the handoff",
     "{cli} agents import -w <ws> [--runtime <r>] [--json]",
-    "{cli} agents import -w <ws> --session <id> --persona <p> [--runtime <r>] [--id <id>]",
+    "{cli} agents import -w <ws> --session <id> --persona <p> [--runtime <r>] [--id <id>] [--model <m>]",
     "    bring in a conversation started outside Den: the first lists the runtime's",
     "    own (default den-claude) in the workspace's folder; the second continues",
     "    one as a Den agent (its resume, in the folder it ran in). Refused while it",
-    "    is still open in another terminal: close it there first",
+    "    is still open in another terminal: close it there first. It keeps the",
+    "    conversation's own model unless --model gives one",
+    "{cli} agents persona <id> <persona> [-w <ws>] [--model <m>] [--now | --after-turn]",
+    "    change an agent's persona: the same conversation resumes with the new",
+    "    persona's role, permissions and commands; id, name, folder and model stay.",
+    "    Mid-turn it asks: --after-turn waits for the turn to end, --now stops it.",
+    "    A person's only (refused in an agent's session)",
     "{cli} agents rm <id> [-w <ws>]",
     "{cli} agents rm --stopped [-w <ws>]",
     "    forget a stopped, interrupted or exited agent (never a running one);",
@@ -273,12 +281,14 @@ async function start(args: string[], d: AgentsResolved): Promise<number> {
     "--persona": true,
     "--runtime": true,
     "--model": true,
+    "--name": true,
     "--id": true,
   });
   noExtra(where, p);
   const ws = workspaceFlag(where, p);
   if (!ws) throw new UsageError(`${where} needs -w <workspace>`);
   const persona = str(p, "--persona");
+  const name = str(p, "--name");
   if (!persona) throw new UsageError(`${where} needs --persona <p>`);
   const s = await startAgent(d, {
     workspace: ws,
@@ -286,6 +296,7 @@ async function start(args: string[], d: AgentsResolved): Promise<number> {
     runtime: str(p, "--runtime"),
     model: str(p, "--model"),
     id: str(p, "--id"),
+    ...(name !== undefined ? { name } : {}),
   });
   return report(
     d,
@@ -303,6 +314,8 @@ async function bringIn(args: string[], d: AgentsResolved): Promise<number> {
     "--session": true,
     "--persona": true,
     "--id": true,
+    "--model": true,
+    "--version": true,
     "--json": false,
   });
   noExtra(where, p);
@@ -352,6 +365,11 @@ async function bringIn(args: string[], d: AgentsResolved): Promise<number> {
     persona,
     runtime,
     id: str(p, "--id"),
+    // AG-17.1c: the conversation's own model unless one is given.
+    ...(str(p, "--model") !== undefined ? { model: str(p, "--model") } : {}),
+    ...(str(p, "--version") !== undefined
+      ? { version: str(p, "--version") }
+      : {}),
   });
   return report(
     d,
@@ -360,6 +378,52 @@ async function bringIn(args: string[], d: AgentsResolved): Promise<number> {
   );
 }
 
+/**
+ * `agents persona <id> <persona> [-w <ws>] [--model <m>] [--version <v>]
+ * [--now | --after-turn]` (AG-18). A person's only: refused inside an
+ * agent's session (its DEN_ACTOR_TOKEN), so an agent can't widen its own
+ * permissions.
+ */
+async function persona(args: string[], d: AgentsResolved): Promise<number> {
+  const where = "agents persona";
+  if (d.env[ACTOR_TOKEN_ENV] !== undefined)
+    throw new AgentError(
+      `${where}: only a person can change an agent's persona (this is an agent's session)`,
+    );
+  const p = parseArgs(where, args, {
+    "--workspace": true,
+    "--model": true,
+    "--version": true,
+    "--now": false,
+    "--after-turn": false,
+  });
+  noExtra(where, p, 2);
+  const [id, to] = p.positional;
+  if (!id || !to) throw new UsageError(`${where} needs <id> <persona>`);
+  if (p.flags["--now"] && p.flags["--after-turn"])
+    throw new UsageError(`${where}: --now or --after-turn, not both`);
+  const when = p.flags["--now"]
+    ? "now"
+    : p.flags["--after-turn"]
+      ? "after-turn"
+      : undefined;
+  if (when === "after-turn") d.out(`waiting for agent ${id}'s turn to end…`);
+  const s = await changePersona(d, id, workspaceFlag(where, p), {
+    persona: to,
+    ...(str(p, "--model") !== undefined ? { model: str(p, "--model") } : {}),
+    ...(str(p, "--version") !== undefined
+      ? { version: str(p, "--version") }
+      : {}),
+    ...(when ? { when } : {}),
+    by: "cli",
+  });
+  return report(
+    d,
+    s,
+    `agent ${s.rec.id} is now ${s.rec.persona} (was ${s.from}); same conversation, as ${s.rec.sessionName} in ${s.rec.cwd}`,
+  );
+}
+
 /** `<id> [-w <ws>]`. */
 function idAndWorkspace(
   where: string,
@@ -700,6 +764,9 @@ export async function cmdAgents(
         case "import":
           await loadAgentWorkspaces(deps);
           return await bringIn(rest, d);
+        case "persona":
+          await loadAgentWorkspaces(deps);
+          return await persona(rest, d);
         case "rm":
           await loadAgentWorkspaces(deps);
           return await rm(rest, d);

package/src/ui/cli/doctor-command.ts

@@ -22,7 +22,12 @@
  * nothing is sent.
  */
 import chalk from "chalk";
-import { readDenConfig, type DenConfig } from "../../shared/den-config.js";
+import {
+  readDenConfig,
+  readMcpConfig,
+  type DenConfig,
+} from "../../shared/den-config.js";
+import { approvalsState } from "../mcp/tools.js";
 import { getStateDir } from "../../shared/paths.js";
 import { product } from "../../shared/product.js";
 import { listRecords } from "../../shared/agents/records.js";
@@ -216,6 +221,25 @@ export function agentsConfigured(
   }
 }
 
+/**
+ * The held writes' state (mcp.approvals), as doctor prints it. A bad value
+ * is a problem: the MCP server refuses to start on it.
+ */
+export function approvalsLines(read: () => boolean): {
+  lines: string[];
+  problem: boolean;
+} {
+  try {
+    const state = approvalsState({ approvals: read() });
+    return { lines: ["", `  ℹ MCP ${state}`], problem: false };
+  } catch (err) {
+    return {
+      lines: ["", chalk.red(`  ✗ MCP ${(err as Error).message}`)],
+      problem: true,
+    };
+  }
+}
+
 /** Informational lines after the rows: never a failure. */
 export function doctorNotes(cli: string, configured: boolean): string[] {
   return configured
@@ -312,6 +336,8 @@ export async function cmdDoctor(args: string[]): Promise<number> {
   }
   const rows = doctorRows();
   for (const l of formatDoctor(rows, readBrand().name)) console.log(l);
+  const held = approvalsLines(() => readMcpConfig().approvals);
+  for (const l of held.lines) console.log(l);
   for (const l of pollingLines(eventsFile(), readBrand().name)) console.log(l);
   const cli = product().cli;
   if (!probe) {
@@ -320,7 +346,7 @@ export async function cmdDoctor(args: string[]): Promise<number> {
       agentsConfigured(readConfigOrNull(), getStateDir()),
     ))
       console.log(l);
-    return rows.some((r) => r.problem) ? 1 : 0;
+    return rows.some((r) => r.problem) || held.problem ? 1 : 0;
   }
   const { runEnvProbe, formatProbe } = await import("./env-probe.js");
   const { resolveDeps, plainSessionEnv } =
@@ -339,5 +365,5 @@ export async function cmdDoctor(args: string[]): Promise<number> {
   console.log("");
   for (const l of formatProbe(results)) console.log(l);
   const found = results.some((r) => r.findings.length);
-  return rows.some((r) => r.problem) || found ? 1 : 0;
+  return rows.some((r) => r.problem) || held.problem || found ? 1 : 0;
 }

package/src/ui/cli/doctor-onboard.ts

@@ -28,6 +28,8 @@ import {
 import { readWebPort } from "../../shared/edge/config.js";
 import { DEFAULT_PORT } from "../../shared/constants.js";
 import { needsDocker } from "./repo-detect.js";
+import { readMcpConfig } from "../../shared/den-config.js";
+import { approvalsState } from "../mcp/tools.js";
 import type { WebProbe } from "./mcp-connect.js";
 
 export type CheckStatus = "ok" | "warn" | "fail";
@@ -59,6 +61,8 @@ export interface OnboardDeps {
   probeWeb: (url: string) => Promise<WebProbe>;
   /** The MCP one-shot against the web server: exit 0, or why not. */
   mcpCall: () => { ok: boolean; detail?: string };
+  /** `mcp.approvals` (throws on a bad value): whether the held writes are on. */
+  approvals: () => boolean;
   /** The command an agent runs, e.g. `./bin/acme`. */
   bin: string;
 }
@@ -193,9 +197,30 @@ export async function onboardingChecks(
           },
     );
   }
+  out.push(approvalsCheck(d));
   return out;
 }
 
+/** `mcp:approvals`: which state the held writes are in. Never needs the server. */
+function approvalsCheck(d: OnboardDeps): OnboardCheck {
+  let on: boolean;
+  try {
+    on = d.approvals();
+  } catch (err) {
+    return {
+      id: "mcp:approvals",
+      status: "fail",
+      detail: (err as Error).message,
+      ask: "Set mcp.approvals in the distribution config to true or false.",
+    };
+  }
+  return {
+    id: "mcp:approvals",
+    status: "ok",
+    detail: approvalsState({ approvals: on }),
+  };
+}
+
 function onPath(bin: string): boolean {
   for (const dir of (process.env.PATH ?? "").split(path.delimiter)) {
     if (!dir) continue;
@@ -286,6 +311,7 @@ export function defaultOnboardDeps(
               `exit ${r.status ?? "timeout"}`,
           };
     },
+    approvals: () => readMcpConfig().approvals,
     bin: runnableCli(),
   };
 }

package/src/ui/cli/flag-parser.ts

@@ -181,7 +181,15 @@ function validateFlagScopes(parsed: ParsedCliArgs): void {
  */
 export const SUBCOMMAND_OWN_HELP: Readonly<Record<string, readonly string[]>> =
   {
-    web: ["token", "login", "sessions", "logout", "owner", "approve"],
+    web: [
+      "token",
+      "login",
+      "sessions",
+      "logout",
+      "owner",
+      "approve",
+      "claim-link",
+    ],
     mcp: ["connect", "disconnect", "clients", "config"],
     repo: ["add"],
   };

package/src/ui/cli/index.ts

@@ -366,12 +366,22 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
   },
   repo: {
     usage:
-      'repo add <path|git-url> [--sidecar] [-w <workspace>] [--name <repo>] [--run "<cmd>"] [--health <url>] [--json]',
+      'repo add <path|git-url> [--sidecar] [-w <workspace>] [--name <repo>] [--run "<cmd>"] [--health <url>] [--dry-run] [--json] | repo detect <folder> [--json]',
     lines: [
       "Add a repo with no prompts, never writing into it. A repo with no",
       "manifest (or --sidecar) gets a side-car manifest in manifests/, detected",
       "from its Makefile, compose file or package.json scripts. Safe to re-run.",
-      "`{cli} repo add --help` says more.",
+      "--dry-run prints the side-car it would write, validated, and writes nothing.",
+      "detect: the git repos in a folder in your home, how each runs, and",
+      "suggested workspaces. `{cli} repo add --help` says more.",
+    ],
+  },
+  onboard: {
+    usage: "onboard status [--json]",
+    lines: [
+      "What's set up (a distribution, the web server, workspaces, repos, a",
+      "running service, Den's MCP) and the one next step, with its command.",
+      "Reads only; it never runs an agent's CLI.",
     ],
   },
   relocate: {
@@ -595,6 +605,7 @@ const TELEMETRY_COMMANDS = new Set<string>([
   "theme",
   "plugin",
   "repo",
+  "onboard",
 ]);
 
 /**
@@ -975,6 +986,15 @@ class DenCLI {
           break;
         }
 
+        case "onboard": {
+          const { cmdOnboard } = await import("./onboard-command.js");
+          const { probeWebServer } = await import("./mcp-connect.js");
+          process.exitCode = await cmdOnboard(args.slice(1), (u) =>
+            probeWebServer(u),
+          );
+          break;
+        }
+
         case "relocate":
           await this.cmdRelocate(args.slice(1));
           break;
@@ -5271,7 +5291,13 @@ class DenCLI {
       "  register [path]      Register a repo in the service catalog",
     );
     console.log(
-      "  repo add <path|url>  Add a repo with no prompts, never changing it (--sidecar, --json)",
+      "  repo add <path|url>  Add a repo with no prompts, never changing it (--sidecar, --dry-run, --json)",
+    );
+    console.log(
+      "  repo detect <folder> Find the repos in a folder and suggest workspaces (--json)",
+    );
+    console.log(
+      "  onboard status       What's set up, and the next step (--json)",
     );
     console.log(
       "  relocate <repo> <path>  Point a moved checkout's workspace entries at its new path",

package/src/ui/cli/onboard-command.ts

@@ -0,0 +1,180 @@
+/**
+ * `<cli> onboard status [--json]` (ON-3): what's set up and the one next
+ * step, the CLI twin of the MCP tool `onboard_status` and of
+ * GET /api/onboard/status. `doctor --json` has the machine checks (Node,
+ * git, Docker, the web server, Den's MCP); this adds what onboarding needs
+ * on top (a distribution, workspaces, repos, a running service) and picks
+ * the next step. Reads only. It never runs an agent's CLI: Den's MCP is
+ * checked in the agents' config files (onboard-reads.ts mcpRegistration).
+ * Exit 0 whenever it answers, whatever is left to do.
+ */
+import { execFile } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { product } from "../../shared/product.js";
+import { getDistRoot } from "../../shared/paths.js";
+import {
+  DEN_SERVICES_DIR,
+  readWorkspacesFile,
+} from "../../shared/environment-manager/workspaces.js";
+import { listDaemons } from "../../shared/environment-manager/service-runner.js";
+import { defaultOnboardDeps, runnableCli } from "./doctor-onboard.js";
+import type { WebProbe } from "./mcp-connect.js";
+import {
+  mcpRegistration,
+  onboardStatus,
+  type OnboardStatus,
+  type OnboardStatusDeps,
+  type RegisteredRepo,
+} from "./onboard-reads.js";
+import { printJson } from "./json-out.js";
+
+/** Every repo in a workspace, at the folder Den runs it from. */
+export function registeredRepos(): RegisteredRepo[] {
+  let file;
+  try {
+    file = readWorkspacesFile();
+  } catch {
+    return [];
+  }
+  const out: RegisteredRepo[] = [];
+  for (const [workspace, ws] of Object.entries(file.workspaces))
+    for (const [addr, entry] of Object.entries(ws?.services ?? {})) {
+      const repo = addr.split("/")[0];
+      const dir =
+        entry.mode === "dev-managed"
+          ? entry.path
+          : path.join(DEN_SERVICES_DIR, repo, entry.branch ?? "main");
+      if (dir) out.push({ path: dir, workspace, repo });
+    }
+  return out;
+}
+
+function readText(file: string): string | null {
+  try {
+    return fs.readFileSync(file, "utf-8");
+  } catch {
+    return null;
+  }
+}
+
+/** Whether the Docker daemon answers, without blocking the event loop. */
+function dockerUpAsync(): Promise<boolean> {
+  return new Promise((resolve) => {
+    execFile(
+      "docker",
+      ["info", "--format", "{{.ServerVersion}}"],
+      { timeout: 10_000 },
+      (err) => resolve(!err),
+    );
+  });
+}
+
+/** This machine's deps for onboardStatus. */
+export async function defaultStatusDeps(o: {
+  probeWeb: (url: string) => Promise<WebProbe>;
+  webUrl?: string;
+  viaMcp?: boolean;
+}): Promise<OnboardStatusDeps> {
+  const doctor = defaultOnboardDeps(o.probeWeb);
+  if (o.webUrl) doctor.webUrl = o.webUrl;
+  // Docker is asked only when a registered repo needs it, and asynchronously:
+  // the web server answers this route too.
+  const dockerRepos = doctor.dockerRepos();
+  const dockerUp =
+    dockerRepos.length && doctor.which("docker")
+      ? await dockerUpAsync()
+      : false;
+  const bin = runnableCli();
+  return {
+    bin,
+    distribution: fs.existsSync(path.join(getDistRoot(), "bin", product().cli)),
+    doctor: {
+      ...doctor,
+      dockerRepos: () => dockerRepos,
+      dockerUp: () => dockerUp,
+    },
+    workspaces: () => {
+      let file;
+      try {
+        file = readWorkspacesFile();
+      } catch {
+        return { names: [], active: [], repos: [] };
+      }
+      const repos = new Set<string>();
+      for (const ws of Object.values(file.workspaces))
+        for (const addr of Object.keys(ws?.services ?? {}))
+          repos.add(addr.split("/")[0]);
+      return {
+        names: Object.keys(file.workspaces),
+        active: file.active.filter((n) => n in file.workspaces),
+        repos: [...repos],
+      };
+    },
+    running: () => {
+      try {
+        return listDaemons().map((d) => d.address);
+      } catch {
+        return [];
+      }
+    },
+    mcp: () =>
+      mcpRegistration({
+        cli: bin,
+        home: os.homedir(),
+        platform: process.platform,
+        appData: process.env.APPDATA,
+        projectDir: getDistRoot(),
+        which: doctor.which,
+        read: readText,
+        viaMcp: o.viaMcp,
+      }),
+  };
+}
+
+const MARK: Record<string, string> = { ok: "✓", warn: "!", todo: "·" };
+
+function printHuman(r: OnboardStatus): void {
+  for (const c of r.checks)
+    console.log(`  ${MARK[c.status] ?? " "} ${c.id.padEnd(12)} ${c.detail}`);
+  console.log(`\n  Next: ${r.next.step}`);
+  if (r.next.command) console.log(`  Run:  ${r.next.command}`);
+}
+
+export const ONBOARD_USAGE = () => `${product().cli} onboard status [--json]`;
+
+/** `onboard <sub> …`; returns the exit code. */
+export async function cmdOnboard(
+  argv: string[],
+  probeWeb: (url: string) => Promise<WebProbe>,
+): Promise<number> {
+  const [sub, ...rest] = argv;
+  const json = rest.includes("--json");
+  const unknown = rest.filter((a) => a !== "--json");
+  if (sub !== "status" || unknown.length) {
+    const error =
+      sub === undefined || sub === "--help" || sub === "-h"
+        ? null
+        : sub !== "status"
+          ? `unknown onboard subcommand "${sub}"`
+          : `unknown flag ${unknown[0]}`;
+    if (json && error)
+      printJson({
+        ok: false,
+        error,
+        fix: `${runnableCli()} onboard status --json`,
+      });
+    else {
+      if (error) console.error(`✗ ${error}`);
+      console.log(
+        `\n  ${ONBOARD_USAGE()}\n\n  What's set up (a distribution, the web server, workspaces, repos,\n  a running service, Den's MCP) and the one next step, with its command.\n`,
+      );
+    }
+    return error ? 2 : sub === undefined ? 1 : 0;
+  }
+  const r = await onboardStatus(await defaultStatusDeps({ probeWeb }));
+  if (json) printJson(r);
+  else printHuman(r);
+  return 0;
+}