@monster-orange/den 0.4.15 → 0.4.16

package/CHANGELOG.md

@@ -4,6 +4,73 @@ All notable changes to Den are documented here. Each release lists the
 config and manifest changes a distribution must make to move to it under
 **Migrations**.
 
+## [0.4.16] - 2026-11-08
+
+### Added
+
+- **Change an agent's persona (AG-18).** **Change persona…** in the
+  agent pane's ⋯ menu (running or stopped), and `<cli> agents persona
+  <id> <persona> [--model <m>] [--now | --after-turn]`. Den stops the
+  session and resumes the same conversation with the new persona's role
+  prompt, permission mode and allowed commands; the history, id, name,
+  workspace, folder, tab and the model it runs stay. The dialog marks the
+  current persona and lists what changes. Mid-turn it never stops a turn
+  unasked: "It's working. Change after this turn, or stop it now?" (409
+  `busy`); After this turn waits for the turn to end, Stop it now stops
+  it. The wait lives in the server's memory: if Den restarts first, the
+  change is dropped, the record no longer marks it pending, and the audit
+  trail says "persona change cancelled: Den restarted". A person's only: an agent's token is refused (403), and there is no
+  MCP tool. Only a runtime that can resume offers it. The record keeps
+  `personaChanges`, and the audit trail records each change. Route `POST
+  /api/workspaces/<ws>/agents/<id>/persona`.
+
+### Changed
+
+- **Bring in keeps the conversation's model, and says what the persona
+  changes (AG-17.1c).** It used to switch the conversation to the
+  persona's model, and drop MCP servers the conversation had outside Den,
+  without a word. Now the model stays the one its last answer came from
+  ("Keeps <model> from the conversation"; Advanced or `--model` picks
+  another), and a short list under the persona says "From now on it works
+  as <persona>: its role, its permissions (<mode>), Den's tools and
+  guards. Its history stays.", plus "It won't have: <servers>." for MCP
+  servers seen in its transcript that Den won't load. The persona of the
+  latest agent that worked in its folder is preselected (`suggest`), never
+  submitted. The list adds `model`, `lost` and `suggest`; the import takes
+  `model` and `version`.
+- **The signed-out page shows Sign in with GitHub once the owner is
+  linked, with no reload.** With no owner yet it watches the session
+  probe (which now says `github.state` to a signed-out browser), and step 1
+  turns done and the button appears as soon as `web owner link` finishes.
+
+- **The signed-out page explains Sign in with GitHub (SEC-2a-UX).** It
+  shows the same three steps whether or not an owner is linked: on the
+  machine Den runs on, run `<cli> web owner link` (or use Settings ›
+  Access there); enter the code it shows at github.com/login/device and
+  approve; come back and press Sign in with GitHub with the same account.
+  Once an owner is linked, step 1 shows as done ("Owner: @login") and the
+  button follows the steps. Below them: only the owner's GitHub account
+  can sign in this way, anyone else uses Approve this computer, and Learn
+  more opens docs/distributions.md, "Signing in with GitHub". English,
+  Spanish and Japanese.
+- Another GitHub account is refused with "@login isn't the owner of this
+  Den. Only the owner's account can use Sign in with GitHub. Use Approve
+  this computer instead." It no longer says to ask the owner to add you:
+  a Den has one owner, and no one to add.
+
+### Fixed
+
+- An open agent pane stayed on the old session after Change persona, Resume
+  or a rotation, showing "[the session exited (143)]" while the list showed
+  the new one running. A pane now follows its agent: it moves to the new
+  session in the same slot, keeps its scrollback, and says "Switched to
+  <persona>". After a session ends the page looks again every second for
+  15 s, so the switch shows within about 2 s.
+
+### Migrations
+
+- None.
+
 ## [0.4.15] - 2026-11-07
 
 ### Added

package/README.md

@@ -10,8 +10,8 @@
 </p>
 
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="docs/images/0.4.15/hero-dark.png">
-  <img src="docs/images/0.4.15/hero-light.png" width="100%" alt="Den's Graph page: the demo workspace's services grouped by application, all healthy, with the status chip and the left rail">
+  <source media="(prefers-color-scheme: dark)" srcset="docs/images/0.4.16/hero-dark.png">
+  <img src="docs/images/0.4.16/hero-light.png" width="100%" alt="Den's Graph page: the demo workspace's services grouped by application, all healthy, with the status chip and the left rail">
 </picture>
 
 ## Set up by your agent
@@ -38,7 +38,7 @@ It doesn't replace your tools. Your repos, Docker, your test runners, your secre
 yours. Den connects them and turns on good practice from the start.
 
 <p align="center">
-  <img src="docs/images/0.4.15/up.gif" width="100%" alt="make up in the Graph page: every stack down, then demo-api, demo-web and demo-notes come up in dependency order until the status chip reads All 3 healthy">
+  <img src="docs/images/0.4.16/up.gif" width="100%" alt="make up in the Graph page: every stack down, then demo-api, demo-web and demo-notes come up in dependency order until the status chip reads All 3 healthy">
 </p>
 
 ## How it helps
@@ -68,10 +68,10 @@ yours. Den connects them and turns on good practice from the start.
   lives in your own repo.
 
 <p align="center">
-  <img src="docs/images/0.4.15/agents.png" width="49%" alt="The Agents tab: the demo workspace's sessions on the left, and one open in a terminal pane on the right, running demo-api's test and then the service">
-  <img src="docs/images/0.4.15/workspaces.png" width="49%" alt="The Workspaces page: the demo workspace's repos with their health, mode and Start, Stop, Restart and Logs actions">
-  <img src="docs/images/0.4.15/status-drawer.png" width="49%" alt="The status drawer: nothing needs attention, and every service in the demo workspace, by application, with its latency">
-  <img src="docs/images/0.4.15/edge.png" width="49%" alt="The Edge page: the edge container up, its ports and TLS, and every route it serves, Den's own and each stack's, with its upstream">
+  <img src="docs/images/0.4.16/agents.png" width="49%" alt="The Agents tab: the demo workspace's sessions on the left, and one open in a terminal pane on the right, running demo-api's test and then the service">
+  <img src="docs/images/0.4.16/workspaces.png" width="49%" alt="The Workspaces page: the demo workspace's repos with their health, mode and Start, Stop, Restart and Logs actions">
+  <img src="docs/images/0.4.16/status-drawer.png" width="49%" alt="The status drawer: nothing needs attention, and every service in the demo workspace, by application, with its latency">
+  <img src="docs/images/0.4.16/edge.png" width="49%" alt="The Edge page: the edge container up, its ports and TLS, and every route it serves, Den's own and each stack's, with its upstream">
 </p>
 
 ## Get started

package/docs/distributions.md

@@ -1687,14 +1687,31 @@ the account's id and login, never a token, and no other account gets in.
   `web owner unlink`. Settings › Access does the same in the browser
   (Link your GitHub account, Unlink): shell-grade actions, for a signed-in
   browser and never an agent's token.
-- **Sign in with GitHub** on the signed-out page shows a code and
-  `github.com/login/device`. The server runs the flow, and when the owner
-  approves it sets the same never-expiring session cookie a one-time link
-  sets, and the page reloads signed in. Another account sees "@<login>
-  isn't allowed on this Den". The token is thrown away either way. At most
-  three sign-ins wait for GitHub at once; a code expires as GitHub says
-  (15 minutes). With no owner linked the page says to run
-  `web owner link`.
+- **Sign in with GitHub** on the signed-out page shows the same three
+  steps whether or not an owner is linked:
+  1. On the machine Den runs on, run `web owner link`, or use
+     Settings › Access there.
+  2. It shows a code. Enter it at `github.com/login/device` and approve.
+  3. Come back to the signed-out page and press **Sign in with GitHub**,
+     with the same GitHub account.
+
+  Once an owner is linked, step 1 shows as done ("Owner: @<login>") and
+  the button follows the steps; before that there is no button. Below the
+  steps the page says only the owner's GitHub account can sign in this
+  way, and that anyone else uses **Approve this computer**; **Learn more**
+  opens this section. With no owner yet, the page watches (the session
+  probe, `GET /api/session`, says `github.state` to a signed-out
+  browser): once the owner is linked on the machine, step 1 shows done
+  and the button appears, with no reload.
+
+- Pressing the button shows a code and `github.com/login/device`. The
+  server runs the flow, and when the owner approves it sets the same
+  never-expiring session cookie a one-time link sets, and the page reloads
+  signed in. Another account sees "@<login> isn't the owner of this Den.
+  Only the owner's account can use Sign in with GitHub. Use Approve this
+  computer instead." Den has one owner, so there is no one to add. The
+  token is thrown away either way. At most three sign-ins wait for GitHub
+  at once; a code expires as GitHub says (15 minutes).
 - **Settings › Access** lists the linked devices (the browser, how it
   signed in, the client address when the edge vouched for one, created and
   last seen; "This device" on yours), each with **Revoke**, which ends its session at once (its
@@ -2180,7 +2197,8 @@ server scoped to its workspace.
 <cli> agents stop <id> [-w <ws>]
 <cli> agents resume <id> [-w <ws>]
 <cli> agents import -w <ws> [--runtime <r>] [--json]          # conversations to bring in
-<cli> agents import -w <ws> --session <id> --persona <p>      # bring one in
+<cli> agents import -w <ws> --session <id> --persona <p> [--model <m>]  # bring one in
+<cli> agents persona <id> <persona> [-w <ws>] [--model <m>] [--now | --after-turn]  # change its persona
 <cli> agents personas [--json]
 <cli> agents doctor [-w <ws>] [--json]  # can each runtime run here, and why not
 <cli> agents handback-check <file|->    # is a hand-back complete and plain (see Guardrails)
@@ -2251,6 +2269,24 @@ import -w <ws>` lists them too.
   Den's token, MCP config, hooks, guards and audit trail apply. It is an
   agent like any other: stop, resume, rename. The record notes
   `broughtInAt`.
+- **What the persona changes.** The persona is the role it takes on from
+  now on: its role prompt, its permission mode and allowed commands, and
+  Den's tools and guards. The history stays. The dialog says so under the
+  persona list: "From now on it works as <persona>: its role, its
+  permissions (<mode>), Den's tools and guards. Its history stays."
+- **The model stays the conversation's own.** Den reads the model of its
+  last answer (`message.model` on the last assistant record, in the ends
+  it reads) and runs it on that: "Keeps <model> from the conversation".
+  Advanced (or `--model`) picks another. With no model in the
+  transcript, the persona's applies.
+- **The MCP servers it won't have.** An agent runs with Den's MCP only
+  (`--strict-mcp-config`). When the transcript shows tool calls from other
+  servers (`mcp__<server>__…`), the dialog names them: "It won't have:
+  <servers>." The list's `lost` field has them.
+- **A suggested persona.** The list's `suggest` is the persona of the
+  latest agent of the workspace that worked in the conversation's folder
+  (or a folder inside it, or one containing it), else the workspace's
+  latest agent's. The dialog preselects it; you confirm with Bring in.
 - **One writer only.** A conversation written in the last minute is taken
   to be still open in another terminal: "Still open in another terminal.
   Close it there first" (HTTP 409 `open_elsewhere`). A conversation an
@@ -2260,8 +2296,43 @@ import -w <ws>` lists them too.
 - Only den-claude can bring one in for now. Other runtimes say "<runtime>
   can't bring in a conversation yet".
 - Routes: `GET /api/workspaces/<ws>/conversations[?runtime=<r>]` and `POST
-/api/workspaces/<ws>/conversations/<id>/import` `{ persona, runtime?, id?
-}`. A person's only, unless MCP `agent_import` is opted in.
+/api/workspaces/<ws>/conversations/<id>/import` `{ persona, runtime?, id?,
+model?, version? }`. A person's only, unless MCP `agent_import` is opted
+  in.
+
+#### Change an agent's persona
+
+**Change persona…** (the agent pane's ⋯ menu, running or stopped) and
+`agents persona <id> <persona>` switch an agent to another persona on the
+same conversation. Den stops its session and resumes the conversation with
+the new persona's role prompt, permission mode and allowed commands (the
+old persona's mode and commands go). The history stays, and so do the
+agent's id, name, workspace, folder, grants, tab and slot, and the model it
+runs unless Advanced (`--model`) picks another. The dialog lists the
+personas with the current one marked, and the same "From now on it works
+as…" line as Bring in.
+
+- **Never mid-turn without asking.** While it works (den-claude: its
+  transcript's last record is a tool call, or a prompt or tool result with
+  no answer yet), the change is refused: "It's working. Change after this
+  turn, or stop it now?" (HTTP 409 `busy`). **After this turn**
+  (`--after-turn`, `when: "after-turn"`) waits for the turn to end, up to
+  30 minutes, and then switches (the API answers 202 `pending` at once;
+  the record marks it `pendingPersona` while it waits). The wait lives in
+  the server's memory: if Den restarts first, the change is dropped, the
+  mark is cleared at start, and the audit trail records "persona change
+  cancelled: Den restarted";
+  **Stop it now** (`--now`, `when: "now"`) stops it and switches.
+- **A person's only.** An agent could widen its own permissions with it,
+  so an agent's token is refused (403), the CLI refuses inside an agent's
+  session, and there is no MCP tool.
+- Only a runtime that can resume offers it (`personaChange: true` on the
+  agent's row); others can't.
+- The record keeps each change in `personaChanges` (from, to, when, and
+  who), and the audit trail records "persona <id> in <ws>: <from> → <to>,
+  by <who>".
+- Route: `POST /api/workspaces/<ws>/agents/<id>/persona` `{ persona, model?,
+version?, when? }`.
 
 ### On the Workspaces page
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monster-orange/den",
-  "version": "0.4.15",
+  "version": "0.4.16",
   "description": "Den: a local multi-repo dev orchestrator, HTTPS edge and E2E harness",
   "type": "module",
   "bin": {

package/src/shared/agents/conversations.ts

@@ -32,6 +32,16 @@ export interface RuntimeConversation {
   lastAt: string;
   /** The folder it ran in. */
   cwd: string;
+  /**
+   * AG-17.1c: the model its last answer came from (the last assistant
+   * record's `message.model`), so Bring in keeps it. Absent when unknown.
+   */
+  model?: string;
+  /**
+   * AG-17.1c: the MCP servers its tools came from (`mcp__<server>__<tool>`
+   * tool calls in the ends read), sorted. Absent when none.
+   */
+  mcp?: string[];
 }
 
 /** Bytes read at each end of a transcript. */
@@ -114,22 +124,63 @@ function promptText(rec: Record<string, unknown>): string | null {
   return cleanName(text);
 }
 
-/** A transcript's cwd and title, from its two ends. */
+/** A model name as a transcript records it: short, printable, not synthetic. */
+const MODEL_RE = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,127}$/;
+/** An MCP tool's name: `mcp__<server>__<tool>`. */
+const MCP_TOOL_RE = /^mcp__([A-Za-z0-9_.-]+?)__[A-Za-z0-9_.-]+$/;
+
+/** An assistant record's tool calls' names. */
+function toolNames(rec: Record<string, unknown>): string[] {
+  const content = (rec.message as { content?: unknown } | undefined)?.content;
+  if (!Array.isArray(content)) return [];
+  return content.flatMap((c) => {
+    const b = c as { type?: unknown; name?: unknown };
+    return b?.type === "tool_use" && typeof b.name === "string" ? [b.name] : [];
+  });
+}
+
+/** A transcript's summary from its two ends (AG-17.1, AG-17.1c). */
+export interface TranscriptSummary {
+  cwd: string | null;
+  title: string | null;
+  /** The last assistant record's model, or null. */
+  model: string | null;
+  /** The MCP servers its tool calls name, sorted. */
+  mcp: string[];
+}
+
+/** A transcript's cwd, title, last model and MCP servers, from its two ends. */
 export function transcriptSummary(
   file: string,
   bytes = ENDS_BYTES,
-): { cwd: string | null; title: string | null } {
+): TranscriptSummary {
   const { head, tail } = readEnds(file, bytes);
   let cwd: string | null = null;
   let prompt: string | null = null;
   let title: string | null = null;
+  let model: string | null = null;
+  const mcp = new Set<string>();
   const titleIn = (line: string) => {
     if (!line.includes("custom-title")) return;
     const r = parse(line);
     if (r?.type === "custom-title") title = cleanName(r.customTitle) ?? title;
   };
+  // AG-17.1c: the last answer's model, and the MCP servers its tools came from.
+  const assistantIn = (line: string) => {
+    if (!line.includes('"assistant"')) return;
+    const r = parse(line);
+    if (r?.type !== "assistant") return;
+    const m = (r.message as { model?: unknown } | undefined)?.model;
+    if (typeof m === "string" && MODEL_RE.test(m) && m !== "<synthetic>")
+      model = m;
+    for (const n of toolNames(r)) {
+      const hit = MCP_TOOL_RE.exec(n);
+      if (hit) mcp.add(hit[1]);
+    }
+  };
   for (const line of head) {
     titleIn(line);
+    assistantIn(line);
     if (cwd && prompt) continue;
     if (!line.includes('"cwd"') && !line.includes('"user"')) continue;
     const r = parse(line);
@@ -138,8 +189,73 @@ export function transcriptSummary(
       cwd = r.cwd;
     prompt ??= promptText(r);
   }
-  for (const line of tail) titleIn(line);
-  return { cwd, title: title ?? prompt };
+  for (const line of tail) {
+    titleIn(line);
+    assistantIn(line);
+  }
+  return { cwd, title: title ?? prompt, model, mcp: [...mcp].sort() };
+}
+
+/** Written this recently, a turn whose last record is an answer is still going. */
+export const TURN_QUIET_MS = 5_000;
+
+/**
+ * AG-18: whether a conversation's turn is still going, from its tail: the
+ * last user or assistant record. An answer that ended (`end_turn`, a stop
+ * sequence, the token limit) is idle; a tool call, or a prompt or tool
+ * result with no answer yet, is busy; an answer with no stop reason is busy
+ * until the file has been quiet TURN_QUIET_MS. An interrupted turn is idle.
+ * No transcript: idle (nothing was asked yet).
+ */
+export function transcriptBusy(
+  file: string | null,
+  now = Date.now(),
+  bytes = ENDS_BYTES,
+): boolean {
+  if (!file) return false;
+  let mtime: number;
+  try {
+    mtime = fs.statSync(file).mtimeMs;
+  } catch {
+    return false;
+  }
+  const { head, tail } = readEnds(file, bytes);
+  const lines = tail.length ? [...head, ...tail] : head;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line.includes('"user"') && !line.includes('"assistant"')) continue;
+    const r = parse(line);
+    if (!r || r.isSidechain === true || r.isMeta === true) continue;
+    if (r.type === "assistant") {
+      const msg = r.message as { stop_reason?: unknown } | undefined;
+      const stop = msg?.stop_reason;
+      if (stop === "tool_use" || toolNames(r).length) return true;
+      if (
+        stop === "end_turn" ||
+        stop === "stop_sequence" ||
+        stop === "max_tokens"
+      )
+        return false;
+      return now - mtime < TURN_QUIET_MS;
+    }
+    if (r.type === "user") {
+      const content = (r.message as { content?: unknown } | undefined)?.content;
+      const text =
+        typeof content === "string"
+          ? content
+          : Array.isArray(content)
+            ? ((
+                content.find(
+                  (c) => (c as { type?: unknown })?.type === "text",
+                ) as { text?: unknown } | undefined
+              )?.text ?? "")
+            : "";
+      if (typeof text === "string" && text.startsWith("[Request interrupted"))
+        return false;
+      return true;
+    }
+  }
+  return false;
 }
 
 /** A folder's absolute forms: as given and its real path. */
@@ -236,6 +352,8 @@ export function claudeConversations(
       title: s.title,
       lastAt: new Date(f.mtimeMs).toISOString(),
       cwd,
+      ...(s.model ? { model: s.model } : {}),
+      ...(s.mcp.length ? { mcp: s.mcp } : {}),
     });
   }
   return out;

package/src/shared/agents/den-claude.ts

@@ -70,7 +70,11 @@ import { catalogFind } from "./catalog-runtime.js";
 import { locateRuntime, type RuntimeFind } from "./runtime-search.js";
 import { claudeProjectsDir } from "../usage/paths.js";
 import { cleanName, transcriptTitle } from "./transcript-follow.js";
-import { claudeConversations, transcriptSummary } from "./conversations.js";
+import {
+  claudeConversations,
+  transcriptBusy,
+  transcriptSummary,
+} from "./conversations.js";
 
 /**
  * `/rename "x"` keeps the quotes in customTitle: one matching pair around
@@ -507,6 +511,14 @@ export const denClaude: Runtime = {
       return null;
     }
   },
+  // AG-18: mid-turn, from its transcript's tail (never the whole file).
+  turnBusy(token, env = process.env) {
+    try {
+      return transcriptBusy(transcriptFile(token, env));
+    } catch {
+      return false;
+    }
+  },
   // AG-4b, unofficial (catalog sessionName): `/rename` appends a
   // {"type":"custom-title","customTitle":…} record to the transcript; the
   // latest one, read on from the last ask (never the whole file), less one

package/src/shared/agents/records.ts

@@ -103,6 +103,25 @@ export interface AgentRecord {
    * the list tags it. Start fresh and Relaunch keep the choices.
    */
   overrides?: Override[];
+  /**
+   * AG-18: each persona change, oldest first: from, to, when, and who (a
+   * person's sign-in, or "cli").
+   */
+  personaChanges?: PersonaChange[];
+  /**
+   * AG-18: a persona change waiting for this agent's turn to end. The wait
+   * lives in the server's memory, so a restart drops it; the upkeep at
+   * start clears this and audits the cancel (cancelStalePersonaChanges).
+   */
+  pendingPersona?: { to: string; since: string; by?: string };
+}
+
+/** One persona change of an agent (AG-18). */
+export interface PersonaChange {
+  from: string;
+  to: string;
+  at: string;
+  by?: string;
 }
 
 /** A setting a session can override for one launch (AG-10.9). */

package/src/shared/agents/runtime.ts

@@ -207,6 +207,11 @@ export interface Runtime {
   ): RuntimeConversation[];
   /** AG-17.1: the folder conversation `token` ran in, or null. Never throws. */
   conversationCwd?(token: string, env?: NodeJS.ProcessEnv): string | null;
+  /**
+   * AG-18: whether conversation `token` is mid-turn (den-claude: its
+   * transcript's tail). None: the runtime can't tell. Never throws.
+   */
+  turnBusy?(token: string, env?: NodeJS.ProcessEnv): boolean;
   /**
    * What the runtime prints when it exits at once (0.4.8): `noConversation`
    * when a resume finds nothing to continue, `idInUse` when a new

package/src/shared/github-app.ts

@@ -83,6 +83,13 @@ export function githubClientId(configured: string | undefined): string {
   return (configured ?? MO_DEN_GITHUB_CLIENT_ID).trim();
 }
 
+/**
+ * The docs section the signed-out page's Learn more opens (SEC-2a-UX):
+ * docs/distributions.md, "Signing in with GitHub", in the public repo.
+ */
+export const GITHUB_SIGNIN_DOCS =
+  "https://github.com/Monster-Orange/den/blob/main/docs/distributions.md#signing-in-with-github";
+
 /** What a GitHub button says while no client id is configured. */
 export function noClientIdMessage(cli: string): string {
   return (