@monster-orange/den 0.4.15 → 0.4.17

package/src/ui/server/check-pool.ts

@@ -0,0 +1,72 @@
+/**
+ * How health checks run (0.4.17): at most CHECK_CONCURRENCY at once, each
+ * given at most CHECK_TIMEOUT_MS. A check that runs over its time gets the
+ * caller's stand-in result ("timed out after 10 s") rather than holding up
+ * the run, and the run never waits on it again.
+ */
+
+/** The most checks in flight at once. */
+export const CHECK_CONCURRENCY = 12;
+/** The longest one check may take, whatever its kind. */
+export const CHECK_TIMEOUT_MS = 10_000;
+
+/** What a check that ran out of time says. */
+export function timedOutText(ms: number): string {
+  return `timed out after ${Math.round(ms / 1000)} s`;
+}
+
+/**
+ * `p`, or `late()` once `ms` passes first. A late `p` that later settles
+ * is ignored, and so is its rejection.
+ */
+export function withTimeout<T>(
+  p: Promise<T>,
+  ms: number,
+  late: () => T,
+): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    let done = false;
+    const timer = setTimeout(() => {
+      if (done) return;
+      done = true;
+      resolve(late());
+    }, ms);
+    timer.unref?.();
+    p.then(
+      (v) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (e: unknown) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        reject(e);
+      },
+    );
+  });
+}
+
+/**
+ * `fn` over `items`, at most `limit` at a time, the results in the items'
+ * order. Each starts as soon as a slot frees up.
+ */
+export async function runCapped<T, R>(
+  items: readonly T[],
+  limit: number,
+  fn: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  const out = new Array<R>(items.length);
+  let next = 0;
+  const worker = async (): Promise<void> => {
+    while (next < items.length) {
+      const i = next++;
+      out[i] = await fn(items[i], i);
+    }
+  };
+  const n = Math.max(1, Math.min(limit, items.length));
+  await Promise.all(Array.from({ length: n }, worker));
+  return out;
+}

package/src/ui/server/github-routes.ts

@@ -98,7 +98,7 @@ function finishedMessage(v: FlowView, cli: string): string | undefined {
   switch (v.state) {
     case "refused":
       return v.purpose === "signin"
-        ? `@${v.login} isn't allowed on this Den. Ask the owner to add you.`
+        ? `@${v.login} isn't the owner of this Den. Only the owner's account can use Sign in with GitHub. Use Approve this computer instead.`
         : `An owner is linked already; \`${cli} web owner unlink\` first.`;
     case "expired":
       return "The code expired before it was approved. Start again.";

package/src/ui/server/index.ts

@@ -31,6 +31,8 @@ import { moduleScanner } from "../../shared/test-discovery/module-scanner.js";
 import { resolveFieldEnv } from "../../shared/perf/optional-fields.js";
 import { testRunner } from "../cli/test-runner.js";
 import { discoverRepos } from "../../pillars/smoke/discover.js";
+import { planSuites } from "../../pillars/suites/run.js";
+import { listServicesWithManifests } from "../../shared/manifest/workspace-manifests.js";
 import {
   awsProfileEnv,
   loadAwsProfiles,
@@ -244,6 +246,7 @@ import {
   githubClientId,
   githubEndpoints,
   noClientIdMessage,
+  GITHUB_SIGNIN_DOCS,
 } from "../../shared/github-app.js";
 import { githubDeviceClient } from "../../shared/github-device.js";
 import { readWebOwner } from "../../shared/web-owner.js";
@@ -855,6 +858,19 @@ import { heldActions } from "./held-actions.js";
 import type { ApprovalQueue } from "./approvals.js";
 import { processPathRules } from "../cli/onboard-reads.js";
 import { handleAgentRoutes, startAgentUpkeep } from "./agent-routes.js";
+import {
+  lastRunsByRepo,
+  recordRunEnd,
+  recordRunStart,
+  reposOfRun,
+} from "./run-history.js";
+import {
+  CHECK_CONCURRENCY,
+  CHECK_TIMEOUT_MS,
+  runCapped,
+  timedOutText,
+  withTimeout,
+} from "./check-pool.js";
 import {
   handleSessionList,
   handleSessionUpgrade,
@@ -1272,6 +1288,9 @@ function sshUserNow(): string {
   return sshUser(set, osUser);
 }
 
+/** Test runs this server is running now, by id (run-history.ts). */
+const LIVE_RUNS = new Set<string>();
+
 /** The ssh target for this request: the Host it used, minus the port. */
 function sshTargetOf(req: http.IncomingMessage): string {
   return sshTarget(req.headers.host, os.hostname());
@@ -1331,10 +1350,19 @@ function denEdgeRoutes(): { host: string; url: string }[] {
   }
 }
 
-/** What the signed-out page says about Sign in with GitHub. */
-function githubSigninState(): "ready" | "no_client_id" | "no_owner" {
-  if (!GITHUB_CLIENT_ID) return "no_client_id";
-  return readWebOwner(getStateDir()) ? "ready" : "no_owner";
+/**
+ * What the signed-out page says about Sign in with GitHub: its state, and
+ * (SEC-2a-UX) the owner's login once one is linked, for step 1's "Owner:
+ * @login".
+ */
+function githubSignin():
+  | { state: "no_client_id" | "no_owner" }
+  | { state: "ready"; ownerLogin: string } {
+  if (!GITHUB_CLIENT_ID) return { state: "no_client_id" };
+  const owner = readWebOwner(getStateDir());
+  return owner
+    ? { state: "ready", ownerLogin: owner.login }
+    : { state: "no_owner" };
 }
 
 /**
@@ -1426,6 +1454,7 @@ function sendSignedOut(
   const cmd = cliCommand(bin, "web", "login", ...loginArgs);
   const ssh = sshTargetOf(req);
   const user = sshUserNow();
+  const gh = githubSignin();
   res.setHeader("Cache-Control", "no-store");
   sendErrorPage(req, res, {
     status: 401,
@@ -1449,8 +1478,10 @@ function sendSignedOut(
       },
       // SEC-2a: Sign in with GitHub, and why it can't be offered yet.
       github: {
-        state: githubSigninState(),
+        state: gh.state,
         owner: cliCommand(bin, "web", "owner", "link"),
+        ...(gh.state === "ready" ? { ownerLogin: gh.ownerLogin } : {}),
+        learnMore: GITHUB_SIGNIN_DOCS,
         ...(GITHUB_CLIENT_ID
           ? {}
           : { message: noClientIdMessage(product().cli) }),
@@ -1956,8 +1987,10 @@ async function handleRequest(
   // AG-4a-term's session routes (`/api/sessions/<id>/io`): shell-grade, and
   // an agent's token reaches its own session's only (request-guard). The io
   // is a WebSocket (the server's upgrade handler): a plain GET of it is 426.
-  if (pathname.startsWith("/api/sessions/"))
-    return sendSessionHttp(req, res, pathname);
+  if (pathname.startsWith("/api/sessions/")) {
+    await sendSessionHttp(req, res, pathname);
+    return;
+  }
   // ON-3: an agent's held writes; Allow from the person's browser only.
   if (
     guard.ok &&
@@ -2769,15 +2802,55 @@ async function handleRequest(
     // Streaming emits in completion order, which varies per poll (shell probes
     // finish at wildly different speeds), so without a stable key the client
     // repaints the dots in a different order every 5s.
-    const results = await Promise.all(
-      sortedEntries.map((e, idx) =>
-        checkEntry(e).then((r) => {
-          const ranked = { ...r, openUrl: e.openUrl, links: e.links, idx };
-          onResult?.(ranked);
-          return ranked;
-        }),
+    // 0.4.17: at most CHECK_CONCURRENCY at once, each with at most
+    // CHECK_TIMEOUT_MS: a dead host's check says "timed out after 10 s" and
+    // never holds up the run (check-pool.ts).
+    const late = (e: (typeof sortedEntries)[number]): HealthResult => ({
+      repo: e.repo,
+      service: e.service,
+      label: e.label,
+      ...(e.checkType !== "none"
+        ? healthCheckFields(e.checkType, e.target)
+        : { url: null }),
+      repoPath: e.repoPath,
+      mode: e.mode,
+      isEntrypoint: e.isEntrypoint,
+      ...e.meta,
+      ms: CHECK_TIMEOUT_MS,
+      ok: false,
+      error: timedOutText(CHECK_TIMEOUT_MS),
+    });
+    const run = (e: (typeof sortedEntries)[number], idx: number) =>
+      withTimeout(checkEntry(e), CHECK_TIMEOUT_MS, () => late(e)).then((r) => {
+        const ranked = { ...r, openUrl: e.openUrl, links: e.links, idx };
+        onResult?.(ranked);
+        return ranked;
+      });
+    // Compose and container checks are answered in-process from one shared
+    // docker listing (the call in flight): they start no process, so they
+    // run outside the cap, all at once, and a cycle still lists once.
+    const inProcess = (e: (typeof sortedEntries)[number]) =>
+      (e.checkType === "container" && !!e.container) ||
+      (e.checkType === "shell" && !!e.compose && e.target === e.compose.cmd);
+    const indexed = sortedEntries.map((e, idx) => ({ e, idx }));
+    const results = new Array<HealthResult>(sortedEntries.length);
+    await Promise.all([
+      ...indexed
+        .filter(({ e }) => inProcess(e))
+        .map(({ e, idx }) =>
+          run(e, idx).then((r) => {
+            results[idx] = r;
+          }),
+        ),
+      runCapped(
+        indexed.filter(({ e }) => !inProcess(e)),
+        CHECK_CONCURRENCY,
+        ({ e, idx }) =>
+          run(e, idx).then((r) => {
+            results[idx] = r;
+          }),
       ),
-    );
+    ]);
     return results;
   }
 
@@ -3400,6 +3473,13 @@ async function handleRequest(
     return;
   }
 
+  // ── API: each repo's last test run (0.4.17, run-history.ts) ─────────────────
+  if (pathname === "/api/runs/last") {
+    return sendJson(res, {
+      repos: lastRunsByRepo(getStateDir(), LIVE_RUNS),
+    });
+  }
+
   // ── API: running daemons list ──────────────────────────────────────────────
   if (pathname === "/api/service/daemons") {
     await startupPrune;
@@ -3865,8 +3945,36 @@ async function handleRequest(
 
     const startTime = Date.now();
     let overallExit = 0;
+    // 0.4.17: the server's run history (every browser's runs, kept), which
+    // Workspaces' Last test run reads per repo.
+    // Every run kind that runs a repo's own tests names it, the suites
+    // pillar (`tests:`) and a repo's performance modules included.
+    const tested = await reposOfRun(String(pillar), String(env), modules, {
+      pillarSources: (p) =>
+        collectTestSources(p as Pillar).map((x) => x.repoName),
+      suiteRepos: (e, only) =>
+        planSuites(listServicesWithManifests(), e as Environment, only).run.map(
+          (x) => x.repo,
+        ),
+      perfModules: async () =>
+        (await moduleScanner.scanModules("performance")).map((m) => m.name),
+      repoNames: () => discoverRepos().map((r) => r.repoName),
+    });
+    LIVE_RUNS.add(runId);
+    recordRunStart(getStateDir(), {
+      id: runId,
+      pillar: String(pillar),
+      env: String(env),
+      repos: tested,
+    });
+    let recorded = false;
 
     const finishLifecycle = (exitCode: number, note?: string): void => {
+      if (!recorded) {
+        recorded = true;
+        LIVE_RUNS.delete(runId);
+        recordRunEnd(getStateDir(), runId, exitCode);
+      }
       const dur = formatDuration(Date.now() - startTime);
       const extra = note ? ` · ${note}` : "";
       serverLog(
@@ -4073,6 +4181,10 @@ async function handleRequest(
       actor: null,
       signedIn: false,
       ...(g && !g.beyond ? { identity: { kind: "local" } } : {}),
+      // SEC-2a-UX: the signed-out page watches this, so Sign in with
+      // GitHub appears once an owner is linked, with no reload. The
+      // owner's login is what that page shows anyway.
+      ...(g?.beyond || !g ? { github: githubSignin() } : {}),
     });
   }
   // Sign out: this browser's session ends and its cookie is cleared.