@monster-orange/den 0.4.16 → 0.4.18

package/CHANGELOG.md

@@ -4,6 +4,107 @@ All notable changes to Den are documented here. Each release lists the
 config and manifest changes a distribution must make to move to it under
 **Migrations**.
 
+## [0.4.18] - 2026-11-08
+
+### Added
+
+- **A pinned service opens a quick panel, not a page jump.** A click on a
+  pinned service's name in the rail (or Enter on its row, or its dot in
+  the collapsed rail) opens a panel beside the row, without leaving the
+  page. It has the service's workspace, state and URL; Visit ↗, Start or
+  Stop, Restart and Logs, which call what the Services page calls; the
+  repo's last test run with Run tests; the agents working in the repo,
+  each with Open, and Start agent here; and Open in Services, Open in
+  Graph and Unpin. It stays current while open. Esc or a click outside
+  closes it and focus goes back to the row. Under 640 px it is a bottom
+  sheet. ⌘-click or a middle click still opens Services in a new tab. The
+  Services card's name and the Graph card's new ⋯ open the same panel.
+- **Visit ↗ on every pinned row.** Always shown, it opens the service's
+  URL in a new tab. It is greyed out ("Not running") while the service is
+  down, and absent when the service has no URL. The hover × is gone:
+  Unpin is in the panel, and Delete on the row still unpins.
+- **Start agent here.** The Start dialog has a Folder field (optional):
+  the agent runs in that folder of the workspace's, or in a repo's
+  folder. The route takes it as `folder`, and refuses a folder outside
+  the workspace (403). The panel's Start agent here fills the workspace
+  and the repo's folder.
+- **Open in Graph focuses the service.** `/graph#focus=<repo>` or
+  `#focus=<repo>/<service>` opens the Graph on that card.
+
+### Fixed
+
+- **The panel's Logs reads the service's log.** It asks where the Logs
+  page asks (taillog for a local service), so a service with no `logs:`
+  block no longer says "Connection closed". The Services page's Logs
+  uses the same rule.
+- **"starting…" follows health.** After Start or Restart, the panel
+  leaves "starting…" once health says up, once it says down after a
+  moment, or after two minutes. Restart works again then, even when the
+  service's `up` never exits (a dev server).
+- **A pinned row's Visit ↗ greys out with the panel.** It reads the
+  panel's live state, so it greys out on the same health update, also
+  for a service outside the top bar's View.
+- **Open in Graph keeps its target.** The Graph page keeps the URL's
+  `#focus=` when it picks a workspace, so the card is focused and in view.
+
+## [0.4.17] - 2026-11-08
+
+### Fixed
+
+- **An agent's workspace is a link.** The agent pane's header and the
+  workspace's heading in the Agents list link to the Workspaces page
+  focused on it (`?ws=`). ⌘K has "Go to workspace <ws>" for every
+  workspace, the front agent's first on the Agents page, found by the
+  workspace's name or any of its agents'.
+- **"Last test run" is the server's.** The Workspaces page's "Last run"
+  column is now "Last test run", read from the server's run history
+  (`<state>/run-history.jsonl`, `GET /api/runs/last`). It shows runs from
+  every browser and survives a restart. The service's own state ("up 2h")
+  is shown apart from it.
+- **One org rule.** Environments and Releases have no org picker of their
+  own. Both follow the top bar's View and say so with the same note. A
+  page shows its own org picker only when it filters by org.
+- **Environments never waits on a slow host.** Every row shows at once,
+  pulsing "checking", and each result streams into its row. The server
+  runs at most 12 checks at once, each capped at 10 s; one that runs out
+  of time says "timed out after 10 s". Re-check works while checks run.
+- **An agent in an inactive workspace opens its terminal.** The terminal
+  route checks the person and the agent, not the workspace's active
+  flag. The pane says "Sign in" only when you're signed out; any other
+  refusal gives its real reason.
+- **Menus are never clipped.** Every ⋯ menu in the shell (Workspaces
+  rows and the workspace menu, the top bar's menus) now opens in the
+  browser's top layer through one shared helper, so a scrolling table or
+  card no longer cuts it off. It stays beside its button, flips up near
+  the bottom of the window, and closes on an outside click as before.
+- **The Tests module picker is never clipped.** It uses the same
+  top-layer menu.
+- **Visit ↗ opens a service.** Workspaces (beside Start, Stop, Restart
+  and Logs, and as a link on the service's name), Services and Graph
+  cards open the service's edge URL when it is routed, else its local
+  URL, in a new tab. A service with no URL has no Visit. Below 1600 px
+  wide the Workspaces button shows only "↗". The detail panel's "Open ↗"
+  is now "Visit ↗".
+- **Favourite a service from Workspaces and Graph.** Workspaces rows and
+  Graph cards (top-right) have the ☆ star. It uses the same list as
+  Services, so a favourite set on one page shows on all of them.
+- **Change persona on an agent that was never prompted** said "same
+  conversation", though there was nothing to resume: it starts fresh under
+  the same conversation id, as Resume does. The CLI, the API (`note`, with
+  `fresh: true`), the toast and the pane now say "nothing to resume yet;
+  started fresh (same conversation id, folder and scope)".
+- **Last test run counts a repo's own suites.** A run of the suites pillar
+  (a repo's `tests:`, such as `unit`) and a repo's performance modules
+  now name the repos they test, so a repo with only `tests: unit` fills
+  its Last test run. Den's own integration tests name none.
+- **The Workspaces table keeps its height in a short window.** Under about
+  620 px tall it shrank to nothing and its rows and ⋯ were out of reach.
+  It keeps at least 200 px and scrolls.
+
+### Migrations
+
+None.
+
 ## [0.4.16] - 2026-11-08
 
 ### Added

package/README.md

@@ -10,8 +10,8 @@
 </p>
 
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="docs/images/0.4.16/hero-dark.png">
-  <img src="docs/images/0.4.16/hero-light.png" width="100%" alt="Den's Graph page: the demo workspace's services grouped by application, all healthy, with the status chip and the left rail">
+  <source media="(prefers-color-scheme: dark)" srcset="docs/images/0.4.18/hero-dark.png">
+  <img src="docs/images/0.4.18/hero-light.png" width="100%" alt="Den's Graph page: the demo workspace's services grouped by application, all healthy, with the status chip and the left rail">
 </picture>
 
 ## Set up by your agent
@@ -38,7 +38,7 @@ It doesn't replace your tools. Your repos, Docker, your test runners, your secre
 yours. Den connects them and turns on good practice from the start.
 
 <p align="center">
-  <img src="docs/images/0.4.16/up.gif" width="100%" alt="make up in the Graph page: every stack down, then demo-api, demo-web and demo-notes come up in dependency order until the status chip reads All 3 healthy">
+  <img src="docs/images/0.4.18/up.gif" width="100%" alt="make up in the Graph page: every stack down, then demo-api, demo-web and demo-notes come up in dependency order until the status chip reads All 3 healthy">
 </p>
 
 ## How it helps
@@ -68,10 +68,10 @@ yours. Den connects them and turns on good practice from the start.
   lives in your own repo.
 
 <p align="center">
-  <img src="docs/images/0.4.16/agents.png" width="49%" alt="The Agents tab: the demo workspace's sessions on the left, and one open in a terminal pane on the right, running demo-api's test and then the service">
-  <img src="docs/images/0.4.16/workspaces.png" width="49%" alt="The Workspaces page: the demo workspace's repos with their health, mode and Start, Stop, Restart and Logs actions">
-  <img src="docs/images/0.4.16/status-drawer.png" width="49%" alt="The status drawer: nothing needs attention, and every service in the demo workspace, by application, with its latency">
-  <img src="docs/images/0.4.16/edge.png" width="49%" alt="The Edge page: the edge container up, its ports and TLS, and every route it serves, Den's own and each stack's, with its upstream">
+  <img src="docs/images/0.4.18/agents.png" width="49%" alt="The Agents tab: the demo workspace's sessions on the left, and one open in a terminal pane on the right, running demo-api's test and then the service">
+  <img src="docs/images/0.4.18/workspaces.png" width="49%" alt="The Workspaces page: the demo workspace's repos with their health, mode and Start, Stop, Restart and Logs actions">
+  <img src="docs/images/0.4.18/status-drawer.png" width="49%" alt="The status drawer: nothing needs attention, and every service in the demo workspace, by application, with its latency">
+  <img src="docs/images/0.4.18/edge.png" width="49%" alt="The Edge page: the edge container up, its ports and TLS, and every route it serves, Den's own and each stack's, with its upstream">
 </p>
 
 ## Get started

package/docs/distributions.md

@@ -355,6 +355,52 @@ is never mistaken for another repo's service. An alias that names more than
 one service is an error that lists them (`"worker" is ambiguous in workspace
 "default": one/worker, two/worker`); name one of them.
 
+## Opening a service
+
+A service with a URL gets **Visit ↗**, which opens it in a new tab. It
+shows on Workspaces (beside Start, Stop, Restart and Logs, and as a link
+on the service's name), on Services and on Graph cards. Den picks the
+URL in this order: the service's `urls.<env>`; for `local`, its edge
+route when the edge serves one; else the origin of its HTTP health
+check. A service with none of these has no Visit.
+
+The ☆ star on Workspaces rows, Services and Graph cards marks a
+favourite. It is one list, saved in `shell.pins`, so a star set on one
+page shows on all of them.
+
+### The service panel
+
+A pinned service in the rail has **↗** at the end of its row, always
+shown: it opens the service's URL in a new tab ("Visit <service> (opens a
+new tab)", the URL as its tooltip). It is greyed out, saying "Not
+running", while the service is down, and absent when the service has no
+URL.
+
+A click on the service's name (or Enter on its row, or its dot when the
+rail is collapsed) opens its **panel** beside the row, without leaving
+the page. ⌘-click, Ctrl-click or a middle click still opens Services in a
+new tab. Esc or a click outside closes it, and focus goes back to the
+row. Under 640 px wide it is a sheet at the bottom of the screen. The
+Services card's name and the Graph card's **⋯** open the same panel.
+
+Top to bottom, it has:
+
+- the name, workspace, health dot, state ("up 2h", "down: HTTP 502",
+  "starting…") and URL;
+- **Visit ↗**, then **Start** or **Stop**, **Restart** and **Logs**. These
+  call what the Services page calls (`/api/service/exec` with `up`,
+  `down` or `restart`, and `/api/service/logs`), each in a tab of the runs
+  dock. Logs opens the dock on that service;
+- **Last test run** (the server's run history, `GET /api/runs/last`) and
+  **Run tests**, which runs the repo's suites (`/api/run?pillar=suites`);
+- **Agents**: the agents working in the repo, each with **Open**, and
+  **+ Start agent here**, which opens the Start dialog with the workspace
+  and the repo's folder filled in;
+- **Open in Services**, **Open in Graph** and **Unpin** (or **Pin**).
+
+It stays current while it is open, from the same feeds the pages use. Delete
+on a pinned row still unpins it.
+
 ## Health checks
 
 A service declares its health per environment under `health`, in one of
@@ -432,6 +478,36 @@ that a container existed, running or not).
 `service`, with both forms at once, or with a key of another type (`cmd`,
 `url`), and says which.
 
+### The Environments page
+
+The Environments page lists every service's row at once, each cell pulsing
+"checking" until its result arrives. The results stream in one at a time
+(`GET /api/health/stream`, one event per check), so a slow host holds up
+its own cell only. The server runs at most 12 checks at once, and no check
+takes longer than 10 s. A check that runs out of time says "timed out after
+10 s" in its row. Re-check and the page's other controls work while the
+checks run.
+
+The page has no org picker of its own. It follows the top bar's View (all
+active workspaces, or one), asks for that workspace only, and says so:
+"Shows workspace south, as the top bar's View. Change it there." The
+Release page follows the same rule with the same note. A page shows its own
+org picker only when it filters by org.
+
+### Last test run
+
+The Workspaces page's "Last test run" column shows each repo's latest test
+run: its result (✓ or ✗), how long ago, and the pillar and environment on
+hover. It reads the server's run history, so it shows runs started from any
+browser or tab, and it survives a restart. The service's own state ("up 2h")
+is shown apart from it, in the Health cell.
+
+The history is `<state>/run-history.jsonl` (mode 0600): one line when a run
+starts and one when it ends. Past 2000 lines it keeps the newest 1000.
+`GET /api/runs/last` (read only) gives `{ repos: { <repo>: { id, pillar,
+env, repos, startedAt, endedAt, exitCode, running } } }`. A run a restart
+cut off has no end and is not shown.
+
 ## Placement
 
 Each service says where it runs, per environment: `local` (on this machine,
@@ -2355,6 +2431,11 @@ started. The workspace header counts them ("2 agents").
   `agents.runtimes.<id>.bin` to its path in <your user.yml>, or run
   `<cli> agents doctor`" (see [Runtimes](#runtimes)). Nothing fails only
   after Start.
+- **Folder** (optional) is where the agent runs: a folder inside the
+  workspace's own, or a repo's folder of the workspace (relative to the
+  workspace's folder, or absolute). Empty, it runs in the workspace's
+  folder. A folder outside the workspace is refused (403). The service
+  panel's **Start agent here** fills it with the repo's folder.
 - The page and the CLI call the same operations and read the same agent
   records, so an agent started in one is listed in the other. A workspace
   lists its own agents only.
@@ -2369,7 +2450,7 @@ started. The workspace header counts them ("2 agents").
 
 The routes: `GET /api/workspaces/<ws>/agents`, `POST
 /api/workspaces/<ws>/agents` (`{ persona, runtime?, model?, version?,
-permission?, allow?, instruction?, id? }`, see
+permission?, allow?, instruction?, id?, folder? }`, see
 [The Start dialog](#the-start-dialog)), `POST
 /api/workspaces/<ws>/agents/<id>/stop` and `…/resume`, `POST
 /api/workspaces/<ws>/sessions` (a plain session), `GET /api/personas`
@@ -2552,6 +2633,18 @@ text frame `{"type":"resize","cols":c,"rows":r}` resizes, and the server
 sends `{"type":"session",…}` first and `{"type":"exit","exitCode":n}` when
 the session ends.
 
+The terminal route checks the person and the agent, not whether the
+agent's workspace is active: an agent in a workspace you've switched away
+from still opens. A `GET` of the io path (not a WebSocket) says why one
+would be refused: `401` when you're signed out (the pane then says "Sign
+in"), `404` with the reason when there is no such session here, and `426`
+when the upgrade would be allowed. The pane shows that reason, not "Sign
+in", for any refusal but the first.
+
+The pane's header and the workspace's heading in the list link to the
+Workspaces page focused on that workspace (`/local-dev?ws=<ws>`), and ⌘K
+has "Go to workspace <ws>" for each workspace with agents.
+
 ### Stopped agents: Resume, Start fresh, Remove
 
 An agent that stops stays in the list, below the running ones (AG-14, the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monster-orange/den",
-  "version": "0.4.16",
+  "version": "0.4.18",
   "description": "Den: a local multi-repo dev orchestrator, HTTPS edge and E2E harness",
   "type": "module",
   "bin": {

package/src/ui/cli/agent-ops.ts

@@ -1409,6 +1409,12 @@ export interface StartRequest {
   allow?: unknown;
   /** AG-10.10: a display name for this agent (AG-4b's), to tell two apart. */
   name?: unknown;
+  /**
+   * 0.4.18, Start agent here: the folder it runs in, the workspace's own
+   * or one inside it (a repo's), relative to the workspace's folder or
+   * absolute. Default: the workspace's folder.
+   */
+  folder?: string;
   /**
    * The page's start (AG-10.1): a model must be one the runtime offers,
    * never a free string (the CLI's --model for generic stays free).
@@ -1524,6 +1530,39 @@ interface StartMore {
   bringIn?: { token: string; cwd: string };
 }
 
+/**
+ * 0.4.18: the folder a start runs in. Relative to the workspace's folder,
+ * or absolute; it must be a directory inside the workspace's scope (its
+ * folder, or a by-path repo's), never outside it.
+ */
+export function startFolder(
+  d: AgentsResolved,
+  ws: string,
+  folder: string,
+): string {
+  const where = "agents start";
+  if (typeof folder !== "string" || !folder.trim() || folder.length > 4096)
+    throw usage(`${where}: folder must be a path`);
+  const dir = path.resolve(d.workspaceDir(ws), folder.trim());
+  let real: string;
+  try {
+    real = fs.realpathSync(dir);
+  } catch {
+    throw usage(`${where}: folder ${dir} does not exist`, 404);
+  }
+  if (!fs.statSync(real).isDirectory())
+    throw usage(`${where}: folder ${dir} is not a directory`);
+  // The real folder only: a link inside the workspace that points out of
+  // it is outside it (the scope's own folders are compared real, too).
+  if (!inScope(real, d.workspaceFolders(ws)))
+    throw refused(
+      `${where}: folder ${dir} is not inside workspace ${ws}`,
+      [],
+      403,
+    );
+  return real;
+}
+
 export async function startAgent(
   d: AgentsResolved,
   req: StartRequest,
@@ -1571,6 +1610,10 @@ export async function startAgent(
       ...(rt.permissions ? { allow } : {}),
     }),
     ...(more.firstPrompt ? { firstPrompt: more.firstPrompt } : {}),
+    // 0.4.18: Start agent here: in a folder of the workspace's.
+    ...(req.folder !== undefined && !more.bringIn
+      ? { worktree: startFolder(d, ws, req.folder) }
+      : {}),
     // AG-17.1: the runtime's resume, in the folder the conversation ran in.
     ...(more.bringIn
       ? { worktree: more.bringIn.cwd, resumeToken: more.bringIn.token }
@@ -2212,6 +2255,13 @@ export interface PersonaChanged extends Resumed {
   from: string;
 }
 
+/**
+ * What a resume with nothing to continue yet says (AG-14, AG-18): the
+ * runtime started fresh under the same conversation id.
+ */
+export const FRESH_NOTE =
+  "nothing to resume yet; started fresh (same conversation id, folder and scope)";
+
 /** How often, and how long, "after this turn" checks its turn (AG-18). */
 export const TURN_POLL_MS = 1_000;
 export const TURN_WAIT_MS = 30 * 60_000;

package/src/ui/cli/agents-command.ts

@@ -95,6 +95,7 @@ import {
   type AgentsDeps,
   type AgentsResolved,
   type EarlyExit,
+  FRESH_NOTE,
   type RuntimeChoice,
   type Started,
 } from "./agent-ops.js";
@@ -420,7 +421,9 @@ async function persona(args: string[], d: AgentsResolved): Promise<number> {
   return report(
     d,
     s,
-    `agent ${s.rec.id} is now ${s.rec.persona} (was ${s.from}); same conversation, as ${s.rec.sessionName} in ${s.rec.cwd}`,
+    s.fresh
+      ? `agent ${s.rec.id} is now ${s.rec.persona} (was ${s.from}); ${FRESH_NOTE}, as ${s.rec.sessionName} in ${s.rec.cwd}`
+      : `agent ${s.rec.id} is now ${s.rec.persona} (was ${s.from}); same conversation, as ${s.rec.sessionName} in ${s.rec.cwd}`,
   );
 }
 
@@ -468,10 +471,7 @@ async function resume(args: string[], d: AgentsResolved): Promise<number> {
   if (args.includes("--all-interrupted")) return resumeAll(args, d);
   const { id, ws } = idAndWorkspace("agents resume", args);
   const s = await resumeAgent(d, id, ws);
-  if (s.fresh)
-    d.out(
-      `agent ${s.rec.id}: nothing to resume yet; started fresh (same conversation id, folder and scope)`,
-    );
+  if (s.fresh) d.out(`agent ${s.rec.id}: ${FRESH_NOTE}`);
   return report(
     d,
     s,

package/src/ui/server/agent-routes.ts

@@ -140,6 +140,7 @@ import {
   type AgentsDeps,
   type AgentsResolved,
   type Started,
+  FRESH_NOTE,
 } from "../cli/agent-ops.js";
 import { agentSessionName } from "../../shared/agents/session-name.js";
 import { recordAction } from "./audit.js";
@@ -314,6 +315,8 @@ interface StartBody {
   instruction?: unknown;
   /** AG-10.10: a display name, checked as a rename's is. */
   name?: unknown;
+  /** 0.4.18: the folder it runs in (Start agent here). */
+  folder?: string;
 }
 
 const START_KEYS = [
@@ -326,6 +329,7 @@ const START_KEYS = [
   "allow",
   "instruction",
   "name",
+  "folder",
 ];
 
 async function startBody(req: http.IncomingMessage): Promise<StartBody> {
@@ -373,6 +377,11 @@ async function startBody(req: http.IncomingMessage): Promise<StartBody> {
   if (o.instruction !== undefined) out.instruction = o.instruction;
   if (o.name !== undefined && o.name !== null && o.name !== "")
     out.name = o.name;
+  if (o.folder !== undefined && o.folder !== null && o.folder !== "") {
+    if (typeof o.folder !== "string" || o.folder.length > 4096)
+      throw new AgentError("folder must be a path", { usage: true });
+    out.folder = o.folder;
+  }
   return out as StartBody;
 }
 
@@ -584,6 +593,7 @@ export async function handleAgentRoutes(
           : {}),
         ...(body.allow !== undefined ? { allow: body.allow } : {}),
         ...(body.name !== undefined ? { name: body.name } : {}),
+        ...(body.folder !== undefined ? { folder: body.folder } : {}),
         strict: true,
       });
       const ov = s.rec.overrides?.length
@@ -714,7 +724,9 @@ export async function handleAgentRoutes(
       }
       const s = await change();
       audit(what, s.early ? "exited at once" : undefined);
-      sendStarted(res, s, d);
+      // Never prompted: nothing was resumed, so it says so (not "same
+      // conversation").
+      sendStarted(res, s, d, s.fresh ? { note: FRESH_NOTE } : {});
     } else if (verb === "remove") {
       const removed = await removeAgent(d, id!, ws);
       audit(what);

package/src/ui/server/check-pool.ts

@@ -0,0 +1,72 @@
+/**
+ * How health checks run (0.4.17): at most CHECK_CONCURRENCY at once, each
+ * given at most CHECK_TIMEOUT_MS. A check that runs over its time gets the
+ * caller's stand-in result ("timed out after 10 s") rather than holding up
+ * the run, and the run never waits on it again.
+ */
+
+/** The most checks in flight at once. */
+export const CHECK_CONCURRENCY = 12;
+/** The longest one check may take, whatever its kind. */
+export const CHECK_TIMEOUT_MS = 10_000;
+
+/** What a check that ran out of time says. */
+export function timedOutText(ms: number): string {
+  return `timed out after ${Math.round(ms / 1000)} s`;
+}
+
+/**
+ * `p`, or `late()` once `ms` passes first. A late `p` that later settles
+ * is ignored, and so is its rejection.
+ */
+export function withTimeout<T>(
+  p: Promise<T>,
+  ms: number,
+  late: () => T,
+): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    let done = false;
+    const timer = setTimeout(() => {
+      if (done) return;
+      done = true;
+      resolve(late());
+    }, ms);
+    timer.unref?.();
+    p.then(
+      (v) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (e: unknown) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        reject(e);
+      },
+    );
+  });
+}
+
+/**
+ * `fn` over `items`, at most `limit` at a time, the results in the items'
+ * order. Each starts as soon as a slot frees up.
+ */
+export async function runCapped<T, R>(
+  items: readonly T[],
+  limit: number,
+  fn: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  const out = new Array<R>(items.length);
+  let next = 0;
+  const worker = async (): Promise<void> => {
+    while (next < items.length) {
+      const i = next++;
+      out[i] = await fn(items[i], i);
+    }
+  };
+  const n = Math.max(1, Math.min(limit, items.length));
+  await Promise.all(Array.from({ length: n }, worker));
+  return out;
+}