@monster-orange/den 0.4.18 → 0.4.20

package/src/ui/cli/agent-ops.ts

@@ -78,6 +78,7 @@ import { envKey } from "../../shared/product.js";
 import { redactSecrets } from "../../shared/redact.js";
 import {
   loadPersonas,
+  serverPersona,
   resolvePackDirs,
   type Persona,
 } from "../../shared/agents/personas.js";
@@ -167,6 +168,11 @@ import {
   type BinSource,
 } from "../../shared/agents/runtime-search.js";
 import { WORKSPACE_NAME_RE } from "../../shared/agent-actor.js";
+import {
+  SERVER_PERSONA_ID,
+  isServerScope,
+  serverAgentDir,
+} from "../../shared/agents/server-agent.js";
 import {
   bindActorSession,
   mintActorToken,
@@ -333,7 +339,7 @@ function defaultMcpServer(cli: string): {
 
 export function resolveAgentsDeps(d: AgentsDeps): AgentsResolved {
   const base = resolveDeps(d);
-  return {
+  return withServerScope({
     ...base,
     agentsConfig: d.agentsConfig ?? (() => readAgentsConfig()),
     distRoot: d.distRoot ?? getDistRoot,
@@ -365,6 +371,26 @@ export function resolveAgentsDeps(d: AgentsDeps): AgentsResolved {
           ? setWorkspaceRuntimeBin(ws, id, bin)
           : setUserRuntimeBin(id, bin)),
     userConfigFile: d.userConfigFile ?? userConfigPath,
+  });
+}
+
+/**
+ * ON-6: the server agent's scope is no workspace, but its agent is a
+ * normal one: it "exists", and its folder is an empty one under the state
+ * dir (serverAgentDir), with no workspace runtime paths.
+ */
+function withServerScope(r: AgentsResolved): AgentsResolved {
+  return {
+    ...r,
+    workspaceExists: (ws) => isServerScope(ws) || r.workspaceExists(ws),
+    workspaceDir: (ws) =>
+      isServerScope(ws) ? serverAgentDir(r.stateDir()) : r.workspaceDir(ws),
+    workspaceFolders: (ws) =>
+      isServerScope(ws)
+        ? { under: [serverAgentDir(r.stateDir())] }
+        : r.workspaceFolders(ws),
+    workspaceRuntimeBin: (ws, id) =>
+      isServerScope(ws) ? undefined : r.workspaceRuntimeBin(ws, id),
   };
 }
 
@@ -685,14 +711,18 @@ function agentsConfig(d: AgentsResolved): ResolvedAgentsConfig {
 function personas(
   d: AgentsResolved,
   cfg: ResolvedAgentsConfig,
+  /** ON-6: the server scope adds Den's own server persona (only there). */
+  ws?: string,
 ): Map<string, Persona> {
   try {
-    return loadPersonas(
+    const all = loadPersonas(
       resolvePackDirs(cfg.personaPacks, d.distRoot()),
       undefined,
       { defaultPack: cfg.defaultPackGuardrails, packs: cfg.packGuardrails },
       localPersonasDir(d.stateDir()),
     );
+    if (isServerScope(ws)) all.set(SERVER_PERSONA_ID, serverPersona());
+    return all;
   } catch (e) {
     throw refused((e as Error).message, [], 422);
   }
@@ -1337,6 +1367,9 @@ function launchInput(
     rotateAfter: after,
     ...(perms.permission ? { permission: perms.permission } : {}),
     ...(perms.allow?.length ? { allow: [...perms.allow] } : {}),
+    // ON-6: the server agent runs Den's own tools without the runtime's
+    // prompt; its writes wait for the person's Allow in the browser.
+    ...(isServerScope(ws) ? { denToolsAllowed: true } : {}),
   };
 }
 
@@ -1573,7 +1606,7 @@ export async function startAgent(
   if (!d.workspaceExists(ws))
     throw usage(`${where}: workspace "${ws}" does not exist`, 404);
   const cfg = agentsConfig(d);
-  const all = personas(d, cfg);
+  const all = personas(d, cfg, ws);
   const persona = all.get(req.persona);
   if (!persona)
     throw usage(
@@ -2108,7 +2141,7 @@ export async function resumeAgent(
     );
   const cfg = agentsConfig(d);
   const grants = resumeGrants(rec, cfg);
-  const persona = personas(d, cfg).get(rec.persona);
+  const persona = personas(d, cfg, rec.workspace).get(rec.persona);
   if (!persona)
     throw refused(`agent ${rec.id}'s persona "${rec.persona}" is gone`);
   const det = await availableOrRefuse(d, rt, rec.workspace);
@@ -2312,7 +2345,7 @@ export async function changePersona(
   const where = "agents persona";
   const rec = agentRecord(d, id, ws);
   const cfg = agentsConfig(d);
-  const all = personas(d, cfg);
+  const all = personas(d, cfg, rec.workspace);
   if (!all.get(req.persona))
     throw usage(
       `${where}: no persona "${req.persona}" (personas: ${[...all.keys()].sort().join(", ")})`,
@@ -2747,7 +2780,9 @@ export async function markInterrupted(
     return found;
   }
   for (const rec of marked) {
-    const p = all.get(rec.persona);
+    const p = isServerScope(rec.workspace)
+      ? serverPersona()
+      : all.get(rec.persona);
     if (!p || !(p.standing || p.resumeOnRestart)) continue;
     if (resumeRefusal(rec)) continue;
     try {

package/src/ui/cli/create.ts

@@ -545,7 +545,7 @@ export async function createResult(
       return {
         ok: false,
         error,
-        fix: `npx ${ENGINE_PACKAGE} create ${args.name} ${path.join(path.dirname(args.dir), `${args.name}-den`)} --yes --json`,
+        fix: `npx ${ENGINE_PACKAGE}@latest create ${args.name} ${path.join(path.dirname(args.dir), `${args.name}-den`)} --yes --json`,
         ask: `${args.dir} already has files that are not a ${args.name} distribution. Which new or empty folder should the distribution go in?`,
       };
     return {
@@ -576,7 +576,7 @@ export async function runCreate(
         JSON.stringify({
           ok: false,
           error: (e as Error).message.split("\n")[0],
-          fix: `npx ${ENGINE_PACKAGE} create <name> [dir] --yes --json`,
+          fix: `npx ${ENGINE_PACKAGE}@latest create <name> [dir] --yes --json`,
         } satisfies CreateJson),
       );
     } else console.error(`create: ${(e as Error).message}`);

package/src/ui/cli/doctor-command.ts

@@ -37,8 +37,13 @@ import { readBrand } from "../../shared/brand.js";
 import { hasEdgeBlock, readEdgeConfig } from "../../shared/edge/config.js";
 import { edgeTlsWarnings, tlsStrategyFor } from "../../shared/edge/tls.js";
 import {
+  describeOpTokenSource,
+  opTokenSourceProblem,
+  parseOpTokenSource,
   readSecretsConfig,
+  resolveProviderName,
   secretsStatus,
+  type SecretsConfig,
 } from "../../shared/secrets/index.js";
 import {
   DEN_PTY_ID,
@@ -77,7 +82,22 @@ type Selector = (env: NodeJS.ProcessEnv) => DoctorRow;
 
 const SELECTORS: Record<string, Selector> = {
   secrets(env) {
-    const st = secretsStatus(readSecretsConfig(), env);
+    let cfg: SecretsConfig;
+    try {
+      cfg = readSecretsConfig();
+    } catch (err) {
+      // A bad secrets.* key (naming the key): a problem, not a crash.
+      return {
+        kind: "secrets",
+        selected: "",
+        implicit: false,
+        available: false,
+        reason: (err as Error).message,
+        problem: true,
+        warnings: [],
+      };
+    }
+    const st = secretsStatus(cfg, env);
     return {
       kind: "secrets",
       selected: st.backend,
@@ -172,7 +192,7 @@ export function doctorRows(env: NodeJS.ProcessEnv = process.env): DoctorRow[] {
     ...Object.keys(SELECTORS).filter((k) => kinds.includes(k)),
     ...kinds.filter((k) => !(k in SELECTORS)),
   ];
-  return ordered.map(
+  const rows = ordered.map(
     (kind) =>
       SELECTORS[kind]?.(env) ?? {
         kind,
@@ -184,6 +204,38 @@ export function doctorRows(env: NodeJS.ProcessEnv = process.env): DoctorRow[] {
         warnings: [],
       },
   );
+  const op = onePasswordTokenRow(env);
+  if (op) rows.splice(rows.findIndex((r) => r.kind === "secrets") + 1, 0, op);
+  return rows;
+}
+
+/**
+ * The 1password row: shown only when 1Password is the configured provider
+ * (secret_env refs and the engine's own secrets resolve through it) and the
+ * configured token source yields no token. A warning, not a failure: a
+ * signed-in desktop app needs none. Checks the source without reading a
+ * keychain secret, so nothing prompts.
+ */
+function onePasswordTokenRow(env: NodeJS.ProcessEnv): DoctorRow | null {
+  try {
+    const cfg = readSecretsConfig();
+    if (resolveProviderName(cfg, env) !== "1password") return null;
+    const src = parseOpTokenSource(cfg.onepassword?.token);
+    const why = opTokenSourceProblem(src, { env });
+    if (!why) return null;
+    return {
+      kind: "1password",
+      selected: describeOpTokenSource(src),
+      implicit: false,
+      available: false,
+      reason:
+        "this process has no service-account token. Set secrets.onepassword.token.",
+      problem: false,
+      warnings: [why],
+    };
+  } catch {
+    return null;
+  }
 }
 
 export function formatDoctor(rows: DoctorRow[], title: string): string[] {

package/src/ui/cli/index.ts

@@ -446,7 +446,7 @@ const COMMAND_HELP: Record<string, { usage: string; lines: string[] }> = {
       "create <name> [dir] [--title <title>] [--cli <cli>] [--env-prefix <PREFIX>]",
     lines: [
       "Scaffold a new distribution (den.yml, config, bin shim, Makefile) in [dir].",
-      "Also: npx @monster-orange/den create <name>. See docs/distributions.md.",
+      "Also: npx @monster-orange/den@latest create <name>. See docs/distributions.md.",
     ],
   },
   validate: {

package/src/ui/cli/repo-command.ts

@@ -60,6 +60,7 @@ import { ensureManagedServiceClone } from "../../shared/environment-manager/work
 import { getGitHubCoords } from "../../shared/smoke/git-remote.js";
 import {
   detectRunCommands,
+  draftHealthUrl,
   repoNameFrom,
   sidecarManifest,
   type DetectedCommands,
@@ -358,7 +359,13 @@ export function repoAdd(
           error: `cannot name a repo from the folder "${key}"`,
           fix: `${bin} repo add ${a.spec} --name <repo> --json`,
         };
-      const manifest = sidecarManifest(mName, d.commands, a.health);
+      // No --health: the dev server's own port, when its script names one,
+      // so the drafted service has a health check and a Visit link.
+      const manifest = sidecarManifest(
+        mName,
+        d.commands,
+        a.health ?? draftHealthUrl(repoPath, d.commands),
+      );
       const v = validate(manifest);
       const dry = a.dryRun
         ? {

package/src/ui/cli/repo-detect.ts

@@ -157,6 +157,64 @@ export function needsDocker(manifest: unknown, repoPath?: string): boolean {
   return repoPath ? composeFileOf(repoPath) !== undefined : false;
 }
 
+/**
+ * Dev servers' own default ports, by the command a package script runs.
+ * Only tools whose default is fixed and documented; anything else gets no
+ * port, and so no health URL.
+ */
+const DEV_SERVER_PORTS: ReadonlyArray<[RegExp, number]> = [
+  [/^next(\s+dev)?\b/, 3000],
+  [/^(vite|vite\s+dev|vite\s+serve)\b/, 5173],
+  [/^(nuxt|nuxi)\s+dev\b/, 3000],
+  [/^react-scripts\s+start\b/, 3000],
+  [/^ng\s+serve\b/, 4200],
+  [/^gatsby\s+develop\b/, 8000],
+  [/^remix\s+vite:dev\b/, 5173],
+  [/^webpack(-dev-server|\s+serve)\b/, 8080],
+];
+
+/** A port the command names itself: --port N, -p N, PORT=N. */
+function explicitPort(cmd: string): number | undefined {
+  const m =
+    /(?:^|\s)--port[=\s]+(\d{2,5})\b/.exec(cmd) ??
+    /(?:^|\s)-p\s+(\d{2,5})\b/.exec(cmd) ??
+    /(?:^|\s)PORT=(\d{2,5})\b/.exec(cmd);
+  const n = m ? Number(m[1]) : NaN;
+  return n > 0 && n < 65536 ? n : undefined;
+}
+
+/**
+ * The port a repo's dev server listens on, when its start command is a
+ * package script that names one or runs a dev server with a known default.
+ * Read-only: the script's text, never the running server.
+ */
+export function detectDevPort(
+  repoPath: string,
+  c: Pick<DetectedCommands, "up">,
+): number | undefined {
+  const scripts = readScripts(repoPath);
+  const m = /^npm\s+(?:run\s+(\S+)|(start))$/.exec(c.up.trim());
+  const script = m ? scripts[m[1] ?? "start"] : c.up;
+  if (!script) return undefined;
+  const own = explicitPort(script);
+  if (own) return own;
+  // The tool the script runs, after any VAR=value prefixes and npx.
+  const tool = script
+    .trim()
+    .replace(/^(?:[A-Z_][A-Z0-9_]*=\S*\s+)+/, "")
+    .replace(/^npx\s+(?:--yes\s+)?/, "");
+  return DEV_SERVER_PORTS.find(([re]) => re.test(tool))?.[1];
+}
+
+/** The health URL to draft: the dev server's own port, at `/`. */
+export function draftHealthUrl(
+  repoPath: string,
+  c: Pick<DetectedCommands, "up">,
+): string | undefined {
+  const port = detectDevPort(repoPath, c);
+  return port ? `http://localhost:${port}/` : undefined;
+}
+
 /** The side-car manifest for a repo Den detected. Validate before writing. */
 export function sidecarManifest(
   name: string,