@monster-orange/den 0.4.18 → 0.4.20

package/src/ui/server/public/shell.js

@@ -200,6 +200,8 @@
     "svp.startHere": "Start agent here",
     "svp.openSvc": "Open in Services",
     "svp.openGraph": "Open in Graph",
+    "graph.outside": "{s} is in {ws}, outside this View.",
+    "graph.showWs": "Show {ws}",
     "svp.close": "Close",
     "ag.new.folder": "Folder (optional)",
     "ag.new.folderHelp":
@@ -428,6 +430,10 @@
     "err.signin.step2":
       "This page signs you in by itself once approved. The code expires in 10 minutes.",
     "err.signin.waiting": "Waiting for approval…",
+    "err.signin.windowsSteps":
+      "Open Windows Terminal or PowerShell, paste this, and press Enter.",
+    "err.signin.nothingOpened":
+      "Nothing opened? Copy the command below and paste it into your terminal app.",
     "err.signin.noTerminal":
       "Don't have a terminal on {host}? From this computer, run:",
     "err.signin.openTerminal": "Open Terminal",
@@ -510,6 +516,7 @@
     "set.cli.web_port": "Your web port",
     "set.cli.signin": "Browser sign-in",
     "set.cli.sudo": "Admin password",
+    "set.cli.op_token": "1Password token source",
     "set.access.owner": "Owner",
     "set.access.devices": "Linked devices",
     "ident.local": "Local",
@@ -691,6 +698,8 @@
     "ap.do.repo_add.new":
       'Add the repo at {path} to a new workspace "{workspace}"',
     "ap.do.service_try": "Start {service}",
+    "ap.do.service_try.activates":
+      "Start {service} (this activates {workspace})",
     "ap.says": "Agent says:",
     "ap.review": "Review",
     "ap.hide": "Hide details",
@@ -833,6 +842,34 @@
     "ag.ws": "Workspace",
     "ag.pal": "Agents › {ws} / {name}",
     "ag.palStart": "Start agent…",
+    // ON-6: the server agent (server-agent-page.js, the rail, ⌘K).
+    "n.serverAgent": "__DEN_TITLE__ agent",
+    "ag.server": "Server",
+    "pal.askServer": "Ask __DEN_TITLE__",
+    "sa.sub.fresh":
+      "Let's set up __DEN_TITLE__. It reads only until you allow a write.",
+    "sa.sub":
+      "For anything about this server: add a repo, fix a failing service, change a setting, or explain what's running.",
+    "sa.login":
+      "If Claude asks you to log in, log in here. Then {name} starts.",
+    "sa.trust": "Claude asks whether to trust this folder. Choose Yes.",
+    "sa.model": "Model",
+    "sa.readsOnly":
+      "It acts only through __DEN_TITLE__'s own tools. Each change asks you first, in this browser.",
+    "sa.starting": "Starting the agent…",
+    "sa.idle": "{name} isn't running.",
+    "sa.start": "Start",
+    "sa.failed": "It didn't start: {why}. {cli} agents doctor says more.",
+    "sa.unread": "Couldn't read the agent's status. Is the web server running?",
+    "sa.none.h": "No runtime can run the agent yet",
+    "sa.none":
+      "The agent runs on an agent CLI from the runtime catalog. Install one, log in to it once, then reload this page.",
+    "sa.noTools": "can't use __DEN_TITLE__'s tools yet",
+    "sa.manual.h": "Or set it up yourself",
+    "sa.manual": "Every step the agent takes is also a command. In a terminal:",
+    "sa.runsOn": "Runs on",
+    "sa.openAgents": "Open in Agents",
+    "sa.saved": "Saved. The agent uses it from its next start.",
     "ag.cap": "Up to 4 panes: {id}'s closed to make room (it keeps running)",
     // AG-4b: the Agents tab's layouts and named tabs.
     "ag.layout": "Layout",
@@ -953,6 +990,9 @@
     agents:
       '<rect x="3" y="5" width="18" height="14" rx="2"/><path d="M7 10l3 2-3 2M12 15h5"/>',
     edge: '<path d="M12 3l8 4v5c0 4.5-3.4 8.3-8 9-4.6-.7-8-4.5-8-9V7z"/><path d="M8 12h8M12 8v8"/>',
+    // ON-6: the server agent, a speech bubble with a spark.
+    assistant:
+      '<path d="M5 5h14a1 1 0 0 1 1 1v9a1 1 0 0 1-1 1h-8l-4 3v-3H5a1 1 0 0 1-1-1V6a1 1 0 0 1 1-1z"/><path d="M12 8v4M10 10h4"/>',
     // SEC-2a: who this browser is (the rail footer's identity chip).
     person:
       '<circle cx="12" cy="8" r="3.5"/><path d="M5 20c.8-3.6 3.6-5.5 7-5.5s6.2 1.9 7 5.5"/>',
@@ -1813,6 +1853,16 @@
       href: "/agents",
       keywords: ["sessions", "terminal"],
     },
+    // ON-6: the server agent, this Den's own: one click away, after Agents.
+    {
+      id: "server-agent",
+      label: "n.serverAgent",
+      icon: "assistant",
+      group: "develop",
+      order: 18,
+      href: "/server-agent",
+      keywords: ["server agent", "ask", "setup", "onboarding"],
+    },
     {
       id: "services",
       label: "n.services",
@@ -1966,11 +2016,16 @@
     "</div>" +
     chips +
     "</header>" +
+    // The rail's box: no box of its own (display: contents). As ☰'s
+    // drawer it is the modal dialog the rail sits in, so the rail stays a
+    // nav (a <nav> may not be a dialog).
+    '<div class="den-rail-box" id="den-rail-box">' +
     '<nav class="den-rail" id="den-rail" aria-label="' +
     esc(t("pages")) +
-    '"></nav>';
+    '"></nav></div>';
 
   var nav = host.querySelector(".den-rail");
+  var railBox = host.querySelector(".den-rail-box");
 
   // ── the scope parts (R4) ───────────────────────────────────────────────
   // Each part's menu comes from its model, set by header.js: setOrgs (the
@@ -2593,8 +2648,9 @@
   function openDrawer() {
     document.body.classList.add("den-rail-open");
     if (menu) menu.setAttribute("aria-expanded", "true");
-    nav.setAttribute("role", "dialog");
-    nav.setAttribute("aria-modal", "true");
+    railBox.setAttribute("role", "dialog");
+    railBox.setAttribute("aria-modal", "true");
+    railBox.setAttribute("aria-label", t("pages"));
     if (!scrim) {
       scrim = document.createElement("div");
       scrim.className = "den-scrim";
@@ -2614,8 +2670,9 @@
     if (!drawerOpen()) return;
     document.body.classList.remove("den-rail-open");
     if (menu) menu.setAttribute("aria-expanded", "false");
-    nav.removeAttribute("role");
-    nav.removeAttribute("aria-modal");
+    railBox.removeAttribute("role");
+    railBox.removeAttribute("aria-modal");
+    railBox.removeAttribute("aria-label");
     if (scrim && scrim.remove) scrim.remove();
     setInert(false);
     if (refocus && menu) menu.focus();
@@ -4334,7 +4391,10 @@
   }
   function apWhat(a) {
     var p = a.params || {};
-    var key = "ap.do." + a.action + (p.isNew ? ".new" : "");
+    var key =
+      "ap.do." +
+      a.action +
+      (p.isNew ? ".new" : p.activates ? ".activates" : "");
     var s = t(key, p);
     if (s !== key) return s;
     s = String(a.summary || a.action);
@@ -4966,6 +5026,7 @@
     // ◐ ▾ (the prototype's user menu, an .ib: appearance.js)
     ".den-top .den-ib[aria-expanded='true'] { background: var(--sunken); color: var(--text); }",
     // Rail (.rail)
+    ".den-rail-box { display: contents; }",
     ".den-rail { position: fixed; left: 0; top: var(--den-top-h); bottom: 0; width: var(--den-rail-cw);",
     "  box-sizing: content-box; display: flex; flex-direction: column; padding: 10px 8px;",
     "  background: var(--surface); border-right: 1px solid var(--border); overflow-y: auto; z-index: 15;",

package/src/ui/server/public/svc-panel.js

@@ -43,8 +43,6 @@ const REFRESH_MS = 5_000;
  * does (lifecycle-exec.ts, readyTimeoutMs).
  */
 const START_TIMEOUT_MS = 120_000;
-/** A down check this soon after Start is the service still coming up. */
-const START_GRACE_MS = 10_000;
 /** Restart: an up check counts after a down one, or after this long. */
 const RESTART_MIN_MS = 5_000;
 /** Phone width: the panel is a bottom sheet. */
@@ -60,8 +58,9 @@ const S = {
   sessions: [],
   /**
    * Pin ids starting from here (Start or Restart): id → { at, cmd, sawDown,
-   * timer }. "starting…" follows the health feed, not the exec stream: a
-   * dev server's `up` never ends.
+   * ready, timer }. "starting…" follows the health feed, not the exec
+   * stream: a dev server's `up` never ends. While it is set, a down from
+   * health reads "starting…" too.
    */
   busy: new Map(),
   /** Pin ids with tests in flight from here. */
@@ -77,6 +76,7 @@ function startBusy(id, cmd) {
     at: Date.now(),
     cmd,
     sawDown: false,
+    ready: false,
     timer: setTimeout(() => {
       endBusy(id);
       sync();
@@ -91,23 +91,35 @@ function endBusy(id) {
 }
 /**
  * A health update for the pins starting from here: up ends "starting…"
- * (after Restart, once the old instance went down or after a moment);
- * down ends it once the service has had a moment to come up.
+ * (after Restart, once the old instance went down, after a moment, or once
+ * the server's ready watch said so). A down never ends it: the service is
+ * still coming up until the first up or the timeout.
  */
 function settleBusy() {
   for (const [id, b] of [...S.busy]) {
     const s = serviceOf(id);
     const age = Date.now() - b.at;
-    if (s.ok === false) {
-      b.sawDown = true;
-      if (age >= START_GRACE_MS) endBusy(id);
-    } else if (
+    if (s.ok === false) b.sawDown = true;
+    else if (
       s.ok === true &&
-      (b.cmd !== "restart" || b.sawDown || age >= RESTART_MIN_MS)
+      (b.cmd !== "restart" || b.ready || b.sawDown || age >= RESTART_MIN_MS)
     )
       endBusy(id);
   }
 }
+/**
+ * The exec stream's ready (the server's own health check passed) or its
+ * end. This page's health results can still hold a down from before (the
+ * forced refresh hasn't answered yet), so ready ends "starting…" only when
+ * they already say up, or there is no check; otherwise the next up does.
+ * An exec that ended in failure ends it now.
+ */
+function readyBusy(id, ok = true) {
+  const b = S.busy.get(id);
+  if (!b) return;
+  if (!ok || serviceOf(id).ok !== false) endBusy(id);
+  else b.ready = true;
+}
 
 /** The primary service of a repo from the health results (entrypoint first). */
 function primaryOf(repo) {
@@ -501,8 +513,9 @@ function exec(s, cmd) {
   if (cmd !== "down") startBusy(s.id, cmd);
   if (cmd === "down") window.denShell?.toast?.(t("svp.stopping", { s: s.id }));
   sync();
-  const settled = () => {
-    endBusy(s.id);
+  const settled = (ok = true) => {
+    readyBusy(s.id, ok);
+    sync();
     S.deps.refreshHealth?.(env(), { force: true });
     void refresh();
   };
@@ -510,7 +523,7 @@ function exec(s, cmd) {
     `/api/service/exec?${params}`,
     `${s.repo}/${s.service}`,
     `${cmd} ${s.repo}/${s.service}`,
-    { again: () => exec(s, cmd), ready: settled },
+    { again: () => exec(s, cmd), ready: () => settled(true) },
     settled,
   );
 }

package/src/ui/server/public/topbar.js

@@ -885,6 +885,8 @@ function paletteItems() {
     });
   }
   for (const x of palSessions) {
+    // ON-6: the server agent is "Ask <name>" below, not a workspace's.
+    if (x.server) continue;
     // AG-4b: the name a person gave the agent, else its persona.
     const base =
       x.kind === "agent" ? x.displayName || (x.persona ?? x.label) : x.label;
@@ -923,7 +925,7 @@ function paletteItems() {
   for (const ws of s?.workspaceNames?.() ?? [])
     if (!byWs.has(ws)) byWs.set(ws, []);
   for (const x of palSessions) {
-    if (!x.workspace) continue;
+    if (!x.workspace || x.server) continue;
     const names = byWs.get(x.workspace) ?? [];
     names.push(x.label, x.displayName ?? "", x.persona ?? "");
     byWs.set(x.workspace, names);
@@ -947,6 +949,16 @@ function paletteItems() {
       keywords: ["agents", "start", "persona"],
       run: () => go("/agents?start=1"),
     });
+  // ON-6: Ask <name>, the server agent's page.
+  const ask = s?.nav?.().find((n) => n.id === "server-agent");
+  if (ask)
+    items.push({
+      key: "agent:ask-server",
+      kind: "action",
+      label: t("pal.askServer"),
+      keywords: ["ask", "server agent", "agent", "help", "setup"],
+      run: () => go(ask.href),
+    });
   for (const c of s?.commands?.() ?? [])
     items.push({
       key: `cmd:${c.id}`,

package/src/ui/server/route-classes.ts

@@ -73,6 +73,8 @@ export const ROUTES: readonly RouteEntry[] = [
     "/graph.html",
     "/agents",
     "/agents.html",
+    "/server-agent",
+    "/server-agent.html",
     "/tests",
     "/index.html",
     "/services",
@@ -174,6 +176,10 @@ export const ROUTES: readonly RouteEntry[] = [
     "/api/sessions",
     "lists the sessions and agents (names and states, never their output)",
   ),
+  R(
+    "/api/server-agent",
+    "the server agent's name, runtime and state (ON-6): reads only",
+  ),
   R("/api/health", "runs the manifests' health probes: read-only checks"),
   R("/api/test-sources", "git rev-parse in each repo: read-only"),
   R("/api/manifest/validate", "GET validates a file at a path: read-only"),
@@ -389,6 +395,21 @@ export const ROUTES: readonly RouteEntry[] = [
     "/api/workspaces/:ws/agents",
     "starts an agent: a runtime in a PTY",
   ),
+  S(
+    ["POST"],
+    "/api/server-agent/start",
+    "starts the server agent (ON-6): a runtime in a PTY; never an agent's token",
+  ),
+  M(
+    ["POST"],
+    "/api/server-agent/runtime",
+    "the person's choice of the server agent's runtime (user.yml); never an agent's token",
+  ),
+  M(
+    ["POST"],
+    "/api/server-agent/model",
+    "the person's choice of the server agent's model (user.yml); never an agent's token",
+  ),
   S(
     ["POST"],
     "/api/workspaces/:ws/conversations/:id/import",

package/src/ui/server/server-agent-routes.ts

@@ -0,0 +1,176 @@
+/**
+ * The server agent's routes (ON-6):
+ *
+ *   GET  /api/server-agent          what it is, its runtime (or why none),
+ *                                   whether it runs, whether this Den is
+ *                                   fresh, and the manual path
+ *   POST /api/server-agent/start    { runtime? }: start it, or bring it
+ *                                   back (resume, relaunch); a person only
+ *   POST /api/server-agent/runtime  { runtime: id | null }: the person's
+ *                                   choice (user.yml agents.server_runtime)
+ *   POST /api/server-agent/model    { model: id | null }: the person's
+ *                                   model, one of the runtime's own
+ *                                   (user.yml agents.server_model)
+ *
+ * An agent never starts the server agent or picks its runtime: any agent
+ * credential or claim is refused (403).
+ */
+import type * as http from "http";
+import { HostError } from "../../shared/sessions/client.js";
+import { AgentError, type AgentsDeps } from "../cli/agent-ops.js";
+import {
+  serverAgentStatus,
+  setServerModel,
+  setServerRuntime,
+  startServerAgent,
+  type ServerAgentDeps,
+} from "../cli/server-agent-ops.js";
+import { webDeps } from "./agent-routes.js";
+import { recordAction } from "./audit.js";
+import { readBody, sendJson } from "./http-helpers.js";
+import {
+  agentPrincipalOf,
+  auditActorOf,
+  principalOf,
+} from "./request-guard.js";
+
+export interface ServerAgentRouteDeps {
+  agents?: AgentsDeps;
+  server?: ServerAgentDeps;
+}
+
+const MAX_BODY = 4 * 1024;
+
+function sendError(res: http.ServerResponse, e: unknown): void {
+  if (e instanceof AgentError) {
+    sendJson(
+      res,
+      {
+        ok: false,
+        error: e.message,
+        ...(e.code ? { code: e.code } : {}),
+        ...(e.hints.length ? { hints: e.hints } : {}),
+      },
+      e.status,
+    );
+    return;
+  }
+  if (e instanceof HostError) {
+    sendJson(res, { ok: false, error: e.message, code: "session_host" }, 503);
+    return;
+  }
+  sendJson(res, { ok: false, error: (e as Error).message }, 500);
+}
+
+async function body(
+  req: http.IncomingMessage,
+): Promise<{ runtime?: unknown; model?: unknown }> {
+  const raw = await readBody(req);
+  if (raw.length > MAX_BODY)
+    throw new AgentError("body too large", { status: 413 });
+  if (!raw.trim()) return {};
+  let b: unknown;
+  try {
+    b = JSON.parse(raw);
+  } catch {
+    throw new AgentError("body must be JSON", { usage: true });
+  }
+  if (!b || typeof b !== "object" || Array.isArray(b))
+    throw new AgentError("body must be an object", { usage: true });
+  return b as { runtime?: unknown; model?: unknown };
+}
+
+export async function handleServerAgentRoutes(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+  pathname: string,
+  deps: ServerAgentRouteDeps = {},
+): Promise<boolean> {
+  if (
+    pathname !== "/api/server-agent" &&
+    pathname !== "/api/server-agent/start" &&
+    pathname !== "/api/server-agent/runtime" &&
+    pathname !== "/api/server-agent/model"
+  )
+    return false;
+  const method = req.method ?? "GET";
+  const d = webDeps(deps.agents);
+  if (pathname === "/api/server-agent") {
+    if (method !== "GET" && method !== "HEAD") {
+      res.setHeader("Allow", "GET");
+      sendJson(res, { ok: false, error: "method not allowed" }, 405);
+      return true;
+    }
+    try {
+      sendJson(res, await serverAgentStatus(d, deps.server));
+    } catch (e) {
+      sendError(res, e);
+    }
+    return true;
+  }
+  if (method !== "POST") {
+    res.setHeader("Allow", "POST");
+    sendJson(res, { ok: false, error: "method not allowed" }, 405);
+    return true;
+  }
+  const actor = auditActorOf(req);
+  const verb = pathname.endsWith("/start")
+    ? "start"
+    : pathname.endsWith("/model")
+      ? "model"
+      : "runtime";
+  const audit = (detail: string, reason?: string) =>
+    recordAction(
+      actor,
+      {
+        verb: "server-agent",
+        detail,
+        ...(reason ? { outcome: "refused" as const, reason } : {}),
+      },
+      principalOf(req),
+    );
+  try {
+    // The person's: an agent's credential, or a claim to be one, never.
+    if (agentPrincipalOf(req) || actor)
+      throw new AgentError(
+        "only a person can start the server agent or pick its runtime or model",
+        { status: 403 },
+      );
+    const b = await body(req);
+    if (
+      b.runtime !== undefined &&
+      b.runtime !== null &&
+      typeof b.runtime !== "string"
+    )
+      throw new AgentError("runtime must be a runtime id", { usage: true });
+    if (verb === "model") {
+      if (b.model !== null && typeof b.model !== "string")
+        throw new AgentError("model must be a model id or null", {
+          usage: true,
+        });
+      const id = (b.model as string | null) ?? null;
+      await setServerModel(d, id, deps.server);
+      audit(id ? `model ${id}` : "model cleared");
+      sendJson(res, { ok: true, ...(await serverAgentStatus(d, deps.server)) });
+      return true;
+    }
+    if (verb === "runtime") {
+      const id = (b.runtime as string | null | undefined) ?? null;
+      setServerRuntime(id, deps.server);
+      audit(id ? `runtime ${id}` : "runtime cleared");
+      sendJson(res, { ok: true, ...(await serverAgentStatus(d, deps.server)) });
+      return true;
+    }
+    const s = await startServerAgent(
+      d,
+      typeof b.runtime === "string" ? { runtime: b.runtime } : {},
+      deps.server,
+    );
+    audit(`${s.how} on ${s.runtime}`);
+    sendJson(res, { ok: true, ...s });
+  } catch (e) {
+    audit(verb, (e as Error).message);
+    sendError(res, e);
+  }
+  return true;
+}

package/src/ui/server/session-routes.ts

@@ -35,6 +35,10 @@
  * with the actor from the credential.
  */
 import type * as http from "http";
+import {
+  SERVER_SCOPE,
+  isServerScope,
+} from "../../shared/agents/server-agent.js";
 import type { Duplex } from "stream";
 import {
   getActiveWorkspaces,
@@ -136,6 +140,8 @@ export interface ListedSession {
   /** `<dist>-<ws>:<name>`. */
   name: string;
   workspace: string;
+  /** ON-6: the server agent's row (its workspace is the server scope). */
+  server?: boolean;
   kind: "agent" | "session";
   /** The `<name>` part: an agent's id, a plain session's name. */
   label: string;
@@ -204,6 +210,8 @@ export function listedSessions(
   const dist = d.dist();
   const active = new Set(d.activeWorkspaces());
   if (also) active.add(also);
+  // ON-6: the server agent belongs to no workspace, and is always listed.
+  active.add(SERVER_SCOPE);
   const mine = sessions.filter((s) => {
     const p = parseSessionName(s.name, dist);
     return p !== null && active.has(p.workspace);
@@ -224,6 +232,7 @@ export function listedSessions(
       id: s?.ref.id ?? rec.session.id,
       name: s?.name ?? rec.sessionName,
       workspace: rec.workspace,
+      ...(isServerScope(rec.workspace) ? { server: true } : {}),
       kind: "agent",
       label: rec.id,
       agent: rec.id,
@@ -376,7 +385,9 @@ function servedSession(
   const p = parseSessionName(s.name, d.dist());
   return (
     p !== null &&
-    (active.has(p.workspace) || d.workspaceExists(p.workspace)) &&
+    (active.has(p.workspace) ||
+      isServerScope(p.workspace) ||
+      d.workspaceExists(p.workspace)) &&
     (s.ref.id === target || s.name === target)
   );
 }

package/src/ui/server/ui-assets.ts

@@ -48,6 +48,8 @@ export const UI_MODULES: readonly string[] = [
   "/i18n/es.js",
   // 0.4.17: one org and workspace rule for Environments and Releases.
   "/view-scope.js",
+  // ON-6: the server agent's page.
+  "/server-agent-page.js",
   // 0.4.18: the service panel (rail pins, Graph ⋯, Services names).
   "/svc-panel.js",
   // 0.4.18: where a service's live log comes from (Logs page and panel).

package/src/ui/server/workspace-routes.ts

@@ -7,6 +7,7 @@
  */
 
 import { hasRuntime, repoKind } from "../../shared/repo-kind.js";
+import { reservedWorkspaceError } from "../../shared/agents/server-agent.js";
 import { loadApplicationTree } from "../../shared/environment-manager/load-applications.js";
 import { localCommandsFor } from "../../shared/stacks/manifest-commands.js";
 import * as http from "http";
@@ -358,6 +359,8 @@ export function workspaceCreateRefusal(
   if (/["'\\/<>\x00-\x1f]/.test(name))
     return "name must not contain quotes, slashes, or control characters";
   if (name.length > 64) return "name must be 64 characters or fewer";
+  const reserved = reservedWorkspaceError(name);
+  if (reserved) return reserved;
   if (readWorkspacesFile().workspaces[name])
     return `workspace "${name}" already exists`;
   return null;