@monster-orange/den 0.4.19 → 0.4.21

package/src/ui/cli/create.ts

@@ -13,6 +13,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { execFileSync } from "node:child_process";
 import { ENGINE_PACKAGE, getEngineRoot } from "../../shared/paths.js";
 import { profileFrom } from "../../shared/profile.js";
 import { parse as parseYaml } from "yaml";
@@ -31,6 +32,44 @@ export interface CreateOptions {
   envPrefix?: string;
   /** The Den version the distribution pins (exact). */
   denVersion: string;
+  /**
+   * D17: `web.allowed_github_org`: the GitHub org whose members may claim
+   * an instance of it (each developer's own). Unset: a commented line.
+   */
+  githubOrg?: string;
+}
+
+const GITHUB_ORG = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+
+/**
+ * The GitHub owner of a git remote URL (https or ssh), or null:
+ * `git@github.com:acme/acme-den.git` → `acme`.
+ */
+export function githubOwnerOfRemote(url: string): string | null {
+  const m =
+    /^(?:https?:\/\/(?:[^@/]+@)?github\.com\/|(?:ssh:\/\/)?git@github\.com[:/])([^/]+)\//i.exec(
+      url.trim(),
+    );
+  return m && GITHUB_ORG.test(m[1]) ? m[1] : null;
+}
+
+/**
+ * The GitHub owner of the repo `dir` is in (its nearest existing folder's
+ * `origin`), or null: no repo, no origin, not GitHub.
+ */
+export function githubOrgOfDir(dir: string): string | null {
+  let d = path.resolve(dir);
+  while (!fs.existsSync(d) && path.dirname(d) !== d) d = path.dirname(d);
+  try {
+    const url = execFileSync("git", ["-C", d, "remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5_000,
+    });
+    return githubOwnerOfRemote(url);
+  } catch {
+    return null;
+  }
 }
 
 const NAME = /^[a-z][a-z0-9-]*$/;
@@ -58,6 +97,10 @@ export function validateCreateOptions(opts: CreateOptions): void {
     throw new Error("--title must not be empty");
   if (opts.title !== undefined && /[\n"\\]/.test(opts.title))
     throw new Error("--title must be one line without quotes or backslashes");
+  if (opts.githubOrg !== undefined && !GITHUB_ORG.test(opts.githubOrg))
+    throw new Error(
+      `--github-org "${opts.githubOrg}" must be a GitHub org name (letters, digits and dashes)`,
+    );
   // The profile validates the env prefix the same way den.yml would.
   profileFrom({
     name: opts.name,
@@ -152,6 +195,13 @@ export function renderDistribution(
     "# Unset, Den lists no GitHub repos (and never calls gh for them). E.g.",
     "# github_org: example-org",
     "",
+    "# Who may claim an instance. Each developer runs their own and opens it",
+    "# in the browser; a member of this GitHub org connects their GitHub",
+    "# account there, on their own computer, and owns that instance.",
+    ...(opts.githubOrg
+      ? ["web:", `  allowed_github_org: ${opts.githubOrg}`]
+      : ["# web:", "#   allowed_github_org: your-github-org"]),
+    "",
     "# Secrets backend: none (this distribution needs no secrets store), or",
     "# env (plain environment variables), doppler or 1password. A backend's",
     "# refs say where Den's own features find their secrets, e.g.",
@@ -307,8 +357,14 @@ export interface ParsedCreateArgs extends Omit<CreateOptions, "denVersion"> {
   port?: number;
 }
 
+/** Where create finds web.allowed_github_org when --github-org isn't given. */
+export interface CreateOrgOptions {
+  /** The GitHub owner of the repo the new folder is in (default: git's). */
+  githubOrgOf?: (dir: string) => string | null;
+}
+
 const CREATE_USAGE =
-  "usage: den create <name> [dir] [--title <title>] [--cli <cli>] [--env-prefix <PREFIX>] [--port <n>] [--yes] [--json]";
+  "usage: den create <name> [dir] [--title <title>] [--cli <cli>] [--env-prefix <PREFIX>] [--port <n>] [--github-org <org>] [--yes] [--json]";
 
 /** Parse `create` argv (after the word `create`). `cwd` resolves the dir. */
 export function parseCreateArgs(argv: string[], cwd: string): ParsedCreateArgs {
@@ -326,7 +382,7 @@ export function parseCreateArgs(argv: string[], cwd: string): ParsedCreateArgs {
       json = true;
       continue;
     }
-    const m = /^--(title|cli|env-prefix|port)(?:=(.*))?$/.exec(a);
+    const m = /^--(title|cli|env-prefix|port|github-org)(?:=(.*))?$/.exec(a);
     if (m) {
       const value = m[2] ?? argv[++i];
       if (value === undefined)
@@ -345,6 +401,9 @@ export function parseCreateArgs(argv: string[], cwd: string): ParsedCreateArgs {
     title: flags.title,
     cli: flags.cli,
     envPrefix: flags["env-prefix"],
+    ...(flags["github-org"] !== undefined
+      ? { githubOrg: flags["github-org"].replace(/^@/, "") }
+      : {}),
     yes,
     json,
     ...(flags.port !== undefined ? { port: parsePortFlag(flags.port) } : {}),
@@ -370,6 +429,9 @@ config/environments/local.json, manifests/ and tests/pillars/.
   --env-prefix <PREFIX>  env-var prefix (default: <NAME>)
   --port <n>             the web UI's port (default: ${DEFAULT_PORT}, or the next
                          free one above it when that is in use)
+  --github-org <org>     web.allowed_github_org: members of this GitHub org
+                         connect their GitHub account to their own instance
+                         (default: the owner of the GitHub repo [dir] is in)
   --yes, -y              never prompt (create never does; for agents)
   --json                 print one JSON object: { ok, dir, cli, existed, port, next }
 
@@ -407,6 +469,8 @@ export interface CreateJson {
   port?: number;
   /** Set when DEFAULT_PORT was in use and `port` was picked instead. */
   portPicked?: { wanted: number; file: string };
+  /** D17: web.allowed_github_org as written, or null when it wasn't known. */
+  githubOrg?: string | null;
   next?: string[];
   error?: string;
   fix?: string;
@@ -478,12 +542,17 @@ export async function createResult(
   args: ParsedCreateArgs,
   cwd: string,
   denVersion: string = runningDenVersion(),
-  portOpts: CreatePortOptions = {},
+  portOpts: CreatePortOptions & CreateOrgOptions = {},
 ): Promise<CreateJson> {
   const cli = args.cli ?? args.name;
-  const next = (dir: string): string[] => [
+  const next = (dir: string, org?: string | null): string[] => [
     `cd ${cdPathFor(cwd, dir)}`,
     "npm install",
+    ...(org === null
+      ? [
+          `set web.allowed_github_org: <your GitHub org> in config/${args.name}.yml (who may claim an instance)`,
+        ]
+      : []),
     `./bin/${cli} repo add <path|git-url> --json`,
   ];
   try {
@@ -509,7 +578,17 @@ export async function createResult(
       args.port ??
       (await pickFreePort({ start: wanted, inUse: portOpts.inUse })) ??
       wanted;
-    const written = writeDistribution(args.dir, { ...args, denVersion });
+    // D17: the org whose members may claim an instance: --github-org, else
+    // the owner of the GitHub repo the folder is in.
+    const githubOrg =
+      args.githubOrg ??
+      (portOpts.githubOrgOf ?? githubOrgOfDir)(args.dir) ??
+      undefined;
+    const written = writeDistribution(args.dir, {
+      ...args,
+      denVersion,
+      ...(githubOrg ? { githubOrg } : {}),
+    });
     let portPicked: CreateJson["portPicked"];
     // Written when the port differs from what the distribution would use
     // anyway (an explicit --port that isn't the default, or a picked one).
@@ -537,7 +616,8 @@ export async function createResult(
       files: written.length,
       port,
       ...(portPicked ? { portPicked } : {}),
-      next: next(args.dir),
+      githubOrg: githubOrg ?? null,
+      next: next(args.dir, githubOrg ?? null),
     };
   } catch (e) {
     const error = (e as Error).message;
@@ -602,6 +682,12 @@ export async function runCreate(
       ? `Web UI port: ${r.port} (${r.portPicked.wanted} is in use here; set in ${r.portPicked.file}).`
       : `Web UI port: ${r.port}.`,
   );
+  if (!r.existed)
+    console.log(
+      r.githubOrg
+        ? `GitHub org: ${r.githubOrg} (web.allowed_github_org: its members connect their GitHub account to their own instance).`
+        : `GitHub org: not known. Set web.allowed_github_org in config/${args.name}.yml, or pass --github-org <org>, so your team can connect GitHub from the browser.`,
+    );
   console.log("");
   console.log("Next:");
   console.log(`  cd ${cdPathFor(cwd, dir)}`);

package/src/ui/cli/doctor-command.ts

@@ -37,8 +37,13 @@ import { readBrand } from "../../shared/brand.js";
 import { hasEdgeBlock, readEdgeConfig } from "../../shared/edge/config.js";
 import { edgeTlsWarnings, tlsStrategyFor } from "../../shared/edge/tls.js";
 import {
+  describeOpTokenSource,
+  opTokenSourceProblem,
+  parseOpTokenSource,
   readSecretsConfig,
+  resolveProviderName,
   secretsStatus,
+  type SecretsConfig,
 } from "../../shared/secrets/index.js";
 import {
   DEN_PTY_ID,
@@ -46,6 +51,7 @@ import {
 } from "../../shared/sessions/den-pty.js";
 import {
   getStrategy,
+  strategyIds,
   strategyKinds,
 } from "../../shared/strategies/registry.js";
 import {
@@ -60,6 +66,7 @@ import {
   type OnboardDeps,
 } from "./doctor-onboard.js";
 import { printJson } from "./json-out.js";
+import { ownerCheck, ownerLine } from "./doctor-owner.js";
 
 export interface DoctorRow {
   kind: string;
@@ -77,7 +84,22 @@ type Selector = (env: NodeJS.ProcessEnv) => DoctorRow;
 
 const SELECTORS: Record<string, Selector> = {
   secrets(env) {
-    const st = secretsStatus(readSecretsConfig(), env);
+    let cfg: SecretsConfig;
+    try {
+      cfg = readSecretsConfig();
+    } catch (err) {
+      // A bad secrets.* key (naming the key): a problem, not a crash.
+      return {
+        kind: "secrets",
+        selected: "",
+        implicit: false,
+        available: false,
+        reason: (err as Error).message,
+        problem: true,
+        warnings: [],
+      };
+    }
+    const st = secretsStatus(cfg, env);
     return {
       kind: "secrets",
       selected: st.backend,
@@ -172,32 +194,91 @@ export function doctorRows(env: NodeJS.ProcessEnv = process.env): DoctorRow[] {
     ...Object.keys(SELECTORS).filter((k) => kinds.includes(k)),
     ...kinds.filter((k) => !(k in SELECTORS)),
   ];
-  return ordered.map(
-    (kind) =>
-      SELECTORS[kind]?.(env) ?? {
-        kind,
-        selected: "",
-        implicit: false,
-        available: false,
-        reason: "no selector for this kind",
-        problem: false,
-        warnings: [],
-      },
+  const rows = ordered.map(
+    (kind) => SELECTORS[kind]?.(env) ?? everyStrategyRow(kind, env),
   );
+  const op = onePasswordTokenRow(env);
+  if (op) rows.splice(rows.findIndex((r) => r.kind === "secrets") + 1, 0, op);
+  return rows;
+}
+
+/**
+ * A kind no config selects one of (usage sources, D9): every registered
+ * strategy is in use, so the row names them all (implicit) and is available
+ * when any is. Never a problem: nothing was configured wrong. (It said
+ * "(invalid config) ✗ no selector for this kind" on every fresh install.)
+ */
+function everyStrategyRow(kind: string, env: NodeJS.ProcessEnv): DoctorRow {
+  const ids = strategyIds(kind);
+  const found = ids.map((id) => {
+    try {
+      return getStrategy(kind, id)?.detect(env) ?? { available: false };
+    } catch (e) {
+      return { available: false, reason: (e as Error).message };
+    }
+  });
+  const available = found.some((d) => d.available);
+  return {
+    kind,
+    selected: ids.join(", "),
+    implicit: true,
+    available,
+    reason: available
+      ? undefined
+      : found
+          .map((d) => d.reason)
+          .filter(Boolean)
+          .join("; ") || undefined,
+    problem: false,
+    warnings: [],
+  };
+}
+
+/**
+ * The 1password row: shown only when 1Password is the configured provider
+ * (secret_env refs and the engine's own secrets resolve through it) and the
+ * configured token source yields no token. A warning, not a failure: a
+ * signed-in desktop app needs none. Checks the source without reading a
+ * keychain secret, so nothing prompts.
+ */
+function onePasswordTokenRow(env: NodeJS.ProcessEnv): DoctorRow | null {
+  try {
+    const cfg = readSecretsConfig();
+    if (resolveProviderName(cfg, env) !== "1password") return null;
+    const src = parseOpTokenSource(cfg.onepassword?.token);
+    const why = opTokenSourceProblem(src, { env });
+    if (!why) return null;
+    return {
+      kind: "1password",
+      selected: describeOpTokenSource(src),
+      implicit: false,
+      available: false,
+      reason:
+        "this process has no service-account token. Set secrets.onepassword.token.",
+      problem: false,
+      warnings: [why],
+    };
+  } catch {
+    return null;
+  }
 }
 
 export function formatDoctor(rows: DoctorRow[], title: string): string[] {
   const lines = [chalk.bold(`${title} doctor: strategies`), ""];
   const width = Math.max(...rows.map((r) => r.kind.length));
-  for (const r of rows) {
-    const sel = r.selected
+  const selOf = (r: DoctorRow) =>
+    r.selected
       ? `${r.selected}${r.implicit ? " (implicit)" : ""}`
       : "(invalid config)";
+  // The state column lines up even past 20 ("den-claude (implicit)").
+  const selWidth = Math.max(20, ...rows.map((r) => selOf(r).length));
+  for (const r of rows) {
+    const sel = selOf(r);
     const state = r.available
       ? chalk.green("✓ available")
       : (r.problem ? chalk.red : chalk.yellow)("✗ unavailable");
     lines.push(
-      `  ${r.kind.padEnd(width)}  ${sel.padEnd(20)} ${state}${r.reason ? `: ${r.reason}` : ""}`,
+      `  ${r.kind.padEnd(width)}  ${sel.padEnd(selWidth)} ${state}${r.reason ? `: ${r.reason}` : ""}`,
     );
     for (const w of r.warnings) lines.push(chalk.yellow(`    ⚠ ${w}`));
   }
@@ -295,10 +376,13 @@ export function strategyCheck(r: DoctorRow): OnboardCheck {
 export async function doctorJson(
   deps: OnboardDeps,
   rows: DoctorRow[] = doctorRows(),
+  owner: () => Promise<OnboardCheck> = () => ownerCheck(),
 ): Promise<{ ok: boolean; checks: OnboardCheck[] }> {
   const checks = [
     ...(await onboardingChecks(deps)),
     ...rows.map(strategyCheck),
+    // D17: who can connect GitHub to this instance from the browser.
+    await owner(),
   ];
   return { ok: !checks.some((c) => c.status === "fail"), checks };
 }
@@ -338,6 +422,11 @@ export async function cmdDoctor(args: string[]): Promise<number> {
   for (const l of formatDoctor(rows, readBrand().name)) console.log(l);
   const held = approvalsLines(() => readMcpConfig().approvals);
   for (const l of held.lines) console.log(l);
+  // D17: who can connect GitHub to this instance from the browser.
+  const owner = await ownerCheck();
+  console.log("");
+  console.log(ownerLine(owner));
+  const ownerProblem = owner.status === "fail";
   for (const l of pollingLines(eventsFile(), readBrand().name)) console.log(l);
   const cli = product().cli;
   if (!probe) {
@@ -346,7 +435,7 @@ export async function cmdDoctor(args: string[]): Promise<number> {
       agentsConfigured(readConfigOrNull(), getStateDir()),
     ))
       console.log(l);
-    return rows.some((r) => r.problem) || held.problem ? 1 : 0;
+    return rows.some((r) => r.problem) || held.problem || ownerProblem ? 1 : 0;
   }
   const { runEnvProbe, formatProbe } = await import("./env-probe.js");
   const { resolveDeps, plainSessionEnv } =
@@ -365,5 +454,7 @@ export async function cmdDoctor(args: string[]): Promise<number> {
   console.log("");
   for (const l of formatProbe(results)) console.log(l);
   const found = results.some((r) => r.findings.length);
-  return rows.some((r) => r.problem) || held.problem || found ? 1 : 0;
+  return rows.some((r) => r.problem) || held.problem || ownerProblem || found
+    ? 1
+    : 0;
 }

package/src/ui/cli/doctor-owner.ts

@@ -0,0 +1,122 @@
+/**
+ * doctor's owner check (D17): who can connect their GitHub account to this
+ * instance from the browser.
+ *
+ *  - An owner is linked: ok, naming it.
+ *  - No owner, but web.owner_github or web.allowed_github_org says who may
+ *    claim it: ok, naming them.
+ *  - Neither, and the edge is reachable from other machines: ✗ (a fail):
+ *    nobody can get in from a browser there, and the page can only name
+ *    the settings.
+ *  - Neither, edge not reachable beyond this machine: a warning.
+ */
+import { readWebOwner } from "../../shared/web-owner.js";
+import {
+  readWebAuthConfig,
+  type WebAuthConfig,
+} from "../../shared/web-session.js";
+import { getDistRoot, getStateDir } from "../../shared/paths.js";
+import { product } from "../../shared/product.js";
+import { readEdgeConfig, readWebPort } from "../../shared/edge/config.js";
+import { edgeNames, webRouteHosts } from "../../shared/edge/render.js";
+import { edgeExposure } from "../../shared/edge/exposure.js";
+import type { OnboardCheck } from "./doctor-onboard.js";
+import { ghLogin, ghNotSignedInHint } from "../../shared/owner-github.js";
+
+export interface OwnerCheckDeps {
+  owner?: () => { login: string } | null;
+  web?: () => WebAuthConfig;
+  /** Why the edge is reachable beyond this machine, or null. */
+  exposed?: () => Promise<string | null>;
+  configFile?: string;
+  /** The login gh is signed in as here, or null (default: ask gh). */
+  ghLogin?: () => string | null;
+}
+
+/**
+ * What to do when web.owner_github isn't set: gh is signed in but nothing
+ * recorded it yet (a restart does), or gh isn't signed in.
+ */
+export function ownerGithubHint(login: string | null, cli: string): string {
+  return login
+    ? `gh is signed in as @${login}: run \`${cli} web restart\` to record it as this Den's owner (web.owner_github), then connect your GitHub account from any browser.`
+    : ghNotSignedInHint(cli);
+}
+
+async function defaultExposed(): Promise<string | null> {
+  try {
+    const cfg = readEdgeConfig();
+    const hosts = webRouteHosts(cfg, new Set([readWebPort()])).map(
+      (r) => r.host,
+    );
+    return await edgeExposure(
+      hosts,
+      cfg.ports ? edgeNames(cfg.org).container : null,
+    );
+  } catch {
+    return null; // no edge
+  }
+}
+
+export async function ownerCheck(
+  deps: OwnerCheckDeps = {},
+): Promise<OnboardCheck> {
+  const owner = (deps.owner ?? (() => readWebOwner(getStateDir())))();
+  if (owner)
+    return {
+      id: "web:owner",
+      status: "ok",
+      detail: `owner: @${owner.login} (linked; Sign in with GitHub from any browser)`,
+    };
+  let web: WebAuthConfig;
+  try {
+    web = (
+      deps.web ?? (() => readWebAuthConfig(getDistRoot(), product().configFile))
+    )();
+  } catch (e) {
+    return { id: "web:owner", status: "fail", detail: (e as Error).message };
+  }
+  const configFile = deps.configFile ?? product().configFile;
+  const who = [
+    ...(web.ownerGithub
+      ? [`@${web.ownerGithub} from any browser (web.owner_github)`]
+      : []),
+    ...(web.allowedGithubOrg
+      ? [
+          `a member of ${web.allowedGithubOrg} on this computer (web.allowed_github_org)`,
+        ]
+      : []),
+  ];
+  // D17: owner_github carries most people (org memberships are usually
+  // private); without it, say how to get it.
+  const ghHint = web.ownerGithub
+    ? {}
+    : { ask: ownerGithubHint((deps.ghLogin ?? ghLogin)(), product().cli) };
+  if (who.length)
+    return {
+      id: "web:owner",
+      status: "ok",
+      detail: `no owner yet; who may connect GitHub to claim it: ${who.join(", or ")}`,
+      ...ghHint,
+    };
+  const exposed = await (deps.exposed ?? defaultExposed)();
+  // Only this machine reaches it: a note, not a warning (every fresh
+  // install starts this way, D12).
+  return {
+    id: "web:owner",
+    status: exposed ? "fail" : "ok",
+    detail:
+      `no owner, and nothing says who may claim it, so nobody can connect GitHub from the browser` +
+      (exposed
+        ? `; the edge is reachable from other machines (${exposed})`
+        : ""),
+    ask: `Which GitHub org's members may claim it (web.allowed_github_org in ${configFile}), or which GitHub login runs it here (web.owner_github in config/local/user.yml)?`,
+  };
+}
+
+/** The check as doctor prints it. */
+export function ownerLine(c: OnboardCheck): string {
+  const mark =
+    c.status === "fail" ? "✗" : c.status === "warn" ? "⚠" : c.ask ? "ℹ" : "✓";
+  return `  ${mark} ${c.detail}${c.ask ? `\n    ${c.ask}` : ""}`;
+}

package/src/ui/cli/service-command.ts

@@ -15,6 +15,11 @@
  * port, and writes and loads nothing; exit 1 when that server is foreign.
  * `status` also names a foreign server on the port.
  */
+import {
+  ownerGithubLine,
+  recordOwnerGithub,
+  type OwnerGithubResult,
+} from "../../shared/owner-github.js";
 import { spawnSync } from "child_process";
 import * as os from "os";
 import * as path from "path";
@@ -100,6 +105,8 @@ export async function waitForServerInfo(
 
 export interface ServiceDeps {
   run?: ServiceRunner;
+  /** D17: record web.owner_github (default: from gh, unless `run` is a test's). */
+  recordOwner?: () => OwnerGithubResult;
   config?: DenConfig;
   distRoot?: string;
   engineRoot?: string;
@@ -214,6 +221,15 @@ export async function cmdService(
     return 0;
   }
 
+  // D17: whoever installs it can connect their GitHub account from any
+  // browser (web.owner_github, from gh), before the server reads it.
+  if (sub === "install") {
+    const rec =
+      deps.recordOwner ??
+      (deps.run ? () => ({ state: "linked" as const }) : recordOwnerGithub);
+    const line = ownerGithubLine(rec(), product().cli);
+    if (line) log(line);
+  }
   const code = run("bash", [script, sub!], {
     ...env,
     // The script then leaves saying "running" to us (after the poll below).