@monster-orange/den 0.4.2 → 0.4.4

package/src/ui/cli/sessions-command.ts

@@ -27,7 +27,7 @@ import { cliEntrypoint } from "../../shared/engine.js";
 import { getDistRoot, getInvokeCwd, getStateDir } from "../../shared/paths.js";
 import { product } from "../../shared/product.js";
 import { ENV_NAME_RE, isCredentialShaped } from "../../shared/secret-env.js";
-import { allScrubEnv } from "../../shared/agents/runtimes.js";
+import { allScrubEnv, withSessionPath } from "../../shared/agents/runtimes.js";
 import {
   ensureHost,
   connectHost,
@@ -320,14 +320,19 @@ export function contractInfo(s: SessionInfo): SessionInfo {
 // ── subcommands ───────────────────────────────────────────────────────────────
 
 /**
- * A plain session's env (AG spec §5a-env): the allowlist, the names the
- * user kept, then every runtime's scrubEnv. `doctor --probe` checks it.
+ * A plain session's env (AG spec §5a-env): the allowlist (its PATH with
+ * the runtime search's directories, AG-0.1), the names the user kept, then
+ * every runtime's scrubEnv. `doctor --probe` checks it.
  */
 export function plainSessionEnv(
   caller: NodeJS.ProcessEnv,
   keep: readonly string[] = [],
 ): Record<string, string> {
-  return buildSessionEnv({ caller, keep, scrub: allScrubEnv() });
+  return buildSessionEnv({
+    caller: withSessionPath(caller),
+    keep,
+    scrub: allScrubEnv(),
+  });
 }
 
 /** Who ran the CLI, for an audit line: a login name, printable. */

package/src/ui/cli/web-command.ts

@@ -33,7 +33,8 @@ import {
 } from "../../shared/web-session.js";
 import { revokeAllActorTokens } from "../../shared/actor-token.js";
 import { engineBin, engineModuleFile } from "../../shared/engine.js";
-import { readWebPort } from "../../shared/edge/config.js";
+import { readEdgeConfig, readWebPort } from "../../shared/edge/config.js";
+import { webRouteHosts } from "../../shared/edge/render.js";
 import {
   ownServer,
   processCwd,
@@ -1081,7 +1082,7 @@ export function displayWebHelp(): void {
   console.log(`  ${product().cli} web --setup-browser-access`);
   console.log(`  ${product().cli} web token --print`);
   console.log(
-    `  ${product().cli} web login [--next <path>] [--origin <url>] [--port <port>]`,
+    `  ${product().cli} web login [--next <path>] [--host <name> | --origin <url>] [--port <port>]`,
   );
   console.log(`  ${product().cli} web sessions [--json] [--port <port>]`);
   console.log(
@@ -1392,20 +1393,24 @@ function takePort(args: string[]): { port: number; rest: string[] } {
 }
 
 /**
- * `<cli> web login [--next <path>] [--origin <url>]`: a fresh sign-in link
+ * `<cli> web login [--next <path>] [--host <name> | --origin <url>]`: a fresh sign-in link
  * on stdout, alone (the only place a login code is ever printed); a note on
- * stderr. `--origin` for the edge hostname or a LAN name, where the cookie
- * must be set (the signed-out page there says which).
+ * stderr. `--host` for an edge hostname (its URL from the edge config),
+ * `--origin` for any allowed origin (a LAN name), where the cookie must be
+ * set (the signed-out page there says which).
  */
 export function cmdWebLogin(args: string[], io: CliIo = stdIo): number {
-  const usage = `Usage: ${product().cli} web login [--next <path>] [--origin <url>] [--port <port>]\n`;
+  const usage = `Usage: ${product().cli} web login [--next <path>] [--host <name> | --origin <url>] [--port <port>]\n`;
   if (isHelp(args)) {
     io.out(
       usage +
         "  Prints a one-time sign-in link (it works once, within 60 s) for one browser.\n" +
         "  On localhost nothing asks for a sign-in; it is needed when this server is\n" +
-        "  reached beyond this machine (the edge, or a LAN address: pass its --origin).\n" +
+        "  reached from another machine (pass the edge hostname as --host, or a LAN\n" +
+        "  address as --origin).\n" +
         "  --next <path>   where the browser lands after signing in (same origin only)\n" +
+        "  --host <name>   an edge hostname that routes here (an edge domain or alias,\n" +
+        "                  a VPN name among them): the link uses its edge URL\n" +
         "  --origin <url>  the address the browser uses, http(s)://host[:port]\n",
     );
     return 0;
@@ -1430,8 +1435,16 @@ export function cmdWebLogin(args: string[], io: CliIo = stdIo): number {
           : undefined;
     const n = val("--next");
     const o = val("--origin");
+    const h = val("--host");
     if (n !== undefined) next = n;
-    else if (o !== undefined) {
+    else if (h !== undefined) {
+      const found = edgeOriginFor(h, port);
+      if (typeof found !== "string") {
+        io.err(found.error);
+        return 2;
+      }
+      origin = found;
+    } else if (o !== undefined) {
       origin = parseOrigin(o);
       if (!origin) {
         io.err(
@@ -1457,6 +1470,38 @@ export function cmdWebLogin(args: string[], io: CliIo = stdIo): number {
   return 0;
 }
 
+/**
+ * `web login --host <name>`: the origin a browser uses for an edge hostname
+ * that routes to this server (edge.routes under any edge domain or alias),
+ * or why there is none and what to add.
+ */
+export function edgeOriginFor(
+  name: string,
+  port: number,
+): string | { error: string } {
+  const want = name.trim().toLowerCase().replace(/\.$/, "");
+  let routes: { host: string; url: string }[] = [];
+  try {
+    routes = webRouteHosts(readEdgeConfig(), new Set([port, readWebPort()]));
+  } catch {
+    routes = [];
+  }
+  const hit = routes.find((r) => r.host === want);
+  if (hit) return hit.url;
+  const known = routes.map((r) => r.host);
+  return {
+    error:
+      `--host ${name} is not a hostname this server answers to` +
+      (known.length
+        ? ` (its edge hostnames: ${known.join(", ")}).\n`
+        : " (no edge route reaches this server).\n") +
+      "  Add it to the config's edge block: its domain to edge.aliases (a VPN\n" +
+      "  name), or a route to this server in edge.routes, then `edge up`. For a\n" +
+      "  LAN name (DEN_BIND_HOST and web.allow_plain_http_remote) pass\n" +
+      "  --origin http://<name>:<port> instead.\n",
+  };
+}
+
 interface SessionRow {
   id: string;
   createdAt: string;

package/src/ui/mcp/scope.ts

@@ -191,6 +191,20 @@ function grantsNote(scope: McpScope): string {
     : "no grants";
 }
 
+/**
+ * How a person gives `scope`'s agent a grant to `other` (MCP-2.3, AG spec
+ * §5b): config in git, then a restart. An agent never grants itself one.
+ */
+export function grantHint(scope: McpScope, other: string): string {
+  const id = scope.actor.slice("agent:".length);
+  return (
+    `To reach it, a person adds "${printable(other)}" to agents.${id}.grants ` +
+    `in the org config and restarts the agent (agents start passes --grant); ` +
+    "an agent can't grant itself one. For names and status counts of every " +
+    "workspace, call org_summary."
+  );
+}
+
 /** The refusal for a call that names `other`; it names the agent's grants. */
 export function otherWorkspace(
   tool: string,
@@ -199,7 +213,8 @@ export function otherWorkspace(
 ): ScopeRefusal {
   return new ScopeRefusal(
     `${tool}: this MCP server is scoped to workspace "${scope.workspace}" ` +
-      `(${scope.actor}; ${grantsNote(scope)}); "${printable(other)}" is another workspace, so nothing was read or run.`,
+      `(${scope.actor}; ${grantsNote(scope)}); "${printable(other)}" is another workspace, so nothing was read or run. ` +
+      grantHint(scope, other),
   );
 }
 
@@ -299,8 +314,10 @@ function focusedOf(body: unknown): string | null {
 export async function assertScopeExists(
   api: DenApi,
   scope: McpScope,
+  /** An /api/workspaces body already read (else it is read now). */
+  read?: unknown,
 ): Promise<unknown> {
-  const body = await api.get("/api/workspaces");
+  const body = read ?? (await api.get("/api/workspaces"));
   if (!(scope.workspace in asRecord(asRecord(body).workspaces)))
     throw new ScopeRefusal(
       `this MCP server is scoped to workspace "${scope.workspace}", which does not exist in this distribution.`,
@@ -375,7 +392,10 @@ export async function assertServicesInScope(
   if (outside.length)
     throw new ScopeRefusal(
       `${tool}: ${outside.map(printable).join(", ")} ${outside.length === 1 ? "is" : "are"} not a service ` +
-        `of workspace "${scope.workspace}", the only one this MCP server serves; nothing was read.`,
+        `of workspace "${scope.workspace}", the only one this MCP server serves; nothing was read. ` +
+        "Logs and service details stay inside each workspace (logs can hold " +
+        "secrets), and a grant does not widen them; org_summary has every " +
+        "workspace's status counts.",
     );
 }
 

package/src/ui/mcp/server.ts

@@ -49,7 +49,9 @@ export function createDenMcpServer(opts: DenMcpOptions): McpServer {
   const p = product();
   const session = opts.session ?? randomUUID();
   const log = opts.log ?? ((l: string) => process.stderr.write(`${l}\n`));
-  const tools = toolsFor(opts.cfg);
+  // Scoped, each workspace tool is registered pinned (MCP-2.2): "this
+  // workspace only", and no workspace parameter unless there are grants.
+  const tools = toolsFor(opts.cfg, opts.scope);
   const server = new McpServer(
     { name: p.name, version: engineVersion() ?? "0.0.0" },
     {
@@ -61,8 +63,11 @@ export function createDenMcpServer(opts: DenMcpOptions): McpServer {
           : "Read-only: the org has enabled no actions (mcp.actions).") +
         (opts.scope
           ? ` Scoped to workspace "${opts.scope.workspace}" as ${opts.scope.actor}: ` +
-            "a call naming another workspace is refused, and lists show this one only."
-          : ""),
+            "a call naming another workspace is refused, and lists show this one only, " +
+            "each with a `scope` block saying how much is hidden. org_summary has " +
+            "every workspace and repo (names and status counts), the graph, the " +
+            "edge and the environments: start there for the whole picture."
+          : " org_summary has the whole org at a glance: start there."),
     },
   );
 
@@ -222,8 +227,10 @@ export async function runOneShot(
   opts: OneShotOptions,
 ): Promise<number> {
   const out = opts.out ?? ((t: string) => process.stdout.write(t));
+  // The tools exactly as the stdio server registers them: pinned when scoped.
+  const tools = toolsFor(opts.cfg, opts.scope);
   if (shot.kind === "list") {
-    const names = toolsFor(opts.cfg).map((t) => t.name);
+    const names = tools.map((t) => t.name);
     out(names.length ? `${names.join("\n")}\n` : "");
     return 0;
   }
@@ -235,11 +242,18 @@ export async function runOneShot(
   };
   // The stdio server validates arguments against each tool's schema (the
   // SDK does it); a one-shot must too, and strictly: it is typed by hand, so
-  // an unknown or misspelt key is an error, not silently dropped.
+  // an unknown or misspelt key is an error, not silently dropped. Scoped,
+  // the schema is the pinned one; a `workspace` it dropped (no grants) is
+  // still taken, so naming another workspace gets Den's refusal (callTool),
+  // never a silent answer about the scope's own.
   let args = shot.args;
-  const tool = toolsFor(opts.cfg).find((t) => t.name === shot.tool);
+  const tool = tools.find((t) => t.name === shot.tool);
   if (tool) {
-    const parsed = z.object(tool.shape).strict().safeParse(args);
+    const shape =
+      opts.scope && !("workspace" in tool.shape) && "workspace" in args
+        ? { ...tool.shape, workspace: z.string().optional() }
+        : tool.shape;
+    const parsed = z.object(shape).strict().safeParse(args);
     if (!parsed.success) {
       const err = opts.err ?? ((t: string) => process.stderr.write(t));
       const lines = parsed.error.issues.map((i) => {
@@ -384,6 +398,16 @@ export async function runMcp(rawArgv: string[]): Promise<void> {
           ...scopeInfo(scope ?? undefined),
         }),
     });
+    // Say the scope on stderr (stdout is the result): a one-shot that ran
+    // unscoped must never pass for a scoped one.
+    if (scope)
+      process.stderr.write(
+        `${cli} mcp --call: scoped to ${scope.workspace} as ${scope.actor}` +
+          (scope.grants?.length
+            ? ` · grants: ${scope.grants.join(", ")}`
+            : "") +
+          "\n",
+      );
     process.exitCode = await runOneShot(shot, {
       cfg,
       cli,