@monster-orange/den 0.4.20 → 0.4.21

package/src/shared/product.ts

@@ -8,6 +8,9 @@
  * distribution root can be found (e.g. help text printed outside a checkout).
  */
 
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse as parseYaml } from "yaml";
 import { getDistRoot } from "./paths.js";
 import {
   loadProfile,
@@ -17,7 +20,11 @@ import {
 } from "./profile.js";
 
 export interface Product extends ProductProfile {
-  /** Display name: the name with its first letter upper-cased ("Den"). */
+  /**
+   * Display name (D11): the org config's brand.name ("Acme Den") when it is
+   * safe to show anywhere (TITLE_SAFE), else the name with its first letter
+   * upper-cased ("Acme-den").
+   */
   title: string;
   /** The YAML manifest file name (".den.yml"). */
   manifestYml: string;
@@ -25,11 +32,43 @@ export interface Product extends ProductProfile {
   manifestJson: string;
 }
 
-function withDerived(p: ProductProfile): Product {
+/**
+ * What a brand.name may hold to be the display title: letters, digits,
+ * spaces, ".", "_" and "-", up to 40. The title is filled into page scripts
+ * (inside "…" and '…' strings) and HTML attributes, so no quote, backslash,
+ * "<" or "&" may reach it (the 0.4.20 hyphen bug's kin).
+ */
+export const TITLE_SAFE = /^[\p{L}\p{N}][\p{L}\p{N} ._-]{0,39}$/u;
+
+/** The name, first letter upper-cased: "acme-den" → "Acme-den". */
+export function nameTitle(name: string): string {
+  return name.charAt(0).toUpperCase() + name.slice(1);
+}
+
+/** The org config's brand.name, trimmed, or undefined. Never throws. */
+export function brandNameAt(root: string | null, configFile: string) {
+  if (!root) return undefined;
+  try {
+    const raw = parseYaml(
+      fs.readFileSync(path.join(root, configFile), "utf-8"),
+    ) as { brand?: { name?: unknown } } | null;
+    const n = raw?.brand?.name;
+    return typeof n === "string" && n.trim() ? n.trim() : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** The display title: a safe brand.name, else nameTitle. */
+export function titleOf(name: string, brandName?: string): string {
+  return brandName && TITLE_SAFE.test(brandName) ? brandName : nameTitle(name);
+}
+
+function withDerived(p: ProductProfile, root: string | null = null): Product {
   const yml = p.manifestFiles[0];
   return {
     ...p,
-    title: p.name.charAt(0).toUpperCase() + p.name.slice(1),
+    title: titleOf(p.name, brandNameAt(root, p.configFile)),
     manifestYml: yml,
     manifestJson: p.manifestFiles[1] ?? yml.replace(/\.ya?ml$/, "") + ".json",
   };
@@ -40,10 +79,11 @@ let derived: { profile: ProductProfile; product: Product } | null = null;
 /** The running product. Never throws. */
 export function product(): Product {
   try {
-    const profile = loadProfile(getDistRoot());
+    const root = getDistRoot();
+    const profile = loadProfile(root);
     // Same profile object (loadProfile caches it): same derived names.
     if (derived?.profile !== profile)
-      derived = { profile, product: withDerived(profile) };
+      derived = { profile, product: withDerived(profile, root) };
     return derived.product;
   } catch {
     const pinned = process.env.DEN_PROFILE?.trim();

package/src/shared/profile.ts

@@ -58,6 +58,13 @@ interface RawProduct {
 }
 
 const SLUG = /^[a-z][a-z0-9-]*$/;
+/**
+ * A path the pages show (config, manifest, services and workspaces dirs):
+ * letters, digits, ".", "_", "-" and "/". The web pages carry these
+ * names as placeholders filled when served (product.ts productTokens), so
+ * a quote, backslash, "$" or "<" in one would break a page's script.
+ */
+const SAFE_PATH = /^[A-Za-z0-9._/-]+$/;
 const PREFIX = /^[A-Z][A-Z0-9_]*$/;
 
 const str = (v: unknown): string | undefined =>
@@ -83,7 +90,7 @@ export function profileFrom(
   const name = str(raw.name) ?? "den";
   if (!SLUG.test(name))
     throw new Error(
-      `den.yml: product.name "${name}" must be lower-case letters, digits and "-"`,
+      `den.yml: product.name "${name}" must be lower-case letters, digits and "-", starting with a letter`,
     );
   const envPrefix =
     str(raw.env_prefix) ?? name.toUpperCase().replace(/-/g, "_");
@@ -91,11 +98,28 @@ export function profileFrom(
     throw new Error(
       `den.yml: product.env_prefix "${envPrefix}" must be upper-case letters, digits and "_"`,
     );
+  const cli = str(raw.cli) ?? name;
+  if (!SLUG.test(cli))
+    throw new Error(
+      `den.yml: product.cli "${cli}" must be lower-case letters, digits and "-", starting with a letter`,
+    );
+  for (const key of [
+    "config",
+    "manifest",
+    "services_dir",
+    "workspaces_dir",
+  ] as const) {
+    const v = str(raw[key]);
+    if (v !== undefined && !SAFE_PATH.test(v))
+      throw new Error(
+        `den.yml: product.${key} "${v}" may use only letters, digits, ".", "_", "-" and "/"`,
+      );
+  }
   const manifest = str(raw.manifest) ?? `.${name}.yml`;
   const json = manifest.replace(/\.ya?ml$/, ".json");
   return {
     name,
-    cli: str(raw.cli) ?? name,
+    cli,
     envPrefix,
     configFile: str(raw.config) ?? `config/${name}.yml`,
     manifestFiles: json === manifest ? [manifest] : [manifest, json],

package/src/shared/web-session.ts

@@ -1,7 +1,8 @@
 /**
  * SEC-1b (SEC-1 spec §2): the browser's sign-in.
  *
- *  - The login code: one-time, valid for 60 s, derived from web.secret.
+ *  - The login code: one-time, valid for `web.login_link_ttl` (D16: 5
+ *    minutes unless set; it was 60 s), derived from web.secret.
  *    `v1.<nonce>.<expiry>.<mac>`, the mac HMAC-SHA256(secret, the rest). The
  *    CLI mints it (it reads the secret as the same OS user); the server
  *    checks the mac in constant time and the expiry, and records the nonce
@@ -24,7 +25,12 @@ import * as yaml from "yaml";
 import { parseMachineName, parseSshUser } from "./cli-command.js";
 import { getStateDir } from "./paths.js";
 
-export const LOGIN_CODE_TTL_MS = 60_000;
+/** D16: how long a sign-in link lasts unless `web.login_link_ttl` says. */
+export const LOGIN_CODE_TTL_MS = 5 * 60_000;
+/** The longest `web.login_link_ttl` may be (and the most a code is believed). */
+export const LOGIN_CODE_MAX_TTL_MS = 60 * 60_000;
+/** The shortest `web.login_link_ttl` may be. */
+export const LOGIN_CODE_MIN_TTL_MS = 30_000;
 /** Clock skew allowed between the CLI that mints a code and the server. */
 const LOGIN_CODE_SKEW_MS = 5_000;
 const LOGIN_CONTEXT = "den-login-v1:";
@@ -57,13 +63,14 @@ function mac(secret: Buffer, body: string): Buffer {
     .digest();
 }
 
-/** A fresh login code, valid for 60 s from `now`. */
+/** A fresh login code, valid for `ttlMs` (web.login_link_ttl) from `now`. */
 export function mintLoginCode(
   secret: Buffer,
   now: number = Date.now(),
+  ttlMs: number = LOGIN_CODE_TTL_MS,
 ): string {
   const nonce = randomBytes(16).toString("base64url");
-  const body = `v1.${nonce}.${(now + LOGIN_CODE_TTL_MS).toString(36)}`;
+  const body = `v1.${nonce}.${(now + ttlMs).toString(36)}`;
   return `${body}.${mac(secret, body).toString("base64url")}`;
 }
 
@@ -72,7 +79,8 @@ export type LoginCodeCheck =
   | { ok: false; reason: "malformed" | "bad_mac" | "expired" };
 
 /**
- * Whether `code` is one this secret minted and still in its 60 s. The mac is
+ * Whether `code` is one this secret minted and still in its time (at most
+ * LOGIN_CODE_MAX_TTL_MS: web.login_link_ttl's ceiling). The mac is
  * compared in constant time. Single use is the caller's (consumeCode).
  */
 export function checkLoginCode(
@@ -93,7 +101,7 @@ export function checkLoginCode(
   if (
     !Number.isFinite(expiresAt) ||
     now >= expiresAt ||
-    expiresAt - now > LOGIN_CODE_TTL_MS + LOGIN_CODE_SKEW_MS
+    expiresAt - now > LOGIN_CODE_MAX_TTL_MS + LOGIN_CODE_SKEW_MS
   )
     return { ok: false, reason: "expired" };
   return { ok: true, nonce: m[2], expiresAt };
@@ -201,6 +209,77 @@ export interface WebAuthConfig {
    * Den runs as. "": no account on the page.
    */
   sshUser?: string;
+  /**
+   * `web.owner_github` (D17, user.yml only): the GitHub login of the person
+   * who runs this instance, recorded from `gh` at `web up` or `service
+   * install`. With no owner linked, that login's GitHub sign-in, from any
+   * machine, becomes the owner.
+   */
+  ownerGithub?: string;
+  /**
+   * `web.allowed_github_org` (D17; the distribution config, or user.yml):
+   * with no owner linked, a member of this GitHub org who proves they are
+   * at this machine ("This is my computer") becomes the owner.
+   */
+  allowedGithubOrg?: string;
+  /** The file `web.allowed_github_org` came from. */
+  allowedGithubOrgFile?: string;
+  /**
+   * `web.login_link_ttl` (D16; user.yml over the distribution config): how
+   * long a sign-in link lasts, in ms. Unset: LOGIN_CODE_TTL_MS (5 minutes).
+   */
+  loginLinkTtlMs: number;
+}
+
+/** A GitHub login (or org name): letters, digits, single dashes, ≤ 39. */
+const GITHUB_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+
+/** `web.owner_github` or `web.allowed_github_org`: a GitHub name, or unset. */
+export function parseGithubName(
+  v: unknown,
+  key: string,
+  file: string,
+): string | undefined {
+  if (v === undefined || v === null) return undefined;
+  const s = typeof v === "string" ? v.trim().replace(/^@/, "") : "";
+  if (s === "" && typeof v === "string") return undefined;
+  if (!GITHUB_NAME.test(s))
+    throw new Error(
+      `${key} (${file}) must be a GitHub name (letters, digits and dashes), got ${JSON.stringify(v)}`,
+    );
+  return s;
+}
+
+/**
+ * `web.login_link_ttl`: `90s`, `5m`, `1h`, or a number of seconds, between
+ * 30 s and 60 min. Unset: undefined. Throws naming the key otherwise.
+ */
+export function parseLoginLinkTtl(
+  v: unknown,
+  file: string,
+): number | undefined {
+  if (v === undefined || v === null) return undefined;
+  const m =
+    typeof v === "number"
+      ? [String(v), String(v), "s"]
+      : typeof v === "string"
+        ? /^\s*(\d+)\s*(s|m|h)?\s*$/i.exec(v)
+        : null;
+  const ms = m
+    ? Number(m[1]) *
+      ({ s: 1000, m: 60_000, h: 3_600_000 } as Record<string, number>)[
+        (m[2] ?? "s").toLowerCase()
+      ]
+    : NaN;
+  if (
+    !Number.isFinite(ms) ||
+    ms < LOGIN_CODE_MIN_TTL_MS ||
+    ms > LOGIN_CODE_MAX_TTL_MS
+  )
+    throw new Error(
+      `web.login_link_ttl (${file}) must be a time between 30s and 60m (such as 5m), got ${JSON.stringify(v)}`,
+    );
+  return ms;
 }
 
 /** `web.edge_unattested`'s values. */
@@ -300,7 +379,34 @@ export function readWebAuthConfig(
     user.ssh_user !== undefined
       ? parseSshUser(user.ssh_user)
       : parseSshUser(team.ssh_user);
+  const ownerGithub = parseGithubName(
+    user.owner_github,
+    "web.owner_github",
+    "config/local/user.yml",
+  );
+  const userOrg = parseGithubName(
+    user.allowed_github_org,
+    "web.allowed_github_org",
+    "config/local/user.yml",
+  );
+  const teamOrg = parseGithubName(
+    team.allowed_github_org,
+    "web.allowed_github_org",
+    configFile,
+  );
+  const allowedGithubOrg = userOrg ?? teamOrg;
+  const ttl =
+    parseLoginLinkTtl(user.login_link_ttl, "config/local/user.yml") ??
+    parseLoginLinkTtl(team.login_link_ttl, configFile);
   return {
+    ...(ownerGithub ? { ownerGithub } : {}),
+    ...(allowedGithubOrg
+      ? {
+          allowedGithubOrg,
+          allowedGithubOrgFile: userOrg ? "config/local/user.yml" : configFile,
+        }
+      : {}),
+    loginLinkTtlMs: ttl ?? LOGIN_CODE_TTL_MS,
     ...(machineName ? { machineName } : {}),
     ...(sshUser !== undefined ? { sshUser } : {}),
     allowPlainHttpRemote: plain === true,

package/src/ui/cli/create.ts

@@ -13,6 +13,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { execFileSync } from "node:child_process";
 import { ENGINE_PACKAGE, getEngineRoot } from "../../shared/paths.js";
 import { profileFrom } from "../../shared/profile.js";
 import { parse as parseYaml } from "yaml";
@@ -31,6 +32,44 @@ export interface CreateOptions {
   envPrefix?: string;
   /** The Den version the distribution pins (exact). */
   denVersion: string;
+  /**
+   * D17: `web.allowed_github_org`: the GitHub org whose members may claim
+   * an instance of it (each developer's own). Unset: a commented line.
+   */
+  githubOrg?: string;
+}
+
+const GITHUB_ORG = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+
+/**
+ * The GitHub owner of a git remote URL (https or ssh), or null:
+ * `git@github.com:acme/acme-den.git` → `acme`.
+ */
+export function githubOwnerOfRemote(url: string): string | null {
+  const m =
+    /^(?:https?:\/\/(?:[^@/]+@)?github\.com\/|(?:ssh:\/\/)?git@github\.com[:/])([^/]+)\//i.exec(
+      url.trim(),
+    );
+  return m && GITHUB_ORG.test(m[1]) ? m[1] : null;
+}
+
+/**
+ * The GitHub owner of the repo `dir` is in (its nearest existing folder's
+ * `origin`), or null: no repo, no origin, not GitHub.
+ */
+export function githubOrgOfDir(dir: string): string | null {
+  let d = path.resolve(dir);
+  while (!fs.existsSync(d) && path.dirname(d) !== d) d = path.dirname(d);
+  try {
+    const url = execFileSync("git", ["-C", d, "remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5_000,
+    });
+    return githubOwnerOfRemote(url);
+  } catch {
+    return null;
+  }
 }
 
 const NAME = /^[a-z][a-z0-9-]*$/;
@@ -58,6 +97,10 @@ export function validateCreateOptions(opts: CreateOptions): void {
     throw new Error("--title must not be empty");
   if (opts.title !== undefined && /[\n"\\]/.test(opts.title))
     throw new Error("--title must be one line without quotes or backslashes");
+  if (opts.githubOrg !== undefined && !GITHUB_ORG.test(opts.githubOrg))
+    throw new Error(
+      `--github-org "${opts.githubOrg}" must be a GitHub org name (letters, digits and dashes)`,
+    );
   // The profile validates the env prefix the same way den.yml would.
   profileFrom({
     name: opts.name,
@@ -152,6 +195,13 @@ export function renderDistribution(
     "# Unset, Den lists no GitHub repos (and never calls gh for them). E.g.",
     "# github_org: example-org",
     "",
+    "# Who may claim an instance. Each developer runs their own and opens it",
+    "# in the browser; a member of this GitHub org connects their GitHub",
+    "# account there, on their own computer, and owns that instance.",
+    ...(opts.githubOrg
+      ? ["web:", `  allowed_github_org: ${opts.githubOrg}`]
+      : ["# web:", "#   allowed_github_org: your-github-org"]),
+    "",
     "# Secrets backend: none (this distribution needs no secrets store), or",
     "# env (plain environment variables), doppler or 1password. A backend's",
     "# refs say where Den's own features find their secrets, e.g.",
@@ -307,8 +357,14 @@ export interface ParsedCreateArgs extends Omit<CreateOptions, "denVersion"> {
   port?: number;
 }
 
+/** Where create finds web.allowed_github_org when --github-org isn't given. */
+export interface CreateOrgOptions {
+  /** The GitHub owner of the repo the new folder is in (default: git's). */
+  githubOrgOf?: (dir: string) => string | null;
+}
+
 const CREATE_USAGE =
-  "usage: den create <name> [dir] [--title <title>] [--cli <cli>] [--env-prefix <PREFIX>] [--port <n>] [--yes] [--json]";
+  "usage: den create <name> [dir] [--title <title>] [--cli <cli>] [--env-prefix <PREFIX>] [--port <n>] [--github-org <org>] [--yes] [--json]";
 
 /** Parse `create` argv (after the word `create`). `cwd` resolves the dir. */
 export function parseCreateArgs(argv: string[], cwd: string): ParsedCreateArgs {
@@ -326,7 +382,7 @@ export function parseCreateArgs(argv: string[], cwd: string): ParsedCreateArgs {
       json = true;
       continue;
     }
-    const m = /^--(title|cli|env-prefix|port)(?:=(.*))?$/.exec(a);
+    const m = /^--(title|cli|env-prefix|port|github-org)(?:=(.*))?$/.exec(a);
     if (m) {
       const value = m[2] ?? argv[++i];
       if (value === undefined)
@@ -345,6 +401,9 @@ export function parseCreateArgs(argv: string[], cwd: string): ParsedCreateArgs {
     title: flags.title,
     cli: flags.cli,
     envPrefix: flags["env-prefix"],
+    ...(flags["github-org"] !== undefined
+      ? { githubOrg: flags["github-org"].replace(/^@/, "") }
+      : {}),
     yes,
     json,
     ...(flags.port !== undefined ? { port: parsePortFlag(flags.port) } : {}),
@@ -370,6 +429,9 @@ config/environments/local.json, manifests/ and tests/pillars/.
   --env-prefix <PREFIX>  env-var prefix (default: <NAME>)
   --port <n>             the web UI's port (default: ${DEFAULT_PORT}, or the next
                          free one above it when that is in use)
+  --github-org <org>     web.allowed_github_org: members of this GitHub org
+                         connect their GitHub account to their own instance
+                         (default: the owner of the GitHub repo [dir] is in)
   --yes, -y              never prompt (create never does; for agents)
   --json                 print one JSON object: { ok, dir, cli, existed, port, next }
 
@@ -407,6 +469,8 @@ export interface CreateJson {
   port?: number;
   /** Set when DEFAULT_PORT was in use and `port` was picked instead. */
   portPicked?: { wanted: number; file: string };
+  /** D17: web.allowed_github_org as written, or null when it wasn't known. */
+  githubOrg?: string | null;
   next?: string[];
   error?: string;
   fix?: string;
@@ -478,12 +542,17 @@ export async function createResult(
   args: ParsedCreateArgs,
   cwd: string,
   denVersion: string = runningDenVersion(),
-  portOpts: CreatePortOptions = {},
+  portOpts: CreatePortOptions & CreateOrgOptions = {},
 ): Promise<CreateJson> {
   const cli = args.cli ?? args.name;
-  const next = (dir: string): string[] => [
+  const next = (dir: string, org?: string | null): string[] => [
     `cd ${cdPathFor(cwd, dir)}`,
     "npm install",
+    ...(org === null
+      ? [
+          `set web.allowed_github_org: <your GitHub org> in config/${args.name}.yml (who may claim an instance)`,
+        ]
+      : []),
     `./bin/${cli} repo add <path|git-url> --json`,
   ];
   try {
@@ -509,7 +578,17 @@ export async function createResult(
       args.port ??
       (await pickFreePort({ start: wanted, inUse: portOpts.inUse })) ??
       wanted;
-    const written = writeDistribution(args.dir, { ...args, denVersion });
+    // D17: the org whose members may claim an instance: --github-org, else
+    // the owner of the GitHub repo the folder is in.
+    const githubOrg =
+      args.githubOrg ??
+      (portOpts.githubOrgOf ?? githubOrgOfDir)(args.dir) ??
+      undefined;
+    const written = writeDistribution(args.dir, {
+      ...args,
+      denVersion,
+      ...(githubOrg ? { githubOrg } : {}),
+    });
     let portPicked: CreateJson["portPicked"];
     // Written when the port differs from what the distribution would use
     // anyway (an explicit --port that isn't the default, or a picked one).
@@ -537,7 +616,8 @@ export async function createResult(
       files: written.length,
       port,
       ...(portPicked ? { portPicked } : {}),
-      next: next(args.dir),
+      githubOrg: githubOrg ?? null,
+      next: next(args.dir, githubOrg ?? null),
     };
   } catch (e) {
     const error = (e as Error).message;
@@ -602,6 +682,12 @@ export async function runCreate(
       ? `Web UI port: ${r.port} (${r.portPicked.wanted} is in use here; set in ${r.portPicked.file}).`
       : `Web UI port: ${r.port}.`,
   );
+  if (!r.existed)
+    console.log(
+      r.githubOrg
+        ? `GitHub org: ${r.githubOrg} (web.allowed_github_org: its members connect their GitHub account to their own instance).`
+        : `GitHub org: not known. Set web.allowed_github_org in config/${args.name}.yml, or pass --github-org <org>, so your team can connect GitHub from the browser.`,
+    );
   console.log("");
   console.log("Next:");
   console.log(`  cd ${cdPathFor(cwd, dir)}`);

package/src/ui/cli/doctor-command.ts

@@ -51,6 +51,7 @@ import {
 } from "../../shared/sessions/den-pty.js";
 import {
   getStrategy,
+  strategyIds,
   strategyKinds,
 } from "../../shared/strategies/registry.js";
 import {
@@ -65,6 +66,7 @@ import {
   type OnboardDeps,
 } from "./doctor-onboard.js";
 import { printJson } from "./json-out.js";
+import { ownerCheck, ownerLine } from "./doctor-owner.js";
 
 export interface DoctorRow {
   kind: string;
@@ -193,22 +195,45 @@ export function doctorRows(env: NodeJS.ProcessEnv = process.env): DoctorRow[] {
     ...kinds.filter((k) => !(k in SELECTORS)),
   ];
   const rows = ordered.map(
-    (kind) =>
-      SELECTORS[kind]?.(env) ?? {
-        kind,
-        selected: "",
-        implicit: false,
-        available: false,
-        reason: "no selector for this kind",
-        problem: false,
-        warnings: [],
-      },
+    (kind) => SELECTORS[kind]?.(env) ?? everyStrategyRow(kind, env),
   );
   const op = onePasswordTokenRow(env);
   if (op) rows.splice(rows.findIndex((r) => r.kind === "secrets") + 1, 0, op);
   return rows;
 }
 
+/**
+ * A kind no config selects one of (usage sources, D9): every registered
+ * strategy is in use, so the row names them all (implicit) and is available
+ * when any is. Never a problem: nothing was configured wrong. (It said
+ * "(invalid config) ✗ no selector for this kind" on every fresh install.)
+ */
+function everyStrategyRow(kind: string, env: NodeJS.ProcessEnv): DoctorRow {
+  const ids = strategyIds(kind);
+  const found = ids.map((id) => {
+    try {
+      return getStrategy(kind, id)?.detect(env) ?? { available: false };
+    } catch (e) {
+      return { available: false, reason: (e as Error).message };
+    }
+  });
+  const available = found.some((d) => d.available);
+  return {
+    kind,
+    selected: ids.join(", "),
+    implicit: true,
+    available,
+    reason: available
+      ? undefined
+      : found
+          .map((d) => d.reason)
+          .filter(Boolean)
+          .join("; ") || undefined,
+    problem: false,
+    warnings: [],
+  };
+}
+
 /**
  * The 1password row: shown only when 1Password is the configured provider
  * (secret_env refs and the engine's own secrets resolve through it) and the
@@ -241,15 +266,19 @@ function onePasswordTokenRow(env: NodeJS.ProcessEnv): DoctorRow | null {
 export function formatDoctor(rows: DoctorRow[], title: string): string[] {
   const lines = [chalk.bold(`${title} doctor: strategies`), ""];
   const width = Math.max(...rows.map((r) => r.kind.length));
-  for (const r of rows) {
-    const sel = r.selected
+  const selOf = (r: DoctorRow) =>
+    r.selected
       ? `${r.selected}${r.implicit ? " (implicit)" : ""}`
       : "(invalid config)";
+  // The state column lines up even past 20 ("den-claude (implicit)").
+  const selWidth = Math.max(20, ...rows.map((r) => selOf(r).length));
+  for (const r of rows) {
+    const sel = selOf(r);
     const state = r.available
       ? chalk.green("✓ available")
       : (r.problem ? chalk.red : chalk.yellow)("✗ unavailable");
     lines.push(
-      `  ${r.kind.padEnd(width)}  ${sel.padEnd(20)} ${state}${r.reason ? `: ${r.reason}` : ""}`,
+      `  ${r.kind.padEnd(width)}  ${sel.padEnd(selWidth)} ${state}${r.reason ? `: ${r.reason}` : ""}`,
     );
     for (const w of r.warnings) lines.push(chalk.yellow(`    ⚠ ${w}`));
   }
@@ -347,10 +376,13 @@ export function strategyCheck(r: DoctorRow): OnboardCheck {
 export async function doctorJson(
   deps: OnboardDeps,
   rows: DoctorRow[] = doctorRows(),
+  owner: () => Promise<OnboardCheck> = () => ownerCheck(),
 ): Promise<{ ok: boolean; checks: OnboardCheck[] }> {
   const checks = [
     ...(await onboardingChecks(deps)),
     ...rows.map(strategyCheck),
+    // D17: who can connect GitHub to this instance from the browser.
+    await owner(),
   ];
   return { ok: !checks.some((c) => c.status === "fail"), checks };
 }
@@ -390,6 +422,11 @@ export async function cmdDoctor(args: string[]): Promise<number> {
   for (const l of formatDoctor(rows, readBrand().name)) console.log(l);
   const held = approvalsLines(() => readMcpConfig().approvals);
   for (const l of held.lines) console.log(l);
+  // D17: who can connect GitHub to this instance from the browser.
+  const owner = await ownerCheck();
+  console.log("");
+  console.log(ownerLine(owner));
+  const ownerProblem = owner.status === "fail";
   for (const l of pollingLines(eventsFile(), readBrand().name)) console.log(l);
   const cli = product().cli;
   if (!probe) {
@@ -398,7 +435,7 @@ export async function cmdDoctor(args: string[]): Promise<number> {
       agentsConfigured(readConfigOrNull(), getStateDir()),
     ))
       console.log(l);
-    return rows.some((r) => r.problem) || held.problem ? 1 : 0;
+    return rows.some((r) => r.problem) || held.problem || ownerProblem ? 1 : 0;
   }
   const { runEnvProbe, formatProbe } = await import("./env-probe.js");
   const { resolveDeps, plainSessionEnv } =
@@ -417,5 +454,7 @@ export async function cmdDoctor(args: string[]): Promise<number> {
   console.log("");
   for (const l of formatProbe(results)) console.log(l);
   const found = results.some((r) => r.findings.length);
-  return rows.some((r) => r.problem) || held.problem || found ? 1 : 0;
+  return rows.some((r) => r.problem) || held.problem || ownerProblem || found
+    ? 1
+    : 0;
 }