@monster-orange/den 0.4.20 → 0.4.22

package/src/shared/web-session.ts

@@ -1,7 +1,8 @@
 /**
  * SEC-1b (SEC-1 spec §2): the browser's sign-in.
  *
- *  - The login code: one-time, valid for 60 s, derived from web.secret.
+ *  - The login code: one-time, valid for `web.login_link_ttl` (D16: 5
+ *    minutes unless set; it was 60 s), derived from web.secret.
  *    `v1.<nonce>.<expiry>.<mac>`, the mac HMAC-SHA256(secret, the rest). The
  *    CLI mints it (it reads the secret as the same OS user); the server
  *    checks the mac in constant time and the expiry, and records the nonce
@@ -24,7 +25,12 @@ import * as yaml from "yaml";
 import { parseMachineName, parseSshUser } from "./cli-command.js";
 import { getStateDir } from "./paths.js";
 
-export const LOGIN_CODE_TTL_MS = 60_000;
+/** D16: how long a sign-in link lasts unless `web.login_link_ttl` says. */
+export const LOGIN_CODE_TTL_MS = 5 * 60_000;
+/** The longest `web.login_link_ttl` may be (and the most a code is believed). */
+export const LOGIN_CODE_MAX_TTL_MS = 60 * 60_000;
+/** The shortest `web.login_link_ttl` may be. */
+export const LOGIN_CODE_MIN_TTL_MS = 30_000;
 /** Clock skew allowed between the CLI that mints a code and the server. */
 const LOGIN_CODE_SKEW_MS = 5_000;
 const LOGIN_CONTEXT = "den-login-v1:";
@@ -57,13 +63,14 @@ function mac(secret: Buffer, body: string): Buffer {
     .digest();
 }
 
-/** A fresh login code, valid for 60 s from `now`. */
+/** A fresh login code, valid for `ttlMs` (web.login_link_ttl) from `now`. */
 export function mintLoginCode(
   secret: Buffer,
   now: number = Date.now(),
+  ttlMs: number = LOGIN_CODE_TTL_MS,
 ): string {
   const nonce = randomBytes(16).toString("base64url");
-  const body = `v1.${nonce}.${(now + LOGIN_CODE_TTL_MS).toString(36)}`;
+  const body = `v1.${nonce}.${(now + ttlMs).toString(36)}`;
   return `${body}.${mac(secret, body).toString("base64url")}`;
 }
 
@@ -72,7 +79,8 @@ export type LoginCodeCheck =
   | { ok: false; reason: "malformed" | "bad_mac" | "expired" };
 
 /**
- * Whether `code` is one this secret minted and still in its 60 s. The mac is
+ * Whether `code` is one this secret minted and still in its time (at most
+ * LOGIN_CODE_MAX_TTL_MS: web.login_link_ttl's ceiling). The mac is
  * compared in constant time. Single use is the caller's (consumeCode).
  */
 export function checkLoginCode(
@@ -93,7 +101,7 @@ export function checkLoginCode(
   if (
     !Number.isFinite(expiresAt) ||
     now >= expiresAt ||
-    expiresAt - now > LOGIN_CODE_TTL_MS + LOGIN_CODE_SKEW_MS
+    expiresAt - now > LOGIN_CODE_MAX_TTL_MS + LOGIN_CODE_SKEW_MS
   )
     return { ok: false, reason: "expired" };
   return { ok: true, nonce: m[2], expiresAt };
@@ -201,6 +209,77 @@ export interface WebAuthConfig {
    * Den runs as. "": no account on the page.
    */
   sshUser?: string;
+  /**
+   * `web.owner_github` (D17, user.yml only): the GitHub login of the person
+   * who runs this instance, recorded from `gh` at `web up` or `service
+   * install`. With no owner linked, that login's GitHub sign-in, from any
+   * machine, becomes the owner.
+   */
+  ownerGithub?: string;
+  /**
+   * `web.allowed_github_org` (D17; the distribution config, or user.yml):
+   * with no owner linked, a member of this GitHub org who proves they are
+   * at this machine ("This is my computer") becomes the owner.
+   */
+  allowedGithubOrg?: string;
+  /** The file `web.allowed_github_org` came from. */
+  allowedGithubOrgFile?: string;
+  /**
+   * `web.login_link_ttl` (D16; user.yml over the distribution config): how
+   * long a sign-in link lasts, in ms. Unset: LOGIN_CODE_TTL_MS (5 minutes).
+   */
+  loginLinkTtlMs: number;
+}
+
+/** A GitHub login (or org name): letters, digits, single dashes, ≤ 39. */
+const GITHUB_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+
+/** `web.owner_github` or `web.allowed_github_org`: a GitHub name, or unset. */
+export function parseGithubName(
+  v: unknown,
+  key: string,
+  file: string,
+): string | undefined {
+  if (v === undefined || v === null) return undefined;
+  const s = typeof v === "string" ? v.trim().replace(/^@/, "") : "";
+  if (s === "" && typeof v === "string") return undefined;
+  if (!GITHUB_NAME.test(s))
+    throw new Error(
+      `${key} (${file}) must be a GitHub name (letters, digits and dashes), got ${JSON.stringify(v)}`,
+    );
+  return s;
+}
+
+/**
+ * `web.login_link_ttl`: `90s`, `5m`, `1h`, or a number of seconds, between
+ * 30 s and 60 min. Unset: undefined. Throws naming the key otherwise.
+ */
+export function parseLoginLinkTtl(
+  v: unknown,
+  file: string,
+): number | undefined {
+  if (v === undefined || v === null) return undefined;
+  const m =
+    typeof v === "number"
+      ? [String(v), String(v), "s"]
+      : typeof v === "string"
+        ? /^\s*(\d+)\s*(s|m|h)?\s*$/i.exec(v)
+        : null;
+  const ms = m
+    ? Number(m[1]) *
+      ({ s: 1000, m: 60_000, h: 3_600_000 } as Record<string, number>)[
+        (m[2] ?? "s").toLowerCase()
+      ]
+    : NaN;
+  if (
+    !Number.isFinite(ms) ||
+    ms < LOGIN_CODE_MIN_TTL_MS ||
+    ms > LOGIN_CODE_MAX_TTL_MS
+  )
+    throw new Error(
+      `web.login_link_ttl (${file}) must be a time between 30s and 60m (such as 5m), got ${JSON.stringify(v)}`,
+    );
+  return ms;
 }
 
 /** `web.edge_unattested`'s values. */
@@ -300,7 +379,34 @@ export function readWebAuthConfig(
     user.ssh_user !== undefined
       ? parseSshUser(user.ssh_user)
       : parseSshUser(team.ssh_user);
+  const ownerGithub = parseGithubName(
+    user.owner_github,
+    "web.owner_github",
+    "config/local/user.yml",
+  );
+  const userOrg = parseGithubName(
+    user.allowed_github_org,
+    "web.allowed_github_org",
+    "config/local/user.yml",
+  );
+  const teamOrg = parseGithubName(
+    team.allowed_github_org,
+    "web.allowed_github_org",
+    configFile,
+  );
+  const allowedGithubOrg = userOrg ?? teamOrg;
+  const ttl =
+    parseLoginLinkTtl(user.login_link_ttl, "config/local/user.yml") ??
+    parseLoginLinkTtl(team.login_link_ttl, configFile);
   return {
+    ...(ownerGithub ? { ownerGithub } : {}),
+    ...(allowedGithubOrg
+      ? {
+          allowedGithubOrg,
+          allowedGithubOrgFile: userOrg ? "config/local/user.yml" : configFile,
+        }
+      : {}),
+    loginLinkTtlMs: ttl ?? LOGIN_CODE_TTL_MS,
     ...(machineName ? { machineName } : {}),
     ...(sshUser !== undefined ? { sshUser } : {}),
     allowPlainHttpRemote: plain === true,

package/src/ui/cli/agent-ops.ts

@@ -71,7 +71,10 @@ import {
   type CatalogEntry,
 } from "../../shared/agents/catalog.js";
 import { checkRuntimeBin } from "../../shared/agents/catalog-runtime.js";
-import { agentSessionName } from "../../shared/agents/session-name.js";
+import {
+  agentSessionName,
+  peerSessionName,
+} from "../../shared/agents/session-name.js";
 import { cliEntrypoint } from "../../shared/engine.js";
 import { getDistRoot } from "../../shared/paths.js";
 import { envKey } from "../../shared/product.js";
@@ -1637,11 +1640,17 @@ export async function startAgent(
     );
   ptyOrRefuse(d);
   const allow = allowedFor(d, persona, ch.extras);
+  // D24: the name peers see it by, from the name it will have (below).
+  const peerName = peerSessionName(d.cli, ws, {
+    id,
+    displayName: given ?? prev?.displayName ?? persona.displayName,
+  });
   const input = {
     ...launchInput(d, cfg, persona, ws, id, model, det.path, undefined, {
       ...(ch.permission ? { permission: ch.permission } : {}),
       ...(rt.permissions ? { allow } : {}),
     }),
+    sessionLabel: peerName,
     ...(more.firstPrompt ? { firstPrompt: more.firstPrompt } : {}),
     // 0.4.18: Start agent here: in a folder of the workspace's.
     ...(req.folder !== undefined && !more.bringIn
@@ -1699,6 +1708,7 @@ export async function startAgent(
           workspace: ws,
           cwd: input.worktree,
           sessionName: sessionName(d.dist, ws, id),
+          peerName,
           // AG-4b: a name given to the agent is the agent's, not its
           // conversation's: Start fresh and Relaunch keep it. AG-10.8:
           // else its persona's name ("Rita").
@@ -2175,8 +2185,11 @@ export async function resumeAgent(
       },
     );
     // Resume in the cwd the agent had, wherever the workspace points now.
+    // D24 (and D25: a rename since) the name peers see it by.
+    const peerName = peerSessionName(d.cli, rec.workspace, rec);
     const at = {
       ...input,
+      sessionLabel: peerName,
       worktree: rec.cwd,
       ...(rec.resumeToken ? { resumeToken: rec.resumeToken } : {}),
     };
@@ -2211,7 +2224,12 @@ export async function resumeAgent(
         d,
         c,
         {
-          rec: { ...base, cwd: rec.cwd, ...(token ? { launched: true } : {}) },
+          rec: {
+            ...base,
+            cwd: rec.cwd,
+            peerName,
+            ...(token ? { launched: true } : {}),
+          },
           argv: out.argv,
           env: out.env,
           passthrough: rt.envPassthrough,

package/src/ui/cli/agents-command.ts

@@ -87,6 +87,7 @@ import {
   relaunchAgent,
   removeAgent,
   removeStopped,
+  renameAgent,
   resolveAgentsDeps,
   resumeAgent,
   resumeInterrupted,
@@ -99,6 +100,7 @@ import {
   type RuntimeChoice,
   type Started,
 } from "./agent-ops.js";
+import { peerSessionName } from "../../shared/agents/session-name.js";
 import {
   columns,
   guarded,
@@ -119,7 +121,7 @@ export {
 
 export const AGENTS_HELP = {
   usage:
-    "agents <list|start|stop|resume|relaunch|import|persona|rm|personas|doctor|handback-check|handoff-check> ...",
+    "agents <list|start|stop|resume|relaunch|import|persona|rename|rm|personas|doctor|handback-check|handoff-check> ...",
   lines: [
     "Agents: a persona and a workspace, run by a runtime in a session that",
     "outlives the web server (see `{cli} sessions`).",
@@ -156,6 +158,11 @@ export const AGENTS_HELP = {
     "    persona's role, permissions and commands; id, name, folder and model stay.",
     "    Mid-turn it asks: --after-turn waits for the turn to end, --now stops it.",
     "    A person's only (refused in an agent's session)",
+    "{cli} agents rename <id> <name> [-w <ws>]",
+    "{cli} agents rename <id> --clear [-w <ws>]",
+    "    name an agent (its tab, row and pane header); the id never changes.",
+    "    Other sessions see it as {cli}-<ws>:<name> from its next start or resume.",
+    "    --clear: back to its id",
     "{cli} agents rm <id> [-w <ws>]",
     "{cli} agents rm --stopped [-w <ws>]",
     "    forget a stopped, interrupted or exited agent (never a running one);",
@@ -513,6 +520,28 @@ async function resumeAll(args: string[], d: AgentsResolved): Promise<number> {
 }
 
 /** `agents rm <id> [-w <ws>]`, `agents rm --stopped [-w <ws>]` (AG-14.1b). */
+/** D25: `agents rename <id> <name>|--clear [-w <ws>]`. */
+function rename(args: string[], d: AgentsResolved): number {
+  const where = "agents rename";
+  const p = parseArgs(where, args, { "--workspace": true, "--clear": false });
+  const [id, ...words] = p.positional;
+  if (!id) throw new UsageError(`${where} needs <id> and a name, or --clear`);
+  const name = words.join(" ").trim();
+  if (p.flags["--clear"] && name)
+    throw new UsageError(`${where}: give a name or --clear, not both`);
+  if (!p.flags["--clear"] && !name)
+    throw new UsageError(`${where} needs a name (or --clear)`);
+  const ws =
+    workspaceFlag(where, p) ?? readRecord(d.stateDir(), id)?.workspace ?? "";
+  const rec = renameAgent(d, id, ws, p.flags["--clear"] ? null : name);
+  d.out(
+    rec.displayName
+      ? `renamed agent ${id} to "${rec.displayName}"; others see it as ${peerSessionName(d.cli, rec.workspace, rec)} from its next start or resume`
+      : `agent ${id} has no name now; others see it as ${peerSessionName(d.cli, rec.workspace, rec)} from its next start or resume`,
+  );
+  return 0;
+}
+
 async function rm(args: string[], d: AgentsResolved): Promise<number> {
   const where = "agents rm";
   const p = parseArgs(where, args, { "--workspace": true, "--stopped": false });
@@ -767,6 +796,8 @@ export async function cmdAgents(
         case "persona":
           await loadAgentWorkspaces(deps);
           return await persona(rest, d);
+        case "rename":
+          return rename(rest, d);
         case "rm":
           await loadAgentWorkspaces(deps);
           return await rm(rest, d);

package/src/ui/cli/create.ts

@@ -13,6 +13,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { execFileSync } from "node:child_process";
 import { ENGINE_PACKAGE, getEngineRoot } from "../../shared/paths.js";
 import { profileFrom } from "../../shared/profile.js";
 import { parse as parseYaml } from "yaml";
@@ -31,6 +32,44 @@ export interface CreateOptions {
   envPrefix?: string;
   /** The Den version the distribution pins (exact). */
   denVersion: string;
+  /**
+   * D17: `web.allowed_github_org`: the GitHub org whose members may claim
+   * an instance of it (each developer's own). Unset: a commented line.
+   */
+  githubOrg?: string;
+}
+
+const GITHUB_ORG = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+
+/**
+ * The GitHub owner of a git remote URL (https or ssh), or null:
+ * `git@github.com:acme/acme-den.git` → `acme`.
+ */
+export function githubOwnerOfRemote(url: string): string | null {
+  const m =
+    /^(?:https?:\/\/(?:[^@/]+@)?github\.com\/|(?:ssh:\/\/)?git@github\.com[:/])([^/]+)\//i.exec(
+      url.trim(),
+    );
+  return m && GITHUB_ORG.test(m[1]) ? m[1] : null;
+}
+
+/**
+ * The GitHub owner of the repo `dir` is in (its nearest existing folder's
+ * `origin`), or null: no repo, no origin, not GitHub.
+ */
+export function githubOrgOfDir(dir: string): string | null {
+  let d = path.resolve(dir);
+  while (!fs.existsSync(d) && path.dirname(d) !== d) d = path.dirname(d);
+  try {
+    const url = execFileSync("git", ["-C", d, "remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5_000,
+    });
+    return githubOwnerOfRemote(url);
+  } catch {
+    return null;
+  }
 }
 
 const NAME = /^[a-z][a-z0-9-]*$/;
@@ -58,6 +97,10 @@ export function validateCreateOptions(opts: CreateOptions): void {
     throw new Error("--title must not be empty");
   if (opts.title !== undefined && /[\n"\\]/.test(opts.title))
     throw new Error("--title must be one line without quotes or backslashes");
+  if (opts.githubOrg !== undefined && !GITHUB_ORG.test(opts.githubOrg))
+    throw new Error(
+      `--github-org "${opts.githubOrg}" must be a GitHub org name (letters, digits and dashes)`,
+    );
   // The profile validates the env prefix the same way den.yml would.
   profileFrom({
     name: opts.name,
@@ -152,6 +195,13 @@ export function renderDistribution(
     "# Unset, Den lists no GitHub repos (and never calls gh for them). E.g.",
     "# github_org: example-org",
     "",
+    "# Who may claim an instance. Each developer runs their own and opens it",
+    "# in the browser; a member of this GitHub org connects their GitHub",
+    "# account there, on their own computer, and owns that instance.",
+    ...(opts.githubOrg
+      ? ["web:", `  allowed_github_org: ${opts.githubOrg}`]
+      : ["# web:", "#   allowed_github_org: your-github-org"]),
+    "",
     "# Secrets backend: none (this distribution needs no secrets store), or",
     "# env (plain environment variables), doppler or 1password. A backend's",
     "# refs say where Den's own features find their secrets, e.g.",
@@ -307,8 +357,14 @@ export interface ParsedCreateArgs extends Omit<CreateOptions, "denVersion"> {
   port?: number;
 }
 
+/** Where create finds web.allowed_github_org when --github-org isn't given. */
+export interface CreateOrgOptions {
+  /** The GitHub owner of the repo the new folder is in (default: git's). */
+  githubOrgOf?: (dir: string) => string | null;
+}
+
 const CREATE_USAGE =
-  "usage: den create <name> [dir] [--title <title>] [--cli <cli>] [--env-prefix <PREFIX>] [--port <n>] [--yes] [--json]";
+  "usage: den create <name> [dir] [--title <title>] [--cli <cli>] [--env-prefix <PREFIX>] [--port <n>] [--github-org <org>] [--yes] [--json]";
 
 /** Parse `create` argv (after the word `create`). `cwd` resolves the dir. */
 export function parseCreateArgs(argv: string[], cwd: string): ParsedCreateArgs {
@@ -326,7 +382,7 @@ export function parseCreateArgs(argv: string[], cwd: string): ParsedCreateArgs {
       json = true;
       continue;
     }
-    const m = /^--(title|cli|env-prefix|port)(?:=(.*))?$/.exec(a);
+    const m = /^--(title|cli|env-prefix|port|github-org)(?:=(.*))?$/.exec(a);
     if (m) {
       const value = m[2] ?? argv[++i];
       if (value === undefined)
@@ -345,6 +401,9 @@ export function parseCreateArgs(argv: string[], cwd: string): ParsedCreateArgs {
     title: flags.title,
     cli: flags.cli,
     envPrefix: flags["env-prefix"],
+    ...(flags["github-org"] !== undefined
+      ? { githubOrg: flags["github-org"].replace(/^@/, "") }
+      : {}),
     yes,
     json,
     ...(flags.port !== undefined ? { port: parsePortFlag(flags.port) } : {}),
@@ -370,6 +429,9 @@ config/environments/local.json, manifests/ and tests/pillars/.
   --env-prefix <PREFIX>  env-var prefix (default: <NAME>)
   --port <n>             the web UI's port (default: ${DEFAULT_PORT}, or the next
                          free one above it when that is in use)
+  --github-org <org>     web.allowed_github_org: members of this GitHub org
+                         connect their GitHub account to their own instance
+                         (default: the owner of the GitHub repo [dir] is in)
   --yes, -y              never prompt (create never does; for agents)
   --json                 print one JSON object: { ok, dir, cli, existed, port, next }
 
@@ -407,6 +469,8 @@ export interface CreateJson {
   port?: number;
   /** Set when DEFAULT_PORT was in use and `port` was picked instead. */
   portPicked?: { wanted: number; file: string };
+  /** D17: web.allowed_github_org as written, or null when it wasn't known. */
+  githubOrg?: string | null;
   next?: string[];
   error?: string;
   fix?: string;
@@ -478,12 +542,17 @@ export async function createResult(
   args: ParsedCreateArgs,
   cwd: string,
   denVersion: string = runningDenVersion(),
-  portOpts: CreatePortOptions = {},
+  portOpts: CreatePortOptions & CreateOrgOptions = {},
 ): Promise<CreateJson> {
   const cli = args.cli ?? args.name;
-  const next = (dir: string): string[] => [
+  const next = (dir: string, org?: string | null): string[] => [
     `cd ${cdPathFor(cwd, dir)}`,
     "npm install",
+    ...(org === null
+      ? [
+          `set web.allowed_github_org: <your GitHub org> in config/${args.name}.yml (who may claim an instance)`,
+        ]
+      : []),
     `./bin/${cli} repo add <path|git-url> --json`,
   ];
   try {
@@ -509,7 +578,17 @@ export async function createResult(
       args.port ??
       (await pickFreePort({ start: wanted, inUse: portOpts.inUse })) ??
       wanted;
-    const written = writeDistribution(args.dir, { ...args, denVersion });
+    // D17: the org whose members may claim an instance: --github-org, else
+    // the owner of the GitHub repo the folder is in.
+    const githubOrg =
+      args.githubOrg ??
+      (portOpts.githubOrgOf ?? githubOrgOfDir)(args.dir) ??
+      undefined;
+    const written = writeDistribution(args.dir, {
+      ...args,
+      denVersion,
+      ...(githubOrg ? { githubOrg } : {}),
+    });
     let portPicked: CreateJson["portPicked"];
     // Written when the port differs from what the distribution would use
     // anyway (an explicit --port that isn't the default, or a picked one).
@@ -537,7 +616,8 @@ export async function createResult(
       files: written.length,
       port,
       ...(portPicked ? { portPicked } : {}),
-      next: next(args.dir),
+      githubOrg: githubOrg ?? null,
+      next: next(args.dir, githubOrg ?? null),
     };
   } catch (e) {
     const error = (e as Error).message;
@@ -602,6 +682,12 @@ export async function runCreate(
       ? `Web UI port: ${r.port} (${r.portPicked.wanted} is in use here; set in ${r.portPicked.file}).`
       : `Web UI port: ${r.port}.`,
   );
+  if (!r.existed)
+    console.log(
+      r.githubOrg
+        ? `GitHub org: ${r.githubOrg} (web.allowed_github_org: its members connect their GitHub account to their own instance).`
+        : `GitHub org: not known. Set web.allowed_github_org in config/${args.name}.yml, or pass --github-org <org>, so your team can connect GitHub from the browser.`,
+    );
   console.log("");
   console.log("Next:");
   console.log(`  cd ${cdPathFor(cwd, dir)}`);