@monster-orange/den 0.4.20 → 0.4.22

package/src/ui/cli/doctor-command.ts

@@ -51,6 +51,7 @@ import {
 } from "../../shared/sessions/den-pty.js";
 import {
   getStrategy,
+  strategyIds,
   strategyKinds,
 } from "../../shared/strategies/registry.js";
 import {
@@ -65,6 +66,14 @@ import {
   type OnboardDeps,
 } from "./doctor-onboard.js";
 import { printJson } from "./json-out.js";
+import { ownerCheck, ownerLine } from "./doctor-owner.js";
+import {
+  formatWhere,
+  serviceJobState,
+  whereRows,
+  type WhereDeps,
+  type WhereRow,
+} from "./doctor-where.js";
 
 export interface DoctorRow {
   kind: string;
@@ -193,22 +202,45 @@ export function doctorRows(env: NodeJS.ProcessEnv = process.env): DoctorRow[] {
     ...kinds.filter((k) => !(k in SELECTORS)),
   ];
   const rows = ordered.map(
-    (kind) =>
-      SELECTORS[kind]?.(env) ?? {
-        kind,
-        selected: "",
-        implicit: false,
-        available: false,
-        reason: "no selector for this kind",
-        problem: false,
-        warnings: [],
-      },
+    (kind) => SELECTORS[kind]?.(env) ?? everyStrategyRow(kind, env),
   );
   const op = onePasswordTokenRow(env);
   if (op) rows.splice(rows.findIndex((r) => r.kind === "secrets") + 1, 0, op);
   return rows;
 }
 
+/**
+ * A kind no config selects one of (usage sources, D9): every registered
+ * strategy is in use, so the row names them all (implicit) and is available
+ * when any is. Never a problem: nothing was configured wrong. (It said
+ * "(invalid config) ✗ no selector for this kind" on every fresh install.)
+ */
+function everyStrategyRow(kind: string, env: NodeJS.ProcessEnv): DoctorRow {
+  const ids = strategyIds(kind);
+  const found = ids.map((id) => {
+    try {
+      return getStrategy(kind, id)?.detect(env) ?? { available: false };
+    } catch (e) {
+      return { available: false, reason: (e as Error).message };
+    }
+  });
+  const available = found.some((d) => d.available);
+  return {
+    kind,
+    selected: ids.join(", "),
+    implicit: true,
+    available,
+    reason: available
+      ? undefined
+      : found
+          .map((d) => d.reason)
+          .filter(Boolean)
+          .join("; ") || undefined,
+    problem: false,
+    warnings: [],
+  };
+}
+
 /**
  * The 1password row: shown only when 1Password is the configured provider
  * (secret_env refs and the engine's own secrets resolve through it) and the
@@ -241,15 +273,19 @@ function onePasswordTokenRow(env: NodeJS.ProcessEnv): DoctorRow | null {
 export function formatDoctor(rows: DoctorRow[], title: string): string[] {
   const lines = [chalk.bold(`${title} doctor: strategies`), ""];
   const width = Math.max(...rows.map((r) => r.kind.length));
-  for (const r of rows) {
-    const sel = r.selected
+  const selOf = (r: DoctorRow) =>
+    r.selected
       ? `${r.selected}${r.implicit ? " (implicit)" : ""}`
       : "(invalid config)";
+  // The state column lines up even past 20 ("den-claude (implicit)").
+  const selWidth = Math.max(20, ...rows.map((r) => selOf(r).length));
+  for (const r of rows) {
+    const sel = selOf(r);
     const state = r.available
       ? chalk.green("✓ available")
       : (r.problem ? chalk.red : chalk.yellow)("✗ unavailable");
     lines.push(
-      `  ${r.kind.padEnd(width)}  ${sel.padEnd(20)} ${state}${r.reason ? `: ${r.reason}` : ""}`,
+      `  ${r.kind.padEnd(width)}  ${sel.padEnd(selWidth)} ${state}${r.reason ? `: ${r.reason}` : ""}`,
     );
     for (const w of r.warnings) lines.push(chalk.yellow(`    ⚠ ${w}`));
   }
@@ -347,14 +383,73 @@ export function strategyCheck(r: DoctorRow): OnboardCheck {
 export async function doctorJson(
   deps: OnboardDeps,
   rows: DoctorRow[] = doctorRows(),
+  owner: () => Promise<OnboardCheck> = () => ownerCheck(),
 ): Promise<{ ok: boolean; checks: OnboardCheck[] }> {
   const checks = [
     ...(await onboardingChecks(deps)),
     ...rows.map(strategyCheck),
+    // D17: who can connect GitHub to this instance from the browser.
+    await owner(),
   ];
   return { ok: !checks.some((c) => c.status === "fail"), checks };
 }
 
+/** D18/D20: the real probes for doctor's "where it runs" rows. */
+export async function defaultWhereDeps(): Promise<WhereDeps> {
+  const os = await import("os");
+  const { readDenConfig: cfg, readWebServiceConfig } =
+    await import("../../shared/den-config.js");
+  const { readWebPort } = await import("../../shared/edge/config.js");
+  const { getDistRoot } = await import("../../shared/paths.js");
+  const { connectHost } = await import("../../shared/sessions/client.js");
+  const { sessionPaths } = await import("../../shared/sessions/paths.js");
+  return {
+    cli: product().cli,
+    platform: process.platform,
+    server: async () => {
+      const port = readWebPort(getDistRoot());
+      const res = await fetch(`http://localhost:${port}/api/server-info`, {
+        signal: AbortSignal.timeout(1500),
+      });
+      if (!res.ok) return null;
+      const body = (await res.json()) as { launchd?: string | null };
+      return { launchd: body.launchd ?? null };
+    },
+    host: async () => {
+      const c = await connectHost(sessionPaths(getStateDir()).socket);
+      try {
+        return {
+          launchd: c.hostLaunchd,
+          access: await c.access().catch(() => null),
+        };
+      } finally {
+        c.close();
+      }
+    },
+    service: () => {
+      try {
+        const { label } = readWebServiceConfig(
+          cfg(),
+          getDistRoot(),
+          os.homedir(),
+        );
+        return serviceJobState(label, os.homedir(), process.getuid?.() ?? 0);
+      } catch {
+        return null;
+      }
+    },
+  };
+}
+
+/** A "where it runs" row as a `doctor --json` check. */
+export function whereCheck(r: WhereRow): OnboardCheck {
+  return {
+    id: `where:${r.what.replace(" ", "-")}`,
+    status: r.status,
+    detail: `${r.session}${r.detail ? `: ${r.detail}` : ""}`,
+  };
+}
+
 export async function cmdDoctor(args: string[]): Promise<number> {
   const probe = args.includes("--probe");
   const json = args.includes("--json");
@@ -383,6 +478,9 @@ export async function cmdDoctor(args: string[]): Promise<number> {
     const r = await doctorJson(
       defaultOnboardDeps((url) => probeWebServer(url)),
     );
+    r.checks.push(
+      ...(await whereRows(await defaultWhereDeps())).map(whereCheck),
+    );
     printJson(r);
     return r.ok ? 0 : 1;
   }
@@ -390,6 +488,17 @@ export async function cmdDoctor(args: string[]): Promise<number> {
   for (const l of formatDoctor(rows, readBrand().name)) console.log(l);
   const held = approvalsLines(() => readMcpConfig().approvals);
   for (const l of held.lines) console.log(l);
+  // D17: who can connect GitHub to this instance from the browser.
+  const owner = await ownerCheck();
+  console.log("");
+  console.log(ownerLine(owner));
+  const ownerProblem = owner.status === "fail";
+  // D18/D20: where the server and the session host run (logout).
+  for (const l of formatWhere(
+    await whereRows(await defaultWhereDeps()),
+    readBrand().name,
+  ))
+    console.log(l);
   for (const l of pollingLines(eventsFile(), readBrand().name)) console.log(l);
   const cli = product().cli;
   if (!probe) {
@@ -398,7 +507,7 @@ export async function cmdDoctor(args: string[]): Promise<number> {
       agentsConfigured(readConfigOrNull(), getStateDir()),
     ))
       console.log(l);
-    return rows.some((r) => r.problem) || held.problem ? 1 : 0;
+    return rows.some((r) => r.problem) || held.problem || ownerProblem ? 1 : 0;
   }
   const { runEnvProbe, formatProbe } = await import("./env-probe.js");
   const { resolveDeps, plainSessionEnv } =
@@ -417,5 +526,7 @@ export async function cmdDoctor(args: string[]): Promise<number> {
   console.log("");
   for (const l of formatProbe(results)) console.log(l);
   const found = results.some((r) => r.findings.length);
-  return rows.some((r) => r.problem) || held.problem || found ? 1 : 0;
+  return rows.some((r) => r.problem) || held.problem || ownerProblem || found
+    ? 1
+    : 0;
 }

package/src/ui/cli/doctor-owner.ts

@@ -0,0 +1,122 @@
+/**
+ * doctor's owner check (D17): who can connect their GitHub account to this
+ * instance from the browser.
+ *
+ *  - An owner is linked: ok, naming it.
+ *  - No owner, but web.owner_github or web.allowed_github_org says who may
+ *    claim it: ok, naming them.
+ *  - Neither, and the edge is reachable from other machines: ✗ (a fail):
+ *    nobody can get in from a browser there, and the page can only name
+ *    the settings.
+ *  - Neither, edge not reachable beyond this machine: a warning.
+ */
+import { readWebOwner } from "../../shared/web-owner.js";
+import {
+  readWebAuthConfig,
+  type WebAuthConfig,
+} from "../../shared/web-session.js";
+import { getDistRoot, getStateDir } from "../../shared/paths.js";
+import { product } from "../../shared/product.js";
+import { readEdgeConfig, readWebPort } from "../../shared/edge/config.js";
+import { edgeNames, webRouteHosts } from "../../shared/edge/render.js";
+import { edgeExposure } from "../../shared/edge/exposure.js";
+import type { OnboardCheck } from "./doctor-onboard.js";
+import { ghLogin, ghNotSignedInHint } from "../../shared/owner-github.js";
+
+export interface OwnerCheckDeps {
+  owner?: () => { login: string } | null;
+  web?: () => WebAuthConfig;
+  /** Why the edge is reachable beyond this machine, or null. */
+  exposed?: () => Promise<string | null>;
+  configFile?: string;
+  /** The login gh is signed in as here, or null (default: ask gh). */
+  ghLogin?: () => string | null;
+}
+
+/**
+ * What to do when web.owner_github isn't set: gh is signed in but nothing
+ * recorded it yet (a restart does), or gh isn't signed in.
+ */
+export function ownerGithubHint(login: string | null, cli: string): string {
+  return login
+    ? `gh is signed in as @${login}: run \`${cli} web restart\` to record it as this Den's owner (web.owner_github), then connect your GitHub account from any browser.`
+    : ghNotSignedInHint(cli);
+}
+
+async function defaultExposed(): Promise<string | null> {
+  try {
+    const cfg = readEdgeConfig();
+    const hosts = webRouteHosts(cfg, new Set([readWebPort()])).map(
+      (r) => r.host,
+    );
+    return await edgeExposure(
+      hosts,
+      cfg.ports ? edgeNames(cfg.org).container : null,
+    );
+  } catch {
+    return null; // no edge
+  }
+}
+
+export async function ownerCheck(
+  deps: OwnerCheckDeps = {},
+): Promise<OnboardCheck> {
+  const owner = (deps.owner ?? (() => readWebOwner(getStateDir())))();
+  if (owner)
+    return {
+      id: "web:owner",
+      status: "ok",
+      detail: `owner: @${owner.login} (linked; Sign in with GitHub from any browser)`,
+    };
+  let web: WebAuthConfig;
+  try {
+    web = (
+      deps.web ?? (() => readWebAuthConfig(getDistRoot(), product().configFile))
+    )();
+  } catch (e) {
+    return { id: "web:owner", status: "fail", detail: (e as Error).message };
+  }
+  const configFile = deps.configFile ?? product().configFile;
+  const who = [
+    ...(web.ownerGithub
+      ? [`@${web.ownerGithub} from any browser (web.owner_github)`]
+      : []),
+    ...(web.allowedGithubOrg
+      ? [
+          `a member of ${web.allowedGithubOrg} on this computer (web.allowed_github_org)`,
+        ]
+      : []),
+  ];
+  // D17: owner_github carries most people (org memberships are usually
+  // private); without it, say how to get it.
+  const ghHint = web.ownerGithub
+    ? {}
+    : { ask: ownerGithubHint((deps.ghLogin ?? ghLogin)(), product().cli) };
+  if (who.length)
+    return {
+      id: "web:owner",
+      status: "ok",
+      detail: `no owner yet; who may connect GitHub to claim it: ${who.join(", or ")}`,
+      ...ghHint,
+    };
+  const exposed = await (deps.exposed ?? defaultExposed)();
+  // Only this machine reaches it: a note, not a warning (every fresh
+  // install starts this way, D12).
+  return {
+    id: "web:owner",
+    status: exposed ? "fail" : "ok",
+    detail:
+      `no owner, and nothing says who may claim it, so nobody can connect GitHub from the browser` +
+      (exposed
+        ? `; the edge is reachable from other machines (${exposed})`
+        : ""),
+    ask: `Which GitHub org's members may claim it (web.allowed_github_org in ${configFile}), or which GitHub login runs it here (web.owner_github in config/local/user.yml)?`,
+  };
+}
+
+/** The check as doctor prints it. */
+export function ownerLine(c: OnboardCheck): string {
+  const mark =
+    c.status === "fail" ? "✗" : c.status === "warn" ? "⚠" : c.ask ? "ℹ" : "✓";
+  return `  ${mark} ${c.detail}${c.ask ? `\n    ${c.ask}` : ""}`;
+}

package/src/ui/cli/doctor-where.ts

@@ -0,0 +1,203 @@
+/**
+ * D18/D20: doctor's "where it runs" rows (macOS only).
+ *
+ *   server        the web server's launchd session (/api/server-info)
+ *   session host  the session host's (its hello), where every agent runs
+ *   full disk access  whether the host (and so every agent) has it, and
+ *                 the executable to grant it to: Den's node copy, never the
+ *                 shared node
+ *   service       the installed launchd job: always (a LaunchDaemon, kept
+ *                 across logout) or login (a LaunchAgent in the desktop
+ *                 session), and "plist present, job not loaded" with the
+ *                 bootstrap that loads it
+ *
+ * A process in the desktop session (Aqua) stops at logout: a warning with
+ * the fix. None of these fails doctor.
+ */
+import { spawnSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import {
+  ALWAYS_UNPROVEN,
+  endsAtLogout,
+  sessionWarning,
+} from "../../shared/launchd-session.js";
+
+export type ServiceMode = "always" | "login";
+
+export interface ServiceJob {
+  /** unknown: launchctl could not be asked. */
+  state: "loaded" | "not-loaded" | "unknown";
+  mode: ServiceMode;
+  plist: string;
+  domain: string;
+}
+
+export interface WhereDeps {
+  cli: string;
+  platform: NodeJS.Platform;
+  /** The web server's launchd session; null when it does not answer. */
+  server: () => Promise<{ launchd?: string | null } | null>;
+  /** The running session host's; null when none runs. */
+  host: () => Promise<{
+    launchd: string | null;
+    access?: { exe: string; fullDiskAccess: boolean | null } | null;
+  } | null>;
+  service: () => ServiceJob | null;
+}
+
+export interface WhereRow {
+  what: "server" | "session host" | "full disk access" | "service";
+  session: string;
+  status: "ok" | "warn";
+  detail?: string;
+}
+
+function sessionRow(
+  what: "server" | "session host",
+  launchd: string | null | undefined,
+  cli: string,
+): WhereRow {
+  const session = launchd || "unknown";
+  return {
+    what,
+    session,
+    status: endsAtLogout(launchd) ? "warn" : "ok",
+    ...(sessionWarning(launchd, cli, what)
+      ? { detail: sessionWarning(launchd, cli, what)! }
+      : {}),
+  };
+}
+
+export async function whereRows(d: WhereDeps): Promise<WhereRow[]> {
+  if (d.platform !== "darwin") return [];
+  const rows: WhereRow[] = [];
+  const server = await d.server().catch(() => null);
+  rows.push(
+    server
+      ? sessionRow("server", server.launchd, d.cli)
+      : {
+          // Not started yet is not a problem (a fresh install).
+          what: "server",
+          session: "not running",
+          status: "ok",
+          detail: `start it: ${d.cli} web up, or ${d.cli} service install`,
+        },
+  );
+  const host = await d.host().catch(() => null);
+  rows.push(
+    host
+      ? sessionRow("session host", host.launchd, d.cli)
+      : {
+          what: "session host",
+          session: "not running",
+          status: "ok",
+          detail: "it starts when the first terminal or agent does",
+        },
+  );
+  const fda = host?.access;
+  if (fda && fda.fullDiskAccess !== null) {
+    const own = /-sessions-host$/.test(fda.exe);
+    rows.push(
+      fda.fullDiskAccess
+        ? {
+            what: "full disk access",
+            session: "granted",
+            status: "ok",
+            detail: `to ${fda.exe}`,
+          }
+        : {
+            what: "full disk access",
+            session: "not granted",
+            status: "warn",
+            detail: own
+              ? `agents can't open protected folders (other volumes, Desktop, Documents): System Settings → Privacy & Security → Full Disk Access → + → ${fda.exe}, then ${d.cli} sessions host --stop (it restarts with the grant)`
+              : `agents can't open protected folders. The host runs the shared node (${fda.exe}): ${d.cli} service install gives it its own copy to grant, so the grant never goes to every node program`,
+          },
+    );
+  }
+  const svc = d.service();
+  if (!svc)
+    rows.push({
+      what: "service",
+      session: "not installed",
+      status: "ok",
+      detail: `${d.cli} service install (login, the default; --mode always is opt-in and ${ALWAYS_UNPROVEN})`,
+    });
+  else if (svc.state === "not-loaded")
+    rows.push({
+      what: "service",
+      session: `${svc.mode} (${svc.domain})`,
+      status: "warn",
+      detail: `plist present, job not loaded: ${svc.domain === "system" ? "sudo " : ""}launchctl bootstrap ${svc.domain} ${svc.plist}`,
+    });
+  else
+    rows.push({
+      what: "service",
+      session: `${svc.mode} (${svc.domain})`,
+      status: "ok",
+      ...(svc.state === "unknown"
+        ? { detail: "launchctl could not be asked whether it is loaded" }
+        : svc.mode === "always"
+          ? { detail: `opt-in: ${ALWAYS_UNPROVEN}` }
+          : {}),
+    });
+  return rows;
+}
+
+export interface JobProbe {
+  exists: (p: string) => boolean;
+  /** `launchctl print <domain>/<label>`'s exit status (127: no launchctl). */
+  print: (target: string) => number | null;
+}
+
+const realProbe: JobProbe = {
+  exists: (p) => fs.existsSync(p),
+  print: (target) =>
+    spawnSync("launchctl", ["print", target], {
+      stdio: "ignore",
+      timeout: 3000,
+    }).status,
+};
+
+/**
+ * The installed service job for `label`: the LaunchDaemon (always) when
+ * its plist exists, else the LaunchAgent (login); null when neither does.
+ */
+export function serviceJobState(
+  label: string,
+  home: string,
+  uid: number,
+  probe: JobProbe = realProbe,
+): ServiceJob | null {
+  const daemon = path.join("/Library/LaunchDaemons", `${label}.plist`);
+  const agent = path.join(home, "Library", "LaunchAgents", `${label}.plist`);
+  const found: [ServiceMode, string, string] | null = probe.exists(daemon)
+    ? ["always", daemon, "system"]
+    : probe.exists(agent)
+      ? ["login", agent, `gui/${uid}`]
+      : null;
+  if (!found) return null;
+  const [mode, plist, domain] = found;
+  const code = probe.print(`${domain}/${label}`);
+  const state =
+    code === 0
+      ? "loaded"
+      : code === null || code === 127
+        ? "unknown"
+        : "not-loaded";
+  return { state, mode, plist, domain };
+}
+
+/** The rows as doctor prints them, under a heading. */
+export function formatWhere(rows: WhereRow[], title: string): string[] {
+  if (!rows.length) return [];
+  const lines = ["", `${title} doctor: where it runs`, ""];
+  const w = Math.max(...rows.map((r) => r.session.length));
+  for (const r of rows) {
+    const mark = r.status === "ok" ? "✓" : "⚠";
+    lines.push(`  ${r.what.padEnd(16)}  ${r.session.padEnd(w)}  ${mark}`);
+    if (r.detail) lines.push(`    ${r.status === "ok" ? "" : "⚠ "}${r.detail}`);
+  }
+  return lines;
+}

package/src/ui/cli/index.ts

@@ -5317,7 +5317,7 @@ class DenCLI {
       "  mcp --call <tool>    Call one MCP tool and print its result (--list: tool names)",
     );
     console.log(
-      "  service install      Run the web UI as a launchd service (status, print, uninstall)",
+      "  service install      Run the web UI as a launchd service (status, print, uninstall, help)",
     );
     console.log(
       "  theme add <repo>@<ref> Install a web UI theme (list, validate, remove)",