@monster-orange/den 0.4.23 → 0.4.25

package/CHANGELOG.md

@@ -4,6 +4,57 @@ All notable changes to Den are documented here. Each release lists the
 config and manifest changes a distribution must make to move to it under
 **Migrations**.
 
+## [0.4.25] - 2026-11-10
+
+### Added
+
+- **Agents can use Hub (HUB-1.5).** With `hub.url` and `hub.token` (a
+  secret ref in this install's own store) set, every agent Den launches
+  gets Hub's MCP server, so it can search Hub and publish docs and mocks
+  there. Hub knows the team from the install's token and the project from
+  the workspace's repos. The token stays in the agent's own 0600 MCP
+  file. Agents use Hub's tools without asking (`hub.allow_tools`, default
+  on; off, they ask like any tool). Settings › Agents › Hub and `doctor`
+  say whether Hub is connected, and to which team. Nothing changes
+  without `hub.url`. See docs/distributions.md, "Hub".
+
+### Fixed
+
+- **Rotation wording.** Add override with no target says "Pick an
+  agent", not "Pick a agent". An install select's inherit option is short
+  ("inherit (auto)"), with where it comes from in the tag beside it, and
+  a select never cuts its words at 375 px.
+- **doctor, an older session host.** A host from an earlier version, with
+  no service host behind it, is ℹ "older host (pid N)", not ⚠ "unknown":
+  it picks up this version the next time it exits, and nothing needs
+  doing.
+
+## [0.4.24] - 2026-11-10
+
+### Fixed
+
+- **Visit opens in Safari (D27).** Visit, in the service panel and the
+  rail's ↗, is now a real link (`target=_blank`) instead of a button that
+  called `window.open`, which Safari's popup blocker stopped. The panel
+  also holds its 5 s repaint while a pointer is down in it, so a click
+  is never lost to a repaint between press and release.
+- **Signing in from another machine (D29).** On an unclaimed Den with
+  `web.owner_github` set, "Sign in as @login" is the primary button. The
+  button that only works on the Den machine says so: "On <host> itself:
+  connect GitHub". With only `web.allowed_github_org`, the page says to
+  open it on that machine, or to set `web.owner_github`.
+- **Rotation overrides are picked by name (D30).** Settings › Agents ›
+  Rotation's Add override form has searchable pickers (type to filter,
+  arrow keys, Enter) for the agent, persona, workspace or service, and a
+  choice for each value, never a typed id. The overrides table shows
+  names; an override for something that is gone is greyed, with Remove.
+  At 375 px the table stacks into cards, so no word breaks mid-letter.
+- **doctor, where it runs.** In login mode (as installed), the server and
+  session host in the desktop session show ℹ, not ⚠. An older session
+  host still serving, with the service's own host standing by, is ℹ
+  "Nothing to do", not "unknown ✓". The version-manager node warning at
+  `service install` prints once, for the web job.
+
 ## [0.4.23] - 2026-11-10
 
 ### Added

package/docs/distributions.md

@@ -911,6 +911,53 @@ later plugins.
   one line per network. Stacks that are down, and projects with no routes
   file there, are left alone. (0.3.0-dev.40.)
 
+## Hub
+
+With `hub.url` set, every agent Den launches gets Hub's tools (HUB-1.5):
+it can search Hub and publish docs and mocks there. Without `hub.url`,
+nothing changes and nothing about Hub shows.
+
+```yaml
+# config/local/user.yml (or the org config; user.yml wins)
+hub:
+  url: https://hub.example.com
+  token: { vault: Private, item: Acme Hub, field: token }
+  # or the name of a secrets.refs entry: token: hub_install
+  allow_tools: true # the default: agents use Hub's tools without asking
+```
+
+- `hub.url` must be https. Plain http works only to this machine
+  (`localhost`, `*.localhost`).
+- `hub.token` is this install's Hub token (`hubi_…`, one per install,
+  made in Hub), as a ref in this install's own secrets store
+  (`secrets.provider`). Den never assumes a vault, item or field for it.
+- Each agent's MCP config gets a server named `hub`: Streamable HTTP at
+  `<hub.url>/mcp`, with `Authorization: Bearer <token>` and four plain
+  headers naming the caller: `X-Den-Agent` (its name), `X-Den-Session`
+  (a new opaque id per launch), `X-Den-Workspace` and `X-Den-Repos` (the
+  workspace's repos, `owner/repo`, comma-separated). Hub sets the team
+  from the token and the project from the repos.
+- Its prompt gets one line: "You can search Hub and publish docs and
+  mocks there with the hub\_\* tools; your team and project are set from
+  this Den install."
+- The token is only in the agent's own MCP file (mode 0600). It is never
+  in a command line, a record, a log, a page or an API answer.
+- `hub.allow_tools` (default `true`): agents use Hub's tools without
+  asking (Den allows `mcp__hub` for every agent it launches). The token
+  limits writes to this install's team, and Hub keeps every version. Set
+  it to `false` and Hub's tools ask before they run, like any tool. An
+  explicit deny in the install's own Claude Code permissions still wins.
+  Settings › Agents › Hub has the checkbox (it saves to
+  `config/local/user.yml`).
+- A Hub that is down, or a token that can't be read, never stops an
+  agent: it starts without Hub.
+
+Settings › Agents › Hub shows the URL, connected or not, the team and
+this install's label (from Hub's whoami tool), or why it can't connect.
+`GET /api/hub` answers the same. `<cli> doctor` has a Hub row: ✓ when
+connected, ⚠ with the reason when not. A Hub that is down never fails
+doctor.
+
 ## doctor
 
 `<cli> doctor` lists every strategy kind in the registry (secrets, tls,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monster-orange/den",
-  "version": "0.4.23",
+  "version": "0.4.25",
   "description": "Den: a local multi-repo dev orchestrator, HTTPS edge and E2E harness",
   "type": "module",
   "bin": {

package/service/install.sh

@@ -110,8 +110,9 @@ pick_node() {
   done
   # Warn when installing; `print` writes the plist and nothing else.
   if [ "${1:-}" = install ]; then
-    echo "⚠ the service will run $node, a version manager's node: it stops starting" >&2
-    echo "  when that version is removed. Re-run install after switching, or set DEN_SERVICE_NODE." >&2
+    echo "⚠ the web job will run $node, a version manager's node: it stops starting" >&2
+    echo "  when that version is removed (the session host runs Den's own copy of node)." >&2
+    echo "  Re-run install after switching, or set DEN_SERVICE_NODE." >&2
   fi
   echo "$node"
 }
@@ -165,7 +166,8 @@ host_exe() { # $1 node
 }
 
 write_plist() { # $1 = output file, $2 = web|host, $3 = mode
-  NODE="$(pick_node "$MODE")"
+  # Warned once, for the web job: the host job runs Den's node copy.
+  NODE="$(pick_node "$([ "$2" = web ] && echo "$MODE")")"
   TSX="$(find_tsx)" || { echo "✗ tsx not installed: run npm ci in $DIST" >&2; exit 1; }
   local exe="$NODE" label="$LABEL" log="web.log"
   if [ "$2" = host ]; then

package/src/shared/agents/den-claude.ts

@@ -50,6 +50,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { MCP_ACTIONS, configuredRuntimeBin } from "../den-config.js";
 import { rolePrompt } from "./personas.js";
+import { HUB_PROMPT_LINE } from "../hub.js";
 import { GUARDRAILS_DIR, guardrailHooks, hookCommands } from "./guardrails.js";
 import { DEFAULT_ROTATE } from "./rotation.js";
 import { idsInNames } from "./handback.js";
@@ -374,7 +375,17 @@ function common(input: LaunchInput): {
       )
     : null;
   const den = input.denToolsAllowed ? denToolRules(input.mcp.name) : null;
-  const allow = [...allowRules(input.allow ?? []), ...(den?.allow ?? [])];
+  // HUB-1.5: Hub's tools without asking, when hub.allow_tools is on (the
+  // default). Claude Code checks deny before allow: an install's deny wins.
+  const hubAllow =
+    input.mcp.hub?.allowTools === true
+      ? [`mcp__${input.mcp.hub.name}`, `mcp__${input.mcp.hub.name}__*`]
+      : [];
+  const allow = [
+    ...allowRules(input.allow ?? []),
+    ...(den?.allow ?? []),
+    ...hubAllow,
+  ];
   const ask = den?.ask ?? [];
   const settings =
     input.stateDir || hooks || allow.length ? settingsPath(input) : null;
@@ -393,7 +404,7 @@ function common(input: LaunchInput): {
         input.agentId,
         input.workspace.name,
         input.mcp.name,
-      ),
+      ) + (input.mcp.hub ? `\n\n${HUB_PROMPT_LINE}` : ""),
     ],
     files: {
       [file]: mcpConfigJson(input.mcp),

package/src/shared/agents/runtime.ts

@@ -60,6 +60,19 @@ export interface AgentMcp {
   env: Record<string, string>;
   /** The workspace it is pinned to. */
   scope: string;
+  /**
+   * HUB-1.5: Den Hub's MCP server (Streamable HTTP), when hub.url is set:
+   * its base URL and the headers (the bearer token among them). The
+   * headers go only into the agent's own 0600 MCP file, never into argv,
+   * a record, a log or a page.
+   */
+  hub?: {
+    name: string;
+    url: string;
+    headers: Record<string, string>;
+    /** hub.allow_tools: its tools run without asking (default on). */
+    allowTools?: boolean;
+  };
 }
 
 export interface LaunchInput {
@@ -322,8 +335,8 @@ export function whichBin(
 }
 
 /**
- * A standard MCP config (`mcpServers`, the shape most MCP clients read)
- * with Den's server as the only entry.
+ * A standard MCP config (`mcpServers`, the shape most MCP clients read):
+ * Den's server, and Den Hub's when it is set (HUB-1.5).
  */
 export function mcpConfigJson(mcp: AgentMcp): string {
   const [command, ...args] = mcp.command;
@@ -336,6 +349,15 @@ export function mcpConfigJson(mcp: AgentMcp): string {
             args,
             ...(Object.keys(mcp.env).length ? { env: mcp.env } : {}),
           },
+          ...(mcp.hub && mcp.hub.name !== mcp.name
+            ? {
+                [mcp.hub.name]: {
+                  type: "http",
+                  url: `${mcp.hub.url}/mcp`,
+                  headers: mcp.hub.headers,
+                },
+              }
+            : {}),
         },
       },
       null,

package/src/shared/hub.ts

@@ -0,0 +1,345 @@
+/**
+ * HUB-1.5: Den Hub for every agent Den launches.
+ *
+ *   hub:
+ *     url: https://hub.example.com       # the Hub's base URL
+ *     token: { item: …, field: … }        # a secret ref (or the name of a
+ *                                         # secrets.refs entry), resolved
+ *                                         # from this install's own store
+ *
+ * Read from the org config, then config/local/user.yml (user wins). SEC-0:
+ * the token is the install's, from the install's secrets backend; Den
+ * never assumes a vault, item or field of its own. With no hub.url,
+ * nothing changes and nothing is shown.
+ *
+ * Every agent gets Hub's MCP server (Streamable HTTP at `<url>/mcp`, with
+ * `Authorization: Bearer <token>`) and plain headers naming who calls:
+ * X-Den-Agent, X-Den-Session, X-Den-Workspace, X-Den-Repos. Hub picks the
+ * team (from the token) and the project (from the repos, then the
+ * workspace's name, then the team's default). The token is never logged,
+ * never in a page or an API answer: only in the agent's own 0600 MCP file.
+ */
+import { readDenConfig, readUserConfig, type DenConfig } from "./den-config.js";
+import {
+  getSecretsProvider,
+  namedSecretRef,
+  readSecretsConfig,
+  type SecretRef,
+  type SecretsConfig,
+  type SecretsProvider,
+} from "./secrets/index.js";
+
+/** The server's name in an agent's MCP config. */
+export const HUB_SERVER = "hub";
+
+/** The line every agent's prompt gets when Hub is set (generic). */
+export const HUB_PROMPT_LINE =
+  "You can search Hub and publish docs and mocks there with the hub_* tools; your team and project are set from this Den install.";
+
+export interface HubConfig {
+  /** The base URL, no trailing slash. */
+  url: string;
+  /** The token's ref in this install's store, or null when none is set. */
+  tokenRef: SecretRef | null;
+  /** Where the ref came from, for messages (never the value). */
+  tokenFrom: string;
+  /**
+   * hub.allow_tools (default true): agents use Hub's tools without asking.
+   * Off, they ask like any tool. An install's own deny rule still wins.
+   */
+  allowTools: boolean;
+}
+
+type RawHub =
+  | { url?: unknown; token?: unknown; allow_tools?: unknown }
+  | undefined;
+
+function rawHub(den: unknown, user: unknown): RawHub {
+  const d = (den as { hub?: RawHub } | null)?.hub ?? {};
+  const u = (user as { hub?: RawHub } | null)?.hub ?? {};
+  return { ...d, ...u };
+}
+
+/** A URL Den will send a token to: https, or http to this machine. */
+export function hubUrlProblem(url: string): string | null {
+  let u: URL;
+  try {
+    u = new URL(url);
+  } catch {
+    return `hub.url is not a URL: ${url}`;
+  }
+  const local =
+    ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname) ||
+    u.hostname.endsWith(".localhost");
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && local))
+    return `hub.url must be https (http only to this machine): ${url}`;
+  return null;
+}
+
+/**
+ * hub.* (org config, then user.yml), or null without hub.url. A bad value
+ * throws naming its key.
+ */
+export function readHubConfig(
+  den: DenConfig | Record<string, unknown> = readDenConfig(),
+  user: Record<string, unknown> = readUserConfig() as Record<string, unknown>,
+  secrets: () => SecretsConfig = readSecretsConfig,
+): HubConfig | null {
+  const h = rawHub(den, user);
+  if (h?.url === undefined || h.url === null || h.url === "") return null;
+  if (typeof h.url !== "string") throw new Error("hub.url must be a string");
+  const url = h.url.trim().replace(/\/+$/, "");
+  const bad = hubUrlProblem(url);
+  if (bad) throw new Error(bad);
+  const t = h.token;
+  let tokenRef: SecretRef | null = null;
+  let tokenFrom = "hub.token";
+  if (typeof t === "string" && t.trim()) {
+    // The name of a secrets.refs entry.
+    tokenFrom = `secrets.refs.${t.trim()}`;
+    tokenRef = namedSecretRef(t.trim(), secrets());
+  } else if (t && typeof t === "object") {
+    const r = t as Record<string, unknown>;
+    const s = (v: unknown) => (typeof v === "string" ? v.trim() : "");
+    const ref: SecretRef = {
+      vault: s(r.vault),
+      item: s(r.item),
+      field: s(r.field) || s(r.key),
+    };
+    if (s(r.key)) ref.key = s(r.key);
+    tokenRef = ref.item || ref.key || ref.field ? ref : null;
+  } else if (t !== undefined && t !== null)
+    throw new Error(
+      "hub.token must be a secret ref ({ item, field } or { key }) or the name of a secrets.refs entry",
+    );
+  const at = h.allow_tools;
+  if (at !== undefined && at !== null && typeof at !== "boolean")
+    throw new Error("hub.allow_tools must be true or false");
+  return { url, tokenRef, tokenFrom, allowTools: at !== false };
+}
+
+/**
+ * Apply a POSTed `hub_allow_tools` to user.yml's hub block (in place): a
+ * boolean sets hub.allow_tools, null clears it (back to the default, on).
+ */
+export function patchHubAllowTools(
+  user: Record<string, unknown>,
+  v: unknown,
+): { ok: true } | { ok: false; error: string } {
+  if (v !== null && typeof v !== "boolean")
+    return { ok: false, error: "hub_allow_tools must be true, false or null" };
+  const hub = { ...((user.hub as Record<string, unknown> | undefined) ?? {}) };
+  if (v === null) delete hub.allow_tools;
+  else hub.allow_tools = v;
+  if (Object.keys(hub).length) user.hub = hub;
+  else delete user.hub;
+  return { ok: true };
+}
+
+/** The token from this install's store, or null (none set, or unreadable). */
+export async function readHubToken(
+  cfg: HubConfig,
+  provider: () => SecretsProvider = getSecretsProvider,
+): Promise<string | null> {
+  if (!cfg.tokenRef) return null;
+  try {
+    const v = await provider().tryGet(cfg.tokenRef);
+    return v && v.trim() ? v.trim() : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Who calls, as Hub reads it: plain names, never a secret. */
+export interface HubCaller {
+  agent: string;
+  session: string;
+  workspace: string;
+  repos: string[];
+}
+
+/** A header value: one line, printable, bounded. */
+const headerSafe = (v: string) => v.replace(/[^\x20-\x7e]/g, "?").slice(0, 512);
+
+export function hubHeaders(
+  token: string,
+  who: HubCaller,
+): Record<string, string> {
+  return {
+    Authorization: `Bearer ${token}`,
+    "X-Den-Agent": headerSafe(who.agent),
+    "X-Den-Session": headerSafe(who.session),
+    "X-Den-Workspace": headerSafe(who.workspace),
+    "X-Den-Repos": headerSafe(who.repos.join(",")),
+  };
+}
+
+/** owner/repo from a catalog entry: its gh slug, else its git remote. */
+export function ownerRepo(
+  entry: { gh?: string; remote?: string } | undefined,
+): string | null {
+  if (entry?.gh && /^[^/\s]+\/[^/\s]+$/.test(entry.gh)) return entry.gh;
+  const r = entry?.remote?.trim();
+  if (!r) return null;
+  const m = /[:/]([^/:\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(r);
+  return m ? `${m[1]}/${m[2]}` : null;
+}
+
+export interface HubWhoami {
+  team?: string;
+  label?: string;
+}
+
+export type HubStatus =
+  | { configured: false }
+  | {
+      configured: true;
+      url: string;
+      connected: boolean;
+      /** hub.allow_tools: agents use Hub's tools without asking. */
+      allowTools?: boolean;
+      team?: string;
+      label?: string;
+      /** Why it isn't connected, in words (never the token). */
+      problem?: string;
+    };
+
+/** The first object in a tool result: structured content, else JSON text. */
+function resultObject(r: unknown): Record<string, unknown> | null {
+  const o = r as {
+    structuredContent?: unknown;
+    content?: { type?: string; text?: string }[];
+  };
+  if (o?.structuredContent && typeof o.structuredContent === "object")
+    return o.structuredContent as Record<string, unknown>;
+  for (const c of o?.content ?? [])
+    if (c?.type === "text" && c.text)
+      try {
+        const v = JSON.parse(c.text) as unknown;
+        if (v && typeof v === "object") return v as Record<string, unknown>;
+      } catch {
+        /* not JSON */
+      }
+  return null;
+}
+
+/**
+ * Ask Hub who this install is: its whoami tool (the first tool whose name
+ * ends in "whoami"), over Streamable HTTP with the token. Bounded by
+ * `timeoutMs`; a failure is said in words, without the token.
+ */
+export async function hubWhoami(
+  url: string,
+  token: string,
+  opts: { timeoutMs?: number; fetch?: typeof fetch } = {},
+): Promise<HubWhoami> {
+  // Loaded here: only Settings › Hub and doctor ask Hub anything.
+  const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
+  const { StreamableHTTPClientTransport } =
+    await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
+  const transport = new StreamableHTTPClientTransport(new URL(`${url}/mcp`), {
+    requestInit: { headers: { Authorization: `Bearer ${token}` } },
+    ...(opts.fetch ? { fetch: opts.fetch } : {}),
+  });
+  const client = new Client({ name: "den", version: "1" });
+  const timeout = opts.timeoutMs ?? 5000;
+  let timer: NodeJS.Timeout | undefined;
+  const bounded = <T>(p: Promise<T>) =>
+    Promise.race([
+      p,
+      new Promise<never>((_r, rej) => {
+        timer = setTimeout(
+          () => rej(new Error(`Hub did not answer in ${timeout} ms`)),
+          timeout,
+        );
+      }),
+    ]).finally(() => clearTimeout(timer));
+  try {
+    await bounded(client.connect(transport));
+    const tools = await bounded(client.listTools());
+    const who = tools.tools.find((t) => /whoami$/.test(t.name));
+    if (!who) return {};
+    const r = resultObject(
+      await bounded(client.callTool({ name: who.name, arguments: {} })),
+    );
+    const str = (v: unknown) => (typeof v === "string" && v ? v : undefined);
+    return {
+      ...(str(r?.team ?? (r?.team_name as unknown))
+        ? { team: str(r?.team ?? r?.team_name)! }
+        : {}),
+      ...(str(r?.label ?? r?.install ?? r?.install_label)
+        ? { label: str(r?.label ?? r?.install ?? r?.install_label)! }
+        : {}),
+    };
+  } finally {
+    await client.close().catch(() => undefined);
+  }
+}
+
+/** A message that is safe to show: the token, if it slipped in, cut out. */
+export function scrubToken(msg: string, token: string | null): string {
+  return token ? msg.split(token).join("[token]") : msg;
+}
+
+/** Settings › Hub and doctor: set, connected, and to whom. */
+export async function hubStatus(
+  deps: {
+    config?: () => HubConfig | null;
+    token?: (c: HubConfig) => Promise<string | null>;
+    whoami?: (url: string, token: string) => Promise<HubWhoami>;
+  } = {},
+): Promise<HubStatus> {
+  let cfg: HubConfig | null;
+  try {
+    cfg = (deps.config ?? (() => readHubConfig()))();
+  } catch (e) {
+    return {
+      configured: true,
+      url: "",
+      connected: false,
+      problem: (e as Error).message,
+    };
+  }
+  if (!cfg) return { configured: false };
+  if (!cfg.tokenRef)
+    return {
+      configured: true,
+      url: cfg.url,
+      allowTools: cfg.allowTools,
+      connected: false,
+      problem:
+        cfg.tokenFrom === "hub.token"
+          ? "no hub.token: set it to the install token's secret ref (Hub › Settings › Den installs makes one)"
+          : `hub.token names ${cfg.tokenFrom}, which is not set for this install's secrets backend`,
+    };
+  const token = await (deps.token ?? ((c) => readHubToken(c)))(cfg);
+  if (!token)
+    return {
+      configured: true,
+      url: cfg.url,
+      allowTools: cfg.allowTools,
+      connected: false,
+      problem: `${cfg.tokenFrom} could not be read from this install's secrets store`,
+    };
+  try {
+    const who = await (deps.whoami ?? ((u, t) => hubWhoami(u, t)))(
+      cfg.url,
+      token,
+    );
+    return {
+      configured: true,
+      url: cfg.url,
+      allowTools: cfg.allowTools,
+      connected: true,
+      ...who,
+    };
+  } catch (e) {
+    return {
+      configured: true,
+      url: cfg.url,
+      allowTools: cfg.allowTools,
+      connected: false,
+      problem: scrubToken(`Hub did not answer: ${(e as Error).message}`, token),
+    };
+  }
+}