@monster-orange/den 0.4.3 → 0.4.4

package/src/ui/server/index.ts

@@ -17,6 +17,7 @@ import {
   type ContainerHealthTarget,
 } from "../../shared/stacks/compose-health.js";
 import { healthCheckFields, type HealthCheckType } from "./health-row.js";
+import { notCheckedReason } from "../../shared/health/not-checked.js";
 import { hasRuntime, repoKind } from "../../shared/repo-kind.js";
 import * as http from "http";
 import * as net from "net";
@@ -162,6 +163,7 @@ import {
   saveSudoToVault,
   sudoRef,
   sudoVaultStatus,
+  sudoVaultWhere,
   SUDO_REF_NAME,
 } from "../../shared/auth/sudo-vault.js";
 import {
@@ -275,6 +277,10 @@ interface HealthResult {
   pending?: boolean;
   status?: number;
   error?: string;
+  /** A 3xx answer's target (MCP-2.4): ok null, not down. */
+  redirect?: string;
+  /** With ok null and nothing checked: why not (MCP-2.4). */
+  why?: string;
   /** Where the app opens for this env (open-in-new-tab), or null. */
   openUrl?: string | null;
   /** Extra named links for this env. */
@@ -716,12 +722,14 @@ const CONFIG_FREE_PAGES = new Set(["/settings", "/settings.html", "/logs"]);
 import {
   setSudoPassword,
   clearSudoPassword,
+  clearSudoShims,
   closeLockForThisRequest,
   inRequestLockScope,
   getSudoEnv,
   prewarmSudo,
   hasSudoPassword,
   hasPasswordlessSudo,
+  watchSudo,
 } from "./sudo-store.js";
 import {
   guardStdio,
@@ -730,6 +738,9 @@ import {
   requestShutdown,
 } from "./shutdown-guard.js";
 
+/** This server saved the admin password to the vault or loaded it from there. */
+let sudoInVault = false;
+
 // ── HTTP helpers ─────────────────────────────────────────────────────────────
 import { sweepLogs } from "../../shared/process/log-rotation.js";
 import {
@@ -1843,6 +1854,8 @@ async function handleRequest(
       compose: ComposeHealthTarget | null;
       /** A `type: container` check: answered from the shared listing. */
       container: ContainerHealthTarget | null;
+      /** The repo has no manifest (the row is kept, unchecked). */
+      noManifest?: boolean;
       meta: Pick<HealthResult, "runs" | "target" | "focused" | "workspaces">;
     }> = [];
     const focusName = getFocusedWorkspaceName();
@@ -1885,6 +1898,7 @@ async function handleRequest(
           org: orgOf(resolved.repoName, catalog),
           compose: null,
           container: null,
+          noManifest: true,
           meta: {
             runs: "none",
             target: null,
@@ -2012,6 +2026,7 @@ async function handleRequest(
       expect,
       compose,
       container,
+      noManifest,
     }) => {
       if (checkType !== "none") {
         const started = Date.now();
@@ -2078,6 +2093,13 @@ async function handleRequest(
         isEntrypoint,
         ...meta,
         ok: null,
+        why: notCheckedReason({
+          env,
+          runs: meta.runs,
+          target: meta.target,
+          manifest: !noManifest,
+          conventional,
+        }),
       };
     };
     // Stream each result the moment it lands. The checks run concurrently but
@@ -2244,9 +2266,10 @@ async function handleRequest(
       Connection: "keep-alive",
       "X-Accel-Buffering": "no",
     });
-    const emit = (obj: unknown): void => {
+    // LK-0: the command's sudo without the password is a needs-sudo event.
+    const emit = watchSudo((obj: unknown): void => {
       res.write(`data: ${JSON.stringify(obj)}\n\n`);
-    };
+    }, `${repoName}/${svcName} ${cmdName}`);
     // Every fail here is before anything ran: a refusal or a lookup miss.
     // Recorded, so failed attempts show in the activity trail (F2).
     const fail = (msg: string): void => {
@@ -3864,8 +3887,13 @@ async function handleRequest(
   }
 
   // ── API: sudo password ────────────────────────────────────────────────────
+  // LK-0: the admin password is for sudo, and nothing else: no route asks
+  // for it as an access check. A run that is about to run sudo without it
+  // streams a needs-sudo event (watchSudo); the page asks, then runs again.
   // POST /api/sudo-password  body: { password: string, saveToVault?: boolean }
-  // GET  /api/sudo-password/status         → { set: boolean }
+  // POST /api/sudo-password/forget         → { ok, vaultCleared, vaultError? }
+  // GET  /api/sudo-password/status         → { set, passwordless,
+  //        saved: "vault" | "session" | null, vault: { configured, label } }
   // GET  /api/sudo-password/vault-status   → { backend, label, configured,
   //        backendAvailable, reason?, hasStored, opAvailable (deprecated) }
   // POST /api/sudo-password/load-from-vault → { ok, reason?, message? }
@@ -3901,6 +3929,7 @@ async function handleRequest(
         try {
           await saveSudoToVault(password);
           savedToVault = true;
+          sudoInVault = true;
         } catch (err) {
           vaultError = (err as Error).message;
         }
@@ -3912,10 +3941,51 @@ async function handleRequest(
   }
 
   if (pathname === "/api/sudo-password/status") {
-    // passwordless: NOPASSWD sudoer (or warm cache) — no admin login needed.
+    // passwordless: NOPASSWD sudoer (or warm cache) — sudo needs none.
+    // saved (Settings, LK-0): "vault" once this server saved it there or
+    // loaded it from there, "session" when it is held in memory only.
+    const set = hasSudoPassword();
     return sendJson(res, {
-      set: hasSudoPassword(),
+      set,
       passwordless: hasPasswordlessSudo(),
+      saved: sudoInVault ? "vault" : set ? "session" : null,
+      vault: sudoVaultWhere(),
+    });
+  }
+
+  // Forget (Settings, LK-0): the password this server holds goes, and the
+  // vault's copy when this server knows there is one (written empty, which
+  // every read takes as none). sudo's own cache is dropped too.
+  if (pathname === "/api/sudo-password/forget") {
+    if (req.method !== "POST") {
+      res.writeHead(405);
+      res.end();
+      return;
+    }
+    clearSudoPassword();
+    try {
+      execSync("sudo -k", {
+        stdio: ["ignore", "ignore", "ignore"],
+        timeout: CLI_SPAWN_TIMEOUT_MS,
+      });
+    } catch {
+      /* best-effort */
+    }
+    let vaultCleared = false;
+    let vaultError: string | undefined;
+    if (sudoInVault) {
+      try {
+        await saveSudoToVault("");
+        vaultCleared = true;
+        sudoInVault = false;
+      } catch (err) {
+        vaultError = (err as Error).message;
+      }
+    }
+    return sendJson(res, {
+      ok: true,
+      vaultCleared,
+      ...(vaultError ? { vaultError } : {}),
     });
   }
 
@@ -3960,6 +4030,7 @@ async function handleRequest(
       return sendJson(res, { ok: false, reason: "stale" });
     }
     setSudoPassword(password);
+    sudoInVault = true;
     return sendJson(res, { ok: true });
   }
 
@@ -4747,7 +4818,7 @@ async function stopDaemons(): Promise<void> {
 }
 
 async function handleShutdown(signal: string): Promise<void> {
-  clearSudoPassword();
+  clearSudoShims();
   // The registry lives in the state dir, which is resolved from the
   // distribution root on every call: if that can no longer be found (den.yml
   // moved or removed while the server ran), still exit. Never product() here:

package/src/ui/server/public/agent-start.js

@@ -13,6 +13,11 @@
  * Start is disabled and the line says why and how to fix it (install it,
  * or set agents.runtimes.<id>.bin in the user.yml it names, or run
  * `<cli> agents doctor`). Nothing fails only after Start.
+ *
+ * AG-0.5: the runtimes come installed first (the server's order). One
+ * that runs as its own CLI, without Den's tools yet, says "Den tools:
+ * coming"; one not installed is disabled; generic is startable only for a
+ * persona with an argv template. Nothing is offered that can't start.
  */
 
 function escHtml(s) {
@@ -53,10 +58,28 @@ export function defaultRuntimeOf(personas, runtimes, personaId) {
   return (runtimes ?? []).find((r) => r.default)?.id ?? "";
 }
 
+/** A catalog runtime the search didn't find (not a path someone set). */
+const notFound = (r) =>
+  !r.available &&
+  r.denTools !== undefined &&
+  r.source !== "setting" &&
+  r.source !== "workspace";
+
+/** Why runtime `r` can't start for persona `personaId`, or "" when it can. */
+export function cantStart(personas, r, personaId, t) {
+  if (!r.available) return r.why || t("ag.unavailable");
+  // generic runs the persona's own argv: none, nothing to run.
+  if (r.id === "generic") {
+    const p = (personas ?? []).find((x) => x.id === personaId);
+    if (!p?.argv?.length) return t("ag.rt.needsArgv");
+  }
+  return "";
+}
+
 /**
  * The runtime select's options. The first ("" = the persona's) reads
  * "<name> (persona default)"; one that can't run here is disabled and
- * says why.
+ * says why; one without Den's tools yet says so.
  */
 export function runtimeOptions(personas, runtimes, personaId, t) {
   const name = runtimeName(
@@ -69,12 +92,18 @@ export function runtimeOptions(personas, runtimes, personaId, t) {
     (runtimes ?? [])
       .map((r) => {
         const label = runtimeName(runtimes, r.id);
-        return r.available
-          ? `<option value="${escHtml(r.id)}">${escHtml(
-              r.version ? `${label} · ${r.version}` : label,
+        const no = cantStart(personas, r, personaId, t);
+        const parts = [
+          label,
+          r.version,
+          r.denTools === false ? t("ag.rt.denTools") : "",
+        ];
+        return no
+          ? `<option value="${escHtml(r.id)}" disabled>${escHtml(
+              `${label} — ${notFound(r) ? t("ag.rt.notInstalled") : no}`,
             )}</option>`
-          : `<option value="${escHtml(r.id)}" disabled>${escHtml(
-              `${label} — ${r.why || t("ag.unavailable")}`,
+          : `<option value="${escHtml(r.id)}">${escHtml(
+              parts.filter(Boolean).join(" · "),
             )}</option>`;
       })
       .join("")
@@ -103,6 +132,13 @@ export function readiness(data, personaId, runtimeId, t) {
   const name = runtimeName(runtimes, r.id);
   const mono = (x) => `<span class="mono">${escHtml(x)}</span>`;
   if (r.available) {
+    const no = cantStart(personas, r, personaId, t);
+    if (no)
+      return {
+        ok: false,
+        tone: "warn",
+        html: escHtml(t("ag.rt.refused", { name, why: no })),
+      };
     if (!r.path) return { ok: true, tone: "none", html: "" };
     return {
       ok: true,
@@ -114,7 +150,10 @@ export function readiness(data, personaId, runtimeId, t) {
             : t("ag.rt.readyNoVer", { name }),
         ) +
         " " +
-        mono(r.path),
+        mono(r.path) +
+        (r.denTools === false
+          ? ` <span class="tagx" data-den-tools="coming">${escHtml(t("ag.rt.denTools"))}</span> ${escHtml(t("ag.rt.ownCli"))}`
+          : ""),
     };
   }
   const file = data?.userConfig || "config/local/user.yml";