@monster-orange/den 0.4.3 → 0.4.5

package/src/shared/edge/status.ts

@@ -5,6 +5,7 @@
  */
 import * as fs from "fs";
 import * as path from "path";
+import * as tls from "tls";
 import { certNames, edgeDomains, edgeNames, routeUrl } from "./render.js";
 import {
   includedRouters,
@@ -28,7 +29,18 @@ export interface EdgeStatus {
   routes: { name: string; url: string; upstream: string }[];
   /** Names on the issued cert, or the planned ones when none is issued yet. */
   certNames: string[];
+  /**
+   * Whether Den minted the edge's cert itself (mkcert: its names stamp is
+   * there). False under `tls: files` (the distribution supplies the cert)
+   * and `tls: none`, whether or not HTTPS serves: see `https`.
+   */
+  certIssuedByDen: boolean;
+  /** @deprecated certIssuedByDen (MCP-2.5); kept for one release. */
   certIssued: boolean;
+  /** MCP-2.5: the TLS strategy in words, and whether HTTPS is serving. */
+  https: EdgeHttps;
+  /** Fields kept for one release under an old name, and what replaces them. */
+  deprecated: { certIssued: string };
   /** Whether the CA is trusted on this machine (null: can't tell, or none). */
   caTrusted: boolean | null;
   /**
@@ -59,6 +71,28 @@ export interface EdgeStatus {
   stackErrors: IncludedRouters["errors"];
 }
 
+export interface EdgeHttps {
+  strategy: EdgeConfig["tls"]["strategy"];
+  /**
+   * Who supplies the cert: "den" (mkcert, minted here), "distribution"
+   * (`tls: files`, or the legacy `issue_cert: false`), or "none" (http only).
+   */
+  certs: "den" | "distribution" | "none";
+  /**
+   * Whether the edge answers a TLS handshake on its https port: true, false,
+   * or null when it was not probed (`edge status` from the CLI, or a proxy
+   * in front owns the port).
+   */
+  serving: boolean | null;
+  /** How `serving` was decided, in words. */
+  detail: string;
+}
+
+export const CERT_ISSUED_DEPRECATION =
+  "certIssued is renamed certIssuedByDen (0.4.4) and goes in the release " +
+  "after: it says whether Den minted the cert itself, so it is false under " +
+  "tls strategy files while HTTPS serves. Read https.serving for that.";
+
 export interface EdgeStatusDeps {
   containerState: (name: string) => string;
   caTrusted: (cfg: EdgeConfig) => boolean | null;
@@ -113,7 +147,23 @@ export function edgeStatus(
     domains: edgeDomains(cfg),
     routes: edgeRoutes(cfg),
     certNames: issued ?? (cfg.tls.strategy === "none" ? [] : certNames(cfg)),
+    certIssuedByDen: issued !== null,
     certIssued: issued !== null,
+    https: {
+      strategy: cfg.tls.strategy,
+      certs:
+        cfg.tls.strategy === "mkcert"
+          ? "den"
+          : cfg.tls.strategy === "files"
+            ? "distribution"
+            : "none",
+      serving: cfg.tls.strategy === "none" ? false : null,
+      detail:
+        cfg.tls.strategy === "none"
+          ? "tls: none: the edge serves http only"
+          : "not probed",
+    },
+    deprecated: { certIssued: CERT_ISSUED_DEPRECATION },
     caTrusted: cfg.tls.strategy === "none" ? null : deps.caTrusted(cfg),
     tls: {
       strategy: cfg.tls.strategy,
@@ -132,3 +182,87 @@ export function edgeStatus(
     stackErrors: stk.errors,
   };
 }
+
+/** One TLS handshake: whether something on host:port speaks TLS. */
+export type TlsHandshake = (o: {
+  host: string;
+  port: number;
+  servername: string;
+  timeoutMs: number;
+}) => Promise<{ ok: boolean; error?: string }>;
+
+/**
+ * Connect, complete a TLS handshake, close. Trust is not checked here (that
+ * is `caTrusted`): only whether HTTPS is being served at all.
+ */
+export const tlsHandshake: TlsHandshake = ({
+  host,
+  port,
+  servername,
+  timeoutMs,
+}) =>
+  new Promise((resolve) => {
+    let settled = false;
+    const done = (v: { ok: boolean; error?: string }) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(v);
+    };
+    const socket = tls.connect({
+      host,
+      port,
+      servername,
+      rejectUnauthorized: false,
+    });
+    const timer = setTimeout(
+      () => done({ ok: false, error: `no TLS answer in ${timeoutMs}ms` }),
+      timeoutMs,
+    );
+    socket.once("secureConnect", () => done({ ok: true }));
+    socket.once("error", (e: NodeJS.ErrnoException) =>
+      done({ ok: false, error: e.code ?? e.message }),
+    );
+    socket.once("close", () =>
+      done({ ok: false, error: "closed before a TLS handshake" }),
+    );
+  });
+
+/**
+ * `st` with `https.serving` probed (MCP-2.5): a TLS handshake on this
+ * machine's published https port, named as one of the edge's hosts. Not
+ * probed when a proxy in front owns the port (no published ports), and
+ * false without a handshake when the edge container is not running.
+ */
+export async function withHttpsServing(
+  st: EdgeStatus,
+  cfg: EdgeConfig,
+  handshake: TlsHandshake = tlsHandshake,
+): Promise<EdgeStatus> {
+  if (cfg.tls.strategy === "none") return st;
+  const set = (serving: boolean | null, detail: string): EdgeStatus => ({
+    ...st,
+    https: { ...st.https, serving, detail },
+  });
+  if (!st.ports)
+    return set(
+      null,
+      "not probed: a proxy in front of the edge owns its ports (edge.publish: false)",
+    );
+  if (!st.up) return set(false, `the edge container is ${st.state}`);
+  const port = st.ports.https;
+  const servername = `${Object.keys(cfg.routes)[0] ?? "edge"}.${cfg.domain}`;
+  const r = await handshake({
+    host: "127.0.0.1",
+    port,
+    servername,
+    timeoutMs: 1500,
+  });
+  return r.ok
+    ? set(true, `TLS handshake answered on 127.0.0.1:${port} (${servername})`)
+    : set(
+        false,
+        `no TLS on 127.0.0.1:${port} (${servername}): ${r.error ?? "failed"}`,
+      );
+}

package/src/shared/edge/types.ts

@@ -73,6 +73,16 @@ export interface EdgeConfig {
   mounts: Record<string, string>;
   /** Extra external Docker networks the edge joins. */
   networks: string[];
-  /** Extra Traefik static-config arguments. */
+  /**
+   * Extra Traefik static-config arguments. Den owns the entrypoints'
+   * forwarded-header and PROXY-protocol trust (SEC-2a): an argument that
+   * sets either is dropped, with a warning at `edge up`.
+   */
   args: string[];
+  /**
+   * `edge.proxy_protocol.trusted_ips` (SEC-2a): the front proxies (IPs or
+   * CIDRs) whose PROXY protocol header the entrypoints believe, so a TCP
+   * passthrough in front can pass on the real client. Empty: none.
+   */
+  proxyProtocolTrustedIps?: string[];
 }

package/src/shared/environment-manager/health.ts

@@ -63,6 +63,14 @@ export interface PingResult {
   pending?: boolean;
   status?: number;
   error?: string;
+  /**
+   * MCP-2.4: the check answered with a redirect (3xx, `status`): where it
+   * points, as a path for the same origin, else origin + path (the query
+   * and fragment are dropped: they can carry tokens). A redirect is not
+   * down and not up (ok null): the service answered, and the check was
+   * sent elsewhere.
+   */
+  redirect?: string;
 }
 
 export interface ServiceHealthResult {
@@ -255,6 +263,41 @@ function statusOk(status: number, body404?: string): boolean {
   return status < 300 || (status >= 400 && status < 500);
 }
 
+/** A 3xx: the check was sent elsewhere (redirect: "manual"). */
+export function isRedirect(status: number | undefined): boolean {
+  return status !== undefined && status >= 300 && status < 400;
+}
+
+/**
+ * Where a redirect points, for a health row: a path when it stays on the
+ * checked URL's origin, else origin + path. Never the query or fragment
+ * (a login redirect's `?next=` or `state=` can carry a token).
+ */
+export function redirectTarget(
+  location: string | null | undefined,
+  from: string,
+): string {
+  if (!location) return "(no Location header)";
+  try {
+    const to = new URL(location, from);
+    const base = new URL(from);
+    return to.origin === base.origin
+      ? to.pathname
+      : `${to.origin}${to.pathname}`;
+  } catch {
+    return "(unreadable Location header)";
+  }
+}
+
+/** The PingResult for a 3xx: not down, not up, and where it points. */
+function redirectResult(
+  status: number,
+  location: string | null | undefined,
+  from: string,
+): PingResult {
+  return { ok: null, status, redirect: redirectTarget(location, from) };
+}
+
 /** The PingResult for `status`, naming an edge 404 as "no route". */
 function statusResult(status: number, body404?: string): PingResult {
   const ok = statusOk(status, body404);
@@ -309,6 +352,12 @@ async function pingHttps(parsed: URL, timeoutMs: number): Promise<PingResult> {
       },
       (res) => {
         const status = res.statusCode ?? 0;
+        if (isRedirect(status)) {
+          res.resume(); // discard the body
+          const loc = res.headers.location;
+          done(redirectResult(status, loc, parsed.toString()));
+          return;
+        }
         if (status !== 404) {
           res.resume(); // discard the body
           done({ ok: statusOk(status), status });
@@ -374,14 +423,21 @@ async function pingOnce(
     });
     clearTimeout(timer);
     // 2xx = healthy. 4xx = healthy (service is up; auth/route 4xx still proves it's responding).
-    // 3xx = unhealthy: with redirect:"manual", a redirect means "go verify somewhere else"
-    // and we haven't confirmed anything. Guards against hostname-to-AWS-ALB resolution
-    // (e.g. VPN / /etc/hosts) returning 301 on port 80 for services that actually run
-    // on a different port — the previous `< 500` check showed those as green.
+    // 3xx = a redirect (MCP-2.4): ok null, with its status and target. With
+    // redirect:"manual" a redirect means "go verify somewhere else", so it
+    // is never green: that guards against hostname-to-AWS-ALB resolution
+    // (e.g. VPN / /etc/hosts) returning 301 on port 80 for services that
+    // actually run on a different port (the old `< 500` check showed those
+    // green). It is not down either: something answered, and a login
+    // redirect (302 → /login) is how a healthy app answers a bare GET.
     // 5xx = unhealthy (service errored).
     // A 404 may be the edge's own "no route" (see EDGE_NO_ROUTE_BODY): read
     // a little of it. Otherwise discard the body: only the status matters,
     // and unconsumed bodies pin sockets in the long-lived web server.
+    if (isRedirect(res.status)) {
+      void res.body?.cancel().catch(() => {});
+      return redirectResult(res.status, res.headers?.get("location"), url);
+    }
     if (res.status === 404) {
       let body = "";
       try {
@@ -421,12 +477,17 @@ export async function pingHttp(
   // never a localhost fallback (it is not on this machine).
   if (expect !== undefined) {
     const r = await pingOnce(url, timeoutMs);
-    return r.status === undefined
-      ? r
-      : { ok: expectMatches(r.status, expect), status: r.status };
+    if (r.status === undefined) return r;
+    if (expectMatches(r.status, expect)) return { ok: true, status: r.status };
+    // A redirect the manifest does not list as up is still a redirect, not
+    // down (MCP-2.4): a production app answering 302 → /login is serving.
+    if (r.redirect !== undefined) return r;
+    return { ok: false, status: r.status };
   }
   const result = await pingOnce(url, timeoutMs);
-  if (!result.ok) {
+  // A redirect answered: no localhost fallback (that is for a name that
+  // could not be reached at all).
+  if (result.ok === false) {
     // Fall back to localhost for Docker-style hostnames regardless of how the
     // first ping failed. Timeouts on the primary are legitimate candidates for
     // retry: on macOS, VPN/`/etc/hosts` can resolve a Docker hostname to an
@@ -689,8 +750,17 @@ export function containerTarget(
     : { project: h.project, service: h.service };
 }
 
+/** A health row whose check answered with a redirect (see checkService). */
+export function isRedirectDetail(detail: string | undefined): boolean {
+  return /^redirect \d{3} → /.test(detail ?? "");
+}
+
 /** A ping result as a ServiceHealthResult health state. */
 export function healthState(r: PingResult): ServiceHealthResult["health"] {
+  // A redirect is a verdict of its own (MCP-2.4): not down, and not a check
+  // still waiting to answer. "unknown", like an unchecked service, so a
+  // caller waiting for health proceeds instead of waiting it out.
+  if (r.ok === null && r.redirect !== undefined) return "unknown";
   return r.ok === true ? "ok" : r.ok === false ? "error" : "pending";
 }
 
@@ -814,6 +884,9 @@ export async function checkServiceHealth(
     ...placed,
     health: healthState(result),
     healthDetail:
+      (result.redirect !== undefined
+        ? `redirect ${result.status} → ${result.redirect}`
+        : undefined) ??
       result.error ??
       (!result.ok && result.status !== undefined
         ? `http ${result.status}`
@@ -899,6 +972,7 @@ export function rollupRepoHealth(
         service: r.subsystem,
         ok: r.health === "ok" ? true : r.health === "error" ? false : null,
         isEntrypoint: !!entrypoint && r.subsystem === entrypoint,
+        redirect: isRedirectDetail(r.healthDetail),
       })),
     );
     const lead =

package/src/shared/environment-manager/workspaces.ts

@@ -877,3 +877,57 @@ export function generateVSCodeWorkspace(
   );
   return outPath;
 }
+
+/** The key of workspace `ws`'s runtime path, as a refusal names it. */
+export const workspaceBinKey = (ws: string, id: string) =>
+  `workspaces.${ws}.agents.runtimes.${id}.bin`;
+
+/**
+ * `<ws>.agents.runtimes.<id>.bin` in config/local/workspaces.yml (AG-0.5),
+ * as written (checked where it is used); undefined when unset or when the
+ * file can't be read. A block that is no mapping is `{ why }`.
+ */
+export function workspaceRuntimeBin(
+  ws: string,
+  id: string,
+  read: () => WorkspacesFile = readWorkspacesFile,
+): unknown {
+  try {
+    const rts = read().workspaces[ws]?.agents?.runtimes;
+    if (!rts || typeof rts !== "object") return undefined;
+    const block = (rts as Record<string, unknown>)[id];
+    if (block === undefined || block === null) return undefined;
+    if (typeof block !== "object" || Array.isArray(block))
+      return {
+        why: `${workspaceBinKey(ws, id).replace(/\.bin$/, "")} must be a mapping ({ bin: <absolute path> })`,
+      };
+    return (block as { bin?: unknown }).bin;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Set (a path) or clear (null) workspace `ws`'s
+ * `agents.runtimes.<id>.bin`. The caller checks the path first.
+ */
+export function setWorkspaceRuntimeBin(
+  ws: string,
+  id: string,
+  bin: string | null,
+): void {
+  const file = readWorkspacesFile();
+  const cfg = file.workspaces[ws];
+  if (!cfg) throw new Error(`workspace "${ws}" does not exist`);
+  const agents = { ...(cfg.agents ?? {}) };
+  const runtimes = { ...(agents.runtimes ?? {}) };
+  if (bin === null) delete runtimes[id];
+  else runtimes[id] = { ...(runtimes[id] ?? {}), bin };
+  if (Object.keys(runtimes).length) agents.runtimes = runtimes;
+  else delete agents.runtimes;
+  const next = { ...cfg };
+  if (Object.keys(agents).length) next.agents = agents;
+  else delete next.agents;
+  file.workspaces[ws] = next;
+  writeWorkspacesFile(file);
+}

package/src/shared/github-app.ts

@@ -0,0 +1,94 @@
+/**
+ * SEC-2a: the MO "Den" GitHub App, as Den uses it (SEC-2 spec, "The MO Den
+ * GitHub App"). Den uses only its public client id, through the device flow,
+ * acting as the person: no client secret and no private key, ever. With the
+ * app's "Expire user authorization tokens" off, no refresh (which would need
+ * the secret) is ever needed, so Den never asks for `offline_access`.
+ *
+ * `web.github_client_id` (config/den.yml, or config/local/user.yml) replaces
+ * the default below; it is the one place the MO app's id lives.
+ */
+
+/**
+ * The "Monster Orange Den" GitHub App's client id (owner Monster-Orange,
+ * slug monster-orange-den). Public by design: it ships in Den. A
+ * distribution sets its own app with `web.github_client_id`; an empty
+ * value there turns Sign in with GitHub off.
+ */
+export const MO_DEN_GITHUB_CLIENT_ID = "Iv23liKL12gnN6WvRV5b";
+
+/** What a person reads when the app issues expiring tokens (never the token). */
+export function expiringTokenWarning(): string {
+  return (
+    "The GitHub App issues expiring user tokens (its answer carried expires_in " +
+    "or a refresh_token). Sign-in still works: Den uses the token once and never " +
+    "keeps it. To fix it, switch off \u201cExpire user authorization tokens\u201d in " +
+    "the app's settings (GitHub \u203a Settings \u203a Developer settings \u203a GitHub Apps)."
+  );
+}
+
+/** Where a person enters the device code. */
+export const GITHUB_DEVICE_PAGE = "https://github.com/login/device";
+
+/**
+ * Tests only: a fake GitHub on loopback (`http://localhost:<port>`), for the
+ * device-flow endpoints and `GET /user` alike. Ignored unless it is plain
+ * http on localhost or 127.0.0.1, so it can never point Den at another host.
+ */
+export const GITHUB_TEST_BASE_ENV = "DEN_TEST_GITHUB_URL";
+
+export interface GithubEndpoints {
+  deviceCode: string;
+  accessToken: string;
+  user: string;
+  /** A test's fake GitHub is in use (GITHUB_TEST_BASE_ENV). */
+  fake: boolean;
+}
+
+/** A loopback http base URL, without a trailing slash, or null. */
+function loopbackBase(raw: string | undefined): string | null {
+  if (!raw) return null;
+  try {
+    const u = new URL(raw);
+    if (u.protocol !== "http:") return null;
+    if (u.hostname !== "localhost" && u.hostname !== "127.0.0.1") return null;
+    return u.origin;
+  } catch {
+    return null;
+  }
+}
+
+/** GitHub's device-flow and user endpoints (or a test's fake GitHub). */
+export function githubEndpoints(
+  env: NodeJS.ProcessEnv = process.env,
+): GithubEndpoints {
+  const fake = loopbackBase(env[GITHUB_TEST_BASE_ENV]);
+  if (fake)
+    return {
+      deviceCode: `${fake}/login/device/code`,
+      accessToken: `${fake}/login/oauth/access_token`,
+      user: `${fake}/user`,
+      fake: true,
+    };
+  return {
+    deviceCode: "https://github.com/login/device/code",
+    accessToken: "https://github.com/login/oauth/access_token",
+    user: "https://api.github.com/user",
+    fake: false,
+  };
+}
+
+/** The client id in use: `web.github_client_id`, else the MO app's. */
+export function githubClientId(configured: string | undefined): string {
+  return (configured ?? MO_DEN_GITHUB_CLIENT_ID).trim();
+}
+
+/** What a GitHub button says while no client id is configured. */
+export function noClientIdMessage(cli: string): string {
+  return (
+    "Sign in with GitHub needs a GitHub App client id, and none is configured. " +
+    "Set web.github_client_id in config/local/user.yml (or the distribution's " +
+    `config), then restart the server (\`${cli} web restart\`). The app's setup ` +
+    "is in docs/distributions.md, “Signing in with GitHub”."
+  );
+}