@monster-orange/den 0.4.3 → 0.4.5

package/src/shared/github-device.ts

@@ -0,0 +1,286 @@
+/**
+ * SEC-2a: GitHub's device flow, for a GitHub App with only its public client
+ * id (no secret), and `GET /user` for who approved it.
+ *
+ *  1. POST /login/device/code (client_id): a device code (kept here), a
+ *     user code (shown to the person), how long both last, and the poll
+ *     interval. No scope is asked for: identity needs none, and
+ *     `offline_access` would force an expiring token.
+ *  2. POST /login/oauth/access_token (client_id, device_code, grant_type
+ *     device_code) every `interval` seconds until it answers a token, or
+ *     `authorization_pending` (keep going), `slow_down` (wait longer),
+ *     `expired_token` or `access_denied` (stop).
+ *  3. GET /user with the token: its numeric `id` and `login`, nothing else.
+ *     The caller drops the token right after.
+ *
+ * A token answer with `expires_in` or a `refresh_token` means the app has
+ * "Expire user authorization tokens" on: the result says so (`expiring`),
+ * for the caller's one warning; the sign-in still completes.
+ *
+ * Every call is one request on a fresh connection (no keep-alive), with a
+ * timeout. Nothing here logs; a token, device code or user code is never in
+ * an error message.
+ */
+import * as http from "http";
+import * as https from "https";
+import { githubEndpoints, type GithubEndpoints } from "./github-app.js";
+
+export interface DeviceCode {
+  deviceCode: string;
+  userCode: string;
+  /** Seconds the codes last. */
+  expiresIn: number;
+  /** Seconds between polls. */
+  interval: number;
+}
+
+export type PollResult =
+  | {
+      kind: "token";
+      token: string;
+      /**
+       * The answer carried `expires_in` or a `refresh_token`: the app has
+       * "Expire user authorization tokens" on, a misconfiguration (Den
+       * never refreshes; it uses the token once). Never the token itself.
+       */
+      expiring: boolean;
+    }
+  | { kind: "pending" }
+  | { kind: "slow_down"; interval?: number }
+  | { kind: "expired" }
+  | { kind: "denied" }
+  | { kind: "error"; message: string };
+
+export interface GithubIdentity {
+  id: number;
+  login: string;
+}
+
+/** The three calls, swappable in a unit test. */
+export interface GithubDeviceClient {
+  start(clientId: string): Promise<DeviceCode>;
+  poll(clientId: string, deviceCode: string): Promise<PollResult>;
+  user(token: string): Promise<GithubIdentity>;
+}
+
+const TIMEOUT_MS = 15_000;
+const UA = "den-device-flow";
+
+function request(
+  url: string,
+  opts: { method: string; headers: Record<string, string>; body?: string },
+): Promise<{ status: number; body: string }> {
+  return new Promise((resolve, reject) => {
+    const u = new URL(url);
+    const lib = u.protocol === "https:" ? https : http;
+    const req = lib.request(
+      u,
+      {
+        method: opts.method,
+        agent: false,
+        timeout: TIMEOUT_MS,
+        headers: {
+          "user-agent": UA,
+          connection: "close",
+          ...opts.headers,
+          ...(opts.body !== undefined
+            ? { "content-length": String(Buffer.byteLength(opts.body)) }
+            : {}),
+        },
+      },
+      (res) => {
+        let out = "";
+        res.setEncoding("utf-8");
+        res.on("data", (d: string) => (out += d));
+        res.on("end", () =>
+          resolve({ status: res.statusCode ?? 0, body: out }),
+        );
+      },
+    );
+    req.on("timeout", () => req.destroy(new Error("GitHub did not answer")));
+    req.on("error", (e) =>
+      reject(new Error(`GitHub unreachable: ${e.message}`)),
+    );
+    req.end(opts.body);
+  });
+}
+
+function parse(body: string): Record<string, unknown> {
+  try {
+    const v = JSON.parse(body) as unknown;
+    return v && typeof v === "object" ? (v as Record<string, unknown>) : {};
+  } catch {
+    return {};
+  }
+}
+
+const form = (o: Record<string, string>) => new URLSearchParams(o).toString();
+const FORM_HEADERS = {
+  accept: "application/json",
+  "content-type": "application/x-www-form-urlencoded",
+};
+
+/** The real GitHub (or a test's fake one, githubEndpoints). */
+export function githubDeviceClient(
+  ep: GithubEndpoints = githubEndpoints(),
+): GithubDeviceClient {
+  return {
+    async start(clientId) {
+      const r = await request(ep.deviceCode, {
+        method: "POST",
+        headers: FORM_HEADERS,
+        body: form({ client_id: clientId }),
+      });
+      const j = parse(r.body);
+      if (
+        r.status !== 200 ||
+        typeof j.device_code !== "string" ||
+        typeof j.user_code !== "string"
+      ) {
+        const why =
+          typeof j.error === "string"
+            ? j.error === "device_flow_disabled"
+              ? "the GitHub App's device flow is off (tick “Enable Device Flow”)"
+              : j.error === "unauthorized_client" ||
+                  j.error === "incorrect_client_credentials"
+                ? "GitHub doesn't know this client id (web.github_client_id)"
+                : `GitHub answered ${j.error}`
+            : `GitHub answered ${r.status}`;
+        throw new Error(why);
+      }
+      return {
+        deviceCode: j.device_code,
+        userCode: j.user_code,
+        expiresIn: Number(j.expires_in) > 0 ? Number(j.expires_in) : 900,
+        interval: Number(j.interval) >= 0 ? Number(j.interval) : 5,
+      };
+    },
+    async poll(clientId, deviceCode) {
+      let r: { status: number; body: string };
+      try {
+        r = await request(ep.accessToken, {
+          method: "POST",
+          headers: FORM_HEADERS,
+          body: form({
+            client_id: clientId,
+            device_code: deviceCode,
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          }),
+        });
+      } catch (e) {
+        return { kind: "error", message: (e as Error).message };
+      }
+      const j = parse(r.body);
+      if (typeof j.access_token === "string" && j.access_token)
+        return {
+          kind: "token",
+          token: j.access_token,
+          expiring: j.expires_in !== undefined || j.refresh_token !== undefined,
+        };
+      switch (j.error) {
+        case "authorization_pending":
+          return { kind: "pending" };
+        case "slow_down":
+          return {
+            kind: "slow_down",
+            ...(Number(j.interval) > 0 ? { interval: Number(j.interval) } : {}),
+          };
+        case "expired_token":
+          return { kind: "expired" };
+        case "access_denied":
+          return { kind: "denied" };
+        default:
+          return {
+            kind: "error",
+            message:
+              typeof j.error === "string"
+                ? `GitHub answered ${j.error}`
+                : `GitHub answered ${r.status}`,
+          };
+      }
+    },
+    async user(token) {
+      const r = await request(ep.user, {
+        method: "GET",
+        headers: {
+          accept: "application/vnd.github+json",
+          authorization: `Bearer ${token}`,
+          "x-github-api-version": "2022-11-28",
+        },
+      });
+      const j = parse(r.body);
+      if (
+        r.status !== 200 ||
+        typeof j.id !== "number" ||
+        !Number.isSafeInteger(j.id) ||
+        typeof j.login !== "string"
+      )
+        throw new Error(`GitHub's /user answered ${r.status}`);
+      return { id: j.id, login: j.login };
+    },
+  };
+}
+
+/** `github:<numeric id>`: how Den names a GitHub account. */
+export function githubPrincipal(id: number): `github:${number}` {
+  return `github:${id}`;
+}
+
+export type DeviceFlowOutcome =
+  | { kind: "ok"; identity: GithubIdentity; expiringToken?: boolean }
+  | { kind: "expired" }
+  | { kind: "denied" }
+  | { kind: "error"; message: string };
+
+/**
+ * The whole flow in one call (the CLI's `web owner link`): start, show the
+ * code (`onCode`), poll at GitHub's interval (`sleep`, injected in a test),
+ * read the identity, drop the token. `minIntervalMs` is the floor between
+ * polls (GitHub's own interval is never shorter than it says).
+ */
+export async function runDeviceFlow(opts: {
+  clientId: string;
+  client?: GithubDeviceClient;
+  onCode: (code: DeviceCode) => void;
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => number;
+  minIntervalMs?: number;
+}): Promise<DeviceFlowOutcome> {
+  const client = opts.client ?? githubDeviceClient();
+  const sleep =
+    opts.sleep ?? ((ms: number) => new Promise((r) => setTimeout(r, ms)));
+  const now = opts.now ?? Date.now;
+  const code = await client.start(opts.clientId);
+  opts.onCode(code);
+  const deadline = now() + code.expiresIn * 1000;
+  const floor = opts.minIntervalMs ?? 1000;
+  let interval = Math.max(code.interval * 1000, floor);
+  let errors = 0;
+  for (;;) {
+    await sleep(interval);
+    if (now() >= deadline) return { kind: "expired" };
+    const r = await client.poll(opts.clientId, code.deviceCode);
+    if (r.kind === "token") {
+      // The token lives only for this one call.
+      const identity = await client.user(r.token);
+      return {
+        kind: "ok",
+        identity,
+        ...(r.expiring ? { expiringToken: true } : {}),
+      };
+    }
+    if (r.kind === "pending") continue;
+    if (r.kind === "slow_down") {
+      interval = Math.max(
+        r.interval !== undefined ? r.interval * 1000 : interval + 5000,
+        floor,
+      );
+      continue;
+    }
+    if (r.kind === "error") {
+      if (++errors >= 5) return { kind: "error", message: r.message };
+      continue;
+    }
+    return r;
+  }
+}

package/src/shared/health/not-checked.ts

@@ -0,0 +1,42 @@
+/**
+ * MCP-2.4: why a service has no health verdict, in words. A row with `ok:
+ * null` and no reason reads as "broken" to an agent (it fell back to
+ * `docker ps`); every unchecked row says which of these it is. One rule for
+ * the web health row (/api/health) and the MCP `status` tool, which derives
+ * it from a row an older web server served without one.
+ */
+import { product } from "../product.js";
+import type { Runs } from "../manifest/placement.js";
+
+export interface NotCheckedInput {
+  /** The env being viewed. */
+  env: string;
+  runs: Runs | undefined;
+  /** A remote service's target (its env), when it has one. */
+  target?: { env?: string } | null;
+  /** false when the repo has no manifest at all. */
+  manifest?: boolean;
+  /** The conventional probe tried (and not answered 2xx), if any. */
+  conventional?: string | null;
+}
+
+export function notCheckedReason(o: NotCheckedInput): string {
+  if (o.manifest === false)
+    return `not checked: the repo has no ${product().manifestYml}`;
+  if (o.runs === "remote") {
+    const where = o.target?.env ?? o.env;
+    return (
+      `not checked: remote (runs in ${where}), and the manifest declares ` +
+      `no health check or target.url for ${where}`
+    );
+  }
+  if (o.runs === "none" || o.runs === undefined)
+    return (
+      `not checked: not deployed in ${o.env} (the manifest has no ` +
+      `commands and no health check for ${o.env})`
+    );
+  return (
+    `not checked: no health check in the manifest for ${o.env}` +
+    (o.conventional ? `, and ${o.conventional} did not answer 2xx` : "")
+  );
+}

package/src/shared/health/rollup.ts

@@ -17,6 +17,8 @@ export interface HealthSignal {
   isEntrypoint?: boolean;
   /** Not answered yet this cycle: the repo stays unknown until it has. */
   awaiting?: boolean;
+  /** The check answered with a redirect (ok null): counted as a redirect. */
+  redirect?: boolean;
 }
 
 export interface RepoRollup {
@@ -29,6 +31,8 @@ export interface RepoRollup {
   unchecked: number;
   /** Checks that haven't answered yet; any holds the state at unknown. */
   awaiting: number;
+  /** Checks that answered with a redirect (not in `unchecked`); absent at 0. */
+  redirected?: number;
 }
 
 export const STATE_RANK: Record<RepoState, number> = rollup.STATE_RANK;

package/src/shared/process/spawn-streaming.ts

@@ -86,6 +86,10 @@ export function spawnDaemon(
   // Stamp the log so the tail starts reading from a clean boundary.
   const ts = new Date().toISOString();
   fs.appendFileSync(logPath, `\n\n─── ${product().cli} start ${ts} ───\n`);
+  // Where this run's output starts. The tail reads from here, not from "the
+  // end when tail opened": a fast command (a refused sudo, a typo) can write
+  // and exit before tail starts, and `-n 0` would drop those lines.
+  const startOffset = fs.statSync(logPath).size;
 
   // Open the log fd in the parent so we can hand it to the child.
   // MUST stay "a" (O_APPEND): rotation truncates this file in place, and only
@@ -120,9 +124,10 @@ export function spawnDaemon(
   fs.closeSync(logFd); // parent closes its copy; child keeps its own fd
 
   // Tail the log for streaming back to the caller.
-  // -F follows by name (handles log rotation). -n 0 shows only new lines written
-  // after tail started (we already stamped the marker above).
-  const tailProc = spawn("tail", ["-F", "-n", "0", logPath], {
+  // -F follows by name (handles log rotation). -c +N starts at this run's
+  // first byte (just after the stamp), so nothing the service wrote before
+  // tail opened the file is lost.
+  const tailProc = spawn("tail", ["-F", "-c", `+${startOffset + 1}`, logPath], {
     stdio: ["ignore", "pipe", "ignore"],
   });
 

package/src/shared/secrets/onepassword.ts

@@ -52,11 +52,34 @@ export class OnePasswordProvider implements SecretsProvider {
     }
   }
 
+  /** Overwrite the field; an item that isn't there yet is created (a Password item). */
   async set(ref: SecretRef, value: string): Promise<void> {
-    const args = ["item", "edit", ref.item];
-    if (ref.vault) args.push("--vault", ref.vault);
-    args.push(`${ref.field}[password]=${value}`);
-    await execFileAsync("op", args, { timeout: this.timeout });
+    const vault = ref.vault ? ["--vault", ref.vault] : [];
+    const field = `${ref.field}[password]=${value}`;
+    try {
+      await execFileAsync("op", ["item", "edit", ref.item, ...vault, field], {
+        timeout: this.timeout,
+      });
+    } catch (err) {
+      try {
+        await execFileAsync(
+          "op",
+          [
+            "item",
+            "create",
+            "--category",
+            "password",
+            "--title",
+            ref.item,
+            ...vault,
+            field,
+          ],
+          { timeout: this.timeout },
+        );
+      } catch {
+        throw err;
+      }
+    }
   }
 
   async preflight(): Promise<PreflightResult> {

package/src/shared/sessions/client.ts

@@ -76,7 +76,8 @@ export class HostClient extends EventEmitter {
       const h = this.attachments.get(ev.aid);
       if (!h) return;
       if (ev.ev === "data") h.onData(Buffer.from(ev.data, "base64"));
-      else {
+      else if (ev.ev === "size") h.onSize?.(ev.cols, ev.rows);
+      else if (ev.ev === "exit") {
         this.attachments.delete(ev.aid);
         h.onExit?.(ev.exitCode);
       }
@@ -174,6 +175,9 @@ export class HostClient extends EventEmitter {
       ref: id,
       aid,
       ...(opts.replay !== undefined ? { replay: opts.replay } : {}),
+      // Only a client that handles them is sent size events: an older
+      // client would read an unknown event as the session's exit.
+      ...(handlers.onSize ? { sizes: true } : {}),
     }).then(
       (r) => r.info as SessionInfo,
       (e: Error) => {

package/src/shared/sessions/host.ts

@@ -63,6 +63,10 @@ interface Session {
   log: ScrollbackLog;
   /** aid → its connection. */
   attachments: Map<string, Conn>;
+  /** The attachments that asked for size events (attach `sizes: true`). */
+  sizeAids?: Set<string>;
+  /** The PTY's size: the start's, then the last resize's (any client's). */
+  size?: { cols: number; rows: number };
   /** The cap it counts against (start's `pool`), when one was named. */
   pool?: SessionPool;
 }
@@ -453,7 +457,15 @@ export class SessionHost {
         const s = this.session(req.ref);
         if (!isInt(req.cols, 1, 10_000) || !isInt(req.rows, 1, 10_000))
           throw new Refusal("bad-request", "resize needs whole cols and rows");
-        if (s.pty && !s.info.exited) s.pty.resize(req.cols, req.rows);
+        if (s.pty && !s.info.exited) {
+          s.pty.resize(req.cols, req.rows);
+          // Last writer wins: every viewer that asked hears the new size,
+          // so one out of step knows to say its own again.
+          if (s.size?.cols !== req.cols || s.size?.rows !== req.rows) {
+            s.size = { cols: req.cols, rows: req.rows };
+            this.sendSize(s);
+          }
+        }
         return {};
       }
       case "signal": {
@@ -606,6 +618,7 @@ export class SessionHost {
         },
       ),
       attachments: new Map(),
+      size: { cols, rows },
       ...(pool !== undefined ? { pool: pool as SessionPool } : {}),
     };
     this.sessions.set(id, s);
@@ -626,6 +639,7 @@ export class SessionHost {
         for (const [aid, c] of s.attachments)
           c.send({ ev: "exit", aid, exitCode: s.info.exitCode });
         s.attachments.clear();
+        s.sizeAids?.clear();
         this.log(`session ${id} (${name}) exited (${s.info.exitCode})`);
       }, EXIT_SETTLE_MS);
     });
@@ -654,10 +668,24 @@ export class SessionHost {
     } else {
       conn.aids.add(aid);
       s.attachments.set(aid, conn);
+      if (req.sizes === true) {
+        (s.sizeAids ??= new Set()).add(aid);
+        if (s.size) conn.send({ ev: "size", aid, ...s.size });
+      }
     }
     return s.info;
   }
 
+  /** Tell each attachment that asked the session's current size. */
+  private sendSize(s: Session): void {
+    if (!s.size || !s.sizeAids?.size) return;
+    for (const aid of s.sizeAids) {
+      const c = s.attachments.get(aid);
+      if (c) c.send({ ev: "size", aid, ...s.size });
+      else s.sizeAids.delete(aid);
+    }
+  }
+
   /** Stop serving: running sessions get SIGHUP, scrollback is flushed. */
   async close(): Promise<void> {
     if (this.closed) return;

package/src/shared/sessions/protocol.ts

@@ -7,6 +7,10 @@
  *             {id, ok: false, code, error}
  *   event     {ev: "data", aid, data}     host → client, per attachment
  *             {ev: "exit", aid, exitCode}
+ *             {ev: "size", aid, cols, rows} only to an attachment that
+ *                                           asked (attach `sizes: true`):
+ *                                           the PTY's size on attach, and
+ *                                           each time it changes
  *
  * ops: hello, start, list, attach, detach, write, resize, signal,
  * scrollback, forget, shutdown. A request whose `v` is not the host's is
@@ -47,7 +51,8 @@ export type Reply =
 
 export type HostEvent =
   | { ev: "data"; aid: string; data: string }
-  | { ev: "exit"; aid: string; exitCode?: number };
+  | { ev: "exit"; aid: string; exitCode?: number }
+  | { ev: "size"; aid: string; cols: number; rows: number };
 
 /** Splits a byte stream into lines; refuses one that grows too long. */
 export class LineReader {

package/src/shared/sessions/types.ts

@@ -55,6 +55,12 @@ export interface AttachHandlers {
   onData(data: Buffer): void;
   /** The session ended (at once, after the replay, when it already had). */
   onExit?(exitCode: number | undefined): void;
+  /**
+   * The PTY's size: once on attach (after the replay), then each time any
+   * client resizes it. The size is last-writer-wins across every viewer,
+   * so a viewer learns here that another one changed it.
+   */
+  onSize?(cols: number, rows: number): void;
 }
 
 /** One attachment; a session has any number, each gets all the output. */

package/src/shared/stacks/status.ts

@@ -3,6 +3,7 @@
  * The CLI prints it; the web server serves it at /api/stacks (and through it
  * the MCP `stacks` tool).
  */
+import { product } from "../product.js";
 import { spawnSync } from "child_process";
 import * as fs from "fs";
 import * as path from "path";
@@ -125,6 +126,29 @@ export function rejoinRunningStacks(
   return rejoinEdgeNetworks(contexts, onLine);
 }
 
+/**
+ * Why a workspace has no stacks (MCP-2.4): an empty list with no reason
+ * reads as "docker is broken". A stack is a `stacks:` entry in the org
+ * config, or a repo of the workspace whose manifest has a `compose:` block.
+ */
+export function emptyStacksReason(o: {
+  workspace: string;
+  workspaceExists: boolean;
+  /** How many stacks the org config itself declares. */
+  configStacks: number;
+}): string {
+  const cfg = `the org config (${product().configFile}) declares no stacks:`;
+  if (!o.workspaceExists)
+    return (
+      `no stacks: workspace "${o.workspace}" does not exist here, so no ` +
+      `repo manifest was read, and ${cfg}`
+    );
+  return (
+    `no stacks: ${cfg}, and no repo of workspace "${o.workspace}" has a ` +
+    `compose: block in its ${product().manifestYml}`
+  );
+}
+
 /** Each stack's name, project, routes and (optionally) container health. */
 export function stackStatuses(
   ctx: StackContext,

package/src/shared/strategies/registry.ts

@@ -44,6 +44,11 @@ export function registerStrategy<K extends string, C>(
   byId.set(entry.id, entry as StrategyEntry);
 }
 
+/** Remove strategy `id` of `kind` (no-op when it isn't there). */
+export function unregisterStrategy(kind: string, id: string): void {
+  registries.get(kind)?.delete(id);
+}
+
 /** The strategy `id` of `kind`, or undefined. */
 export function getStrategy<K extends string, C>(
   kind: K,

package/src/shared/types/index.ts

@@ -667,6 +667,12 @@ export interface WorkspaceServiceEntry {
 }
 
 export interface WorkspaceConfig {
+  /**
+   * Agents in this workspace, on this machine (AG-0.5):
+   * `agents.runtimes.<id>.bin`, a runtime's CLI for this workspace's
+   * agents, which wins over user.yml's and the search.
+   */
+  agents?: { runtimes?: Record<string, { bin?: unknown } | null> };
   /**
    * Service entries keyed by service address.
    * Single-service repos: "tasks-runner"