@monster-orange/den 0.4.7 → 0.4.9

package/src/ui/server/agent-routes.ts

@@ -15,7 +15,21 @@
  *   GET  /api/workspaces/<ws>/agents              the workspace's agents
  *   POST /api/workspaces/<ws>/agents              start { persona, runtime?, model?, id? }
  *   POST /api/workspaces/<ws>/agents/<id>/stop
- *   POST /api/workspaces/<ws>/agents/<id>/resume
+ *   POST /api/workspaces/<ws>/agents/<id>/resume  the same conversation (AG-14)
+ *   POST /api/workspaces/<ws>/agents/<id>/fresh   a new conversation, same
+ *                                                 persona and workspace
+ *   POST /api/workspaces/<ws>/agents/<id>/relaunch  a rotated agent (den#4):
+ *                                                 a new conversation whose
+ *                                                 first prompt is its
+ *                                                 handoff.md; a resume of
+ *                                                 one is refused (409 rotated)
+ *   POST /api/workspaces/<ws>/agents/<id>/remove  forget a stopped one (Undo:
+ *                                                 /api/agents/restore)
+ *   POST /api/agents/clear-stopped                { workspaces: [...] }: forget
+ *                                                 every stopped one there
+ *   POST /api/agents/restore                      { agents: [ids] }: Undo
+ *   POST /api/agents/resume-interrupted           { workspaces: [...] }: Resume
+ *                                                 all after a restart (AG-14.3)
  *
  * Each calls the CLI's own operation (cli/agent-ops.ts): neither the page
  * nor the CLI keeps state of its own, so an agent started here is the one
@@ -39,7 +53,11 @@
  * the only route that writes to a session or streams its output.
  */
 import * as http from "http";
-import { getReposRoot } from "../../shared/den-config.js";
+import {
+  configuredRemoveStoppedAfter,
+  getReposRoot,
+  readMcpConfig,
+} from "../../shared/den-config.js";
 import {
   readWorkspacesFile,
   resolveWorkspaceDir,
@@ -52,18 +70,31 @@ import {
   listAgents,
   listPersonas,
   listRuntimes,
+  markInterrupted,
   NOT_IN_WORKSPACE,
+  pruneStopped,
+  removeAgent,
+  removeStopped,
+  restoreAgents,
+  resumeInterrupted,
   setRuntimePath,
   resolveAgentsDeps,
+  relaunchAgent,
   resumeAgent,
   startAgent,
+  startFresh,
   stopAgent,
   type AgentsDeps,
   type AgentsResolved,
   type Started,
 } from "../cli/agent-ops.js";
 import { recordAction } from "./audit.js";
-import { auditActorOf, principalOf } from "./request-guard.js";
+import {
+  agentPrincipalOf,
+  auditActorOf,
+  principalOf,
+} from "./request-guard.js";
+import { agentResumeRefusal } from "./agent-resume-grant.js";
 import { readBody, sendJson } from "./http-helpers.js";
 import type { Actor } from "../../shared/agent-actor.js";
 
@@ -73,10 +104,14 @@ export interface AgentRouteDeps {
 }
 
 const AGENTS_PATH =
-  /^\/api\/workspaces\/([^/]+)\/agents(?:\/([^/]+)\/(stop|resume))?$/;
+  /^\/api\/workspaces\/([^/]+)\/agents(?:\/([^/]+)\/(stop|resume|fresh|relaunch|remove))?$/;
+
 const RUNTIME_PATH = /^\/api\/agents\/runtimes\/([^/]+)\/path$/;
 /** A start's body is a few short names. */
 const MAX_BODY = 4096;
+/** A list of names (a page's workspaces, an Undo's agents). */
+const MANY_BODY = 64 * 1024;
+const NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 
 /** Never a TTY: a web start's terminal is 80×24. */
 const NO_TTY = { isTTY: false } as NodeJS.WriteStream;
@@ -129,7 +164,10 @@ function sendError(res: http.ServerResponse, e: unknown, ws?: string): void {
 }
 
 /** A started or resumed agent's answer: its record, or its early exit. */
-function sendStarted(res: http.ServerResponse, s: Started): void {
+function sendStarted(
+  res: http.ServerResponse,
+  s: Started & { fresh?: boolean },
+): void {
   if (s.early) {
     const code =
       s.early.exitCode === undefined ? "" : ` (exit ${s.early.exitCode})`;
@@ -160,6 +198,8 @@ function sendStarted(res: http.ServerResponse, s: Started): void {
       sessionId: s.info.ref.id,
       startedAt: s.rec.startedAt,
     },
+    // A resume with nothing to continue yet started fresh (same id).
+    ...(s.fresh ? { fresh: true } : {}),
     ...(s.warnings.length ? { warnings: s.warnings } : {}),
   });
 }
@@ -203,17 +243,24 @@ export async function handleAgentRoutes(
 ): Promise<boolean> {
   const m = AGENTS_PATH.exec(pathname);
   const rp = RUNTIME_PATH.exec(pathname);
+  // AG-14's routes over many agents at once.
+  const many =
+    pathname === "/api/agents/clear-stopped" ||
+    pathname === "/api/agents/restore" ||
+    pathname === "/api/agents/resume-interrupted";
   if (
     pathname !== "/api/personas" &&
     pathname !== "/api/agents/runtimes" &&
     !m &&
-    !rp
+    !rp &&
+    !many
   )
     return false;
   const method = req.method ?? "GET";
   const d = webDeps(deps.agents);
 
   if (rp) return runtimePath(req, res, safeDecode(rp[1]), d);
+  if (many) return manyAgents(req, res, pathname, d);
   if (!m) {
     if (method !== "GET" && method !== "HEAD")
       return methodNotAllowed(res, "GET");
@@ -241,7 +288,13 @@ export async function handleAgentRoutes(
     return true;
   }
   const id = m[2] === undefined ? undefined : safeDecode(m[2]);
-  const action = m[3] as "stop" | "resume" | undefined;
+  const action = m[3] as
+    | "stop"
+    | "resume"
+    | "fresh"
+    | "relaunch"
+    | "remove"
+    | undefined;
 
   if (!action && method === "GET") {
     try {
@@ -281,7 +334,12 @@ export async function handleAgentRoutes(
     // Another workspace's agent is no agent here: a 404 that doesn't name
     // it, before anything else is said about it.
     if (id !== undefined) agentRecord(d, id, ws);
-    guard(actor);
+    // AG-14.4: MCP agent_resume may resume another agent of its scope.
+    const agent = agentPrincipalOf(req);
+    if (verb === "resume" && agent) {
+      const why = agentResumeRefusal(agent, ws, id!, mcpActions());
+      if (why) throw new AgentError(why, { status: 403 });
+    } else guard(actor);
     if (verb === "start") {
       const body = await startBody(req);
       if (!body.persona)
@@ -298,9 +356,35 @@ export async function handleAgentRoutes(
       audit(what, s.early ? "exited at once" : undefined);
       sendStarted(res, s);
     } else if (verb === "stop") {
+      // The answer comes once the session has ended (200, stopped: true),
+      // or, still running after the wait, 202 with stillStopping: true.
       const s = await stopAgent(d, id!, ws);
+      audit(s.stillStopping ? `${what} (still stopping)` : what);
+      sendJson(
+        res,
+        {
+          ok: true,
+          agent: s.rec.id,
+          wasRunning: !!s.session,
+          stopped: !s.stillStopping,
+          ...(s.stillStopping ? { stillStopping: true } : {}),
+        },
+        s.stillStopping ? 202 : 200,
+      );
+    } else if (verb === "fresh") {
+      const s = await startFresh(d, id!, ws);
+      what = `start ${s.rec.id} fresh (${s.rec.persona}, ${s.rec.runtime}) in ${ws}`;
+      audit(what, s.early ? "exited at once" : undefined);
+      sendStarted(res, s);
+    } else if (verb === "relaunch") {
+      const s = await relaunchAgent(d, id!, ws);
+      what = `relaunch ${s.rec.id} from its handoff (${s.why}) in ${ws}`;
+      audit(what, s.early ? "exited at once" : undefined);
+      sendStarted(res, s);
+    } else if (verb === "remove") {
+      const removed = await removeAgent(d, id!, ws);
       audit(what);
-      sendJson(res, { ok: true, agent: s.rec.id, wasRunning: !!s.session });
+      sendJson(res, { ok: true, removed });
     } else {
       const s = await resumeAgent(d, id!, ws);
       audit(what);
@@ -313,6 +397,112 @@ export async function handleAgentRoutes(
   return true;
 }
 
+/** The org config's mcp.actions; none when it can't be read. */
+function mcpActions(): readonly string[] {
+  try {
+    return readMcpConfig().actions;
+  } catch {
+    return [];
+  }
+}
+
+/** A POST body's JSON object (a usage error otherwise). */
+async function jsonBody(
+  req: http.IncomingMessage,
+): Promise<Record<string, unknown>> {
+  const raw = await readBody(req).catch(() => "");
+  if (raw.length > MANY_BODY)
+    throw new AgentError("request too large", { status: 413, usage: true });
+  let v: unknown;
+  try {
+    v = JSON.parse(raw || "{}");
+  } catch {
+    throw new AgentError("invalid JSON", { usage: true });
+  }
+  if (!v || typeof v !== "object" || Array.isArray(v))
+    throw new AgentError("the body must be a JSON object", { usage: true });
+  return v as Record<string, unknown>;
+}
+
+/** A body's list of names (workspaces or agent ids), each checked. */
+function names(v: unknown, key: string): string[] {
+  if (!Array.isArray(v) || !v.length)
+    throw new AgentError(`${key} must be a list of names`, { usage: true });
+  for (const x of v)
+    if (typeof x !== "string" || !NAME_RE.test(x))
+      throw new AgentError(`${key}: "${String(x)}" is not a name`, {
+        usage: true,
+      });
+  return [...new Set(v as string[])];
+}
+
+/**
+ * POST /api/agents/clear-stopped, /restore, /resume-interrupted (AG-14):
+ * a person only. Each is audited, refused or done.
+ */
+async function manyAgents(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+  pathname: string,
+  d: AgentsResolved,
+): Promise<true> {
+  if (req.method !== "POST") return methodNotAllowed(res, "POST");
+  const actor = auditActorOf(req);
+  const verb = pathname.slice("/api/agents/".length);
+  let what = verb;
+  const audit = (reason?: string) =>
+    recordAction(
+      actor,
+      {
+        verb: "agents",
+        detail: what,
+        ...(reason ? { outcome: "refused" as const, reason } : {}),
+      },
+      principalOf(req),
+    );
+  try {
+    guard(actor);
+    const body = await jsonBody(req);
+    if (verb === "restore") {
+      const ids = names(body.agents, "agents");
+      const restored = restoreAgents(d, ids);
+      what = `restore ${restored.join(", ") || "nothing"}`;
+      audit();
+      sendJson(res, { ok: true, restored });
+      return true;
+    }
+    const wss = names(body.workspaces, "workspaces");
+    for (const w of wss)
+      if (!d.workspaceExists(w))
+        throw new AgentError(`workspace "${w}" does not exist`, {
+          status: 404,
+        });
+    if (verb === "clear-stopped") {
+      const removed = await removeStopped(d, wss);
+      what = `clear stopped in ${wss.join(", ")}: ${removed.map((r) => r.agent).join(", ") || "none"}`;
+      audit();
+      sendJson(res, { ok: true, removed });
+      return true;
+    }
+    const r = await resumeInterrupted(d, wss);
+    what = `resume interrupted in ${wss.join(", ")}: ${r.resumed.map((x) => x.rec.id).join(", ") || "none"}`;
+    audit(r.failed.length ? `${r.failed.length} could not resume` : undefined);
+    sendJson(res, {
+      ok: r.failed.length === 0,
+      resumed: r.resumed.map((x) => ({
+        id: x.rec.id,
+        workspace: x.rec.workspace,
+        sessionId: x.info.ref.id,
+      })),
+      failed: r.failed,
+    });
+  } catch (e) {
+    audit(e instanceof Error ? e.message : String(e));
+    sendError(res, e);
+  }
+  return true;
+}
+
 /** `?workspace=<ws>`, when it names a workspace here; else none. */
 function queryWorkspace(
   req: http.IncomingMessage,
@@ -419,3 +609,51 @@ function methodNotAllowed(res: http.ServerResponse, allow: string): true {
   sendJson(res, { ok: false, error: "method not allowed" }, 405);
   return true;
 }
+
+/** How often stopped agents are checked against remove_stopped_after. */
+const PRUNE_EVERY_MS = 60 * 60 * 1000;
+
+/**
+ * What the web server does for agents on its own (AG-14):
+ *   - once, shortly after it starts: marks interrupted the agents whose
+ *     session is gone (Den or the machine went down), and resumes the
+ *     standing personas and those with `resume_on_restart: true`
+ *     (markInterrupted). A session host that outlived a web-server-only
+ *     restart keeps every session: nothing is marked;
+ *   - at start and every hour: forgets stopped and exited agents older
+ *     than user.yml's agents.remove_stopped_after (never by default;
+ *     interrupted ones never).
+ * Nothing here asks for the admin password (LK-0).
+ */
+export function startAgentUpkeep(
+  log: (line: string) => void,
+  deps: AgentRouteDeps & { delayMs?: number } = {},
+): void {
+  const d = webDeps(deps.agents);
+  const restart = async () => {
+    try {
+      const f = await markInterrupted(d);
+      if (f.interrupted.length)
+        log(
+          `Agents interrupted when Den restarted: ${f.interrupted.join(", ")}` +
+            (f.resumed.length ? ` · resumed: ${f.resumed.join(", ")}` : ""),
+        );
+      for (const x of f.failed)
+        log(`  ⚠ agent ${x.agent} did not resume: ${x.why}`);
+    } catch (e) {
+      log(`  ⚠ agents after the restart: ${(e as Error).message}`);
+    }
+  };
+  const prune = async () => {
+    try {
+      const gone = await pruneStopped(d, configuredRemoveStoppedAfter());
+      if (gone.length) log(`Removed stopped agents: ${gone.join(", ")}`);
+    } catch (e) {
+      log(`  ⚠ agents.remove_stopped_after: ${(e as Error).message}`);
+    }
+  };
+  setTimeout(() => {
+    void restart().then(prune);
+  }, deps.delayMs ?? 2000).unref();
+  setInterval(() => void prune(), PRUNE_EVERY_MS).unref();
+}

package/src/ui/server/audit.ts

@@ -3,8 +3,15 @@
  * asked (a person in the UI, or an agent through `<cli> mcp`). Each action
  * becomes a lifecycle line in the server log, the stream the /logs page shows
  * as the web-server log, so agent actions sit beside the UI's own; the
- * structured entries are kept in a small in-memory ring.
+ * structured entries are kept in a small ring.
+ *
+ * den#6: the ring persists. With setAuditFile (the web server's state dir,
+ * audit.jsonl, 0600), each entry is appended as one JSON line and the last
+ * RING_MAX are read back when the server starts, so a restart keeps the
+ * trail. The file is compacted to the ring once it holds twice as many.
+ * Entries hold names and reasons, never an env value or a secret.
  */
+import * as fs from "fs";
 import * as path from "path";
 import {
   actorLabel,
@@ -72,6 +79,65 @@ const RING_MAX = 200;
 const ring: AuditEntry[] = [];
 let sink: Sink | null = null;
 
+/** The persisted ring's file name, in the state dir. */
+export const AUDIT_FILE = "audit.jsonl";
+let file: string | null = null;
+let fileLines = 0;
+
+/**
+ * Persist the ring to `f` (null: memory only). Reads the last RING_MAX
+ * entries back into the ring; a line that isn't an entry is skipped.
+ */
+export function setAuditFile(f: string | null): void {
+  file = f;
+  fileLines = 0;
+  ring.length = 0;
+  if (!f) return;
+  let text = "";
+  try {
+    text = fs.readFileSync(f, "utf-8");
+  } catch (e) {
+    if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
+  }
+  const lines = text.split("\n").filter(Boolean);
+  fileLines = lines.length;
+  for (const l of lines.slice(-RING_MAX)) {
+    try {
+      const e = JSON.parse(l) as AuditEntry;
+      if (e && typeof e.ts === "string" && typeof e.verb === "string")
+        ring.push(e);
+    } catch {
+      /* a torn line */
+    }
+  }
+}
+
+function persist(entry: AuditEntry): void {
+  if (!file) return;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    if (fileLines + 1 > RING_MAX * 2) {
+      // Compact to the ring (which already holds this entry).
+      const tmp = `${file}.${process.pid}.tmp`;
+      fs.writeFileSync(
+        tmp,
+        ring.map((e) => JSON.stringify(e)).join("\n") + "\n",
+        {
+          mode: 0o600,
+        },
+      );
+      fs.renameSync(tmp, file);
+      fileLines = ring.length;
+      return;
+    }
+    fs.appendFileSync(file, JSON.stringify(entry) + "\n", { mode: 0o600 });
+    fs.chmodSync(file, 0o600);
+    fileLines++;
+  } catch {
+    /* the trail stays in memory; the log line still goes out */
+  }
+}
+
 /** Where audit lines go (the server log); null to disconnect. */
 export function setAuditSink(fn: Sink | null): void {
   sink = fn;
@@ -135,6 +201,7 @@ export function recordAction(
   };
   ring.push(entry);
   if (ring.length > RING_MAX) ring.shift();
+  persist(entry);
   const mark = entry.outcome === "refused" ? "✗" : "▶";
   const why = entry.reason ? ` — refused: ${entry.reason}` : "";
   // A refusal whose detail is its reason names what it touched instead.

package/src/ui/server/index.ts

@@ -24,7 +24,7 @@ import * as net from "net";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
-import { execSync, spawn, spawnSync } from "child_process";
+import { execFileSync, spawn, spawnSync } from "child_process";
 import { fileURLToPath } from "url";
 import { envSelector } from "../../shared/environment/env-selector.js";
 import { moduleScanner } from "../../shared/test-discovery/module-scanner.js";
@@ -179,6 +179,8 @@ import {
   recordCrossWorkspace,
   repoAtPath,
   setAuditSink,
+  setAuditFile,
+  AUDIT_FILE,
 } from "./audit.js";
 import { handleReadonlyRoutes } from "./readonly-routes.js";
 import {
@@ -672,6 +674,12 @@ function sendErrorPage(
 setAuditSink((line, actor) =>
   serverLog(line, "lifecycle", actor ? actorLabel(actor) : undefined),
 );
+// den#6: the audit ring outlives a restart (<state dir>/audit.jsonl, 0600).
+try {
+  setAuditFile(path.join(getStateDir(), AUDIT_FILE));
+} catch (e) {
+  console.error(`[server] the audit file could not be read: ${String(e)}`);
+}
 
 /** ANSI helpers (no chalk dependency in the server) */
 const dim = (s: string) => `\x1b[2m${s}\x1b[0m`;
@@ -752,6 +760,7 @@ const CONFIG_FREE_PAGES = new Set(["/settings", "/settings.html", "/logs"]);
 // ── Sudo password store ───────────────────────────────────────────────────────
 import {
   setSudoPassword,
+  realSudoPath,
   clearSudoPassword,
   clearSudoShims,
   closeLockForThisRequest,
@@ -814,7 +823,7 @@ import { parseChangelog } from "./changelog-parser.js";
 import { GitHubService } from "./github-service.js";
 import { EditorManager, SUPPORTED_LANGUAGES } from "./editor-manager.js";
 import { handleWorkspaceRoutes } from "./workspace-routes.js";
-import { handleAgentRoutes } from "./agent-routes.js";
+import { handleAgentRoutes, startAgentUpkeep } from "./agent-routes.js";
 import {
   handleSessionList,
   handleSessionUpgrade,
@@ -4321,7 +4330,7 @@ async function handleRequest(
       // Validate the password before storing it.
       try {
         // -k: ignore cached credentials for this check (don't permanently invalidate)
-        execSync("sudo -k -S -v", {
+        execFileSync(realSudoPath(), ["-k", "-S", "-v"], {
           input: password + "\n",
           stdio: ["pipe", "pipe", "pipe"],
           timeout: CLI_SPAWN_TIMEOUT_MS,
@@ -4379,7 +4388,7 @@ async function handleRequest(
     }
     clearSudoPassword();
     try {
-      execSync("sudo -k", {
+      execFileSync(realSudoPath(), ["-k"], {
         stdio: ["ignore", "ignore", "ignore"],
         timeout: CLI_SPAWN_TIMEOUT_MS,
       });
@@ -4433,7 +4442,7 @@ async function handleRequest(
       return sendJson(res, { ok: false, reason: "not-found" });
     }
     try {
-      execSync("sudo -k -S -v", {
+      execFileSync(realSudoPath(), ["-k", "-S", "-v"], {
         input: password + "\n",
         stdio: ["pipe", "pipe", "pipe"],
         timeout: CLI_SPAWN_TIMEOUT_MS,
@@ -5152,6 +5161,8 @@ try {
 // service's PATH leaves out ~/.local/bin. Until (or unless) it answers, the
 // search is this PATH and the runtimes' install directories.
 void initLoginPath();
+// AG-14: agents interrupted by a restart, and stopped ones to forget.
+startAgentUpkeep((line) => serverLog(line, "lifecycle"));
 server.listen(PORT, BIND_HOST, () => {
   const hosts = fs.existsSync("/etc/hosts")
     ? fs.readFileSync("/etc/hosts", "utf-8")