@lanes-sh/link 0.2.2 → 0.3.0

package/src/cli/commands/operate/inspect.ts

@@ -1,18 +1,9 @@
-import { ownerPrincipal } from '#auth';
-import type { DiscoveredCapability } from '#connectivity';
-import { BROKERED } from '#connectivity/auth/index.ts';
-import { allowedConnections } from '#policy';
-import {
-  credentialRefFor,
-  formatPlan,
-  planIsNoop,
-  planReconcile,
-  toPolicyDocument,
-} from '#registry';
+import { credentialRefFor, formatPlan, planIsNoop, planReconcile } from '#registry';
 import { announce, emit, fail, ok, print, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
-import { capabilityDiff, discoveryProbe } from '../../runtime/discovery.ts';
 import { openRuntime, resolveProfile, type GlobalFlags } from '../../runtime.ts';
+import type { FetchLike } from '#deployments/knowledge.ts';
+import { credentialAge, reportCapabilityDrift } from './findings.ts';
 
 /**
  * The gate order — check, doctor, plan, start — exists so failures surface in
@@ -48,16 +39,18 @@ export async function plan(flags: GlobalFlags): Promise<void> {
 
 export interface DoctorFlags extends GlobalFlags {
   readonly json?: boolean | undefined;
+  /** Injected for tests. A knowledge repository is the only thing doctor fetches. */
+  readonly fetch?: FetchLike | undefined;
 }
 
 /**
  * One thing doctor found: what is wrong, and the command that fixes it.
  *
- * `fix` carries `--profile` while the printed line does not. A person reading
- * the terminal just resolved a profile to get here and their next command
- * resolves the same one; something parsing this JSON has no shell context at
- * all, so leaving it off would hand an agent a command that acts on whichever
- * profile happens to be the default.
+ * `fix` carries both flags. That used to be an argument about JSON callers —
+ * a person reading the terminal had just resolved a profile and their next
+ * command would resolve the same one, while a parser had no shell context. The
+ * argument is moot now: nothing resolves on its own (ADR-037), so a command
+ * without them refuses whoever runs it. What survives is the shape.
  */
 export interface DoctorFinding {
   readonly kind: string;
@@ -68,15 +61,15 @@ export interface DoctorFinding {
 
 /** Read-only external checks: credentials resolve, stores reachable. */
 export async function doctor(flags: DoctorFlags): Promise<void> {
-  const runtime = await openRuntime(flags);
+  const runtime = await openRuntime(flags, { fetch: flags.fetch });
 
   const checks: string[] = [];
   const warnings: DoctorFinding[] = [];
   const problems: DoctorFinding[] = [];
 
   try {
-    const forProfile = (command: string) =>
-      `${command} --profile ${runtime.resolution.profile}`;
+    const forSelection = (command: string) =>
+      `${command} --profile ${runtime.resolution.profile} --target ${runtime.resolution.target}`;
 
     checks.push('config is valid');
     checks.push('state store is reachable');
@@ -90,7 +83,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       warnings.push({
         kind: 'no_profile_token',
         message: 'no profile token yet — lanes link start will mint one, or run: lanes link token rotate',
-        fix: forProfile('lanes link token rotate'),
+        fix: forSelection('lanes link token rotate'),
       });
     }
 
@@ -120,7 +113,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
             message:
               `${key} credential is ${staleness.days} days old — a Google app in "Testing" expires at 7. ` +
               `Run: lanes link connect ${key}`,
-            fix: forProfile(`lanes link connect ${key}`),
+            fix: forSelection(`lanes link connect ${key}`),
           });
         } else {
           const age = staleness
@@ -133,7 +126,45 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
           kind: 'missing_credential',
           key,
           message: `${key} has no stored credential — run: lanes link connect ${key}`,
-          fix: forProfile(`lanes link connect ${key}`),
+          fix: forSelection(`lanes link connect ${key}`),
+        });
+      }
+    }
+
+    // A repository this profile stores memory and skills in is an external
+    // dependency the other checks here do not cover, and it fails in the way
+    // doctor exists for: a token expires, and memory stops working with nothing
+    // said until the next read. One request answers all of it.
+    if (runtime.knowledge) {
+      try {
+        const facts = await runtime.knowledge.repository.facts();
+
+        if (!facts.canPush) {
+          problems.push({
+            kind: 'knowledge_read_only',
+            key: facts.fullName,
+            message:
+              `memory and skills are kept in ${facts.fullName}, and the token can no longer write ` +
+              'to it — writes will fail. Regenerate it with Contents: read and write, then run: ' +
+              'lanes link knowledge use github --repo ' + facts.fullName + ' --replace',
+            fix: forSelection(`lanes link knowledge use github --repo ${facts.fullName} --replace`),
+          });
+        } else if (!facts.private) {
+          warnings.push({
+            kind: 'knowledge_public',
+            key: facts.fullName,
+            message: `${facts.fullName} is public — every memory entry and skill in it is world-readable`,
+          });
+        } else {
+          checks.push(`memory and skills reachable in ${facts.fullName}`);
+        }
+      } catch (error) {
+        problems.push({
+          kind: 'knowledge_unreachable',
+          key: runtime.knowledge.describe,
+          message:
+            `memory and skills are kept in ${runtime.knowledge.describe}, which could not be ` +
+            `reached: ${(error as Error).message}`,
         });
       }
     }
@@ -174,7 +205,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
         message:
           `this profile ${hasSetupRow ? 'does not grant "setup.*"' : 'has no "setup" connection'}` +
           ', so an agent cannot see what is configured — run: lanes link connect setup',
-        fix: forProfile('lanes link connect setup'),
+        fix: forSelection('lanes link connect setup'),
       });
     }
 
@@ -205,7 +236,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       warnings.push({
         kind: 'reconcile_drift',
         message: 'runtime state differs from config — run: lanes link plan',
-        fix: forProfile('lanes link plan'),
+        fix: forSelection('lanes link plan'),
       });
     }
 
@@ -227,136 +258,3 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
     await runtime.close();
   }
 }
-
-/**
- * How old a stored OAuth credential is.
- *
- * Derived from the `expires_at` the OAuth provider stamps when saving tokens.
- * Returns null for anything that is not a token blob — an app password has no
- * meaningful age, and guessing one would produce a confusing warning.
- */
-async function credentialAge(
-  credentials: { get(ref: string): Promise<string | null> },
-  ref: string,
-): Promise<{ days: number; brokered: boolean } | null> {
-  const raw = await credentials.get(ref);
-  if (!raw) return null;
-
-  try {
-    const parsed = JSON.parse(raw) as {
-      expires_at?: number;
-      expires_in?: number;
-      authorized_via?: string;
-    };
-    if (typeof parsed.expires_at !== 'number') return null;
-
-    const issued = parsed.expires_at - (parsed.expires_in ?? 3600) * 1000;
-    return {
-      days: Math.floor((Date.now() - issued) / 86_400_000),
-      brokered: parsed.authorized_via === BROKERED,
-    };
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Capabilities the upstream has grown since you connected.
- *
- * This is what replaced pinning an allow line per tool. `connect` writes
- * `provider.*`, which is readable and which a vendor can quietly widen by
- * shipping a new tool — so the widening has to be *visible* somewhere, and
- * doctor is where you look when you want to know what changed.
- *
- * Compared against the discovery cache rather than against config, because the
- * cache is what the running server actually serves. Failures are reported and
- * skipped: an upstream being down is not a reason for doctor to fail, and it is
- * already obvious from every other check.
- *
- * This used to open `if (kind !== 'mcp') continue`, which meant it watched the
- * one connector kind whose capabilities this repository does not ship and
- * ignored the two it does. Drive gained three operations in a commit and the
- * endpoint served six for as long as the operator did not re-authorise; the
- * check written to make exactly that visible never ran. `http` is no longer
- * listed here because it no longer can drift — `runtime/discovery.ts` re-derives
- * it at startup — so what is left is the kinds that genuinely still cache.
- */
-async function reportCapabilityDrift(
-  runtime: Awaited<ReturnType<typeof openRuntime>>,
-  say: (message: string) => void,
-): Promise<void> {
-  const policy = toPolicyDocument(runtime.config);
-  const principal = ownerPrincipal(runtime.config.instance.profile).id;
-
-  for (const entry of runtime.registry.list()) {
-    const connection = runtime.config.connections.find((c) => c.provider === entry.manifest.id);
-    if (!connection) continue;
-
-    const connector = runtime.connectorFor(entry.manifest.id, connection.id);
-    const probe = discoveryProbe(entry.manifest, connector);
-    // Re-derived every startup, so what is served is what is shipped. Probing
-    // it here would only ever compare a value against itself.
-    if (!probe || probe.cost === 'offline') continue;
-
-    const cached = runtime.registry.discovered(entry.manifest.id) ?? [];
-
-    let live: readonly DiscoveredCapability[];
-    try {
-      live = await probe.run();
-    } catch {
-      continue;
-    }
-
-    // A provider that was never discovered serves nothing at all, which reads
-    // from the outside like the provider being broken. Skipping it silently is
-    // how that stays a mystery.
-    if (cached.length === 0) {
-      say(
-        `${entry.manifest.name} has never been discovered, so none of its ${live.length} ` +
-          `capability(ies) are served — run: lanes link connect ${entry.manifest.id}`,
-      );
-      continue;
-    }
-
-    const diff = capabilityDiff(cached, live);
-
-    if (diff.added.length > 0) {
-      // Through the same `allowedConnections` the dispatcher enforces with,
-      // rather than reading `policy.allow` directly. The predicate this replaced
-      // ignored its own `name` argument, so the answer was all-or-nothing, and
-      // it never consulted `deny` — telling an operator their policy covered a
-      // capability they had explicitly withheld.
-      const reachable = diff.added.filter(
-        (name) =>
-          allowedConnections(
-            `${entry.manifest.id}.${name}`,
-            [`${entry.manifest.id}.${connection.id}`],
-            principal,
-            policy,
-          ).length > 0,
-      );
-
-      say(
-        `${entry.manifest.name} has ${diff.added.length} new capability(ies) since you connected: ` +
-          `${diff.added.slice(0, 5).join(', ')}${diff.added.length > 5 ? ', …' : ''}` +
-          (reachable.length > 0
-            ? `\n      Your policy covers ${reachable.length} of them — lanes link policy deny ${entry.manifest.id}.<name> to withhold one.`
-            : ''),
-      );
-    }
-
-    if (diff.removed.length > 0) {
-      say(`${entry.manifest.name} no longer offers: ${diff.removed.slice(0, 5).join(', ')}`);
-    }
-
-    // The case ADR-017 said `plan` structurally could not report: a schema or a
-    // description moved, the name did not, and the endpoint is serving the old
-    // shape until it restarts.
-    if (diff.changed.length > 0) {
-      say(
-        `${entry.manifest.name} changed the shape of: ${diff.changed.slice(0, 5).join(', ')}` +
-          `\n      Run: lanes link connect ${entry.manifest.id}, then restart the endpoint.`,
-      );
-    }
-  }
-}

package/src/cli/commands/operate/outputs.ts

@@ -1,4 +1,5 @@
 import { listProfiles } from '#profile';
+import { unservableProfiles } from '#deployments/servable.ts';
 import { fileURLToPath } from 'node:url';
 import { deployedUrl, endpointHealth, localUrl } from '../../endpoint-url.ts';
 import { announce, heading, print, style, warn } from '../../output.ts';
@@ -36,11 +37,14 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
     const live = await endpointHealth(url, token);
     const mine = live?.profile === runtime.resolution.profile;
 
-    // Live if it is up, otherwise what `start` would serve: the whole
-    // workspace, since `--only` is the exception rather than the default.
+    // Live if it is up, otherwise what `start` would serve — which is every
+    // profile in the workspace *that declares this target*, not every profile
+    // full stop. `start` opens them all against one target and skips the ones
+    // that cannot run on it, so listing those here would promise a reach the
+    // endpoint will not have.
     const profiles = mine
       ? live.profiles
-      : await listProfiles(runtime.resolution.workspaceRoot);
+      : await servable(runtime.resolution.workspaceRoot, runtime.target);
 
     if (flags.json) {
       print(
@@ -99,7 +103,11 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
     );
     print('');
 
-    const invocation = await tokenInvocation(runtime.config.auth.token_ref, token, flags.profile);
+    const invocation = await tokenInvocation(
+      token,
+      runtime.resolution.profile,
+      runtime.resolution.target,
+    );
 
     print(
       `  claude mcp add --transport http lanes-link ${url} \\\n` +
@@ -130,6 +138,18 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
   }
 }
 
+/** The profiles a `start` on this target would actually open. */
+async function servable(workspaceRoot: string, target: string): Promise<string[]> {
+  const all = await listProfiles(workspaceRoot);
+  const cannot = new Set(
+    (await unservableProfiles({ workspaceRoot, profile: undefined, target })).map(
+      (one) => one.profile,
+    ),
+  );
+
+  return all.filter((name) => !cannot.has(name));
+}
+
 /**
  * The command that prints this endpoint's token, verified to actually work.
  *
@@ -140,18 +160,25 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
  * checking it returns *this* token; otherwise the printed command names this
  * checkout, which always works.
  */
-async function tokenInvocation(
-  tokenRef: string,
+export async function tokenInvocation(
   expected: string,
-  profile: string | undefined,
+  profile: string,
+  target: string,
 ): Promise<{ command: string; onPath: boolean }> {
-  const suffix = profile ? ` --profile ${profile}` : '';
-  const short = `lanes link token show --raw${suffix}`;
+  // Both, always, and from the *resolved* selection rather than the flags. A
+  // token is per-target, so `outputs --target cloud` printing a bare
+  // `token show --raw` hands over the local one beside a deployed URL — a
+  // credential that looks like an answer and fails as a wrong password. Naming
+  // the profile as well makes the line pasteable into any shell rather than
+  // only into one where the same default happens to resolve.
+  const selection = ` --profile ${profile} --target ${target}`;
+  const short = `lanes link token show --raw${selection}`;
+  const argv = ['link', 'token', 'show', '--raw', '--profile', profile, '--target', target];
 
   const resolved = Bun.which('lanes');
   if (resolved) {
     try {
-      const result = Bun.spawnSync([resolved, 'link', 'token', 'show', '--raw', ...(profile ? ['--profile', profile] : [])]);
+      const result = Bun.spawnSync([resolved, ...argv]);
       // Compared against the token rather than merely checking it exited zero:
       // a `lanes` on PATH could belong to a different workspace entirely,
       // and would hand the harness a token this endpoint rejects.
@@ -168,6 +195,6 @@ async function tokenInvocation(
   // which is the empty-token failure this whole function exists to avoid,
   // reintroduced by the fallback meant to prevent it.
   const entry = fileURLToPath(new URL('../../lanes.ts', import.meta.url));
-  return { command: `bun run ${entry} link token show --raw${suffix}`, onPath: false };
+  return { command: `bun run ${entry} link token show --raw${selection}`, onPath: false };
 }
 

package/src/cli/commands/operate/serve.ts

@@ -24,6 +24,9 @@ export async function start(
     port: flags.port,
     only: flags.only,
     mintToken: true,
+    // Local, so there is a browser and a person at it. `container.ts` does not
+    // pass this — see `#server/dashboard.ts`.
+    dashboard: true,
     // Stderr, not stdout: `--json` and `--raw` callers parse the other stream.
     // A refused credential is the event worth seeing while this runs in the
     // foreground, and until now nothing printed it.

package/src/cli/commands/operate/token.ts

@@ -63,7 +63,7 @@ export async function tokenRotate(
     // than the command, so nothing re-reads this on its own.
     print(warn('every agent configured with the old token must be re-registered'));
     print(style.dim('  A harness stores the token it was given, not the command that produced it.'));
-    print(style.dim('  Run: lanes link outputs   for the command to re-run.'));
+    print(style.dim('  Run: lanes link outputs with this profile and target for the command to re-run.'));
   } finally {
     await runtime.close();
   }

package/src/cli/commands/operate.ts

@@ -8,6 +8,7 @@
  *   inspect.ts   check, plan, doctor — the gate order, cheapest failure first
  *   status.ts    connections, reachable capabilities, endpoint
  *   outputs.ts   what an agent harness needs, and proving the short form works
+ *   dashboard.ts opening the page a local endpoint serves, with the key it needs
  *   serve.ts     start
  *   audit.ts     audit tail and verify, and the Markdown rendering of tail
  *   token.ts     token show, token rotate
@@ -22,6 +23,7 @@ export { status } from './operate/status.ts';
 export { outputs, type OutputsFlags } from './operate/outputs.ts';
 export { tools, type ToolsFlags } from './operate/tools.ts';
 export { start } from './operate/serve.ts';
+export { dashboard, type DashboardFlags } from './operate/dashboard.ts';
 export { auditTail, auditVerify, markdownCell } from './operate/audit.ts';
 export { attachFile } from './operate/attach.ts';
 export { tokenRotate, tokenShow } from './operate/token.ts';

package/src/cli/commands/profile/declare.ts

@@ -0,0 +1,154 @@
+import { listProfiles, loadProfileConfig, ConfigError, type TargetConfig } from '#profile';
+import { ask, isInteractive } from '../../prompt.ts';
+import { print, style } from '../../output.ts';
+
+/**
+ * The targets a new profile declares, and where their values come from.
+ *
+ * `profile add` used to emit exactly one target — `local`, hard-coded in the
+ * template — while accepting a `--target` it dropped on the floor. So the
+ * command that creates a profile could not create the thing a profile is mostly
+ * *for*: somewhere to run.
+ *
+ * A `local` target is derivable and never asked about: a path under the
+ * workspace, an encrypted file beside it. Anything else names a cloud account,
+ * and this is the one place in the CLI where guessing those is actively harmful.
+ * `deploy`'s survey proposes a *fresh* project id (`lanes-link-<random>`),
+ * which is right for a first deploy and exactly wrong here — pressing return
+ * would build a second, separate deployment rather than adding this profile to
+ * the one the operator already has. So the defaults come from a sibling profile
+ * that already declares the same target name, and the service name is the only
+ * one derived, because that is the one field that has to differ per profile.
+ */
+
+export interface DeclaredTarget {
+  readonly name: string;
+  /** Rendered YAML, indented two spaces, ready to sit under `targets:`. */
+  readonly block: string;
+  /** Which profile the values were taken from, when they were taken from one. */
+  readonly from?: string;
+}
+
+/** The `local` target, which is the same shape in every profile. */
+export function localBlock(profile: string, name = 'local'): string {
+  return (
+    `  ${name}:\n` +
+    `    credentials: { adapter: file, path: ./data/${profile}/credentials.enc }\n` +
+    `    storage: { adapter: filesystem, path: ./data/${profile} }\n`
+  );
+}
+
+/**
+ * A sibling profile's declaration of the same target name, if there is one.
+ *
+ * The first match wins rather than the operator being asked which — two
+ * profiles declaring `cloud` against different projects is possible and rare,
+ * and the values are shown and editable at the prompt either way.
+ */
+export async function siblingTarget(
+  workspaceRoot: string,
+  target: string,
+  exclude: string,
+): Promise<{ profile: string; declared: TargetConfig } | null> {
+  for (const name of await listProfiles(workspaceRoot)) {
+    if (name === exclude) continue;
+
+    try {
+      const { config } = await loadProfileConfig(workspaceRoot, name);
+      const declared = config.targets[target];
+      if (declared) return { profile: name, declared };
+    } catch {
+      // A profile that will not parse is not a source of defaults, and saying
+      // so here would report a broken sibling as a problem with this command.
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Ask for what a non-local target needs, pre-filled from a sibling.
+ *
+ * Refuses rather than inventing when there is nobody to ask and nothing to copy
+ * — the same bargain `connect --non-interactive` makes. A profile written with
+ * a guessed project id parses, deploys, and points at the wrong account.
+ */
+export async function askTarget(input: {
+  readonly target: string;
+  readonly profile: string;
+  readonly sibling: { profile: string; declared: TargetConfig } | null;
+  readonly nonInteractive?: boolean;
+}): Promise<DeclaredTarget> {
+  const { target, profile, sibling } = input;
+
+  if (!sibling) {
+    throw new ConfigError(
+      `No profile in this workspace declares a target called "${target}", so there is\n` +
+        'nothing to copy its adapters from.\n' +
+        `  lanes link profile add ${profile} --target local\n` +
+        `  lanes link deploy --profile ${profile} --target ${target}\n` +
+        '  The deploy surveys for what it does not know and writes the block.',
+    );
+  }
+
+  const declared = sibling.declared;
+  const project = declared.credentials.project ?? '';
+  const bucket = declared.storage.bucket ?? '';
+
+  // The one field that must differ: two profiles served by one project need two
+  // services, which is what makes them separately deployable.
+  const service = `lanes-link-${profile}-mcp`;
+
+  if (input.nonInteractive === true || !isInteractive()) {
+    return {
+      name: target,
+      block: cloudBlock({ target, project, bucket, service, declared }),
+      from: sibling.profile,
+    };
+  }
+
+  print(style.dim(`  ${target} — defaults from profile "${sibling.profile}"`));
+
+  const answeredProject = (await ask(`  Cloud project [${project}]: `)) || project;
+  const answeredBucket = (await ask(`  Bucket [${bucket}]: `)) || bucket;
+  const answeredService = (await ask(`  Service [${service}]: `)) || service;
+
+  return {
+    name: target,
+    block: cloudBlock({
+      target,
+      project: answeredProject,
+      bucket: answeredBucket,
+      service: answeredService,
+      declared,
+    }),
+    from: sibling.profile,
+  };
+}
+
+/** One target's YAML, carrying over the adapters the sibling chose. */
+function cloudBlock(input: {
+  target: string;
+  project: string;
+  bucket: string;
+  service: string;
+  declared: TargetConfig;
+}): string {
+  const { declared } = input;
+  const deploy = declared.deploy;
+
+  return (
+    `  ${input.target}:\n` +
+    `    credentials: { adapter: ${declared.credentials.adapter}, project: ${input.project} }\n` +
+    `    storage: { adapter: ${declared.storage.adapter}, bucket: ${input.bucket} }\n` +
+    `    vault: { adapter: ${declared.vault?.adapter ?? 'secret'} }\n` +
+    (deploy
+      ? `    deploy:\n` +
+        `      platform: ${deploy.platform}\n` +
+        `      project: ${input.project}\n` +
+        `      region: ${deploy.region}\n` +
+        `      service: ${input.service}\n` +
+        `      access: ${deploy.access}\n`
+      : '')
+  );
+}

package/src/cli/commands/profile/removal.ts

@@ -119,6 +119,23 @@ export async function removalPlan(
       continue;
     }
 
+    // A repository this profile keeps memory and skills in is not this
+    // command's to empty, and it is not reachable from here either: the routing
+    // that points memory at a repository is applied by `openRuntime`, and this
+    // plan is built on `openBlobStoreFor`, which opens the target's own declared
+    // storage. That is the right answer — deleting a profile must not delete
+    // somebody's repository — and it is a surprising one, because
+    // `rm -r data/<profile>` used to be the whole of "what could this profile
+    // reach". So it is said before the operator confirms rather than discovered
+    // afterwards.
+    if (declared.knowledge) {
+      warnings.push(
+        `Target "${name}" keeps this profile's memory and skills in ${declared.knowledge.repo}. ` +
+          'Nothing here touches a repository, so they survive this removal — delete them there ' +
+          'if you want them gone.',
+      );
+    }
+
     // Secrets first, and this ordering is load-bearing rather than tidy:
     // `layout.credentials(p)` is `data/<p>/credentials.enc`, *inside* the blob
     // root `data/<p>`. For the file adapter the credential store is itself a