@lanes-sh/link 0.3.1 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "A self-hostable MCP gateway for all your connections, memory, skills, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/deployments/sync-apply.ts

@@ -8,7 +8,7 @@ import {
   type Config,
 } from '#profile';
 import { ConfigDocument } from '#cli/config-edit.ts';
-import { diffConfigs, keyedArrayFor, type Change } from './sync.ts';
+import { diffConfigs, keyOfElement, keyedArrayFor, type Change } from './sync.ts';
 import { isWorkspaceConfig } from './upload.ts';
 
 /**
@@ -155,28 +155,82 @@ export async function applyPulls(
   const remote = await readRawProfile(remoteRoot, profile);
   if (remote === undefined) return 0;
 
+  const local = document.toJSON();
   const written = new Set<string>();
+
   for (const change of pulls) {
     const array = keyedArrayFor(change.path);
-    const path = array ?? change.path;
 
-    // One write per array, however many of its elements were missing.
-    const key = path.join('.');
-    if (written.has(key)) continue;
-    written.add(key);
+    if (array) {
+      // One write per array, however many of its elements were missing — and
+      // the value written is the *merge*, never the remote array.
+      //
+      // It used to be `setIn(array, remoteArray)`, which reads as "pull the
+      // connections" and means "replace the connections". A profile that had
+      // gained six accounts locally since the last deploy lost all six to a
+      // command whose entire purpose is not losing things. The tests missed it
+      // because every one of them had a local array that was a subset of the
+      // remote — the case where replacing and merging agree.
+      const key = array.join('.');
+      if (written.has(key)) continue;
+      written.add(key);
+
+      const merged = mergeKeyed(
+        array,
+        valueAt(local, array),
+        valueAt(remote, array),
+        pulls
+          .filter((one) => keyedArrayFor(one.path)?.join('.') === key)
+          .map((one) => one.path[array.length])
+          .filter((name): name is string => name !== undefined),
+      );
+      if (merged !== undefined) document.setIn([...array], merged);
+      continue;
+    }
 
-    const value = valueAt(remote, path);
+    const value = valueAt(remote, change.path);
     // Absent from the raw document means the remote side only has it as a
     // default, which the local side fills in identically. Nothing to write.
     if (value === undefined) continue;
 
-    document.setIn([...path], value);
+    document.setIn([...change.path], value);
   }
 
   await document.save();
   return written.size;
 }
 
+/**
+ * The local array, with the named elements taken from the remote one.
+ *
+ * Element order is local's, with anything new appended, so a pull reads as a
+ * diff in the file rather than as a reshuffle. An element named in `wanted` and
+ * absent from the remote array is skipped rather than removed: the diff said it
+ * was missing locally, so it cannot also be missing remotely.
+ */
+function mergeKeyed(
+  arrayPath: readonly string[],
+  local: unknown,
+  remote: unknown,
+  wanted: readonly string[],
+): unknown[] | undefined {
+  if (!Array.isArray(remote)) return undefined;
+
+  const merged = Array.isArray(local) ? [...(local as unknown[])] : [];
+  const keyOf = (item: unknown): string | undefined => keyOfElement(arrayPath, item);
+
+  for (const name of new Set(wanted)) {
+    const incoming = remote.find((item) => keyOf(item) === name);
+    if (incoming === undefined) continue;
+
+    const at = merged.findIndex((item) => keyOf(item) === name);
+    if (at >= 0) merged[at] = incoming;
+    else merged.push(incoming);
+  }
+
+  return merged;
+}
+
 /** Read a path out of the raw document, for handing to `setIn`. */
 function valueAt(config: unknown, path: readonly string[]): unknown {
   let value: unknown = config;

package/src/deployments/sync.ts

@@ -41,12 +41,23 @@ export interface Change {
  * first entry of a kind is the one to reach for — so it is an ordered list and
  * compares as one.
  */
-const KEYED: Record<string, (item: Record<string, unknown>) => string> = {
-  connections: (item) => `${String(item['provider'])}.${String(item['id'])}`,
-  'policy.allow': (item) => String(item['capability']),
-  'policy.deny': (item) => String(item['capability']),
+const KEYED: Record<string, (item: unknown) => string | undefined> = {
+  connections: (item) =>
+    isRecord(item) ? `${String(item['provider'])}.${String(item['id'])}` : undefined,
+  // Two shapes, and both are reached. The diff runs over validated configs,
+  // where `allow: [gmail.*]` has become `[{capability: gmail.*}]`; the writer
+  // runs over the raw document, where it is still a string. A key function that
+  // knew only the validated shape found nothing to merge and silently wrote the
+  // array without it.
+  'policy.allow': capabilityOf,
+  'policy.deny': capabilityOf,
 };
 
+function capabilityOf(item: unknown): string | undefined {
+  if (typeof item === 'string') return item;
+  return isRecord(item) ? String(item['capability']) : undefined;
+}
+
 const isRecord = (value: unknown): value is Record<string, unknown> =>
   typeof value === 'object' && value !== null && !Array.isArray(value);
 
@@ -102,12 +113,16 @@ function walk(path: readonly string[], local: unknown, remote: unknown): Change[
  */
 function walkKeyed(
   path: readonly string[],
-  keyOf: (item: Record<string, unknown>) => string,
+  keyOf: (item: unknown) => string | undefined,
   local: readonly unknown[],
   remote: readonly unknown[],
 ): Change[] {
   const index = (items: readonly unknown[]): Map<string, unknown> =>
-    new Map(items.filter(isRecord).map((item) => [keyOf(item), item]));
+    new Map(
+      items
+        .map((item) => [keyOf(item), item] as const)
+        .filter((pair): pair is readonly [string, unknown] => pair[0] !== undefined),
+    );
 
   const here = index(local);
   const there = index(remote);
@@ -130,6 +145,19 @@ export function keyedArrayFor(path: readonly string[]): readonly string[] | unde
   return undefined;
 }
 
+/**
+ * How an element of a keyed array identifies itself, for the writer.
+ *
+ * The diff indexes these to compare them; applying one has to find the same
+ * element again in *both* raw documents, and it cannot re-derive the key from
+ * the path — `connections.gmail.work` is one key containing a dot, not two
+ * steps. Exported so the two halves cannot disagree about what identifies a
+ * connection.
+ */
+export function keyOfElement(arrayPath: readonly string[], item: unknown): string | undefined {
+  return KEYED[arrayPath.join('.')]?.(item);
+}
+
 /** Whether a set of changes can be applied without being told which side wins. */
 export function conflictsIn(changes: readonly Change[]): Change[] {
   return changes.filter((change) => change.direction === 'conflict');